trackly-cli 0.22.1 → 0.22.2

package/lib/agent.js

@@ -8,7 +8,7 @@ const { spawnSync } = require('node:child_process');
 const { apiRequest, downloadFile, getConfigPaths, hasAuth, maintenanceOutput } = require('./client');
 const { version: PACKAGE_VERSION } = require('../package.json');
 const { contractVersion: MCP_CONTRACT_VERSION } = require('../contracts/trackly-apply-tools.json');
-const SKILL_VERSION = '4.9.1';
+const SKILL_VERSION = '4.9.2';
 const SKILL_POLICY_REVISION = SKILL_VERSION;
 const CLI_USER_AGENT = `trackly-cli/${PACKAGE_VERSION}`;
 const MCP_USER_AGENT = `trackly-mcp/${PACKAGE_VERSION}`;

package/mcp/apply-tools.js

@@ -440,14 +440,15 @@ const applyExecutionSchema = z.object({
   currentWave: executionWaveSchema.nullable(),
   unresolvedWaves: z.array(executionWaveSchema).max(APPLY_EXECUTION_MAX_TARGET),
 }).strict();
-const getExecutionAccessReviewResponseSchema = z.object({
+const getExecutionAccessReviewResponseObjectSchema = z.object({
   success: z.literal(true),
   execution: applyExecutionSchema,
   progress: executionProgressSchema,
   proposedWave: z.array(proposedWaveMemberSchema).max(APPLY_EXECUTION_MAX_TARGET),
   accessProposal: accessProposalSchema,
-}).strict().superRefine(validateMatchingProposal);
-const activeExecutionAccessReviewResponseSchema = getExecutionAccessReviewResponseSchema.innerType().extend({
+}).strict();
+const getExecutionAccessReviewResponseSchema = getExecutionAccessReviewResponseObjectSchema.superRefine(validateMatchingProposal);
+const activeExecutionAccessReviewResponseSchema = getExecutionAccessReviewResponseObjectSchema.extend({
   enabled: z.boolean().optional(),
   active: z.boolean().optional(),
   preserved: z.boolean().optional(),

package/mcp/server.js

@@ -448,7 +448,7 @@ function createServer() {
     'trackly_update_experience_limits',
     'Atomically replace the complete role-specific experience-limit map. Each value is the highest stated minimum years requirement the user wants for that job function. When Trackly enforcement is active, a job is included when its stated minimum is less than or equal to the limit. Jobs with no stated minimum remain visible. An empty object clears the saved limits. experienceFilterV2Available reports edit capability, not enforcement state. Read discoveryPreferenceRevision with trackly_get_preferences first. If the backend returns a revision conflict, refetch and reconcile with the user; never retry blindly with the newer revision.',
     {
-      experienceLimitsByJobFunction: z.record(z.enum(JOB_FUNCTIONS), z.number().int().min(0).max(60)).describe(
+      experienceLimitsByJobFunction: z.partialRecord(z.enum(JOB_FUNCTIONS), z.number().int().min(0).max(60)).describe(
         'Complete replacement map from canonical job-function slug to maximum acceptable stated minimum years. Use {} to turn role-specific experience filtering off.'
       ),
       expectedPreferenceRevision: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).describe(

package/npm-shrinkwrap.json

@@ -1,21 +1,21 @@
 {
   "name": "trackly-cli",
-  "version": "0.22.1",
+  "version": "0.22.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trackly-cli",
-      "version": "0.22.1",
+      "version": "0.22.2",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.32.1",
         "@posthog/mcp": "0.11.0",
-        "fast-uri": "3.1.8",
-        "hono": "4.13.7",
-        "ip-address": "10.7.3",
+        "fast-uri": "3.1.9",
+        "hono": "4.13.11",
+        "ip-address": "10.7.4",
         "posthog-node": "5.48.1",
-        "zod": "^3.23.0"
+        "zod": "4.6.7"
       },
       "bin": {
         "trackly": "bin/trackly"
@@ -812,18 +812,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -836,9 +836,9 @@
       }
     },
     "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1156,9 +1156,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
-      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
+      "version": "3.1.9",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
+      "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
       "funding": [
         {
           "type": "github",
@@ -1293,9 +1293,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.7",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
-      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
+      "version": "4.13.11",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.11.tgz",
+      "integrity": "sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -1322,9 +1322,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -1344,9 +1344,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.7.3",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz",
-      "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==",
+      "version": "10.7.4",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.4.tgz",
+      "integrity": "sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -1598,9 +1598,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
@@ -2008,9 +2008,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.22.1",
+  "version": "0.22.2",
   "mcpName": "io.github.trackly-app/trackly",
   "description": "Search 250K+ jobs across 5,400+ companies with the Trackly CLI and MCP server for Claude, ChatGPT, Codex and Cursor. Filter by role, location, salary and sponsorship; track jobs and prepare applications.",
   "bin": {
@@ -72,20 +72,21 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.32.1",
     "@posthog/mcp": "0.11.0",
-    "fast-uri": "3.1.8",
-    "hono": "4.13.7",
-    "ip-address": "10.7.3",
+    "fast-uri": "3.1.9",
+    "hono": "4.13.11",
+    "ip-address": "10.7.4",
     "posthog-node": "5.48.1",
-    "zod": "^3.23.0"
+    "zod": "4.6.7"
   },
   "engines": {
     "node": "^20.20.0 || >=22.22.0"
   },
   "overrides": {
     "@hono/node-server": "2.0.12",
-    "fast-uri": "3.1.8",
-    "ip-address": "10.7.3",
-    "qs": "6.16.0"
+    "fast-uri": "3.1.9",
+    "ip-address": "10.7.4",
+    "qs": "6.16.1",
+    "body-parser": "2.4.0"
   },
   "devDependencies": {
     "@babel/parser": "7.29.8",

package/scripts/verify-audit-exceptions.js

@@ -12,7 +12,6 @@ const DEFAULT_POLICY_PATH = path.join(
   'security',
   'audit-exceptions.json',
 );
-const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 
 function selectAdvisoryFields(advisory) {
   return {
@@ -112,10 +111,19 @@ function loadPolicy(policyPath = DEFAULT_POLICY_PATH) {
 }
 
 function runAudit() {
-  const result = spawnSync(NPM, ['audit', '--json', '--audit-level=moderate'], {
+  // npm.cmd is not directly executable on Windows. During npm run, invoke
+  // its CLI with Node so paths containing spaces or shell characters stay literal.
+  const npmCli = process.env.npm_execpath;
+  const command = npmCli ? process.execPath
+    : process.platform === 'win32' ? (process.env.ComSpec || 'cmd.exe') : 'npm';
+  const args = npmCli ? [npmCli, 'audit', '--json', '--audit-level=moderate']
+    : process.platform === 'win32' ? ['/d', '/s', '/c', 'npm.cmd audit --json --audit-level=moderate']
+      : ['audit', '--json', '--audit-level=moderate'];
+  const result = spawnSync(command, args, {
     cwd: path.join(__dirname, '..'),
     encoding: 'utf8',
     maxBuffer: 10 * 1024 * 1024,
+    windowsHide: true,
   });
 
   if (result.error) {

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.22.1",
+  "version": "0.22.2",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.22.1",
+      "version": "0.22.2",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {

package/skills/trackly-apply/SKILL.md

@@ -1,15 +1,17 @@
 ---
 name: trackly-apply
-description: Fill the next user-approved jobs from a Trackly apply/check-later queue through a supported ATS in a real browser, using the user’s profile and resume from Trackly, then stop for manual review and submission. Use for requests such as “apply to my queue,” “fill the next application,” or “Trackly apply” in Codex or Claude Code on macOS.
+description: Help users finish Trackly Apply setup and resolve missing profile or resume requirements, then fill user-approved jobs through a supported ATS in a real browser and stop for manual review and submission. Use for requests such as “set up Apply,” “fix my incomplete profile,” “apply to my queue,” or “fill the next application” in Codex or Claude Code on macOS.
 ---
 
 # Trackly Apply
 
 Use Trackly as the source of truth for profile answers, documents, queue decisions, and application state. Use this skill only for reusable browser mechanics; never store personal answers or application logs inside the skill.
 
+Before application work, read [onboarding guidance](references/onboarding.md). Guide the user through only the missing requirements and verify saved answers, the stored default resume, and explicit profile confirmation.
+
 ## Skill version
 
-Skill version: `4.9.1`. Before browser readiness read [references/handoff-compatibility.md](references/handoff-compatibility.md). This policy takes precedence over returned-persistence-receipt or finalizer requirements elsewhere when using the documented markHandoff path. Other review and safety gates remain unchanged.
+Skill version: `4.9.2`. Before browser readiness read [references/handoff-compatibility.md](references/handoff-compatibility.md). This policy takes precedence over returned-persistence-receipt or finalizer requirements elsewhere when using the documented markHandoff path. Other review and safety gates remain unchanged.
 
 ## Non-negotiable rules
 
@@ -39,7 +41,7 @@ value-free phase receipt with `scripts/validate-phase-checkpoint.js` before
 claiming that phase complete.
 Read [references/legal-clarifications.md](references/legal-clarifications.md) when a form asks for a legal, regulatory, consent, or employer-relationship decision.
 
-1. Call `trackly_get_apply_protocol`. Skill 4.9.1 requires protocol 3.7.0 or newer for new reliability work. Protocol 3.2 remains valid only for an already-active explicit legacy single run; an already-active explicit 3.2 single run may finish through its legacy path. Preserve the protocol's documented recovery paths for already-active older work. Require `compatibleSkillMajor: 4` and `compatibleSkillMinimumVersion` no newer than this installed skill. Reject an older or incompatible version for new work and report that the backend must finish updating or `trackly agent setup` must update the skill. Protocol 3.2 added exact-origin trust for jobs Trackly ingested directly from employer careers sources; do not recreate the retired ownership-timestamp gate in the client.
+1. Call `trackly_get_apply_protocol`. Skill 4.9.2 requires protocol 3.7.0 or newer for new reliability work. Protocol 3.2 remains valid only for an already-active explicit legacy single run; an already-active explicit 3.2 single run may finish through its legacy path. Preserve the protocol's documented recovery paths for already-active older work. Require `compatibleSkillMajor: 4` and `compatibleSkillMinimumVersion` no newer than this installed skill. Reject an older or incompatible version for new work and report that the backend must finish updating or `trackly agent setup` must update the skill. Protocol 3.2 added exact-origin trust for jobs Trackly ingested directly from employer careers sources; do not recreate the retired ownership-timestamp gate in the client.
 2. Call `trackly_get_profile_onboarding` or fetch both the profile schema and application profile. When present, render `schema.screens` in ascending `order` as one grouped question packet per screen. Within a screen, preserve category `order` and then field `order`; use each field's user-facing `rationale` when the user asks why it is needed. Ask only unknown or confirmation-needed fields and honor `consistencyRules` before submitting profile changes, resolving contradictions with the user instead of guessing. When `schema.screens` is absent on a legacy backend, fall back to the existing category-based onboarding behavior. Treat `completeness.percent` as required onboarding readiness only. Use `coverage.missingReusableKeys` to explain reusable optional gaps, while `coverage.contextualKeys` are intentionally asked only on the relevant employer form. Do not claim that 100% required completeness answers every possible application question.
 3. Save answers with `trackly_update_application_profile`:
    - Use `answered`, `intentionally_blank`, `declined`, or `unknown` exactly.
@@ -85,7 +87,7 @@ Read [references/legal-clarifications.md](references/legal-clarifications.md) wh
    - For each fixed batch member, preserve an explicit job ID -> application run ID -> browser tab mapping. Complete the full start -> conditional resume preparation/confirmation/verification when an upload control exists -> form completion -> `review_ready` lifecycle for every member. A review-ready run does not block the next member. Never submit any of them.
 6. When the selected job or current fixed batch member has no `runId`, call `trackly_start_apply_run` with the complete `batchId`, `memberId`, `expectedMemberVersion`, `expectedInspectionEpoch`, and `leaseToken` returned by Trackly. This is the sanctioned idempotent lookup for a recovered member whose `runId` is absent; call it with the exact recovered binding and Trackly will reuse the bound active run. When the member already has a `runId`, do not call `trackly_start_apply_run` in this or any subsequent start step: reuse that exact run and bind or recover its browser surface through `trackly_bind_apply_surface` as required. Never create a replacement run because browser control was interrupted.
    - If a bound start returns a transport failure, a non-access HTTP 5xx response, or an error explicitly marked `retryable: true`, preserve the frozen member and browser state. Refetch the active batch, renew its lease, and retry the same complete binding once. Classify the retry response independently with these same rules: route canonical `maintenance_mode` or legacy `planned_maintenance` directly through **Resume after maintenance**; surface controlled-access/request errors marked `retryable: false` and every other HTTP 4xx response unchanged; only a second transport failure, non-access HTTP 5xx response, or explicitly retryable error becomes `backend_run_start_unavailable`. Route maintenance on either attempt without consuming or relabeling the retry, and never relabel a permanent retry response as an outage. For `backend_run_start_unavailable`, continue other members and report a Trackly control-plane failure. Do not call `trackly_checkpoint_apply_batch` for this condition because start failure has not produced the required run ID. The unchanged frozen member is the durable resume point. Never switch that frozen member to an unbound legacy run or blame the employer form.
-   - Require `run.protocolVersion` to be 3.1.0 or newer and to share protocol major 3 with the fetched protocol. A new reliability execution member requires 3.7.0 or newer; already-active older work may use only the recovery path published by its fetched protocol. Never continue a pre-evidence 3.0.x run under skill 4.9.1. Preserve that run instead of starting a replacement, record it `blocked` with a value-free protocol-upgrade reason when possible, and tell the user the saved job can be retried only after the stale run is cleared through Trackly's supported lifecycle. Stop and refetch the protocol and active execution or batch if support level, execution mode, provider, required scenarios, authorized origin policy, member version, or inspection epoch changes after run creation.
+   - Require `run.protocolVersion` to be 3.1.0 or newer and to share protocol major 3 with the fetched protocol. A new reliability execution member requires 3.7.0 or newer; already-active older work may use only the recovery path published by its fetched protocol. Never continue a pre-evidence 3.0.x run under skill 4.9.2. Preserve that run instead of starting a replacement, record it `blocked` with a value-free protocol-upgrade reason when possible, and tell the user the saved job can be retried only after the stale run is cleared through Trackly's supported lifecycle. Stop and refetch the protocol and active execution or batch if support level, execution mode, provider, required scenarios, authorized origin policy, member version, or inspection epoch changes after run creation.
    - In guided mode, inspect the page before preparing any resume bytes. Confirm the employer, role, HTTPS origin, reachable review path, semantic controls, whether an attachment control exists, and absence of a credential, verification, CAPTCHA, or submit-only wall. A missing file input is not itself a blocker; skip the resume path when the application has no attachment control. Any other failed precondition is an execution blocker, not permission to improvise.
 7. Pass the browser readiness gate before preparing resume bytes:
    - Use semantic browser control through Codex in-app browser controls, Chrome MCP/extension browser control, or Claude in Chrome.

package/skills/trackly-apply/references/onboarding.md

@@ -0,0 +1,9 @@
+# Finish Apply setup
+
+Treat setup as a guided conversation. Read the current profile and schema through trackly_get_profile_onboarding or equivalent profile reads. Derive next steps from authoritative completeness and saved states. Explain Apply capability separately from profile completion. Incomplete setup is not a rollout failure, and absent answers or an absent upload do not resolve by waiting.
+
+1. Check availability before interpreting saved state. If profile or schema is unavailable, report the failed check and a concrete next action without asking the user to repeat saved setup.
+2. Explain remaining requirements in the user's language. Ask only canonical questions that remain unknown or need confirmation. Preserve answered, declined and intentionally blank fields. Save only user-confirmed facts and scopes using the current revision, then refetch the profile. Education updates replace the entire saved list. Never send a partial education list. Guide missing education through https://usetrackly.app/profile with the same account to edit only missing fields and preserve existing records, then refetch the profile after they save. Never invent missing facts or claim an unsaved conversational answer was stored.
+3. Treat documents.default_resume as a file requirement. If no stored default resume is available, give https://usetrackly.app/profile and explain how to sign in with the same Trackly account, upload the original resume and select Set Default if needed. A PDF attached to a conversation or permission to use it does not store the file in Trackly. Do not invent an incoming chat-file import operation. After the user confirms the upload, refetch the profile and verify it returns a stored default resume. Employer attachment is a later step.
+4. When requirements are complete but the profile is unconfirmed, ask the user to review and explicitly confirm it. Save confirmProfile: true with the current expectedRevision through trackly_update_application_profile only after confirmation. Refetch the profile and verify confirmedAt is present, a stored default resume exists and no missing requirements remain before continuing.
+5. Name any failed operation and the next concrete action. Avoid repeated polling. Capability disablement, incomplete setup, unavailable checks and a host without a controlled browser are distinct blockers. Profile readiness does not prove browser capability. Never submit an application or infer submission from setup completion.