job-application-agent 3.1.0 → 3.1.2

package/job-application-agent/tests/source-community-client.test.mjs

@@ -0,0 +1,245 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { SourceCommunityClient } from '../scripts/source-community-client.mjs';
+
+const source = {
+  name: 'Example Engineering Board',
+  baseUrl: 'https://jobs.example.org/openings/engineering?ref=candidate@example.com#openings',
+  kind: 'job-board',
+  regions: ['global', 'remote'],
+  roleFamilies: ['engineering'],
+  requiresSession: false,
+};
+
+function relay() {
+  const requests = [];
+  const community = [{
+    sourceId: 'community-abcdef1234567890',
+    name: 'Example Engineering Board',
+    baseUrl: 'https://jobs.example.org/openings/engineering',
+    kind: 'job-board',
+    regions: ['global', 'remote'],
+    roleFamilies: ['engineering'],
+    requiresSession: false,
+    registryStatus: 'community-reviewed',
+    contributionCount: 2,
+  }];
+  const fetch = async (url, options = {}) => {
+    requests.push({ url, options, body: options.body ? JSON.parse(options.body) : null });
+    if (url.endsWith('/v1/install')) return Response.json({ installationId: '11111111-1111-4111-8111-111111111111', token: 'source-token', expiresAt: '2099-01-01T00:00:00.000Z' }, { status: 201 });
+    if (url.endsWith('/v1/sources') && options.method === 'POST') return Response.json({ accepted: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 }, { status: 202 });
+    return Response.json({ version: 1, sources: community });
+  };
+  return { fetch, requests };
+}
+
+test('source sharing is enabled by default, disclosed, sanitized, and sent immediately', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-default-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  let notice = '';
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: (value) => { notice += value; } });
+
+  const result = await client.contribute(source);
+
+  assert.deepEqual(result, { shared: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 });
+  assert.match(notice, /community source sharing is enabled by default/i);
+  assert.equal(network.requests.length, 2);
+  assert.equal(network.requests[1].url, 'https://relay.example.com/v1/sources');
+  assert.equal(network.requests[1].body.source.baseUrl, 'https://jobs.example.org/openings/engineering');
+  assert.equal(JSON.stringify(network.requests[1].body).includes('candidate@example.com'), false);
+  const stored = JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8'));
+  assert.equal(stored.enabled, true);
+  assert.equal(stored.disclosed, true);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'source-sharing.json'))).mode & 0o777, 0o600);
+});
+
+test('community source listing validates the public response before reuse', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-list-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+  const [listed] = await client.list();
+  assert.equal(listed.sourceId, 'community-abcdef1234567890');
+  assert.equal(listed.baseUrl, 'https://jobs.example.org/openings/engineering');
+  assert.equal(listed.contributionCount, 2);
+  assert.equal(listed.registryStatus, 'community-reviewed');
+});
+
+test('source sharing can be disabled independently and never blocks local collection', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-disabled-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+
+  assert.equal((await client.configure('disable')).enabled, false);
+  assert.deepEqual(await client.contribute(source), { shared: false, reason: 'disabled' });
+  assert.equal(network.requests.length, 0);
+  assert.equal((await client.configure('enable')).enabled, true);
+  assert.equal((await client.contribute(source)).shared, true);
+});
+
+test('source sharing rejects personal and one-off job URLs before network transmission', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-reject-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+
+  await assert.rejects(() => client.preview({ ...source, baseUrl: 'https://linkedin.com/in/some-person' }), /profile or personal/i);
+  await assert.rejects(() => client.preview({ ...source, baseUrl: 'https://jobs.example.org/jobs/123456' }), /repeatable discovery surface/i);
+  await assert.rejects(() => client.preview({ ...source, baseUrl: 'https://jobs.example.org/candidate@example.com/openings' }), /identity-like content/i);
+  await assert.rejects(() => client.preview({ ...source, baseUrl: 'https://127.0.0.1/jobs' }), /public internet hostname/i);
+  await assert.rejects(() => client.preview({ ...source, baseUrl: 'https://careers.internal.local/jobs' }), /public internet hostname/i);
+  assert.equal(network.requests.length, 0);
+});
+
+test('network failures are best effort and return an unavailable result', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-offline-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: async () => { throw new Error('offline'); }, stderr: () => {} });
+  assert.deepEqual(await client.contribute(source), { shared: false, reason: 'unavailable' });
+});
+
+test('a failed contribution does not suppress a healthy community registry read', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-independent-read-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  const fetch = async (url, options = {}) => {
+    if (url.endsWith('/v1/sources') && options.method === 'POST') return Response.json({ error: 'rate_limited' }, { status: 429 });
+    return network.fetch(url, options);
+  };
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+
+  assert.deepEqual(await client.contribute(source), { shared: false, reason: 'unavailable' });
+  const [listed] = await client.list();
+  assert.equal(listed.sourceId, 'community-abcdef1234567890');
+});
+
+test('concurrent opt-out is preserved and rechecked before source transmission', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-opt-out-race-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, 'source-sharing.json'), JSON.stringify({
+    version: 1,
+    enabled: true,
+    disclosed: true,
+    installationId: null,
+    token: null,
+    tokenExpiresAt: null,
+  }));
+  let releaseInstall;
+  let installStarted;
+  const installGate = new Promise((resolve) => { releaseInstall = resolve; });
+  const installObserved = new Promise((resolve) => { installStarted = resolve; });
+  const sourcePosts = [];
+  const fetch = async (url, options = {}) => {
+    if (url.endsWith('/v1/install')) {
+      installStarted();
+      await installGate;
+      return Response.json({ installationId: '11111111-1111-4111-8111-111111111111', token: 'source-token', expiresAt: '2099-01-01T00:00:00.000Z' }, { status: 201 });
+    }
+    sourcePosts.push({ url, options });
+    return Response.json({ accepted: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 }, { status: 202 });
+  };
+  const contributor = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+  const settings = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+
+  const contribution = contributor.contribute(source);
+  await installObserved;
+  assert.equal((await settings.configure('disable')).enabled, false);
+  releaseInstall();
+
+  assert.deepEqual(await contribution, { shared: false, reason: 'disabled' });
+  assert.equal(sourcePosts.length, 0);
+  assert.equal(JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8')).enabled, false);
+});
+
+test('concurrent reset is not undone by an in-flight credential refresh', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-reset-race-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, 'source-sharing.json'), JSON.stringify({
+    version: 1,
+    enabled: true,
+    disclosed: true,
+    installationId: null,
+    token: null,
+    tokenExpiresAt: null,
+  }));
+  let releaseInstall;
+  let installStarted;
+  const installGate = new Promise((resolve) => { releaseInstall = resolve; });
+  const installObserved = new Promise((resolve) => { installStarted = resolve; });
+  const fetch = async (url) => {
+    if (!url.endsWith('/v1/install')) throw new Error('source contribution must remain disabled');
+    installStarted();
+    await installGate;
+    return Response.json({ installationId: '11111111-1111-4111-8111-111111111111', token: 'source-token', expiresAt: '2099-01-01T00:00:00.000Z' }, { status: 201 });
+  };
+  const contributor = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+  const settings = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+
+  const contribution = contributor.contribute(source);
+  await installObserved;
+  assert.deepEqual(await settings.configure('reset'), {
+    enabled: false,
+    disclosed: true,
+    hasInstallationId: false,
+    endpoint: 'https://relay.example.com',
+    schemaVersion: 1,
+  });
+  releaseInstall();
+
+  assert.deepEqual(await contribution, { shared: false, reason: 'disabled' });
+  const stored = JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8'));
+  assert.equal(stored.enabled, false);
+  assert.equal(stored.installationId, null);
+  assert.equal(stored.token, null);
+  assert.equal(stored.tokenExpiresAt, null);
+});
+
+test('recovers a source-sharing lock whose owner process no longer exists', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-stale-lock-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, '.source-sharing.lock'), '99999999\n');
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: async () => { throw new Error('network must not be used'); }, stderr: () => {} });
+
+  assert.equal((await client.configure('disable')).enabled, false);
+  await assert.rejects(() => stat(join(directory, '.source-sharing.lock')), { code: 'ENOENT' });
+});
+
+test('invalid stored relay credentials are replaced once and persisted', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-credential-recovery-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const oldInstallationId = '11111111-1111-4111-8111-111111111111';
+  const newInstallationId = '22222222-2222-4222-8222-222222222222';
+  await writeFile(join(directory, 'source-sharing.json'), JSON.stringify({
+    version: 1,
+    enabled: true,
+    disclosed: true,
+    installationId: oldInstallationId,
+    token: 'invalid-old-token',
+    tokenExpiresAt: '2099-01-01T00:00:00.000Z',
+  }));
+  const requests = [];
+  const fetch = async (url, options = {}) => {
+    const body = options.body ? JSON.parse(options.body) : null;
+    requests.push({ url, body });
+    if (url.endsWith('/v1/sources') && body.installationId === oldInstallationId) return Response.json({ error: 'invalid_token' }, { status: 401 });
+    if (url.endsWith('/v1/install') && body.installationId === oldInstallationId) return Response.json({ error: 'invalid_token' }, { status: 401 });
+    if (url.endsWith('/v1/install')) return Response.json({ installationId: newInstallationId, token: 'new-token', expiresAt: '2099-01-01T00:00:00.000Z' }, { status: 201 });
+    return Response.json({ accepted: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 }, { status: 202 });
+  };
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch, stderr: () => {} });
+
+  const result = await client.contribute(source);
+
+  assert.equal(result.shared, true);
+  assert.ok(requests.some((request) => request.url.endsWith('/v1/install') && request.body.installationId === oldInstallationId));
+  assert.ok(requests.some((request) => request.url.endsWith('/v1/install') && Object.keys(request.body).length === 0));
+  const stored = JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8'));
+  assert.equal(stored.installationId, newInstallationId);
+  assert.equal(stored.token, 'new-token');
+});

package/job-application-agent/tests/source-community-schema.test.mjs

@@ -0,0 +1,166 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { communitySourceId, isRepeatableCommunitySourceRoute, normalizeCommunitySource } from '../scripts/source-community-schema.mjs';
+
+const source = {
+  name: 'Example Jobs',
+  baseUrl: 'https://example.com/',
+  kind: 'job-board',
+  regions: ['global'],
+  roleFamilies: ['engineering'],
+  requiresSession: false,
+};
+
+test('rejects known ATS and network job-detail routes', () => {
+  const detailUrls = [
+    'https://example.wd5.myworkdayjobs.com/en-US/jobs/job/Bengaluru/Senior-Engineer_R-12345',
+    'https://www.linkedin.com/jobs/view/1234567890',
+    'https://job-boards.greenhouse.io/example/jobs/1234567',
+    'https://jobs.lever.co/example/12345678-1234-4123-8123-123456789abc',
+    'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc',
+    'https://apply.workable.com/example/j/ABC123DEF4/',
+    'https://jobs.smartrecruiters.com/Example/123456789-senior-engineer',
+  ];
+
+  for (const baseUrl of detailUrls) {
+    assert.equal(isRepeatableCommunitySourceRoute(new URL(baseUrl)), false, baseUrl);
+    assert.throws(
+      () => normalizeCommunitySource({ ...source, baseUrl }),
+      /repeatable discovery surface|identity-like content/i,
+      baseUrl,
+    );
+  }
+});
+
+test('accepts roots and recognizable collection, directory, feed, careers, openings, and job-index routes', () => {
+  const collectionUrls = [
+    'https://example.com/',
+    'https://example.com/careers',
+    'https://example.com/openings/engineering',
+    'https://example.com/jobs/search',
+    'https://example.com/job-index',
+    'https://example.com/community/directory',
+    'https://example.com/hiring/feed.xml',
+    'https://example.wd5.myworkdayjobs.com/en-US/jobs',
+    'https://www.linkedin.com/jobs/search',
+    'https://job-boards.greenhouse.io/example',
+    'https://jobs.lever.co/example',
+    'https://jobs.ashbyhq.com/example',
+    'https://apply.workable.com/example',
+    'https://jobs.smartrecruiters.com/Example',
+  ];
+
+  for (const baseUrl of collectionUrls) {
+    assert.equal(isRepeatableCommunitySourceRoute(new URL(baseUrl)), true, baseUrl);
+    assert.equal(normalizeCommunitySource({ ...source, baseUrl }).baseUrl, baseUrl.replace(/\/$/, ''), baseUrl);
+  }
+});
+
+test('fails closed for unknown non-collection paths and strips collection queries and fragments', () => {
+  for (const baseUrl of ['https://example.com/software-engineer', 'https://example.com/jobs/senior-software-engineer']) {
+    assert.equal(isRepeatableCommunitySourceRoute(new URL(baseUrl)), false, baseUrl);
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /repeatable discovery surface/i);
+  }
+
+  const normalized = normalizeCommunitySource({
+    ...source,
+    baseUrl: 'https://example.com/openings/engineering?email=candidate@example.com&token=secret#jobs',
+  });
+  assert.equal(normalized.baseUrl, 'https://example.com/openings/engineering');
+  assert.equal(JSON.stringify(normalized).includes('candidate@example.com'), false);
+});
+
+test('rejects identity-like path namespaces even when they contain a collection cue', () => {
+  for (const baseUrl of ['https://example.com/users/jane/openings', 'https://example.com/profile/jane/careers', 'https://x.com/jane/jobs']) {
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /profile or personal|identity-like/i, baseUrl);
+  }
+});
+
+test('rejects repeatedly encoded identity paths and identity-bearing taxonomy fields', () => {
+  assert.throws(
+    () => normalizeCommunitySource({ ...source, baseUrl: 'https://example.com/candidate%2540example.com/openings' }),
+    /identity-like/i,
+  );
+  assert.throws(() => normalizeCommunitySource({ ...source, regions: ['candidate@example.com'] }), /identity-like/i);
+  assert.throws(() => normalizeCommunitySource({ ...source, roleFamilies: ['+1 415 555 0100'] }), /identity-like/i);
+});
+
+test('rejects Unicode and compatibility-form email identities before sharing', () => {
+  const privateValues = [
+    { name: 'Jobs curated by josé@example.com' },
+    { regions: ['用户@example.com'] },
+    { regions: ['उपयोगकर्ता@example.com'] },
+    { roleFamilies: ['ｊｏｓｅ＠ｅｘａｍｐｌｅ．ｃｏｍ'] },
+    { baseUrl: 'https://example.com/%E7%94%A8%E6%88%B7%40example.com/openings' },
+  ];
+
+  for (const override of privateValues) {
+    assert.throws(() => normalizeCommunitySource({ ...source, ...override }), /identity-like/i);
+  }
+});
+
+test('rejects credential-like opaque path segments before source sharing', () => {
+  assert.throws(
+    () => normalizeCommunitySource({ ...source, baseUrl: 'https://example.com/feed/AbCdEfGhIjKlMnOpQrStUvWxYz/jobs' }),
+    /credential-like/i,
+  );
+});
+
+test('rejects JWT, key-value, and prefixed credentials in source paths', () => {
+  const credentialUrls = [
+    'https://example.com/feed/eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c/jobs',
+    'https://example.com/feed/token=AbCdEfGhIjKlMnOpQrStUvWxYz/jobs',
+    'https://example.com/feed/api_key.AbCdEfGhIjKlMnOpQrStUvWxYz/jobs',
+  ];
+
+  for (const baseUrl of credentialUrls) {
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /credential-like/i, baseUrl);
+  }
+});
+
+test('rejects phone identities written with Unicode decimal digits', () => {
+  const privateValues = [
+    { name: 'Jobs curated by +٩١ ٩٨٧٦٥ ٤٣٢١٠' },
+    { regions: ['+९१ ९८७६५ ४३२१०'] },
+    { baseUrl: 'https://example.com/%2B%D9%A9%D9%A1%20%D9%A9%D9%A8%D9%A7%D9%A6%D9%A5%20%D9%A4%D9%A3%D9%A2%D9%A1%D9%A0/jobs' },
+  ];
+
+  for (const override of privateValues) {
+    assert.throws(() => normalizeCommunitySource({ ...source, ...override }), /identity-like/i);
+  }
+});
+
+test('normalizes compatibility characters before personal-path classification', () => {
+  for (const baseUrl of ['https://example.com/ｐｒｏｆｉｌｅ/candidate/jobs', 'https://example.com/ｕｓｅｒ/candidate/jobs']) {
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /identity-like/i, baseUrl);
+  }
+});
+
+test('removes every trailing path separator when canonicalizing source URLs', async () => {
+  const canonical = normalizeCommunitySource({ ...source, baseUrl: 'https://example.com/jobs' });
+  const redundant = normalizeCommunitySource({ ...source, baseUrl: 'https://example.com/jobs///' });
+
+  assert.equal(redundant.baseUrl, canonical.baseUrl);
+  assert.equal(await communitySourceId(redundant), await communitySourceId(canonical));
+});
+
+test('normalizes trailing DNS root dots before rejecting private hosts', () => {
+  for (const baseUrl of ['https://localhost./jobs', 'https://service.local./careers', 'https://service.internal./openings']) {
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /public internet hostname/i, baseUrl);
+  }
+});
+
+test('rejects identity-like public hostnames after normalizing a trailing DNS root dot', () => {
+  for (const baseUrl of ['https://14155550100.example.org./jobs', 'https://candidate-14155550100.example.org/openings']) {
+    assert.throws(() => normalizeCommunitySource({ ...source, baseUrl }), /identity-like/i, baseUrl);
+  }
+});
+
+test('source IDs normalize scheme and hostname case while preserving path case', async () => {
+  const upperHost = await communitySourceId({ ...source, baseUrl: 'HTTPS://EXAMPLE.COM/Jobs' });
+  const lowerHost = await communitySourceId({ ...source, baseUrl: 'https://example.com/Jobs' });
+  const lowerPath = await communitySourceId({ ...source, baseUrl: 'https://example.com/jobs' });
+  assert.equal(upperHost, lowerHost);
+  assert.notEqual(upperHost, lowerPath);
+});

package/job-application-agent/tests/telemetry-client.test.mjs

@@ -30,7 +30,7 @@ test('new installations disclose and send the first event immediately', async (t
   assert.equal(result.sent, true);
   assert.equal(relay.requests.length, 3);
   assert.equal((await client.beginCommand('search')).installationEventPending, false);
-  assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
 });
 
 test('existing installations receive a one-command grace period without backfill', async (t) => {