shakers-cli-beta 0.10.4 → 0.12.0

package/bin/certify.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
-// `certify` — dimension certification interview over LiveKit (src/certify-dimension-flow.js).
+// `certify` — discover + pick a dimension, then hand over the web link (src/certify-dimension-flow.js).
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');

package/bin/login.js

@@ -4,8 +4,7 @@
 // `login` / `logout` — a registered Talent identifies themselves to the CLI (talents-ai-score, issue 122 / ADR-044).
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
-const { getLoginEndpoint, getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
-const { requestLogin } = require('../src/auth-client');
+const { getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
 const { runDeviceLogin, appendProviderParam } = require('../src/device-login');
 const { buildRegistrationContext } = require('../src/signup-client');
 const { openPath } = require('../src/open-file');
@@ -15,7 +14,7 @@ const {
   loadAuthSession,
   sessionStatus,
 } = require('../src/auth-session-store');
-const { isValidEmail, normalizeEmail, loadConsentState, clearConsentState } = require('../src/share');
+const { normalizeEmail, loadConsentState, clearConsentState } = require('../src/share');
 const { createStdinAsk } = require('../src/stdin-ask');
 const { chooseAuthMethod } = require('../src/auth-method-picker');
 
@@ -50,23 +49,6 @@ async function chooseLoginMethod({ ask, stdinIsTTY, c, input, output }) {
   return chooseAuthMethod({ flow: 'login', ask, stdinIsTTY, catalog: c, input, output });
 }
 
-// The SECRET prompt (issue 102) — falls back to the ordinary line read on a pipe, which `ask()` still services.
-async function promptSecret(ask, label) {
-  const read = typeof ask.secret === 'function' ? ask.secret.bind(ask) : ask;
-  return String(await read(label)).trim();
-}
-
-async function resolveEmail(opts, c, ask) {
-  if (opts.email) return String(opts.email).trim();
-  for (let attempt = 0; attempt < 5; attempt++) {
-    const raw = String(await ask(c.emailPrompt)).trim();
-    if (raw === '') return null; // EOF / empty line / cancel
-    if (isValidEmail(raw)) return raw;
-    process.stdout.write(`  ${c.emailInvalid}\n`);
-  }
-  return null;
-}
-
 async function run(
   argv = process.argv.slice(2),
   { ask: injectedAsk = null, openBrowser = undefined, stdinIsTTY: ttyOverride = undefined, input = undefined, output = undefined, sleep = undefined } = {},
@@ -75,75 +57,42 @@ async function run(
   const lang = opts.lang || detectReportLang();
   const c = getCatalog(lang).login;
 
-  if (opts.google) return runSocial('google', c, { openBrowser, sleep, lang });
-  if (opts.linkedin) return runSocial('linkedin', c, { openBrowser, sleep, lang });
+  // Every method signs in through the real web device flow (RFC 8628): the
+  // Talent reuses an existing web session or signs in on the `/cli-login` page,
+  // so no password is ever read in the terminal. Email now travels the same
+  // path Google/LinkedIn already use; only the `provider` query differs.
+  let method = null;
+  if (opts.google) method = 'google';
+  else if (opts.linkedin) method = 'linkedin';
+  else if (opts.provider === 'email' || !!opts.email) method = 'email';
 
-  // No method flag: offer the picker (ADR-041/046 — Email, Google and LinkedIn; LinkedIn pending Hub OAuth provisioning).
-  if (!hasMethodFlag(opts)) {
+  if (!method) {
     const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
+    // ADR-044: an ACTIVE session is not silently overwritten, and the picker never shows.
+    if (sessionStatus(loadAuthSession()) === 'active') {
+      (output || process.stdout).write(`\n  ${c.alreadyLoggedIn}\n\n`);
+      return;
+    }
     if (stdinIsTTY) {
-      if (sessionStatus(loadAuthSession()) === 'active') {
-        process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
-        return;
-      }
+      // ADR-041/046 — the picker offers Email, Google and LinkedIn.
       const pickerAsk = injectedAsk || createStdinAsk();
-      let method;
       try {
         method = await chooseLoginMethod({ ask: pickerAsk, stdinIsTTY, c, input, output });
       } finally {
         if (!injectedAsk) pickerAsk.close();
       }
       if (method === null) return; // esc/ctrl-c: cancelled, nothing sent
-      if (method === 'google' || method === 'linkedin') return runSocial(method, c, { openBrowser, sleep, lang });
-      // method === 'email' falls through to the unchanged flow below.
+    } else {
+      method = 'email'; // non-interactive default (matches the picker's own non-TTY default)
     }
   }
 
-  const endpoint = getLoginEndpoint();
-  if (!endpoint) {
-    process.stderr.write(`\n  ${c.errorNoEndpoint}\n\n`);
-    process.exitCode = 1;
-    return;
-  }
-
-  // ADR-044: an ACTIVE session is not silently overwritten — the Talent is told, and pointed at `logout` to switch accounts.
-  const status = sessionStatus(loadAuthSession());
-  if (status === 'active') {
-    process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
-    return;
-  }
-  process.stdout.write(`\n  ${status === 'expired' ? c.sessionExpiredIntro : c.intro}\n`);
-
-  const ask = injectedAsk || createStdinAsk();
-  try {
-    const email = await resolveEmail(opts, c, ask);
-    if (!email || !isValidEmail(email)) {
-      process.stderr.write(`\n  ${c.needInput}\n\n`);
-      process.exitCode = 1;
-      return;
-    }
-    const password = await promptSecret(ask, c.passwordPrompt);
-    if (!password) {
-      process.stderr.write(`\n  ${c.needInput}\n\n`);
-      process.exitCode = 1;
-      return;
-    }
-
-    const normalizedEmail = normalizeEmail(email);
-    // better-auth email login: sign-in captures the session cookie, then a hub
-    // JWT is minted from it (auth-client.js). `endpoint` is the sign-in URL.
-    const result = await requestLogin(
-      { email: normalizedEmail, password },
-      { signInEndpoint: endpoint, tokenEndpoint: getAuthTokenEndpoint() },
-    );
-    handleResult(result, c, normalizedEmail);
-  } finally {
-    if (!injectedAsk) ask.close();
-  }
+  return runDeviceFlow(method, c, { openBrowser, sleep, lang, output });
 }
 
 // Shared success path: persist the session (atomic 0600 store) and report.
-function persistAndReport(result, c, email = null) {
+// `output` lets a caller (and tests) redirect the human-facing lines; errors stay on stderr.
+function persistAndReport(result, c, email = null, output = process.stdout) {
   if (email) {
     const prior = loadConsentState();
     if (prior && prior.email && normalizeEmail(prior.email) !== normalizeEmail(email)) {
@@ -167,37 +116,16 @@ function persistAndReport(result, c, email = null) {
     process.exitCode = 1;
     return false;
   }
-  process.stdout.write(`\n  ${c.success}\n`);
-  if (result.expiresAt) process.stdout.write(`  ${c.expiresAt(result.expiresAt)}\n`);
-  process.stdout.write('\n');
+  output.write(`\n  ${c.success}\n`);
+  if (result.expiresAt) output.write(`  ${c.expiresAt(result.expiresAt)}\n`);
+  output.write('\n');
   return true;
 }
 
-// `typedEmail` is what the CALLER typed/passed as `--email` for THIS attempt.
-function handleResult(result, c, typedEmail = null) {
-  if (result.ok) return void persistAndReport(result, c, result.email || typedEmail);
-
-  // One message per contract reason (ADR-044) — each names the cause (issue 109).
-  const messageFor = {
-    'invalid-credentials': c.errorInvalidCredentials,
-    'no-email-password': c.errorNoEmailPassword,
-    upstream: c.errorUpstream,
-    // Creds were good but the hub JWT could not be minted from the cookie.
-    'token-fetch-failed': c.errorUpstream,
-    timeout: c.errorUnreachable,
-    'network-error': c.errorUnreachable,
-    'invalid-url': c.errorConfig,
-    'no-endpoint': c.errorNoEndpoint,
-    'bad-response': c.errorGeneric,
-    'http-error': c.errorGeneric,
-    'local-error': c.errorGeneric,
-  };
-  process.stderr.write(`\n  ${messageFor[result.reason] || c.errorGeneric}\n\n`);
-  process.exitCode = 1;
-}
-
-// `login --google` / `--linkedin` — one device flow (RFC 8628); only the `provider` query on the URL differs.
-async function runSocial(provider, c, { openBrowser = openPath, sleep = undefined, lang = 'en' } = {}) {
+// `login` for one method — one device flow (RFC 8628); only the `provider` query
+// on the `/cli-login` URL differs (google | linkedin | email). Email reuses an
+// existing web session or signs in on the page, with no password in the terminal.
+async function runDeviceFlow(provider, c, { openBrowser = openPath, sleep = undefined, lang = 'en', output = process.stdout } = {}) {
   const authorizeEndpoint = getDeviceAuthorizeEndpoint();
   const tokenEndpoint = getDeviceTokenEndpoint();
   const authTokenEndpoint = getAuthTokenEndpoint();
@@ -206,18 +134,21 @@ async function runSocial(provider, c, { openBrowser = openPath, sleep = undefine
     process.exitCode = 1;
     return;
   }
-  // A new social account also needs complete-registration before the JWT (freelanceType is a transient default).
+  // A new account also needs complete-registration before the JWT (freelanceType is a transient default).
   const completeRegistrationEndpoint = getCompleteRegistrationEndpoint();
   const registrationContext = buildRegistrationContext({ preferredLanguage: lang, newsletterConsent: false, freelanceType: 'POTENTIAL_FREELANCE' });
-  const providerName = provider === 'linkedin' ? c.methodLinkedin : c.methodGoogle;
+  const providerName = provider === 'linkedin' ? c.methodLinkedin : provider === 'email' ? c.methodEmail : c.methodGoogle;
 
-  // Same as email: an ACTIVE session is not silently overwritten.
+  // An ACTIVE session is not silently overwritten.
   const status = sessionStatus(loadAuthSession());
   if (status === 'active') {
-    process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
+    output.write(`\n  ${c.alreadyLoggedIn}\n\n`);
     return;
   }
-  process.stdout.write(`\n  ${status === 'expired' ? c.sessionExpiredIntro : c.deviceIntro(providerName)}\n`);
+  const intro = status === 'expired'
+    ? c.sessionExpiredIntro
+    : (provider === 'email' ? c.emailDeviceIntro : c.deviceIntro(providerName));
+  output.write(`\n  ${intro}\n`);
 
   const result = await runDeviceLogin(
     { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint, registrationContext },
@@ -225,21 +156,23 @@ async function runSocial(provider, c, { openBrowser = openPath, sleep = undefine
       ...(sleep ? { sleep } : {}),
       onPrompt: ({ verificationUriComplete, userCode }) => {
         const url = appendProviderParam(verificationUriComplete, provider);
-        process.stdout.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        output.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        if (provider === 'email') output.write(`  ${c.deviceApproveHint}\n`);
         try { openBrowser(url); } catch { /* the printed URL covers it */ }
       },
     },
   );
-  handleSocialResult(result, c);
+  handleDeviceResult(result, c, output);
 }
 
-function handleSocialResult(result, c) {
+function handleDeviceResult(result, c, output = process.stdout) {
   if (result.ok) {
     // Map the device-flow JWT to the shared persist shape (no cookie).
     return void persistAndReport(
       { accessToken: result.token, hubAccessToken: result.token, email: result.email || null },
       c,
       result.email || null,
+      output,
     );
   }
 
@@ -264,14 +197,14 @@ function handleSocialResult(result, c) {
 }
 
 // `logout` — local only (no endpoint, no network): forget the stored session.
-async function runLogout(argv = process.argv.slice(2)) {
+async function runLogout(argv = process.argv.slice(2), { output = process.stdout } = {}) {
   const opts = parseArgs(argv);
   const lang = opts.lang || detectReportLang();
   const c = getCatalog(lang).login;
   const had = loadAuthSession() !== null;
   clearAuthSession();
   clearConsentState();
-  process.stdout.write(`\n  ${had ? c.loggedOut : c.notLoggedIn}\n\n`);
+  output.write(`\n  ${had ? c.loggedOut : c.notLoggedIn}\n\n`);
 }
 
 module.exports = { run, runLogout, chooseLoginMethod, parseArgs, hasMethodFlag };

package/bin/shakers.js

@@ -46,7 +46,11 @@ const { run: runRegister } = require('./register');
 const { run: runOnboarding } = require('./onboarding');
 const { run: runConfig } = require('./config');
 const { run: runMcp } = require('./mcp');
+const { run: runUpdate } = require('./update');
 const { checkOnboardingCompleted } = require('../src/onboarding-availability');
+const { emitCommandAudit } = require('../src/command-audit');
+const { readPackageInfo } = require('../src/update-flow');
+const { isSuppressed, maybeNotify, triggerBackgroundCheck } = require('../src/update-notifier');
 
 let VERSION = '';
 try {
@@ -95,13 +99,14 @@ const HANDLERS = {
   register: runRegister,
   onboarding: runOnboarding,
   config: runConfig,
+  update: runUpdate,
   login: runLogin,
   logout: runLogout,
   superadmin: runSuperadmin,
   mcp: runMcp,
 };
 
-const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma']);
+const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma', 'update']);
 
 // Command FAMILIES — a navigation layer over the flat commands (which all stay
 // valid as aliases). `shakers <family> <sub>` resolves to the flat handler; every
@@ -119,7 +124,7 @@ const FAMILIES = {
     invitations: 'invitations', applications: 'applications',
   },
   usage: { run: 'ai-usage', report: 'report', share: 'share' },
-  account: { login: 'login', logout: 'logout', register: 'register', config: 'config' },
+  account: { login: 'login', logout: 'logout', register: 'register', config: 'config', update: 'update' },
   certs: { list: 'certifications', certify: 'certify' },
 };
 
@@ -212,12 +217,13 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `  Sesión:\n`
       + `    login        Inicia sesión en tu cuenta de Shakers\n`
       + `    logout       Cierra la sesión\n`
-      + `    config       Lee/escribe la configuración (bases de hub/certs)\n\n`
+      + `    config       Lee/escribe la configuración (bases de hub/certs)\n`
+      + `    update       Actualiza el CLI a la última versión publicada (--check solo informa)\n\n`
       + `  Familias (agrupan los comandos de arriba; los nombres planos siguen valiendo como alias):\n`
       + `    add <skill|agent|project|role>     ·  role <add|change>\n`
       + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
       + `    projects <find|show|save|unsave|invitations|applications>\n`
-      + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config>\n`
+      + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
       + `    Ejecuta \`shakers <familia>\` (sin subcomando) para ver sus subcomandos.\n\n`
       + `  Ejecuta shakers <comando> --help para las opciones de cada comando.\n\n`;
   }
@@ -255,12 +261,13 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `  Session:\n`
     + `    login        Sign in to your Shakers account\n`
     + `    logout       Sign out\n`
-    + `    config       Read/write configuration (hub/certs bases)\n\n`
+    + `    config       Read/write configuration (hub/certs bases)\n`
+    + `    update       Update the CLI to the latest published version (--check only reports)\n\n`
     + `  Families (group the commands above; the flat names still work as aliases):\n`
     + `    add <skill|agent|project|role>     ·  role <add|change>\n`
     + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
     + `    projects <find|show|save|unsave|invitations|applications>\n`
-    + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config>\n`
+    + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
     + `    Run \`shakers <family>\` (no subcommand) to list its subcommands.\n\n`
     + `  Run \`shakers <command> --help\` for a command's options.\n\n`;
 }
@@ -295,6 +302,18 @@ async function main() {
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 
   const token = argv.find((a) => !a.startsWith('-'));
+
+  // Single dispatch choke-point (ADR-060): audit EXACTLY once before branching, fire-and-forget (never awaited). MCP tool calls run in-process and never reach here.
+  const auditCommand =
+    !token || token.toLowerCase() === 'help' ? 'help' : token.toLowerCase();
+  emitCommandAudit({ command: auditCommand, argv, env: process.env });
+
+  // Non-blocking update notice: reads a cached version synchronously, registry check runs in a detached worker; stderr-only, suppressed for --json/non-TTY/CI/update/opt-out.
+  if (!isSuppressed({ argv, command: auditCommand, env: process.env })) {
+    maybeNotify({ currentVersion: VERSION, lang, env: process.env });
+    triggerBackgroundCheck({ name: readPackageInfo().name, env: process.env });
+  }
+
   if (!token || token.toLowerCase() === 'help') {
     let hideOnboarding = false;
     try {

package/bin/update-check-worker.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+'use strict';
+
+// Detached worker: fetches the latest version from the PUBLIC, unauthenticated npm registry, writes the `{lastCheck, latest}` cache, fails silent.
+
+const https = require('https');
+const { writeCache } = require('../src/update-notifier');
+
+const FETCH_TIMEOUT_MS = 10000;
+const MAX_BODY_BYTES = 3 * 1024 * 1024;
+
+// Scoped names (`@scope/pkg`) address the registry as `@scope%2fpkg`, `@` literal; install-v1 metadata still carries `dist-tags`.
+function registryUrl(name) {
+  const p = name.startsWith('@') ? `@${name.slice(1).replace('/', '%2f')}` : name;
+  return `https://registry.npmjs.org/${p}`;
+}
+
+function fetchLatest(name, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (v) => {
+      if (!settled) {
+        settled = true;
+        resolve(v);
+      }
+    };
+    let req;
+    try {
+      req = https.get(
+        registryUrl(name),
+        { headers: { Accept: 'application/vnd.npm.install-v1+json' } },
+        (res) => {
+          if (res.statusCode !== 200) {
+            res.resume();
+            return done(null);
+          }
+          let body = '';
+          res.setEncoding('utf8');
+          res.on('data', (c) => {
+            body += c;
+            if (body.length > MAX_BODY_BYTES) req.destroy();
+          });
+          res.on('end', () => {
+            try {
+              const json = JSON.parse(body);
+              const latest = json && json['dist-tags'] && json['dist-tags'].latest;
+              done(typeof latest === 'string' && latest ? latest : null);
+            } catch {
+              done(null);
+            }
+          });
+        },
+      );
+    } catch {
+      return done(null);
+    }
+    req.setTimeout(timeoutMs, () => req.destroy());
+    req.on('error', () => done(null));
+  });
+}
+
+async function main() {
+  const name = process.argv[2];
+  if (!name) return;
+  const latest = await fetchLatest(name, FETCH_TIMEOUT_MS);
+  if (!latest) return;
+  writeCache({ lastCheck: Date.now(), latest });
+}
+
+main();

package/bin/update.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+'use strict';
+
+// `update` — update the CLI to the latest published version (CLI-only, never an MCP tool); `--check` reports without installing. Logic in src/update-flow.js.
+
+const { detectReportLang, getCatalog } = require('../src/i18n');
+const updateFlow = require('../src/update-flow');
+
+function parseUpdateArgs(argv = []) {
+  const o = { help: false, check: false, json: false, lang: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h') o.help = true;
+    else if (a === '--check' || a === '--dry-run') o.check = true;
+    else if (a === '--json') o.json = true;
+    else if (a === '--lang') {
+      const v = argv[++i];
+      o.lang = v === 'es' || v === 'en' ? v : null;
+    } else if (a.startsWith('--lang=')) {
+      const v = a.slice(7);
+      o.lang = v === 'es' || v === 'en' ? v : null;
+    }
+  }
+  return o;
+}
+
+async function run(
+  argv = process.argv.slice(2),
+  { out = null, env = process.env, deps = null } = {},
+) {
+  const opts = parseUpdateArgs(argv);
+  const lang = opts.lang || detectReportLang();
+  const t = getCatalog(lang).cli.update;
+  const write = out || ((s) => process.stdout.write(s));
+  const flow = deps || updateFlow;
+
+  if (opts.help) {
+    write(t.help + '\n');
+    return;
+  }
+
+  const info = flow.readPackageInfo();
+  const install = flow.detectInstall(env);
+  const current = info.version;
+
+  if (!opts.json) write(`  ${t.checking}\n`);
+  const latest = flow.fetchLatestVersion(info);
+
+  if (opts.json) {
+    const updateAvailable =
+      latest.ok && current ? flow.compareVersions(current, latest.version) < 0 : null;
+    write(
+      `${JSON.stringify({
+        package: info.name,
+        current: current || null,
+        latest: latest.ok ? latest.version : null,
+        install: install.kind,
+        updateAvailable,
+        reason: latest.ok ? null : latest.reason,
+      })}\n`,
+    );
+    if (!latest.ok) process.exitCode = 1;
+    return;
+  }
+
+  if (current) write(`  ${t.current(current)}\n`);
+
+  if (!latest.ok) {
+    write(`  ${t.latestUnknown(latest.reason)}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (!current || flow.compareVersions(current, latest.version) >= 0) {
+    write(`  ${t.upToDate(latest.version)}\n`);
+    return;
+  }
+
+  write(`  ${t.available(current, latest.version)}\n`);
+
+  // `--check`: report only, never install.
+  if (opts.check) {
+    write(`  ${t.checkHint}\n`);
+    return;
+  }
+
+  const plan = flow.buildUpdatePlan(install, info, env);
+  if (!plan) {
+    if (install.kind === 'source') write(`  ${t.sourceCheckout}\n`);
+    else write(`  ${t.unknownInstall(flow.manualCommand(info))}\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  write(`  ${t.detected(plan.label)}\n`);
+  write(`  ${t.updating(info.name, current, latest.version)}\n\n`);
+
+  const result = flow.runInstall(plan, env);
+  if (result.ok) {
+    write(`\n  ${t.success(latest.version)}\n  ${t.reRun}\n`);
+    return;
+  }
+  write(`\n  ${t.failInstall(result.reason)}\n  ${t.failHint(flow.manualCommand(info))}\n`);
+  process.exitCode = 1;
+}
+
+module.exports = { run, parseUpdateArgs };
+
+if (require.main === module) {
+  run();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.10.4",
+  "version": "0.12.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/agents-client.js

@@ -95,7 +95,7 @@ async function requestDeclareAgent(
   return { ok: true, agentId };
 }
 
-// `PATCH {hub}/works/me/agents/:id/portfolios` — DIRECT to Hub (ADR-041), replace-set.
+// DIRECT to Hub (ADR-041), replace-set.
 async function requestRelateAgentPortfolios(
   { agentId, items, hubAccessToken } = {},
   { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},

package/src/ai-profile-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// GET hub `works/me/ai-profile` — the same read model the "My work with AI" front
+// The same read model the "My work with AI" front
 // paints: { setup, usage, cell, isAiNative, traction, vision, howIWork }.
 
 const { postJsonWithTimeout } = require('./backend-request');

package/src/applications-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// My-applications client (hub `works/candidatures/me`, talent Bearer). Lists the
+// My-applications client. Lists the
 // positions the talent applied to, with the candidature status.
 
 const { postJsonWithTimeout } = require('./backend-request');

package/src/availability-client.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Availability client. VIEW = GET `works/me/availability`; SET = PUT
-// `works/talents/me/work-details/availability` (the same endpoint register uses).
+// (the same endpoint register uses).
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');

package/src/certifications-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// My-certifications client (hub `works/certifications/me`, talent Bearer). The
+// My-certifications client. The
 // "By role" page: main-role cluster + its dimension rows (state/band) + ratios.
 
 const { postJsonWithTimeout } = require('./backend-request');