job-application-agent 3.4.0 → 3.4.2

package/README.md

@@ -9,22 +9,42 @@
 [![MIT License](https://img.shields.io/badge/license-MIT-2563EB.svg)](LICENSE)
 [![Agent Skills](https://img.shields.io/badge/Agent_Skills-compatible-111827)](job-application-agent/SKILL.md)
 
-[Get started](#-get-started) · [Safety](#-safety) · [Privacy](#-privacy) · [Dashboard](https://job-application-agent-telemetry.varora1406.workers.dev/) · [Security](SECURITY.md)
+[Get started](#-get-started) · [Privacy in 30 seconds](#-privacy-in-30-seconds) · [Safety](#-safety) · [Privacy](#-privacy) · [Where to find it](#-where-to-find-it) · [Dashboard](https://job-application-agent-telemetry.varora1406.workers.dev/) · [Security](SECURITY.md)
 
 </div>
 
+```bash
+npx job-application-agent@latest install
+```
+
+```bash
+npx skills add vaibhavarora14/job-application-agent
+```
+
 ---
 
 Job Application Agent is an [Agent Skill](https://agentskills.io/specification) that helps a coding agent discover, evaluate, complete, and track your own job applications. It uses one verified résumé, checks eligibility and duplicates, and records only confirmed submissions.
 
+## 🔒 Privacy in 30 seconds
+
+- OS credential store for profile
+- One verified résumé; refuse unverifiable claims
+- Never reads cookies/session files; pauses for SSO/MFA/CAPTCHA/legal
+- Only records confirmed submissions (filled ≠ applied)
+- Analytics/community sharing opt-out via CLI
+
 ## 🚀 Get started
 
-Install it:
+Install it with either:
 
 ```bash
 npx job-application-agent@latest install
 ```
 
+```bash
+npx skills add vaibhavarora14/job-application-agent
+```
+
 Then tell your coding agent:
 
 ```text
@@ -49,6 +69,8 @@ On Linux, profile storage uses the Secret Service via the `secret-tool` CLI. Ins
 
 Unlike macOS Keychain or Windows Credential Manager, the Linux Secret Service has no always-running system daemon: a keyring daemon (GNOME Keyring, KWallet, or similar) must be running in the user session for `secret-tool` to store or read the profile. On a desktop login this is normally already the case; on headless servers, containers, or SSH-only sessions, start one explicitly (e.g. `gnome-keyring-daemon --unlock --components=secrets`) before first use.
 
+For one person's agents across several trusted hosts, an optional private Cloudflare D1 backend with R2 (or a private Workers KV blob fallback) shares profile, résumé, application, outcome, round, answer, and attention state. Each host receives a separate revocable credential, and one renewable lease ensures only one host submits applications at a time. See [`CLOUD_STATE.md`](job-application-agent/references/CLOUD_STATE.md).
+
 ## ✨ What it does
 
 | Stage | Behavior |
@@ -114,15 +136,17 @@ Rounds require recorded attempts across at least three distinct discovery source
 
 | Data | Where it stays |
 |---|---|
-| Profile | macOS Keychain, Windows Credential Manager, or Linux Secret Service (libsecret) |
+| Profile | OS credential store, or private D1 with an owner-only local cache |
 | Analytics name and email (unless opted out) | Private PostHog events after disclosure; local sharing preference in owner-only state |
-| Résumé and ledgers | Owner-only local state directory |
+| Résumé and ledgers | Owner-only local state, or private D1 plus private blob storage when configured |
 | Browser login | Existing browser session |
 | Community-sharing preference and delivery receipts | Owner-only local state directory |
 | Skill code | Version-controlled installation directory |
 
 Candidate data, résumés, application history, credentials, and browser sessions are never committed to this repository.
 
+Private cloud state is opt-in and isolated from public analytics/community services. Client tokens remain in owner-only host configuration, only token hashes are stored server-side, and browser/Gmail credentials never enter the backend.
+
 Structured usage analytics and name/email sharing are enabled by default for support and product improvement. After a disclosure command with no identity transmission, subsequent commands include the name and email explicitly saved in the candidate profile in the maintainer's private PostHog analytics. No résumé content, other profile fields, prompts, answers, browser data, IP addresses, or raw errors are sent. `telemetry identity disable` stops identity sharing and rotates the analytics UUID so future usage is anonymous; `telemetry disable` stops all analytics. Previously collected events remain subject to the retention policy.
 
 Anonymous community sharing is also enabled by default, separately from analytics. Confirmed applications share only a canonical public job URL, company, role, application channel, optional coarse discovery source, and derived provider URL—never candidate identity, answers, résumé, score, referral parameters, or submission timestamp. Repeatable discovery surfaces share their bounded catalog metadata through a maintainer-review queue. The registry stores no raw installation IDs; record-scoped contributor hashes are used only for deduplication and counts, never as identity or publication authority.
@@ -154,6 +178,18 @@ Updates are staged and validated before replacement. Private candidate state liv
 
 </details>
 
+## 📍 Where to find it
+
+- [jobappagent.com](https://jobappagent.com) — product site (cloud launch Oct 1; open-source skill on GitHub/npm)
+- [GitHub](https://github.com/vaibhavarora14/job-application-agent)
+- [npm](https://www.npmjs.com/package/job-application-agent)
+- [skills.sh](https://skills.sh/vaibhavarora14/job-application-agent)
+- [Agent Skills discussion](https://github.com/agentskills/agentskills/discussions/537)
+- [awesome-agent-skills (Community Skills)](https://github.com/VoltAgent/awesome-agent-skills)
+- [SkillHub](https://www.skillhub.club/app/skills/b99cbef5-2445-47d0-94d0-e6d1fac81263) (may still be in review)
+- [ClawHub](https://clawhub.ai/vaibhavarora14/skills/job-application-agent)
+- [cursor.directory](https://cursor.directory/plugins/job-application-agent) (pending review)
+
 ## 🧰 Develop
 
 ```bash

package/installer/src/installer.mjs

@@ -35,11 +35,26 @@ async function isDirectory(filePath) {
   try { return (await lstat(filePath)).isDirectory(); } catch (error) { if (error.code === 'ENOENT') return false; throw error; }
 }
 
-async function validatePackagedSkill(source) {
+async function packagedCapabilities(source) {
+  try {
+    const value = JSON.parse(await readFile(path.join(source, 'capabilities.json'), 'utf8'));
+    return Array.isArray(value.capabilities) ? value.capabilities.filter((item) => typeof item === 'string') : [];
+  } catch (error) {
+    if (error.code === 'ENOENT') return [];
+    throw new Error('Invalid packaged skill: capabilities.json is malformed.');
+  }
+}
+
+async function validatePackagedSkill(source, requiredCapabilities = []) {
   const skillFile = path.join(source, 'SKILL.md');
   const content = await readFile(skillFile, 'utf8').catch(() => '');
   if (!content.trim()) throw new Error('Invalid packaged skill: SKILL.md is missing or empty.');
   await stat(path.join(source, 'scripts', 'job-application.mjs')).catch(() => { throw new Error('Invalid packaged skill: application CLI is missing.'); });
+  const capabilities = await packagedCapabilities(source);
+  for (const required of requiredCapabilities) {
+    if (!capabilities.includes(required)) throw new Error(`Invalid packaged skill: required capability ${required} is missing.`);
+  }
+  return capabilities;
 }
 
 async function writeConfig(configPath, config) {
@@ -131,12 +146,13 @@ export async function installSkill({
   const paths = pathsFor(home);
   const source = path.join(packageRoot, SKILL_NAME);
   await migrateLegacyCodexInstall({ homeDir, agentHome: home, legacyHome: legacyHome || resolveLegacyCodexHome(homeDir) });
-  await validatePackagedSkill(source);
+  const prior = await readInstallStatus({ homeDir, agentHome: home });
+  const capabilities = await validatePackagedSkill(source, prior.requiredCapabilities ?? []);
   await mkdir(path.dirname(paths.target), { recursive: true });
   await mkdir(paths.managerDir, { recursive: true });
   const staging = path.join(paths.managerDir, `staging-${Date.now()}-${Math.random().toString(16).slice(2)}`);
   await cp(source, staging, { recursive: true, force: true });
-  await validatePackagedSkill(staging);
+  await validatePackagedSkill(staging, prior.requiredCapabilities ?? []);
 
   const hadTarget = await exists(paths.target);
   if (hadTarget) {
@@ -151,13 +167,14 @@ export async function installSkill({
     throw error;
   }
 
-  const prior = await readInstallStatus({ homeDir, agentHome: home });
   const config = {
     installed: true,
     installedVersion: packageVersion,
     automaticUpdates: prior.installed ? prior.automaticUpdates !== false : true,
     installedAt: prior.installedAt || new Date().toISOString(),
     updatedAt: new Date().toISOString(),
+    capabilities,
+    ...(prior.requiredCapabilities ? { requiredCapabilities: prior.requiredCapabilities } : {}),
   };
   await writeConfig(paths.configPath, config);
   await syncVendorSkillCopies({ homeDir, sourceSkillDir: paths.target });

package/job-application-agent/SKILL.md

@@ -20,7 +20,7 @@ Use `scripts/job-application.mjs` for private state and deterministic checks. Re
 1. Ask for a local PDF or read-only Google Docs resume URL. Import it without modifying the source.
 2. Run `profile check`. If it reports missing or legacy fields, collect only facts that cannot be preserved or defaulted, then run `profile migrate --stdin`. Use `profile set --stdin` for a new profile.
 3. Preserve identity fields during migration. Map legacy `salaryPreference` to `targetCompensation`. Add `compensationFloor` only when the candidate provides an amount, currency, and annual comparison basis.
-4. Store the profile in OS-backed profile storage (macOS Keychain, Windows Credential Manager with a DPAPI-protected local file, or Linux Secret Service via `secret-tool`). Store the canonical resume and append-only ledgers in the owner-only state directory.
+4. Store the profile in OS-backed profile storage (macOS Keychain, Windows Credential Manager with a DPAPI-protected local file, or Linux Secret Service via `secret-tool`). Store the canonical resume and append-only ledgers in the owner-only state directory. When private cloud state is configured, read and write the profile, résumé, and structured records through the v2 adapter instead. Owner-only local caches support browser uploads on macOS and Linux without Keychain access.
 5. Use `review-each` for per-application approval. Use `routine-auto` only when the current request authorizes the destination or batch and every automatic-eligibility condition passes.
 6. When the candidate explicitly grants continuing autonomy, read [references/AUTONOMY.md](references/AUTONOMY.md) and persist it with `autonomy grant --stdin`. Do not repeat skill-level upload or submission approval prompts while the active grant and profile both use `routine-auto`.
 7. Obey browser and tool confirmation requirements regardless of the stored mode or autonomy grant.
@@ -54,19 +54,21 @@ Do not lower seniority, compensation, location, work mode, or evidence threshold
 For batches, scheduled work, or resumable handoffs, read [references/RUNS.md](references/RUNS.md), create a round ID, and use the attention and friction queues.
 Check `round status` after the initial discovery pass and before submitting. Preserve source attribution independently of the ATS. A round cannot complete without recorded coverage and attribution; if one discovery source supplies more than 60% of confirmed submissions, explain why using the reviewed alternatives and their fit or access results. Do not submit weaker matches to balance source percentages. Report searched sources, blockers, source mix, and any concentration explanation when handing off or completing a round.
 
-1. Recheck employer, title, direct domain, posting status, eligibility, and `autoEligible` immediately before submission.
-2. Run `ledger check --stdin` with the internal ledger ID, canonical URL, employer job ID, company, and role when available. Review both requisition duplicate status and same-company history.
-3. Stop on a hard ledger-ID, canonical-URL, employer-job-ID, or requisition duplicate. Treat a same-company/same-role alias as a possible duplicate. Use `duplicateOverride: "NEW REQUISITION CONFIRMED"` only after verifying it is a distinct requisition.
-4. For a genuinely different role at a previously applied company, follow `companyReapply`: proceed automatically only when it returns `eligible-after-cooldown` (15 full days since the latest company application and no recorded outcome). `cooldown-active` and `follow-up-present` require the candidate's explicit approval and `companyReapplyOverride: "CANDIDATE APPROVED EARLY REAPPLICATION"`.
-5. Keep authentication in the existing browser session. Never inspect cookies, local storage, passwords, or session files.
-6. Fill only explicit profile fields, candidate-provided answers, or facts verified in the canonical resume.
-7. Follow [references/APPLICATION_GUIDANCE.md](references/APPLICATION_GUIDANCE.md) for narrative answers.
-8. Upload only the canonical resume unless the candidate explicitly provides another attachment. Resolve its absolute path with `resume path`, then follow [references/BROWSER_UPLOADS.md](references/BROWSER_UPLOADS.md). Use the browser's privileged path-based upload capability first; treat a visible native file picker as a fallback.
-9. Do not answer demographic questions. Stop for login/SSO/MFA, CAPTCHA, legal attestations, unclear authorization or compensation, sensitive identifiers, and judgment-only questions.
-10. Verify every required field, answer, attachment, and disclosure. Submit when the current request or active autonomy grant authorizes it.
-11. Record `submitted` only after visible success confirmation, using independent `discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` values. `ledger add` automatically shares the sanitized public job metadata and durably retries on relay failure; do not run a separate manual contribution. Record no submission when confirmation is missing or ambiguous.
-12. Record workflow telemetry with `telemetry record --stdin`. Let `ledger add` emit `application_submitted`; do not emit it twice. Pass job URLs and structured metrics only through documented transient fields.
-13. Queue hard stops with `attention add --stdin` and continue elsewhere. Record reproducible general-purpose failures with `friction record --stdin`; improvement work must never delay application work.
+1. When private cloud state is configured, run `cloud status`, acquire the application-run lease with `cloud lease-acquire`, and renew it at least every five minutes. A client without the live lease may research and draft but must not submit.
+2. Recheck employer, title, direct domain, posting status, eligibility, and `autoEligible` immediately before submission.
+3. Run `ledger check --stdin` with the internal ledger ID, canonical URL, employer job ID, company, and role when available. Review both requisition duplicate status and same-company history.
+4. Stop on a hard ledger-ID, canonical-URL, employer-job-ID, or requisition duplicate. Treat a same-company/same-role alias as a possible duplicate. Use `duplicateOverride: "NEW REQUISITION CONFIRMED"` only after verifying it is a distinct requisition.
+5. For a genuinely different role at a previously applied company, follow `companyReapply`: proceed automatically only when it returns `eligible-after-cooldown` (15 full days since the latest company application and no recorded outcome). `cooldown-active` and `follow-up-present` require the candidate's explicit approval and `companyReapplyOverride: "CANDIDATE APPROVED EARLY REAPPLICATION"`.
+6. Keep authentication in the existing browser session. Never inspect cookies, local storage, passwords, or session files.
+7. Fill only explicit profile fields, candidate-provided answers, or facts verified in the canonical resume.
+8. Follow [references/APPLICATION_GUIDANCE.md](references/APPLICATION_GUIDANCE.md) for narrative answers.
+9. Upload only the canonical resume unless the candidate explicitly provides another attachment. Resolve its absolute path with `resume path`, then follow [references/BROWSER_UPLOADS.md](references/BROWSER_UPLOADS.md). Use the browser's privileged path-based upload capability first; treat a visible native file picker as a fallback.
+10. Do not answer demographic questions. Stop for login/SSO/MFA, CAPTCHA, legal attestations, unclear authorization or compensation, sensitive identifiers, and judgment-only questions.
+11. In cloud mode, create an application intent with `cloud intent-prepare --stdin` immediately before transmission. It rechecks the active lease and cloud duplicate history. If transmission occurs but confirmation is ambiguous, mark it with `cloud intent-sent --stdin`; never retry that application until the ATS or sent email is verified.
+12. Verify every required field, answer, attachment, and disclosure. Submit when the current request or active autonomy grant authorizes it.
+13. Record `submitted` only after visible success confirmation, using independent `discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` values. In cloud mode include the returned `cloudIntentId` and active `cloudLeaseId` in `ledger add`; confirmation atomically records the application and round progress. `ledger add` automatically shares the sanitized public job metadata and durably retries on relay failure; do not run a separate manual contribution. Record no submission when confirmation is missing or ambiguous.
+14. Record workflow telemetry with `telemetry record --stdin`. Let `ledger add` emit `application_submitted`; do not emit it twice. Pass job URLs and structured metrics only through documented transient fields.
+15. Queue hard stops with `attention add --stdin` and continue elsewhere. Record reproducible general-purpose failures with `friction record --stdin`; improvement work must never delay application work.
 
 ## Outcomes and reviews
 
@@ -83,6 +85,12 @@ Check `round status` after the initial discovery pass and before submitting. Pre
 ## Commands
 
 ```text
+node scripts/job-application.mjs cloud configure --stdin
+node scripts/job-application.mjs cloud status
+node scripts/job-application.mjs cloud reconcile [--dry-run]
+node scripts/job-application.mjs cloud export [owner-only-path]
+node scripts/job-application.mjs cloud lease-acquire|lease-renew|lease-release
+node scripts/job-application.mjs cloud intent-prepare|intent-sent|intent-confirm --stdin
 node scripts/job-application.mjs profile set --stdin
 node scripts/job-application.mjs profile migrate --stdin
 node scripts/job-application.mjs profile check

package/job-application-agent/capabilities.json

@@ -0,0 +1,5 @@
+{
+  "capabilities": [
+    "cloud-state-v2"
+  ]
+}

package/job-application-agent/references/CLOUD_STATE.md

@@ -0,0 +1,19 @@
+# Optional private cloud state
+
+Private cloud state lets multiple trusted agent hosts use one authoritative candidate dataset. It is separate from anonymous analytics and the public community registry.
+
+Configure each host with a different revocable client token:
+
+```text
+echo '{"version":2,"url":"https://private-worker.example","clientId":"mac-codex","clientName":"Mac Codex","token":"..."}' | node scripts/job-application.mjs cloud configure --stdin
+node scripts/job-application.mjs cloud status
+node scripts/job-application.mjs cloud reconcile --dry-run
+```
+
+The owner-only configuration file stores the token with mode `0600`. The server stores only its SHA-256 hash. D1 stores revisioned documents, append-only records, application intents, and the single-writer lease. R2 stores the canonical résumé, migration snapshots, and 30-day backups when enabled; an existing private Workers KV namespace is supported as a compatible blob fallback.
+
+Browser sessions, Gmail credentials, passwords, verification codes, CAPTCHA responses, demographic responses, legal answers, and device-specific telemetry credentials never enter private cloud state.
+
+Normal profile, résumé, ledger, outcome, round, attention, review, and friction commands automatically reconcile through the configured backend. `cloud export` creates an owner-only JSON archive. During a cloud outage, continue cached research and drafts but do not transmit a new application.
+
+For a shared Linux host where Codex and another agent need separate credentials, follow [`VPS_CLIENTS.md`](VPS_CLIENTS.md). Keep a single scheduler and rely on the D1 lease—not local process assumptions—to enforce the one-writer rule.

package/job-application-agent/references/RUNS.md

@@ -1,5 +1,11 @@
 # Resumable application runs
 
+## Shared cloud coordination
+
+If `cloud status` reports a Cloudflare D1 backend (`cloudflare-d1-r2` or the private `cloudflare-d1-kv` blob fallback), acquire one 15-minute application-run lease before any transmission and renew it every five minutes. Other clients may still read shared state and record independent outcomes. A cloud outage pauses new submissions, while cached research and drafting may continue.
+
+Immediately before sending an application, create an intent containing its application ID, canonical URL, round ID, and active lease ID. After visible confirmation, pass the intent and lease IDs to `ledger add`; the Worker records the submission and round progress together. If a send may have happened but confirmation is unavailable, mark the intent `sent-unverified`. Lease expiry never makes an unverified intent safe to retry.
+
 ## Round lifecycle
 
 Start each batch with an explicit ID:

package/job-application-agent/references/SCHEMAS.md

@@ -125,13 +125,17 @@ Add only after visible success confirmation.
     "fieldsFilled": 14,
     "shortAnswerCount": 2,
     "resumeUploaded": true
-  }
+  },
+  "cloudIntentId": "intent UUID returned before transmission",
+  "cloudLeaseId": "active application-run lease UUID"
 }
 ```
 
 Use `duplicateOverride` only for a verified distinct requisition after a possible-duplicate warning. Use `companyReapplyOverride` only when the candidate explicitly approves a different-role reapplication during the cooldown or after a recorded outcome. Both override phrases and `telemetry` are transient. An accepted company reapplication override stores only `reapplicationApproval: "candidate-explicit"` in the private ledger. Use approval `APPROVE SUBMIT` for per-application approval or `STANDING AUTHORIZATION` when the current request authorizes routine batch submission.
 
-`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` accepts stable packaged and `community-…` source IDs; per-application attribution remains local. Separate source-coverage events may include packaged source IDs, while community IDs are collapsed to `community`. After a visibly confirmed submission, `ledger add` automatically contributes only the canonical public URL, company, role, application channel, optional coarse discovery source, and derived provider URL to the pending community job registry. Existing installations receive a one-command disclosure grace period before historical backfill; `sources sharing disable` opts out. The private answers, score, submission time, IDs, and round remain local, and no job appears publicly before maintainer review. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
+`cloudIntentId` and `cloudLeaseId` are transient coordination fields. They are required for the strongest atomic cloud path and are never written into the application payload itself.
+
+`discoverySource`, `discoverySourceId`, `applicationChannel`, and `roundId` are optional for backward compatibility and should be supplied for new resumable rounds. `discoverySourceId` accepts stable packaged and `community-…` source IDs; per-application attribution stays in private state and is not included in telemetry. Separate source-coverage events may include packaged source IDs, while community IDs are collapsed to `community`. After a visibly confirmed submission, `ledger add` automatically contributes only the canonical public URL, company, role, application channel, optional coarse discovery source, and derived provider URL to the pending community job registry. Existing installations receive a one-command disclosure grace period before historical backfill; `sources sharing disable` opts out. Private answers, score, submission time, IDs, and round remain in the owner-only local or configured cloud state, and no job appears publicly before maintainer review. `ledger check` returns hard duplicate status, bounded same-company history, and the same `companyReapply` decision enforced by `ledger add` while holding the application lock.
 
 ## Autonomy grant input
 

package/job-application-agent/references/VPS_CLIENTS.md

@@ -0,0 +1,33 @@
+# VPS client instructions
+
+This host is a reader by default. It must acquire the shared Cloudflare application-run lease before transmitting any application.
+
+## VPS Codex
+
+Use the installed skill and its default Linux cloud configuration:
+
+```sh
+node "$HOME/.agents/skills/job-application-agent/scripts/job-application.mjs" cloud status
+```
+
+All profile, resume, ledger, outcome, round, attention, and review commands must use that same CLI. Do not create or treat an independent local ledger as authoritative.
+
+## VPS Antigravity
+
+Use the dedicated wrapper so Antigravity presents its separately revocable client credential:
+
+```sh
+"$HOME/.local/bin/job-application-agent-antigravity" cloud status
+```
+
+Never copy the Codex credential into Antigravity configuration or print either token. Browser sessions, Gmail credentials, passwords, and verification codes stay on the host and are not uploaded.
+
+## Writer protocol
+
+1. Require a healthy `cloud status` result.
+2. Acquire the application-run lease before application work and renew it every five minutes.
+3. Create an application intent before each transmission.
+4. Confirm the intent only after visible submission evidence; mark an ambiguous send `sent-unverified` and do not retry it.
+5. Release the lease when the run finishes or stops.
+
+If cloud state is unavailable, continue cached research and drafting only. Do not submit.

package/job-application-agent/scripts/cloud-state-client.mjs

@@ -0,0 +1,384 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { appendFile, chmod, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
+import { homedir, platform } from 'node:os';
+import { dirname, join } from 'node:path';
+
+export const CLOUD_STREAM_FILES = Object.freeze({
+  applications: 'applications.ndjson',
+  outcomes: 'outcomes.ndjson',
+  rounds: 'rounds.ndjson',
+  discovery: 'discovery.ndjson',
+  attention: 'attention.ndjson',
+  reviews: 'reviews.ndjson',
+  friction: 'friction.ndjson',
+});
+
+const CLOUD_DOCUMENT_FILES = Object.freeze({
+  profile: 'cloud-profile-cache.json',
+  autonomy: 'autonomy.json',
+  'review-policy': 'review-policy.json',
+  'postal-address': 'postal-address.json',
+});
+
+const FORBIDDEN_KEYS = /^(password|passwd|cookie|cookies|mfa|mfaCode|totp|ssn|passport|aadhaar|governmentId|governmentID|nationalId|sessionCookie|browserCookies|credential|credentials)$/i;
+
+export function defaultCloudConfigPath(home = homedir()) {
+  if (platform() === 'darwin') return join(home, 'Library', 'Application Support', 'job-application-agent-cloud', 'config.json');
+  if (platform() === 'win32') return join(process.env.LOCALAPPDATA || join(home, 'AppData', 'Local'), 'job-application-agent-cloud', 'config.json');
+  return join(process.env.XDG_CONFIG_HOME || join(home, '.config'), 'job-application-agent', 'cloud.json');
+}
+
+function hash(bytes) {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+function scanForbidden(value, depth = 0) {
+  if (depth > 8 || value == null) return null;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = scanForbidden(item, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (typeof value !== 'object') return null;
+  for (const [key, item] of Object.entries(value)) {
+    if (FORBIDDEN_KEYS.test(key)) return key;
+    const found = scanForbidden(item, depth + 1);
+    if (found) return found;
+  }
+  return null;
+}
+
+async function ensurePrivateDirectory(path) {
+  await mkdir(path, { recursive: true, mode: 0o700 });
+  await chmod(path, 0o700);
+}
+
+async function privateWrite(path, contents) {
+  await ensurePrivateDirectory(dirname(path));
+  const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  await writeFile(temporary, contents, { mode: 0o600 });
+  await rename(temporary, path);
+  await chmod(path, 0o600);
+}
+
+async function fileExists(path) {
+  try { await stat(path); return true; } catch (error) { if (error.code === 'ENOENT') return false; throw error; }
+}
+
+export async function saveCloudConfig(input, { configPath = defaultCloudConfigPath() } = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Cloud configuration must be a JSON object.');
+  const url = String(input.url ?? '').replace(/\/+$/, '');
+  const token = String(input.token ?? '');
+  if (!/^https:\/\//i.test(url)) throw new Error('Cloud URL must use HTTPS.');
+  if (token.length < 32) throw new Error('Cloud token must be at least 32 characters.');
+  const config = {
+    version: 2,
+    url,
+    token,
+    ...(input.clientId ? { clientId: String(input.clientId) } : {}),
+    ...(input.clientName ? { clientName: String(input.clientName) } : {}),
+    configuredAt: new Date().toISOString(),
+  };
+  await privateWrite(configPath, `${JSON.stringify(config, null, 2)}\n`);
+  return { ...config, token: tokenSuffix(token) };
+}
+
+export async function enableCloudUpdateGuard({ home = homedir(), agentHome = process.env.JOB_APPLICATION_AGENT_HOME } = {}) {
+  const root = agentHome || join(home, '.agents');
+  const path = join(root, 'job-application-agent', 'install.json');
+  let config;
+  try { config = JSON.parse(await readFile(path, 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return { guarded: false, reason: 'managed-install-not-found' }; throw error; }
+  const required = new Set(config.requiredCapabilities ?? []);
+  required.add('cloud-state-v2');
+  await privateWrite(path, `${JSON.stringify({ ...config, requiredCapabilities: [...required].sort() }, null, 2)}\n`);
+  return { guarded: true, capability: 'cloud-state-v2' };
+}
+
+function tokenSuffix(token) {
+  return token.length >= 4 ? `****${token.slice(-4)}` : '****';
+}
+
+export async function loadCloudConfig({ configPath = defaultCloudConfigPath(), optional = false } = {}) {
+  try {
+    const value = JSON.parse(await readFile(configPath, 'utf8'));
+    const url = String(value.url ?? '').replace(/\/+$/, '');
+    const token = String(value.token ?? '');
+    if (!/^https:\/\//i.test(url) || token.length < 24) throw new Error('Cloud configuration is malformed.');
+    return { ...value, url, token };
+  } catch (error) {
+    if (optional && error.code === 'ENOENT') return null;
+    if (error.code === 'ENOENT') throw new Error(`Cloud configuration is missing at ${configPath}. Run cloud configure --stdin.`);
+    throw error;
+  }
+}
+
+async function responseError(response) {
+  try { return (await response.json()).error ?? `HTTP ${response.status}`; } catch { return `HTTP ${response.status}`; }
+}
+
+export class CloudStateClient {
+  constructor({ stateDir, configPath = defaultCloudConfigPath(), fetchImpl = fetch } = {}) {
+    if (!stateDir) throw new Error('stateDir is required.');
+    this.stateDir = stateDir;
+    this.configPath = configPath;
+    this.fetchImpl = fetchImpl;
+  }
+
+  async config(optional = false) {
+    return loadCloudConfig({ configPath: this.configPath, optional });
+  }
+
+  async configured() {
+    return (await this.config(true))?.version === 2;
+  }
+
+  async request(path, init = {}) {
+    const config = await this.config();
+    if (config.version !== 2) throw new Error('Cloud configuration uses the retired whole-file protocol. Run cloud configure --stdin with a v2 client credential.');
+    let response;
+    try {
+      response = await this.fetchImpl(`${config.url}${path}`, {
+        ...init,
+        headers: { authorization: `Bearer ${config.token}`, ...(init.headers ?? {}) },
+      });
+    } catch (error) {
+      throw new Error(`Cloud state unavailable: ${error.message}`);
+    }
+    if (!response.ok) throw new Error(`Cloud state request failed (${response.status}): ${await responseError(response)}`);
+    return response;
+  }
+
+  async status() {
+    const config = await this.config(true);
+    if (!config) return { configured: false, backend: 'local', pendingLocalWrites: 0 };
+    const pending = await this.pendingWrites();
+    const remote = await (await this.request('/v2/status')).json();
+    return { configured: true, url: config.url, configuredClient: { id: config.clientId ?? null, name: config.clientName ?? null, token: tokenSuffix(config.token) }, pendingLocalWrites: pending.length, ...remote };
+  }
+
+  async getDocument(name) {
+    const response = await this.request(`/v2/documents/${encodeURIComponent(name)}`);
+    return response.json();
+  }
+
+  async putDocument(name, value, revision) {
+    const forbidden = scanForbidden(value);
+    if (forbidden) throw new Error(`Cloud document contains forbidden field: ${forbidden}`);
+    const response = await this.request(`/v2/documents/${encodeURIComponent(name)}`, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json', 'if-match': String(revision) },
+      body: JSON.stringify({ value }),
+    });
+    return response.json();
+  }
+
+  async putDocumentCurrent(name, value) {
+    let revision = 0;
+    try { revision = (await this.getDocument(name)).revision; }
+    catch (error) { if (!/\(404\)/.test(error.message)) throw error; }
+    return this.putDocument(name, value, revision);
+  }
+
+  async listStream(stream) {
+    const records = [];
+    let cursor = 0;
+    do {
+      const page = await (await this.request(`/v2/streams/${encodeURIComponent(stream)}?after=${cursor}&limit=1000`)).json();
+      records.push(...page.records);
+      if (page.nextCursor === cursor || page.records.length === 0) break;
+      cursor = page.nextCursor;
+    } while (true);
+    return records;
+  }
+
+  async appendRecord(stream, value, { recordKey, idempotencyKey, occurredAt, provenance = 'live', queueOnFailure = false } = {}) {
+    const forbidden = scanForbidden(value);
+    if (forbidden) throw new Error(`Cloud record contains forbidden field: ${forbidden}`);
+    const payload = {
+      recordKey: String(recordKey ?? value?.id ?? value?.roundId ?? randomUUID()),
+      idempotencyKey: String(idempotencyKey ?? `${stream}:${hash(JSON.stringify(value))}`),
+      occurredAt: occurredAt ?? value?.occurredAt ?? value?.submittedAt ?? new Date().toISOString(),
+      provenance,
+      value,
+    };
+    try {
+      return await (await this.request(`/v2/streams/${encodeURIComponent(stream)}`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload) })).json();
+    } catch (error) {
+      if (!queueOnFailure) throw error;
+      await this.queueWrite({ type: 'append-record', stream, payload, queuedAt: new Date().toISOString() });
+      return { queued: true, error: 'cloud_unavailable' };
+    }
+  }
+
+  async appendRecordBatch(stream, records) {
+    if (!Array.isArray(records) || records.length < 1 || records.length > 100) throw new Error('Cloud record batch must contain 1 to 100 records.');
+    const response = await this.request(`/v2/streams/${encodeURIComponent(stream)}/batch`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ records }) });
+    return response.json();
+  }
+
+  async queueWrite(event) {
+    await ensurePrivateDirectory(this.stateDir);
+    const path = join(this.stateDir, 'cloud-pending.ndjson');
+    await appendFile(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    await chmod(path, 0o600);
+  }
+
+  async pendingWrites() {
+    try { return (await readFile(join(this.stateDir, 'cloud-pending.ndjson'), 'utf8')).split('\n').filter(Boolean).map(JSON.parse); }
+    catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+  }
+
+  async putFile(name, bytes, revision) {
+    const body = Buffer.from(bytes);
+    const response = await this.request(`/v2/files/${encodeURIComponent(name)}`, { method: 'PUT', headers: { 'content-type': name.endsWith('.pdf') ? 'application/pdf' : 'application/json', 'if-match': String(revision), 'x-content-sha256': hash(body) }, body });
+    return response.json();
+  }
+
+  async putFileCurrent(name, bytes) {
+    let revision = 0;
+    try {
+      const status = await this.status();
+      revision = status.files?.find((file) => file.name === name)?.revision ?? 0;
+    } catch (error) { if (!/\(404\)/.test(error.message)) throw error; }
+    return this.putFile(name, bytes, revision);
+  }
+
+  async fetchResume() {
+    const response = await this.request('/v2/files/resume.pdf');
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const expected = response.headers.get('x-sha256');
+    const actual = hash(bytes);
+    if (!expected || expected !== actual) throw new Error('Cloud resume checksum verification failed.');
+    if (!bytes.subarray(0, 4).equals(Buffer.from('%PDF'))) throw new Error('Cloud resume is not a PDF.');
+    const path = join(this.stateDir, 'resume.pdf');
+    await privateWrite(path, bytes);
+    return { path, sha256: actual, bytes: bytes.length };
+  }
+
+  async refreshProfileCache() {
+    const document = await this.getDocument('profile');
+    await privateWrite(join(this.stateDir, 'cloud-profile-cache.json'), `${JSON.stringify(document.value)}\n`);
+    return document.value;
+  }
+
+  async refreshDocumentCaches() {
+    const refreshed = {};
+    for (const [name, filename] of Object.entries(CLOUD_DOCUMENT_FILES)) {
+      let document;
+      try { document = await this.getDocument(name); }
+      catch (error) { if (/\(404\)/.test(error.message)) continue; throw error; }
+      await privateWrite(join(this.stateDir, filename), `${JSON.stringify(document.value)}\n`);
+      refreshed[name] = { revision: document.revision, updatedAt: document.updatedAt ?? null };
+    }
+    return refreshed;
+  }
+
+  async acquireLease() {
+    return (await this.request('/v2/leases/application-run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'acquire' }) })).json();
+  }
+
+  async renewLease(leaseId) {
+    return (await this.request('/v2/leases/application-run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'renew', leaseId }) })).json();
+  }
+
+  async releaseLease(leaseId) {
+    return (await this.request('/v2/leases/application-run', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ action: 'release', leaseId }) })).json();
+  }
+
+  async createIntent(value) {
+    return (await this.request('/v2/intents', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(value) })).json();
+  }
+
+  async markIntentSentUnverified(intentId, leaseId) {
+    return (await this.request(`/v2/intents/${encodeURIComponent(intentId)}/sent-unverified`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ leaseId }) })).json();
+  }
+
+  async confirmIntent(intentId, application, leaseId, idempotencyKey) {
+    return (await this.request(`/v2/intents/${encodeURIComponent(intentId)}/confirm`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ application, leaseId, idempotencyKey }) })).json();
+  }
+
+  async reconcile({ dryRun = true, provenance = 'local-reconcile' } = {}) {
+    const report = { dryRun, streams: {}, imported: 0, downloaded: 0 };
+    for (const [stream, filename] of Object.entries(CLOUD_STREAM_FILES)) {
+      const local = await readNdjson(join(this.stateDir, filename));
+      const cloudRecords = await this.listStream(stream);
+      const cloud = cloudRecords.map((record) => record.value);
+      const localCounts = multiset(local);
+      const cloudCounts = multiset(cloud);
+      const localOnly = multisetDifference(local, cloudCounts);
+      const cloudOnly = multisetDifference(cloud, localCounts);
+      report.streams[stream] = { localRows: local.length, cloudRows: cloud.length, localOnly: localOnly.length, cloudOnly: cloudOnly.length, unionRows: local.length + cloudOnly.length };
+      if (!dryRun) {
+        const prepared = localOnly.map(({ value, index }) => ({
+          recordKey: String(value?.id ?? value?.roundId ?? value?.applicationId ?? `${stream}-${index}`),
+          idempotencyKey: `reconcile:${hash(JSON.stringify(value))}:${index}`,
+          occurredAt: value?.occurredAt ?? value?.submittedAt ?? new Date().toISOString(),
+          provenance,
+          value,
+        }));
+        for (let offset = 0; offset < prepared.length; offset += 100) {
+          const result = await this.appendRecordBatch(stream, prepared.slice(offset, offset + 100));
+          report.imported += result.inserted;
+        }
+        if (cloudOnly.length) {
+          await ensurePrivateDirectory(this.stateDir);
+          const path = join(this.stateDir, filename);
+          for (const { value } of cloudOnly) await appendFile(path, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+          await chmod(path, 0o600);
+          report.downloaded += cloudOnly.length;
+        }
+      }
+    }
+    return report;
+  }
+
+  async exportTo(path) {
+    const status = await this.status();
+    const documents = {};
+    for (const item of status.documents ?? []) documents[item.name] = await this.getDocument(item.name);
+    const streams = {};
+    for (const stream of Object.keys(CLOUD_STREAM_FILES)) streams[stream] = await this.listStream(stream);
+    const output = path ?? join(this.stateDir, `cloud-export-${new Date().toISOString().replaceAll(':', '-')}.json`);
+    await privateWrite(output, `${JSON.stringify({ version: 1, exportedAt: new Date().toISOString(), backend: status.backend, documents, streams, files: status.files ?? [] })}\n`);
+    return { path: output, documents: Object.keys(documents).length, records: Object.values(streams).reduce((sum, rows) => sum + rows.length, 0) };
+  }
+}
+
+async function readNdjson(path) {
+  try { return (await readFile(path, 'utf8')).split('\n').filter(Boolean).map((line) => JSON.parse(line)); }
+  catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+}
+
+function key(value) {
+  return JSON.stringify(value);
+}
+
+function multiset(values) {
+  const counts = new Map();
+  for (const value of values) counts.set(key(value), (counts.get(key(value)) ?? 0) + 1);
+  return counts;
+}
+
+function multisetDifference(values, otherCounts) {
+  const remaining = new Map(otherCounts);
+  const result = [];
+  values.forEach((value, index) => {
+    const itemKey = key(value);
+    const count = remaining.get(itemKey) ?? 0;
+    if (count > 0) remaining.set(itemKey, count - 1);
+    else result.push({ value, index });
+  });
+  return result;
+}
+
+export async function readCachedCloudProfile(stateDir) {
+  try { return JSON.parse(await readFile(join(stateDir, 'cloud-profile-cache.json'), 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+
+export function cloudDocumentFile(name) {
+  return CLOUD_DOCUMENT_FILES[name] ?? null;
+}

package/job-application-agent/scripts/job-application.mjs

@@ -12,6 +12,7 @@ import { SourceCommunityClient } from './source-community-client.mjs';
 import { normalizeCommunityJob, normalizeCommunitySource } from './source-community-schema.mjs';
 import { TelemetryClient } from './telemetry-client.mjs';
 import { jobIdentity } from './telemetry-schema.mjs';
+import { CloudStateClient, defaultCloudConfigPath, enableCloudUpdateGuard, saveCloudConfig } from './cloud-state-client.mjs';
 
 const SOURCES = new Set(['linkedin', 'greenhouse', 'lever', 'ashby', 'workable', 'comeet', 'workday', 'rippling', 'smartrecruiters', 'google-form', 'company', 'email', 'other']);
 const DISCOVERY_SOURCES = new Set(['direct-company', 'linkedin', 'x', 'yc', 'hacker-news', 'job-board', 'email', 'user-supplied', 'web-search', 'other']);
@@ -67,6 +68,17 @@ function stateDir() {
 }
 
 const secretStore = createSecretStore({ stateDir });
+const cloudState = new CloudStateClient({ stateDir: stateDir(), configPath: process.env.JOB_APPLICATION_AGENT_CLOUD_CONFIG ?? defaultCloudConfigPath() });
+
+function cachedCloudProfileRaw() {
+  try {
+    const config = JSON.parse(readFileSync(process.env.JOB_APPLICATION_AGENT_CLOUD_CONFIG ?? defaultCloudConfigPath(), 'utf8'));
+    if (config.version !== 2) return null;
+    return object(JSON.parse(readFileSync(join(stateDir(), 'cloud-profile-cache.json'), 'utf8')), 'profile');
+  } catch {
+    return null;
+  }
+}
 
 export function durationBucket(milliseconds) {
   if (milliseconds < 1_000) return 'under-1s';
@@ -604,6 +616,8 @@ export function buildReview(entries, outcomeEntries = [], acknowledgements = [],
 }
 
 function storedProfileRaw() {
+  const cloudProfile = cachedCloudProfileRaw();
+  if (cloudProfile) return cloudProfile;
   try { return object(JSON.parse(secretStore.readProfile()), 'profile'); } catch (error) {
     if (/missing or unreadable|could not read|could not store|Windows profile storage|not supported on this platform|secret-tool is not installed/i.test(error.message)) throw error;
     throw new Error('The stored profile is missing or unreadable. Run profile set again.');
@@ -863,6 +877,7 @@ async function autonomyGrant(input) {
   for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown autonomy grant property: ${key}.`);
   if (value.mode !== 'routine-auto') throw new Error('autonomy grant mode must be routine-auto.');
   const grant = { version: 1, enabled: true, mode: 'routine-auto', scopes: [...AUTONOMY_SCOPES], grantedAt: new Date().toISOString() };
+  if (await cloudState.configured()) await cloudState.putDocumentCurrent('autonomy', grant);
   const file = join(await ensureStateDir(), 'autonomy.json');
   await writePrivateJson(file, grant);
   return autonomyView(grant);
@@ -872,14 +887,21 @@ async function autonomyRevoke() {
   const file = join(await ensureStateDir(), 'autonomy.json');
   const current = await readPrivateJson(file, { version: 1, enabled: false });
   const revoked = { version: 1, enabled: false, revokedAt: new Date().toISOString(), ...(current.grantedAt ? { grantedAt: current.grantedAt } : {}) };
+  if (await cloudState.configured()) await cloudState.putDocumentCurrent('autonomy', revoked);
   await writePrivateJson(file, revoked);
   return autonomyView(revoked);
 }
 
 async function storeProfile(profileInput) {
   const profile = validateProfile(profileInput);
-  if (process.platform === 'win32') await ensureStateDir();
-  secretStore.writeProfile(JSON.stringify(profile));
+  if (await cloudState.configured()) {
+    const dir = await ensureStateDir();
+    await cloudState.putDocumentCurrent('profile', profile);
+    await writePrivateJson(join(dir, 'cloud-profile-cache.json'), profile);
+  } else {
+    if (process.platform === 'win32') await ensureStateDir();
+    secretStore.writeProfile(JSON.stringify(profile));
+  }
   return profile;
 }
 
@@ -926,11 +948,23 @@ async function importResume(source) {
   await chmod(target, 0o600);
   const metadata = { source: sourceLabel, importedAt: new Date().toISOString(), sha256: createHash('sha256').update(bytes).digest('hex'), bytes: bytes.length };
   await writeFile(join(dir, 'resume.json'), `${JSON.stringify(metadata, null, 2)}\n`, { mode: 0o600 });
+  if (await cloudState.configured()) {
+    await cloudState.putFileCurrent('resume.pdf', bytes);
+    await cloudState.putFileCurrent('resume.json', Buffer.from(JSON.stringify(metadata)));
+  }
   return { path: target, sha256: metadata.sha256, bytes: metadata.bytes };
 }
 
 async function canonicalResumePath() {
   const target = join(await ensureStateDir(), 'resume.pdf');
+  if (await cloudState.configured()) {
+    try { await cloudState.fetchResume(); }
+    catch (error) {
+      // Cached research and browser preparation remain usable during an
+      // outage. Integrity, authentication, and checksum failures still stop.
+      if (!/^Cloud state unavailable:/.test(error.message)) throw error;
+    }
+  }
   try {
     const details = await stat(target);
     if (!details.isFile()) throw new Error('Canonical resume path is not a file. Import the resume again.');
@@ -1009,7 +1043,7 @@ async function ledgerCheck(candidate) {
   return duplicateResult(entries, candidate, outcomes);
 }
 
-async function ledgerAdd(entryInput, duplicateOverride, companyReapplyOverride) {
+async function ledgerAdd(entryInput, duplicateOverride, companyReapplyOverride, cloudIntent = null) {
   const entry = validateLedgerEntry(entryInput);
   return withStateLock('applications', async (dir) => {
     const file = join(dir, 'applications.ndjson');
@@ -1039,15 +1073,30 @@ async function ledgerAdd(entryInput, duplicateOverride, companyReapplyOverride)
       await appendFile(roundsFile, `${JSON.stringify({ type: 'submission-confirmed', roundId: entry.roundId, applicationId: entry.id, occurredAt: entry.submittedAt })}\n`, { mode: 0o600 });
       await chmod(roundsFile, 0o600);
     }
-    return { recorded: storedEntry.id, review: buildReview([...entries, storedEntry]) };
+    if (await cloudState.configured()) {
+      if (cloudIntent?.intentId && cloudIntent?.leaseId) {
+        await cloudState.confirmIntent(cloudIntent.intentId, storedEntry, cloudIntent.leaseId, `application:${storedEntry.id}:${storedEntry.submittedAt}`);
+      } else {
+        await cloudState.appendRecord('applications', storedEntry, { recordKey: storedEntry.id, idempotencyKey: `application:${storedEntry.id}:${storedEntry.submittedAt}`, occurredAt: storedEntry.submittedAt, queueOnFailure: true });
+        if (entry.roundId) await cloudState.appendRecord('rounds', { type: 'submission-confirmed', roundId: entry.roundId, applicationId: entry.id, occurredAt: entry.submittedAt }, { recordKey: entry.roundId, idempotencyKey: `round-confirmation:${entry.roundId}:${entry.id}`, occurredAt: entry.submittedAt, queueOnFailure: true });
+      }
+    }
+    return { recorded: storedEntry.id, review: buildReview([...entries, storedEntry]), ...(cloudIntent ? { cloudIntent: cloudIntent.intentId } : {}) };
   });
 }
 
+async function appendCloudEvent(name, event) {
+  if (!await cloudState.configured()) return;
+  const key = event.id ?? event.roundId ?? event.applicationId ?? randomUUID();
+  await cloudState.appendRecord(name, event, { recordKey: key, idempotencyKey: `${name}:${createHash('sha256').update(JSON.stringify(event)).digest('hex')}`, occurredAt: event.occurredAt, queueOnFailure: true });
+}
+
 async function appendPrivateEvent(name, event) {
   return withStateLock(name, async (dir) => {
     const file = join(dir, `${name}.ndjson`);
     await appendFile(file, `${JSON.stringify(event)}\n`, { mode: 0o600 });
     await chmod(file, 0o600);
+    if (['rounds', 'discovery', 'attention', 'friction'].includes(name)) await appendCloudEvent(name, event);
     return event;
   });
 }
@@ -1131,7 +1180,7 @@ async function roundSource(input) {
   const evidence = string(value.evidence, 'coverage.evidence', 2000);
   const applicationIds = value.applicationIds == null ? [] : [...new Set(stringArray(value.applicationIds, 'coverage.applicationIds'))];
   if (applicationIds.length > 1000 || (status === 'blocked' && applicationIds.length)) throw new Error('Invalid coverage.applicationIds.');
-  return withStateLock('rounds', async (dir) => {
+  const event = await withStateLock('rounds', async (dir) => {
     const round = await roundStatus(string(value.roundId, 'coverage.roundId', 180));
     if (round.completed) throw new Error('Cannot record coverage for a completed round.');
     const applications = await jsonLines(join(dir, 'applications.ndjson'));
@@ -1145,6 +1194,8 @@ async function roundSource(input) {
     await chmod(file, 0o600);
     return event;
   });
+  await appendCloudEvent('rounds', event);
+  return event;
 }
 
 function replayAttention(events, roundId = null) {
@@ -1237,7 +1288,7 @@ async function roundComplete(input) {
   const allowed = new Set(['roundId', 'completedAt', 'concentrationReason', 'concentrationEvidence']);
   for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`Unknown round completion property: ${key}.`);
   // Use the same lock order as ledger writes so completion cannot race a confirmed submission.
-  return withStateLock('applications', () => withStateLock('rounds', async (dir) => {
+  const result = await withStateLock('applications', () => withStateLock('rounds', async (dir) => {
     const status = await roundStatus(string(value.roundId, 'round.roundId', 180));
     if (status.completed) return { ...status, completionRecorded: false };
     if (status.confirmedCount < status.requestedCount) throw new Error(`Round requires ${status.requestedCount} confirmed submissions before completion.`);
@@ -1254,6 +1305,8 @@ async function roundComplete(input) {
     await chmod(file, 0o600);
     return { ...status, discovery: { ...status.discovery, ...explanation }, completed: true, completionRecorded: true, completedAt: event.occurredAt };
   }));
+  if (result.completionRecorded) await appendCloudEvent('rounds', { type: 'completed', roundId: result.roundId, occurredAt: result.completedAt, ...(result.discovery.concentrationReason ? { concentrationReason: result.discovery.concentrationReason, concentrationEvidence: result.discovery.concentrationEvidence } : {}) });
+  return result;
 }
 
 async function frictionRecord(input) {
@@ -1330,6 +1383,14 @@ async function ledgerOutcome(outcomeInput) {
     return { stored: true, enriched };
   });
   const applications = await jsonLines(join(await ensureStateDir(), 'applications.ndjson'));
+  if (storage.stored && await cloudState.configured()) {
+    await cloudState.appendRecord('outcomes', event, {
+      recordKey: event.id,
+      idempotencyKey: `outcome:${event.id}:${event.status}:${event.occurredAt}:${createHash('sha256').update(JSON.stringify(event)).digest('hex')}`,
+      occurredAt: event.occurredAt,
+      queueOnFailure: true,
+    });
+  }
   return { result: { recorded: storage.stored, duplicate: !storage.stored, enriched: storage.enriched, recordedOutcome: event.id, status }, application: applications.find((entry) => entry.id === event.id) ?? null, event };
 }
 
@@ -1352,9 +1413,62 @@ async function ledgerReviewAcknowledge(input) {
     await appendFile(file, `${JSON.stringify(event)}\n`, { mode: 0o600 });
     await chmod(file, 0o600);
   });
+  if (await cloudState.configured()) await cloudState.appendRecord('reviews', event, { recordKey: reviewedAt, idempotencyKey: `review:${reviewedAt}`, occurredAt: reviewedAt, queueOnFailure: true });
   return { acknowledged: true, ...event };
 }
 
+async function prepareCloudState(area, action) {
+  if (!await cloudState.configured() || area === 'cloud') return;
+  try {
+    await cloudState.reconcile({ dryRun: false, provenance: 'automatic-recovery' });
+    await cloudState.refreshDocumentCaches();
+  } catch (error) {
+    // New submissions still fail closed because lease and intent operations
+    // call the cloud directly. Local checks, research, and observed-result
+    // ledger appends can continue and queue their idempotent recovery writes.
+    if (!/^Cloud state unavailable:/.test(error.message)) throw error;
+  }
+}
+
+async function cloudCommand(action, value) {
+  if (action === 'configure' && value === '--stdin') {
+    const configured = await saveCloudConfig(await jsonStdin(), { configPath: process.env.JOB_APPLICATION_AGENT_CLOUD_CONFIG ?? defaultCloudConfigPath() });
+    const updateGuard = await enableCloudUpdateGuard();
+    return { configured: true, url: configured.url, clientId: configured.clientId ?? null, clientName: configured.clientName ?? null, token: configured.token, updateGuard };
+  }
+  if (action === 'status' && value == null) return cloudState.status();
+  if (action === 'reconcile' && value === '--dry-run') return cloudState.reconcile({ dryRun: true });
+  if (action === 'reconcile' && value == null) return cloudState.reconcile({ dryRun: false });
+  if (action === 'export') return cloudState.exportTo(value ?? null);
+  if (action === 'lease-acquire' && value == null) {
+    const lease = await cloudState.acquireLease();
+    await writePrivateJson(join(await ensureStateDir(), 'cloud-lease.json'), lease);
+    return lease;
+  }
+  if (action === 'lease-renew' && value == null) {
+    const lease = await readPrivateJson(join(await ensureStateDir(), 'cloud-lease.json'), null);
+    if (!lease?.leaseId) throw new Error('No local cloud lease is recorded. Run cloud lease-acquire.');
+    const renewed = await cloudState.renewLease(lease.leaseId);
+    await writePrivateJson(join(await ensureStateDir(), 'cloud-lease.json'), renewed);
+    return renewed;
+  }
+  if (action === 'lease-release' && value == null) {
+    const lease = await readPrivateJson(join(await ensureStateDir(), 'cloud-lease.json'), null);
+    if (!lease?.leaseId) throw new Error('No local cloud lease is recorded.');
+    return cloudState.releaseLease(lease.leaseId);
+  }
+  if (action === 'intent-prepare' && value === '--stdin') return cloudState.createIntent(await jsonStdin());
+  if (action === 'intent-sent' && value === '--stdin') {
+    const input = await jsonStdin();
+    return cloudState.markIntentSentUnverified(string(input.intentId, 'intentId', 200), string(input.leaseId, 'leaseId', 200));
+  }
+  if (action === 'intent-confirm' && value === '--stdin') {
+    const input = await jsonStdin();
+    return cloudState.confirmIntent(string(input.intentId, 'intentId', 200), object(input.application, 'application'), string(input.leaseId, 'leaseId', 200), input.idempotencyKey);
+  }
+  throw new Error('Usage: cloud status|configure --stdin|reconcile [--dry-run]|export [path]|lease-acquire|lease-renew|lease-release|intent-prepare --stdin|intent-sent --stdin|intent-confirm --stdin');
+}
+
 function print(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
@@ -1414,7 +1528,8 @@ function roundCompletedTelemetry(round) {
 async function executeCommand([area, action, value], telemetry, session, community) {
   const domainEvents = [];
   let result;
-  if (area === 'profile' && action === 'set' && value === '--stdin') {
+  if (area === 'cloud') result = await cloudCommand(action, value);
+  else if (area === 'profile' && action === 'set' && value === '--stdin') {
     const profile = await jsonStdin();
     result = await profileSet(profile);
   } else if (area === 'profile' && action === 'migrate' && value === '--stdin') {
@@ -1436,7 +1551,7 @@ async function executeCommand([area, action, value], telemetry, session, communi
     const input = await jsonStdin();
     const telemetryDetails = validateSubmissionTelemetry(input.telemetry);
     const entry = validateLedgerEntry(input);
-    result = await ledgerAdd(entry, input.duplicateOverride, input.companyReapplyOverride);
+    result = await ledgerAdd(entry, input.duplicateOverride, input.companyReapplyOverride, input.cloudIntentId && input.cloudLeaseId ? { intentId: input.cloudIntentId, leaseId: input.cloudLeaseId } : null);
     result.communityJob = await communityJobsSync(community, { limit: 1, applicationIds: [entry.id] });
     domainEvents.push(await telemetryApplicationSubmitted(entry, telemetryDetails));
   } else if (area === 'ledger' && action === 'outcome' && value === '--stdin') {
@@ -1488,7 +1603,7 @@ async function executeCommand([area, action, value], telemetry, session, communi
   else if (area === 'attention' && action === 'resolve' && value === '--stdin') result = await attentionResolve(await jsonStdin());
   else if (area === 'friction' && action === 'record' && value === '--stdin') result = await frictionRecord(await jsonStdin());
   else if (area === 'friction' && action === 'list' && value == null) result = await frictionList();
-  else throw new Error('Usage: profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|source|complete --stdin|status [round-id]; sources list [--stdin]|jobs [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
+  else throw new Error('Usage: cloud status|configure --stdin|reconcile [--dry-run]|export [path]|lease-acquire|lease-renew|lease-release|intent-prepare --stdin|intent-sent --stdin|intent-confirm --stdin; profile set|migrate --stdin; profile check|field <name>; resume import <url-or-pdf>|path; score --stdin; ledger check|add|outcome|review-ack --stdin; ledger review; autonomy grant --stdin|status|preview|revoke; round start|source|complete --stdin|status [round-id]; sources list [--stdin]|jobs [--stdin]|suggest --stdin|pending|sync|sharing status|enable|disable|reset; attention add|resolve --stdin|list; friction record --stdin|list; telemetry status|enable|disable|reset|preview --stdin|record --stdin');
   for (const event of domainEvents) await telemetry.record(event, session);
   return result;
 }
@@ -1527,6 +1642,8 @@ async function main(args) {
     throw new Error('Usage: telemetry status|enable|disable|reset|preview --stdin|record --stdin; telemetry identity status|enable|disable');
   }
 
+  await prepareCloudState(area, action);
+
   const command = commandCategory(args);
   const session = await telemetry.beginCommand(command);
   await recordInstallationStart(telemetry, session);

package/job-application-agent/scripts/version.mjs

@@ -1 +1 @@
-export const SKILL_VERSION = '3.4.0';
+export const SKILL_VERSION = '3.4.2';

package/job-application-agent/tests/cloud-state-client.test.mjs

@@ -0,0 +1,105 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { CloudStateClient, saveCloudConfig } from '../scripts/cloud-state-client.mjs';
+import worker, { sha256Hex } from '../../state-worker/src/worker.mjs';
+import { createMemoryD1, hasNodeSqlite } from '../../state-worker/tests/d1-mock.mjs';
+import { createMemoryR2 } from '../../state-worker/tests/r2-mock.mjs';
+
+const TOKEN = 'test-client-token-with-sufficient-length-cloud';
+const sqliteTest = hasNodeSqlite ? test : test.skip;
+
+async function setup() {
+  const root = await mkdtemp(join(tmpdir(), 'job-agent-cloud-'));
+  const stateDir = join(root, 'state');
+  const configPath = join(root, 'cloud', 'config.json');
+  await mkdir(stateDir, { recursive: true });
+  const schema = await readFile(new URL('../../state-worker/migrations/0001_private_state.sql', import.meta.url), 'utf8');
+  const DB = createMemoryD1(schema);
+  await DB.prepare('INSERT INTO clients (client_id, name, token_hash, created_at) VALUES (?, ?, ?, ?)')
+    .bind('client-test', 'Test Client', sha256Hex(TOKEN), new Date().toISOString()).run();
+  const bindings = { DB, STATE: createMemoryR2(), STATE_TOKEN: 'legacy', LEGACY_WRITES_DISABLED: '1' };
+  const fetchImpl = (input, init) => worker.fetch(new Request(input, init), bindings);
+  await saveCloudConfig({ version: 2, url: 'https://state.example.com', token: TOKEN, clientId: 'client-test', clientName: 'Test Client' }, { configPath });
+  const client = new CloudStateClient({ stateDir, configPath, fetchImpl });
+  return { root, stateDir, configPath, bindings, client };
+}
+
+sqliteTest('cloud config and profile cache are owner-only and work without Keychain', async () => {
+  const ctx = await setup();
+  await ctx.client.putDocument('profile', { name: 'Ada', email: 'ada@example.com' }, 0);
+  const profile = await ctx.client.refreshProfileCache();
+  assert.equal(profile.name, 'Ada');
+  if (process.platform !== 'win32') assert.equal((await stat(ctx.configPath)).mode & 0o777, 0o600);
+  const cache = join(ctx.stateDir, 'cloud-profile-cache.json');
+  if (process.platform !== 'win32') assert.equal((await stat(cache)).mode & 0o777, 0o600);
+  assert.deepEqual(JSON.parse(await readFile(cache, 'utf8')), profile);
+});
+
+sqliteTest('cloud documents refresh the owner-only local caches', async () => {
+  const ctx = await setup();
+  await ctx.client.putDocument('autonomy', { version: 1, enabled: true, mode: 'routine-auto' }, 0);
+
+  const refreshed = await ctx.client.refreshDocumentCaches();
+
+  assert.equal(refreshed.autonomy.revision, 1);
+  assert.equal(JSON.parse(await readFile(join(ctx.stateDir, 'autonomy.json'), 'utf8')).enabled, true);
+  if (process.platform !== 'win32') assert.equal((await stat(join(ctx.stateDir, 'autonomy.json'))).mode & 0o777, 0o600);
+});
+
+sqliteTest('reconcile dry-run reports the exact union without writing', async () => {
+  const ctx = await setup();
+  const local = [
+    { id: 'app-1', company: 'A', submittedAt: '2026-01-01T00:00:00.000Z' },
+    { id: 'app-2', company: 'B', submittedAt: '2026-01-02T00:00:00.000Z' },
+  ];
+  await writeFile(join(ctx.stateDir, 'applications.ndjson'), `${local.map(JSON.stringify).join('\n')}\n`);
+  await ctx.client.appendRecord('applications', local[0], { recordKey: 'app-1', idempotencyKey: 'migration:app-1' });
+  const report = await ctx.client.reconcile({ dryRun: true });
+  assert.deepEqual(report.streams.applications, { localRows: 2, cloudRows: 1, localOnly: 1, cloudOnly: 0, unionRows: 2 });
+  assert.equal((await ctx.bindings.DB.prepare("SELECT COUNT(*) AS count FROM records WHERE stream = 'applications'").first()).count, 1);
+});
+
+sqliteTest('reconcile imports local-only rows idempotently and preserves provenance', async () => {
+  const ctx = await setup();
+  const local = [{ id: 'app-1', company: 'A', submittedAt: '2026-01-01T00:00:00.000Z' }];
+  await writeFile(join(ctx.stateDir, 'applications.ndjson'), `${JSON.stringify(local[0])}\n`);
+  const first = await ctx.client.reconcile({ dryRun: false, provenance: 'mac-cutover' });
+  const second = await ctx.client.reconcile({ dryRun: false, provenance: 'mac-cutover' });
+  assert.equal(first.imported, 1);
+  assert.equal(second.imported, 0);
+  const row = await ctx.bindings.DB.prepare("SELECT provenance FROM records WHERE stream = 'applications'").first();
+  assert.equal(row.provenance, 'mac-cutover');
+});
+
+sqliteTest('reconcile includes the owner-only discovery review ledger', async () => {
+  const ctx = await setup();
+  const lead = { type: 'lead-reviewed', roundId: 'round-1', leadId: 'lead-1', disposition: 'duplicate', occurredAt: '2026-01-01T00:00:00.000Z' };
+  await writeFile(join(ctx.stateDir, 'discovery.ndjson'), `${JSON.stringify(lead)}\n`);
+
+  const report = await ctx.client.reconcile({ dryRun: false });
+
+  assert.equal(report.streams.discovery.imported ?? report.streams.discovery.localOnly, 1);
+  assert.deepEqual((await ctx.client.listStream('discovery'))[0].value, lead);
+});
+
+sqliteTest('resume download verifies checksum and creates a private path cache', async () => {
+  const ctx = await setup();
+  const bytes = Buffer.from('%PDF-1.7\ncloud-resume-fixture');
+  await ctx.client.putFile('resume.pdf', bytes, 0);
+  const result = await ctx.client.fetchResume();
+  assert.equal(result.sha256, sha256Hex(bytes));
+  if (process.platform !== 'win32') assert.equal((await stat(result.path)).mode & 0o777, 0o600);
+  assert.equal(Buffer.from(await readFile(result.path)).equals(bytes), true);
+});
+
+sqliteTest('outage queues an already observed append but blocks application intents', async () => {
+  const ctx = await setup();
+  const offline = new CloudStateClient({ stateDir: ctx.stateDir, configPath: ctx.configPath, fetchImpl: async () => { throw new Error('offline'); } });
+  const queued = await offline.appendRecord('outcomes', { id: 'app-1', status: 'interview' }, { recordKey: 'app-1', idempotencyKey: 'outcome:1', queueOnFailure: true });
+  assert.equal(queued.queued, true);
+  await assert.rejects(() => offline.createIntent({ applicationId: 'app-2', canonicalUrl: 'https://jobs.example/app-2', leaseId: 'lease' }), /cloud state unavailable/i);
+});

package/job-application-agent/tests/job-application.test.mjs

@@ -53,6 +53,7 @@ function isolatedCliEnv(directory) {
   return {
     ...process.env,
     JOB_APPLICATION_AGENT_STATE_DIR: directory,
+    JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'),
     JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
   };
 }
@@ -89,6 +90,24 @@ test('returns the canonical resume path for direct browser uploads', async (t) =
   assert.deepEqual(result, { path: resume });
 });
 
+test('returns a verified local resume cache while configured cloud storage is offline', async (t) => {
+  const directory = await mkdtemp(join(tmpdir(), 'public-job-agent-offline-resume-'));
+  const cloudDirectory = await mkdtemp(join(tmpdir(), 'public-job-agent-offline-cloud-'));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  t.after(() => rm(cloudDirectory, { recursive: true, force: true }));
+  const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+  const resume = join(directory, 'resume.pdf');
+  const configPath = join(cloudDirectory, 'config.json');
+  await writeFile(join(directory, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  await writeFile(resume, '%PDF-1.7\ncached resume fixture');
+  await writeFile(configPath, JSON.stringify({ version: 2, url: 'https://127.0.0.1:9', token: 'offline-client-token-with-sufficient-length', clientId: 'offline-client' }), { mode: 0o600 });
+  const env = { ...isolatedCliEnv(directory), JOB_APPLICATION_AGENT_CLOUD_CONFIG: configPath };
+
+  const result = JSON.parse(execFileSync(process.execPath, [script, 'resume', 'path'], { env, encoding: 'utf8' }));
+
+  assert.deepEqual(result, { path: resume });
+});
+
 test('preserves the Linux secret-tool install error for profile-dependent commands', async (t) => {
   const directory = await mkdtemp(join(tmpdir(), 'job-agent-linux-profile-error-'));
   t.after(() => rm(directory, { recursive: true, force: true }));

package/job-application-agent/tests/linux-secret-service.integration.test.mjs

@@ -18,6 +18,7 @@ test('Linux Secret Service supports the real profile CLI lifecycle', { skip: !en
   const env = {
     ...process.env,
     JOB_APPLICATION_AGENT_KEYCHAIN_SERVICE: service,
+    JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'),
     JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
     JOB_APPLICATION_AGENT_STATE_DIR: directory,
   };

package/job-application-agent/tests/workflow-state.test.mjs

@@ -20,7 +20,7 @@ async function fixture(t, label) {
     graceConsumed: true,
     installationEventPending: false,
   }));
-  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' } };
+  return { directory, env: { ...process.env, JOB_APPLICATION_AGENT_STATE_DIR: directory, JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(directory, 'cloud-config.json'), JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' } };
 }
 
 function cli(env, args, input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.4.0",
+  "version": "3.4.2",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",
@@ -19,9 +19,15 @@
     "skill",
     "job-search",
     "job-application",
-    "career"
+    "career",
+    "privacy",
+    "claude",
+    "cursor",
+    "codex",
+    "resume",
+    "browser-automation"
   ],
-  "homepage": "https://github.com/vaibhavarora14/job-application-agent#readme",
+  "homepage": "https://jobappagent.com",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/vaibhavarora14/job-application-agent.git"
@@ -38,7 +44,7 @@
     "check:native-artifacts": "node scripts/ci/validate-native-artifacts.mjs",
     "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs",
+    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/cloud-state-client.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/backup.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs",
     "prepack": "npm run check && npm test && npm run privacy-audit"
   },
   "engines": {