Skip to content

feat(agenticjobs): the job board, as a command on every box - #64

Merged
ralyodio merged 1 commit into
masterfrom
worktree-agenticjobs-command
Sep 9, 2026
Merged

feat(agenticjobs): the job board, as a command on every box#64
ralyodio merged 1 commit into
masterfrom
worktree-agenticjobs-command

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

agenticjobs joins the set: the board at agenticjobs.work, installed on first use and handed everything you type.

agenticjobs signup
agenticjobs search rust --remote
agenticjobs search go --network      # every board in the directory
agenticjobs apply <slug> --resume cv.md
agenticjobs post job.md              # then `publish <slug>`
agenticjobs tui
agenticjobs mcp

Ours, spelled --self-* because every plain word is upstream's: --self-update, --self-where. AGENTICJOBS_BIN points at a copy you would rather run, AGENTICJOBS_SPEC pins a version.

The name collides with the package it launches

This is the first wrapper here whose name is also upstream's executable name. A global install would put two agenticjobs on PATH, the winner decided by directory order, and if ours won and followed PATH it would exec itself. resolveRunner only accepts a copy that is not this wrapper, and the private prefix under ~/.local/share/cli-tools/vendor/agenticjobs means the name exists once.

Three plain words are intercepted, and only for our copy

update, uninstall and where are upstream's, answered from a manifest.json its own curl installer writes. A copy npm puts in our prefix has no manifest, so upstream replies "not installed by the installer" on a box where this command installed it and works.

So those three are answered here when the board that would run is ours (vendor/missing), and handed straight through when it is not (path/env) so an installer-managed or AGENTICJOBS_BIN board keeps upstream's behaviour exactly.

The collision is already live on this box

Upstream's installer writes a real shell script to ~/.local/bin/agenticjobs, the same directory install-links.mjs links into, and that script never takes over a real file even with --force:

SKIP  /home/anthony/.local/bin/agenticjobs — is a real file

That is the right outcome and it is now documented rather than left to be discovered. On a box that has run upstream's installer, this wrapper does not get the name until that script is removed; cli-tools list shows it as ! agenticjobs … ↳ on PATH: …, and the wrapper defers to it correctly.

Checks

  • 857 tests pass across 32 files, 23 of them new here.
  • typecheck reports nothing in the new files (src/argontv.ts and src/free-names.ts have pre-existing exactOptionalPropertyTypes errors on master, untouched).
  • Verified end to end with ~/.local/bin off PATH, so the vendored path actually runs:
### first run
agenticjobs: first run, installing @profullstack/agenticjobs@latest
agenticjobs: installed 0.5.0 with pnpm
0.5.0

### --self-where after install
…/cli-tools/vendor/agenticjobs/node_modules/.bin/agenticjobs  installed by cli-tools

### update
agenticjobs: updating @profullstack/agenticjobs@latest
agenticjobs: installed 0.5.0 with pnpm

### uninstall (without --yes, changed nothing; with it)
Removed /home/anthony/.local/share/cli-tools/vendor/agenticjobs

Install goes through vendor-verify, so pnpm's release-age cooldown cannot report success while leaving the old version in place (#59).

No version bump here, following #53/#55: the release is its own PR.

🤖 Generated with Claude Code

The board is @profullstack/agenticjobs, the same one running at
agenticjobs.work. It has had a CLI since 0.2.0 and it was reachable from
exactly one place: a curl installer you had to remember the URL for. This makes
it a command here like every other one, installed on first use.

Everything is handed through untouched. Two flags are ours, spelled --self-*
because every plain word is upstream's.

The name is the interesting part. Upstream's own executable is also called
`agenticjobs`, so this is the first wrapper in the repo whose name collides
head-on with the package it launches. A global install would put two of them on
PATH and the winner would come down to directory order; if ours won and it
followed PATH it would exec itself. resolveRunner only ever accepts a copy that
is not this wrapper, and the vendor prefix means the name exists once.

Three plain words are intercepted, and only for the copy we installed.
`update`, `uninstall` and `where` are upstream's, and upstream answers them out
of a manifest.json that its own curl installer writes. A copy npm puts in our
prefix has no manifest, so upstream replies "not installed by the installer" on
a box where this command plainly did install it and works. Those three are
answered here when the board that would run is ours, and handed straight
through when it is not, so a board from upstream's installer keeps upstream's
behaviour exactly.

That case is already live on this box: upstream's installer writes a real shell
script to ~/.local/bin/agenticjobs, which is the directory install-links.mjs
links into, and it never takes over a real file even with --force. So a box
that already ran their installer reports SKIP and keeps what it had. The README
says so rather than leaving it to be discovered.

Verified end to end with ~/.local/bin off PATH: first run installed 0.5.0 with
pnpm and then ran the command, --self-where reported the prefix, `update`
refreshed ours, `uninstall` without --yes changed nothing and with it removed
only our prefix. Install goes through vendor-verify, so pnpm's release-age
cooldown cannot report success while leaving the old version in place.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WxWrsbLuaSaZqQ7FFTrdVW
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 4 | MEDIUM: 4 | LOW: 4

Severity Rule Location
HIGH sh-remote-script-execution root-ubuntu.sh:3227
HIGH sh-remote-script-execution root-ubuntu.sh:3228
HIGH sh-remote-script-execution root-ubuntu.sh:4840
HIGH sh-remote-script-execution root-ubuntu.sh:4844
MEDIUM sh-remote-script-execution root-ubuntu.sh:4993
MEDIUM sh-remote-script-execution root-ubuntu.sh:6055
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/mail.ts:1042
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:135
LOW secret-generic-credential test/shorten.test.ts:36

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio ralyodio mentioned this pull request Sep 9, 2026
@ralyodio
ralyodio merged commit 5b13cbc into master Sep 9, 2026
5 checks passed
ralyodio added a commit that referenced this pull request Sep 9, 2026
Four changes since v0.29.0, three of which have been sitting on master
unreleased:

- argontv: the shared line, and whether there is room to sell (#61)
- mobile companions: adb, expo and eas, installed on request (#62)
- telnyx, because a number bought by clicking is not reproducible (#63)
- agenticjobs: the job board, as a command on every box (#64)


Claude-Session: https://claude.ai/code/session_01WxWrsbLuaSaZqQ7FFTrdVW

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant