job-application-agent 3.4.2 → 3.6.0

package/job-application-agent/tests/accounting-cloud-client.test.mjs

@@ -0,0 +1,183 @@
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+
+import { CloudStateClient, readCachedCloudProfile, saveCloudConfig } from '../scripts/cloud-state-client.mjs';
+import { deliveryProjection, discoveryProjection, validateDelivery, validateLead } from '../scripts/application-accounting.mjs';
+import worker, { sha256Hex } from '../../state-worker/src/worker.mjs';
+import { createBackup, restoreBackup } from '../../state-worker/src/backup.mjs';
+import { createMemoryD1, hasNodeSqlite } from '../../state-worker/tests/d1-mock.mjs';
+import { createMemoryR2 } from '../../state-worker/tests/r2-mock.mjs';
+
+const TOKEN = 'accounting-cloud-client-synthetic-token-long-enough';
+const sqliteTest = hasNodeSqlite ? test : test.skip;
+const now = '2026-09-13T10:00:00.000Z';
+const application = { id: 'app', company: 'Example', role: 'Engineer', source: 'email', url: 'https://example.com/jobs/app', status: 'submitted', submittedAt: '2026-09-12T10:00:00.000Z' };
+const failure = validateDelivery({ version: 1, id: 'failure-event', applicationId: 'app', attemptId: 'initial:app', type: 'delivery-failed', occurredAt: now, evidenceType: 'final-delivery-failure', evidence: 'Synthetic final failure matched to the original application email.' });
+const retry = validateDelivery({ version: 1, id: 'retry-event', applicationId: 'app', attemptId: 'recovery-attempt', type: 'retry-confirmed', channel: 'browser', url: 'https://example.com/jobs/app', channelVerifiedAt: now, approval: 'STANDING AUTHORIZATION', evidenceType: 'browser-confirmation', evidence: 'Synthetic visible ATS success.', occurredAt: '2026-09-13T11:00:00.000Z' });
+const qualifiedLead = validateLead({ version: 1, id: 'lead-event', type: 'lead-reviewed', roundId: 'round-1', sourceId: 'direct', url: application.url, company: application.company, role: application.role, disposition: 'qualified', observedAt: now, evidence: 'Synthetic active employer posting matches requirements.' });
+
+async function setup(t) {
+  const root = await mkdtemp(join(tmpdir(), 'job-agent-accounting-cloud-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const stateDir = join(root, 'state');
+  const configPath = join(root, 'cloud', 'config.json');
+  await mkdir(stateDir, { recursive: true });
+  const schema = await readFile(new URL('../../state-worker/migrations/0001_private_state.sql', import.meta.url), 'utf8');
+  const DB = createMemoryD1(schema);
+  await DB.prepare('INSERT INTO clients (client_id, name, token_hash, created_at) VALUES (?, ?, ?, ?)')
+    .bind('client-test', 'Synthetic Accounting Client', sha256Hex(TOKEN), now).run();
+  const bindings = { DB, STATE: createMemoryR2(), STATE_TOKEN: 'legacy', LEGACY_WRITES_DISABLED: '1' };
+  const fetchImpl = (input, init) => worker.fetch(new Request(input, init), bindings);
+  await saveCloudConfig({ version: 2, url: 'https://state.example.com', token: TOKEN, clientId: 'client-test' }, { configPath });
+  const client = new CloudStateClient({ stateDir, configPath, fetchImpl });
+  return { root, stateDir, configPath, schema, bindings, fetchImpl, client };
+}
+
+async function writeRows(stateDir, stream, rows) {
+  await writeFile(join(stateDir, `${stream}.ndjson`), `${rows.map(row => JSON.stringify(row)).join('\n')}\n`, { mode: 0o600 });
+}
+
+async function readRows(stateDir, stream) {
+  return (await readFile(join(stateDir, `${stream}.ndjson`), 'utf8')).split('\n').filter(Boolean).map(JSON.parse);
+}
+
+sqliteTest('local and cloud accounting projections agree after repeated bidirectional reconciliation', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await writeRows(ctx.stateDir, 'delivery', [failure]);
+  await writeRows(ctx.stateDir, 'discovery', [qualifiedLead]);
+  const originalProjection = deliveryProjection([application], [failure]);
+  assert.equal(originalProjection.effectiveSubmissionCount, 0);
+  await ctx.client.reconcile({ dryRun: false });
+  const correction = validateDelivery({ version: 1, id: 'correction-event', applicationId: 'app', attemptId: 'initial:app', type: 'correction', supersedes: failure.id, status: 'receipt-confirmed', occurredAt: '2026-09-14T10:00:00.000Z', evidenceType: 'employer-acknowledgement', evidence: 'Synthetic employer acknowledgement corrects the matched failure.' });
+  await ctx.client.appendRecord('delivery', correction);
+  const downloaded = await ctx.client.reconcile({ dryRun: false });
+  assert.equal(downloaded.streams.delivery.cloudOnly, 1);
+  const repeated = await ctx.client.reconcile({ dryRun: false });
+  assert.equal(repeated.imported, 0);
+  assert.equal(repeated.downloaded, 0);
+  const localApplications = await readRows(ctx.stateDir, 'applications');
+  const localDelivery = await readRows(ctx.stateDir, 'delivery');
+  const cloudApplications = (await ctx.client.listStream('applications')).map(row => row.value);
+  const cloudDelivery = (await ctx.client.listStream('delivery')).map(row => row.value);
+  assert.equal(cloudDelivery.length, 2);
+  assert.deepEqual(deliveryProjection(localApplications, localDelivery), deliveryProjection(cloudApplications, cloudDelivery));
+  assert.equal(deliveryProjection(localApplications, localDelivery).effectiveSubmissionCount, 1);
+  const localDiscovery = await readRows(ctx.stateDir, 'discovery');
+  const cloudDiscovery = (await ctx.client.listStream('discovery')).map(row => row.value);
+  assert.deepEqual(discoveryProjection(localDiscovery, { roundId: 'round-1' }), discoveryProjection(cloudDiscovery, { roundId: 'round-1' }));
+});
+
+sqliteTest('default reconciliation migrates failed-email recovery history and exports one application with two delivery records', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await writeRows(ctx.stateDir, 'delivery', [failure, retry]);
+  const result = await ctx.client.reconcile({ dryRun: false });
+  assert.equal(result.imported, 3);
+  const again = await ctx.client.reconcile({ dryRun: false });
+  assert.equal(again.imported, 0);
+  const exported = await ctx.client.exportTo(join(ctx.root, 'private-export.json'));
+  const archive = JSON.parse(await readFile(exported.path, 'utf8'));
+  assert.equal(archive.streams.applications.length, 1);
+  assert.equal(archive.streams.delivery.length, 2);
+  assert.ok(archive.streams.delivery.every(row => row.provenance === 'local-reconcile'));
+  assert.deepEqual(archive.streams.delivery.map(row => row.value), [failure, retry]);
+  assert.equal(deliveryProjection(archive.streams.applications.map(row => row.value), archive.streams.delivery.map(row => row.value)).effectiveSubmissionCount, 1);
+  if (process.platform !== 'win32') assert.equal((await stat(exported.path)).mode & 0o777, 0o600);
+});
+
+sqliteTest('private backup restores delivery attempts and projection without duplicating a second restore', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await writeRows(ctx.stateDir, 'delivery', [failure, retry]);
+  await ctx.client.reconcile({ dryRun: false });
+  const archive = await createBackup(ctx.bindings.DB, now);
+  const restored = createMemoryD1(ctx.schema);
+  assert.equal((await restoreBackup(restored, archive)).records, 3);
+  assert.equal((await restoreBackup(restored, archive)).records, 0);
+  const values = async stream => (await restored.prepare('SELECT payload_json FROM records WHERE stream = ? ORDER BY sequence').bind(stream).all()).results.map(row => JSON.parse(row.payload_json));
+  const restoredApplications = await values('applications');
+  const restoredDelivery = await values('delivery');
+  assert.deepEqual(restoredDelivery, [failure, retry]);
+  assert.deepEqual(deliveryProjection(restoredApplications, restoredDelivery), deliveryProjection([application], [failure, retry]));
+});
+
+sqliteTest('an older backend is rejected before any local-only accounting data uploads', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await writeRows(ctx.stateDir, 'delivery', [failure]);
+  const mutations = [];
+  const older = new CloudStateClient({ stateDir: ctx.stateDir, configPath: ctx.configPath, fetchImpl: async (input, init) => {
+    if (new URL(input).pathname === '/v2/status') return Response.json({ apiVersion: 2, backend: 'cloudflare-d1-r2', capabilities: [] });
+    if (init.method && init.method !== 'GET') mutations.push({ input, method: init.method });
+    return ctx.fetchImpl(input, init);
+  } });
+  await assert.rejects(() => older.reconcile({ dryRun: false }), /backend upgrade required.*application-accounting-v1/i);
+  assert.equal(mutations.length, 0);
+  assert.equal((await ctx.bindings.DB.prepare('SELECT COUNT(*) AS count FROM records').first()).count, 0);
+  assert.deepEqual(await readRows(ctx.stateDir, 'delivery'), [failure]);
+});
+
+sqliteTest('cached accounting permits offline research and durable observation queues while blocking transmission intents', async t => {
+  const ctx = await setup(t);
+  await ctx.client.putDocument('profile', { name: 'Synthetic Candidate', roleFamilies: ['engineering'] }, 0);
+  await ctx.client.refreshProfileCache();
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await ctx.client.reconcile({ dryRun: false });
+  const offline = new CloudStateClient({ stateDir: ctx.stateDir, configPath: ctx.configPath, fetchImpl: async () => { throw new Error('synthetic network outage'); } });
+  await offline.requireAccounting();
+  assert.equal((await readCachedCloudProfile(ctx.stateDir)).name, 'Synthetic Candidate');
+  assert.deepEqual(await readRows(ctx.stateDir, 'applications'), [application]);
+  const queued = await offline.appendRecord('delivery', failure, { queueOnFailure: true });
+  assert.equal(queued.queued, true);
+  const restarted = new CloudStateClient({ stateDir: ctx.stateDir, configPath: ctx.configPath, fetchImpl: offline.fetchImpl });
+  const pending = await restarted.pendingWrites();
+  assert.equal(pending.length, 1);
+  assert.deepEqual(pending[0].payload.value, failure);
+  assert.equal(pending[0].stream, 'delivery');
+  if (process.platform !== 'win32') assert.equal((await stat(join(ctx.stateDir, 'cloud-pending.ndjson'))).mode & 0o777, 0o600);
+  await assert.rejects(() => restarted.createIntent({ applicationId: 'another-app', canonicalUrl: 'https://example.com/jobs/another', leaseId: 'expired-lease' }), /cloud state unavailable/i);
+  assert.equal((await ctx.bindings.DB.prepare('SELECT COUNT(*) AS count FROM application_intents').first()).count, 0);
+  await ctx.client.reconcile({dryRun:false});
+  assert.equal((await ctx.client.pendingWrites()).length,0);
+  assert.equal((await readRows(ctx.stateDir,'delivery')).length,1);
+});
+
+sqliteTest('a delivery replay followed by repeated synchronization preserves one logical evidence event', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await writeRows(ctx.stateDir, 'delivery', [failure]);
+  await ctx.client.reconcile({ dryRun: false });
+  await ctx.client.appendRecord('delivery', failure, { idempotencyKey: 'different-network-replay-id' });
+  const sync = await ctx.client.reconcile({ dryRun: false });
+  const repeated = await ctx.client.reconcile({ dryRun: false });
+  assert.equal(sync.imported + sync.downloaded + repeated.imported + repeated.downloaded, 0);
+  assert.equal((await ctx.client.listStream('delivery')).length, 1);
+  assert.equal((await readRows(ctx.stateDir, 'delivery')).length, 1);
+  assert.equal(deliveryProjection([application], await readRows(ctx.stateDir, 'delivery')).failedDeliveryCount, 1);
+});
+
+sqliteTest('cross-client JSON field ordering does not duplicate the same delivery event during synchronization', async t => {
+  const ctx = await setup(t);
+  await writeRows(ctx.stateDir, 'applications', [application]);
+  await ctx.client.reconcile({ dryRun: false });
+  await writeRows(ctx.stateDir, 'delivery', [failure]);
+  const reorderedFailure = Object.fromEntries(Object.entries(failure).reverse());
+  await ctx.client.appendRecord('delivery', reorderedFailure);
+  await ctx.client.reconcile({ dryRun: false });
+  await ctx.client.reconcile({ dryRun: false });
+  assert.equal((await ctx.client.listStream('delivery')).length, 1);
+  assert.equal((await readRows(ctx.stateDir, 'delivery')).length, 1);
+});
+
+sqliteTest('unfamiliar versioned discovery records survive synchronization unchanged', async t => {
+  const ctx = await setup(t);
+  const legacy = {version:7,type:'legacy-discovery-report',id:'legacy',roundId:'old',results:{reviewed:12}};
+  await writeRows(ctx.stateDir,'discovery',[legacy]);
+  await ctx.client.reconcile({dryRun:false});
+  assert.deepEqual((await ctx.client.listStream('discovery'))[0].value,legacy);
+  assert.deepEqual(discoveryProjection(await readRows(ctx.stateDir,'discovery')).leads,[]);
+});

package/job-application-agent/tests/accounting-retry-cli.test.mjs

@@ -0,0 +1,96 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+
+import { validateDelivery } from '../scripts/application-accounting.mjs';
+
+const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+
+test('CLI records a transmitted cloud retry when late receipt evidence invalidates its original preparation eligibility', async t => {
+  const stateDir = await mkdtemp(join(tmpdir(), 'accounting-retry-cli-'));
+  t.after(() => rm(stateDir, { recursive: true, force: true }));
+  const token = 'synthetic-accounting-retry-cli-token-long-enough';
+  const intentId = 'prepared-recovery-intent';
+  const leaseId = 'synthetic-live-lease';
+  const occurredAt = '2026-09-14T10:00:00.000Z';
+  const application = { id: 'app', company: 'Example', role: 'Engineer', url: 'https://jobs.example.com/app', source: 'email', status: 'submitted', submittedAt: '2026-09-12T10:00:00.000Z' };
+  const failure = validateDelivery({ version: 1, id: 'failure-event', applicationId: 'app', attemptId: 'initial:app', type: 'delivery-failed', occurredAt: '2026-09-13T10:00:00.000Z', evidenceType: 'final-delivery-failure', evidence: 'Synthetic final failure matched to original email.' });
+  const receipt = validateDelivery({ version: 1, id: 'late-receipt', applicationId: 'app', attemptId: 'initial:app', type: 'receipt-confirmed', occurredAt, evidenceType: 'employer-acknowledgement', evidence: 'Synthetic employer acknowledgement arrived after recovery was transmitted.' });
+  const retry = validateDelivery({ version: 1, id: 'retry-event', applicationId: 'app', attemptId: intentId, type: 'retry-confirmed', channel: 'browser', url: application.url, channelVerifiedAt: occurredAt, approval: 'STANDING AUTHORIZATION', evidenceType: 'browser-confirmation', evidence: 'Synthetic visible ATS success for prepared recovery.', occurredAt });
+  const streams = { applications: [application], delivery: [failure, receipt] };
+  const confirmations = [];
+  const unexpected = [];
+  const server = createServer(async (request, response) => {
+    const url = new URL(request.url, 'http://127.0.0.1');
+    response.setHeader('content-type', 'application/json');
+    if (request.headers.authorization !== `Bearer ${token}`) {
+      response.writeHead(401).end(JSON.stringify({ error: 'Synthetic authentication required' }));
+      return;
+    }
+    if (request.method === 'GET' && url.pathname === '/v2/status') {
+      response.end(JSON.stringify({ apiVersion: 2, backend: 'synthetic-accounting-backend', capabilities: ['application-accounting-v1'], documents: [], streams: [], files: [] }));
+      return;
+    }
+    if (request.method === 'GET' && url.pathname.startsWith('/v2/streams/')) {
+      const stream = url.pathname.split('/').at(-1);
+      const records = (streams[stream] ?? []).map((value, index) => ({ sequence: index + 1, recordKey: value.id, idempotencyKey: `accounting:${value.id}`, value }));
+      const after = Number(url.searchParams.get('after') ?? 0);
+      const page = records.filter(record => record.sequence > after);
+      response.end(JSON.stringify({ stream, records: page, nextCursor: page.at(-1)?.sequence ?? after }));
+      return;
+    }
+    if (request.method === 'GET' && url.pathname.startsWith('/v2/documents/')) {
+      response.writeHead(404).end(JSON.stringify({ error: 'Synthetic document not present' }));
+      return;
+    }
+    if (request.method === 'POST' && url.pathname === `/v2/intents/${intentId}/confirm`) {
+      let raw = '';
+      for await (const chunk of request) raw += chunk;
+      const body = JSON.parse(raw);
+      confirmations.push(body);
+      if (body.leaseId !== leaseId || body.delivery?.attemptId !== intentId) {
+        response.writeHead(409).end(JSON.stringify({ error: 'Wrong prepared intent or lease' }));
+        return;
+      }
+      streams.delivery.push(body.delivery);
+      response.end(JSON.stringify({ confirmed: true, intentId }));
+      return;
+    }
+    unexpected.push(`${request.method} ${url.pathname}`);
+    response.writeHead(500).end(JSON.stringify({ error: 'Unexpected synthetic backend request' }));
+  });
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  t.after(() => new Promise(resolve => server.close(resolve)));
+  const backendUrl = `http://127.0.0.1:${server.address().port}`;
+  const preload = `const realFetch = globalThis.fetch; globalThis.fetch = (input, init) => { const url = new URL(typeof input === 'string' ? input : input.url); if (url.origin !== 'https://state.example.com') throw new Error('Unexpected non-fixture network request'); return realFetch(process.env.ACCOUNTING_TEST_BACKEND_URL + url.pathname + url.search, init); };`;
+  const configPath = join(stateDir, 'cloud-config.json');
+  await writeFile(configPath, JSON.stringify({ version: 2, url: 'https://state.example.com', token, clientId: 'synthetic-client' }), { mode: 0o600 });
+  await writeFile(join(stateDir, 'telemetry.json'), JSON.stringify({ version: 1, enabled: false, disclosed: true, graceConsumed: true, installationEventPending: false }));
+  for (const [stream, rows] of Object.entries(streams)) {
+    await writeFile(join(stateDir, `${stream}.ndjson`), `${rows.map(row => JSON.stringify(row)).join('\n')}\n`, { mode: 0o600 });
+  }
+  const env = { ...process.env, ACCOUNTING_TEST_BACKEND_URL: backendUrl, JOB_APPLICATION_AGENT_STATE_DIR: stateDir, JOB_APPLICATION_AGENT_CLOUD_CONFIG: configPath, JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9' };
+  const result = await new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['--import', `data:text/javascript,${encodeURIComponent(preload)}`, script, 'ledger', 'retry', '--stdin'], { env, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk; });
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    child.on('error', reject);
+    child.on('close', code => resolve({ code, stdout, stderr }));
+    child.stdin.end(JSON.stringify({ ...retry, cloudIntentId: intentId, cloudLeaseId: leaseId }));
+  });
+
+  assert.deepEqual(unexpected, []);
+  assert.equal(result.code, 0, result.stderr);
+  assert.equal(confirmations.length, 1);
+  assert.deepEqual(confirmations[0], { delivery: retry, leaseId });
+  assert.equal(JSON.parse(result.stdout).recorded, true);
+  const localEvents = (await readFile(join(stateDir, 'delivery.ndjson'), 'utf8')).trim().split('\n').map(JSON.parse);
+  assert.equal(localEvents.filter(event => event.type === 'retry-confirmed' && event.attemptId === intentId).length, 1);
+});

package/job-application-agent/tests/accounting-source-race.test.mjs

@@ -0,0 +1,109 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import test from 'node:test';
+
+const script = fileURLToPath(new URL('../scripts/job-application.mjs', import.meta.url));
+// Constant preload: pause immediately before the source command acquires its
+// rounds lock, allowing a real lead command to commit first without timing sleeps.
+const lockBarrierPreload = `
+import fs from 'node:fs/promises';
+import { basename } from 'node:path';
+import { syncBuiltinESMExports } from 'node:module';
+const originalOpen = fs.open;
+let intercepted = false;
+fs.open = async function(path, ...args) {
+  if (!intercepted && basename(String(path)) === '.rounds.lock') {
+    intercepted = true;
+    await new Promise((resolve, reject) => {
+      process.once('message', message => {
+        if (message !== 'release-lock-attempt') return reject(new Error('Unexpected barrier message'));
+        process.disconnect();
+        resolve();
+      });
+      process.send('before-rounds-lock');
+    });
+  }
+  return originalOpen.call(fs, path, ...args);
+};
+syncBuiltinESMExports();
+`;
+
+function launch(env, args, input, preloadPath) {
+  const runtime = preloadPath ? ['--import', pathToFileURL(preloadPath).href] : [];
+  const child = spawn(process.execPath, [...runtime, script, ...args], {
+    env, stdio: preloadPath ? ['pipe', 'pipe', 'pipe', 'ipc'] : ['pipe', 'pipe', 'pipe'],
+  });
+  const completed = new Promise((resolve, reject) => {
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', chunk => { stdout += chunk; });
+    child.stderr.on('data', chunk => { stderr += chunk; });
+    child.once('error', reject);
+    child.once('close', code => resolve({ code, stdout, stderr }));
+  });
+  child.stdin.end(JSON.stringify(input));
+  return { child, completed };
+}
+
+for (const explicitStaleCounts of [false, true]) {
+  test(explicitStaleCounts
+    ? 'source coverage rejects stale count assertions after a lead commits before lock acquisition'
+    : 'source coverage derives counts from the lead committed before lock acquisition', { timeout: 15000 }, async t => {
+    const dir = await mkdtemp(join(tmpdir(), 'accounting-source-race-'));
+    t.after(() => rm(dir, { recursive: true, force: true }));
+    const preloadPath = join(dir, 'rounds-lock-barrier.mjs');
+    await writeFile(preloadPath, lockBarrierPreload);
+    await writeFile(join(dir, 'telemetry.json'), JSON.stringify({ enabled: false, disclosed: true }));
+    const env = {
+      ...process.env,
+      JOB_APPLICATION_AGENT_STATE_DIR: dir,
+      JOB_APPLICATION_AGENT_CLOUD_CONFIG: join(dir, 'absent-cloud-config.json'),
+      JOB_APPLICATION_AGENT_SOURCE_COMMUNITY_URL: 'http://127.0.0.1:9',
+    };
+    const started = await launch(env, ['round', 'start', '--stdin'], { requestedCount: 1 }).completed;
+    assert.equal(started.code, 0, started.stderr);
+    const { roundId } = JSON.parse(started.stdout);
+    const sourceId = 'indeed';
+    const source = launch(env, ['round', 'source', '--stdin'], {
+      roundId, sourceId, status: 'searched', evidence: 'Synthetic source search.',
+      ...(explicitStaleCounts ? { reviewedCount: 0, qualifiedCount: 0 } : {}),
+    }, preloadPath);
+    t.after(() => { if (source.child.exitCode === null) source.child.kill(); });
+    await Promise.race([
+      new Promise((resolve, reject) => {
+        source.child.once('message', message => {
+          if (message === 'before-rounds-lock') resolve();
+          else reject(new Error('Source sent an unexpected barrier message.'));
+        });
+      }),
+      source.completed.then(result => { throw new Error(`Source exited before the lock barrier: ${result.stderr}`); }),
+    ]);
+    const lead = await launch(env, ['round', 'lead', '--stdin'], {
+      id: 'qualified-lead', roundId, sourceId, company: 'Synthetic Example', role: 'Engineer',
+      url: 'https://example.test/jobs/123', disposition: 'qualified',
+      observedAt: '2026-09-14T10:00:00.000Z', evidence: 'Synthetic qualifying employer requisition.',
+    }).completed;
+    assert.equal(lead.code, 0, lead.stderr);
+    source.child.send('release-lock-attempt');
+    const result = await source.completed;
+    const stored = (await readFile(join(dir, 'rounds.ndjson'), 'utf8')).split('\n').filter(Boolean).map(JSON.parse);
+    const coverage = stored.filter(event => event.type === 'source-checked');
+    if (explicitStaleCounts) {
+      assert.notEqual(result.code, 0, 'Stale zero-count assertions must not be accepted after one qualified lead commits.');
+      assert.match(result.stderr, /count assertions do not match recorded leads/i);
+      assert.equal(coverage.length, 0);
+    } else {
+      assert.equal(result.code, 0, result.stderr);
+      const event = JSON.parse(result.stdout);
+      assert.equal(event.reviewedCount, 1);
+      assert.equal(event.qualifiedCount, 1);
+      assert.equal(coverage.length, 1);
+      assert.equal(coverage[0].reviewedCount, 1);
+      assert.equal(coverage[0].qualifiedCount, 1);
+    }
+  });
+}

package/job-application-agent/tests/answer-inject-captcha.test.mjs

@@ -0,0 +1,169 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  buildAnswerInjectPlan,
+  labelSimilarity,
+  mapAnswersToFields,
+  shouldInjectAnswersBeforeSubmit,
+} from "../scripts/ats/answer-inject.mjs";
+import {
+  detectAiAssistanceDiscouraged,
+  extractNarrativeQuestionsFromText,
+  normalizeAttentionQuestions,
+} from "../scripts/attention-questions.mjs";
+import {
+  checkCaptchaSpendCap,
+  detectChallenge,
+  resolveCaptchaVendorConfig,
+  tryCaptchaVendorAssist,
+} from "../scripts/captcha-vendor.mjs";
+import {
+  RESUME_EXIT,
+  decideResumeSubmit,
+} from "../scripts/attention-resume-submit.mjs";
+
+const binding = {
+  version: 1,
+  attentionId: "attention-1",
+  jobUrl: "https://jobs.ashbyhq.com/livekit/application",
+  browserProfilePath: "/tmp/jaa-chrome",
+  display: ":99",
+  vncPort: 5900,
+  createdAt: "2026-09-16T00:00:00.000Z",
+  questions: [
+    { id: "why", prompt: "Why do you want to work at LiveKit?", kind: "why-us", required: true },
+  ],
+};
+
+test("mapAnswersToFields matches by id and label", () => {
+  const mapped = mapAnswersToFields(
+    [
+      { questionId: "why", text: "Because realtime infra.", source: "typed", prompt: "Why LiveKit?" },
+      { questionId: "proud", text: "Shipped agents.", source: "bank", prompt: "Proud project?" },
+    ],
+    [
+      { id: "why", label: "Why LiveKit?", selector: "textarea#why" },
+      { id: "other", label: "Project you are proud of", selector: "textarea#proud" },
+    ],
+  );
+  assert.equal(mapped.mappings.length, 2);
+  assert.equal(mapped.mappings[0].matchedBy, "question_id");
+  assert.ok(mapped.mappings[1].score >= 0.25);
+  assert.ok(labelSimilarity("why this role", "why this company") > 0.2);
+});
+
+test("buildAnswerInjectPlan prefers ashby hint", () => {
+  const plan = buildAnswerInjectPlan({
+    pageUrl: "https://jobs.ashbyhq.com/x/application",
+    answers: [{ questionId: "why", text: "Hello", source: "typed", prompt: "Why us?" }],
+  });
+  assert.equal(plan.adapterHint, "ashby");
+  assert.equal(plan.fills.length, 1);
+  assert.equal(plan.fills[0].action, "fill_textarea");
+  assert.equal(shouldInjectAnswersBeforeSubmit({ answers: plan.fills }).inject, true);
+});
+
+test("pause packaging extracts questions and AI policy", () => {
+  const text = "Why do you want to work at LiveKit? Do not use AI assistance.";
+  assert.equal(detectAiAssistanceDiscouraged(text), true);
+  const extracted = extractNarrativeQuestionsFromText(text);
+  assert.ok(extracted.length >= 1);
+  assert.equal(normalizeAttentionQuestions(extracted)[0].kind, "why-us");
+});
+
+test("decideResumeSubmit injects answers before submit", () => {
+  const decision = decideResumeSubmit({
+    binding,
+    answers: [{ questionId: "why", text: "I want to build realtime systems.", source: "typed" }],
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/livekit/application",
+      submitEnabled: true,
+      leaseHeld: true,
+    },
+  });
+  assert.equal(decision.action, "inject_answers");
+  assert.equal(decision.exitCode, RESUME_EXIT.INJECT_ANSWERS);
+  assert.equal(decision.injectPlan.fills[0].text.includes("realtime"), true);
+
+  const after = decideResumeSubmit({
+    binding,
+    answers: [{ questionId: "why", text: "I want to build realtime systems.", source: "typed" }],
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/livekit/application",
+      submitEnabled: true,
+      leaseHeld: true,
+      answersInjected: true,
+    },
+  });
+  assert.equal(after.action, "ready_to_submit");
+});
+
+test("captcha vendor off → no network and fail closed", async () => {
+  let network = 0;
+  const fetchImpl = async () => {
+    network += 1;
+    return new Response("{}");
+  };
+
+  const off = await tryCaptchaVendorAssist({
+    env: { CAPTCHA_VENDOR: "off" },
+    fetchImpl,
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/x/application",
+      pageHtml: '<div class="g-recaptcha" data-sitekey="abc"></div>',
+    },
+  });
+  assert.equal(off.reason, "vendor_off");
+  assert.equal(off.fallback, "complete-captcha");
+  assert.equal(network, 0);
+
+  const missingKey = await tryCaptchaVendorAssist({
+    env: { CAPTCHA_VENDOR: "capsolver", CAPTCHA_BUYER_OPT_IN: "on" },
+    fetchImpl,
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/x/application",
+      pageHtml: '<div class="g-recaptcha" data-sitekey="abc"></div>',
+    },
+  });
+  assert.equal(missingKey.reason, "api_key_missing");
+  assert.equal(network, 0);
+
+  const unsupported = await tryCaptchaVendorAssist({
+    env: {
+      CAPTCHA_VENDOR: "capsolver",
+      CAPTCHA_VENDOR_API_KEY: "test-key",
+      CAPTCHA_BUYER_OPT_IN: "on",
+    },
+    fetchImpl,
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/x/application",
+      pageHtml: "<div>hCaptcha challenge</div>",
+      challengeType: "hcaptcha",
+    },
+  });
+  assert.equal(unsupported.reason, "unsupported_type");
+  assert.equal(network, 0);
+  assert.equal(detectChallenge({ pageHtml: "cf-turnstile" }).type, "turnstile");
+  assert.equal(resolveCaptchaVendorConfig({}).vendor, "off");
+  assert.equal(checkCaptchaSpendCap({ spendMonthUsd: 5, spendCapUsd: 5, additionalUsd: 0.01 }).ok, false);
+});
+
+test("still_blocked captcha surfaces vendor_off assist note", () => {
+  const decision = decideResumeSubmit({
+    binding,
+    captchaAssist: {
+      reason: "vendor_off",
+      fallback: "complete-captcha",
+      networkCalled: false,
+    },
+    snapshot: {
+      pageUrl: "https://jobs.ashbyhq.com/livekit/application",
+      pageText: "Please complete the reCAPTCHA",
+      leaseHeld: true,
+      answersInjected: true,
+    },
+  });
+  assert.equal(decision.action, "still_blocked");
+  assert.equal(decision.captchaAssist.reason, "vendor_off");
+});