job-application-agent 3.2.1 → 3.4.0

package/job-application-agent/scripts/telemetry-client.mjs

@@ -1,13 +1,14 @@
 import { chmod, mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
-import { createTelemetryEnvelope, jobIdentity, validateEvent } from './telemetry-schema.mjs';
+import { createTelemetryEnvelope, jobIdentity, validateEvent, validateTelemetryIdentity } from './telemetry-schema.mjs';
 import { SKILL_VERSION } from './version.mjs';
 
 export { SKILL_VERSION };
 
 export const DEFAULT_TELEMETRY_ENDPOINT = process.env.JOB_APPLICATION_AGENT_TELEMETRY_URL ?? 'https://job-application-agent-telemetry.varora1406.workers.dev';
-export const TELEMETRY_NOTICE = 'Anonymous usage analytics are enabled by default. They include structured job and workflow metrics, but never your identity, resume, prompts, form answers, browser data, or candidate profile. Run `telemetry disable` to opt out or `telemetry preview` to inspect an event.\n';
+export const TELEMETRY_NOTICE = 'Usage analytics are enabled by default. They include structured job and workflow metrics. Name and email sharing has a separate disclosure and opt-out. Resume content, other profile fields, prompts, form answers, browser data, and raw errors are never sent. Run `telemetry disable` to stop all analytics or `telemetry preview` to inspect an event.\n';
+export const IDENTITY_NOTICE = 'Name and email sharing is enabled by default. Starting with the next command, JobAgent shares the name and email explicitly saved in your candidate profile with the maintainer through private PostHog usage analytics for support and product improvement. Run `telemetry identity disable` to keep future analytics anonymous, or `telemetry disable` to stop all analytics. Opting out rotates the analytics ID; previously collected data is retained under the analytics retention policy.\n';
 
 const CONFIG_VERSION = 1;
 const CONFIG_FILE = 'telemetry.json';
@@ -38,13 +39,14 @@ async function writePrivate(file, value) {
 }
 
 export class TelemetryClient {
-  constructor({ stateDir, endpoint = DEFAULT_TELEMETRY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_TELEMETRY_TIMEOUT_MS ?? 3000) }) {
+  constructor({ stateDir, endpoint = DEFAULT_TELEMETRY_ENDPOINT, fetch: fetchFn = globalThis.fetch, stderr = (value) => process.stderr.write(value), now = () => new Date(), timeoutMs = Number(process.env.JOB_APPLICATION_AGENT_TELEMETRY_TIMEOUT_MS ?? 3000), readIdentity = () => undefined }) {
     this.stateDir = stateDir;
     this.endpoint = endpoint.replace(/\/$/, '');
     this.fetch = fetchFn;
     this.stderr = stderr;
     this.now = now;
     this.timeoutMs = timeoutMs;
+    this.readIdentity = readIdentity;
   }
 
   get configPath() { return join(this.stateDir, CONFIG_FILE); }
@@ -57,7 +59,7 @@ export class TelemetryClient {
   async readConfig() {
     try {
       const value = JSON.parse(await readFile(this.configPath, 'utf8'));
-      return { version: CONFIG_VERSION, enabled: value.enabled !== false, disclosed: value.disclosed === true, graceConsumed: value.graceConsumed === true, installationEventPending: value.installationEventPending === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null };
+      return { version: CONFIG_VERSION, enabled: value.enabled !== false, disclosed: value.disclosed === true, graceConsumed: value.graceConsumed === true, installationEventPending: value.installationEventPending === true, installationId: value.installationId ?? null, token: value.token ?? null, tokenExpiresAt: value.tokenExpiresAt ?? null, identityEnabled: value.identityEnabled !== false, identityDisclosed: value.identityDisclosed === true };
     } catch (error) {
       if (error.code === 'ENOENT') return null;
       return { version: CONFIG_VERSION, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false, installationId: null, token: null, tokenExpiresAt: null };
@@ -101,7 +103,13 @@ export class TelemetryClient {
       config.graceConsumed = true;
       await this.saveConfig(config);
     }
-    return { command, enabled: config.enabled, allowSend: config.enabled && allowSend, installationEventPending: config.installationEventPending === true };
+    const allowIdentity = config.identityEnabled !== false && config.identityDisclosed === true;
+    if (config.enabled && config.identityEnabled !== false && !config.identityDisclosed) {
+      this.stderr(IDENTITY_NOTICE);
+      config.identityDisclosed = true;
+      await this.saveConfig(config);
+    }
+    return { command, enabled: config.enabled, allowSend: config.enabled && allowSend, allowIdentity, installationEventPending: config.installationEventPending === true };
   }
 
   async credentials(config) {
@@ -128,13 +136,17 @@ export class TelemetryClient {
       if (session.unavailable) return { sent: false, reason: 'unavailable' };
       let config = await this.readConfig();
       if (!config?.enabled) return { sent: false, reason: 'disabled' };
+      let identity;
+      if (session.allowIdentity === true && config.identityEnabled !== false && config.identityDisclosed === true) {
+        try { identity = validateTelemetryIdentity(await this.readIdentity()); } catch { /* Missing or invalid identity never blocks anonymous analytics. */ }
+      }
       config = await this.credentials(config);
-      const payload = createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION });
+      const payload = createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION, identity });
       let response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload), signal: AbortSignal.timeout(this.timeoutMs) });
       if (response.status === 401) {
         config.tokenExpiresAt = null;
         config = await this.credentials(config);
-        response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION })), signal: AbortSignal.timeout(this.timeoutMs) });
+        response = await this.fetch(`${this.endpoint}/v1/events`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(createTelemetryEnvelope({ installationId: config.installationId, token: config.token, event, skillVersion: SKILL_VERSION, identity })), signal: AbortSignal.timeout(this.timeoutMs) });
       }
       if (!response.ok) {
         session.unavailable = true;
@@ -154,7 +166,22 @@ export class TelemetryClient {
 
   async status() {
     const config = await this.readConfig();
-    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), endpoint: this.endpoint, schemaVersion: 1 };
+    return { enabled: config?.enabled ?? true, disclosed: config?.disclosed ?? false, hasInstallationId: Boolean(config?.installationId), installationId: config?.installationId ?? null, identityEnabled: config?.identityEnabled ?? true, identityDisclosed: config?.identityDisclosed ?? false, endpoint: this.endpoint, schemaVersion: 1 };
+  }
+
+  async configureIdentity(action) {
+    if (action === 'status') return this.status();
+    if (!['enable', 'disable'].includes(action)) throw new Error('Identity action must be status, enable, or disable.');
+    const current = await this.readConfig() ?? { version: CONFIG_VERSION, enabled: true, disclosed: false, graceConsumed: true, installationEventPending: true };
+    const enabled = action === 'enable';
+    // Rotate at both boundaries to avoid identifying an earlier anonymous period.
+    if (enabled !== (current.identityEnabled !== false)) {
+      Object.assign(current, { installationId: null, token: null, tokenExpiresAt: null });
+    }
+    if (enabled && current.identityEnabled === false) current.identityDisclosed = false;
+    current.identityEnabled = enabled;
+    await this.saveConfig(current);
+    return this.status();
   }
 
   async configure(action) {

package/job-application-agent/scripts/telemetry-schema.mjs

@@ -31,6 +31,9 @@ const FAILURE_POINTS = values('role-scope', 'company-problem', 'constraints', 'i
 const ERROR_CODES = values('invalid_input', 'network_failure', 'relay_unavailable', 'authentication_required', 'site_changed', 'upload_failed', 'submission_unconfirmed', 'rate_limited', 'internal_error');
 const MATCH_TAGS = values('role_family', 'seniority', 'skills', 'industry', 'location', 'remote', 'salary', 'ai', 'product', 'leadership', 'authorization');
 const GAP_TAGS = values('role_family', 'seniority', 'skills', 'industry', 'location', 'salary_unknown', 'salary_below', 'authorization_unclear', 'sponsorship', 'experience', 'domain', 'other');
+const DISCOVERY_SOURCE_KEYS = values('direct-company-careers', 'linkedin-jobs-feed', 'x-hiring-feed', 'yc-work-at-a-startup', 'yc-company-directory', 'hacker-news-who-is-hiring', 'we-work-remotely', 'a16z-build-jobs', 'engg-space', 'js-guru-jobs', 'linux-careers', 'indeed', 'recruiter-inbound', 'user-supplied-leads', 'community');
+const DISCOVERY_BLOCKERS = values('login', 'mfa', 'captcha', 'site-error', 'access-unavailable');
+const CONCENTRATION_REASONS = values('stronger-fit', 'alternatives-exhausted', 'access-blocked', 'candidate-directed');
 
 const text = (max, identitySafe = false) => ({ kind: 'text', max, identitySafe });
 const integer = (min, max) => ({ kind: 'integer', min, max });
@@ -43,6 +46,7 @@ const JOB = {
 };
 
 export const EVENT_SCHEMAS = {
+  source_checked: { required: { sourceId: enumValue(DISCOVERY_SOURCE_KEYS), status: enumValue(values('searched', 'blocked')), reviewedCount: integer(0, 10000), qualifiedCount: integer(0, 10000) }, optional: { blocker: enumValue(DISCOVERY_BLOCKERS) } },
   installation_started: { required: { osFamily: enumValue(values('macos', 'linux', 'windows', 'other')), nodeMajor: integer(20, 99), submissionMode: enumValue(SUBMISSION_MODES) } },
   command_completed: { required: { command: enumValue(COMMANDS), result: enumValue(RESULTS), durationBucket: enumValue(DURATIONS) } },
   job_discovered: { required: { ...JOB, source: enumValue(SOURCES), jobCountry: text(80, true), workMode: enumValue(WORK_MODES), seniority: enumValue(SENIORITIES), employmentType: enumValue(EMPLOYMENT), roleFamily: enumValue(ROLE_FAMILIES) }, optional: { salaryCurrency: { kind: 'currency' }, salaryMin: integer(0, 10000000), salaryMax: integer(0, 10000000) } },
@@ -52,7 +56,7 @@ export const EVENT_SCHEMAS = {
   application_paused: { required: { jobHash: { kind: 'hash' }, ats: enumValue(ATS), stage: enumValue(STAGES), reason: enumValue(PAUSE_REASONS) } },
   application_skipped: { required: { jobHash: { kind: 'hash' }, reason: enumValue(SKIP_REASONS), fitScore: integer(0, 100), eligibility: enumValue(ELIGIBILITY) } },
   application_submitted: { required: { ...JOB, durationBucket: enumValue(DURATIONS), fieldsFilled: integer(0, 500), shortAnswerCount: integer(0, 100), resumeUploaded: boolean, approvalMode: enumValue(APPROVAL_MODES) } },
-  round_completed: { required: { requestedCount: integer(1, 1000), submittedCount: integer(0, 1000), assessedCount: integer(0, 10000), skippedCount: integer(0, 10000), pausedCount: integer(0, 10000), errorCount: integer(0, 10000), durationBucket: enumValue(DURATIONS) } },
+  round_completed: { required: { requestedCount: integer(1, 1000), submittedCount: integer(0, 1000), assessedCount: integer(0, 10000), skippedCount: integer(0, 10000), pausedCount: integer(0, 10000), errorCount: integer(0, 10000), durationBucket: enumValue(DURATIONS) }, optional: { attemptedSourceCount: integer(0, 10000), searchedSourceCount: integer(0, 10000), blockedSourceCount: integer(0, 10000), maxSourceSharePercent: integer(0, 100), concentrationReason: enumValue(CONCENTRATION_REASONS) } },
   outcome_recorded: {
     required: { ...JOB, outcome: enumValue(OUTCOMES), daysSinceSubmission: integer(0, 3650) },
     optional: { interviewQuality: enumValue(INTERVIEW_QUALITIES), failurePoint: enumValue(FAILURE_POINTS) },
@@ -118,6 +122,11 @@ export function validateEvent(input) {
   }
   for (const [name, rule] of Object.entries(schema.optional ?? {})) if (name in input.properties) properties[name] = validateProperty(name, input.properties[name], rule);
   if (input.event === 'outcome_recorded' && properties.failurePoint && !properties.interviewQuality) throw new Error('failurePoint requires interviewQuality.');
+  if (input.event === 'source_checked') {
+    if (properties.qualifiedCount > properties.reviewedCount) throw new Error('qualifiedCount cannot exceed reviewedCount.');
+    if (properties.status === 'blocked' && (!properties.blocker || properties.reviewedCount !== 0 || properties.qualifiedCount !== 0)) throw new Error('Blocked sources require a blocker and zero counts.');
+    if (properties.status === 'searched' && properties.blocker) throw new Error('Searched sources cannot have a blocker.');
+  }
   const result = { event: input.event, properties };
   if (new TextEncoder().encode(JSON.stringify(result)).length > TELEMETRY_MAX_BYTES) throw new Error('Telemetry event exceeds 4 KB.');
   return result;
@@ -142,19 +151,37 @@ export async function jobIdentity(value) {
   return { jobHash: [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join(''), domain: new URL(canonical).hostname };
 }
 
-export function createTelemetryEnvelope({ installationId, token, event, properties, skillVersion }) {
+// Identity is a separate allowlisted envelope field, never arbitrary event input.
+export function validateTelemetryIdentity(input) {
+  if (!input || Array.isArray(input) || typeof input !== 'object') throw new Error('Telemetry identity must be an object.');
+  for (const key of Object.keys(input)) if (!['name', 'email'].includes(key)) throw new Error('Unknown telemetry identity property.');
+  const identity = {};
+  for (const [key, max] of [['name', 160], ['email', 254]]) {
+    if (!(key in input)) continue;
+    const value = input[key];
+    if (typeof value !== 'string' || !value.trim() || value.length > max || /[\x00-\x1f\x7f]/.test(value)) throw new Error('Invalid telemetry identity field.');
+    const normalized = value.trim();
+    if (key === 'email' && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) throw new Error('Invalid telemetry identity email.');
+    identity[key] = normalized;
+  }
+  if (!Object.keys(identity).length) throw new Error('Telemetry identity must include name or email.');
+  return identity;
+}
+
+export function createTelemetryEnvelope({ installationId, token, event, properties, skillVersion, identity }) {
   if (!UUID.test(installationId)) throw new Error('installationId must be an anonymous UUID.');
   if (typeof token !== 'string' || token.length < 8 || token.length > 2048) throw new Error('token is invalid.');
   if (typeof skillVersion !== 'string' || !VERSION.test(skillVersion)) throw new Error('skillVersion is invalid.');
   const safe = validateEvent(typeof event === 'string' ? { event, properties } : event);
   const envelope = { schemaVersion: TELEMETRY_SCHEMA_VERSION, skillVersion, installationId, token, ...safe };
+  if (identity !== undefined) envelope.identity = validateTelemetryIdentity(identity);
   if (new TextEncoder().encode(JSON.stringify(envelope)).length > TELEMETRY_MAX_BYTES) throw new Error('Telemetry payload exceeds 4 KB.');
   return envelope;
 }
 
 export function validateTelemetryEnvelope(input) {
   if (!input || Array.isArray(input) || typeof input !== 'object') throw new Error('Telemetry payload must be an object.');
-  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'event', 'properties']);
+  const allowed = new Set(['schemaVersion', 'skillVersion', 'installationId', 'token', 'event', 'properties', 'identity']);
   for (const key of Object.keys(input)) if (!allowed.has(key)) throw new Error(`Unknown telemetry envelope property: ${key}.`);
   if (input.schemaVersion !== TELEMETRY_SCHEMA_VERSION) throw new Error('Unsupported telemetry schema version.');
   return createTelemetryEnvelope(input);

package/job-application-agent/scripts/version.mjs

@@ -1 +1 @@
-export const SKILL_VERSION = '3.2.1';
+export const SKILL_VERSION = '3.4.0';

package/job-application-agent/tests/job-application.test.mjs

@@ -5,8 +5,9 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import test from 'node:test';
 import { fileURLToPath } from 'node:url';
+import { createServer } from 'node:http';
 
-import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
+import { buildReview, commandCategory, durationBucket, migrateProfile, profileStatus, scoreJob, telemetryErrorCode, telemetryJobAssessed, validateLedgerEntry, validateProfile, validateSubmissionTelemetry } from '../scripts/job-application.mjs';
 
 const target = {
   name: 'Test Candidate',
@@ -56,9 +57,9 @@ function isolatedCliEnv(directory) {
   };
 }
 
-function runCli(script, args, input, env) {
+function runCli(script, args, input, env, runtimeArgs = []) {
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, [script, ...args], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    const child = spawn(process.execPath, [...runtimeArgs, script, ...args], { env, stdio: ['pipe', 'pipe', 'pipe'] });
     let stdout = '';
     let stderr = '';
     child.stdout.on('data', (chunk) => { stdout += chunk; });
@@ -88,6 +89,43 @@ test('returns the canonical resume path for direct browser uploads', async (t) =
   assert.deepEqual(result, { path: resume });
 });
 
+test('preserves the Linux secret-tool install error for profile-dependent commands', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-profile-error-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  const platformOverride = `data:text/javascript,${encodeURIComponent("Object.defineProperty(process, 'platform', { value: 'linux' });")}`;
+  const env = { ...isolatedCliEnv(directory), PATH: '' };
+
+  const result = await runCli(script, ['profile', 'field', 'name'], undefined, env, ['--import', platformOverride]);
+
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /secret-tool is not installed/);
+  assert.doesNotMatch(result.stderr, /profile needs migration/i);
+});
+
+test('preserves an unavailable Linux Secret Service error for profile-dependent commands', {
+  skip: process.platform === 'win32',
+}, async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-service-error-'));
+  const toolDirectory = await mkdtemp(join(tmpdir(), 'job-agent-secret-tool-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  t.after(() => rm(toolDirectory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const toolPath = join(toolDirectory, 'secret-tool');
+  const toolSource = '#!/bin/sh\nprintf "%s\\n" "secret-tool: Secret Service is unavailable" >&2\nexit 1\n';
+  await writeFile(toolPath, toolSource, { mode: 0o755 });
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  const platformOverride = `data:text/javascript,${encodeURIComponent("Object.defineProperty(process, 'platform', { value: 'linux' });")}`;
+  const env = { ...isolatedCliEnv(directory), PATH: toolDirectory };
+
+  const result = await runCli(script, ['profile', 'field', 'name'], undefined, env, ['--import', platformOverride]);
+
+  assert.equal(result.code, 1);
+  assert.match(result.stderr, /Secret Service could not read the profile/);
+  assert.doesNotMatch(result.stderr, /profile needs migration/i);
+});
+
 test('migrates a legacy profile without discarding identity or salary preference', () => {
   const legacy = {
     name: 'Test Candidate', email: 'candidate@example.com', phone: '+1 555 0100',
@@ -428,6 +466,8 @@ test('maps commands and durations to bounded telemetry categories', () => {
   assert.equal(durationBucket(700), 'under-1s');
   assert.equal(durationBucket(70_000), '1-2m');
   assert.equal(durationBucket(2_000_000), '15m-plus');
+  assert.equal(telemetryErrorCode(new Error('Secret Service could not read the profile.')), 'authentication_required');
+  assert.equal(telemetryErrorCode(new Error('secret-tool is not installed.')), 'authentication_required');
 });
 
 test('builds a structured assessment event without description or candidate profile data', async () => {
@@ -453,5 +493,81 @@ test('telemetry CLI controls are private and reset removes anonymous credentials
   assert.equal(disabled.enabled, false);
   const reset = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'reset'], { env, encoding: 'utf8' }));
   assert.equal(reset.hasInstallationId, false);
+  const identityDisabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'disable'], { env, encoding: 'utf8' }));
+  assert.equal(identityDisabled.identityEnabled, false);
+  assert.equal(identityDisabled.enabled, false);
+  const identityEnabled = JSON.parse(execFileSync(process.execPath, [script, 'telemetry', 'identity', 'enable'], { env, encoding: 'utf8' }));
+  assert.equal(identityEnabled.identityEnabled, true);
+  assert.equal(identityEnabled.enabled, false);
+  assert.equal(identityEnabled.identityDisclosed, false);
   if (process.platform !== 'win32') assert.equal((await stat(join(directory, 'telemetry.json'))).mode & 0o777, 0o600);
 });
+
+test('CLI emits bounded source coverage without private evidence or attribution', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-coverage-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push(JSON.parse(raw));
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify({ accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: true, disclosed: true, graceConsumed: true, installationEventPending: false, identityEnabled: false, installationId: crypto.randomUUID(), token: 'synthetic-token', tokenExpiresAt: '2099-01-01T00:00:00Z' }));
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const started = await runCli(script, ['round', 'start', '--stdin'], { requestedCount: 1 }, env);
+  assert.equal(started.code, 0, started.stderr);
+  const roundId = JSON.parse(started.stdout).roundId;
+  const sourceId = 'community-0123456789abcdef';
+  const report = await runCli(script, ['round', 'source', '--stdin'], { roundId, sourceId, status: 'searched', reviewedCount: 8, qualifiedCount: 2, evidence: 'Private search query and candidate context', applicationIds: [] }, env);
+  assert.equal(report.code, 0, report.stderr);
+  const event = captured.find((body) => body.event === 'source_checked');
+  assert.ok(event, JSON.stringify(captured));
+  assert.deepEqual(event.properties, { sourceId: 'community', status: 'searched', reviewedCount: 8, qualifiedCount: 2 });
+  assert.equal(JSON.stringify(captured).includes('Private search query'), false);
+  assert.equal(JSON.stringify(captured).includes(roundId), false);
+  assert.equal(JSON.stringify(captured).includes(sourceId), false);
+});
+
+test('CLI attaches only explicit saved name/email after disclosure and opt-out continues anonymous usage', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-identity-cli-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const captured = [];
+  const server = createServer(async (request, response) => {
+    let raw = '';
+    for await (const chunk of request) raw += chunk;
+    captured.push({ path: request.url, body: JSON.parse(raw) });
+    response.setHeader('content-type', 'application/json');
+    response.end(JSON.stringify(request.url === '/v1/install' ? { installationId: crypto.randomUUID(), token: 'synthetic-relay-token', expiresAt: '2099-01-01T00:00:00Z' } : { accepted: true }));
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  // Synthetic Secret Service implementation: never touch the developer's real profile.
+  const preload = `import cp from 'node:child_process'; import { syncBuiltinESMExports } from 'node:module'; Object.defineProperty(process, 'platform', { value: 'linux' }); cp.execFileSync = (file, args) => { if (file === 'secret-tool' && args[0] === 'lookup') return ${JSON.stringify(JSON.stringify(target))}; throw new Error('Unexpected secret operation'); }; syncBuiltinESMExports();`;
+  const runtimeArgs = ['--import', `data:text/javascript,${encodeURIComponent(preload)}`];
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_TELEMETRY_URL: `http://127.0.0.1:${server.address().port}` };
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const run = (args) => runCli(script, args, undefined, env, runtimeArgs);
+  const first = await run(['profile', 'check']);
+  assert.equal(first.code, 0, first.stderr);
+  assert.match(first.stderr, /name and email sharing is enabled by default/i);
+  assert.ok(captured.length > 0);
+  assert.ok(captured.every(({ body }) => body.identity === undefined));
+  const second = await run(['profile', 'check']);
+  assert.equal(second.code, 0, second.stderr);
+  const identified = captured.at(-1).body;
+  assert.deepEqual(identified.identity, { name: target.name, email: target.email });
+  assert.equal(JSON.stringify(identified).includes(target.phone), false);
+  assert.equal(JSON.stringify(identified).includes(target.location), false);
+  const count = captured.length;
+  const optedOut = await run(['telemetry', 'identity', 'disable']);
+  assert.equal(optedOut.code, 0, optedOut.stderr);
+  assert.equal(captured.length, count);
+  assert.equal((await run(['profile', 'check'])).code, 0);
+  assert.equal(captured.at(-1).body.identity, undefined);
+  assert.notEqual(captured.at(-1).body.installationId, identified.installationId);
+});

package/job-application-agent/tests/linux-secret-service.integration.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import { createSecretStore, LINUX_SECRET_MAX_BYTES } from '../scripts/secret-store.mjs';
+
+const enabled = process.platform === 'linux'
+  && process.env.JOB_APPLICATION_AGENT_LINUX_SECRET_SERVICE_TEST === '1';
+
+test('Linux Secret Service supports the real profile CLI lifecycle', { skip: !enabled }, async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-secret-service-'));
+  const service = `com.vaibhavarora.job-application-agent.test.${process.pid}.${Date.now()}`;
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const env = {
+    ...process.env,
+    JOB_APPLICATION_AGENT_KEYCHAIN_SERVICE: service,
+    JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
+    JOB_APPLICATION_AGENT_STATE_DIR: directory,
+  };
+  t.after(async () => {
+    execFileSync('secret-tool', ['clear', 'service', service, 'account', 'profile'], { stdio: 'ignore' });
+    await rm(directory, { recursive: true, force: true });
+  });
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({
+    version: 1,
+    enabled: false,
+    disclosed: true,
+    graceConsumed: true,
+    installationEventPending: false,
+  }));
+
+  const store = createSecretStore({ platform: 'linux', env, service });
+  const first = JSON.stringify({ name: 'Secret Service integration' });
+  store.writeProfile(first);
+  assert.equal(store.readProfile(), first);
+  assert.throws(
+    () => store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES + 1)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.equal(store.readProfile(), first);
+
+  const profile = {
+    name: 'Linux Test Candidate',
+    email: 'candidate@example.com',
+    phone: '+1 555 0100',
+    location: 'Toronto, Canada',
+    workAuthorization: 'Canada',
+    roleFamilies: ['product-engineering'],
+    seniority: ['senior'],
+    skills: ['JavaScript'],
+    targetLocations: ['Canada'],
+    excludedLocations: [],
+    workModes: ['remote'],
+    industries: ['software'],
+    excludedCompanies: [],
+    submissionMode: 'review-each',
+    yearsExperience: 8,
+    autoSubmitMinScore: 80,
+    manualReviewMinScore: 70,
+    minMustHaveCoverage: 70,
+  };
+  const setResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'set', '--stdin'], {
+    env,
+    input: JSON.stringify(profile),
+    encoding: 'utf8',
+  }));
+  const checkResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'check'], { env, encoding: 'utf8' }));
+  const fieldResult = JSON.parse(execFileSync(process.execPath, [script, 'profile', 'field', 'name'], { env, encoding: 'utf8' }));
+
+  assert.equal(setResult.stored, true);
+  assert.equal(checkResult.configured, true);
+  assert.deepEqual(fieldResult, { name: profile.name });
+});

package/job-application-agent/tests/secret-store.test.mjs

@@ -8,10 +8,11 @@ import {
   createSecretStore,
   DEFAULT_SECRET_SERVICE,
   LEGACY_SECRET_SERVICE,
-  LINUX_PROFILE_ERROR,
+  LINUX_SECRET_MAX_BYTES,
   migrateLegacyStateDir,
   PROFILE_ACCOUNT,
   resolveStateDir,
+  UNSUPPORTED_PLATFORM_ERROR,
 } from '../scripts/secret-store.mjs';
 
 const sampleProfile = {
@@ -132,8 +133,115 @@ test('windows store keeps a wrapping key small and a profile larger than 2560 by
   assert.ok(files.get(profileFile).length > 2560);
 });
 
-test('linux store rejects secure profile storage with a clear error', () => {
-  const store = createSecretStore({ platform: 'linux' });
-  assert.throws(() => store.readProfile(), { message: LINUX_PROFILE_ERROR });
-  assert.throws(() => store.writeProfile('{}'), { message: LINUX_PROFILE_ERROR });
+test('linux store writes and reads the profile via Secret Service', () => {
+  const secrets = new Map();
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      if (!secrets.has(`${service}/${account}`)) throw new Error('not found');
+      return `${secrets.get(`${service}/${account}`)}\n`;
+    }
+    if (args[0] === 'store') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      secrets.set(`${service}/${account}`, options.input);
+      return '';
+    }
+    throw new Error(`unexpected secret-tool args: ${args.join(' ')}`);
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  store.writeProfile(JSON.stringify(sampleProfile));
+  assert.equal(store.readProfile(), JSON.stringify(sampleProfile));
+});
+
+test('linux store reports a clear error when secret-tool is not installed', () => {
+  const exec = () => { throw Object.assign(new Error('spawn secret-tool ENOENT'), { code: 'ENOENT' }); };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  assert.throws(() => store.writeProfile(JSON.stringify(sampleProfile)), /libsecret-tools/);
+  assert.throws(() => store.readProfile(), /libsecret-tools/);
+});
+
+test('linux store reports a clear error when keyring storage fails', () => {
+  const exec = (command, args) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') throw new Error('not found');
+    throw new Error('keyring locked');
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  assert.throws(() => store.writeProfile(JSON.stringify(sampleProfile)), /could not store the profile/);
+  assert.throws(() => store.readProfile(), /missing or unreadable/);
+});
+
+test('linux store treats a successful empty lookup as a missing profile', () => {
+  const store = createSecretStore({ platform: 'linux', execFileSync: () => '' });
+  assert.throws(() => store.readProfile(), /missing or unreadable/);
+});
+
+test('linux store rejects profiles that secret-tool would silently truncate', () => {
+  const stored = [];
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    assert.equal(args[0], 'store');
+    stored.push(options.input);
+    return '';
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+
+  store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES));
+  assert.equal(stored[0].length, LINUX_SECRET_MAX_BYTES);
+  assert.throws(
+    () => store.writeProfile('x'.repeat(LINUX_SECRET_MAX_BYTES + 1)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.throws(
+    () => store.writeProfile('é'.repeat((LINUX_SECRET_MAX_BYTES + 1) / 2)),
+    /too large for Linux Secret Service storage/,
+  );
+  assert.equal(stored.length, 1);
+});
+
+test('linux store distinguishes an unavailable Secret Service from a missing profile', () => {
+  const exec = () => {
+    throw Object.assign(new Error('secret-tool exited with status 1'), {
+      stderr: 'secret-tool: Cannot autolaunch D-Bus without X11 $DISPLAY\n',
+    });
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+
+  assert.throws(() => store.readProfile(), /Secret Service could not read the profile/);
+});
+
+test('linux store keeps a prior profile readable when a later write fails', () => {
+  const secrets = new Map();
+  let failWrites = false;
+  const exec = (command, args, options) => {
+    assert.equal(command, 'secret-tool');
+    if (args[0] === 'lookup') {
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      if (!secrets.has(`${service}/${account}`)) throw new Error('not found');
+      return `${secrets.get(`${service}/${account}`)}\n`;
+    }
+    if (args[0] === 'store') {
+      if (failWrites) throw new Error('keyring locked');
+      const service = args[args.indexOf('service') + 1];
+      const account = args[args.indexOf('account') + 1];
+      secrets.set(`${service}/${account}`, options.input);
+      return '';
+    }
+    throw new Error(`unexpected secret-tool args: ${args.join(' ')}`);
+  };
+  const store = createSecretStore({ platform: 'linux', execFileSync: exec });
+  store.writeProfile(JSON.stringify(sampleProfile));
+  failWrites = true;
+  assert.throws(() => store.writeProfile(JSON.stringify({ ...sampleProfile, name: 'Overwrite' })), /could not store the profile/);
+  assert.equal(store.readProfile(), JSON.stringify(sampleProfile));
+});
+
+test('unsupported platforms retain an explicit profile storage error', () => {
+  const store = createSecretStore({ platform: 'freebsd' });
+  assert.throws(() => store.readProfile(), { message: UNSUPPORTED_PLATFORM_ERROR });
+  assert.throws(() => store.writeProfile('{}'), { message: UNSUPPORTED_PLATFORM_ERROR });
 });