This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+11 more
Summary
AI summaryAdded read‑only detection of installed AI CLI tools via a new route and settings tab.
Full changelog
[1.103.0] — 2026-07-06
Settings: "AI CLI tools" — which agent CLIs are installed. career-ops is Claude-Code-driven but works with any agent CLI on the open skill standard. A new AI CLI tools tab in App settings (#/config) shows which of them — Claude Code, Codex, Gemini CLI, OpenCode, GitHub Copilot CLI, Qwen, Antigravity — are installed on the machine running the server, and their paths. It is a read-only PATH scan: it only checks whether each binary exists and never runs it (no --version, no execution), writes nothing, and touches no user data.
- New route module (28th)
server/lib/routes/cli-detect.mjs—GET /api/cli-detect. Detection resolves the path of a binary from a fixed 7-entry allowlist acrossprocess.env.PATH(Windows.cmd/.exe/.batshims; POSIX execute-bit); a hostile file on PATH can never be executed by this route. - New "AI CLI tools" tab in
public/js/views/config.js(lazy-loaded, deep-linkable via#/config?tab=cli). Tests:tests/cli-detect-routes.test.mjs(PATH resolve with a stub exec that must never run, detect shape, endpoint). 8 new i18n keys ×16 (cli.*+config.tabCli). Help §2 extended in place.
New: server/lib/routes/cli-detect.mjs.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Career Ops UI
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]