shakers-cli-beta 0.10.3 → 0.11.0

package/bin/shakers.js

@@ -46,7 +46,11 @@ const { run: runRegister } = require('./register');
 const { run: runOnboarding } = require('./onboarding');
 const { run: runConfig } = require('./config');
 const { run: runMcp } = require('./mcp');
+const { run: runUpdate } = require('./update');
 const { checkOnboardingCompleted } = require('../src/onboarding-availability');
+const { emitCommandAudit } = require('../src/command-audit');
+const { readPackageInfo } = require('../src/update-flow');
+const { isSuppressed, maybeNotify, triggerBackgroundCheck } = require('../src/update-notifier');
 
 let VERSION = '';
 try {
@@ -95,13 +99,14 @@ const HANDLERS = {
   register: runRegister,
   onboarding: runOnboarding,
   config: runConfig,
+  update: runUpdate,
   login: runLogin,
   logout: runLogout,
   superadmin: runSuperadmin,
   mcp: runMcp,
 };
 
-const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma']);
+const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma', 'update']);
 
 // Command FAMILIES — a navigation layer over the flat commands (which all stay
 // valid as aliases). `shakers <family> <sub>` resolves to the flat handler; every
@@ -119,7 +124,7 @@ const FAMILIES = {
     invitations: 'invitations', applications: 'applications',
   },
   usage: { run: 'ai-usage', report: 'report', share: 'share' },
-  account: { login: 'login', logout: 'logout', register: 'register', config: 'config' },
+  account: { login: 'login', logout: 'logout', register: 'register', config: 'config', update: 'update' },
   certs: { list: 'certifications', certify: 'certify' },
 };
 
@@ -212,12 +217,13 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `  Sesión:\n`
       + `    login        Inicia sesión en tu cuenta de Shakers\n`
       + `    logout       Cierra la sesión\n`
-      + `    config       Lee/escribe la configuración (bases de hub/certs)\n\n`
+      + `    config       Lee/escribe la configuración (bases de hub/certs)\n`
+      + `    update       Actualiza el CLI a la última versión publicada (--check solo informa)\n\n`
       + `  Familias (agrupan los comandos de arriba; los nombres planos siguen valiendo como alias):\n`
       + `    add <skill|agent|project|role>     ·  role <add|change>\n`
       + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
       + `    projects <find|show|save|unsave|invitations|applications>\n`
-      + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config>\n`
+      + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
       + `    Ejecuta \`shakers <familia>\` (sin subcomando) para ver sus subcomandos.\n\n`
       + `  Ejecuta shakers <comando> --help para las opciones de cada comando.\n\n`;
   }
@@ -255,12 +261,13 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `  Session:\n`
     + `    login        Sign in to your Shakers account\n`
     + `    logout       Sign out\n`
-    + `    config       Read/write configuration (hub/certs bases)\n\n`
+    + `    config       Read/write configuration (hub/certs bases)\n`
+    + `    update       Update the CLI to the latest published version (--check only reports)\n\n`
     + `  Families (group the commands above; the flat names still work as aliases):\n`
     + `    add <skill|agent|project|role>     ·  role <add|change>\n`
     + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
     + `    projects <find|show|save|unsave|invitations|applications>\n`
-    + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config>\n`
+    + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
     + `    Run \`shakers <family>\` (no subcommand) to list its subcommands.\n\n`
     + `  Run \`shakers <command> --help\` for a command's options.\n\n`;
 }
@@ -295,6 +302,18 @@ async function main() {
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 
   const token = argv.find((a) => !a.startsWith('-'));
+
+  // Single dispatch choke-point (ADR-060): audit EXACTLY once before branching, fire-and-forget (never awaited). MCP tool calls run in-process and never reach here.
+  const auditCommand =
+    !token || token.toLowerCase() === 'help' ? 'help' : token.toLowerCase();
+  emitCommandAudit({ command: auditCommand, argv, env: process.env });
+
+  // Non-blocking update notice: reads a cached version synchronously, registry check runs in a detached worker; stderr-only, suppressed for --json/non-TTY/CI/update/opt-out.
+  if (!isSuppressed({ argv, command: auditCommand, env: process.env })) {
+    maybeNotify({ currentVersion: VERSION, lang, env: process.env });
+    triggerBackgroundCheck({ name: readPackageInfo().name, env: process.env });
+  }
+
   if (!token || token.toLowerCase() === 'help') {
     let hideOnboarding = false;
     try {

package/bin/update-check-worker.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+'use strict';
+
+// Detached worker: fetches the latest version from the PUBLIC, unauthenticated npm registry, writes the `{lastCheck, latest}` cache, fails silent.
+
+const https = require('https');
+const { writeCache } = require('../src/update-notifier');
+
+const FETCH_TIMEOUT_MS = 10000;
+const MAX_BODY_BYTES = 3 * 1024 * 1024;
+
+// Scoped names (`@scope/pkg`) address the registry as `@scope%2fpkg`, `@` literal; install-v1 metadata still carries `dist-tags`.
+function registryUrl(name) {
+  const p = name.startsWith('@') ? `@${name.slice(1).replace('/', '%2f')}` : name;
+  return `https://registry.npmjs.org/${p}`;
+}
+
+function fetchLatest(name, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (v) => {
+      if (!settled) {
+        settled = true;
+        resolve(v);
+      }
+    };
+    let req;
+    try {
+      req = https.get(
+        registryUrl(name),
+        { headers: { Accept: 'application/vnd.npm.install-v1+json' } },
+        (res) => {
+          if (res.statusCode !== 200) {
+            res.resume();
+            return done(null);
+          }
+          let body = '';
+          res.setEncoding('utf8');
+          res.on('data', (c) => {
+            body += c;
+            if (body.length > MAX_BODY_BYTES) req.destroy();
+          });
+          res.on('end', () => {
+            try {
+              const json = JSON.parse(body);
+              const latest = json && json['dist-tags'] && json['dist-tags'].latest;
+              done(typeof latest === 'string' && latest ? latest : null);
+            } catch {
+              done(null);
+            }
+          });
+        },
+      );
+    } catch {
+      return done(null);
+    }
+    req.setTimeout(timeoutMs, () => req.destroy());
+    req.on('error', () => done(null));
+  });
+}
+
+async function main() {
+  const name = process.argv[2];
+  if (!name) return;
+  const latest = await fetchLatest(name, FETCH_TIMEOUT_MS);
+  if (!latest) return;
+  writeCache({ lastCheck: Date.now(), latest });
+}
+
+main();

package/bin/update.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+// `update` — update the CLI to the latest published version (CLI-only, never an MCP tool); `--check` reports without installing. Logic in src/update-flow.js.
+
+const { detectReportLang, getCatalog } = require('../src/i18n');
+const updateFlow = require('../src/update-flow');
+
+function parseUpdateArgs(argv = []) {
+  const o = { help: false, check: false, json: false, lang: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h') o.help = true;
+    else if (a === '--check' || a === '--dry-run') o.check = true;
+    else if (a === '--json') o.json = true;
+    else if (a === '--lang') {
+      const v = argv[++i];
+      o.lang = v === 'es' || v === 'en' ? v : null;
+    } else if (a.startsWith('--lang=')) {
+      const v = a.slice(7);
+      o.lang = v === 'es' || v === 'en' ? v : null;
+    }
+  }
+  return o;
+}
+
+async function run(
+  argv = process.argv.slice(2),
+  { out = null, env = process.env, deps = null } = {},
+) {
+  const opts = parseUpdateArgs(argv);
+  const lang = opts.lang || detectReportLang();
+  const t = getCatalog(lang).cli.update;
+  const write = out || ((s) => process.stdout.write(s));
+  const flow = deps || updateFlow;
+
+  if (opts.help) {
+    write(t.help + '\n');
+    return;
+  }
+
+  const info = flow.readPackageInfo();
+  const install = flow.detectInstall(env);
+  const current = info.version;
+
+  if (!opts.json) write(`  ${t.checking}\n`);
+  const latest = flow.fetchLatestVersion(info);
+
+  if (opts.json) {
+    const updateAvailable =
+      latest.ok && current ? flow.compareVersions(current, latest.version) < 0 : null;
+    write(
+      `${JSON.stringify({
+        package: info.name,
+        current: current || null,
+        latest: latest.ok ? latest.version : null,
+        install: install.kind,
+        updateAvailable,
+        reason: latest.ok ? null : latest.reason,
+      })}\n`,
+    );
+    if (!latest.ok) process.exitCode = 1;
+    return;
+  }
+
+  if (current) write(`  ${t.current(current)}\n`);
+
+  if (!latest.ok) {
+    write(`  ${t.latestUnknown(latest.reason)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!current || flow.compareVersions(current, latest.version) >= 0) {
+    write(`  ${t.upToDate(latest.version)}\n`);
+    return;
+  }
+
+  write(`  ${t.available(current, latest.version)}\n`);
+
+  // `--check`: report only, never install.
+  if (opts.check) {
+    write(`  ${t.checkHint}\n`);
+    return;
+  }
+
+  const plan = flow.buildUpdatePlan(install, info, env);
+  if (!plan) {
+    if (install.kind === 'source') write(`  ${t.sourceCheckout}\n`);
+    else write(`  ${t.unknownInstall(flow.manualCommand(info))}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  write(`  ${t.detected(plan.label)}\n`);
+  write(`  ${t.updating(info.name, current, latest.version)}\n\n`);
+
+  const result = flow.runInstall(plan, env);
+  if (result.ok) {
+    write(`\n  ${t.success(latest.version)}\n  ${t.reRun}\n`);
+    return;
+  }
+  write(`\n  ${t.failInstall(result.reason)}\n  ${t.failHint(flow.manualCommand(info))}\n`);
+  process.exitCode = 1;
+}
+
+module.exports = { run, parseUpdateArgs };
+
+if (require.main === module) {
+  run();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.10.3",
+  "version": "0.11.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/certify-dimension-client.js

@@ -4,6 +4,7 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
+const { toUpperLang } = require('./lang-codes');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -153,9 +154,87 @@ async function discoverOfferableDimensions(deps = {}, { accessToken, hubAccessTo
   return { ok: true, mainRole: mine.mainRole, offerable, unmatched };
 }
 
+async function requestCreateCertificationInterview(
+  { dimensionKey, languageCode, accessToken } = {},
+  { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
+) {
+  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
+  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
+  const body = { dimensionKey };
+  if (languageCode) body.languageCode = toUpperLang(languageCode);
+  let res;
+  try {
+    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(accessToken));
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+  if (res.status < 200 || res.status >= 300) {
+    const reason = reasonForError(res.status, res.raw);
+    if (reason !== 'dimension-on-cooldown') return { ok: false, reason };
+    // certs puts the date in the message only: "... available on 2026-10-28T14:50:38.265Z".
+    const available = String(res.raw || '').match(/available on (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/);
+    return { ok: false, reason, availableOn: available ? available[1] : null };
+  }
+  const data = payloadOf(res.raw);
+  const interviewId = pick(data || {}, ['interviewId', 'id']);
+  if (!interviewId) return { ok: false, reason: 'bad-response' };
+  return { ok: true, interviewId, language: pick(data || {}, ['language', 'languageCode']) || null };
+}
+
+// Poll the verdict; a 2xx/404/425/202 with no band yet resolves `ready:false` (retriable).
+async function requestCertificationReport(
+  { interviewId, accessToken } = {},
+  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
+) {
+  if (!base) return { ok: false, reason: 'no-endpoint' };
+  if (!interviewId) return { ok: false, reason: 'no-interview' };
+  const url = `${base.replace(/\/+$/, '')}/${encodeURIComponent(interviewId)}/report`;
+  let res;
+  try {
+    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+  if (res.status === 404 || res.status === 425 || res.status === 202) return { ok: true, ready: false, report: null };
+  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
+  const data = payloadOf(res.raw);
+  if (data === undefined || data === null || typeof data !== 'object') return { ok: true, ready: false, report: null };
+  const band = pick(data, ['band', 'level', 'combinedLevel']);
+  // A report with too little evidence for a level has band null; it is still finished.
+  if (!band && !pick(data, ['evaluationId'])) return { ok: true, ready: false, report: null };
+  return { ok: true, ready: true, report: data };
+}
+
+// The case the web preview shows before starting (works `get-dimension-case`): the exercise statement, else the
+// version's brief. `case: null` for a template with neither.
+async function requestDimensionCase(
+  { dimensionKey, accessToken } = {},
+  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
+) {
+  if (!base) return { ok: false, reason: 'no-endpoint' };
+  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
+  const path = String(dimensionKey).split('/').map(encodeURIComponent).join('/');
+  const url = `${base.replace(/\/+$/, '')}/dimension/${path}/case`;
+  let res;
+  try {
+    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
+  const data = payloadOf(res.raw);
+  if (!data || typeof data !== 'object') return { ok: false, reason: 'bad-response' };
+  const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
+  const brief = text(data.statement) || text(data.candidateBrief);
+  return { ok: true, case: brief ? { brief, testType: text(data.testType) } : null };
+}
+
 module.exports = {
   requestMyCertifications,
   requestTemplatesByDimension,
+  requestCreateCertificationInterview,
+  requestCertificationReport,
+  requestDimensionCase,
   composeDimensionKey,
   composeOfferableDimensions,
   discoverOfferableDimensions,

package/src/certify-dimension-flow.js

@@ -1,15 +1,24 @@
 'use strict';
 
-// `certify` dimension flow: discover -> pick -> hand off to the web interview.
+// `certify` dimension flow: discover -> pick -> create -> LiveKit interview -> poll verdict.
 
 const { runInteractiveMultiSelect } = require('./interactive-select');
 
 function makeCertifyDimensionDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./certify-dimension-client');
+  const onboardingFlow = require('./onboarding-flow');
   return {
-    getTalentProfileUrl: config.getTalentProfileUrl,
+    getCertificationInterviewsEndpoint: config.getCertificationInterviewsEndpoint,
+    // `{certsBase}/interviews` — shared base for LiveKit start/complete + the report poll.
+    getInterviewsBase: config.getOnboardingInterviewsEndpoint,
     discoverOfferableDimensions: (opts) => client.discoverOfferableDimensions({}, opts),
+    requestCreateCertificationInterview: client.requestCreateCertificationInterview,
+    requestCertificationReport: client.requestCertificationReport,
+    requestDimensionCase: client.requestDimensionCase,
+    conductLivekitInterview: onboardingFlow.conductLivekitInterview,
+    onboardingDeps: onboardingFlow.makeDeps(),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     ...overrides,
   };
 }
@@ -53,19 +62,51 @@ function resolveDimensionArg(arg, items) {
   return items.find((d) => d.dimensionKey === raw || d.slug === raw) || undefined;
 }
 
-// Deep link into the talent's Shakers web profile, filtered to the chosen dimension.
-// One dimension can publish more than one assessment, so the filtered catalog is the
-// robust target rather than a single templateId.
-function buildWebLink(profileUrl, dimension) {
-  if (!profileUrl || !dimension || !dimension.clusterId || !dimension.slug) return null;
-  let origin;
-  try {
-    origin = new URL(profileUrl).origin;
-  } catch {
-    return null;
+// The evaluation lands one to two minutes after the interview ends, four when the queue is busy.
+async function pollReport(deps, { interviewId, accessToken }, { base, attempts = 60, intervalMs = 5000 } = {}) {
+  for (let i = 0; i < attempts; i++) {
+    const res = await deps.requestCertificationReport({ interviewId, accessToken }, { base });
+    if (!res.ok) return { ok: false, reason: res.reason };
+    if (res.ready) return { ok: true, report: res.report };
+    if (i < attempts - 1) await deps.sleep(intervalMs);
   }
-  const key = `${encodeURIComponent(dimension.clusterId)}/${encodeURIComponent(dimension.slug)}`;
-  return `${origin}/certifications?dimension=${key}`;
+  return { ok: false, reason: 'timeout' };
+}
+
+function formatDay(iso, lang) {
+  const d = iso ? new Date(iso) : null;
+  if (!d || Number.isNaN(d.getTime())) return null;
+  return d.toLocaleDateString(lang === 'en' ? 'en-GB' : 'es-ES', { day: 'numeric', month: 'long', year: 'numeric' });
+}
+
+function renderVerdict(report, cd) {
+  const lines = [];
+  const band = report.band || report.level || report.combinedLevel;
+  const dimension = report.dimensionName || report.dimension || report.dimensionKey;
+  if (dimension) lines.push(cd.verdictDimension(dimension));
+  if (band) lines.push(cd.verdictBand(band));
+  if (typeof report.certified === 'boolean') lines.push(report.certified ? cd.verdictCertified : cd.verdictNotCertified);
+  const summary = report.summary || report.rationale || report.feedback;
+  if (typeof summary === 'string' && summary.trim()) lines.push(summary.trim());
+  const areas = Array.isArray(report.areas) ? report.areas : null;
+  if (areas && areas.length) {
+    for (const a of areas) {
+      const name = a && (a.name || a.area || a.tag);
+      const note = a && (a.note || a.comment);
+      if (name) lines.push(`- ${name}${note ? `: ${note}` : ''}`);
+    }
+  }
+  return lines.join('\n  ');
+}
+
+// The statement is Markdown; the terminal shows it without the emphasis markers.
+function renderCase(dimensionCase, cd) {
+  const brief = dimensionCase.brief.replace(/(\*\*|__)(.+?)\1/g, '$2');
+  const expectations = cd.caseExpectations[dimensionCase.testType];
+  const lines = brief.split('\n');
+  if (expectations) lines.push('', cd.caseExpectationsTitle, ...Object.values(expectations).map((e) => `- ${e}`));
+  lines.push('', cd.caseBeforeStart);
+  return lines.join('\n  ');
 }
 
 async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog, opts = {}, deps = makeCertifyDimensionDeps() }) {
@@ -116,11 +157,52 @@ async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog
     }
   }
 
-  const webLink = buildWebLink(deps.getTalentProfileUrl(), chosen);
-  io.notify(cd.webHandoff);
-  if (webLink) io.success(cd.webHandoffLink(webLink));
-  else io.notify(cd.webHandoffNoLink);
-  return { ok: true, handoff: true, dimensionKey: chosen.dimensionKey, webLink };
+  const createEndpoint = deps.getCertificationInterviewsEndpoint();
+  const created = await io.withProgress(cd.creating, () =>
+    deps.requestCreateCertificationInterview(
+      { dimensionKey: chosen.dimensionKey, languageCode: lang, accessToken },
+      { endpoint: createEndpoint },
+    ));
+  if (!created.ok) {
+    io.error(created.reason === 'dimension-on-cooldown'
+      ? cd.onCooldown(formatDay(created.availableOn, lang))
+      : cd.createFailed(created.reason));
+    return { ok: false, reason: created.reason, step: 'create' };
+  }
+
+  // A failed read leaves the run as it was before the case existed, like the web preview does.
+  const caseRead = await deps.requestDimensionCase(
+    { dimensionKey: chosen.dimensionKey, accessToken },
+    { base: deps.getInterviewsBase() },
+  );
+  if (caseRead.ok && caseRead.case) {
+    io.section(cd.caseTitle);
+    io.notify(renderCase(caseRead.case, cd));
+    if (stdinIsTTY) await ask(`  ${cd.caseReadyPrompt}`);
+  }
+
+  const interview = await deps.conductLivekitInterview(io, deps.onboardingDeps, {
+    interviewId: created.interviewId,
+    language: lang,
+    plain: true,
+  });
+  if (!interview.ok) {
+    io.warn(interview.reason === 'needs-web' ? cd.needsWeb : cd.interviewUnavailable(interview.reason));
+    return { ok: false, reason: interview.reason, step: 'interview' };
+  }
+
+  const reportBase = deps.getInterviewsBase();
+  const polled = await io.withProgress(cd.reportPolling, () =>
+    pollReport(deps, { interviewId: created.interviewId, accessToken }, { base: reportBase }));
+  if (!polled.ok) {
+    io.warn(polled.reason === 'timeout' ? cd.reportTimeout : cd.reportFailed(polled.reason));
+    return { ok: true, completed: 'interview', verdict: null };
+  }
+
+  io.section(cd.verdictTitle);
+  io.notify(renderVerdict(polled.report, cd));
+  io.success(cd.done);
+  return { ok: true, completed: 'interview', verdict: polled.report };
 }
 
 module.exports = {
@@ -128,5 +210,7 @@ module.exports = {
   runCertifyDimension,
   chooseDimension,
   resolveDimensionArg,
-  buildWebLink,
+  pollReport,
+  renderVerdict,
+  renderCase,
 };

package/src/command-audit.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const { scrubSecrets } = require('./agent-synthesis');
+const { loadAuthSession } = require('./auth-session-store');
+const { getCertsBase } = require('./config');
+const { postJsonWithTimeout } = require('./backend-request');
+
+// Fire-and-forget: short timeout, every error swallowed, so a logging failure never blocks or fails a command.
+const AUDIT_TIMEOUT_MS = 1500;
+
+// Capped at 200 chars AFTER scrubbing (mirrors MAX_COMMAND_LEN in session-scan.js) so a secret straddling the cut cannot leak.
+const MAX_ARGS_LEN = 200;
+
+function cliVersion() {
+  try {
+    return require(path.join(__dirname, '..', 'package.json')).version || null;
+  } catch {
+    return null;
+  }
+}
+
+// Scrub THEN cap: scrubSecrets can GROW text, so the cap is measured on the scrubbed string that goes on the wire.
+function redactArgs(argv) {
+  if (!Array.isArray(argv) || argv.length === 0) return null;
+  const scrubbed = scrubSecrets(argv.join(' ')).trim().slice(0, MAX_ARGS_LEN);
+  return scrubbed || null;
+}
+
+// Anonymous runs carry only a best-effort machine hint; authenticated runs identify via the Bearer instead.
+function machineHint() {
+  let osUser = null;
+  try {
+    const info = os.userInfo();
+    osUser = info && typeof info.username === 'string' ? info.username : null;
+  } catch {
+    osUser = null;
+  }
+  let hostname = null;
+  try {
+    hostname = os.hostname() || null;
+  } catch {
+    hostname = null;
+  }
+  return { osUser, hostname };
+}
+
+// Builds the record + headers; returns null when there is no endpoint to post to.
+function buildAudit(command, argv, env) {
+  let base;
+  try {
+    base = getCertsBase(env);
+  } catch {
+    base = null;
+  }
+  if (!base) return null;
+
+  const session = loadAuthSession(env);
+  const token =
+    session && (session.accessToken || session.hubAccessToken)
+      ? session.accessToken || session.hubAccessToken
+      : null;
+
+  const body = {
+    command: String(command || 'unknown').slice(0, 100),
+    args: redactArgs(argv),
+    cliVersion: cliVersion(),
+    clientTimestamp: new Date().toISOString(),
+  };
+
+  // Machine hint only when anonymous; identity comes from the token otherwise.
+  if (!token) {
+    const { osUser, hostname } = machineHint();
+    body.osUser = osUser;
+    body.hostname = hostname;
+  }
+
+  const headers = token ? { Authorization: `Bearer ${token}` } : null;
+  const endpoint = `${base.replace(/\/+$/, '')}/cli/command-log`;
+  return { endpoint, body, headers };
+}
+
+// Emits ONE fire-and-forget audit record; never throws or rejects. Returns the `.catch`-guarded promise so tests can await it (production does not).
+function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
+  try {
+    const audit = buildAudit(command, argv, env);
+    if (!audit) return Promise.resolve();
+    return postJsonWithTimeout(
+      audit.endpoint,
+      audit.body,
+      AUDIT_TIMEOUT_MS,
+      'POST',
+      null,
+      audit.headers,
+    ).then(
+      () => {},
+      () => {},
+    );
+  } catch {
+    return Promise.resolve();
+  }
+}
+
+module.exports = { emitCommandAudit, redactArgs, buildAudit };

package/src/config.js

@@ -318,6 +318,14 @@ function getTemplatesByDimensionEndpoint(env = process.env) {
   return base ? `${base}/templates/by-dimension` : null;
 }
 
+// The Talent's assessments with their retry availability (certs, talent Bearer).
+function getMyAssessmentsEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'MY_ASSESSMENTS_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = getCertsBase(env);
+  return base ? `${base}/users/me/assessments` : null;
+}
+
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
@@ -749,6 +757,7 @@ module.exports = {
   getSetMainRoleEndpoint,
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
+  getMyAssessmentsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).