fix: stop silent Jobs filters from emptying Discovered

Hide-prior-skips is off by default and counts in the badge when on; Settings searchCities no longer hard-filters the Jobs list.

.gitleaks.toml

@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [
@@ -11,9 +20,13 @@ paths = [
   '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
   '''(?i).*vault\.example\.(yml|yaml)$''',
   '''(?i).*\.env\.example$''',
+  '''(?i)docs-site/docs/extractors/.*''',
+  '''(?i)extractors/golangjobs/.*''',
+  '''(?i)orchestrator/src/server/infra/product-analytics\.ts$''',
 ]
 regexes = [
   '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
   '''(?i)sk-or-invalid''',
   '''(?i)msk-or-invalid''',
+  '''(?i)YOUR_API_KEY''',
 ]

docs-site/docs/features/duplicate-jobs.md

@@ -45,7 +45,7 @@ During a pipeline run, if a new posting matches an existing row by URL, source i
 
 Open jobs that match a prior skip or apply are **hidden** from Discovered, Ready, and All tabs so the queue stays fresh. Skipped and applied rows themselves remain visible in their statuses.
 
-Use **Filters → Employer keywords → Hide roles you already skipped** to toggle this behavior (on by default). When enabled, JobOps compares **company + job title** only:
+Use **Filters → Employer keywords → Hide roles you already skipped** to toggle this behavior (off by default). When enabled, JobOps compares **company + job title** only:
 
 - Same company after normalization (legal suffixes stripped; short names like `CGI` match longer forms like `CGI IT UK Limited`).
 - Same title after normalization (including simple plural variants such as `Engineer` vs `Engineers`).

orchestrator/src/client/pages/OrchestratorPage.tsx

@@ -1,6 +1,5 @@
 import { useSettings } from "@client/hooks/useSettings";
 import { buildDuplicateDismissHints } from "@client/lib/job-dedup";
-import { inferCountryKeyFromSearchGeography } from "@shared/search-cities";
 import type React from "react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useNavigate, useParams } from "react-router-dom";
@@ -168,12 +167,6 @@ export const OrchestratorPage: React.FC = () => {
     [settings],
   );
 
-  const searchGeographyCountryKey = useMemo(
-    () =>
-      inferCountryKeyFromSearchGeography(settings?.searchCities?.value ?? null),
-    [settings?.searchCities?.value],
-  );
-
   const duplicateDismissHints = useMemo(
     () => (hidePriorSkips ? buildDuplicateDismissHints(jobs) : undefined),
     [hidePriorSkips, jobs],
@@ -188,7 +181,7 @@ export const OrchestratorPage: React.FC = () => {
       settingsBlockedEmployerKeywords: applySettingsCompanySkipList
         ? settingsSkipEmployerKeywords
         : [],
-      searchGeographyCountryKey,
+      searchGeographyCountryKey: null,
       duplicateDismissHints,
     }),
     [
@@ -198,7 +191,6 @@ export const OrchestratorPage: React.FC = () => {
       employerExcludeFilter,
       applySettingsCompanySkipList,
       settingsSkipEmployerKeywords,
-      searchGeographyCountryKey,
       duplicateDismissHints,
     ],
   );

orchestrator/src/client/pages/orchestrator/OrchestratorFilters.tsx

@@ -257,7 +257,7 @@ export const OrchestratorFilters: React.FC<OrchestratorFiltersProps> = ({
         employerIncludeFilter.length > 0 || employerExcludeFilter.length > 0,
       ) +
       Number(!applySettingsCompanySkipList) +
-      Number(!hidePriorSkips) +
+      Number(hidePriorSkips) +
       Number(sponsorFilter !== "all") +
       Number(sponsorshipSignalsFilter.length > 0) +
       Number(hideSponsorBlockers) +

orchestrator/src/client/pages/orchestrator/useOrchestratorFilters.ts

@@ -436,7 +436,7 @@ export const useOrchestratorFilters = () => {
   );
 
   const hidePriorSkips = useMemo(
-    () => searchParams.get("hidePriorSkips") !== "0",
+    () => searchParams.get("hidePriorSkips") === "1",
     [searchParams],
   );
 
@@ -458,8 +458,8 @@ export const useOrchestratorFilters = () => {
     (value: boolean) => {
       setSearchParams(
         (prev) => {
-          if (value) prev.delete("hidePriorSkips");
-          else prev.set("hidePriorSkips", "0");
+          if (value) prev.set("hidePriorSkips", "1");
+          else prev.delete("hidePriorSkips");
           return prev;
         },
         { replace: true },

scripts/git-hooks/install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# One-time installer for the local pre-commit gitleaks hook.
+# Run once per clone: bash scripts/git-hooks/install.sh
+#
+# Respects `core.hooksPath` if you've set one (local or global) — some setups
+# point git at a hooks dir outside `.git/hooks/` (e.g. a machine-wide
+# `~/.git-hooks/`), and installing to `.git/hooks/` in that case would be a
+# silent no-op. If an existing hook is already at that path, this chains to
+# it so nothing already relying on it breaks.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+HOOKS_DIR="$(git config --get core.hooksPath || true)"
+if [ -z "$HOOKS_DIR" ]; then
+  HOOKS_DIR=".git/hooks"
+elif [[ "$HOOKS_DIR" != /* ]]; then
+  HOOKS_DIR="$REPO_ROOT/$HOOKS_DIR"
+fi
+mkdir -p "$HOOKS_DIR"
+
+TARGET="$HOOKS_DIR/pre-commit"
+if [ -f "$TARGET" ] && ! grep -q "gitleaks" "$TARGET" 2>/dev/null; then
+  echo "⚠️  Existing pre-commit hook found at $TARGET that isn't ours — chaining instead of overwriting."
+  CHAINED="$HOOKS_DIR/pre-commit.d-gitleaks"
+  cp scripts/git-hooks/pre-commit "$CHAINED"
+  chmod +x "$CHAINED"
+  if ! grep -q "pre-commit.d-gitleaks" "$TARGET" 2>/dev/null; then
+    printf '\n# Added by levkinops ansible repo (scripts/git-hooks/install.sh)\n"%s"\n' "$CHAINED" >> "$TARGET"
+  fi
+else
+  cp scripts/git-hooks/pre-commit "$TARGET"
+  chmod +x "$TARGET"
+fi
+
+echo "✓ Installed pre-commit gitleaks hook → $TARGET"
+if [ "$HOOKS_DIR" != ".git/hooks" ] && [ "$HOOKS_DIR" != "$REPO_ROOT/.git/hooks" ]; then
+  echo "  (using core.hooksPath=$HOOKS_DIR — applies to every repo that shares this hooksPath)"
+fi
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "  Note: gitleaks isn't installed locally yet. Install it for the hook to actually run:"
+  echo "    macOS:  brew install gitleaks"
+  echo "    Linux:  see https://github.com/gitleaks/gitleaks#installing"
+  echo "  Until then this hook is a no-op locally (CI still scans every push)."
+fi

scripts/git-hooks/pre-commit

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Local pre-commit secret scan — mirrors the `secret-scanning` CI job (gitleaks)
+# so leaked secrets are caught before they ever leave your machine, not just at
+# CI time. Installed via `make install-git-hooks`.
+#
+# Uses the same .gitleaks.toml allowlist as CI. Only scans staged content.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "⚠️  gitleaks not installed locally — skipping local secret scan."
+  echo "    Install: brew install gitleaks   (CI will still catch it either way)"
+  exit 0
+fi
+
+echo "🔐 Running gitleaks on staged changes..."
+if ! gitleaks protect --staged --config .gitleaks.toml --no-banner --redact; then
+  echo ""
+  echo "❌ gitleaks found a potential secret in your staged changes."
+  echo "   Fix it, or if it's a false positive, add an allowlist entry to .gitleaks.toml."
+  echo "   Bypass (not recommended): git commit --no-verify"
+  exit 1
+fi
+
+echo "✓ gitleaks: no secrets found in staged changes"