1.27.0 (2026-08-18)
Features
- cli: add --help / -h usage block to stats.mjs (#2556) (3d8b53d)
- cli: shared flag-validation helper, migrate 3 fixed scripts, fix scan.mjs (#2778) (f05fc0f), closes #2775
- dashboard: add a POSTED column showing requisition age (#2692) (a229727)
- dashboard: add Stats analytics view with score quality & seniority mix charts (#2960) (9f0c3c3)
- intake: read documents/ locally to propose source-annotated profile additions (87abc32)
- invite-match: distinguish AI-interviewer platforms from human calls (#2676) (7fa3b1d), closes #2673
- negotiation: ROI-based salary-negotiation talking points from verified achievements (#2950) (03b440f)
- pdf: batch render path reusing one Chromium across N CVs (#2747) (7bb5c32)
- providers: Eightfold AI talent-acquisition boards (#2684) (e991d58)
- providers: extend getro with auto-resolve, salary, retry and remote-detect (#2640) (85c0928), closes #2602
- providers: senjob — the scanner's first African source, Senegal (#2962) (db9bd6a)
- rank: opt-in LLM relevance re-ranker for pipeline.md (#2579) (03fc92b)
- scan: AND-groups in title_filter.positive (#2552) (5483083)
- scan: record failed runs in scan-runs.tsv so trends exclude survivorship bias (713a6b0)
- skill-extract: recognize certifications, not just engineering tools (#2603) (4c6a1d2)
- templates: five named CV templates + a contract test for template variants (#2954) (314cbb5)
- tracker-sync-check: flag applications.md rows that active-interviews.md has already moved past (a1304a4)
- update: declare fork-local paths outside the system layer (#2793) (b082ec6)
- update: restore locally deleted system files instead of preserving the deletion (#2448) (bfcaaba)
- web: give the Apply page a way back and a way to record that you applied (#2735) (05cc972)
Bug Fixes
- add-entry: key non-Latin headings and dedup keys faithfully (#2850) (27757e4)
- add-entry: reject mistyped flags instead of reading them as data (f4c4fda)
- agent-inbox: give concurrent add() a burst-sized lock timeout (#2825) (513f07a), closes #2824
- agent-inbox: serialize concurrent adds through the shared lock (#2777) (a7f65b6)
- agent-inbox: stop dropping requests queued during an add (#2614) (ad382c0)
- archive: key JD captures to report numbers so they resolve after capture day (#2701) (81d7b06)
- assessment-log: reject unknown flags (#2802) (ce56efe)
- batch-tailor: --min-score 4.5 was silently ignored, and the worker's pdf mode path was cwd-relative (#2961) (f306801)
- batch: retry state updates and lock reservations to prevent worker silent drops (#2417) (5404185)
- build-cv-html: render numeric year/date scalars instead of dropping them (#2641) (949a690)
- build-cv-latex: numeric year/date scalars are still dropped — #2641 fixed only the HTML mirror (#2916) (94eb334)
- check-table-freshness: validate CLI flags and add a usage block (#2873) (a12dd6b), closes #2855
- ci: only greet a first-time contributor when it is actually their first (a0d45aa)
- ci: skip the upgrade leg when nothing managed changed, instead of failing (#2697) (9dcfd2f)
- classify-tier: an incidental senior word outranked an explicit intern marker (#2737) (cc2b1ce)
- cli: a one-letter typo returned a false all-clear at exit 0 in 4 reporting CLIs (#2920) (d65d024)
- company-history: record response dates via --on, not --note free text (9b17a8a)
- contacto: LinkedIn connection-request limit is 200 on free tier, not 300 (#2951) (9c242c5)
- csod: replay bootstrap session cookies and repair fetchResponse() (#2769) (7aee3b9)
- cv-facts: treat a k/M/B magnitude suffix as part of the number (#2612) (18d245a)
- cv: Korean and Traditional Chinese CVs had no font rule (#2616) (994552d)
- dedup-tracker: reject unrecognized flags instead of silently live-running (#2746) (429b0dc)
- deps: make js-yaml imports work on both 4.x and 5.x (#2656) (6466b18)
- deps: patch both HIGH advisories in web (js-yaml 4.3.1, nanoid 3.3.18) (a094ec9)
- deps: raise the js-yaml floor to ^4.3.1 and guard it (#2767) (5b18a96)
- doctor: detect Playwright MCP servers provided by Claude Code plugins (#2753) (49d20f2)
- doctor: validate CLI flags and add a usage block (#2874) (d4c31be), closes #2856
- eval: merge openrouter tracker TSVs and send Ollama options to the native /api/chat (#2647) (a86f776)
- find: print the one USAGE constant on the empty-query path too (f0dd6ed)
- find: reject mistyped flags instead of searching for them (9265e08)
- followup-cadence: parse annotated pins, and add a retire directive (#2514) (b4f6b2d)
- followup-seed: resolve "today" in local time, not UTC (#2765) (15aa769)
- followup: ignore an apply date cited about another row (#2610) (53808a9), closes #2607
- invite-match: validate CLI flags and add usage (#2958) (34b1d58)
- jd-similarity: add --help and reject unknown flags instead of reading them as paths (#2819) (ce1f321), closes #2772
- jd-similarity: the seniority gate fired on JD boilerplate (#2661) (772ea35)
- jd-skill-gap: recognize all six markdown heading levels (#2721) (2a3bd2f)
- jd-skill-gap: recognize sentence-form requirement headings (#2686) (fd9ca41)
- jobvite: migrate to the public XML feed after the JSON API retirement (#2623) (0c7522b)
- keys: stop the dotted-I fix from collapsing Polish, Lithuanian and Maltese (5df43e7)
- keys: stop the Turkish dotted capital from splitting one employer in two (462d276)
- liveness: classify a rate-limited posting as uncertain, not expired (#2613) (c65afe6)
- liveness: treat an api.lever.co 404 as inconclusive, not proof of removal (#2649) (84fe20f)
- locks: treat Windows rm/stat contention as contention, not death (#2984) (2743281)
- match-star: score a non-English story bank against a question in its own language (#2848) (fa5926d)
- merge-tracker: deterministic dedup on the posting URL (#1298) (a0426bb)
- merge-tracker: match inline URL headers so URL dedup activates for doc-style rows (#2926) (c078513)
- merge-tracker: re-eval no longer inherits the superseded report's checkmark (#2595) (c85d02f)
- ollama: include profile context in evaluations (#2664) (ef2a82f)
- oraclecloud: accept Oracle's numbered tenant apexes (oraclecloud1-99.com) (#2683) (a23ebc1)
- patterns: rate denominators counted rows that could never contribute (#2783) (e2dbbbf)
- pipeline-lock: a non-EEXIST mkdir refusal is contention, not a fatal error (#2838) (bca798f), closes #2777
- pipeline-lock: jitter the retry so a starved writer costs a retry, not an item (c7dbf0d)
- plugin-audit: validate CLI arguments and add a usage block (#2813) (588139c), closes #2771
- process-quality: three undisclosed employers were reported as disclosed (#3005) (b5acfa5)
- providers: decode HTML entities in titles before matching so encoded ampersands stop dropping jobs (#2923) (37f4c11)
- providers: fill in the docs and vendor-detection gaps (#2658) (7152907)
- providers: harden workable with retry, headers, and serialization (#2675) (feabcd4)
- providers: isRetryableError no longer misclassifies a refused redirect (#2657) (f8feaa5)
- providers: make themuse resilient to per-page fetch failures (#2682) (a83800f)
- providers: personio falls back to HTML scrape when the XML feed is disabled (5fe2784)
- providers: phenom pagination/retry fixes, drop dead auto-detection (#2669) (1331ebf)
- providers: reject numeric entities outside the XML 1.0 Char set (#2713) (a050631)
- providers: route seven RSS decoders through the shared safe entity decoder (#2818) (5b00081), closes #2790
- providers: route softgarden and radancy through the shared entity decoder (#2487) (96b1de6)
- reply-matcher: require corroboration for partial role-title matches (#2672) (3215fa3)
- reply-matcher: the '?' unknown-employer placeholder matched everything (#3001) (86e653d)
- reply-watch: reject unrecognized CLI flags instead of treating them as a path (#2745) (ba2b634)
- reserve-report-num: do not read a bare date file as a report number (#2759) (6d6524b), closes #2757
- role-matcher: tokenize non-Latin role titles and scope the mark fold (#2782) (6704dd6), closes #2781
- scan-ats-full: cap single-host ATS sweeps at their own concurrency (#2839) (5ef0676)
- scan: locate the URL anywhere in a pipeline.md entry (#2605) (c0413e3)
- scan: take the shared lock for scan-history.tsv appends (#2639) (8e264c4)
- set-status: stop the --role guard from folding every non-Latin title to the same key (#2736) (437da7a)
- states: aliases the engine accepts were missing from states.yml (#2615) (04ef492)
- status: fold Turkish dotted capitals so uppercase tracker rows resolve to canonical states (0834e72)
- tests: contain a discovered suite that throws at import (#2830) (51e8f19)
- theme-style: a
$-pattern in a profile style value splices the body into the CV's (1798f3a) - update: commit the index so file-mode changes are not dropped (#2629) (4b1d66b)
- update: ignore CRLF/LF-only differences when detecting local system edits (#2820) (9c06337), closes #2817
- update: reconcile .gitignore on apply so new ignore rules reach existing installs (#2857) (2728cd0)
- velocity: count a web-written transition as an observation (#2898) (2e36380)
- verify-cv-facts: fold allow_metrics through the same noun synonyms (#2720) (5352f38)
- verify-cv-facts: treat a period as a thousands separator too (#2722) (dceaddb)
- voice-dna: make voice-dna.md private via the template pattern (#2952) (10a9c55)
- web: add Grok Build CLI to the web runtime picker (#2688) (af0d818)
- web: analytics tells an offer-holder they have 0 interviews (and nudges them to try harder) (#2410) (8f2b415)
- web: anchor the fallback stderr classifier so a word can't fail a run (#2882) (be62e3e)
- web: carry the posted: segment so web evaluations reach the POSTED column (#2899) (6eece73)
- web: detect OpenCode in its default install directory (#1794) (c10b887)
- web: emit the posting URL in the tracker-additions TSV so web runs join the dedup (#2833) (3c68721)
- web: enforce that no runtime grants itself blanket write permission (#2875) (9ba6ebf)
- web: finish Unicode company keys for explore + registry (#2668) (c294242)
- web: fold Turkish dotted capitals in status keys, and stop hand-copying the state list (#2786) (e1a0961)
- web: keep Codex JSONL + exit code authoritative for web scoring (#2102) (2d43601)
- web: let the pipeline table scroll horizontally instead of clipping on narrow screens (#2363) (632031c)
- web: make the tracker reader agree with parseTrackerRow on row shape (#2565) (4fea438)
- web: prevent Codex run jobs from waiting on stdin (#1973) (9a139a2)
- web: read target_roles with the shape it is actually written in (#2750) (5f5c06d)
- web: show the retry card, not the update-checkout panel, for runtime scan errors (#1904) (29c0d69)
- web: skip {n}-RESERVED.md sentinels when looking up reports (#1967) (5f4842e)
- web: stop the 16-chip cap from truncating the user's own portals.yml (#2749) (a5af949)
- web: strip the author letter from any lettered block, not just A-G (#2420) (630709a)
- web: take the core tracker lock in POST /api/status (#2903) (d9c4fd0)
- workday: key the cap-hit warning on entry provenance, not on --since (#2763) (7f067bc)
Performance Improvements
- analytics: drop redundant existsSync probes before report reads (#2655) (f06cbf8)
- scan: read each dedup source once per scan run (d68c4c9)
web: 0.7.0
0.7.0 (2026-08-18)
Features
Bug Fixes
- deps: make js-yaml imports work on both 4.x and 5.x (#2656) (6466b18)
- deps: patch both HIGH advisories in web (js-yaml 4.3.1, nanoid 3.3.18) (a094ec9)
- deps: raise the js-yaml floor to ^4.3.1 and guard it (#2767) (5b18a96)
- keys: stop the dotted-I fix from collapsing Polish, Lithuanian and Maltese (5df43e7)
- keys: stop the Turkish dotted capital from splitting one employer in two (462d276)
- scan: take the shared lock for scan-history.tsv appends (#2639) (8e264c4)
- web: add Grok Build CLI to the web runtime picker (#2688) (af0d818)
- web: analytics tells an offer-holder they have 0 interviews (and nudges them to try harder) (#2410) (8f2b415)
- web: anchor the fallback stderr classifier so a word can't fail a run (#2882) (be62e3e)
- web: carry the posted: segment so web evaluations reach the POSTED column (#2899) (6eece73)
- web: detect OpenCode in its default install directory (#1794) (c10b887)
- web: emit the posting URL in the tracker-additions TSV so web runs join the dedup (#2833) (3c68721)
- web: enforce that no runtime grants itself blanket write permission (#2875) (9ba6ebf)
- web: finish Unicode company keys for explore + registry (#2668) (c294242)
- web: fold Turkish dotted capitals in status keys, and stop hand-copying the state list (#2786) (e1a0961)
- web: keep Codex JSONL + exit code authoritative for web scoring (#2102) (2d43601)
- web: let the pipeline table scroll horizontally instead of clipping on narrow screens (#2363) (632031c)
- web: make the tracker reader agree with parseTrackerRow on row shape (#2565) (4fea438)
- web: prevent Codex run jobs from waiting on stdin (#1973) (9a139a2)
- web: read target_roles with the shape it is actually written in (#2750) (5f5c06d)
- web: show the retry card, not the update-checkout panel, for runtime scan errors (#1904) (29c0d69)
- web: skip {n}-RESERVED.md sentinels when looking up reports (#1967) (5f4842e)
- web: stop the 16-chip cap from truncating the user's own portals.yml (#2749) (a5af949)
- web: strip the author letter from any lettered block, not just A-G (#2420) (630709a)
- web: take the core tracker lock in POST /api/status (#2903) (d9c4fd0)