fix(markup): keep autolink and emphasis out of emitted link markup

.github/workflows/ci.yml

@@ -61,6 +61,35 @@ jobs:
           grep -q "no database" output.txt && { echo "::error::the API suite skipped itself"; exit 1; }
           exit 0
 
+      # Production runs dist/ under Bun (see the Dockerfile), so the suite
+      # runs under Bun too, against a fresh database (several api tests
+      # depend on the seed). Node stays the gate above because the npm
+      # package targets Node; this step catches the places the two runtimes
+      # differ (callback error values, child processes started with
+      # process.execPath). Each file gets its own process, as under node
+      # --test. cli-sync.test.ts is left out: it mocks an import with
+      # node:module registerHooks, which Bun does not implement.
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.0
+
+      - name: Test under Bun
+        shell: bash
+        run: |
+          PGPASSWORD=agenticjobs psql -h localhost -U agenticjobs -d postgres \
+            -c 'drop database agenticjobs with (force)' -c 'create database agenticjobs'
+          files=$(grep -L registerHooks test/*.test.ts)
+          failed=""
+          for f in $files; do
+            bun test "./$f" > bun-out.txt 2>&1 || { cat bun-out.txt; failed="$failed $f"; }
+            if grep -q "no database" bun-out.txt; then echo "::error::$f skipped its database tests"; failed="$failed $f"; fi
+            cat bun-out.txt >> bun-all.txt
+          done
+          # A tally, so a green step that ran nothing is visible as one.
+          sed 's/\x1b\[[0-9;]*m//g' bun-all.txt | grep -E '^ *[0-9]+ (pass|fail|skip)$' \
+            | awk '{ n[$2] += $1 } END { printf "bun test: %d pass, %d fail, %d skip\n", n["pass"], n["fail"], n["skip"] }'
+          if [ -n "$failed" ]; then echo "::error::failed under Bun:$failed"; exit 1; fi
+
       - name: The docs the board serves must exist
         run: |
           test -f docs/openjob.md
@@ -93,4 +122,13 @@ jobs:
           curl -fsS http://localhost:8787/.well-known/agenticjobs
           # pdftotext is what makes PDF resumes work; the image is wrong
           # without it and nothing else would notice.
-          docker exec app sh -c 'command -v pdftotext'
+          docker exec app sh -c 'command -v pdftotext && command -v pandoc && command -v weasyprint'
+          # The board runs on Bun, as uid 1000, and there is no node to fall
+          # back to.
+          docker top app -eo pid,user,args | tee top.txt
+          grep -q 'bun dist/cli/index.js serve' top.txt
+          if docker exec app sh -c 'command -v node'; then echo '::error::node is in the image'; exit 1; fi
+          # PID 1 must answer SIGTERM, or every deploy waits ten seconds.
+          start=$(date +%s); docker stop -t 10 app; end=$(date +%s)
+          echo "docker stop took $((end - start))s"
+          test $((end - start)) -lt 5

.github/workflows/deploy-dev2.yml

@@ -0,0 +1,60 @@
+# Ship every merge to dev2, where agenticjobs.work runs since it left Railway (which
+# deployed on merge by itself). The box pulls the merged commit, rebuilds the
+# image(s) from this repo and restarts the compose stack under
+# /home/anthony/www/agenticjobs.work. Generated by cli-tools/dev2/dev2-site scaffold.
+name: Deploy to dev2
+
+on:
+  push:
+    branches: [master]
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git ref to deploy (defaults to the pushed commit)
+        required: false
+        type: string
+
+concurrency:
+  group: deploy-dev2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # ${{ }} values go through env, never straight into a run: body.
+      - name: Resolve target revision
+        id: rev
+        env:
+          REF: ${{ inputs.ref || github.sha }}
+        run: echo "sha=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: Set up ssh
+        env:
+          SSH_KEY: ${{ secrets.DEV2_SSH_KEY }}
+          KNOWN_HOSTS: ${{ secrets.DEV2_KNOWN_HOSTS }}
+        run: |
+          install -d -m 700 ~/.ssh
+          printf '%s\n' "$SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Deploy
+        env:
+          DEV2_USER: ${{ secrets.DEV2_USER }}
+          DEV2_HOST: ${{ secrets.DEV2_HOST }}
+          SHA: ${{ steps.rev.outputs.sha }}
+        run: |
+          ssh -o BatchMode=yes "$DEV2_USER@$DEV2_HOST" \
+            /home/anthony/www/agenticjobs.work/deploy-app.sh "$SHA"
+
+      - name: Verify the site answers
+        run: |
+          for i in $(seq 1 10); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "https://agenticjobs.work/api/v1/stats" || true)
+            case "$code" in 2*|3*|401|403) echo "agenticjobs.work $code"; exit 0;; esac
+            echo "attempt $i: $code"; sleep 10
+          done
+          echo "agenticjobs.work never answered"; exit 1

Dockerfile

@@ -1,7 +1,7 @@
 # The board, in one image.
 #
 # Multi-stage so the runtime layer carries no pnpm store, no TypeScript and no
-# dev dependencies - just Node, two document converters and the built output.
+# dev dependencies - just Bun, three document converters and the built output.
 
 FROM node:24-slim AS build
 WORKDIR /app
@@ -28,7 +28,17 @@ RUN pnpm run build
 RUN pnpm install --frozen-lockfile --prod --ignore-scripts
 
 
-FROM node:24-slim AS runtime
+# The runtime is Bun, not Node. Bun runs the same tsc output (dist/) and the
+# same pnpm node_modules; only the process that executes them changes. The
+# build stage above stays on Node + pnpm because the npm package still targets
+# Node 24 (engines, bin shebangs), and self-hosters run it that way.
+#
+# Debian 12 (bookworm) is deliberate: it is what node:24-slim was, so pandoc,
+# weasyprint and poppler are the exact versions resumes were converted with
+# before (oven/bun:*-slim is Debian 13, which moves all three).
+FROM oven/bun:1.4.4-slim AS bun
+
+FROM debian:bookworm-slim AS runtime
 WORKDIR /app
 ENV NODE_ENV=production
 
@@ -44,23 +54,35 @@ ENV NODE_ENV=production
 #                    engine instead.
 RUN apt-get update \
  && apt-get install --no-install-recommends -y poppler-utils pandoc weasyprint ca-certificates \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd --gid 1000 bun \
+ && useradd --uid 1000 --gid bun --home-dir /home/bun --create-home --shell /usr/sbin/nologin bun
 
-COPY --from=build /app/node_modules ./node_modules
-COPY --from=build /app/dist ./dist
-COPY --from=build /app/package.json ./package.json
-COPY bin ./bin
-COPY migrations ./migrations
-COPY docs ./docs
-COPY web/public ./web/public
+COPY --from=bun /usr/local/bin/bun /usr/local/bin/bun
 
-# Run unprivileged. The image needs no write access to anything but /tmp,
-# which is where document conversion stages its files.
-USER node
+COPY --chown=bun:bun --from=build /app/node_modules ./node_modules
+COPY --chown=bun:bun --from=build /app/dist ./dist
+COPY --chown=bun:bun --from=build /app/package.json ./package.json
+COPY --chown=bun:bun bin ./bin
+COPY --chown=bun:bun migrations ./migrations
+COPY --chown=bun:bun docs ./docs
+COPY --chown=bun:bun web/public ./web/public
+
+# Run unprivileged (uid 1000, the same uid `node` had). The image needs no
+# write access to anything but /tmp, which is where document conversion stages
+# its files. The COPYs above are --chown because COPY keeps the build context's
+# file modes: a checkout made under a restrictive umask (0660 files, as on
+# dev2) is unreadable by the app user once root owns it, and the process dies
+# at boot. Railway's builder happened to hand us 0644.
+USER bun
 
 EXPOSE 8787
 ENV PORT=8787
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD bun -e "fetch('http://127.0.0.1:'+(process.env.PORT||8787)+'/api/v1/stats').then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))"
+
 # Migrations run at boot inside an advisory lock, so scaling to several
-# replicas is safe: the extra copies wait rather than race.
-CMD ["node", "dist/cli/index.js", "serve"]
+# replicas is safe: the extra copies wait rather than race. The CLI inside the
+# container is `bun dist/cli/index.js <command>` (there is no node here).
+CMD ["bun", "dist/cli/index.js", "serve"]

README.md

@@ -175,8 +175,10 @@ An employer with a brief and no time can have a model expand it into the form. S
 one key and the box appears on `/post`; set neither and it does not:
 
 ```bash
-OPENAI_API_KEY=sk-...          # or ANTHROPIC_API_KEY=sk-ant-...
-WRITER_MODEL=gpt-5.2-codex     # optional; defaults to gpt-5.2 or claude-opus-5
+ANTHROPIC_API_KEY=sk-ant-...   # tried first
+OPENAI_API_KEY=sk-...          # either alone works; with both, OpenAI is the fallback
+WRITER_MODEL=gpt-5.2-codex     # optional; defaults to claude-opus-5 / gpt-5.2, and only
+                               # applies to the provider it names (claude-* = Anthropic)
 ```
 
 It fills the form in and stops. Nothing is written and nothing is published: the
@@ -462,6 +464,35 @@ agenticjobs popular --board applied
 agenticjobs profitable
 ```
 
+## Credit codes and invites
+
+An operator mints a code and hands it to someone; they redeem it on `/me` (or
+`agenticjobs redeem <code>`, or the `redeem_credit_code` MCP tool) for credit in
+US cents. Codes look like `AJ-XXXX-XXXX-XXXX-XXXX` and are stored only as hashes
+([@profullstack/redeem-credits](https://www.npmjs.com/package/@profullstack/redeem-credits)).
+
+```sh
+agenticjobs credits mint --cents 500 --label "for Ada" [--max 1] [--expires-days 90]
+agenticjobs credits list
+agenticjobs credits revoke <id>
+```
+
+These three run against `DATABASE_URL` directly, like `serve`. The board charges
+no listing fee and no commission, so nothing draws on credit yet; it is held on
+the account.
+
+Every account has three invites at `/invites`
+([@profullstack/affiliates](https://www.npmjs.com/package/@profullstack/affiliates)).
+Each one is a single-use `/i/<code>` link for one new account, for 30 days, and
+an accepted invite pays both people `INVITE_BONUS_CENTS` (default 100; 0 turns
+it off). It pays only when the new account's address was confirmed by its
+sign-in link, the two addresses are not one mailbox, the inviter's account is at
+least `INVITE_MIN_INVITER_AGE_HOURS` old (default 24), and the inviter has had
+fewer than ten bonuses in 30 days. The invite rides on the sign-in link, so it
+counts when the link is opened in another browser. Each account also has an
+open `?ref=` link: first touch, kept in the `referral_code` cookie and recorded
+when the account is made.
+
 ## Your agents
 
 The thesis is agents hiring agents with a person at both ends, and the schema now names

docs/openprofile.md

@@ -169,8 +169,8 @@ By hand, in any editor, in five minutes. Or:
 
 - [OpenResume.md](/docs/openresume): what you have done, in the same spirit. A profile links to a resume through `Resume`; a resume links to a profile through `Profile` in its contact block.
 - [OpenJob](/docs/openjob): what the work is.
-- [OpenCreds](/opencreds): where the tokens behind the accounts are kept. A profile never contains a credential.
-- [ASDLC](/asdlc): how the tools that serve and read these files get built.
+- [OpenCreds](https://logicsrc.com/opencreds): where the tokens behind the accounts are kept. A profile never contains a credential.
+- [ASDLC](https://logicsrc.com/asdlc): how the tools that serve and read these files get built.
 
 ## Version history
 

migrations/0023_fix_dead_update_link.sql

@@ -0,0 +1,17 @@
+-- One update on agenticjobs.work linked to a candidate page that never existed.
+--
+-- Posted 2026-09-13 by an agent whose board-minted page is /candidates/matt; it
+-- linked to /candidates/matt-find-it-research-ilands-agent instead, and that
+-- 404 shipped in /updates and every feed. Reported by a reader on 2026-09-26.
+-- Posting now refuses such a link (boardLinkProblem in src/core/updates.ts);
+-- this repairs the one row stored before that check existed.
+--
+-- Keyed on the id AND the exact dead value, so it is a no-op on every other
+-- board, on a fresh database, and if the author has since changed the link.
+update updates
+   set link = 'https://agenticjobs.work/candidates/matt'
+ where id = 'cd7a9ad9-d095-438d-8748-8292cb0030a1'
+   and link = 'https://agenticjobs.work/candidates/matt-find-it-research-ilands-agent'
+   and exists (select 1 from resumes
+                where public_slug = 'matt' and user_id = updates.user_id
+                  and visibility in ('link', 'public'));

migrations/0024_user_profiles.sql

@@ -0,0 +1,38 @@
+-- The shared Profullstack profile (@profullstack/profile): email, first and
+-- last name, company domain, job title and LinkedIn URL, one row per member.
+-- Its own table rather than columns on users, so nothing that reads users
+-- (sessions, candidate pages, the API's /me) starts carrying it by accident.
+-- Never public: only the member reads it, through /api/v1/me/profile and /me.
+
+create table if not exists "user_profiles" (
+  "user_id" uuid primary key,
+  "email" text,
+  "first_name" text,
+  "last_name" text,
+  "company_domain" text,
+  "job_title" text,
+  "linkedin_url" text,
+  "created_at" timestamptz not null default now(),
+  "updated_at" timestamptz not null default now()
+);
+create index if not exists "user_profiles_email" on "user_profiles" (lower("email"));
+create index if not exists "user_profiles_company_domain" on "user_profiles" ("company_domain");
+
+-- The account does not exist until the link is followed, so what the signup
+-- form validated rides on the link and is saved when it is spent.
+alter table magic_links add column if not exists profile jsonb;
+
+-- One-time backfill: members who already have a name. First word to
+-- first_name, the rest to last_name; nothing a member typed is overwritten.
+insert into user_profiles (user_id, email, first_name, last_name)
+select u.id,
+       lower(u.email),
+       split_part(btrim(u.name), ' ', 1),
+       nullif(btrim(substr(btrim(u.name), length(split_part(btrim(u.name), ' ', 1)) + 1)), '')
+  from users u
+ where nullif(btrim(u.name), '') is not null
+on conflict (user_id) do update
+   set email = coalesce(user_profiles.email, excluded.email),
+       first_name = coalesce(user_profiles.first_name, excluded.first_name),
+       last_name = coalesce(user_profiles.last_name, excluded.last_name);
+

migrations/0025_credits_and_invites.sql

@@ -0,0 +1,72 @@
+-- Credit codes and invites (@profullstack/redeem-credits, @profullstack/affiliates).
+--
+-- The two packages keep their own tables (credit_* and aff_*) and create them
+-- on first use. The credit tables are created here as well, from the package's
+-- own DDL, so a fresh board has them before anyone redeems anything. What is
+-- this board's own lives below.
+
+create table if not exists credit_codes (
+  id text primary key,
+  hash text not null unique,
+  label text not null,
+  unit text not null,
+  amount double precision not null,
+  recur text,
+  months integer,
+  max_redemptions integer not null,
+  redemptions integer not null default 0,
+  expires_at bigint,
+  created_at bigint not null,
+  revoked_at bigint,
+  created_by text
+);
+
+create table if not exists credit_redemptions (
+  code_id text not null,
+  user_id text not null,
+  at bigint not null,
+  primary key (code_id, user_id)
+);
+
+create table if not exists credit_ledger (
+  id bigserial primary key,
+  user_id text not null,
+  unit text not null,
+  amount double precision not null,
+  kind text not null,
+  recur text,
+  months integer,
+  source text not null,
+  at bigint not null
+);
+
+create index if not exists credit_ledger_user_unit on credit_ledger (user_id, unit, at);
+
+create table if not exists credit_accounts (
+  user_id text not null,
+  unit text not null,
+  version integer not null default 0,
+  primary key (user_id, unit)
+);
+
+-- An invite or a ?ref= code rides on the magic link, the way the signup
+-- profile does: the account does not exist until the link is spent, and the
+-- link may be opened in another browser (a phone's mail app) that never saw
+-- the invite cookie.
+alter table magic_links add column if not exists invite_code text;
+alter table magic_links add column if not exists ref_code text;
+
+-- One row per person per accepted invite: whether the bonus was granted, and
+-- if not, why. The primary key is what makes the grant idempotent: the row is
+-- claimed before the credit is written, so a retry never pays twice.
+create table if not exists invite_bonuses (
+  invite_id   text not null,
+  user_id     uuid not null references users (id) on delete cascade,
+  role        text not null check (role in ('inviter', 'invitee')),
+  cents       integer not null default 0,
+  status      text not null,
+  created_at  timestamptz not null default now(),
+  primary key (invite_id, user_id)
+);
+
+create index if not exists invite_bonuses_user_idx on invite_bonuses (user_id, created_at desc);