Fighter90/career-ops-ui v1.10.2

on GitHub

[1.10.2] — 2026-05-12

Functional-regression patch. Two bugs discovered in v1.10.1 hand-testing closed; documentation surface expanded.

🐛 Bug fixes

• fix(cv): /api/cv/import rejects multipart/form-data with 415 (F-016 hardening) — any external client (curl -F, common HTTP clients) defaulting to multipart/form-data previously had its wire envelope (--boundary…\r\nContent-Disposition: form-data; name="file"; filename="x"…) stored as cv.md content. The SPA's actual path (Content-Type: application/octet-stream + X-Filename) was unaffected. Route now returns 415 with a hint pointing at the documented contract. Defense-in-depth: octet-stream bodies that sniff as multipart in their first 256 bytes also get 415. cv.md is never touched on a 415.
• fix(pdf): /api/stream/pdf invokes generate-pdf.mjs with proper positional args — was calling the script with []. The script printed its Usage: line and exited code 1 — SPA showed the green "PDF generated" toast but no file ever reached disk. The route now reads cv.md, renders it to an HTML file under output/cv-input-<TIMESTAMP>.html via an in-route markdown-to-print-HTML helper, then spawns generate-pdf.mjs <input.html> <output.pdf> --format=a4. Optional ?format=letter query for US-letter output. When cv.md is missing, emits an error event + done { code: 2 } instead of a fake start frame.

🧪 Tests

• New tests/cv-upload-multipart-reject.test.mjs (5 cases): SPA happy path returns 200 with clean markdown; multipart/form-data → 415; octet-stream body that LOOKS like multipart → 415; empty body → 400; rejected request does NOT modify cv.md.
• New tests/pdf-stream-args.test.mjs (3 cases): start event carries <input.html> <output.pdf> --format=a4 with absolute paths and the HTML exists on disk; ?format=letter switches the flag; missing cv.md emits the expected error frame.
• Total: 340 unit tests (was 318). One pre-existing failure in portals-dead.test.mjs remains parent-side data drift, unrelated to web-ui.
• Coverage: 94.63 % line / 84.94 % branch.

📝 Docs

• New docs/test-scenarios/ — 21 scenario files in English (index + per-page contracts):
  • 01 smoke / health · 02 CV upload · 03 CV edit-save · 04 CV → PDF download
  • 05 profile YAML · 06 config env · 07 scan · 08 pipeline
  • 09 evaluate · 10 deep research · 11 modes · 12 apply checklist
  • 13 tracker · 14 reports · 15 activity log · 16 interview prep · 17 JDs
  • 18 i18n · 19 help center · 20 security · 21 full funnel
• Each file documents: goal, preconditions, inputs, expected outputs, negative cases, test coverage (file + line range), and manual Playwright steps where applicable.
• New docs/reviews/REVIEW-2026-05-12-v1.10.2.md — full session context, scope-out list, verification commands.
• All 8 READMEs: badge bumps (tests 318 → 340, release v1.10.1 → v1.10.2) + "What's new in v1.10.2" section per locale.
• All 8 CHANGELOGs receive this entry.

Out of scope (deferred to future GSD phases)

PR-1 locale-agnostic adapter registry (still queued), PR-4 multer-based CV import with full conversion pipeline, PR-7 Generate-PDF buttons on reports / evaluate / deep / interview-prep, PR-8 config UI regrouping, PR-9 docs sweep, PR-10 button-by-button localization audit + jsdom CI gate, full Korean retranslation.