Local Resume Autofill

A local-first, privacy-boundary-clear Edge/Chrome resume autofill extension. Resumes are encrypted with a passphrase-derived key, page adapters are auditable declarative JSON, and agents such as Codex can only process sanitized page structures and synthetic test data.

[!WARNING] The current version is a developer preview. The Tencent, Alibaba, ByteDance, JD, Meituan, Pinduoduo, and Kuaishou adapters are all fixture-verified and have not yet completed per-site fill verification on real application accounts. The extension only saves local path references to attachments, does not read or upload files, and never automatically submits applications.

Core boundaries

• The production extension only requests storage, activeTab, and scripting.

• No <all_urls>, persistent content script, telemetry, cloud sync, or remote rules.

• Resumes are encrypted with PBKDF2-SHA-256 (310,000 iterations) and AES-256-GCM.

• Attachments such as PDF/Word resumes, transcripts, and portfolios only save "name + local path", encrypted together with other data.

• The passphrase is not saved; the session key is only placed in chrome.storage.session and becomes invalid after the browser restarts.

• Page scripts cannot read the vault through window.postMessage or external messages.

• Authorization is confirmed by exact hostname before the first fill on each website.

• Only the fields planned for the current page are sent; the full resume is not handed to the content script.

• Attachment paths do not enter field matching, fill plans, sanitized capture, or MCP; the popup only copies the path when the user clicks.

• After filling, the user reviews the result and submits manually.

See SECURITY.md and architecture notes for the full boundaries.

Related MCP server: agent-auth

Installing the development version

Requires Node.js 20+ and Microsoft Edge or Google Chrome.

npm ci
npm run check
npm run build

1. Open edge://extensions or chrome://extensions.

2. Enable "Developer mode".

3. Select "Load unpacked" and point to dist/extension.

4. Open the extension's "Resume & Permissions", create a vault, and enter your data.

Usage

1. In "Attachment locations" under "Resume & Permissions", add attachment names and Windows absolute paths, e.g. D:\Documents\resume.pdf.

2. On a job application form page, click the extension icon, then click "Preview" to check field references.

3. Click "Fill". A new hostname will first show an authorization confirmation.

4. When an attachment is needed, copy the corresponding path from "Attachment locations" in the popup, paste it into the system file picker, and manually confirm the file.

5. Review the page result and handle CAPTCHAs and submission manually.

The browser does not expose the real absolute path of the selected file to the web page, so the path must be entered manually. The extension does not check whether the file exists, nor does it open File Explorer or operate on <input type="file">.

"Capture" exports a *.capture.json that does not contain input values, selected items, attachment names, or screenshots. Capture files may still contain page labels and structure and do not enter Git by default.

Current adapters

See adapter authoring for the meaning of the statuses and the process for adding new adapters.

Connecting Codex or another Agent

This project provides a local STDIO MCP server. It can only access the adapters, sanitized captures, and fixtures in the repository; it cannot read the browser vault, resume values, or attachment paths.

npm run build
Copy-Item .codex/config.toml.example .codex/config.toml
codex mcp list

Project-level MCP configuration must be used in a trusted repository. Codex's STDIO, project-level configuration, and client sharing behavior follow the official OpenAI MCP documentation. Other MCP-capable agents can connect to the same dist/mcp/server.js.

See MCP integration for detailed tools and the confirmation flow.

Verification

npm run typecheck
npm run test:unit
npm run test:integration
npm run test:e2e
npm run audit:extension

Current regression scope:

• 44 unit tests: vault migration, attachment path validation and copying, tamper detection, sanitization, unique selectors, DOM scanning and drivers, 7 site fixtures, MCP paths, and two-phase installation.

• 1 real STDIO MCP integration test: handshake, tool discovery, adapter enumeration, and fixture execution.

• 2 Edge extension end-to-end tests: MV3 loading, scan sanitization, attachment path ciphertext/display/copy, file control isolation, page filling, hostname authorization, no submission, and zero external HTTP(S) requests.

• Static audit of the production package: permissions, persistent injection, page message bridge, network APIs, and content-script storage access.

Development

• Architecture and threat model

• Security self-review before v0.4.0 release

• Adapter authoring

• MCP integration

• Contribution guide

• Changelog

The project is licensed under the MIT License. Third-party recruiting website names are used only for compatibility descriptions; this project has no affiliation with or endorsement from these companies.