job-application-agent 3.1.0 → 3.1.2

package/job-application-agent/tests/workflow-state.test.mjs

@@ -1,11 +1,14 @@
 import assert from 'node:assert/strict';
-import { execFileSync, spawnSync } from 'node:child_process';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
+import { fileURLToPath } from 'node:url';
 
-const script = new URL('../scripts/job-application.mjs', import.meta.url).pathname;
+import { sourcesSync } from '../scripts/job-application.mjs';
+
+const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
 
 async function fixture(t, label) {
   const directory = await mkdtemp(join(tmpdir(), `public-job-agent-${label}-`));
@@ -17,7 +20,7 @@ async function fixture(t, label) {
     graceConsumed: true,
     installationEventPending: false,
   }));
-  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory } };
+  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' } };
 }
 
 function cli(env, args, input) {
@@ -36,6 +39,18 @@ function cliFailure(env, args, input) {
   });
 }
 
+function cliConcurrent(env, args, input) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [script, ...args], { env });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8').on('data', (chunk) => { stdout += chunk; });
+    child.stderr.setEncoding('utf8').on('data', (chunk) => { stderr += chunk; });
+    child.on('close', (status) => resolve({ status, stdout, stderr }));
+    child.stdin.end(JSON.stringify(input));
+  });
+}
+
 function submission(index, roundId, overrides = {}) {
   return {
     id: `round-role-${index}`,
@@ -69,7 +84,7 @@ test('persists a scoped autonomy grant and revokes future routine transmissions'
   const status = cli(env, ['autonomy', 'status']);
   assert.equal(status.enabled, true);
   assert.equal(status.mode, 'routine-auto');
-  assert.equal((await stat(join(directory, 'autonomy.json'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'autonomy.json'))).mode & 0o777, 0o600);
 
   const preview = cli(env, ['autonomy', 'preview']);
   assert.equal(preview.maySubmitRoutineApplications, true);
@@ -112,7 +127,379 @@ test('counts only unique confirmed ledger submissions for an explicit round', as
   const roundEvents = (await readFile(join(directory, 'rounds.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
   assert.equal(roundEvents.filter((event) => event.type === 'submission-confirmed').length, 30);
   assert.equal(roundEvents.length, 32);
-  assert.equal((await stat(join(directory, 'rounds.ndjson'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'rounds.ndjson'))).mode & 0o777, 0o600);
+});
+
+test('ships a filterable global discovery source catalog and tracks source attribution', async (t) => {
+  const { directory, env } = await fixture(t, 'source-catalog');
+  const catalog = cli(env, ['sources', 'list']);
+  const yc = catalog.sources.find((source) => source.id === 'yc-work-at-a-startup');
+
+  assert.ok(yc);
+  assert.equal(yc.kind, 'startup-network');
+  assert.equal(yc.requiresSession, true);
+  assert.equal(yc.verification, 'direct-employer-or-ats');
+
+  const filtered = cli(env, ['sources', 'list', '--stdin'], {
+    regions: ['global'],
+    roleFamilies: ['engineering'],
+  });
+  assert.ok(filtered.sources.some((source) => source.id === 'yc-work-at-a-startup'));
+
+  cli(env, ['ledger', 'add', '--stdin'], {
+    id: 'catalog-sourced-role',
+    company: 'Catalog Example',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.catalog.example/staff-product-engineer',
+    source: 'company',
+    discoverySource: 'yc',
+    discoverySourceId: 'yc-work-at-a-startup',
+    applicationChannel: 'company',
+    score: 90,
+    status: 'submitted',
+    submittedAt: new Date().toISOString(),
+    approval: 'STANDING AUTHORIZATION',
+    answers: {},
+  });
+  const [stored] = (await readFile(join(directory, 'applications.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal(stored.discoverySourceId, 'yc-work-at-a-startup');
+
+  const invalidSource = cliFailure(env, ['ledger', 'add', '--stdin'], {
+    id: 'catalog-mistyped-source-role',
+    company: 'Catalog Example Two',
+    role: 'Senior Product Engineer',
+    url: 'https://jobs.catalog.example/senior-product-engineer',
+    source: 'company',
+    discoverySource: 'job-board',
+    discoverySourceId: 'employable-al',
+    applicationChannel: 'company',
+    score: 85,
+    status: 'submitted',
+    submittedAt: new Date().toISOString(),
+    approval: 'STANDING AUTHORIZATION',
+    answers: {},
+  });
+  assert.equal(invalidSource.status, 1);
+  assert.match(invalidSource.stderr, /packaged source catalog/i);
+});
+
+test('queues sanitized repeatable source suggestions locally for public-registry review', async (t) => {
+  const { directory, env } = await fixture(t, 'source-suggestions');
+  const suggestion = cli(env, ['sources', 'suggest', '--stdin'], {
+    name: 'Example Engineering Board',
+    baseUrl: 'https://jobs.example.org/openings/engineering?term=software&ref=candidate@example.com&token=private#apply',
+    kind: 'job-board',
+    regions: ['global'],
+    roleFamilies: ['engineering'],
+    requiresSession: false,
+  });
+
+  assert.equal(suggestion.queued, true);
+  assert.equal(suggestion.suggestion.baseUrl, 'https://jobs.example.org/openings/engineering');
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'source-suggestions.ndjson'))).mode & 0o777, 0o600);
+
+  const pending = cli(env, ['sources', 'pending']);
+  assert.equal(pending.scope, 'local-unsent');
+  assert.equal(pending.count, 1);
+  assert.equal(pending.suggestions[0].name, 'Example Engineering Board');
+
+  const rejected = cliFailure(env, ['sources', 'suggest', '--stdin'], {
+    name: 'Personal referral',
+    baseUrl: 'https://linkedin.com/in/some-person',
+    kind: 'user-supplied',
+    regions: ['global'],
+    roleFamilies: ['engineering'],
+    requiresSession: true,
+  });
+  assert.equal(rejected.status, 1);
+  assert.match(rejected.stderr, /profile or personal URL/i);
+});
+
+test('exposes independent opt-out controls for default community source sharing', async (t) => {
+  const { directory, env } = await fixture(t, 'source-sharing-controls');
+  const initial = cli(env, ['sources', 'sharing', 'status']);
+  assert.equal(initial.enabled, true);
+
+  const disabled = cli(env, ['sources', 'sharing', 'disable']);
+  assert.equal(disabled.enabled, false);
+  assert.equal(disabled.hasInstallationId, false);
+
+  const suggestion = cli(env, ['sources', 'suggest', '--stdin'], {
+    name: 'Example Engineering Board',
+    baseUrl: 'https://jobs.example.org/openings/engineering',
+    kind: 'job-board',
+    regions: ['global'],
+    roleFamilies: ['engineering'],
+    requiresSession: false,
+  });
+  assert.equal(suggestion.queued, true);
+  assert.deepEqual(suggestion.community, { shared: false, reason: 'disabled' });
+  assert.equal(cli(env, ['sources', 'pending']).count, 1);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'source-sharing.json'))).mode & 0o777, 0o600);
+});
+
+test('source sync counts only the contribution actually attempted before an unavailable relay stops the queue', async (t) => {
+  const { directory, env } = await fixture(t, 'source-sync-attempts');
+  const previous = process.env.JOB_APPLICATION_AGENT_STATE_DIR;
+  process.env.JOB_APPLICATION_AGENT_STATE_DIR = directory;
+  t.after(() => {
+    if (previous == null) delete process.env.JOB_APPLICATION_AGENT_STATE_DIR;
+    else process.env.JOB_APPLICATION_AGENT_STATE_DIR = previous;
+  });
+  const suggestion = (id, baseUrl) => ({
+    type: 'suggested', id, name: `Source ${id}`, baseUrl, kind: 'job-board',
+    regions: ['global'], roleFamilies: ['engineering'], requiresSession: false,
+    createdAt: new Date().toISOString(),
+  });
+  await writeFile(join(directory, 'source-suggestions.ndjson'), [
+    JSON.stringify(suggestion('source-suggestion-one', 'https://one.example.com/openings')),
+    JSON.stringify(suggestion('source-suggestion-two', 'https://two.example.com/openings')),
+  ].join('\n').concat('\n'));
+  let calls = 0;
+
+  const result = await sourcesSync({
+    contribute: async () => {
+      calls += 1;
+      return { shared: false, reason: 'unavailable' };
+    },
+  });
+
+  assert.equal(calls, 1);
+  assert.deepEqual(result, { attempted: 1, shared: 0, remaining: 2 });
+});
+
+test('blocks a different role at the same company during the 15-day cooldown', async (t) => {
+  const { env } = await fixture(t, 'company-cooldown-enforced');
+  const recent = new Date(Date.now() - (5 * 86_400_000)).toISOString();
+  const now = new Date().toISOString();
+  cli(env, ['ledger', 'add', '--stdin'], submission(100, undefined, {
+    id: 'example-backend-role',
+    company: 'Example',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/backend-100',
+    employerJobId: 'example:backend-100',
+    submittedAt: recent,
+  }));
+
+  const check = cli(env, ['ledger', 'check', '--stdin'], {
+    id: 'example-product-role',
+    company: 'Example',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/product-101',
+    employerJobId: 'example:product-101',
+  });
+  assert.equal(check.companyReapply.decision, 'cooldown-active');
+  assert.equal(check.companyReapply.eligible, false);
+
+  const blocked = cliFailure(env, ['ledger', 'add', '--stdin'], submission(101, undefined, {
+    id: 'example-product-role',
+    company: 'Example',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/product-101',
+    employerJobId: 'example:product-101',
+    submittedAt: now,
+  }));
+
+  assert.equal(blocked.status, 1);
+  assert.match(blocked.stderr, /reapplication cooldown is active/i);
+  assert.match(blocked.stderr, /CANDIDATE APPROVED EARLY REAPPLICATION/);
+});
+
+test('records bounded evidence for an explicitly approved early reapplication', async (t) => {
+  const { directory, env } = await fixture(t, 'company-cooldown-override');
+  const recent = new Date(Date.now() - (5 * 86_400_000)).toISOString();
+  const now = new Date().toISOString();
+  cli(env, ['ledger', 'add', '--stdin'], submission(110, undefined, {
+    id: 'override-backend-role',
+    company: 'Override Co',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/override-backend-110',
+    submittedAt: recent,
+  }));
+
+  const result = cli(env, ['ledger', 'add', '--stdin'], {
+    ...submission(111, undefined, {
+      id: 'override-product-role',
+      company: 'Override Co',
+      role: 'Staff Product Engineer',
+      url: 'https://jobs.example.com/override-product-111',
+      submittedAt: now,
+    }),
+    companyReapplyOverride: 'CANDIDATE APPROVED EARLY REAPPLICATION',
+  });
+
+  assert.equal(result.recorded, 'override-product-role');
+  const stored = (await readFile(join(directory, 'applications.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal(stored[1].reapplicationApproval, 'candidate-explicit');
+  assert.equal(JSON.stringify(stored).includes('CANDIDATE APPROVED EARLY REAPPLICATION'), false);
+  assert.equal('companyReapplyOverride' in stored[1], false);
+});
+
+test('requires explicit approval when the latest company application has a follow-up', async (t) => {
+  const { directory, env } = await fixture(t, 'company-follow-up-override');
+  const old = new Date(Date.now() - (30 * 86_400_000)).toISOString();
+  const followUp = new Date(Date.now() - (20 * 86_400_000)).toISOString();
+  const now = new Date().toISOString();
+  cli(env, ['ledger', 'add', '--stdin'], submission(120, undefined, {
+    id: 'follow-up-backend-role',
+    company: 'Follow Up Co',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/follow-up-backend-120',
+    submittedAt: old,
+  }));
+  cli(env, ['ledger', 'outcome', '--stdin'], {
+    id: 'follow-up-backend-role',
+    status: 'rejected',
+    occurredAt: followUp,
+  });
+
+  const candidate = submission(121, undefined, {
+    id: 'follow-up-product-role',
+    company: 'Follow Up Co',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/follow-up-product-121',
+    submittedAt: now,
+  });
+  const blocked = cliFailure(env, ['ledger', 'add', '--stdin'], candidate);
+  assert.equal(blocked.status, 1);
+  assert.match(blocked.stderr, /recorded follow-up/i);
+
+  const result = cli(env, ['ledger', 'add', '--stdin'], {
+    ...candidate,
+    companyReapplyOverride: 'CANDIDATE APPROVED EARLY REAPPLICATION',
+  });
+  assert.equal(result.recorded, 'follow-up-product-role');
+  const stored = (await readFile(join(directory, 'applications.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal(stored[1].reapplicationApproval, 'candidate-explicit');
+});
+
+test('allows a genuinely different role after 15 full quiet days', async (t) => {
+  const { env } = await fixture(t, 'company-cooldown-complete');
+  const old = new Date(Date.now() - (16 * 86_400_000)).toISOString();
+  cli(env, ['ledger', 'add', '--stdin'], submission(130, undefined, {
+    id: 'quiet-backend-role',
+    company: 'Quiet Co',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/quiet-backend-130',
+    submittedAt: old,
+  }));
+
+  const check = cli(env, ['ledger', 'check', '--stdin'], {
+    id: 'quiet-product-role',
+    company: 'Quiet Co',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/quiet-product-131',
+    employerJobId: 'example:quiet-product-131',
+  });
+  assert.equal(check.companyReapply.decision, 'eligible-after-cooldown');
+  assert.equal(check.companyReapply.eligible, true);
+
+  const result = cli(env, ['ledger', 'add', '--stdin'], submission(131, undefined, {
+    id: 'quiet-product-role',
+    company: 'Quiet Co',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/quiet-product-131',
+    employerJobId: 'example:quiet-product-131',
+    submittedAt: new Date().toISOString(),
+  }));
+  assert.equal(result.recorded, 'quiet-product-role');
+});
+
+test('requires the requisition override for same-role aliases', async (t) => {
+  const { directory, env } = await fixture(t, 'same-role-alias');
+  const recent = new Date(Date.now() - (2 * 86_400_000)).toISOString();
+  cli(env, ['ledger', 'add', '--stdin'], submission(140, undefined, {
+    id: 'alias-backend-original',
+    company: 'Alias Co',
+    role: 'Senior Backend Developer',
+    url: 'https://jobs.example.com/alias-backend-140',
+    employerJobId: 'alias:140',
+    submittedAt: recent,
+  }));
+  const candidate = submission(141, undefined, {
+    id: 'alias-backend-new',
+    company: 'Alias Co',
+    role: 'Sr Backend Engineer',
+    url: 'https://jobs.example.com/alias-backend-141',
+    employerJobId: 'alias:141',
+    submittedAt: new Date().toISOString(),
+  });
+
+  const blocked = cliFailure(env, ['ledger', 'add', '--stdin'], candidate);
+  assert.equal(blocked.status, 1);
+  assert.match(blocked.stderr, /NEW REQUISITION CONFIRMED/);
+  const result = cli(env, ['ledger', 'add', '--stdin'], {
+    ...candidate,
+    duplicateOverride: 'NEW REQUISITION CONFIRMED',
+  });
+  assert.equal(result.recorded, 'alias-backend-new');
+  const stored = (await readFile(join(directory, 'applications.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal('reapplicationApproval' in stored[1], false);
+});
+
+test('never permits hard duplicates even when both override phrases are supplied', async (t) => {
+  const { env } = await fixture(t, 'hard-duplicates');
+  const original = submission(150, undefined, {
+    id: 'hard-original',
+    company: 'Hard Duplicate Co',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/hard-original',
+    employerJobId: 'hard:150',
+    submittedAt: new Date(Date.now() - (30 * 86_400_000)).toISOString(),
+  });
+  cli(env, ['ledger', 'add', '--stdin'], original);
+  const overrides = {
+    duplicateOverride: 'NEW REQUISITION CONFIRMED',
+    companyReapplyOverride: 'CANDIDATE APPROVED EARLY REAPPLICATION',
+    submittedAt: new Date().toISOString(),
+  };
+  const candidates = [
+    { ...submission(151, undefined), ...overrides, id: original.id, company: original.company },
+    { ...submission(152, undefined), ...overrides, company: original.company, url: original.url },
+    { ...submission(153, undefined), ...overrides, company: original.company, employerJobId: original.employerJobId },
+  ];
+
+  const messages = [/matching ledger ID/, /matching canonical URL/, /matching employer job ID or requisition/];
+  for (const [index, candidate] of candidates.entries()) {
+    const blocked = cliFailure(env, ['ledger', 'add', '--stdin'], candidate);
+    assert.equal(blocked.status, 1);
+    assert.match(blocked.stderr, /Hard duplicate blocked/);
+    assert.match(blocked.stderr, messages[index]);
+  }
+});
+
+test('serializes concurrent company writes so the cooldown cannot be bypassed', async (t) => {
+  const { directory, env } = await fixture(t, 'concurrent-company-cooldown');
+  cli(env, ['ledger', 'add', '--stdin'], submission(160, undefined, {
+    id: 'concurrent-backend-role',
+    company: 'Concurrent Co',
+    role: 'Senior Backend Engineer',
+    url: 'https://jobs.example.com/concurrent-backend-160',
+    submittedAt: new Date(Date.now() - (16 * 86_400_000)).toISOString(),
+  }));
+  const first = submission(161, undefined, {
+    id: 'concurrent-product-role',
+    company: 'Concurrent Co',
+    role: 'Staff Product Engineer',
+    url: 'https://jobs.example.com/concurrent-product-161',
+    submittedAt: new Date().toISOString(),
+  });
+  const second = submission(162, undefined, {
+    id: 'concurrent-data-role',
+    company: 'Concurrent Co',
+    role: 'Principal Data Engineer',
+    url: 'https://jobs.example.com/concurrent-data-162',
+    submittedAt: new Date().toISOString(),
+  });
+
+  const results = await Promise.all([
+    cliConcurrent(env, ['ledger', 'add', '--stdin'], first),
+    cliConcurrent(env, ['ledger', 'add', '--stdin'], second),
+  ]);
+  assert.deepEqual(results.map((result) => result.status).sort(), [0, 1]);
+  assert.match(results.find((result) => result.status === 1).stderr, /reapplication cooldown is active/i);
+  const stored = (await readFile(join(directory, 'applications.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal(stored.length, 2);
 });
 
 test('does not complete a round from blocked or partially filled applications', async (t) => {
@@ -156,7 +543,7 @@ test('replays and prioritizes an owner-only attention queue', async (t) => {
 
   const before = cli(env, ['attention', 'list']);
   assert.deepEqual(before.items.map((item) => item.id), [captcha.id, judgment.id]);
-  assert.equal((await stat(join(directory, 'attention.ndjson'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'attention.ndjson'))).mode & 0o777, 0o600);
 
   cli(env, ['attention', 'resolve', '--stdin'], { id: captcha.id });
   const after = cli(env, ['attention', 'list']);
@@ -185,7 +572,7 @@ test('qualifies only reproducible general-purpose friction for a public PR', asy
   const listed = cli(env, ['friction', 'list']);
   assert.equal(listed.items.length, 2);
   assert.deepEqual(listed.prCandidates.map((item) => item.id), [general.id]);
-  assert.equal((await stat(join(directory, 'friction.ndjson'))).mode & 0o777, 0o600);
+  if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'friction.ndjson'))).mode & 0o777, 0o600);
   assert.equal((await readFile(join(directory, 'friction.ndjson'), 'utf8')).includes('candidate@example.com'), false);
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.1.0",
+  "version": "3.1.2",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",
@@ -34,13 +34,17 @@
     "provenance": true
   },
   "scripts": {
-    "test": "node --test job-application-agent/tests/*.test.mjs telemetry-worker/tests/*.test.mjs installer/tests/*.test.mjs",
+    "test": "node --test",
+    "check:native-artifacts": "node scripts/ci/validate-native-artifacts.mjs",
     "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check bin/job-application-agent.mjs",
+    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs",
     "prepack": "npm run check && npm test && npm run privacy-audit"
   },
   "engines": {
     "node": ">=20"
+  },
+  "devDependencies": {
+    "yaml": "2.9.0"
   }
 }