shakers-cli-beta 0.10.4 → 0.12.0

package/src/i18n.js

@@ -487,6 +487,39 @@ const catalogs = {
         yes: 'Sí, iniciar sesión',
         no: 'No, continuar sin cuenta',
       },
+      // `update` command: actualiza el CLI a la última versión publicada (solo CLI, no MCP).
+      update: {
+        help:
+          'update — actualiza el CLI de Shakers a la última versión publicada.\n\n'
+          + '  Uso: shakers update [--check]\n\n'
+          + '    (sin flag)   Comprueba la última versión y, si hay una más nueva, la instala\n'
+          + '                 por el mismo método con el que se instaló este CLI.\n'
+          + '    --check      Solo informa de tu versión frente a la última publicada; no instala.\n'
+          + '    --json       Salida JSON (paquete, versión actual/última, si hay actualización).\n',
+        checking: 'Comprobando actualizaciones…',
+        current: (v) => `Versión instalada: ${v}`,
+        upToDate: (v) => `Ya tienes la última versión (${v}).`,
+        available: (from, to) => `Hay una actualización disponible: ${from} → ${to}`,
+        checkHint: 'Ejecuta `shakers update` (sin --check) para instalarla.',
+        detected: (label) => `Instalación detectada: ${label}`,
+        updating: (name, from, to) => `Actualizando ${name}: ${from} → ${to}…`,
+        success: (v) => `Actualizado a la versión ${v}.`,
+        reRun: 'Vuelve a ejecutar tu comando para usar la nueva versión.',
+        latestUnknown: (reason) =>
+          `No se pudo determinar la última versión (${reason}). Revisa tu conexión y el acceso al registro.`,
+        failInstall: (reason) => `La actualización falló (${reason}).`,
+        failHint: (cmd) =>
+          `Revisa tu conexión y permisos y vuelve a intentarlo, o actualiza a mano:\n    ${cmd}`,
+        sourceCheckout:
+          'Este CLI se ejecuta desde un checkout de código — actualízalo con `git pull` en ese repositorio.',
+        unknownInstall: (cmd) =>
+          `No se pudo detectar cómo se instaló este CLI. Actualiza a mano:\n    ${cmd}`,
+      },
+      // Aviso pasivo "hay una versión nueva" al arrancar cualquier comando (lectura de caché, sin red en el camino caliente).
+      updateNotifier: {
+        available: (from, to) => `Hay una versión nueva del CLI de Shakers: ${from} → ${to}`,
+        howTo: 'Ejecuta `shakers update` para actualizar.',
+      },
       // `report` command (ADR-016): genera y ABRE el informe HTML completo y compartible de este proyecto (uso de IA + Skills certificadas).
       report: {
         help: 'report — genera y abre el informe HTML completo de este proyecto (uso de IA + Skills certificadas) para compartir con tu equipo.\n'
@@ -726,39 +759,9 @@ const catalogs = {
       dimensionInvalid: 'Esa dimensión no está entre las certificables ahora mismo.',
       dimensionOnCooldown: (slug, day) => `Aún no puedes repetir ${slug}: estará disponible el ${day}.`,
       dimensionUsing: (slug) => `Dimensión elegida: ${slug}`,
-      creating: 'Creando la entrevista…',
-      createFailed: (reason) => `No se pudo crear la entrevista (${reason}).`,
-      onCooldown: (day) => (day
-        ? `Ya hiciste esta dimensión hace poco. Podrás repetirla a partir del ${day}.`
-        : 'Ya hiciste esta dimensión hace poco y todavía no se puede repetir.'),
-      needsWeb: 'Esta dimensión lleva un ejercicio que por ahora solo se hace en la web, no por terminal.',
-      interviewUnavailable: (reason) => `La entrevista no pudo completarse (${reason}).`,
-      reportPolling: 'Calculando tu veredicto…',
-      reportTimeout: 'El veredicto todavía se está calculando. Consúltalo en tu perfil en unos minutos.',
-      reportFailed: (reason) => `No se pudo obtener el veredicto (${reason}). Consúltalo en tu perfil.`,
-      verdictTitle: 'Veredicto',
-      verdictDimension: (dim) => `Dimensión: ${dim}`,
-      verdictBand: (band) => `Nivel: ${band}`,
-      verdictCertified: 'Resultado: certificada',
-      verdictNotCertified: 'Resultado: no certificada esta vez',
-      done: 'Certificación completada.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'El caso',
-      caseExpectationsTitle: 'Qué se espera',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'Se evalúa tu razonamiento y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir datos que no están en el caso: di para qué los quieres.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'Se evalúa cómo razonas en la conversación y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir a la otra parte datos que no están en el caso.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-      },
-      caseBeforeStart: 'Alma te va a hacer preguntas sobre este caso. Si te falta algún dato, pídeselo durante la entrevista.',
-      caseReadyPrompt: 'Pulsa Enter cuando lo hayas leído para empezar la entrevista.',
+      webHandoff: 'Esta certificación se hace en la web. Abre este enlace para empezar la entrevista:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'No se pudo generar el enlace. Entra en tu perfil de Shakers y abre la sección de certificaciones.',
     },
     findProjects: {
       help:
@@ -982,6 +985,7 @@ const catalogs = {
       noTerminal: 'No hay una terminal donde preguntarte, así que no he tocado nada. Vuelve a ejecutar el instalador en tu terminal para conectarlo.',
       restart: 'Reinicia las apps que estén abiertas para que carguen Shakers.',
       noneFound: 'No he encontrado ninguna app de IA compatible en esta máquina.',
+      failedAll: 'No he podido conectar Shakers a tus apps de IA. Vuelve a ejecutar el instalador para reintentarlo.',
     },
     rate: {
       help: 'rate — ver o fijar tu tarifa por proyecto.\n\nUso:\n  rate [--lang es|en] [--json]      ver tu tarifa\n  rate --set [--lang es|en]         fijarla (interactivo, con confirmación)\n\nRequiere una sesión activa (shakers login).',
@@ -1210,7 +1214,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Inicia sesión con tu email y contraseña de Shakers.',
-      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión con tu email y contraseña.',
+      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión.',
       alreadyLoggedIn: 'Ya has iniciado sesión. Usa `logout` si quieres cambiar de cuenta.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Contraseña:',
@@ -1240,16 +1244,19 @@ const catalogs = {
       googleErrorState: 'La respuesta del navegador no coincidió con lo esperado (posible interferencia). Por seguridad no se inició sesión; inténtalo de nuevo.',
       googleErrorDenied: 'Cancelaste el acceso en Google (o no se concedió). No se inició sesión.',
       googleErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
-      // Google por device flow (RFC 8628): la config de Google la tiene el Hub; abres una URL y escribes un código.
+      // Device flow (RFC 8628) para TODO método (Google, LinkedIn, email): el Hub tiene la config; abres una URL y, si hace falta, escribes un código.
       deviceIntro: (name) => `Inicia sesión con ${name}. Abre el enlace de abajo e introduce el código para autorizar; luego vuelve aquí.`,
+      // Email por device flow: se abre la web de Shakers; reutiliza tu sesión abierta o entra con tu email ahí. Nunca pide contraseña en la terminal.
+      emailDeviceIntro: 'Inicia sesión con tu email. Abrimos la web de Shakers: entra con tu email o aprueba si ya tienes la sesión abierta. No hace falta contraseña aquí.',
       deviceVisit: 'Abre esta página en tu navegador:',
       deviceCodeLabel: (code) => `e introduce este código: ${code}`,
       deviceWaiting: 'Esperando a que autorices en el navegador…',
-      deviceErrorExpired: 'La solicitud de acceso con Google caducó antes de autorizarse. Vuelve a ejecutar `login --google` cuando estés listo.',
-      deviceErrorDenied: 'Se canceló el acceso con Google (o no se concedió). No se inició sesión.',
-      deviceErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
+      deviceApproveHint: 'Abrimos tu navegador: apruébalo ahí para terminar (o entra con tu email si aún no has iniciado sesión). No hace falta contraseña.',
+      deviceErrorExpired: 'La solicitud de acceso caducó antes de autorizarse. Vuelve a ejecutar `login` cuando estés listo.',
+      deviceErrorDenied: 'Se canceló el acceso (o no se concedió). No se inició sesión.',
+      deviceErrorGeneric: 'No se pudo iniciar sesión. Inténtalo de nuevo.',
       chooseMethodHeading: '¿Cómo quieres iniciar sesión?',
-      methodEmail: 'Email y contraseña',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Flechas ↑/↓ para moverte · enter para elegir · esc para cancelar',
@@ -2122,6 +2129,39 @@ const catalogs = {
         yes: 'Yes, sign in',
         no: 'No, continue without an account',
       },
+      // `update` command: updates the CLI to the latest published version (CLI-only, not MCP).
+      update: {
+        help:
+          'update — update the Shakers CLI to the latest published version.\n\n'
+          + '  Usage: shakers update [--check]\n\n'
+          + '    (no flag)    Check the latest version and, if a newer one exists, install it\n'
+          + '                 the same way this CLI was installed.\n'
+          + '    --check      Only report your version vs the latest published; do not install.\n'
+          + '    --json       JSON output (package, current/latest version, whether an update exists).\n',
+        checking: 'Checking for updates…',
+        current: (v) => `Installed version: ${v}`,
+        upToDate: (v) => `You are on the latest version (${v}).`,
+        available: (from, to) => `An update is available: ${from} → ${to}`,
+        checkHint: 'Run `shakers update` (without --check) to install it.',
+        detected: (label) => `Detected install: ${label}`,
+        updating: (name, from, to) => `Updating ${name}: ${from} → ${to}…`,
+        success: (v) => `Updated to version ${v}.`,
+        reRun: 'Re-run your command to use the new version.',
+        latestUnknown: (reason) =>
+          `Could not determine the latest version (${reason}). Check your network and registry access.`,
+        failInstall: (reason) => `The update failed (${reason}).`,
+        failHint: (cmd) =>
+          `Check your network and permissions and try again, or update manually:\n    ${cmd}`,
+        sourceCheckout:
+          'This CLI is running from a source checkout — update it with `git pull` in that repository.',
+        unknownInstall: (cmd) =>
+          `Could not detect how this CLI was installed. Update manually:\n    ${cmd}`,
+      },
+      // Passive "a newer version exists" notice printed when any command starts (cache read, no network on the hot path).
+      updateNotifier: {
+        available: (from, to) => `A newer Shakers CLI is available: ${from} → ${to}`,
+        howTo: 'Run `shakers update` to upgrade.',
+      },
       // `report` command (ADR-016): builds and OPENS the full, shareable HTML report for this project (AI usage + certified Skills).
       report: {
         help: 'report — build and open the full HTML report for this project (AI usage + certified Skills) to share with your team.\n'
@@ -2354,39 +2394,9 @@ const catalogs = {
       dimensionInvalid: 'That dimension is not among the certifiable ones right now.',
       dimensionOnCooldown: (slug, day) => `You can't retake ${slug} yet: it will be available on ${day}.`,
       dimensionUsing: (slug) => `Chosen dimension: ${slug}`,
-      creating: 'Creating the interview…',
-      createFailed: (reason) => `Could not create the interview (${reason}).`,
-      onCooldown: (day) => (day
-        ? `You took this dimension recently. You can retake it from ${day}.`
-        : 'You took this dimension recently and cannot retake it yet.'),
-      needsWeb: 'This dimension has an exercise that for now is only taken on the web, not in the terminal.',
-      interviewUnavailable: (reason) => `The interview could not be completed (${reason}).`,
-      reportPolling: 'Computing your verdict…',
-      reportTimeout: 'The verdict is still being computed. Check your profile in a few minutes.',
-      reportFailed: (reason) => `Could not fetch the verdict (${reason}). Check your profile.`,
-      verdictTitle: 'Verdict',
-      verdictDimension: (dim) => `Dimension: ${dim}`,
-      verdictBand: (band) => `Level: ${band}`,
-      verdictCertified: 'Result: certified',
-      verdictNotCertified: 'Result: not certified this time',
-      done: 'Certification complete.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'The case',
-      caseExpectationsTitle: 'What is expected',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'We assess your reasoning and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask for data that is not in the case: say what you want it for.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'We assess how you reason in the conversation and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask the other side for data that is not in the case.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-      },
-      caseBeforeStart: 'Alma is going to ask you questions about this case. If you are missing any data, ask her for it during the interview.',
-      caseReadyPrompt: 'Press Enter once you have read it to start the interview.',
+      webHandoff: 'This certification is done on the web. Open this link to start the interview:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'Could not build the link. Go to your Shakers profile and open the certifications section.',
     },
     findProjects: {
       help:
@@ -2610,6 +2620,7 @@ const catalogs = {
       noTerminal: 'There is no terminal to ask you on, so nothing was touched. Run the installer again in your terminal to connect it.',
       restart: 'Restart any of these apps that is open so it loads Shakers.',
       noneFound: 'Found no supported AI app on this machine.',
+      failedAll: 'Could not connect Shakers to your AI apps. Re-run this installer to retry.',
     },
     rate: {
       help: 'rate — view or set your per-project rate.\n\nUsage:\n  rate [--lang es|en] [--json]      view your rate\n  rate --set [--lang es|en]         set it (interactive, with confirmation)\n\nRequires an active session (shakers login).',
@@ -2834,7 +2845,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Log in with your Shakers email and password.',
-      sessionExpiredIntro: 'Your previous session expired. Log in again with your email and password.',
+      sessionExpiredIntro: 'Your previous session expired. Log in again.',
       alreadyLoggedIn: 'You are already logged in. Use `logout` if you want to switch accounts.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Password:',
@@ -2864,17 +2875,20 @@ const catalogs = {
       googleErrorState: 'The browser response did not match what was expected (possible interference). For safety no session was started; try again.',
       googleErrorDenied: 'You cancelled access in Google (or it was not granted). No session was started.',
       googleErrorGeneric: 'Could not log in with Google. Try again.',
-      // Google via device flow (RFC 8628): the Hub owns Google config; you open a URL and type a code.
+      // Device flow (RFC 8628) for EVERY method (Google, LinkedIn, email): the Hub owns the config; you open a URL and, if needed, type a code.
       deviceIntro: (name) => `Sign in with ${name}. Open the link below and enter the code to authorize; then come back here.`,
+      // Email via device flow: the Shakers web opens; reuse your open session or sign in with your email there. It never asks for a password in the terminal.
+      emailDeviceIntro: 'Sign in with your email. We open the Shakers web: sign in with your email, or approve if you are already signed in. No password is needed here.',
       deviceVisit: 'Open this page in your browser:',
       deviceCodeLabel: (code) => `and enter this code: ${code}`,
       deviceWaiting: 'Waiting for you to authorize in the browser…',
-      deviceErrorExpired: 'The Google sign-in request expired before it was authorized. Run `login --google` again when you are ready.',
-      deviceErrorDenied: 'The Google sign-in was cancelled or not granted. No session was started.',
-      deviceErrorGeneric: 'Could not sign in with Google. Try again.',
+      deviceApproveHint: 'We opened your browser: approve there to finish (or sign in with your email if you are not signed in yet). No password needed.',
+      deviceErrorExpired: 'The sign-in request expired before it was authorized. Run `login` again when you are ready.',
+      deviceErrorDenied: 'The sign-in was cancelled or not granted. No session was started.',
+      deviceErrorGeneric: 'Could not sign in. Try again.',
       // Interactive method picker (`login` with no --email/--google/--provider): reuses the SAME single-select picker `certify agents` uses to choose an agent (src/interactive-select.js).
       chooseMethodHeading: 'How do you want to log in?',
-      methodEmail: 'Email and password',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Arrows ↑/↓ to move · enter to pick · esc to cancel',

package/src/lang-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Languages client. VIEW = GET `works/talents/me/work-details/languages`; the
+// Languages client. The
 // catalog (id<->name) = GET `static-data/languages` (@Public); SET = PATCH the
 // same work-details endpoint (REPLACE-ALL: send the full list of {id, level}).
 

package/src/mcp-device-login-tools.js

@@ -5,7 +5,7 @@
 const START_SCHEMA = {
   type: 'object',
   properties: {
-    provider: { type: 'string', enum: ['google', 'linkedin'], description: "Optional social provider. Defaults to 'google'. Same device flow either way; it selects which social button the sign-in page opens." },
+    provider: { type: 'string', enum: ['google', 'linkedin', 'email'], description: "Optional provider. Defaults to 'google'. Same device flow either way; it selects which option the Shakers sign-in page opens — 'email' opens the email sign-in (the talent reuses their open web session or signs in there, never a password in the chat)." },
     mode: { type: 'string', enum: ['login', 'register'], description: "Optional. 'login' signs an existing talent in; 'register' creates the account if new (the profile steps come from the register/onboarding tools afterwards). Defaults to 'login'." },
     freelanceType: { type: 'string', description: 'Optional, register only: FREELANCE | EMPLOYEE | AGENCY | POTENTIAL_FREELANCE. Used to complete a new account.' },
     preferredLanguage: { type: 'string', description: 'Optional, register only: es | en | it | pt | fr.' },
@@ -33,7 +33,7 @@ function makeDeviceLoginTools(deps = {}) {
 
   async function start(args = {}) {
     const mode = args.mode === 'register' ? 'register' : 'login';
-    const provider = args.provider === 'linkedin' ? 'linkedin' : 'google';
+    const provider = args.provider === 'linkedin' ? 'linkedin' : args.provider === 'email' ? 'email' : 'google';
     const authorizeEndpoint = getDeviceAuthorizeEndpoint();
     const tokenEndpoint = getDeviceTokenEndpoint();
     const authTokenEndpoint = getAuthTokenEndpoint();
@@ -157,7 +157,7 @@ function makeDeviceLoginTools(deps = {}) {
   return [
     {
       name: 'social_signin_start',
-      description: "Begin social sign-in (or registration) via the device flow — provider 'google' (default) or 'linkedin'. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
+      description: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
       inputSchema: START_SCHEMA,
       handler: start,
     },

package/src/mcp-install.js

@@ -266,7 +266,8 @@ async function runMcpInstall({ out = (s) => process.stdout.write(s), lang = null
     out(`  ${c.clients[r.client]}: ${c.status[r.status]}\n`);
     if (r.removedLegacy) out(`    ${c.removedLegacy}\n`);
   }
-  out(`\n  ${c.restart}\n\n`);
+  const touched = results.some((r) => r.status === 'configured' || r.status === 'unchanged');
+  out(`\n  ${touched ? c.restart : c.failedAll}\n\n`);
   if (results.some((r) => r.status === 'failed' || r.status === 'invalid-json')) process.exitCode = 1;
   return { ok: true, results };
 }

package/src/mcp-instructions.js

@@ -11,10 +11,10 @@ function buildServerInstructions({ elicitation = false } = {}) {
       ? 'Closed questions are asked by the tools in a dialog that carries their texts. Only if a tool returns `say` (the talent closed the dialog), print it and pass the option they pick back as `answer` (the number or the text).'
       : 'Closed questions come as `say` with their numbered options: print it, then pass the option they pick back as `answer` (the number or the text).',
     'Sign-up flow:',
-    '1. signup_start (welcome and one question: may I look for your CV here?). If yes, find and read their CV (suggest_register_context, read_cv) without asking again; otherwise wait for the CV in the chat.',
+    '1. signup_start (welcome and one question: may I look for your CV here?); a CV path in their first message goes as cvPath and skips the question. If yes, find and read their CV (suggest_register_context, read_cv) without asking again; otherwise wait for the CV in the chat.',
     '2. LinkedIn: take it from the CV. If it has none, ask the linkedinAsk text. Only if they say they do not know where to find it, say the linkedinOpening text and call open_linkedin_profile.',
     '3. signup_email with the best email you know (CV first), or none.',
-    '4. signup_draft with your draft of their profile (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate). It shows the draft, the data notice and how the account window works, and asks them to confirm; if they want changes, ask what and call it again.',
+    '4. signup_draft with your draft of their profile (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate; sources: cv and/or linkedin, only those you have). It shows the draft, the data notice and how the account window works, and asks them to confirm; if they want changes, ask what and call it again.',
     '5. Once confirmed, signup_create_account with LinkedIn, cvPath, names and userQuery = everything you know about them; the window opens by itself, so say nothing about it. Then signup_status (waitSeconds 20) until the account exists, and follow its message (a failed LinkedIn import: its fixed line comes with the next question; retry once, then ask for their website or GitHub).',
     '6. New account: save_profile_details with the confirmed draft, without asking. Existing account (the talent signed in instead): update_existing_profile, which shows what would fill their empty fields and asks; nothing they already set is overwritten.',
     '7. AI usage, a step of its own: ai_usage without consent asks the question with the two disclaimers; nothing is scanned before their yes. On yes it runs in the background: never wait for it. If they skip it, its fixed line comes with the next question.',

package/src/mcp-onboarding-tools.js

@@ -5,7 +5,7 @@ const path = require('path');
 const LOGIN_SCHEMA = {
   type: 'object',
   properties: {
-    method: { type: 'string', enum: ['email', 'google', 'linkedin'], description: "Optional auth method. 'email' opens an email-and-password window in the talent's browser (they type the password there, never in the chat). 'google'/'linkedin' do not sign in here — they point you to social_signin_start/social_signin_poll (the device flow) with that provider. Omit it to open that window." },
+    method: { type: 'string', enum: ['email', 'google', 'linkedin'], description: "Optional auth method. None of them sign in here: this tool points you to social_signin_start/social_signin_poll (the device flow) with that provider. 'email' reuses the talent's open Shakers web session or signs them in on the page (never a password in the chat); 'google'/'linkedin' open that social sign-in. Omit it to default to email (the page still offers Google and LinkedIn)." },
   },
 };
 
@@ -92,7 +92,6 @@ function makeOnboardingTools(deps = {}) {
     normalizeDomain = require('./start-add-portfolio').normalizeDomain,
     isValidEmail = require('./share').isValidEmail,
     normalizeEmail = require('./share').normalizeEmail,
-    runLoopbackAuth = require('./mcp-auth-form').runLoopbackAuth,
   } = deps;
 
   const requireSession = () => {
@@ -118,8 +117,10 @@ function makeOnboardingTools(deps = {}) {
     return endpoint;
   };
 
-  // Google/LinkedIn run through the device flow (start/poll tools); a blocking form can't surface the code.
-  const socialSigninPointer = (mode, provider = 'google') => ({
+  // Every method runs through the device flow (start/poll tools); a blocking form
+  // can't surface the code, and email now reuses the web session there instead of
+  // prompting for a password. The start/poll pair persists the session.
+  const socialSigninPointer = (mode, provider = 'email') => ({
     ok: false,
     reason: 'use-device-flow',
     next: 'social_signin_start',
@@ -128,18 +129,11 @@ function makeOnboardingTools(deps = {}) {
     message: `For ${provider}, call social_signin_start (provider "${provider}", mode "${mode}") to get a URL and code to show the talent, then social_signin_poll.`,
   });
 
-  // No explicit `method`: the loopback form opens on its email/social choice screen.
-  async function loginViaForm({ method = null } = {}) {
-    const result = await runLoopbackAuth(method ? { mode: 'login', method } : { mode: 'login' });
-    if (result.viaSocial) return socialSigninPointer('login', result.provider || 'google');
-    if (!result.ok) return { ok: false, reason: result.reason || 'login-failed' };
-    return { ok: true, method: 'email', email: result.email || null };
-  }
-
+  // Email, Google and LinkedIn all hand off to social_signin_start/poll. Email
+  // defaults when no method is given; the /cli-login page still offers the others.
   async function login(args = {}) {
-    if (args.method === 'google' || args.method === 'linkedin') return socialSigninPointer('login', args.method);
-    if (args.method === 'email') return loginViaForm({ method: 'email' });
-    return loginViaForm();
+    const provider = args.method === 'google' || args.method === 'linkedin' ? args.method : 'email';
+    return socialSigninPointer('login', provider);
   }
 
   async function logout() {
@@ -340,7 +334,7 @@ function makeOnboardingTools(deps = {}) {
   return [
     {
       name: 'login',
-      description: "Sign the talent in to Shakers with email and password and persist the session so the add_* and certify tools can run. The talent types their password into a window in their own browser, never in the chat. For Google or LinkedIn, use social_signin_start + social_signin_poll instead (this tool with method 'google'/'linkedin' just points you there). Returns { ok, method, email } or a structured error.",
+      description: "Start signing the talent in to Shakers so the add_* and certify tools can run. This tool does not sign in itself: it points you to social_signin_start + social_signin_poll (the device flow), which open the Shakers web page and persist the session. Email (the default) reuses the talent's open web session or signs them in on the page — never a password in the chat; 'google'/'linkedin' open that social sign-in. Returns a { ok: false, reason: 'use-device-flow', next, provider } pointer; call social_signin_start next.",
       inputSchema: LOGIN_SCHEMA,
       handler: login,
     },

package/src/mcp-role-tools.js

@@ -22,7 +22,12 @@ const fold = (text) => String(text || '').normalize('NFD').replace(/[\u0300-\u03
 
 const wordsOf = (text) => fold(text).split(/[^a-z0-9+#.]+/).filter((w) => w.length >= 2);
 
-// Catalogue roles by relevance: the exact name first, then shared role words, then stack words; a word many roles share (engineer) counts less.
+// Words that name no specialty: a role sharing only these with the talent does not match.
+const GENERIC_ROLE_WORDS = new Set(['developer', 'developers', 'dev', 'engineer', 'engineering', 'software', 'programmer', 'specialist', 'expert', 'consultant', 'senior', 'junior', 'lead', 'freelance',
+  'desarrollador', 'desarrolladora', 'programador', 'programadora', 'ingeniero', 'ingeniera', 'especialista', 'experto', 'experta', 'consultor', 'consultora',
+  'sviluppatore', 'sviluppatrice', 'programmatore', 'ingegnere', 'esperto', 'consulente', 'desenvolvedor', 'desenvolvedora', 'engenheiro', 'engenheira']);
+
+// Catalogue roles by relevance: the exact name first, then shared role words, then stack words; a word many roles share (engineer) counts less, and only a specific word qualifies a role.
 function rankRoles(roles, said, skills) {
   const names = roles.map((r) => wordsOf(r.name));
   const df = new Map();
@@ -31,13 +36,16 @@ function rankRoles(roles, said, skills) {
   const asked = new Set(wordsOf(said));
   const stack = new Set(wordsOf(skills));
   const exact = fold(said).trim();
-  const shown = (role, words) => words.map((w) => role.name.split(/[^A-Za-z0-9+#.]+/).find((t) => fold(t) === w) || w);
+  const specific = (words) => words.filter((w) => !GENERIC_ROLE_WORDS.has(w));
+  const shown = (role, words) => specific(words).map((w) => role.name.split(/[^A-Za-z0-9+#.]+/).find((t) => fold(t) === w) || w);
   return roles
     .map((role, i) => {
       const byRole = names[i].filter((w) => asked.has(w));
       const byStack = names[i].filter((w) => stack.has(w) && !asked.has(w));
-      const score = (exact && fold(role.name) === exact ? 100 : 0) + weight(byRole) + weight(byStack) / 2;
-      return { role, score, byRole: shown(role, byRole), byStack: shown(role, byStack) };
+      const isExact = !!exact && fold(role.name) === exact;
+      const score = (isExact ? 100 : 0) + weight(byRole) + weight(byStack) / 2;
+      const matches = isExact || specific([...byRole, ...byStack]).length > 0;
+      return { role, score, matches, byRole: shown(role, byRole), byStack: shown(role, byStack) };
     })
     .sort((a, b) => b.score - a.score);
 }
@@ -269,7 +277,7 @@ function makeRoleTools(deps = {}) {
     const roles = byName(available.roles);
     if (!roles.length) return { reply: { ok: false, reason: 'no-roles' } };
     const ranked = rankRoles(roles, said, args.skills);
-    const shown = roles.length <= MAX_ROLE_OPTIONS ? ranked : ranked.filter((m) => m.score > 0).slice(0, MAX_ROLE_OPTIONS);
+    const shown = roles.length <= MAX_ROLE_OPTIONS ? ranked : ranked.filter((m) => m.matches).slice(0, MAX_ROLE_OPTIONS);
     if (!shown.length) return askOwnRole();
     // This call's own list: another call may replace `offered` while the dialog is open.
     const options = shown.map((m) => m.role);

package/src/mcp-signup-client.js

@@ -65,7 +65,7 @@ async function requestMcpSignup(
   return { ok: true, claimCode: data.claimCode, claimCodeExpiresAt: data.claimCodeExpiresAt || null };
 }
 
-// hub works/me/import-profile/status → { state: running | done | failed, sources: { linkedin?, cv? } }, the shape signup_status reports.
+// { state: running | done | failed, sources: { linkedin?, cv? } }, the shape signup_status reports.
 function importStateOf(data) {
   const status = data.profileImportStatus;
   const reported = Array.isArray(data.sources) ? data.sources : [];