trackly-cli 0.18.5 → 0.18.6

package/contracts/trackly-apply-contract-history.json

@@ -38,5 +38,14 @@
   },
   "3.8.1": {
     "contractSha256": "49028b8a8e1d75a8db6e54dd91001195f8a2e50b1f0ff6554750bd243dde4c6e"
+  },
+  "3.9.0": {
+    "contractSha256": "1d6afc41df1b72ec6eb340df8c080b7dfac2843e9fd6d9d9795d8de6f413559a"
+  },
+  "3.9.1": {
+    "contractSha256": "26dfb900c2782a5437475c06d2e30c718dee4781daa938bc4fa3b6a03a505323"
+  },
+  "3.9.2": {
+    "contractSha256": "d3a82489330d0b0062a1baec8d226b510628accc434731136dca9951ec64c302"
   }
 }

package/contracts/trackly-apply-tools.json

@@ -1,20 +1,21 @@
 {
-  "contractVersion": "3.8.1",
+  "contractVersion": "3.9.2",
   "constants": {
     "applyExecutionProtocolVersion": "trackly-apply-execution/v3",
     "applyAccessKnowledgeOrderingVersion": 3,
     "applyExecutionMaxTarget": 20,
+    "applyAdapterCodes": ["greenhouse:1","ashby:1","lever:1","workday:1","oracle_hcm:1","successfactors:1","icims:1","phenom:1","eightfold:1","jibe:1","avature:1","smartrecruiters:1","workable:1","bamboohr:1","recruitee:1","jobvite:1","teamtailor:1","comeet:1","rippling:1","gem:1","workatastartup:1","jazzhr:1","breezyhr:1","freshteam:1","personio:1","pinpoint:1","zohorecruit:1","gusto:1","hibob:1","paylocity:1","paycor:1","adp:1","linkedin_easy_apply:1","generic_web_form:1"],
     "applyScenarioCodes": ["browser_reclaim", "resume_upload", "resume_parser_recheck", "semantic_boolean_commit", "custom_select_commit", "multi_step_navigation", "free_text_voice", "required_error_sweep", "final_consent", "handoff_reclaim", "critical_contact_integrity", "manual_submit_boundary", "job_identity_match"],
     "applyBrowserSurfaces": ["codex_in_app", "chrome_extension", "claude_in_chrome"],
-    "applyCheckpointActionCodes": ["answer/unknown", "auth/sign_in", "auth/account_creation", "auth/otp", "captcha/before_form", "captcha/at_submit", "artifact/upload_required", "legal/decision_required", "consent/decision_required", "review/manual_submit", "trust/origin_mismatch", "observability/unverifiable_state"],
-    "applyCheckpointContinuationByAction": {"answer/unknown": true, "auth/sign_in": true, "auth/account_creation": true, "auth/otp": true, "captcha/before_form": true, "captcha/at_submit": false, "artifact/upload_required": true, "legal/decision_required": true, "consent/decision_required": true, "review/manual_submit": false, "trust/origin_mismatch": false, "observability/unverifiable_state": false},
-    "applyCheckpointLifecycleByAction": {"answer/unknown": "needs_input", "auth/sign_in": "needs_input", "auth/account_creation": "needs_input", "auth/otp": "needs_input", "captcha/before_form": "needs_input", "captcha/at_submit": "review_ready", "artifact/upload_required": "needs_input", "legal/decision_required": "needs_input", "consent/decision_required": "needs_input", "review/manual_submit": "review_ready", "trust/origin_mismatch": "blocked", "observability/unverifiable_state": "blocked"},
-    "applyCheckpointQuestionPacketByAction": {"answer/unknown": true, "auth/sign_in": false, "auth/account_creation": false, "auth/otp": false, "captcha/before_form": false, "captcha/at_submit": false, "artifact/upload_required": false, "legal/decision_required": true, "consent/decision_required": true, "review/manual_submit": false, "trust/origin_mismatch": false, "observability/unverifiable_state": false},
+    "applyCheckpointActionCodes": ["answer/unknown", "auth/sign_in", "auth/account_creation", "auth/otp", "captcha/before_form", "captcha/at_submit", "artifact/upload_required", "legal/decision_required", "consent/decision_required", "review/manual_submit", "trust/origin_mismatch", "observability/unverifiable_state", "client/upgrade_required"],
+    "applyCheckpointContinuationByAction": {"answer/unknown": true, "auth/sign_in": true, "auth/account_creation": true, "auth/otp": true, "captcha/before_form": true, "captcha/at_submit": false, "artifact/upload_required": true, "legal/decision_required": true, "consent/decision_required": true, "review/manual_submit": false, "trust/origin_mismatch": false, "observability/unverifiable_state": false, "client/upgrade_required": false},
+    "applyCheckpointLifecycleByAction": {"answer/unknown": "needs_input", "auth/sign_in": "needs_input", "auth/account_creation": "needs_input", "auth/otp": "needs_input", "captcha/before_form": "needs_input", "captcha/at_submit": "review_ready", "artifact/upload_required": "needs_input", "legal/decision_required": "needs_input", "consent/decision_required": "needs_input", "review/manual_submit": "review_ready", "trust/origin_mismatch": "blocked", "observability/unverifiable_state": "blocked", "client/upgrade_required": "blocked"},
+    "applyCheckpointQuestionPacketByAction": {"answer/unknown": true, "auth/sign_in": false, "auth/account_creation": false, "auth/otp": false, "captcha/before_form": false, "captcha/at_submit": false, "artifact/upload_required": false, "legal/decision_required": true, "consent/decision_required": true, "review/manual_submit": false, "trust/origin_mismatch": false, "observability/unverifiable_state": false, "client/upgrade_required": false},
     "applyAccessClassifications": ["accessible", "authentication_required", "account_creation_required", "otp_required", "captcha_before_form", "captcha_at_submit", "manual_only", "unknown_unobservable"],
     "applyExecutionDispositionSources": ["live_probe"],
     "applyProbeCleanupPreferences": ["never", "submitted_only", "submitted_and_probe_blockers"],
     "applyExecutionStopReasonCodes": ["user_requested", "target_changed", "session_ended", "execution_restarted", "operator_stop"],
-    "applyBatchConflictCodes": ["state_changed", "lease_unavailable", "idempotency_key_reused", "fixed_batch_not_found", "execution_child_batch", "fixed_batch_not_active", "fixed_batch_revision_changed", "submission_in_progress", "attestation_dependencies_changed", "legacy_fixed_batch_active", "dedicated_recovery_required", "recovery_migration_not_ready", "access_deferment_limit_reached", "access_deferments_active"],
+    "applyBatchConflictCodes": ["state_changed", "client_upgrade_required", "lease_unavailable", "idempotency_key_reused", "fixed_batch_not_found", "execution_child_batch", "fixed_batch_not_active", "fixed_batch_revision_changed", "submission_in_progress", "attestation_dependencies_changed", "legacy_fixed_batch_active", "dedicated_recovery_required", "recovery_migration_not_ready", "access_deferment_limit_reached", "access_deferments_active"],
     "fixedApplyBatchCancelReasonCodes": ["user_requested_restart"],
     "applyCheckpointPacketPhases": ["first_pass", "delta"],
     "applySurfaceBindingReasons": ["initial_binding", "recovery_binding"],

package/lib/client.js

@@ -6,6 +6,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const { version: PACKAGE_VERSION } = require('../package.json');
+const APPLY_CONTRACT = require('../contracts/trackly-apply-tools.json');
 
 const DEFAULT_CONFIG_DIR = path.join(os.homedir(), '.trackly');
 const DEFAULT_BASE_URL = 'https://closeai.mba';
@@ -712,8 +713,15 @@ function apiRequest(
         ? Object.entries(additionalHeaders)
         : [];
       const idempotencyEntry = entries.find(([name]) => name.toLowerCase() === 'idempotency-key');
+      const startEntry = entries.find(([name]) => name.toLowerCase() === 'x-trackly-apply-start-contract');
+      const validStartHeader = startEntry
+        && method === 'POST'
+        && (endpoint === '/api/jobscout/apply/executions'
+          || endpoint === '/api/jobscout/apply/executions/recover')
+        && startEntry[1] === APPLY_CONTRACT.contractVersion;
       if (
-        entries.length !== 1
+        entries.length !== (startEntry ? 2 : 1)
+        || (startEntry && !validStartHeader)
         || !idempotencyEntry
         || typeof idempotencyEntry[1] !== 'string'
         || !/^[\x20-\x7e]{16,200}$/.test(idempotencyEntry[1])
@@ -722,6 +730,7 @@ function apiRequest(
         return;
       }
       headers['Idempotency-Key'] = idempotencyEntry[1];
+      if (startEntry) headers['X-Trackly-Apply-Start-Contract'] = startEntry[1];
     }
     const authMethod = getAuthMethod();
     const requestedTimeoutMs = Number(requestOptions?.timeoutMs);

package/mcp/apply-tools.js

@@ -810,7 +810,12 @@ function registerApplyTools(
       false,
       false,
       MCP_USER_AGENT,
-      idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : undefined,
+      idempotencyKey ? {
+        'Idempotency-Key': idempotencyKey,
+        ...(method === 'POST' && (path === '/api/jobscout/apply/executions'
+          || path === '/api/jobscout/apply/executions/recover')
+          ? { 'X-Trackly-Apply-Start-Contract': APPLY_CONTRACT.contractVersion } : {}),
+      } : undefined,
     )
   );
   const discoveredRecoverableSources = new Map();
@@ -1976,7 +1981,7 @@ function registerApplyTools(
       role: 'user',
       content: {
         type: 'text',
-        text: 'Protocol 3.7.0 reliability gate for new work: require MCP contract 3.8.1 and skill 4.8.0. Consume the exact proposedWave with frozen accessKnowledge before opening any browser; same-key advance replay returns identical member IDs, order, and rationale. When nextAction is access_review, including ordinary OPEN or neutral proposals, display the exact access-review receipt and do not report exhaustion. For a nonempty proposal, obtain explicit approval for the unchanged ordered job IDs and server approval hash before probing. For an all-deferred or recovery-blocked proposal with zero members, show the deferred count and stable job/company/provider deferment IDs, offer clear-deferment only for explicitly returned IDs, stop, or expiry, and never send an empty approval. Defer or clear only through jobId-scoped job, company, or provider tools; provider scope applies across companies until explicitly cleared. Never submit provider names, URLs, or raw chat. After complete local context loss, list bounded recovery candidates, obtain explicit confirmation of the exact set, and recover only that set. An active personal deferment blocks exact recovery until cleared. Treat tab recovery, form-state recovery, and mutation authority as independent. List active handoff receipts for the execution before resolving grouped submission statements; use the named receipt or the sole returned active receipt, classify every member, and claim that receipt before recording outcomes. Validate tab keep sets and resume upload stages locally. Never send raw browser values or click Submit.',
+        text: `Protocol 3.7.0 reliability gate for new work: require MCP contract ${APPLY_CONTRACT.contractVersion} and skill 4.8.0. Consume the exact proposedWave with frozen accessKnowledge before opening any browser; same-key advance replay returns identical member IDs, order, and rationale. When nextAction is access_review, including ordinary OPEN or neutral proposals, display the exact access-review receipt and do not report exhaustion. For a nonempty proposal, obtain explicit approval for the unchanged ordered job IDs and server approval hash before probing. For an all-deferred or recovery-blocked proposal with zero members, show the deferred count and stable job/company/provider deferment IDs, offer clear-deferment only for explicitly returned IDs, stop, or expiry, and never send an empty approval. Defer or clear only through jobId-scoped job, company, or provider tools; provider scope applies across companies until explicitly cleared. Never submit provider names, URLs, or raw chat. After complete local context loss, list bounded recovery candidates, obtain explicit confirmation of the exact set, and recover only that set. An active personal deferment blocks exact recovery until cleared. Treat tab recovery, form-state recovery, and mutation authority as independent. List active handoff receipts for the execution before resolving grouped submission statements; use the named receipt or the sole returned active receipt, classify every member, and claim that receipt before recording outcomes. Validate tab keep sets and resume upload stages locally. Never send raw browser values or click Submit.`,
       },
     }, {
       role: 'user',

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "trackly-cli",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trackly-cli",
-      "version": "0.18.5",
+      "version": "0.18.6",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.30.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "mcpName": "io.github.trackly-app/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 250K+ jobs, 5,400+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {
@@ -10,6 +10,7 @@
     "test": "node --test",
     "test:contract-fixture": "node --test test/apply-contract.test.js",
     "test:hosted-contract": "node scripts/verify-hosted-contract.js",
+    "test:candidate-contract": "node scripts/verify-candidate-contract.js",
     "test:review-auth-contract": "node scripts/verify-review-auth-contract.js",
     "test:plugin-submission": "node scripts/verify-plugin-submission.js",
     "security:audit": "node scripts/verify-audit-exceptions.js"

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.18.5",
+  "version": "0.18.6",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.18.5",
+      "version": "0.18.6",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {