job-application-agent 3.2.0 → 3.3.0

package/README.md

@@ -45,6 +45,10 @@ record outcome Company — Senior Engineer — interview
 
 Requires Node.js 20 or newer and a browser-capable coding agent.
 
+On Linux, profile storage uses the Secret Service via the `secret-tool` CLI. Install it with `sudo apt-get install libsecret-tools` (Debian/Ubuntu) or the equivalent package manager command for your distribution.
+
+Unlike macOS Keychain or Windows Credential Manager, the Linux Secret Service has no always-running system daemon: a keyring daemon (GNOME Keyring, KWallet, or similar) must be running in the user session for `secret-tool` to store or read the profile. On a desktop login this is normally already the case; on headless servers, containers, or SSH-only sessions, start one explicitly (e.g. `gnome-keyring-daemon --unlock --components=secrets`) before first use.
+
 ## ✨ What it does
 
 | Stage | Behavior |
@@ -108,7 +112,7 @@ Discovery combines the reviewed [`SOURCES.json`](job-application-agent/reference
 
 | Data | Where it stays |
 |---|---|
-| Profile | macOS Keychain or Windows Credential Manager |
+| Profile | macOS Keychain, Windows Credential Manager, or Linux Secret Service (libsecret) |
 | Résumé and ledgers | Owner-only local state directory |
 | Browser login | Existing browser session |
 | Community-sharing preference and delivery receipts | Owner-only local state directory |

package/job-application-agent/SKILL.md

@@ -20,7 +20,7 @@ Use `scripts/job-application.mjs` for private state and deterministic checks. Re
 1. Ask for a local PDF or read-only Google Docs resume URL. Import it without modifying the source.
 2. Run `profile check`. If it reports missing or legacy fields, collect only facts that cannot be preserved or defaulted, then run `profile migrate --stdin`. Use `profile set --stdin` for a new profile.
 3. Preserve identity fields during migration. Map legacy `salaryPreference` to `targetCompensation`. Add `compensationFloor` only when the candidate provides an amount, currency, and annual comparison basis.
-4. Store the profile in OS-backed profile storage (macOS Keychain, or Windows Credential Manager with a DPAPI-protected local file). Store the canonical resume and append-only ledgers in the owner-only state directory.
+4. Store the profile in OS-backed profile storage (macOS Keychain, Windows Credential Manager with a DPAPI-protected local file, or Linux Secret Service via `secret-tool`). Store the canonical resume and append-only ledgers in the owner-only state directory.
 5. Use `review-each` for per-application approval. Use `routine-auto` only when the current request authorizes the destination or batch and every automatic-eligibility condition passes.
 6. When the candidate explicitly grants continuing autonomy, read [references/AUTONOMY.md](references/AUTONOMY.md) and persist it with `autonomy grant --stdin`. Do not repeat skill-level upload or submission approval prompts while the active grant and profile both use `routine-auto`.
 7. Obey browser and tool confirmation requirements regardless of the stored mode or autonomy grant.

package/job-application-agent/scripts/job-application.mjs

@@ -98,9 +98,9 @@ function telemetryStage(command) {
   return ({ search: 'discovery', assess: 'assessment', apply: 'submission', outcome: 'outcome', review: 'review', resume: 'resume', profile: 'contact', onboard: 'contact' })[command] ?? 'application';
 }
 
-function telemetryErrorCode(error) {
+export function telemetryErrorCode(error) {
   const message = String(error?.message ?? '');
-  if (/keychain|credential manager|dpapi|authentication|login/i.test(message)) return 'authentication_required';
+  if (/keychain|keyring|secret service|secret-tool|credential manager|dpapi|authentication|login/i.test(message)) return 'authentication_required';
   if (/network|fetch|http/i.test(message)) return 'network_failure';
   if (/invalid|must|required|expected|unsupported/i.test(message)) return 'invalid_input';
   return 'internal_error';
@@ -601,14 +601,14 @@ export function buildReview(entries, outcomeEntries = [], acknowledgements = [],
 
 function storedProfileRaw() {
   try { return object(JSON.parse(secretStore.readProfile()), 'profile'); } catch (error) {
-    if (/missing or unreadable|requires macOS or Windows|could not store|Windows profile storage/i.test(error.message)) throw error;
+    if (/missing or unreadable|could not read|could not store|Windows profile storage|not supported on this platform|secret-tool is not installed/i.test(error.message)) throw error;
     throw new Error('The stored profile is missing or unreadable. Run profile set again.');
   }
 }
 
 function storedProfile() {
   try { return validateProfile(storedProfileRaw()); } catch (error) {
-    if (/requires macOS or Windows/i.test(error.message)) throw error;
+    if (/Secret Service could not read|not supported on this platform|secret-tool is not installed/i.test(error.message)) throw error;
     throw new Error('The stored profile needs migration. Run profile check, then profile migrate --stdin.');
   }
 }

package/job-application-agent/scripts/secret-store.mjs

@@ -7,7 +7,9 @@ import { fileURLToPath } from 'node:url';
 export const PROFILE_ACCOUNT = 'profile';
 export const DEFAULT_SECRET_SERVICE = 'com.vaibhavarora.job-application-agent';
 export const LEGACY_SECRET_SERVICE = 'com.openai.codex.job-application-agent';
-export const LINUX_PROFILE_ERROR = 'Secure profile storage requires macOS or Windows.';
+export const UNSUPPORTED_PLATFORM_ERROR = 'Secure profile storage is not supported on this platform.';
+export const LINUX_STORE_REQUIRED_TOOL = 'secret-tool';
+export const LINUX_SECRET_MAX_BYTES = 8191;
 export const WINDOWS_PROFILE_SCRIPT = fileURLToPath(new URL('./windows-profile-store.ps1', import.meta.url));
 
 export function resolveSecretService(env = process.env) {
@@ -99,6 +101,54 @@ function createDarwinStore({ execFileSync: exec, service, legacyService, account
   };
 }
 
+function linuxToolMissing(error) {
+  return error?.code === 'ENOENT';
+}
+
+function linuxFind(exec, service, account) {
+  try {
+    return exec(LINUX_STORE_REQUIRED_TOOL, ['lookup', 'service', service, 'account', account], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    if (linuxToolMissing(error)) throw new Error(`${LINUX_STORE_REQUIRED_TOOL} is not installed. Install libsecret-tools (e.g. sudo apt-get install libsecret-tools) to enable Linux profile storage.`);
+    if (String(error?.stderr ?? '').trim()) {
+      throw new Error('Secret Service could not read the profile. Start or unlock your keyring and retry; no profile data was logged.');
+    }
+    return null;
+  }
+}
+
+function linuxWrite(exec, service, account, raw) {
+  if (Buffer.byteLength(raw, 'utf8') > LINUX_SECRET_MAX_BYTES) {
+    throw new Error(`The profile is too large for Linux Secret Service storage. Keep it under ${LINUX_SECRET_MAX_BYTES + 1} UTF-8 bytes and retry; the stored profile was not changed.`);
+  }
+  try {
+    exec(LINUX_STORE_REQUIRED_TOOL, ['store', '--label=job-application-agent', 'service', service, 'account', account], {
+      input: raw,
+      encoding: 'utf8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch (error) {
+    if (linuxToolMissing(error)) throw new Error(`${LINUX_STORE_REQUIRED_TOOL} is not installed. Install libsecret-tools (e.g. sudo apt-get install libsecret-tools) to enable Linux profile storage.`);
+    throw new Error('Secret Service could not store the profile. Unlock your keyring and retry; no profile data was logged.');
+  }
+}
+
+function createLinuxStore({ execFileSync: exec, service, account }) {
+  return {
+    readProfile() {
+      const current = linuxFind(exec, service, account);
+      if (current != null && current.trim()) return decodeSecret(current.trim());
+      throw new Error('The stored profile is missing or unreadable. Run profile set again.');
+    },
+    writeProfile(raw) {
+      linuxWrite(exec, service, account, raw);
+    },
+  };
+}
+
 function windowsRequest(exec, scriptPath, payload, plaintext = '') {
   const input = `${JSON.stringify(payload)}\n${plaintext}`;
   try {
@@ -143,8 +193,8 @@ function createWin32Store({
 
 function unsupportedStore() {
   return {
-    readProfile() { throw new Error(LINUX_PROFILE_ERROR); },
-    writeProfile() { throw new Error(LINUX_PROFILE_ERROR); },
+    readProfile() { throw new Error(UNSUPPORTED_PLATFORM_ERROR); },
+    writeProfile() { throw new Error(UNSUPPORTED_PLATFORM_ERROR); },
   };
 }
 
@@ -160,5 +210,6 @@ export function createSecretStore({
 } = {}) {
   if (platform === 'darwin') return createDarwinStore({ execFileSync: exec, service, legacyService, account });
   if (platform === 'win32') return createWin32Store({ execFileSync: exec, service, account, stateDir, scriptPath });
+  if (platform === 'linux') return createLinuxStore({ execFileSync: exec, service, account });
   return unsupportedStore();
 }

package/job-application-agent/scripts/source-community-schema.mjs

@@ -74,6 +74,11 @@ function isPublicHostname(hostname) {
   return value.includes('.');
 }
 
+function isReservedExampleHostname(hostname) {
+  const value = hostname.toLowerCase();
+  return ['example.com', 'example.net', 'example.org'].some((suffix) => value === suffix || value.endsWith(`.${suffix}`));
+}
+
 function hostnameMatches(hostname, suffix) {
   return hostname === suffix || hostname.endsWith(`.${suffix}`);
 }
@@ -139,6 +144,7 @@ export function normalizeCommunityJob(input) {
   if (url.protocol !== 'https:' || url.username || url.password) throw new Error('community job.url must be a public HTTPS URL.');
   url.hostname = url.hostname.replace(/\.+$/, '').toLowerCase();
   if (!isPublicHostname(url.hostname)) throw new Error('community job.url must use a public HTTPS hostname.');
+  if (isReservedExampleHostname(url.hostname)) throw new Error('community job.url must not use a reserved example hostname.');
   const pathname = decodedPathname(url.pathname).normalize('NFKC');
   url.pathname = pathname;
   if (containsEmailLike(pathname) || containsPhoneLikeLocation(url.hostname, pathname) || looksIdentityPath(pathname) || looksPersonal(url)) throw new Error('community job.url must not be a personal URL.');

package/job-application-agent/scripts/version.mjs

@@ -1 +1 @@
-export const SKILL_VERSION = '3.2.0';
+export const SKILL_VERSION = '3.3.0';

package/job-application-agent/tests/job-application.test.mjs

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath } from 'node:url';
 
-import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
+import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryErrorCode, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
 
 const target = {
   name: 'Test Candidate',
@@ -48,9 +48,17 @@ const matchingJob = {
   ],
 };
 
-function runCli(script, args, input, env) {
+function isolatedCliEnv(directory) {
+  return {
+    ...process.env,
+    JOB_APPLICATION_AGENT_STATE_DIR: directory,
+    JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
+  };
+}
+
+function runCli(script, args, input, env, runtimeArgs = []) {
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, [script, ...args], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    const child = spawn(process.execPath, [...runtimeArgs, script, ...args], { env, stdio: ['pipe', 'pipe', 'pipe'] });
     let stdout = '';
     let stderr = '';
     child.stdout.on('data', (chunk) => { stdout += chunk; });
@@ -73,13 +81,50 @@ test('returns the canonical resume path for direct browser uploads', async (t) =
   const resume = join(directory, 'resume.pdf');
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
   await writeFile(resume, '%PDF-1.7\ncanonical resume fixture');
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
 
   const result = JSON.parse(execFileSync(process.execPath, [script, 'resume', 'path'], { env, encoding: 'utf8' }));
 
   assert.deepEqual(result, { path: resume });
 });
 
+test('preserves the Linux secret-tool install error for profile-dependent commands', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-profile-error-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  const platformOverride = `data:text/javascript,${encodeURIComponent("Object.defineProperty(process, 'platform', { value: 'linux' });")}`;
+  const env = { ...isolatedCliEnv(directory), PATH: '' };
+
+  const result = await runCli(script, ['profile', 'field', 'name'], undefined, env, ['--import', platformOverride]);
+
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /secret-tool is not installed/);
+  assert.doesNotMatch(result.stderr, /profile needs migration/i);
+});
+
+test('preserves an unavailable Linux Secret Service error for profile-dependent commands', {
+  skip: process.platform === 'win32',
+}, async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-service-error-'));
+  const toolDirectory = await mkdtemp(join(tmpdir(), 'job-agent-secret-tool-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  t.after(() => rm(toolDirectory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const toolPath = join(toolDirectory, 'secret-tool');
+  const toolSource = '#!/bin/sh\nprintf "%s\\n" "secret-tool: Secret Service is unavailable" >&2\nexit 1\n';
+  await writeFile(toolPath, toolSource, { mode: 0o755 });
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  const platformOverride = `data:text/javascript,${encodeURIComponent("Object.defineProperty(process, 'platform', { value: 'linux' });")}`;
+  const env = { ...isolatedCliEnv(directory), PATH: toolDirectory };
+
+  const result = await runCli(script, ['profile', 'field', 'name'], undefined, env, ['--import', platformOverride]);
+
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /Secret Service could not read the profile/);
+  assert.doesNotMatch(result.stderr, /profile needs migration/i);
+});
+
 test('migrates a legacy profile without discarding identity or salary preference', () => {
   const legacy = {
     name: 'Test Candidate', email: 'candidate@example.com', phone: '+1 555 0100',
@@ -246,7 +291,7 @@ test('deduplicates ledger entries by normalized URL', async (t) => {
     telemetry: { durationBucket: '5-15m', fieldsFilled: 14, shortAnswerCount: 2, resumeUploaded: true },
   };
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   execFileSync(process.execPath, [script, 'ledger', 'add', '--stdin'], { input: JSON.stringify(entry), env, encoding: 'utf8' });
   const duplicate = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'check', '--stdin'], { input: JSON.stringify({ id: 'different', url: 'https://jobs.example.com/123?ref=friend' }), env, encoding: 'utf8' }));
   assert.equal(duplicate.duplicate, true);
@@ -263,7 +308,7 @@ test('warns on same-company role matches and serializes concurrent duplicate sub
   t.after(() => rm(directory, { recursive: true, force: true }));
   const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
   await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const base = {
     company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 88,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {}, employerJobId: 'example:123',
@@ -291,7 +336,7 @@ test('records structured outcomes idempotently without duplicate rows', async (t
     id: 'example-role-1', company: 'Example', role: 'Senior Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 88,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   })}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const outcome = { id: 'example-role-1', status: 'rejected', occurredAt: '2026-01-20T09:00:00Z', note: 'No sponsorship' };
   const enriched = { ...outcome, reasons: [{ category: 'eligibility', evidence: 'explicit' }] };
   const first = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'outcome', '--stdin'], { input: JSON.stringify(outcome), env, encoding: 'utf8' }));
@@ -314,7 +359,7 @@ test('records bounded interview quality and failure-point enrichment idempotentl
     id: 'example-role-1', company: 'Example', role: 'Staff Product Engineer', url: 'https://jobs.example.com/123', source: 'company', score: 91,
     status: 'submitted', submittedAt: '2026-01-15T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   })}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const base = { id: 'example-role-1', status: 'interview', occurredAt: '2026-01-20T09:00:00Z' };
   const enriched = { ...base, interviewQuality: 'weak', failurePoint: 'role-scope' };
   const first = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'outcome', '--stdin'], { input: JSON.stringify(base), env, encoding: 'utf8' }));
@@ -400,7 +445,7 @@ test('acknowledges a generated review only through the explicit CLI command', as
     source: 'company', score: 80, status: 'submitted', submittedAt: '2026-01-01T10:00:00Z', approval: 'STANDING AUTHORIZATION', answers: {},
   }));
   await writeFile(join(directory, 'applications.ndjson'), `${entries.map(JSON.stringify).join('\n')}\n`);
-  const env = { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory };
+  const env = isolatedCliEnv(directory);
   const before = JSON.parse(execFileSync(process.execPath, [script, 'ledger', 'review'], { env, encoding: 'utf8' }));
   assert.equal(before.reviewDue, true);
   assert.equal(await readFile(join(directory, 'reviews.ndjson'), 'utf8').catch(() => ''), '');
@@ -420,6 +465,8 @@ test('maps commands and durations to bounded telemetry categories', () => {
   assert.equal(durationBucket(700), 'under-1s');
   assert.equal(durationBucket(70_000), '1-2m');
   assert.equal(durationBucket(2_000_000), '15m-plus');
+  assert.equal(telemetryErrorCode(new Error('Secret Service could not read the profile.')), 'authentication_required');
+  assert.equal(telemetryErrorCode(new Error('secret-tool is not installed.')), 'authentication_required');
 });
 
 test('builds a structured assessment event without description or candidate profile data', async () => {

package/job-application-agent/tests/linux-secret-service.integration.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { createSecretStore, LINUX_SECRET_MAX_BYTES } from '../scripts/secret-store.mjs';
+
+const enabled = process.platform === 'linux'
+  && process.env.JOB_APPLICATION_AGENT_LINUX_SECRET_SERVICE_TEST === '1';
+
+test('Linux Secret Service supports the real profile CLI lifecycle', { skip: !enabled }, async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-secret-service-'));
+  const service = `com.vaibhavarora.job-application-agent.test.${process.pid}.${Date.now()}`;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const env = {
+    ...process.env,
+    JOB_APPLICATION_AGENT_KEYCHAIN_SERVICE: service,
+    JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
+    JOB_APPLICATION_AGENT_STATE_DIR: directory,
+  };
+  t.after(async () => {
+    execFileSync('secret-tool', ['clear', 'service', service, 'account', 'profile'], { stdio: 'ignore' });
+    await rm(directory, { recursive: true, force: true });
+  });
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({
+    version: 1,
+    enabled: false,
+    disclosed: true,
+    graceConsumed: true,
+    installationEventPending: false,
+  }));
+
+  const store = createSecretStore({ platform: 'linux', env, service });
+  const first = JSON.stringify({ name: 'Secret Service integration' });
+  store.writeProfile(first);
+  assert.equal(store.readProfile(), first);
+  assert.throws(
+    () => store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES + 1)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.equal(store.readProfile(), first);
+
+  const profile = {
+    name: 'Linux Test Candidate',
+    email: 'candidate@example.com',
+    phone: '+1 555 0100',
+    location: 'Toronto, Canada',
+    workAuthorization: 'Canada',
+    roleFamilies: ['product-engineering'],
+    seniority: ['senior'],
+    skills: ['JavaScript'],
+    targetLocations: ['Canada'],
+    excludedLocations: [],
+    workModes: ['remote'],
+    industries: ['software'],
+    excludedCompanies: [],
+    submissionMode: 'review-each',
+    yearsExperience: 8,
+    autoSubmitMinScore: 80,
+    manualReviewMinScore: 70,
+    minMustHaveCoverage: 70,
+  };
+  const setResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'set', '--stdin'], {
+    env,
+    input: JSON.stringify(profile),
+    encoding: 'utf8',
+  }));
+  const checkResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'check'], { env, encoding: 'utf8' }));
+  const fieldResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'field', 'name'], { env, encoding: 'utf8' }));
+
+  assert.equal(setResult.stored, true);
+  assert.equal(checkResult.configured, true);
+  assert.deepEqual(fieldResult, { name: profile.name });
+});

package/job-application-agent/tests/secret-store.test.mjs

@@ -8,10 +8,11 @@ import {
   createSecretStore,
   DEFAULT_SECRET_SERVICE,
   LEGACY_SECRET_SERVICE,
-  LINUX_PROFILE_ERROR,
+  LINUX_SECRET_MAX_BYTES,
   migrateLegacyStateDir,
   PROFILE_ACCOUNT,
   resolveStateDir,
+  UNSUPPORTED_PLATFORM_ERROR,
 } from '../scripts/secret-store.mjs';
 
 const sampleProfile = {
@@ -132,8 +133,115 @@ test('windows store keeps a wrapping key small and a profile larger than 2560 by
   assert.ok(files.get(profileFile).length > 2560);
 });
 
-test('linux store rejects secure profile storage with a clear error', () => {
-  const store = createSecretStore({ platform: 'linux' });
-  assert.throws(() => store.readProfile(), { message: LINUX_PROFILE_ERROR });
-  assert.throws(() => store.writeProfile('{}'), { message: LINUX_PROFILE_ERROR });
+test('linux store writes and reads the profile via Secret Service', () => {
+  const secrets = new Map();
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      if (!secrets.has(`${service}/${account}`)) throw new Error('not found');
+      return `${secrets.get(`${service}/${account}`)}\n`;
+    }
+    if (args[0] === 'store') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      secrets.set(`${service}/${account}`, options.input);
+      return '';
+    }
+    throw new Error(`unexpected secret-tool args: ${args.join(' ')}`);
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  store.writeProfile(JSON.stringify(sampleProfile));
+  assert.equal(store.readProfile(), JSON.stringify(sampleProfile));
+});
+
+test('linux store reports a clear error when secret-tool is not installed', () => {
+  const exec = () => { throw Object.assign(new Error('spawn secret-tool ENOENT'), { code: 'ENOENT' }); };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  assert.throws(() => store.writeProfile(JSON.stringify(sampleProfile)), /libsecret-tools/);
+  assert.throws(() => store.readProfile(), /libsecret-tools/);
+});
+
+test('linux store reports a clear error when keyring storage fails', () => {
+  const exec = (command, args) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') throw new Error('not found');
+    throw new Error('keyring locked');
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  assert.throws(() => store.writeProfile(JSON.stringify(sampleProfile)), /could not store the profile/);
+  assert.throws(() => store.readProfile(), /missing or unreadable/);
+});
+
+test('linux store treats a successful empty lookup as a missing profile', () => {
+  const store = createSecretStore({ platform: 'linux', execFileSync: () => '' });
+  assert.throws(() => store.readProfile(), /missing or unreadable/);
+});
+
+test('linux store rejects profiles that secret-tool would silently truncate', () => {
+  const stored = [];
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    assert.equal(args[0], 'store');
+    stored.push(options.input);
+    return '';
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+
+  store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES));
+  assert.equal(stored[0].length, LINUX_SECRET_MAX_BYTES);
+  assert.throws(
+    () => store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES + 1)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.throws(
+    () => store.writeProfile('é'.repeat((LINUX_SECRET_MAX_BYTES + 1) / 2)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.equal(stored.length, 1);
+});
+
+test('linux store distinguishes an unavailable Secret Service from a missing profile', () => {
+  const exec = () => {
+    throw Object.assign(new Error('secret-tool exited with status 1'), {
+      stderr: 'secret-tool: Cannot autolaunch D-Bus without X11 $DISPLAY\n',
+    });
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+
+  assert.throws(() => store.readProfile(), /Secret Service could not read the profile/);
+});
+
+test('linux store keeps a prior profile readable when a later write fails', () => {
+  const secrets = new Map();
+  let failWrites = false;
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      if (!secrets.has(`${service}/${account}`)) throw new Error('not found');
+      return `${secrets.get(`${service}/${account}`)}\n`;
+    }
+    if (args[0] === 'store') {
+      if (failWrites) throw new Error('keyring locked');
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      secrets.set(`${service}/${account}`, options.input);
+      return '';
+    }
+    throw new Error(`unexpected secret-tool args: ${args.join(' ')}`);
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  store.writeProfile(JSON.stringify(sampleProfile));
+  failWrites = true;
+  assert.throws(() => store.writeProfile(JSON.stringify({ ...sampleProfile, name: 'Overwrite' })), /could not store the profile/);
+  assert.equal(store.readProfile(), JSON.stringify(sampleProfile));
+});
+
+test('unsupported platforms retain an explicit profile storage error', () => {
+  const store = createSecretStore({ platform: 'freebsd' });
+  assert.throws(() => store.readProfile(), { message: UNSUPPORTED_PLATFORM_ERROR });
+  assert.throws(() => store.writeProfile('{}'), { message: UNSUPPORTED_PLATFORM_ERROR });
 });

package/job-application-agent/tests/source-community-schema.test.mjs

@@ -53,6 +53,7 @@ test('accepts public job detail identifiers but rejects private, personal, and c
 
   const rejected = [
     'http://localhost/jobs/123',
+    'https://jobs.example.com/123',
     'https://linkedin.com/in/some-person',
     'https://company.example/candidate/9876543210',
     'https://company.example/referral/12345678-1234-4123-8123-123456789abc',
@@ -61,7 +62,7 @@ test('accepts public job detail identifiers but rejects private, personal, and c
     'https://company.example/jobs/access-token=abcdefghijklmnop',
     'https://user:password@company.example/jobs/123',
   ];
-  for (const url of rejected) assert.throws(() => normalizeCommunityJob({ ...job, url }), /public HTTPS|personal|credential/i, url);
+  for (const url of rejected) assert.throws(() => normalizeCommunityJob({ ...job, url }), /public HTTPS|personal|credential|reserved example/i, url);
 });
 
 test('preserves only stable query job identifiers while removing referral data', async () => {

package/job-application-agent/tests/workflow-state.test.mjs

@@ -56,7 +56,7 @@ function submission(index, roundId, overrides = {}) {
     id: `round-role-${index}`,
     company: `Company ${index}`,
     role: 'Senior Product Engineer',
-    url: `https://jobs.example.com/${index}`,
+    url: `https://jobs.fixture.example/${index}`,
     employerJobId: `example:${index}`,
     source: 'ashby',
     discoverySource: 'linkedin',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",