Rolester Desktop 0.4.0

What's Changed

• ✨ Deep ingest is now a step-by-step wizard matching the onboarding flow — one lane at a time (Material → Evidence → Stories → Honesty → Voice → Role signals → Done), with real draft review instead of raw proposal dumps
• 🐛 "Generate proposals" actually generates now: fixed the strict-JSON schema the AI call needs, routed auto-classification to the right lanes, and raised the output cap that was truncating longer pastes
• 🐛 Onboarding fixes from a full fresh-user QA pass: company seeding no longer fails silently over 12 companies, city fields stop splitting on commas, stray "[object Object]" chips can't be minted, and the resume step footnote is gone
• 🐛 Dashboard poll backs off while a fresh install has no database yet
• 🚀 Desktop shell 0.4.0, signed and notarized

Full Changelog: desktop-v0.3.0...desktop-v0.4.0

Rolester Desktop 0.3.0

What's Changed

• 🚀 Release 0.3.1 — reevaluation gate fixes + compEstimate staleness by @scttbnsn in #10
• release: promote dev → main (v0.3.3 → v0.5.0) by @scttbnsn in #12
• release: promote dev → main (v0.5.1 → v0.5.2) by @scttbnsn in #13
• 🔧 config(coderabbit): add review config with per-path agent rules by @scttbnsn in #14
• 🔧 config(coderabbit): adopt agent-voice tone and SYP best practices by @scttbnsn in #15
• 🔧 config(greptile): on-call reviews only, skip automatic by @scttbnsn in #16
• 📝 docs(front-door): rewrite README and site copy for candidates, not testers by @scttbnsn in #17
• 🐛 fix(deploy): anchor .vercelignore paths so merging to main stops shipping a 404 by @scttbnsn in #18
• 🐛 fix(build): guard root postinstall so it stops printing a MODULE_NOT_FOUND stack by @scttbnsn in #19

Full Changelog: v0.5.2...desktop-v0.3.0

v0.5.2 — eliminate the slug-trim ReDoS

A security patch. The slugify idiom .replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") had a polynomial-ReDoS in the trailing -+$ (O(n²) backtracking). CodeQL flagged two reachable sites; this fixes the whole class — 15 sites across providers, tracker, profile, comms, research, interview, and a script. The preceding collapse makes boundary dashes single, so /^-|-$/g is equivalent and quantifier-free.

rolester update    # or: npm i -g rolester@0.5.2

v0.5.1 — complete the bad-tag-filter fix

A one-line security patch. The 0.4.1 HTML-stripper fix used </script\s*>, which still misses real end tags like </script bar> (an HTML parser closes the element on </script + any non-> chars + >). htmlToText now uses [^>]* so script/style stripping can't be bypassed. Caught by CodeQL's PR diff (js/bad-tag-filter).

rolester update    # or: npm i -g rolester@0.5.1

v0.5.0 — report-issue skill + ship the scripts skills invoke

What's new

• report-issue skill — when Rolester itself looks broken (a crash, stack trace, non-zero exit, or clearly-wrong output), the agent now knows to help you file a bug. It first separates a real defect from a config problem (setup issues route to configure / doctor), assembles redacted diagnostics — no candidate PII, comp, employer/recruiter names, or workspace contents, with home paths normalized — and, only with your explicit yes, opens a GitHub issue on this repo under your own gh identity. It never auto-files and falls back to a prefilled issue URL when gh isn't available. Say "this is broken", "report a bug", or "file an issue".

Fixes

• Ship the scripts the skills actually invoke. The package files allowlist shipped only install-skills.mjs, but skills call npm run verify:tracker (13×), calibrate:style (9×), scan:sourced, analyze:outcomes, and more — all of which point at scripts/*.mjs that weren't in the package. So those commands broke in every installed and live copy (the missing verify-tracker.mjs failure). This release ships all 8 user-facing scripts. If you maintain a live tree, rolester update (or update-live) now pulls them in.

Housekeeping

• New packaging guard: a test now fails if any script reachable from a skill or a published npm run alias isn't in the files allowlist (dev-only demo build/deploy scripts exempted) — so this regression class can't ship again.
• Docs: backfilled the missing company-health entry in the skills reference.

rolester update    # or: npm i -g rolester@0.5.0

v0.4.1 — security hardening

A security-hardening patch. These fixes were flagged by CodeQL and landed just after 0.4.0 went out; since they touch shipped src/ files, this release gets them to users.

Security fixes

• Markdown-table escaping — the escapeCell helpers (interview packet, sourced-intake, sourced-delta) now escape backslashes before pipes, so a trailing \ can't escape the cell delimiter and break out of a table cell. (js/incomplete-sanitization)
• HTML stripper — the liveness job-link checker's htmlToText now tolerates whitespace in </script > / </style > end-tags, closing a tag-filter bypass. (js/bad-tag-filter)
• Library drawer — tag rendering clones DOM nodes instead of round-tripping innerHTML, removing an XSS-through-DOM path. (js/xss-through-dom)

Housekeeping

• CodeQL now scans the dev release branch, not just main — releases ship from dev, so the scanner had never analyzed the actually-released code. The dev baseline is clean.

No schema or workflow changes; this is a drop-in update.

rolester update    # or: npm i -g rolester@0.4.1

v0.4.0

What's new

The global rolester binary now exposes the full command surface. Every workflow CLI is reachable as rolester <cmd> — companies, tracker-dev, modes, activity, research, stories, strategy-review, analytics, evidence, gate, learnings, status-map, and install-skills — not just via npm run. They're all listed in rolester help.

Fixes

• Documented commands now actually run. The command-form sweep left a stray npm -- separator on the binary form. The global binary forwards args verbatim, so rolester automation -- status failed with unknown command "--". Fixed across 49 call sites, including the fix-it guidance rolester doctor prints to users.
• Fixed the non-existent rolester render alias (now rolester tracker).

Housekeeping

• All command references across the skills, AGENTS.md, docs, docs-site, website, and templates now use the rolester binary form.

Update: rolester update (your candidate/ and workspace/ data is untouched).

v0.3.3

What's changed

• Added shared agent guidance for doctor, rolester next, and the dashboard Next agent task card.
• Added rolester next / npm run next with durable discovery skip recording for optional board/company discovery steps.
• Updated onboarding/search/discovery router docs so agents steer through setup-searches -> research-boards -> discover-companies -> search-jobs and keep recommending the next useful skill after setup.
• Tightened empty search/company source outputs and manual rolester start --no-agent handoff text.

Verification

• npm test
• npm run doctor
• npm run lint:placeholders
• npm run next
• npm run tracker -- --json
• npm pack --dry-run

Rolester v0.3.2

What's changed

• Adds an onboarding target posting-age preference and threads it into generated search recency.
• Makes doctor, search source, and company source CLIs surface readiness instead of leaving users to infer what has or has not run.
• Aligns the post-onboarding discovery flow around setup-searches -> research-boards -> discover-companies -> search-jobs.
• Fixes capture:search-sources YAML loading for canonical searches[] configs, query-to-term mapping, and HiringCafe checkpoint failures.

Verification

• npm test
• npm run doctor
• npm run lint:placeholders
• npx biome check on touched source/test files
• npm pack --dry-run

v0.3.1

Bugfix-led patch with one backward-compatible feature.

Fixed — reevaluation gate false positive (and the same class elsewhere)

The reevaluation gate could fire a false "thresholds tripped" because contract prose invited the agent to recompute the gate from cumulative rejections instead of reading the persisted analytics block, which trips on the delta since the last review.

• reevaluate-strategy reads tracker.json#analytics.reevaluation (npm run analytics), not the descriptive analyze:outcomes; fit-bands come from persisted app.fitBucket.
• AGENTS.md reevaluation contract clarified (delta not cumulative; read-the-block; dashboard nudge vs reevaluation.due are distinct gates).
• track-outcomes refreshes the analytics block (npm run analytics -- --write) before re-render, so the gate isn't read stale.
• company-health counts screen toward the interview fire-band.
• apply-job reads persisted fitBucket before re-deriving the FIT tier.

Added

• compEstimate staleness — comp estimates now carry asOf and a comp_estimate.recheck_days window (default 30), mirroring company_health; the comp card shows "as of <date>". Additive, non-breaking.

909 tests pass.