Job-application agent

Job application forms are repetitive for humans and hostile for automation: multi-step wizards, cross-origin embedded frames, custom dropdowns, session logins, and a final submit you must not fire by accident. I built a Bun CLI that works through them in a dedicated Chrome profile over the DevTools protocol.

The design rule is that deterministic code, not a model, has final authority. Each screen starts with an in-page DOM snapshot that assigns stable refs to every visible control and field, including inside child frames and open shadow roots. A cascade then chooses actions cheapest-first: learned field replays and a local answer registry (no model call), a small decision model for the per-screen choice, a DeepSeek planner consulted only when the driver stays stuck, and a Claude writer for free-text answers, which it composes from local facts and resume material within each field's limit. Before anything executes, the action is revalidated against a fresh snapshot; stale refs, destructive controls, marketing opt-ins, and social sign-in are refused outright.

Secrets are outside the trust boundary. Passwords are generated and filled from the macOS Keychain and never appear in prompts, logs, or snapshots; structured fills are resolved locally by key, so a model names "facts.email" and never sees a raw value. CAPTCHAs, MFA codes, and date-of-birth pickers are left to me — the agent stops safely and holds the tab open. Without an explicit --submit flag it fills everything and stops before the final submit.

Around the core loop there is a queue runner, posting discovery, per-run JSONL traces with cost accounting, and a read-only mail sync that classifies employer replies and builds a to-do list with the deadlines the emails state.

1,100+ logged runs at about $0.05 per submitted application. What I'd do differently if I rebuilt it: make per-host lessons the first feature rather than a later layer. The cheapest model call is the one a previous run already made, and every screen that a deterministic path can handle is one where a model is not spending your money or your trust.