v2.2.0 – Hosted web-app demo, hardening, and profile enrichment

The skill's prompt content is unchanged since v2.1.0 — SKILL.md and references/ carry no diff. Everything here is the new hosted harness around it, so if you run the skill in Claude Code there's nothing behavioral to pick up; pull for the docs.

Live demo

The skill now runs as a web app at tech-sourcing-webapp.pages.dev — paste a JD, get persona → live X-ray search → scorecard → outreach in the browser, without installing Claude Code. Same skill, same rules (real search, no invented URLs); a Cloudflare Worker calling the Claude API replaces Claude Code as the harness. (#56, #58)

Profile enrichment

The agent gained a second tool, fetch_profile(url), so candidates are scored on dated employment history instead of search snippets alone: LinkedIn routes to Apollo, everything else to Firecrawl scrape. Profile data only — no email or phone reveal. Enrichment is capped per run to bound credit spend. (#68)

Hardening

A review pass over the public demo endpoint closed a set of abuse and disclosure paths:

• jobDescription size is capped, so a large body can't be billed as Opus input tokens (#60)
• upstream error text is no longer relayed to callers, via 500s or tool results (#62)
• CORS is an allowlist rather than * (#63)
• the rate limiter uses a sliding window, closing the hour-boundary burst (#64)
• CI typechecks the Worker, which caught a real bug within the day (#61)

Fixes

Boolean search strings — the main copy-pasteable deliverable — no longer render as a run-on paragraph, and fenced code blocks render at all (#65). The Worker's smoke test verifies from the response body after wrangler tail proved unreliable non-interactively (#69).

Full changelog: v2.1.0...v2.2.0