job-application-agent 3.1.0 → 3.1.2

package/job-application-agent/scripts/source-community-client.mjs

@@ -0,0 +1,254 @@
+import { chmod, mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+
+import { SKILL_VERSION } from './telemetry-client.mjs';
+import { createSourceContributionEnvelope, normalizeCommunitySource, validateCommunitySourceList } from './source-community-schema.mjs';
+
+export const DEFAULT_SOURCE_COMMUNITY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL ?? process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https://job-application-agent-telemetry.varora1406.workers.dev';
+export const SOURCE_SHARING_NOTICE = 'Community source sharing is enabled by default. Repeatable public job boards and hiring feeds are shared anonymously into a pending maintainer-review queue after removing personal and referral data. Run `sources sharing disable` to opt out.\n';
+
+const CONFIG_FILE = 'source-sharing.json';
+const CONFIG_LOCK_FILE = '.source-sharing.lock';
+const CONFIG_LOCK_TIMEOUT_MS = 15_000;
+const CONFIG_LOCK_STALE_MS = 60_000;
+
+function defaultConfig() {
+  return { version: 1, enabled: true, disclosed: false, installationId: null, token: null, tokenExpiresAt: null };
+}
+
+function sameCredentialState(left, right) {
+  return left.enabled === right.enabled
+    && left.installationId === right.installationId
+    && left.token === right.token
+    && left.tokenExpiresAt === right.tokenExpiresAt;
+}
+
+function processIsAlive(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  if (pid === process.pid) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    if (error.code === 'ESRCH') return false;
+    return true;
+  }
+}
+
+async function writePrivate(file, value) {
+  const temporary = `${file}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+  await rename(temporary, file);
+  await chmod(file, 0o600);
+}
+
+export class SourceCommunityClient {
+  constructor({ stateDir, endpoint = DEFAULT_SOURCE_COMMUNITY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_TIMEOUT_MS ?? 3000) }) {
+    this.stateDir = stateDir;
+    this.endpoint = endpoint.replace(/\/$/, '');
+    this.fetch = fetchFn;
+    this.stderr = stderr;
+    this.now = now;
+    this.timeoutMs = timeoutMs;
+  }
+
+  get configPath() { return join(this.stateDir, CONFIG_FILE); }
+  get configLockPath() { return join(this.stateDir, CONFIG_LOCK_FILE); }
+
+  async ensureDirectory() {
+    await mkdir(this.stateDir, { recursive: true, mode: 0o700 });
+    await chmod(this.stateDir, 0o700);
+  }
+
+  async readConfig() {
+    try {
+      const value = JSON.parse(await readFile(this.configPath, 'utf8'));
+      return { version: 1, enabled: value.enabled !== false, disclosed: value.disclosed === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null };
+    } catch (error) {
+      if (error.code === 'ENOENT') return null;
+      return { version: 1, enabled: false, disclosed: true, installationId: null, token: null, tokenExpiresAt: null };
+    }
+  }
+
+  async saveConfigUnlocked(config) {
+    await this.ensureDirectory();
+    await writePrivate(this.configPath, config);
+  }
+
+  async removeStaleConfigLock() {
+    let contents;
+    let metadata;
+    try {
+      [contents, metadata] = await Promise.all([
+        readFile(this.configLockPath, 'utf8'),
+        stat(this.configLockPath),
+      ]);
+    } catch (error) {
+      if (error.code === 'ENOENT') return true;
+      throw error;
+    }
+    const trimmed = contents.trim();
+    const pid = /^\d+$/.test(trimmed) ? Number(trimmed) : null;
+    const ownerIsDead = pid !== null && !processIsAlive(pid);
+    const lockExpired = Date.now() - metadata.mtimeMs >= CONFIG_LOCK_STALE_MS;
+    if (!ownerIsDead && !lockExpired) return false;
+    try {
+      if (await readFile(this.configLockPath, 'utf8') !== contents) return false;
+      await unlink(this.configLockPath);
+      return true;
+    } catch (error) {
+      if (error.code === 'ENOENT') return true;
+      throw error;
+    }
+  }
+
+  async withConfigLock(operation) {
+    await this.ensureDirectory();
+    const startedAt = Date.now();
+    let handle;
+    while (!handle) {
+      try {
+        handle = await open(this.configLockPath, 'wx', 0o600);
+      } catch (error) {
+        if (error.code !== 'EEXIST') throw error;
+        if (await this.removeStaleConfigLock()) continue;
+        if (Date.now() - startedAt >= CONFIG_LOCK_TIMEOUT_MS) throw new Error('Could not acquire source-sharing config lock.');
+        await delay(20);
+      }
+    }
+    try {
+      await handle.writeFile(`${process.pid}\n`);
+    } catch (error) {
+      await handle.close();
+      await unlink(this.configLockPath).catch(() => {});
+      throw error;
+    }
+    try {
+      return await operation();
+    } finally {
+      await handle.close();
+      await unlink(this.configLockPath).catch((error) => { if (error.code !== 'ENOENT') throw error; });
+    }
+  }
+
+  async updateConfig(transform) {
+    return this.withConfigLock(async () => {
+      const current = await this.readConfig() ?? defaultConfig();
+      const next = transform(current);
+      await this.saveConfigUnlocked(next);
+      return next;
+    });
+  }
+
+  async config() {
+    return this.withConfigLock(async () => {
+      const existing = await this.readConfig();
+      if (existing) return existing;
+      const config = defaultConfig();
+      await this.saveConfigUnlocked(config);
+      return config;
+    });
+  }
+
+  async status() {
+    const config = await this.readConfig();
+    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), endpoint: this.endpoint, schemaVersion: 1 };
+  }
+
+  async configure(action) {
+    if (action === 'status') return this.status();
+    await this.updateConfig((config) => {
+      if (action === 'enable') config.enabled = true;
+      else if (action === 'disable') config.enabled = false;
+      else if (action === 'reset') Object.assign(config, { enabled: false, disclosed: true, installationId: null, token: null, tokenExpiresAt: null });
+      else throw new Error('Source sharing action must be status, enable, disable, or reset.');
+      config.disclosed = true;
+      return config;
+    });
+    return this.status();
+  }
+
+  async credentials(config) {
+    if (config.installationId && config.token && config.tokenExpiresAt && Date.parse(config.tokenExpiresAt) > this.now().getTime() + 60_000) return config;
+    let expectedState = config;
+    let body = config.installationId && config.token ? { installationId: config.installationId, token: config.token } : {};
+    let response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(this.timeoutMs) });
+    if (response.status === 401 && body.installationId) {
+      config = await this.updateConfig((current) => {
+        if (current.installationId === body.installationId) Object.assign(current, { installationId: null, token: null, tokenExpiresAt: null });
+        return current;
+      });
+      expectedState = config;
+      body = {};
+      response = await this.fetch(`${this.endpoint}/v1/install`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body), signal: AbortSignal.timeout(this.timeoutMs) });
+    }
+    if (!response.ok) throw new Error('community relay unavailable');
+    const identity = await response.json();
+    return this.updateConfig((current) => sameCredentialState(current, expectedState)
+      ? { ...current, installationId: identity.installationId, token: identity.token, tokenExpiresAt: identity.expiresAt }
+      : current);
+  }
+
+  async preview(input) {
+    return normalizeCommunitySource(input);
+  }
+
+  async contribute(input) {
+    const source = normalizeCommunitySource(input);
+    try {
+      let config = await this.config();
+      if (!config.enabled) return { shared: false, reason: 'disabled' };
+      if (!config.disclosed) {
+        this.stderr(SOURCE_SHARING_NOTICE);
+        config = await this.updateConfig((current) => ({ ...current, disclosed: true }));
+        if (!config.enabled) return { shared: false, reason: 'disabled' };
+      }
+      config = await this.credentials(config);
+      let sent = await this.sendContribution(config, source);
+      if (sent.disabled) return { shared: false, reason: 'disabled' };
+      let response = sent.response;
+      if (response.status === 401) {
+        config = await this.updateConfig((current) => ({ ...current, tokenExpiresAt: null }));
+        config = await this.credentials(config);
+        sent = await this.sendContribution(config, source);
+        if (sent.disabled) return { shared: false, reason: 'disabled' };
+        response = sent.response;
+      }
+      if (!response.ok) {
+        return { shared: false, reason: 'unavailable' };
+      }
+      const result = await response.json();
+      const allowed = new Set(['accepted', 'sourceId', 'publicationStatus', 'uniqueContributors']);
+      if (!result || typeof result !== 'object' || Array.isArray(result) || Object.keys(result).some((key) => !allowed.has(key))) return { shared: false, reason: 'unavailable' };
+      if (result.accepted !== true || !/^community-[0-9a-f]{16}$/.test(result.sourceId)) return { shared: false, reason: 'unavailable' };
+      if (!['pending', 'published', 'rejected'].includes(result.publicationStatus)) return { shared: false, reason: 'unavailable' };
+      if (!Number.isSafeInteger(result.uniqueContributors) || result.uniqueContributors < 1 || result.uniqueContributors > 1_000_000_000) return { shared: false, reason: 'unavailable' };
+      return { shared: true, sourceId: result.sourceId, publicationStatus: result.publicationStatus, uniqueContributors: result.uniqueContributors };
+    } catch {
+      return { shared: false, reason: 'unavailable' };
+    }
+  }
+
+  async sendContribution(config, source) {
+    return this.withConfigLock(async () => {
+      const current = await this.readConfig() ?? config;
+      if (!current.enabled) return { disabled: true };
+      const envelope = createSourceContributionEnvelope({ installationId: current.installationId, token: current.token, source, skillVersion: SKILL_VERSION });
+      const response = await this.fetch(`${this.endpoint}/v1/sources`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(envelope), signal: AbortSignal.timeout(this.timeoutMs) });
+      return { disabled: false, response };
+    });
+  }
+
+  async list() {
+    if (this.readUnavailable) return [];
+    try {
+      const response = await this.fetch(`${this.endpoint}/v1/sources`, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(this.timeoutMs) });
+      if (!response.ok) return [];
+      return validateCommunitySourceList(await response.json());
+    } catch {
+      this.readUnavailable = true;
+      return [];
+    }
+  }
+}

package/job-application-agent/scripts/source-community-schema.mjs

@@ -0,0 +1,180 @@
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const SOURCE_ID = /^community-[0-9a-f]{16}$/;
+export const SOURCE_KINDS = new Set(['direct-employer', 'professional-network', 'social-feed', 'startup-network', 'community-thread', 'job-board', 'curated-board', 'inbound', 'user-supplied']);
+
+function record(value, label) {
+  if (!value || Array.isArray(value) || typeof value !== 'object') throw new Error(`${label} must be an object.`);
+  return value;
+}
+
+function boundedString(value, label, max) {
+  if (typeof value !== 'string' || !value.trim() || value.length > max) throw new Error(`${label} must be a non-empty string no longer than ${max} characters.`);
+  return value.trim();
+}
+
+function containsIdentityLike(value) {
+  const normalized = value.normalize('NFKC');
+  return /[^\s/@]+@(?:[^\s./@]+\.)+[^\s./@]+/u.test(normalized)
+    || /\+?\p{Nd}[\p{Nd}\s().-]{7,}/u.test(normalized);
+}
+
+function terms(value, label) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 12) throw new Error(`${label} must be a non-empty array with at most 12 values.`);
+  const normalized = value.map((item, index) => boundedString(item, `${label}[${index}]`, 40).toLowerCase());
+  if (normalized.some((item) => containsIdentityLike(item) || /https?:\/\//i.test(item))) throw new Error(`${label} must not contain identity-like content.`);
+  return [...new Set(normalized)].sort();
+}
+
+function looksPersonal(url) {
+  return (/(^|\.)linkedin\.com$/i.test(url.hostname) && /^\/in\//i.test(url.pathname))
+    || (/(^|\.)github\.com$/i.test(url.hostname) && /^\/[^/]+\/?$/i.test(url.pathname))
+    || (/(^|\.)x\.com$/i.test(url.hostname) && /^\/(?!home(?:\/|$)|jobs(?:\/|$)|search(?:\/|$)|i\/)[^/]+(?:\/|$)/i.test(url.pathname));
+}
+
+function looksIdentityPath(pathname) {
+  const segments = pathname.split('/').filter(Boolean).map((segment) => segment.toLowerCase());
+  const namespaces = new Set(['user', 'users', 'profile', 'profiles', 'member', 'members', 'author', 'authors', 'person', 'people']);
+  return segments.some((segment, index) => namespaces.has(segment) && index < segments.length - 1);
+}
+
+function decodedPathname(pathname) {
+  let current = pathname;
+  for (let pass = 0; pass < 5; pass += 1) {
+    let decoded;
+    try { decoded = decodeURIComponent(current); } catch { throw new Error('community source.baseUrl path encoding is invalid.'); }
+    if (decoded === current) return decoded;
+    current = decoded;
+  }
+  throw new Error('community source.baseUrl path encoding is too deeply nested.');
+}
+
+function looksCredentialLikePath(pathname) {
+  return pathname.split('/').filter(Boolean).some((segment) => {
+    const normalized = segment.normalize('NFKC');
+    if (/^[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/.test(normalized)) return true;
+    if (/^(?:access[-_]?token|api[-_]?key|auth(?:orization)?|bearer|client[-_]?secret|password|secret|token)(?:[=:.]|\s+)(?:bearer\s+)?[A-Za-z0-9._~+/=-]{8,}$/i.test(normalized)) return true;
+    if (/^(?:cfat_|github_pat_|gh[pousr]_|[spr]k_(?:live|test)_|xox[baprs]-)[A-Za-z0-9_-]{8,}$/i.test(normalized)) return true;
+    const opaque = normalized.replace(/=+$/, '');
+    if (!/^[A-Za-z0-9_-]{20,}$/.test(opaque)) return false;
+    return (/[a-z]/.test(opaque) && /[A-Z]/.test(opaque)) || /\d/.test(opaque) || /[-_]/.test(opaque);
+  });
+}
+
+function isPublicHostname(hostname) {
+  const value = hostname.toLowerCase();
+  if (value === 'localhost' || value.endsWith('.localhost') || value.endsWith('.local') || value.endsWith('.internal')) return false;
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(value) || value.startsWith('[')) return false;
+  return value.includes('.');
+}
+
+function hostnameMatches(hostname, suffix) {
+  return hostname === suffix || hostname.endsWith(`.${suffix}`);
+}
+
+export function isRepeatableCommunitySourceRoute(url) {
+  const hostname = url.hostname.toLowerCase();
+  const segments = url.pathname.split('/').filter(Boolean).map((segment) => segment.toLowerCase());
+  if (segments.length === 0) return true;
+
+  const path = `/${segments.join('/')}`;
+  const last = segments.at(-1) ?? '';
+  const uuid = /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/i;
+  if (uuid.test(path) || /^\d{4,}(?:[-_].*)?$/.test(last) || segments.some((segment) => /^(apply|application)$/.test(segment))) return false;
+
+  if (hostnameMatches(hostname, 'myworkdayjobs.com') && segments.some((segment, index) => segment === 'job' && index < segments.length - 1)) return false;
+  if (hostnameMatches(hostname, 'linkedin.com') && segments[0] === 'jobs' && segments[1] === 'view') return false;
+  if (hostnameMatches(hostname, 'greenhouse.io') && segments.some((segment, index) => segment === 'jobs' && index < segments.length - 1)) return false;
+  if (hostname === 'jobs.lever.co' && segments.length >= 2) return false;
+  if (hostname === 'jobs.ashbyhq.com' && segments.length >= 2) return false;
+  if (hostname === 'apply.workable.com' && segments.some((segment, index) => segment === 'j' && index < segments.length - 1)) return false;
+  if (hostname === 'jobs.smartrecruiters.com' && segments.length >= 2) return false;
+  if (segments.some((segment, index) => segment === 'job' && index < segments.length - 1)) return false;
+
+  if (hostnameMatches(hostname, 'myworkdayjobs.com')) return segments.includes('jobs') || ['external', 'internal', 'careers'].includes(last);
+  if (hostnameMatches(hostname, 'linkedin.com')) return segments[0] === 'jobs' && (segments.length === 1 || ['search', 'collections'].includes(segments[1]));
+  if (hostnameMatches(hostname, 'greenhouse.io')) return segments.length === 1 || last === 'jobs';
+  if (hostname === 'jobs.lever.co' || hostname === 'jobs.ashbyhq.com' || hostname === 'jobs.smartrecruiters.com') return segments.length === 1;
+  if (hostname === 'apply.workable.com') return segments.length === 1 || last === 'jobs';
+
+  if (/\.(?:rss|atom|xml|json)$/i.test(last)) return /(?:feed|jobs?|openings|careers)/i.test(path);
+  const collectionCues = new Set(['careers', 'openings', 'positions', 'vacancies', 'opportunities', 'jobs', 'job-search', 'job-listings', 'job-index', 'directory', 'feed', 'rss', 'atom', 'open-roles', 'available-jobs']);
+  const collectionQualifiers = new Set(['search', 'list', 'index', 'directory', 'feed', 'openings', 'engineering', 'product', 'design', 'sales', 'marketing', 'operations', 'finance', 'legal', 'people', 'remote']);
+  return segments.some((segment, index) => collectionCues.has(segment)
+    && (index === segments.length - 1 || (index === segments.length - 2 && collectionQualifiers.has(segments[index + 1]))));
+}
+
+export function normalizeCommunitySource(input) {
+  const value = record(input, 'community source');
+  const allowed = new Set(['name', 'baseUrl', 'kind', 'regions', 'roleFamilies', 'requiresSession']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown community source property: ${key}.`);
+  const name = boundedString(value.name, 'community source.name', 120);
+  if (containsIdentityLike(name) || /https?:\/\//i.test(name)) throw new Error('community source.name must not contain identity-like content.');
+  const url = new URL(boundedString(value.baseUrl, 'community source.baseUrl', 1000));
+  if (url.protocol !== 'https:' || url.username || url.password) throw new Error('community source.baseUrl must be a public HTTPS URL.');
+  url.hostname = url.hostname.replace(/\.+$/, '');
+  if (!isPublicHostname(url.hostname)) throw new Error('community source.baseUrl must use a public internet hostname.');
+  if (containsIdentityLike(url.hostname)) throw new Error('community source.baseUrl must not contain identity-like content.');
+  const decodedPath = decodedPathname(url.pathname).normalize('NFKC');
+  if (containsIdentityLike(decodedPath)) throw new Error('community source.baseUrl must not contain identity-like content.');
+  if (looksIdentityPath(decodedPath)) throw new Error('community source.baseUrl must not contain an identity-like path.');
+  url.pathname = decodedPath;
+  if (looksPersonal(url)) throw new Error('community source.baseUrl must not be a profile or personal URL.');
+  if (!isRepeatableCommunitySourceRoute(url)) throw new Error('community source.baseUrl must identify a repeatable discovery surface, not a one-off job.');
+  if (looksCredentialLikePath(decodedPath)) throw new Error('community source.baseUrl must not contain credential-like path segments.');
+  url.search = '';
+  url.hash = '';
+  const kind = boundedString(value.kind, 'community source.kind', 40).toLowerCase();
+  if (!SOURCE_KINDS.has(kind)) throw new Error('community source.kind is invalid.');
+  if (typeof value.requiresSession !== 'boolean') throw new Error('community source.requiresSession must be a Boolean.');
+  return {
+    name,
+    baseUrl: url.toString().replace(/\/+$/, ''),
+    kind,
+    regions: terms(value.regions, 'community source.regions'),
+    roleFamilies: terms(value.roleFamilies, 'community source.roleFamilies'),
+    requiresSession: value.requiresSession,
+  };
+}
+
+export function createSourceContributionEnvelope({ installationId, token, source, skillVersion }) {
+  return validateSourceContributionEnvelope({ schemaVersion: 1, skillVersion, installationId, token, source });
+}
+
+export function validateSourceContributionEnvelope(input) {
+  const value = record(input, 'source contribution');
+  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'source']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown source contribution property: ${key}.`);
+  if (value.schemaVersion !== 1) throw new Error('Unsupported source contribution schema version.');
+  const installationId = boundedString(value.installationId, 'source contribution.installationId', 36);
+  if (!UUID.test(installationId)) throw new Error('source contribution.installationId is invalid.');
+  return {
+    schemaVersion: 1,
+    skillVersion: boundedString(value.skillVersion, 'source contribution.skillVersion', 40),
+    installationId,
+    token: boundedString(value.token, 'source contribution.token', 2048),
+    source: normalizeCommunitySource(value.source),
+  };
+}
+
+export async function communitySourceId(source) {
+  const normalized = normalizeCommunitySource(source);
+  const bytes = new TextEncoder().encode(normalized.baseUrl);
+  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+  return `community-${[...digest].map((value) => value.toString(16).padStart(2, '0')).join('').slice(0, 16)}`;
+}
+
+export function validateCommunitySourceList(input) {
+  const value = record(input, 'community source list');
+  for (const key of Object.keys(value)) if (!['version', 'sources'].includes(key)) throw new Error(`Unknown community source list property: ${key}.`);
+  if (value.version !== 1 || !Array.isArray(value.sources) || value.sources.length > 500) throw new Error('Invalid community source list.');
+  return value.sources.map((entry) => {
+    const source = record(entry, 'community source entry');
+    const allowed = new Set(['sourceId', 'name', 'baseUrl', 'kind', 'regions', 'roleFamilies', 'requiresSession', 'registryStatus', 'contributionCount']);
+    for (const key of Object.keys(source)) if (!allowed.has(key)) throw new Error(`Unknown community source entry property: ${key}.`);
+    if (!SOURCE_ID.test(source.sourceId)) throw new Error('community source entry.sourceId is invalid.');
+    if (source.registryStatus !== 'community-reviewed') throw new Error('community source entry.registryStatus is invalid.');
+    if (!Number.isSafeInteger(source.contributionCount) || source.contributionCount < 1 || source.contributionCount > 1_000_000_000) throw new Error('community source entry.contributionCount is invalid.');
+    const normalized = normalizeCommunitySource(Object.fromEntries(['name', 'baseUrl', 'kind', 'regions', 'roleFamilies', 'requiresSession'].map((key) => [key, source[key]])));
+    return { sourceId: source.sourceId, ...normalized, registryStatus: source.registryStatus, contributionCount: source.contributionCount };
+  });
+}

package/job-application-agent/tests/job-application.test.mjs

@@ -4,6 +4,7 @@ import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
+import { fileURLToPath } from 'node:url';
 
 import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
 
@@ -68,7 +69,7 @@ test('validates a candidate-defined target profile', () => {
 test('returns the canonical resume path for direct browser uploads', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-resume-path-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   const resume = join(directory, 'resume.pdf');
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   await writeFile(resume, '%PDF-1.7\ncanonical resume fixture');
@@ -238,7 +239,7 @@ test('requires review at each ten confirmed submissions', () => {
 test('deduplicates ledger entries by normalized URL', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   const entry = {
     id: 'example-role-1', company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123?utm_source=x', source: 'company', score: 80, status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
     telemetry: { durationBucket: '5-15m', fieldsFilled: 14, shortAnswerCount: 2, resumeUploaded: true },
@@ -253,13 +254,13 @@ test('deduplicates ledger entries by normalized URL', async (t) => {
   }));
   assert.equal(relabelled.duplicate, true);
   assert.equal((await readFile(join(directory, 'applications.ndjson'), 'utf8')).includes('telemetry'), false);
-  assert.equal((await stat(join(directory, 'applications.ndjson'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'applications.ndjson'))).mode & 0o777, 0o600);
 });
 
 test('warns on same-company role matches and serializes concurrent duplicate submissions', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-dedup-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
   const base = {
@@ -283,7 +284,7 @@ test('warns on same-company role matches and serializes concurrent duplicate sub
 test('records structured outcomes idempotently without duplicate rows', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-outcomes-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   await writeFile(join(directory, 'applications.ndjson'), `${JSON.stringify({
     id: 'example-role-1', company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 88,
@@ -306,7 +307,7 @@ test('records structured outcomes idempotently without duplicate rows', async (t
 test('records bounded interview quality and failure-point enrichment idempotently', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-interview-quality-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   await writeFile(join(directory, 'applications.ndjson'), `${JSON.stringify({
     id: 'example-role-1', company: 'Example', role: 'Staff Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 91,
@@ -391,7 +392,7 @@ test('preserves interview quality after a later final outcome', () => {
 test('acknowledges a generated review only through the explicit CLI command', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-review-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   const entries = Array.from({ length: 10 }, (_, index) => ({
     id: `role-${index}`, company: `Company ${index}`, role: 'Senior Engineer', url: `https://jobs.example.com/${index}`,
@@ -414,6 +415,7 @@ test('maps commands and durations to bounded telemetry categories', () => {
   assert.equal(commandCategory(['ledger', 'add', '--stdin']), 'apply');
   assert.equal(commandCategory(['ledger', 'outcome', '--stdin']), 'outcome');
   assert.equal(commandCategory(['score', '--stdin']), 'assess');
+  assert.equal(commandCategory(['sources', 'list']), 'search');
   assert.equal(durationBucket(700), 'under-1s');
   assert.equal(durationBucket(70_000), '1-2m');
   assert.equal(durationBucket(2_000_000), '15m-plus');
@@ -436,11 +438,11 @@ test('builds a structured assessment event without description or candidate prof
 test('telemetry CLI controls are private and reset removes anonymous credentials', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-telemetry-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
-  const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_TELEMETRY_URL: 'https://relay.invalid' };
   const disabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'disable'], { env, encoding: 'utf8' }));
   assert.equal(disabled.enabled, false);
   const reset = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'reset'], { env, encoding: 'utf8' }));
   assert.equal(reset.hasInstallationId, false);
-  assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
 });

package/job-application-agent/tests/privacy-audit.test.mjs

@@ -3,6 +3,7 @@ import test from 'node:test';
 
 import { prepareTelemetryInput } from '../scripts/telemetry-client.mjs';
 import { validateEvent } from '../scripts/telemetry-schema.mjs';
+import { normalizeCommunitySource } from '../scripts/source-community-schema.mjs';
 
 const forbiddenProperties = [
   'name', 'email', 'phone', 'exactAddress', 'linkedin', 'github', 'portfolio', 'candidateLocation',
@@ -40,3 +41,18 @@ test('privacy audit strips the full query and fragment before job URL hashing',
   assert.equal(serialized.includes('secret'), false);
   assert.equal(serialized.includes('jobs.example.com/role/123'), false);
 });
+
+test('privacy audit strips identity-bearing source parameters and rejects personal source metadata', () => {
+  const source = normalizeCommunitySource({
+    name: 'Example Engineering Board',
+    baseUrl: 'https://jobs.example.org/openings/engineering?email=candidate@example.com&token=secret#private',
+    kind: 'job-board',
+    regions: ['global'],
+    roleFamilies: ['engineering'],
+    requiresSession: false,
+  });
+  assert.equal(source.baseUrl, 'https://jobs.example.org/openings/engineering');
+  assert.equal(JSON.stringify(source).includes('candidate@example.com'), false);
+  assert.throws(() => normalizeCommunitySource({ ...source, name: 'candidate@example.com' }), /identity/i);
+  assert.throws(() => normalizeCommunitySource({ ...source, baseUrl: 'https://linkedin.com/in/candidate' }), /profile or personal/i);
+});