job-application-agent 3.5.0 → 3.6.0

package/job-application-agent/tests/session-binding.test.mjs

@@ -0,0 +1,102 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+import {
+  FILL_DISPLAY,
+  FILL_VNC_PORT,
+  FORBIDDEN_VNC_PORT,
+  assertSameTab,
+  createSessionBinding,
+  extractSessionBindingFields,
+  readSessionBindingFile,
+  sessionBindingPath,
+  validateSessionBinding,
+  writeSessionBindingFile,
+} from "../scripts/session-binding.mjs";
+
+test("validateSessionBinding requires fill display and VNC 5900", () => {
+  const ok = validateSessionBinding({
+    attentionId: "attention-1",
+    jobUrl: "https://jobs.ashbyhq.com/acme/application",
+    browserProfilePath: "/tmp/jaa-chrome",
+  });
+  assert.equal(ok.ok, true);
+  assert.equal(ok.binding.display, FILL_DISPLAY);
+  assert.equal(ok.binding.vncPort, FILL_VNC_PORT);
+
+  const badPort = validateSessionBinding({
+    attentionId: "attention-1",
+    jobUrl: "https://jobs.example.com/a",
+    browserProfilePath: "/tmp/p",
+    vncPort: FORBIDDEN_VNC_PORT,
+  });
+  assert.equal(badPort.ok, false);
+  assert.match(badPort.error, /5901/);
+
+  const badDisplay = validateSessionBinding({
+    attentionId: "attention-1",
+    jobUrl: "https://jobs.example.com/a",
+    browserProfilePath: "/tmp/p",
+    display: ":1",
+  });
+  assert.equal(badDisplay.ok, false);
+  assert.match(badDisplay.error, /forbidden|display/i);
+});
+
+test("assertSameTab detects drift and accepts same application path", () => {
+  const same = assertSameTab(
+    "https://jobs.ashbyhq.com/acme/job/123",
+    "https://jobs.ashbyhq.com/acme/job/123?utm_source=x",
+  );
+  assert.equal(same.ok, true);
+
+  const drift = assertSameTab(
+    "https://jobs.ashbyhq.com/acme/job/123",
+    "https://jobs.ashbyhq.com/acme",
+  );
+  assert.equal(drift.ok, false);
+  assert.equal(drift.reason, "tab_drift");
+
+  const hintFail = assertSameTab(
+    "https://jobs.ashbyhq.com/acme/job/123",
+    "https://jobs.ashbyhq.com/acme/job/123",
+    { urlContains: "/application" },
+  );
+  assert.equal(hintFail.ok, false);
+});
+
+test("write/read session binding stays local under state dir", async (t) => {
+  const dir = await mkdtemp(join(tmpdir(), "jaa-binding-"));
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  const binding = createSessionBinding({
+    attentionId: "attention-abc",
+    jobUrl: "https://jobs.ashbyhq.com/acme/application",
+    browserProfilePath: "/home/runner/.jaa-chrome-fill",
+    applicationId: "app-1",
+    roundId: "round-1",
+    tabHint: { urlContains: "/application" },
+  });
+  const path = sessionBindingPath(dir, binding.attentionId);
+  await writeSessionBindingFile(path, binding);
+  const loaded = await readSessionBindingFile(path);
+  assert.equal(loaded.attentionId, "attention-abc");
+  assert.equal(loaded.vncPort, 5900);
+  const raw = JSON.parse(await readFile(path, "utf8"));
+  assert.equal(raw.browserProfilePath, "/home/runner/.jaa-chrome-fill");
+});
+
+test("extractSessionBindingFields pulls local-only keys", () => {
+  const fields = extractSessionBindingFields({
+    url: "https://example.com",
+    browserProfilePath: "/tmp/p",
+    display: ":99",
+    vncPort: 5900,
+  });
+  assert.equal(fields.browserProfilePath, "/tmp/p");
+  assert.equal(fields.display, ":99");
+  assert.equal(extractSessionBindingFields({ url: "https://example.com" }), null);
+});

package/job-application-agent/tests/skill-contract.test.mjs

@@ -19,14 +19,39 @@ test('documents durable autonomy, resumable rounds, attention and friction contr
   const skill = await readFile(new URL('../SKILL.md', import.meta.url), 'utf8');
   const autonomy = await readFile(new URL('../references/AUTONOMY.md', import.meta.url), 'utf8');
   const runs = await readFile(new URL('../references/RUNS.md', import.meta.url), 'utf8');
+  const agentBox = await readFile(new URL('../references/agent-box/README.md', import.meta.url), 'utf8');
 
   assert.match(skill, /autonomy status/);
   assert.match(skill, /round status/);
   assert.match(skill, /attention list/);
   assert.match(skill, /friction record/);
+  assert.match(skill, /attention-runner-poll/);
+  assert.match(skill, /attention-resume-submit/);
+  assert.match(skill, /session-binding/);
+  assert.match(skill, /DISPLAY=:99/);
+  assert.match(skill, /5900/);
   assert.match(autonomy, /never.*merge.*publish/i);
   assert.match(autonomy, /CAPTCHA/i);
   assert.match(runs, /visible.*confirmation/i);
   assert.match(runs, /discoverySource/);
   assert.match(runs, /applicationChannel/);
+  assert.match(runs, /Resume → submit/);
+  assert.match(runs, /attention-runner-poll/);
+  assert.match(runs, /submit if possible/i);
+  assert.match(agentBox, /localhost:5900/);
+  assert.match(agentBox, /5901/);
+  assert.match(agentBox, /DISPLAY=:99/);
+});
+
+test('documents Free.ai as optional LLM assist only', async () => {
+  const skill = await readFile(new URL('../SKILL.md', import.meta.url), 'utf8');
+  const freeAi = await readFile(new URL('../references/FREE_AI.md', import.meta.url), 'utf8');
+
+  assert.match(skill, /FREE_AI\.md/);
+  assert.match(skill, /does not call Free\.ai/i);
+  assert.match(freeAi, /https:\/\/api\.free\.ai\/v1/);
+  assert.match(freeAi, /FREE_AI_API_KEY/);
+  assert.match(freeAi, /qwen7b/);
+  assert.match(freeAi, /not the hosted/i);
+  assert.match(freeAi, /does not read `FREE_AI_API_KEY`/i);
 });

package/job-application-agent/tests/workflow-state.test.mjs

@@ -739,7 +739,18 @@ test('replays and prioritizes an owner-only attention queue', async (t) => {
     stage: 'submission',
     blocker: 'captcha',
     requiredActions: ['complete-captcha'],
-  });
+    browserProfilePath: join(directory, 'chrome-fill'),
+    display: ':99',
+    vncPort: 5900,
+    tabHint: { urlContains: '/captcha' },
+  });
+
+  assert.ok(captcha.sessionBinding?.binding?.browserProfilePath);
+  assert.equal(captcha.sessionBinding.binding.vncPort, 5900);
+  assert.equal(captcha.sessionBinding.binding.display, ':99');
+  const attentionRaw = await readFile(join(directory, 'attention.ndjson'), 'utf8');
+  assert.doesNotMatch(attentionRaw, /browserProfilePath/);
+  assert.ok((await readFile(captcha.sessionBinding.path, 'utf8')).includes('chrome-fill'));
 
   const before = cli(env, ['attention', 'list']);
   assert.deepEqual(before.items.map((item) => item.id), [captcha.id, judgment.id]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "job-application-agent",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "A privacy-first Agent Skill and CLI for evidence-based job discovery, application completion, and outcome tracking.",
   "license": "MIT",
   "type": "module",
@@ -42,9 +42,9 @@
   "scripts": {
     "test": "node --test",
     "check:native-artifacts": "node scripts/ci/validate-native-artifacts.mjs",
-    "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs",
+    "privacy-audit": "node --test job-application-agent/tests/privacy-audit.test.mjs job-application-agent/tests/outreach-cli.test.mjs",
     "smoke:package": "node scripts/smoke-package.mjs",
-    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/cloud-state-client.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/backup.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs && node --check job-application-agent/scripts/application-accounting.mjs",
+    "check": "node --check job-application-agent/scripts/job-application.mjs && node --check job-application-agent/scripts/attention-runner-poll.mjs && node --check job-application-agent/scripts/attention-resume-submit.mjs && node --check job-application-agent/scripts/session-binding.mjs && node --check job-application-agent/scripts/novnc-display-guard.mjs && node --check job-application-agent/scripts/ats/submit-adapters.mjs && node --check job-application-agent/scripts/cloud-state-client.mjs && node --check job-application-agent/scripts/secret-store.mjs && node --check job-application-agent/scripts/source-community-client.mjs && node --check job-application-agent/scripts/source-community-schema.mjs && node --check job-application-agent/scripts/telemetry-client.mjs && node --check job-application-agent/scripts/telemetry-schema.mjs && node --check job-application-agent/scripts/version.mjs && node --check telemetry-worker/src/worker.mjs && node --check telemetry-worker/src/public-stats.mjs && node --check telemetry-worker/public/dashboard.js && node --check installer/src/cli.mjs && node --check installer/src/installer.mjs && node --check installer/src/runner.mjs && node --check installer/src/scheduler.mjs && node --check scripts/ci/classify-paths.mjs && node --check scripts/ci/validate-native-artifacts.mjs && node --check bin/job-application-agent.mjs && node --check state-worker/src/worker.mjs && node --check state-worker/src/backup.mjs && node --check state-worker/src/cli.mjs && node --check state-worker/bin/sync.mjs && node --check job-application-agent/scripts/application-accounting.mjs && node --check job-application-agent/scripts/outreach-domain.mjs && node --check job-application-agent/scripts/outreach-store.mjs && node --check job-application-agent/scripts/outreach-cli.mjs && node --check state-worker/src/outreach.mjs && node --check job-application-agent/scripts/ats/answer-inject.mjs && node --check job-application-agent/scripts/attention-questions.mjs && node --check job-application-agent/scripts/captcha-vendor.mjs",
     "prepack": "npm run check && npm test && npm run privacy-audit"
   },
   "engines": {
@@ -52,5 +52,8 @@
   },
   "devDependencies": {
     "yaml": "2.9.0"
+  },
+  "dependencies": {
+    "sql.js": "1.13.0"
   }
 }