job-application-agent 3.1.2 → 3.2.1

package/job-application-agent/scripts/source-community-schema.mjs

@@ -1,6 +1,9 @@
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const SOURCE_ID = /^community-[0-9a-f]{16}$/;
+const JOB_ID = /^community-job-[0-9a-f]{16}$/;
 export const SOURCE_KINDS = new Set(['direct-employer', 'professional-network', 'social-feed', 'startup-network', 'community-thread', 'job-board', 'curated-board', 'inbound', 'user-supplied']);
+export const COMMUNITY_JOB_CHANNELS = new Set(['linkedin', 'greenhouse', 'lever', 'ashby', 'workable', 'comeet', 'workday', 'rippling', 'smartrecruiters', 'google-form', 'company', 'email', 'other']);
+export const COMMUNITY_JOB_DISCOVERY_SOURCES = new Set(['direct-company', 'linkedin', 'x', 'yc', 'hacker-news', 'job-board', 'email', 'user-supplied', 'web-search', 'other']);
 
 function record(value, label) {
   if (!value || Array.isArray(value) || typeof value !== 'object') throw new Error(`${label} must be an object.`);
@@ -18,6 +21,10 @@ function containsIdentityLike(value) {
     || /\+?\p{Nd}[\p{Nd}\s().-]{7,}/u.test(normalized);
 }
 
+function containsEmailLike(value) {
+  return /[^\s/@]+@(?:[^\s./@]+\.)+[^\s./@]+/u.test(value.normalize('NFKC'));
+}
+
 function terms(value, label) {
   if (!Array.isArray(value) || value.length === 0 || value.length > 12) throw new Error(`${label} must be a non-empty array with at most 12 values.`);
   const normalized = value.map((item, index) => boundedString(item, `${label}[${index}]`, 40).toLowerCase());
@@ -33,7 +40,7 @@ function looksPersonal(url) {
 
 function looksIdentityPath(pathname) {
   const segments = pathname.split('/').filter(Boolean).map((segment) => segment.toLowerCase());
-  const namespaces = new Set(['user', 'users', 'profile', 'profiles', 'member', 'members', 'author', 'authors', 'person', 'people']);
+  const namespaces = new Set(['user', 'users', 'profile', 'profiles', 'member', 'members', 'author', 'authors', 'person', 'people', 'candidate', 'candidates', 'referral', 'referrals', 'referrer', 'referrers']);
   return segments.some((segment, index) => namespaces.has(segment) && index < segments.length - 1);
 }
 
@@ -67,10 +74,149 @@ function isPublicHostname(hostname) {
   return value.includes('.');
 }
 
+function isReservedExampleHostname(hostname) {
+  const value = hostname.toLowerCase();
+  return ['example.com', 'example.net', 'example.org'].some((suffix) => value === suffix || value.endsWith(`.${suffix}`));
+}
+
 function hostnameMatches(hostname, suffix) {
   return hostname === suffix || hostname.endsWith(`.${suffix}`);
 }
 
+function publicJobLabel(value, label, max) {
+  const result = boundedString(value, label, max);
+  if (containsIdentityLike(result) || /https?:\/\//i.test(result) || /[\x00-\x1f\x7f]/.test(result)) throw new Error(`${label} must not contain identity-like content.`);
+  return result;
+}
+
+function explicitCredentialPath(pathname) {
+  return pathname.split('/').filter(Boolean).some((segment) => {
+    const normalized = segment.normalize('NFKC');
+    return /^[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}$/.test(normalized)
+      || /^(?:access[-_]?token|api[-_]?key|auth(?:orization)?|bearer|client[-_]?secret|password|secret|token)(?:[=:.]|\s+)(?:bearer\s+)?[A-Za-z0-9._~+/=-]{8,}$/i.test(normalized)
+      || /^(?:cfat_|github_pat_|gh[pousr]_|[spr]k_(?:live|test)_|xox[baprs]-)[A-Za-z0-9_-]{8,}$/i.test(normalized);
+  });
+}
+
+function containsPhoneLikeLocation(hostname, pathname) {
+  if (containsIdentityLike(hostname)) return true;
+  return pathname.split('/').filter(Boolean).some((segment) => {
+    const normalized = segment.normalize('NFKC');
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(normalized)) return false;
+    const digits = normalized.match(/\p{Nd}/gu)?.length ?? 0;
+    const separators = normalized.match(/[\s().-]/gu)?.length ?? 0;
+    return digits >= 8 && (/\+\p{Nd}/u.test(normalized) || separators >= 2);
+  });
+}
+
+const STABLE_JOB_QUERY_KEYS = new Set([
+  'gh_jid', 'jk', 'job', 'job_id', 'jobid', 'req', 'req_id', 'reqid',
+  'requisition', 'requisition_id', 'requisitionid',
+]);
+
+function stableJobQuery(searchParams) {
+  const identifiers = new Map();
+  for (const [rawKey, rawValue] of searchParams) {
+    const key = rawKey.toLowerCase();
+    if (!STABLE_JOB_QUERY_KEYS.has(key)) continue;
+    const value = rawValue.normalize('NFKC').trim();
+    if (!/^[A-Za-z0-9._~-]{1,128}$/.test(value)) continue;
+    if (identifiers.has(key) && identifiers.get(key) !== value) throw new Error(`community job.url contains conflicting ${key} identifiers.`);
+    identifiers.set(key, value);
+  }
+  return [...identifiers].sort(([left], [right]) => left.localeCompare(right));
+}
+
+function providerUrl(url) {
+  const hostname = url.hostname.toLowerCase();
+  const segments = url.pathname.split('/').filter(Boolean);
+  if (hostnameMatches(hostname, 'greenhouse.io') && segments[0]) return `${url.origin}/${segments[0]}`;
+  if (['jobs.lever.co', 'jobs.ashbyhq.com', 'apply.workable.com', 'jobs.smartrecruiters.com'].includes(hostname) && segments[0]) return `${url.origin}/${segments[0]}`;
+  if (hostnameMatches(hostname, 'linkedin.com')) return `${url.origin}/jobs`;
+  return url.origin;
+}
+
+export function normalizeCommunityJob(input) {
+  const value = record(input, 'community job');
+  const allowed = new Set(['url', 'company', 'role', 'applicationChannel', 'discoverySource', 'providerUrl']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown community job property: ${key}.`);
+  const url = new URL(boundedString(value.url, 'community job.url', 2048));
+  if (url.protocol !== 'https:' || url.username || url.password) throw new Error('community job.url must be a public HTTPS URL.');
+  url.hostname = url.hostname.replace(/\.+$/, '').toLowerCase();
+  if (!isPublicHostname(url.hostname)) throw new Error('community job.url must use a public HTTPS hostname.');
+  if (isReservedExampleHostname(url.hostname)) throw new Error('community job.url must not use a reserved example hostname.');
+  const pathname = decodedPathname(url.pathname).normalize('NFKC');
+  url.pathname = pathname;
+  if (containsEmailLike(pathname) || containsPhoneLikeLocation(url.hostname, pathname) || looksIdentityPath(pathname) || looksPersonal(url)) throw new Error('community job.url must not be a personal URL.');
+  if (explicitCredentialPath(pathname)) throw new Error('community job.url must not contain credential-like path segments.');
+  const identifiers = stableJobQuery(url.searchParams);
+  url.pathname = pathname.replace(/\/+$/, '') || '/';
+  url.search = '';
+  for (const [key, identifier] of identifiers) url.searchParams.append(key, identifier);
+  url.hash = '';
+  const applicationChannel = boundedString(value.applicationChannel, 'community job.applicationChannel', 40).toLowerCase();
+  if (!COMMUNITY_JOB_CHANNELS.has(applicationChannel)) throw new Error('community job.applicationChannel is invalid.');
+  const discoverySource = value.discoverySource == null ? null : boundedString(value.discoverySource, 'community job.discoverySource', 40).toLowerCase();
+  if (discoverySource != null && !COMMUNITY_JOB_DISCOVERY_SOURCES.has(discoverySource)) throw new Error('community job.discoverySource is invalid.');
+  const derivedProviderUrl = providerUrl(url);
+  if (value.providerUrl != null && value.providerUrl !== derivedProviderUrl) throw new Error('community job.providerUrl must match the derived provider URL.');
+  return {
+    url: url.toString().replace(/\/+$/, ''),
+    company: publicJobLabel(value.company, 'community job.company', 160),
+    role: publicJobLabel(value.role, 'community job.role', 200),
+    applicationChannel,
+    ...(discoverySource == null ? {} : { discoverySource }),
+    providerUrl: derivedProviderUrl,
+  };
+}
+
+export async function communityJobId(job) {
+  const normalized = normalizeCommunityJob(job);
+  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(normalized.url)));
+  return `community-job-${[...digest].map((value) => value.toString(16).padStart(2, '0')).join('').slice(0, 16)}`;
+}
+
+export function createCommunityJobContributionEnvelope({ installationId, token, job, skillVersion }) {
+  return validateCommunityJobContributionEnvelope({ schemaVersion: 1, skillVersion, installationId, token, job });
+}
+
+export function validateCommunityJobContributionEnvelope(input) {
+  const value = record(input, 'community job contribution');
+  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'job']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown community job contribution property: ${key}.`);
+  if (value.schemaVersion !== 1) throw new Error('Unsupported community job contribution schema version.');
+  const installationId = boundedString(value.installationId, 'community job contribution.installationId', 36);
+  if (!UUID.test(installationId)) throw new Error('community job contribution.installationId is invalid.');
+  return {
+    schemaVersion: 1,
+    skillVersion: boundedString(value.skillVersion, 'community job contribution.skillVersion', 40),
+    installationId,
+    token: boundedString(value.token, 'community job contribution.token', 2048),
+    job: normalizeCommunityJob(value.job),
+  };
+}
+
+export function validateCommunityJobList(input) {
+  const value = record(input, 'community job list');
+  const allowed = new Set(['version', 'jobs', 'nextCursor']);
+  for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown community job list property: ${key}.`);
+  if (value.version !== 1 || !Array.isArray(value.jobs) || value.jobs.length > 100) throw new Error('Invalid community job list.');
+  if (value.nextCursor != null && (typeof value.nextCursor !== 'string' || !value.nextCursor || value.nextCursor.length > 1024)) throw new Error('community job list.nextCursor is invalid.');
+  const jobs = value.jobs.map((entry) => {
+    const job = record(entry, 'community job entry');
+    const entryAllowed = new Set(['jobId', 'url', 'company', 'role', 'applicationChannel', 'discoverySource', 'providerUrl', 'firstSeenAt', 'lastSeenAt', 'contributionCount']);
+    for (const key of Object.keys(job)) if (!entryAllowed.has(key)) throw new Error(`Unknown community job entry property: ${key}.`);
+    if (!JOB_ID.test(job.jobId)) throw new Error('community job entry.jobId is invalid.');
+    if (!Number.isSafeInteger(job.contributionCount) || job.contributionCount < 1 || job.contributionCount > 1_000_000_000) throw new Error('community job entry.contributionCount is invalid.');
+    for (const field of ['firstSeenAt', 'lastSeenAt']) {
+      if (typeof job[field] !== 'string' || Number.isNaN(Date.parse(job[field]))) throw new Error(`community job entry.${field} must be an ISO date.`);
+    }
+    const normalized = normalizeCommunityJob(Object.fromEntries(['url', 'company', 'role', 'applicationChannel', 'discoverySource', 'providerUrl'].filter((key) => job[key] != null).map((key) => [key, job[key]])));
+    return { jobId: job.jobId, ...normalized, firstSeenAt: job.firstSeenAt, lastSeenAt: job.lastSeenAt, contributionCount: job.contributionCount };
+  });
+  return { version: 1, jobs, nextCursor: value.nextCursor ?? null };
+}
+
 export function isRepeatableCommunitySourceRoute(url) {
   const hostname = url.hostname.toLowerCase();
   const segments = url.pathname.split('/').filter(Boolean).map((segment) => segment.toLowerCase());

package/job-application-agent/scripts/telemetry-client.mjs

@@ -2,8 +2,10 @@ import { chmod, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/prom
 import { join } from 'node:path';
 
 import { createTelemetryEnvelope, jobIdentity, validateEvent } from './telemetry-schema.mjs';
+import { SKILL_VERSION } from './version.mjs';
+
+export { SKILL_VERSION };
 
-export const SKILL_VERSION = '1.2.1';
 export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https://job-application-agent-telemetry.varora1406.workers.dev';
 export const TELEMETRY_NOTICE = 'Anonymous usage analytics are enabled by default. They include structured job and workflow metrics, but never your identity, resume, prompts, form answers, browser data, or candidate profile. Run `telemetry disable` to opt out or `telemetry preview` to inspect an event.\n';
 

package/job-application-agent/scripts/version.mjs

@@ -0,0 +1 @@
+export const SKILL_VERSION = '3.2.1';

package/job-application-agent/tests/job-application.test.mjs

@@ -48,6 +48,14 @@ const matchingJob = {
   ],
 };
 
+function isolatedCliEnv(directory) {
+  return {
+    ...process.env,
+    JOB_APPLICATION_AGENT_STATE_DIR: directory,
+    JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
+  };
+}
+
 function runCli(script, args, input, env) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, [script, ...args], { env, stdio: ['pipe', 'pipe', 'pipe'] });
@@ -73,7 +81,7 @@ test('returns the canonical resume path for direct browser uploads', async (t) =
   const resume = join(directory, 'resume.pdf');
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   await writeFile(resume, '%PDF-1.7\ncanonical resume fixture');
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
 
   const result = JSON.parse(execFileSync(process.execPath, [script, 'resume', 'path'], { env, encoding: 'utf8' }));
 
@@ -108,6 +116,7 @@ test('scores a matching role from candidate preferences', () => {
   assert.equal(result.autoEligible, true);
   assert.equal(result.mustHaveCoverage, 83);
   assert.ok(result.score >= 80);
+  assert.equal(scoreJob({ ...matchingJob, discoverySourceId: 'community-abcdef1234567890' }, target).decision, 'review');
 });
 
 test('applies posting, eligibility, work-mode, seniority and evidence gates before auto-submit', () => {
@@ -245,7 +254,7 @@ test('deduplicates ledger entries by normalized URL', async (t) => {
     telemetry: { durationBucket: '5-15m', fieldsFilled: 14, shortAnswerCount: 2, resumeUploaded: true },
   };
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   execFileSync(process.execPath, [script, 'ledger', 'add', '--stdin'], { input: JSON.stringify(entry), env, encoding: 'utf8' });
   const duplicate = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'check', '--stdin'], { input: JSON.stringify({ id: 'different', url: 'https://jobs.example.com/123?ref=friend' }), env, encoding: 'utf8' }));
   assert.equal(duplicate.duplicate, true);
@@ -262,7 +271,7 @@ test('warns on same-company role matches and serializes concurrent duplicate sub
   t.after(() => rm(directory, { recursive: true, force: true }));
   const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const base = {
     company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 88,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {}, employerJobId: 'example:123',
@@ -290,7 +299,7 @@ test('records structured outcomes idempotently without duplicate rows', async (t
     id: 'example-role-1', company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 88,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   })}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const outcome = { id: 'example-role-1', status: 'rejected', occurredAt: '2026-01-20T09:00:00Z', note: 'No sponsorship' };
   const enriched = { ...outcome, reasons: [{ category: 'eligibility', evidence: 'explicit' }] };
   const first = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'outcome', '--stdin'], { input: JSON.stringify(outcome), env, encoding: 'utf8' }));
@@ -313,7 +322,7 @@ test('records bounded interview quality and failure-point enrichment idempotentl
     id: 'example-role-1', company: 'Example', role: 'Staff Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 91,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   })}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const base = { id: 'example-role-1', status: 'interview', occurredAt: '2026-01-20T09:00:00Z' };
   const enriched = { ...base, interviewQuality: 'weak', failurePoint: 'role-scope' };
   const first = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'outcome', '--stdin'], { input: JSON.stringify(base), env, encoding: 'utf8' }));
@@ -399,7 +408,7 @@ test('acknowledges a generated review only through the explicit CLI command', as
     source: 'company', score: 80, status: 'submitted', submittedAt: '2026-01-01T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   }));
   await writeFile(join(directory, 'applications.ndjson'), `${entries.map(JSON.stringify).join('\n')}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const before = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'review'], { env, encoding: 'utf8' }));
   assert.equal(before.reviewDue, true);
   assert.equal(await readFile(join(directory, 'reviews.ndjson'), 'utf8').catch(() => ''), '');

package/job-application-agent/tests/privacy-audit.test.mjs

@@ -3,7 +3,7 @@ import test from 'node:test';
 
 import { prepareTelemetryInput } from '../scripts/telemetry-client.mjs';
 import { validateEvent } from '../scripts/telemetry-schema.mjs';
-import { normalizeCommunitySource } from '../scripts/source-community-schema.mjs';
+import { createCommunityJobContributionEnvelope, normalizeCommunityJob, normalizeCommunitySource } from '../scripts/source-community-schema.mjs';
 
 const forbiddenProperties = [
   'name', 'email', 'phone', 'exactAddress', 'linkedin', 'github', 'portfolio', 'candidateLocation',
@@ -56,3 +56,26 @@ test('privacy audit strips identity-bearing source parameters and rejects person
   assert.throws(() => normalizeCommunitySource({ ...source, name: 'candidate@example.com' }), /identity/i);
   assert.throws(() => normalizeCommunitySource({ ...source, baseUrl: 'https://linkedin.com/in/candidate' }), /profile or personal/i);
 });
+
+test('privacy audit permits only sanitized public fields in community jobs', () => {
+  const job = normalizeCommunityJob({
+    url: 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc?email=candidate@example.com&token=secret#private',
+    company: 'Example',
+    role: 'Senior Product Engineer',
+    applicationChannel: 'ashby',
+    discoverySource: 'job-board',
+  });
+  const envelope = createCommunityJobContributionEnvelope({
+    installationId: '11111111-1111-4111-8111-111111111111',
+    token: 'anonymous-relay-token',
+    skillVersion: '3.2.0',
+    job,
+  });
+  const serialized = JSON.stringify(envelope.job);
+  assert.equal(serialized.includes('candidate@example.com'), false);
+  assert.equal(serialized.includes('secret'), false);
+  assert.deepEqual(Object.keys(envelope.job).sort(), ['applicationChannel', 'company', 'discoverySource', 'providerUrl', 'role', 'url']);
+  assert.throws(() => normalizeCommunityJob({ ...job, answers: { private: true } }), /unknown/i);
+  assert.throws(() => normalizeCommunityJob({ ...job, company: 'candidate@example.com' }), /identity/i);
+  assert.throws(() => normalizeCommunityJob({ ...job, url: 'https://linkedin.com/in/candidate' }), /personal/i);
+});

package/job-application-agent/tests/source-community-client.test.mjs

@@ -15,6 +15,14 @@ const source = {
   requiresSession: false,
 };
 
+const job = {
+  url: 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc?ref=candidate@example.com#apply',
+  company: 'Example',
+  role: 'Senior Product Engineer',
+  applicationChannel: 'ashby',
+  discoverySource: 'job-board',
+};
+
 function relay() {
   const requests = [];
   const community = [{
@@ -28,10 +36,24 @@ function relay() {
     registryStatus: 'community-reviewed',
     contributionCount: 2,
   }];
+  const jobs = [{
+    jobId: 'community-job-abcdef1234567890',
+    url: 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc',
+    company: 'Example',
+    role: 'Senior Product Engineer',
+    applicationChannel: 'ashby',
+    discoverySource: 'job-board',
+    providerUrl: 'https://jobs.ashbyhq.com/example',
+    firstSeenAt: '2026-08-24T00:00:00.000Z',
+    lastSeenAt: '2026-08-24T00:00:00.000Z',
+    contributionCount: 2,
+  }];
   const fetch = async (url, options = {}) => {
     requests.push({ url, options, body: options.body ? JSON.parse(options.body) : null });
     if (url.endsWith('/v1/install')) return Response.json({ installationId: '11111111-1111-4111-8111-111111111111', token: 'source-token', expiresAt: '2099-01-01T00:00:00.000Z' }, { status: 201 });
     if (url.endsWith('/v1/sources') && options.method === 'POST') return Response.json({ accepted: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 }, { status: 202 });
+    if (url.endsWith('/v1/jobs') && options.method === 'POST') return Response.json({ accepted: true, jobId: 'community-job-abcdef1234567890', publicationStatus: 'pending', contributionCount: 2 }, { status: 202 });
+    if (url.includes('/v1/jobs')) return Response.json({ version: 1, jobs, nextCursor: 'next-page' });
     return Response.json({ version: 1, sources: community });
   };
   return { fetch, requests };
@@ -47,7 +69,7 @@ test('source sharing is enabled by default, disclosed, sanitized, and sent immed
   const result = await client.contribute(source);
 
   assert.deepEqual(result, { shared: true, sourceId: 'community-abcdef1234567890', publicationStatus: 'pending', uniqueContributors: 1 });
-  assert.match(notice, /community source sharing is enabled by default/i);
+  assert.match(notice, /community sharing is enabled by default/i);
   assert.equal(network.requests.length, 2);
   assert.equal(network.requests[1].url, 'https://relay.example.com/v1/sources');
   assert.equal(network.requests[1].body.source.baseUrl, 'https://jobs.example.org/openings/engineering');
@@ -55,9 +77,89 @@ test('source sharing is enabled by default, disclosed, sanitized, and sent immed
   const stored = JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8'));
   assert.equal(stored.enabled, true);
   assert.equal(stored.disclosed, true);
+  assert.equal(stored.jobSharingDisclosed, true);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'source-sharing.json'))).mode & 0o777, 0o600);
 });
 
+test('existing source-sharing users receive one command to opt out before job backfill', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-upgrade-disclosure-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, 'source-sharing.json'), JSON.stringify({
+    version: 1,
+    enabled: true,
+    disclosed: true,
+    installationId: '11111111-1111-4111-8111-111111111111',
+    token: 'source-token',
+    tokenExpiresAt: '2099-01-01T00:00:00.000Z',
+  }));
+  const network = relay();
+  let notice = '';
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: (value) => { notice += value; } });
+
+  assert.deepEqual(await client.contributeJob(job), { shared: false, reason: 'grace' });
+  assert.match(notice, /confirmed public job links/i);
+  assert.equal(JSON.parse(await readFile(join(directory, 'source-sharing.json'), 'utf8')).jobSharingDisclosed, true);
+  assert.equal(network.requests.length, 0);
+  notice = '';
+  assert.equal((await client.contributeJob(job)).shared, true);
+  assert.equal(notice, '');
+});
+
+test('an interrupted job-sharing disclosure still preserves the grace command', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-job-grace-recovery-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, 'source-sharing.json'), JSON.stringify({
+    version: 1,
+    enabled: true,
+    disclosed: true,
+    jobSharingDisclosed: true,
+    jobSharingGraceConsumed: false,
+    installationId: null,
+    token: null,
+    tokenExpiresAt: null,
+  }));
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+
+  assert.deepEqual(await client.contributeJob(job), { shared: false, reason: 'grace' });
+  assert.equal(network.requests.length, 0);
+  assert.equal((await client.contributeJob(job)).shared, true);
+});
+
+test('historical applications without a source config receive the disclosure grace command', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-historical-no-config-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  await writeFile(join(directory, 'applications.ndjson'), '{"historical":true}\n');
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+
+  assert.deepEqual(await client.contributeJob(job), { shared: false, reason: 'grace' });
+  assert.equal(network.requests.length, 0);
+});
+
+test('confirmed jobs are sanitized, shared anonymously, and public listings are validated', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'source-community-job-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const network = relay();
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+
+  const contributed = await client.contributeJob(job);
+  assert.deepEqual(contributed, { shared: true, jobId: 'community-job-abcdef1234567890', publicationStatus: 'pending', contributionCount: 2 });
+  const posted = network.requests.find((request) => request.url.endsWith('/v1/jobs') && request.options.method === 'POST');
+  assert.equal(posted.body.job.url, 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc');
+  assert.equal(posted.body.job.providerUrl, 'https://jobs.ashbyhq.com/example');
+  assert.equal(JSON.stringify(posted.body).includes('candidate@example.com'), false);
+
+  const listed = await client.listJobs({ limit: 25, cursor: 'current-page' });
+  assert.equal(listed.jobs[0].jobId, 'community-job-abcdef1234567890');
+  assert.equal(listed.jobs[0].contributionCount, 2);
+  assert.equal(listed.nextCursor, 'next-page');
+  assert.equal(network.requests.at(-1).url, 'https://relay.example.com/v1/jobs?limit=25&cursor=current-page');
+  const requestsBeforeInvalidInput = network.requests.length;
+  await assert.rejects(() => client.listJobs({ limit: 0 }), /between 1 and 100/i);
+  assert.equal(network.requests.length, requestsBeforeInvalidInput);
+});
+
 test('community source listing validates the public response before reuse', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'source-community-list-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
@@ -74,12 +176,15 @@ test('source sharing can be disabled independently and never blocks local collec
   const directory = await mkdtemp(join(tmpdir(), 'source-community-disabled-'));
   t.after(() => rm(directory, { recursive: true, force: true }));
   const network = relay();
-  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: () => {} });
+  let notice = '';
+  const client = new SourceCommunityClient({ stateDir: directory, endpoint: 'https://relay.example.com', fetch: network.fetch, stderr: (value) => { notice += value; } });
 
   assert.equal((await client.configure('disable')).enabled, false);
   assert.deepEqual(await client.contribute(source), { shared: false, reason: 'disabled' });
+  assert.deepEqual(await client.contributeJob(job), { shared: false, reason: 'disabled' });
   assert.equal(network.requests.length, 0);
   assert.equal((await client.configure('enable')).enabled, true);
+  assert.match(notice, /confirmed public job links/i);
   assert.equal((await client.contribute(source)).shared, true);
 });
 
@@ -186,6 +291,7 @@ test('concurrent reset is not undone by an in-flight credential refresh', async
   assert.deepEqual(await settings.configure('reset'), {
     enabled: false,
     disclosed: true,
+    jobSharingDisclosed: false,
     hasInstallationId: false,
     endpoint: 'https://relay.example.com',
     schemaVersion: 1,

package/job-application-agent/tests/source-community-schema.test.mjs

@@ -1,7 +1,16 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
 
-import { communitySourceId, isRepeatableCommunitySourceRoute, normalizeCommunitySource } from '../scripts/source-community-schema.mjs';
+import {
+  communityJobId,
+  communitySourceId,
+  createCommunityJobContributionEnvelope,
+  isRepeatableCommunitySourceRoute,
+  normalizeCommunityJob,
+  normalizeCommunitySource,
+  validateCommunityJobContributionEnvelope,
+  validateCommunityJobList,
+} from '../scripts/source-community-schema.mjs';
 
 const source = {
   name: 'Example Jobs',
@@ -12,6 +21,102 @@ const source = {
   requiresSession: false,
 };
 
+const job = {
+  url: 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc?utm_source=private#apply',
+  company: 'Example',
+  role: 'Senior Product Engineer',
+  applicationChannel: 'ashby',
+  discoverySource: 'job-board',
+};
+
+test('normalizes an applied job and derives its reusable provider without referral data', () => {
+  const normalized = normalizeCommunityJob(job);
+
+  assert.deepEqual(normalized, {
+    url: 'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc',
+    company: 'Example',
+    role: 'Senior Product Engineer',
+    applicationChannel: 'ashby',
+    discoverySource: 'job-board',
+    providerUrl: 'https://jobs.ashbyhq.com/example',
+  });
+});
+
+test('accepts public job detail identifiers but rejects private, personal, and credential-bearing routes', () => {
+  const accepted = [
+    'https://job-boards.greenhouse.io/example/jobs/1234567',
+    'https://jobs.lever.co/example/12345678-1234-4123-8123-123456789abc',
+    'https://jobs.ashbyhq.com/example/12345678-1234-4123-8123-123456789abc',
+    'https://company.example/careers/senior-product-engineer',
+  ];
+  for (const url of accepted) assert.equal(normalizeCommunityJob({ ...job, url }).url, url);
+
+  const rejected = [
+    'http://localhost/jobs/123',
+    'https://jobs.example.com/123',
+    'https://linkedin.com/in/some-person',
+    'https://company.example/candidate/9876543210',
+    'https://company.example/referral/12345678-1234-4123-8123-123456789abc',
+    'https://candidate-14155550100.example.org/jobs/123',
+    'https://company.example/jobs/+1-415-555-0100',
+    'https://company.example/jobs/access-token=abcdefghijklmnop',
+    'https://user:password@company.example/jobs/123',
+  ];
+  for (const url of rejected) assert.throws(() => normalizeCommunityJob({ ...job, url }), /public HTTPS|personal|credential|reserved example/i, url);
+});
+
+test('preserves only stable query job identifiers while removing referral data', async () => {
+  const first = normalizeCommunityJob({
+    ...job,
+    url: 'https://company.example/viewjob?jobId=111&utm_source=private&ref=candidate@example.com',
+  });
+  const second = normalizeCommunityJob({
+    ...job,
+    url: 'https://company.example/viewjob?jobId=222&utm_source=private',
+  });
+
+  assert.equal(first.url, 'https://company.example/viewjob?jobid=111');
+  assert.equal(second.url, 'https://company.example/viewjob?jobid=222');
+  assert.notEqual(await communityJobId(first), await communityJobId(second));
+  assert.equal(first.url.includes('candidate@example.com'), false);
+  assert.equal(normalizeCommunityJob({ ...job, url: 'https://boards.example/jobs?gh_jid=7654321&utm_campaign=secret' }).url, 'https://boards.example/jobs?gh_jid=7654321');
+});
+
+test('community job IDs deduplicate tracking variants and contribution envelopes validate strictly', async () => {
+  const first = await communityJobId(job);
+  const second = await communityJobId({ ...job, url: `${job.url.split('?')[0]}?ref=another#details` });
+  assert.equal(first, second);
+  assert.match(first, /^community-job-[0-9a-f]{16}$/);
+
+  const envelope = createCommunityJobContributionEnvelope({
+    installationId: '12345678-1234-4123-8123-123456789abc',
+    token: 'signed-token',
+    job,
+    skillVersion: '3.2.0',
+  });
+  assert.deepEqual(validateCommunityJobContributionEnvelope(envelope), envelope);
+  assert.throws(() => validateCommunityJobContributionEnvelope({ ...envelope, answers: { private: true } }), /Unknown community job contribution property/i);
+});
+
+test('validates paginated public community job responses without accepting extra data', async () => {
+  const jobId = await communityJobId(job);
+  const response = {
+    version: 1,
+    jobs: [{
+      jobId,
+      ...normalizeCommunityJob(job),
+      firstSeenAt: '2026-08-24T10:00:00.000Z',
+      lastSeenAt: '2026-08-24T11:00:00.000Z',
+      contributionCount: 2,
+    }],
+    nextCursor: 'opaque-cursor',
+  };
+
+  assert.deepEqual(validateCommunityJobList(response), response);
+  assert.throws(() => validateCommunityJobList({ ...response, installationId: 'private' }), /Unknown community job list property/i);
+  assert.throws(() => validateCommunityJobList({ ...response, jobs: [{ ...response.jobs[0], score: 90 }] }), /Unknown community job entry property/i);
+});
+
 test('rejects known ATS and network job-detail routes', () => {
   const detailUrls = [
     'https://example.wd5.myworkdayjobs.com/en-US/jobs/job/Bengaluru/Senior-Engineer_R-12345',

package/job-application-agent/tests/version.test.mjs

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import test from 'node:test';
+
+import { SKILL_VERSION as telemetryVersion } from '../scripts/telemetry-client.mjs';
+import { SKILL_VERSION } from '../scripts/version.mjs';
+
+test('the packaged skill and telemetry report the npm package version', async () => {
+  const manifest = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'));
+  assert.equal(SKILL_VERSION, manifest.version);
+  assert.equal(telemetryVersion, manifest.version);
+});