-
-
Notifications
You must be signed in to change notification settings - Fork 10.8k
Expand file tree
/
Copy pathtest-all.mjs
More file actions
3979 lines (3530 loc) · 175 KB
/
Copy pathtest-all.mjs
File metadata and controls
3979 lines (3530 loc) · 175 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
#!/usr/bin/env node
/**
* test-all.mjs — Comprehensive test suite for career-ops
*
* Run before merging any PR or pushing changes.
* Tests: syntax, scripts, dashboard, data contract, personal data, paths.
*
* Usage:
* node test-all.mjs # Run all tests
* node test-all.mjs --quick # Skip dashboard build (faster)
*/
import { execSync, execFileSync, spawn } from 'child_process';
import { readFileSync, existsSync, readdirSync, mkdtempSync, mkdirSync, writeFileSync, rmSync, realpathSync } from 'fs';
import { join, dirname, delimiter } from 'path';
import { tmpdir } from 'os';
import { fileURLToPath, pathToFileURL } from 'url';
const __dirname = dirname(fileURLToPath(import.meta.url));
const ROOT = __dirname;
const QUICK = process.argv.includes('--quick');
const NODE = process.execPath;
let passed = 0;
let failed = 0;
let warnings = 0;
/**
* Record and print one passing test assertion.
*
* The suite uses these small counters instead of a framework so it can run in
* any freshly cloned career-ops checkout with only Node.js available.
*
* @param {string} msg - Human-readable success message for the terminal log.
* @returns {void}
*/
function pass(msg) { console.log(` ✅ ${msg}`); passed++; }
/**
* Record and print one failing test assertion.
*
* Failures increment the shared counter that controls the final process exit
* code, while still allowing later checks to run and show the full problem set.
*
* @param {string} msg - Human-readable failure message for the terminal log.
* @returns {void}
*/
function fail(msg) { console.log(` ❌ ${msg}`); failed++; }
/**
* Record and print one non-fatal warning.
*
* Warnings are used for expected local-environment gaps, such as missing user
* data in a clean repo, where the check should stay visible but not fail CI.
*
* @param {string} msg - Human-readable warning message for the terminal log.
* @returns {void}
*/
function warn(msg) { console.log(` ⚠️ ${msg}`); warnings++; }
/**
* Run a shell command or executable and return trimmed stdout on success.
*
* Array-form arguments use execFileSync to avoid shell parsing. String-only
* commands use execSync for existing simple checks. Failures return null so the
* caller can decide whether to count the result as a failure or warning.
*
* @param {string} cmd - Command or executable to run.
* @param {string[]} [args=[]] - Optional argument vector for execFileSync.
* @param {object} [opts={}] - Extra child_process options.
* @returns {string|null} Trimmed stdout, or null when the command fails.
*/
function run(cmd, args = [], opts = {}) {
try {
if (Array.isArray(args) && args.length > 0) {
return execFileSync(cmd, args, { cwd: ROOT, encoding: 'utf-8', timeout: 30000, ...opts }).trim();
}
return execSync(cmd, { cwd: ROOT, encoding: 'utf-8', timeout: 30000, ...opts }).trim();
} catch (e) {
return null;
}
}
/**
* Check whether a repo-relative file exists.
*
* @param {string} path - Path relative to the career-ops repository root.
* @returns {boolean} True when the file exists.
*/
function fileExists(path) { return existsSync(join(ROOT, path)); }
function toBashPath(wpath) {
if (process.platform !== 'win32') return wpath;
try {
const forwardSlashed = wpath.replace(/\\/g, '/');
const out = execSync(`wsl wslpath -u "${forwardSlashed}"`, { stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim();
if (out) return out;
} catch {}
try {
const forwardSlashed = wpath.replace(/\\/g, '/');
const out = execSync(`cygpath -u "${forwardSlashed}"`, { stdio: ['pipe', 'pipe', 'ignore'] }).toString().trim();
if (out) return out;
} catch {}
return wpath.replace(/^[A-Za-z]:/, m => '/' + m[0].toLowerCase()).replace(/\\/g, '/');
}
/**
* Read a repo-relative text file as UTF-8.
*
* @param {string} path - Path relative to the career-ops repository root.
* @returns {string} File contents.
*/
function readFile(path) {
const fullPath = join(ROOT, path);
let content = readFileSync(fullPath, 'utf-8');
if (content.trim().startsWith('..') && content.trim().split('\n').length === 1) {
const target = join(dirname(fullPath), content.trim());
if (existsSync(target)) {
content = readFileSync(target, 'utf-8');
}
}
return content;
}
console.log('\n🧪 career-ops test suite\n');
// ── 1. SYNTAX CHECKS ────────────────────────────────────────────
console.log('1. Syntax checks');
const mjsFiles = readdirSync(ROOT).filter(f => f.endsWith('.mjs'));
for (const f of mjsFiles) {
const result = run(NODE, ['--check', f]);
if (result !== null) {
pass(`${f} syntax OK`);
} else {
fail(`${f} has syntax errors`);
}
}
// ── 2. SCRIPT EXECUTION ─────────────────────────────────────────
console.log('\n2. Script execution (graceful on empty data)');
const scripts = [
{ name: 'cv-sync-check.mjs', expectExit: 1, allowFail: true }, // fails without cv.md (normal in repo)
{ name: 'verify-pipeline.mjs', expectExit: 0 },
// --dry-run: these scripts resolve ROOT from import.meta.url and write
// data/applications.md (or data/pipeline.md) in place. On a provisioned working
// copy with a real tracker present, running them without --dry-run mutates user
// data. Harmless in this repo (no tracker shipped), risky for end users who run
// tests inside their active career-ops workspace.
{ name: 'normalize-statuses.mjs --dry-run', expectExit: 0 },
{ name: 'dedup-tracker.mjs --dry-run', expectExit: 0 },
{ name: 'merge-tracker.mjs --dry-run', expectExit: 0 },
{ name: 'reconcile-pipeline.mjs --dry-run', expectExit: 0 },
{ name: 'analyze-patterns.mjs --self-test', expectExit: 0 },
{ name: 'updater-migration-tests.mjs', expectExit: 0 },
{ name: 'tracker-columns-tests.mjs', expectExit: 0 },
{ name: 'validate-portals.mjs --file templates/portals.example.yml', expectExit: 0 },
// Bare run: no portals.yml in the repo, so it must exit 0 gracefully (and hit
// no network). The probe logic itself is unit-tested below with a mock.
{ name: 'verify-portals.mjs', expectExit: 0 },
{ name: 'update-system.mjs check', expectExit: 0 },
];
for (const { name, allowFail } of scripts) {
const result = run(NODE, name.split(' '), { stdio: ['pipe', 'pipe', 'pipe'] });
if (result !== null) {
pass(`${name} runs OK`);
} else if (allowFail) {
warn(`${name} exited with error (expected without user data)`);
} else {
fail(`${name} crashed`);
}
}
// ── 3. LIVENESS CLASSIFICATION ──────────────────────────────────
console.log('\n3. Liveness classification');
try {
const { classifyLiveness } = await import(pathToFileURL(join(ROOT, 'liveness-core.mjs')).href);
const expiredChromeApply = classifyLiveness({
finalUrl: 'https://example.com/jobs/closed-role',
bodyText: 'Company Careers\nApply\nThe job you are looking for is no longer open.',
applyControls: [],
});
if (expiredChromeApply.result === 'expired') {
pass('Expired pages are not revived by nav/footer "Apply" text');
} else {
fail(`Expired page misclassified as ${expiredChromeApply.result}`);
}
const activeWorkdayPage = classifyLiveness({
finalUrl: 'https://example.workday.com/job/123',
bodyText: [
'663 JOBS FOUND',
'Senior AI Engineer',
'Join our applied AI team to ship production systems, partner with customers, and own delivery across evaluation, deployment, and reliability.',
].join('\n'),
applyControls: ['Apply for this Job'],
});
if (activeWorkdayPage.result === 'active') {
pass('Visible apply controls still keep real job pages active');
} else {
fail(`Active job page misclassified as ${activeWorkdayPage.result}`);
}
const closedMycareersfuture = classifyLiveness({
finalUrl: 'https://www.mycareersfuture.gov.sg/job/engineering/senior-staff-embedded-software-engineer',
bodyText: [
'Senior Staff Embedded Software Engineer',
'MaxLinear Asia Singapore Private Limited',
'9 applications Posted 27 Oct 2025 Closed on 26 Nov 2025',
'Applications have closed for this job',
'Log in to Apply',
"You'll need to log in with Singpass to verify your identity.",
'Roles & Responsibilities: design, develop and maintain embedded firmware for broadband communications ICs.',
].join('\n'),
applyControls: ['Log in to Apply'],
});
if (closedMycareersfuture.result === 'expired') {
pass('Closed postings with "Applications have closed" banner are detected');
} else {
fail(`Closed mycareersfuture posting misclassified as ${closedMycareersfuture.result}`);
}
const cloudflareChallenge = classifyLiveness({
status: 403,
finalUrl: 'https://www.pracuj.pl/praca/sap-consultant,oferta,1004870954',
bodyText: 'www.pracuj.pl\nJust a moment...\nPerforming security verification\nThis website uses a security service to protect against malicious bots.\nRay ID: a06489bab8bc4cd7\nPerformance and Security by Cloudflare',
applyControls: [],
});
if (cloudflareChallenge.result === 'uncertain' && cloudflareChallenge.code === 'bot_challenge') {
pass('Cloudflare anti-bot challenge pages are uncertain, not expired');
} else {
fail(`Cloudflare challenge misclassified as ${cloudflareChallenge.result} (${cloudflareChallenge.code})`);
}
const blocked403 = classifyLiveness({
status: 403,
finalUrl: 'https://www.pracuj.pl/praca/sap-consultant,oferta,1004870954',
bodyText: 'Access denied',
applyControls: [],
});
if (blocked403.result === 'uncertain' && blocked403.code === 'access_blocked') {
pass('HTTP 403 is treated as access-blocked (uncertain), not expired');
} else {
fail(`HTTP 403 misclassified as ${blocked403.result} (${blocked403.code})`);
}
const activePolishPosting = classifyLiveness({
status: 200,
finalUrl: 'https://www.pracuj.pl/praca/administrator-sap-utilities-warszawa,oferta,1004870954',
bodyText: 'Administrator SAP Utilities. Connectis_. Siedziba firmy: Chmielna 71, Warszawa. '.repeat(6),
applyControls: ['Aplikuj Aplikuj na ogłoszenie'],
});
if (activePolishPosting.result === 'active') {
pass('Polish "Aplikuj" apply control marks a loaded posting active');
} else {
fail(`Polish apply control not recognized: ${activePolishPosting.result} (${activePolishPosting.code})`);
}
// Headed-fallback-on-challenge path (liveness-browser.mjs). Fake Playwright
// pages script the goto/evaluate calls so we can exercise the wrapper without
// launching a browser. checkUrlLiveness reads body text first, apply controls
// second — the fake returns them in that order.
const { checkUrlLivenessWithFallback, isChallengeResult, jitteredDelayMs } =
await import(pathToFileURL(join(ROOT, 'liveness-browser.mjs')).href);
const disabled = jitteredDelayMs(0) === 0 && jitteredDelayMs(-1) === 0;
let inRange = true;
for (let i = 0; i < 200; i += 1) {
const d = jitteredDelayMs(5000);
if (d < 5000 || d >= 10000) { inRange = false; break; }
}
if (disabled && inRange) {
pass('jitteredDelayMs returns 0 when disabled and stays in [base, 2*base)');
} else {
fail(`jitteredDelayMs out of spec (disabled=${disabled}, inRange=${inRange})`);
}
const fakePage = ({ status, finalUrl, bodyText, applyControls }) => {
let evalCall = 0;
return {
async goto() { return { status: () => status }; },
async waitForTimeout() {},
url() { return finalUrl; },
async evaluate() { evalCall += 1; return evalCall === 1 ? bodyText : applyControls; },
};
};
const URL = 'https://www.pracuj.pl/praca/sap-consultant,oferta,1004870954';
const challengePage = () => fakePage({
status: 403,
finalUrl: URL,
bodyText: 'Just a moment... Performing security verification. Ray ID: abc123. Cloudflare.',
applyControls: [],
});
const livePage = () => fakePage({
status: 200,
finalUrl: URL,
bodyText: 'Administrator SAP Utilities. '.repeat(20),
applyControls: ['Apply for this job'],
});
if (isChallengeResult({ result: 'uncertain', code: 'bot_challenge' }) &&
isChallengeResult({ result: 'uncertain', code: 'access_blocked' }) &&
!isChallengeResult({ result: 'expired', code: 'http_gone' }) &&
!isChallengeResult({ result: 'active', code: 'apply_control_visible' })) {
pass('isChallengeResult flags only bot_challenge/access_blocked uncertains');
} else {
fail('isChallengeResult misclassified a result');
}
const fellBackToActive = await checkUrlLivenessWithFallback(challengePage(), URL, {
getHeadedPage: async () => livePage(),
});
if (fellBackToActive.result === 'active') {
pass('Headed fallback recovers a challenge-blocked page as active');
} else {
fail(`Headed fallback did not recover page: ${fellBackToActive.result} (${fellBackToActive.code})`);
}
const noProvider = await checkUrlLivenessWithFallback(challengePage(), URL, {});
if (noProvider.result === 'uncertain' && noProvider.code === 'bot_challenge') {
pass('No fallback provider keeps the original challenge result');
} else {
fail(`Missing provider changed result to ${noProvider.result} (${noProvider.code})`);
}
const stillBlocked = await checkUrlLivenessWithFallback(challengePage(), URL, {
getHeadedPage: async () => challengePage(),
});
if (stillBlocked.result === 'uncertain' && stillBlocked.code === 'bot_challenge'
&& /headed retry also blocked/.test(stillBlocked.reason)) {
pass('Persistent challenge stays uncertain after headed retry (never upgraded to expired)');
} else {
fail(`Persistent challenge mishandled: ${stillBlocked.result} (${stillBlocked.code})`);
}
const noHeadedAvailable = await checkUrlLivenessWithFallback(challengePage(), URL, {
getHeadedPage: async () => null, // headed launch failed (no display)
});
if (noHeadedAvailable.result === 'uncertain' && noHeadedAvailable.code === 'bot_challenge') {
pass('Headless-only environment degrades to original challenge result');
} else {
fail(`No-display degrade path wrong: ${noHeadedAvailable.result} (${noHeadedAvailable.code})`);
}
// SSRF guard — `rejectPrivateOrInvalid` has to refuse every URL whose host
// resolves to loopback / private / link-local space. The earlier guard only
// matched literal IPv4 patterns and bracketless IPv6, so several Chromium-
// routable bypasses (0.0.0.0, [::], [::1] (bracketed), [::ffff:127.0.0.1],
// localhost.) slipped through. These cases keep that regression covered.
const { rejectPrivateOrInvalid } = await import(
pathToFileURL(join(ROOT, 'liveness-browser.mjs')).href
);
const blockCases = [
['http://0.0.0.0/admin', 'IPv4 all-zeros (Linux routes to loopback)'],
['http://[::]/', 'IPv6 all-zeros (Linux routes to loopback)'],
['http://[::1]/', 'IPv6 loopback (brackets included in url.hostname)'],
['http://[::ffff:127.0.0.1]/', 'IPv4-mapped IPv6 loopback (dotted form)'],
['http://[::ffff:7f00:1]/', 'IPv4-mapped IPv6 loopback (hex form)'],
['http://[::ffff:169.254.169.254]/', 'IPv4-mapped IPv6 link-local (cloud metadata)'],
['http://[fc00::1]/', 'IPv6 ULA (private)'],
['http://[fe80::1]/', 'IPv6 link-local'],
['http://localhost./', 'FQDN-trailing-dot localhost'],
['http://localhost.localdomain/', 'localhost.localdomain alias'],
['http://169.254.169.254/latest/meta-data/', 'cloud metadata IPv4 link-local'],
['http://10.0.0.5/', 'IPv4 RFC1918'],
];
let blockMissed = 0;
for (const [url, label] of blockCases) {
const verdict = rejectPrivateOrInvalid(url);
if (verdict?.code !== 'blocked_host') {
fail(`SSRF guard missed ${label}: ${url} → ${verdict ? verdict.code : 'allowed'}`);
blockMissed += 1;
}
}
if (blockMissed === 0) pass(`SSRF guard blocks ${blockCases.length} known bypass vectors`);
const allowCases = [
'https://boards.greenhouse.io/example/jobs/123',
'https://jobs.lever.co/example/abc-def',
'https://example.com/careers/role',
'https://www.pracuj.pl/praca/role,oferta,1234567',
];
let allowDenied = 0;
for (const url of allowCases) {
if (rejectPrivateOrInvalid(url) !== null) {
fail(`SSRF guard false-positive on legitimate ATS URL: ${url}`);
allowDenied += 1;
}
}
if (allowDenied === 0) pass('SSRF guard lets legitimate ATS URLs through');
const protoCase = rejectPrivateOrInvalid('file:///etc/passwd');
if (protoCase?.code === 'unsupported_protocol') {
pass('SSRF guard rejects unsupported protocol');
} else {
fail(`SSRF guard let unsupported protocol through: ${protoCase?.code ?? 'allowed'}`);
}
} catch (e) {
fail(`Liveness classification tests crashed: ${e.message}`);
}
// ── 4. DASHBOARD BUILD ──────────────────────────────────────────
if (!QUICK) {
console.log('\n4. Dashboard build');
const isWindows = process.platform === 'win32';
const outPath = isWindows ? 'career-dashboard-test.exe' : '/tmp/career-dashboard-test';
const goBuild = run(`cd dashboard && go build -o ${outPath} . 2>&1`);
if (goBuild !== null) {
pass('Dashboard compiles');
if (isWindows) {
try { rmSync(join(ROOT, 'dashboard', 'career-dashboard-test.exe'), { force: true }); } catch (e) {}
}
} else {
fail('Dashboard build failed');
}
} else {
console.log('\n4. Dashboard build (skipped --quick)');
}
// ── 5. DATA CONTRACT ────────────────────────────────────────────
console.log('\n5. Data contract validation');
// Check system files exist
const systemFiles = [
'CLAUDE.md', 'OPENCODE.md', 'VERSION', 'DATA_CONTRACT.md',
'modes/_shared.md', 'modes/_profile.template.md',
'modes/oferta.md', 'modes/pdf.md', 'modes/scan.md',
'templates/states.yml', 'templates/cv-template.html',
'.claude/skills/career-ops/SKILL.md',
'.opencode/skills/career-ops/SKILL.md',
'.antigravitycli/skills/career-ops/SKILL.md',
];
for (const f of systemFiles) {
if (fileExists(f)) {
pass(`System file exists: ${f}`);
} else {
fail(`Missing system file: ${f}`);
}
}
// Check user files are NOT tracked (gitignored)
const userFiles = [
'config/profile.yml', 'modes/_profile.md', 'portals.yml',
];
for (const f of userFiles) {
const tracked = run('git', ['ls-files', f]);
if (tracked === '') {
pass(`User file gitignored: ${f}`);
} else if (tracked === null) {
pass(`User file gitignored: ${f}`);
} else {
fail(`User file IS tracked (should be gitignored): ${f}`);
}
}
const batchRunnerSource = readFile('batch/batch-runner.sh');
const minScoreSkipIndex = batchRunnerSource.indexOf('update_state "$id" "$url" "skipped"');
const minScoreReturnIndex = batchRunnerSource.indexOf('return 0', minScoreSkipIndex);
const completedStateIndex = batchRunnerSource.indexOf('update_state "$id" "$url" "completed"', minScoreSkipIndex);
if (
minScoreSkipIndex !== -1 &&
minScoreReturnIndex !== -1 &&
completedStateIndex !== -1 &&
minScoreSkipIndex < minScoreReturnIndex &&
minScoreReturnIndex < completedStateIndex
) {
pass('Batch min-score gate returns before completed state update');
} else {
fail('Batch min-score gate can fall through to completed state update');
}
if (/if \[\[ "\$status" == "completed" \|\| "\$status" == "skipped" \]\]/.test(batchRunnerSource)) {
pass('Batch resume treats min-score skipped offers as terminal');
} else {
fail('Batch resume can reprocess min-score skipped offers');
}
if (/local total=0 completed=0 skipped=0 failed=0 pending=0/.test(batchRunnerSource) &&
/skipped\) skipped=\$\(\(skipped \+ 1\)\)/.test(batchRunnerSource) &&
/Completed: \$completed \| Skipped: \$skipped \| Failed: \$failed \| Pending: \$pending/.test(batchRunnerSource)) {
pass('Batch summary reports skipped offers separately from pending');
} else {
fail('Batch summary can misreport skipped offers as pending');
}
// ── 6. PERSONAL DATA LEAK CHECK ─────────────────────────────────
console.log('\n6. Personal data leak check');
const leakPatterns = [
'Santiago', 'santifer.io', 'Santifer iRepair', 'Zinkee', 'ALMAS',
'hi@santifer.io', '688921377', '/Users/santifer/',
];
const scanExtensions = ['md', 'yml', 'html', 'mjs', 'sh', 'go', 'json'];
const allowedFiles = [
// English README + localized translations (all legitimately credit Santiago)
'README.md', 'README.es.md', 'README.fr.md', 'README.ja.md', 'README.ko-KR.md',
'README.pt-BR.md', 'README.ru.md', 'README.cn.md', 'README.zh-TW.md',
// Standard project files
'LICENSE', 'CITATION.cff', 'CONTRIBUTING.md', 'CHANGELOG.md', 'TRADEMARK.md',
'package.json', '.github/FUNDING.yml', 'CLAUDE.md', 'AGENTS.md', 'go.mod', 'test-all.mjs',
'.claude-plugin/marketplace.json', '.claude-plugin/plugin.json',
// Community / governance files (added in v1.3.0, all legitimately reference the maintainer)
'CODE_OF_CONDUCT.md', 'GOVERNANCE.md', 'SECURITY.md', 'SUPPORT.md',
'.github/SECURITY.md',
// Dashboard credit string
'dashboard/internal/ui/screens/pipeline.go',
'dashboard/internal/ui/screens/progress.go',
];
// Build pathspec for git grep — only scan tracked files matching these
// extensions. This is what `grep -rn` was trying to do, but git-aware:
// untracked files (debate artifacts, AI tool scratch, local plans/) and
// gitignored files can't trigger false positives because they were never
// going to reach a commit anyway.
const grepPathspec = scanExtensions.map(e => `'*.${e}'`).join(' ');
let leakFound = false;
for (const pattern of leakPatterns) {
const result = run(
`git grep -n "${pattern}" -- ${grepPathspec} 2>/dev/null`
);
if (result) {
for (const line of result.split('\n')) {
const file = line.split(':')[0];
if (allowedFiles.some(a => file.includes(a))) continue;
if (file.includes('dashboard/go.mod')) continue;
warn(`Possible personal data in ${file}: "${pattern}"`);
leakFound = true;
}
}
}
if (!leakFound) {
pass('No personal data leaks outside allowed files');
}
// ── 7. ABSOLUTE PATH CHECK ──────────────────────────────────────
console.log('\n7. Absolute path check');
// Same git grep approach: only scans tracked files. Untracked AI tool
// outputs, local debate artifacts, etc. can't false-positive here.
const absPathResult = run(
`git grep -n "/Users/" -- '*.mjs' '*.sh' '*.md' '*.go' '*.yml' 2>/dev/null | grep -v README.md | grep -v LICENSE | grep -v CLAUDE.md | grep -v test-all.mjs`
);
if (!absPathResult) {
pass('No absolute paths in code files');
} else {
for (const line of absPathResult.split('\n').filter(Boolean)) {
fail(`Absolute path: ${line.slice(0, 100)}`);
}
}
// ── 7b. PDF RENDER WAIT CONDITION ───────────────────────────────
console.log('\n7b. PDF render wait condition');
const generatePdfScript = readFile('generate-pdf.mjs');
if (/waitUntil:\s*['"]load['"]/.test(generatePdfScript)) {
pass('generate-pdf waits for load before rendering');
} else {
fail('generate-pdf does not wait for load before rendering');
}
if (!/waitUntil:\s*['"]networkidle['"]/.test(generatePdfScript)) {
pass('generate-pdf does not wait for networkidle');
} else {
fail('generate-pdf still waits for networkidle');
}
// ── 7c. UPDATER DASHBOARD REBUILD ─────────────────────────────────
console.log('\n7c. Updater dashboard rebuild');
const updateSystemScript = readFile('update-system.mjs');
if (
/git\('diff',\s*'--name-only',\s*'HEAD',\s*'--',\s*'dashboard'\)/.test(updateSystemScript) &&
/path\.startsWith\(['"]dashboard\/['"]\)\s*&&\s*path\.endsWith\(['"]\.go['"]\)/.test(updateSystemScript) &&
/go build -o career-dashboard \./.test(updateSystemScript) &&
/cwd:\s*join\(ROOT,\s*['"]dashboard['"]\)/.test(updateSystemScript) &&
/dashboard binary rebuild skipped/.test(updateSystemScript)
) {
pass('update-system rebuilds dashboard binary when dashboard Go sources change');
} else {
fail('update-system does not rebuild dashboard binary after dashboard Go source updates');
}
// ── 8. MODE FILE INTEGRITY ──────────────────────────────────────
console.log('\n8. Mode file integrity');
const expectedModes = [
'_shared.md', '_profile.template.md', 'oferta.md', 'pdf.md', 'scan.md',
'batch.md', 'apply.md', 'auto-pipeline.md', 'contacto.md', 'deep.md',
'ofertas.md', 'pipeline.md', 'project.md', 'tracker.md', 'training.md',
'interview.md', 'latex.md',
];
for (const mode of expectedModes) {
if (fileExists(`modes/${mode}`)) {
pass(`Mode exists: ${mode}`);
} else {
fail(`Missing mode: ${mode}`);
}
}
// Check _shared.md references _profile.md
const shared = readFile('modes/_shared.md');
if (shared.includes('_profile.md')) {
pass('_shared.md references _profile.md');
} else {
fail('_shared.md does NOT reference _profile.md');
}
for (const skillPath of ['.claude/skills/career-ops/SKILL.md', '.agents/skills/career-ops/SKILL.md']) {
if (!fileExists(skillPath)) {
fail(`${skillPath} is missing`);
continue;
}
const skill = readFile(skillPath);
if (skill.includes('/career-ops latex')) {
pass(`${skillPath} exposes /career-ops latex in discovery menu`);
} else {
fail(`${skillPath} does not expose /career-ops latex in discovery menu`);
}
}
const applyMode = readFile('modes/apply.md');
if (
applyMode.includes('## Step 5 — Preflight gate') &&
applyMode.includes('verify liveness with Playwright') &&
applyMode.includes('matching report has been loaded') &&
applyMode.includes('Do not continue to Step 6 until this preflight is resolved') &&
applyMode.includes('refuse to generate final copy')
) {
pass('apply mode includes liveness and role-match preflight gate');
} else {
fail('apply mode missing liveness/role-match preflight gate');
}
const ofertaMode = readFile('modes/oferta.md');
const autoPipelineMode = readFile('modes/auto-pipeline.md');
if (
ofertaMode.includes('## Liveness gate (URL inputs)') &&
ofertaMode.includes('closed posting evidence') &&
ofertaMode.includes('Do not continue to Block A until this gate is resolved') &&
autoPipelineMode.includes('## Step 0.5 — Liveness gate') &&
autoPipelineMode.includes('closed posting evidence') &&
autoPipelineMode.includes('Do not continue to Step 1 until this gate is resolved')
) {
pass('eval modes (oferta/auto-pipeline) gate dead links before evaluation');
} else {
fail('eval modes missing liveness gate before evaluation');
}
const pipelineMode = readFile('modes/pipeline.md');
if (
pipelineMode.includes('## Liveness sweep') &&
pipelineMode.includes('check-liveness.mjs') &&
pipelineMode.includes('unconfirmed') &&
pipelineMode.includes('Do not') &&
pipelineMode.includes('liveness sweep')
) {
pass('pipeline mode sweeps unconfirmed entries for liveness before processing');
} else {
fail('pipeline mode missing batch liveness sweep for unconfirmed entries');
}
// ── 9. LOCAL PARSER CONTRACT ────────────────────────────────────
console.log('\n9. Local parser contract');
const scanScript = readFile('scan.mjs');
if (
scanScript.includes('typeof entry.name !== \'string\'') &&
scanScript.includes('entry.name.trim()') &&
scanScript.includes('entry.name.toLowerCase()')
) {
pass('scan.mjs guards company names before filtering');
} else {
fail('scan.mjs does not guard company names before filtering');
}
if (
scanScript.includes("skipIds: ['local-parser']") &&
scanScript.includes('local parser failed, used API fallback') &&
scanScript.includes('resolveProvider(company, providers')
) {
pass('scan.mjs falls back to ATS API when local parser fails');
} else {
fail('scan.mjs does not fall back to ATS API when local parser fails');
}
if (fileExists('providers/local-parser.mjs')) {
pass('local-parser provider module exists');
} else {
fail('local-parser provider module is missing');
}
const scanMode = fileExists('modes/scan.md') ? readFile('modes/scan.md') : '';
if (
scanMode.includes('local_parser_ok') &&
(scanMode.includes('No Expensive Scraping Repetition') || scanMode.includes('no repetir scraping caro')) &&
(scanMode.includes('name not listed in `local_parser_ok`') || scanMode.includes('nombre no listado en `local_parser_ok`'))
) {
pass('scan.md skips expensive levels after successful local parser');
} else {
fail('scan.md missing local_parser_ok skip rules for agent scan');
}
if (!fileExists('scripts/parsers/cohere_jobs.py')) {
pass('Cohere parser example is not bundled as a runtime script');
} else {
fail('Cohere parser example is still bundled as a runtime script');
}
const portalExample = readFile('templates/portals.example.yml');
if (
!portalExample.includes('cohere_jobs.py') &&
portalExample.includes('scripts/parsers/example-js-company-jobs.js') &&
portalExample.includes('scripts/parsers/example_python_company_jobs.py') &&
portalExample.includes('already know their target careers URL')
) {
pass('portals example documents a generic local parser contract');
} else {
fail('portals example still points at a bundled Cohere parser');
}
// Security hardening: command allowlist, in-repo script containment, careers_url/company validation.
try {
const localParser = (await import(pathToFileURL(join(ROOT, 'providers/local-parser.mjs')).href)).default;
if (localParser.detect({ name: 'X', careers_url: 'https://x.co', parser: { command: 'rm' } }) === null) {
pass('local-parser rejects a non-interpreter command (e.g. rm)');
} else {
fail('local-parser should reject a command that is not a whitelisted interpreter or in-repo script');
}
if (localParser.detect({ name: 'X', careers_url: 'https://x.co', parser: { command: 'python3', script: '/etc/passwd' } }) === null) {
pass('local-parser rejects a script outside the project root');
} else {
fail('local-parser should reject a script path that escapes the project root');
}
const okEntry = localParser.detect({
name: 'X', careers_url: 'https://x.co',
parser: { command: 'node', script: 'scan.mjs' },
});
if (okEntry && okEntry.url) pass('local-parser accepts a whitelisted interpreter + an in-repo script');
else fail('local-parser should accept a whitelisted interpreter with an in-repo script');
let rejectedUrl = false;
try {
await localParser.fetch({ name: 'X', careers_url: '--oops', parser: { command: 'python3', args: ['--url', '{careers_url}'] } });
} catch (e) {
rejectedUrl = /careers_url/.test(e.message);
}
if (rejectedUrl) pass('local-parser rejects a non-URL careers_url before spawning (argument injection guard)');
else fail('local-parser should reject a careers_url that is not http(s)');
let rejectedCompany = false;
try {
await localParser.fetch({ name: '--rf', careers_url: 'https://x.co', parser: { command: 'python3', args: ['--company', '{company}'] } });
} catch (e) {
rejectedCompany = /company/.test(e.message);
}
if (rejectedCompany) pass('local-parser rejects a company name that could be read as a flag');
else fail('local-parser should reject an unsafe company name');
if (localParser.detect({ name: 'X', careers_url: 'https://x.co', parser: { command: 'node', args: ['-e', 'process.exit(0)'] } }) === null) {
pass('local-parser rejects inline interpreter code (node -e ...)');
} else {
fail('local-parser should reject inline-code flags (-e/-c/--eval)');
}
if (localParser.detect({ name: 'X', careers_url: 'https://x.co', parser: { command: 'node', args: ['--eval=globalThis.x=1', 'scan.mjs'] } }) === null) {
pass('local-parser rejects interpreter options before the script (node --eval=… script)');
} else {
fail('local-parser should reject interpreter options preceding the parser script');
}
if (localParser.detect({ name: 'Yahoo!', careers_url: 'https://x.co', parser: { command: 'node', script: 'scan.mjs' } })?.url) {
pass('local-parser accepts a company name with punctuation when {company} is unused');
} else {
fail('local-parser should not reject a fixed-script entry over an unused company placeholder');
}
} catch (e) {
fail(`local-parser hardening tests crashed: ${e.message}`);
}
// Reverse-scan SSRF guard: a constructed careers_url must resolve to the ATS's own host.
try {
const { entryOnHost } = await import(pathToFileURL(join(ROOT, 'scan-ats-full.mjs')).href);
const canonical = entryOnHost('acme', 'https://jobs.lever.co/acme', (h) => h === 'jobs.lever.co');
const offHost = entryOnHost('acme', 'https://evil.example.com/acme', (h) => h === 'jobs.lever.co');
if (canonical && canonical.careers_url === 'https://jobs.lever.co/acme' && offHost === null) {
pass('scan-ats-full entryOnHost keeps canonical ATS hosts and drops others (SSRF guard)');
} else {
fail('scan-ats-full entryOnHost should keep canonical hosts and drop non-canonical ones');
}
} catch (e) {
fail(`scan-ats-full host-guard test crashed: ${e.message}`);
}
// ── 10. PORTALS CONFIG VALIDATOR ────────────────────────────────
console.log('\n10. Portals config validator');
try {
const tmp = mkdtempSync(join(tmpdir(), 'career-ops-portals-validator-'));
const validPath = join(tmp, 'valid.yml');
const invalidProviderPath = join(tmp, 'invalid-provider.yml');
const emptyKeywordPath = join(tmp, 'empty-keyword.yml');
const duplicateCompanyPath = join(tmp, 'duplicate-company.yml');
const badContentFilterPath = join(tmp, 'bad-content-filter.yml');
writeFileSync(validPath, `
title_filter:
positive: ["AI"]
negative: ["Intern"]
tracked_companies:
- name: "Acme"
careers_url: "https://jobs.lever.co/acme"
`, 'utf-8');
writeFileSync(invalidProviderPath, `
title_filter:
positive: ["AI"]
tracked_companies:
- name: "Acme"
provider: "missing-provider"
careers_url: "https://jobs.lever.co/acme"
`, 'utf-8');
writeFileSync(emptyKeywordPath, `
title_filter:
positive: ["AI", " "]
tracked_companies:
- name: "Acme"
careers_url: "https://jobs.lever.co/acme"
`, 'utf-8');
writeFileSync(duplicateCompanyPath, `
title_filter:
positive: ["AI"]
tracked_companies:
- name: "Acme"
careers_url: "https://jobs.lever.co/acme"
- name: " acme "
careers_url: "https://jobs.lever.co/acme2"
`, 'utf-8');
// content_filter with an empty-string keyword must be rejected, same as
// title/location filters (an empty keyword would match every description).
writeFileSync(badContentFilterPath, `
title_filter:
positive: ["AI"]
content_filter:
positive: ["rust", " "]
tracked_companies:
- name: "Acme"
careers_url: "https://jobs.lever.co/acme"
`, 'utf-8');
const validResult = run(NODE, ['validate-portals.mjs', '--file', validPath]);
if (validResult !== null && validResult.includes('0 errors')) {
pass('validate-portals accepts a minimal valid portals file');
} else {
fail('validate-portals should accept a minimal valid portals file');
}
const exampleResult = run(NODE, ['validate-portals.mjs', '--file', 'templates/portals.example.yml']);
if (exampleResult !== null && exampleResult.includes('0 errors')) {
pass('validate-portals accepts templates/portals.example.yml');
} else {
fail('validate-portals should accept templates/portals.example.yml');
}
const invalidProviderResult = run(NODE, ['validate-portals.mjs', '--file', invalidProviderPath]);
if (invalidProviderResult === null) {
pass('validate-portals rejects unknown explicit providers');
} else {
fail('validate-portals should reject unknown explicit providers');
}
const emptyKeywordResult = run(NODE, ['validate-portals.mjs', '--file', emptyKeywordPath]);
if (emptyKeywordResult === null) {
pass('validate-portals rejects empty title/location keywords');
} else {
fail('validate-portals should reject empty title/location keywords');
}
const duplicateCompanyResult = run(NODE, ['validate-portals.mjs', '--file', duplicateCompanyPath]);
if (duplicateCompanyResult !== null && duplicateCompanyResult.includes('1 warning')) {
pass('validate-portals warns on duplicate enabled company names');
} else {
fail('validate-portals should warn on duplicate enabled company names');
}
const badContentFilterResult = run(NODE, ['validate-portals.mjs', '--file', badContentFilterPath]);
if (badContentFilterResult === null) {
pass('validate-portals rejects empty content_filter keywords');
} else {
fail('validate-portals should reject empty content_filter keywords');
}
rmSync(tmp, { recursive: true, force: true });
} catch (e) {
fail(`portals validator tests crashed: ${e.message}`);
}
// ── 10b. PORTAL SLUG VALIDATOR (verify-portals.mjs) ─────────────
console.log('\n10b. Portal slug validator');
try {
const { deriveSlugCandidates, parseAtsSlug, verifyCompanies } =
await import(pathToFileURL(join(ROOT, 'verify-portals.mjs')).href);
const slugs = deriveSlugCandidates('Acme Corp!');
if (JSON.stringify(slugs) === JSON.stringify(['acmecorp', 'acme-corp', 'acme_corp', 'acme'])) {
pass('verify-portals derives slug candidates from a company name');
} else {
fail(`verify-portals slug candidates wrong: ${JSON.stringify(slugs)}`);
}
if (
parseAtsSlug('https://job-boards.greenhouse.io/acme')?.ats === 'greenhouse' &&
parseAtsSlug('https://jobs.ashbyhq.com/acme')?.ats === 'ashby' &&
parseAtsSlug('https://api.lever.co/v0/postings/acme')?.slug === 'acme' &&
parseAtsSlug('https://openai.com/careers') === null
) {
pass('verify-portals recognizes ATS slugs and skips branded URLs');
} else {
fail('verify-portals parseAtsSlug misclassified an ATS or branded URL');
}
// Mock fetchJson: 200+jobs → live, 200+empty → empty, otherwise 404 → missing.
const mockFetch = async (url) => {
if (url.includes('/boards/live/')) return { jobs: [{}, {}] };
if (url.includes('/boards/empty/')) return { jobs: [] };
const err = new Error('HTTP 404'); err.status = 404; throw err;
};
const results = await verifyCompanies([
{ name: 'Live', careers_url: 'https://job-boards.greenhouse.io/live' },
{ name: 'Empty', careers_url: 'https://job-boards.greenhouse.io/empty' },
{ name: 'Typo', careers_url: 'https://job-boards.greenhouse.io/nope' },
{ name: 'Branded', careers_url: 'https://acme.com/careers' },
{ name: 'Off', enabled: false, careers_url: 'https://job-boards.greenhouse.io/live' },
], { fetchJson: mockFetch });
const byName = Object.fromEntries(results.map((r) => [r.name, r.status]));
if (
results.length === 4 &&
byName.Live === 'live' && byName.Empty === 'empty' &&
byName.Typo === 'missing' && byName.Branded === 'skipped'
) {
pass('verify-portals classifies live / empty / unresolved / non-ATS (disabled excluded)');
} else {
fail(`verify-portals classification wrong: ${JSON.stringify(byName)} (${results.length} rows)`);
}
} catch (e) {
fail(`portal slug validator tests crashed: ${e.message}`);
}
// ── 11. AGENTS.md INTEGRITY ─────────────────────────────────────
console.log('\n11. AGENTS.md integrity');
const agents = readFile('AGENTS.md');
const requiredSections = [
'Data Contract', 'Update Check', 'Ethical Use',
'Offer Verification', 'Canonical States', 'TSV Format',
'First Run', 'Onboarding',
];
for (const section of requiredSections) {
if (agents.includes(section)) {
pass(`AGENTS.md has section: ${section}`);
} else {
fail(`AGENTS.md missing section: ${section}`);
}
}
// ── 11. CLI WRAPPER FILE INTEGRITY ──────────────────────────
console.log('\n11. CLI wrapper file integrity');
const cliWrappers = ['CLAUDE.md', 'OPENCODE.md', 'GEMINI.md'];
for (const f of cliWrappers) {