$ show career-ops-hq/career-ops
CareerOps is a local-first, AI-assisted job search automation platform. It scans 100+ ATS job boards and aggregators (Greenhouse, Lever, Ashby, Workday, iCIMS, PeopleSoft, 55+ providers) through a standardized provider abstraction, evaluates each posting against the user's CV by delegating to AI coding CLIs (Claude Code, Codex, Gemini, OpenCode, etc.), emits structured A–H evaluation reports with 1–5 fit scores, generates ATS-optimized CV PDFs and cover letters, and tracks the full application lifecycle in a Markdown/TSV data store. It ships three surfaces: a Node.js CLI core (~150 .mjs modules), a Next.js 16 web dashboard, and a Go Bubble Tea TUI. All data remains on the user's machine; nothing is ever auto-submitted—a human presses send. The evaluation, scoring, and pattern-analysis features (funnel velocity, repost detection, calibration against outcomes) are product features, not research artifacts, so the repo is classified as an application despite these analytical components. Architecturally, this is a monorepo spanning three runtimes that share a flat-file data layer coordinated by cross-process file locks (SHA256-derived lock directories compatible between Go and Node). Its standout engineering includes a provider registry pattern for ATS integrations, a plugin engine with mandatory human-in-the-loop enforcement, capability-fenced CLI spawning for AI agents (read-only/web-search-only modes with per-CLI fencing probes), atomic write-with-backup for every user-layer file, and a 400+ file test suite including byte-level parity tests that keep web-side algorithm mirrors aligned with core logic, SSRF-hardening tests across all providers, and cross-platform contention tests. The repo also demonstrates unusually mature governance: plugin registration with pinned SHAs, direction gates in CI, localization drift checks for 16 languages, and a self-updater with rollback. Weaknesses: the Go/Node split duplicates tracker parsing logic (mitigated by shared header-alias tables but still a maintenance burden), parsing is regex-heavy over markdown tables with many special-case bugs, and rapid feature expansion has produced visible bloat—dozens of AI-provider-specific eval scripts, many localized mode trees, and extensive one-off migration scripts. The external ecosystem (ATS site markup, AI CLI permission models) shifts constantly, requiring the active dead-board pruning and fencing probes visible in the codebase. Overall this is a well-crafted, heavily tested local-first application with several genuinely reusable security and concurrency patterns, held back from exceptional by its dual-runtime duplication and feature sprawl.
The LLM identified 6 files worth highlighting for reuse:
A generic plugin engine that validates plugin manifests (apiVersion major-version rejection), enforces a mandatory humanInTheLoop=true contract and rejects any plugin declaring auto-submit/auto-send hooks, scopes secrets via ctx.env key prefixing, and gates all outbound egress through an allowedHosts allowlist. The hook taxonomy (provider/ingest/search/notify/export) is cleanly separated from the engine core. This is a safely extractable pattern for any application that needs third-party plugin execution with hard security boundaries.
A hardened HTTP fetch helper used by all 55+ ATS/job-board providers. It enforces redirect:'error' to prevent SSRF via redirect chains, implements separate connect and body-read timeouts (not just header timeouts), includes DNS caching with pacing to avoid hammering job boards, and supports an opt-in proxy-egress mode for scanning through corporate proxies. The accompanying test suite (ats-ssrf-hardening, http-timeout, proxy-egress, private-address-guard) proves the guarantees. This is directly reusable in any scraping or provider-integration project.
A cross-platform atomic file write utility that writes to a temp file, fsyncs, renames into place, and preserves a timestamped backup of the previous content before overwriting. Error paths for EACCES, ENOSPC, and ENOENT are explicitly tested, and it is the single sanctioned write seam for all user-layer data files, preventing torn writes when the web server, CLI, and Go TUI concurrently touch the same Markdown/TSV store. Reusable for any local-first application needing safe persistence.
A capability-fencing layer for spawning third-party AI coding CLIs as subprocesses. It detects each CLI's supported fencing flags (e.g., read-only vs. web-search-only modes) via probe commands, enforces permission deny-lists per CLI and per worker, and produces a transparency report of the exact capability grants used for each invocation. This solves the recurring problem of safely invoking powerful LLM agents from an application and is novel enough to be worth extracting for any AI-orchestration tool.
A standalone utility that budgets how much of a user's CV, profile, and job-description content fits within a given LLM context window, preventing prompt truncation and runaway token costs. It is parameterized by model context size and content priority, has no internal imports, and is directly reusable in any LLM application that assembles variable-length context from multiple sources.
A directory-based file lock that is byte-for-byte compatible between the Go TUI and the Node.js core (both derive the lock directory via SHA256 of the canonical tracker path). It implements timeout acquisition, stale-lock recovery, and atomic release. This solves the genuinely hard problem of coordinating concurrent writers to flat-file data across two runtimes and two languages, and the pattern is reusable for any polyglot system sharing a filesystem-backed store.