shakers-cli-beta 0.11.0 → 0.12.0

package/src/config.js

@@ -264,7 +264,7 @@ function getAuthTokenEndpoint(env = process.env) {
 function getCompleteRegistrationEndpoint(env = process.env) {
   const explicit = readEnv(env, 'COMPLETE_REGISTRATION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/auth/complete-registration');
+  return deriveFromHub(env, 'works/talent/auth/complete-registration');
 }
 
 // Google via device flow (RFC 8628): the Hub broker owns all Google config; the CLI holds no client_id.
@@ -287,7 +287,7 @@ function getDeviceTokenEndpoint(env = process.env) {
 function getMyCertificationsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CERTIFICATIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me');
+  return deriveFromHub(env, 'works/talent/certifications/me');
 }
 
 // Role/cluster endpoints (hub, talent Bearer). available-roles = the catalog the
@@ -296,19 +296,19 @@ function getMyCertificationsEndpoint(env = process.env) {
 function getAvailableRolesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABLE_ROLES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/available-roles');
+  return deriveFromHub(env, 'works/talent/certifications/me/available-roles');
 }
 
 function getSetMainRoleEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SET_MAIN_ROLE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/main-role');
+  return deriveFromHub(env, 'works/talent/certifications/me/main-role');
 }
 
 function getAssignedClustersEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ASSIGNED_CLUSTERS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/assigned-clusters');
+  return deriveFromHub(env, 'works/talent/me/work-details/assigned-clusters');
 }
 
 function getTemplatesByDimensionEndpoint(env = process.env) {
@@ -326,12 +326,20 @@ function getMyAssessmentsEndpoint(env = process.env) {
   return base ? `${base}/users/me/assessments` : null;
 }
 
+// `certify` creates its dimension interview here (certs, talent Bearer).
+function getCertificationInterviewsEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'CERTIFICATION_INTERVIEWS_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = getCertsBase(env);
+  return base ? `${base}/users/me/certification-interviews` : null;
+}
+
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'FIND_POSITIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/positions/find');
+  return deriveFromHub(env, 'works/talent/positions/find');
 }
 
 // Marketplace read/write (hub, talent Bearer). The id-taking getters return null
@@ -340,20 +348,20 @@ function getPositionDetailEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'POSITION_DETAIL_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/positions/${encodeURIComponent(positionId)}/detail`);
+  return deriveFromHub(env, `works/talent/positions/${encodeURIComponent(positionId)}/detail`);
 }
 
 function getSavePositionEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/saved-positions');
+  return deriveFromHub(env, 'works/talent/saved-positions');
 }
 
 function getUnsavePositionEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'UNSAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/saved-positions/${encodeURIComponent(positionId)}`);
+  return deriveFromHub(env, `works/talent/saved-positions/${encodeURIComponent(positionId)}`);
 }
 
 function getReceivedInvitationsEndpoint(env = process.env) {
@@ -365,7 +373,7 @@ function getReceivedInvitationsEndpoint(env = process.env) {
 function getMyCandidaturesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CANDIDATURES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/candidatures/me');
+  return deriveFromHub(env, 'works/talent/candidatures/me');
 }
 
 function getMeAvailabilityEndpoint(env = process.env) {
@@ -377,13 +385,13 @@ function getMeAvailabilityEndpoint(env = process.env) {
 function getMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile-summary');
 }
 
 function getTalentMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile');
 }
 
 // Alma (the AI assistant) is a SEPARATE service — NOT derived from hubBase.
@@ -444,7 +452,7 @@ function getUsageReportEndpoint(env = process.env) {
 function getAiProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AI_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/ai-profile');
+  return deriveFromHub(env, 'works/talent/me/ai-profile');
 }
 
 // Evidence emission endpoint for the `cli_scan` instrument (talents-ai-score Phase 2).
@@ -476,7 +484,7 @@ function getPortfolioDraftDescriptionEndpoint(env = process.env) {
 function getPortfolioUpdateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PORTFOLIO_UPDATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/portfolios');
+  return deriveFromHub(env, 'works/talent/portfolios');
 }
 
 function getAgentsDeclareEndpoint(env = process.env) {
@@ -502,7 +510,7 @@ function getAgentPortfoliosEndpoint(agentId, env = process.env) {
   // Null on missing/non-scalar id: no bogus URL, and keeps config.test.js's `fn(env)`
   // getter sweep honest when the env object lands in `agentId`.
   if (agentId == null || typeof agentId === 'object') return null;
-  return deriveFromHub(env, `works/me/agents/${encodeURIComponent(agentId)}/portfolios`);
+  return deriveFromHub(env, `works/talent/me/agents/${encodeURIComponent(agentId)}/portfolios`);
 }
 
 // Onboarding endpoints (evaluation-mcp, ADR-011..015/024 — the register flow).
@@ -533,7 +541,7 @@ function getSignUpEndpoint(env = process.env) {
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/import-profile');
+  return deriveFromHub(env, 'works/talent/me/import-profile');
 }
 
 // MCP sign-up (ticket 39540): public UNREGISTERED + claim code, its import status, and the one-time web login.
@@ -542,7 +550,7 @@ function getMcpSignupEndpoint(env = process.env) {
 }
 
 function getMyImportStatusEndpoint(env = process.env) {
-  return deriveFromHub(env, 'works/me/import-profile/status');
+  return deriveFromHub(env, 'works/talent/me/import-profile/status');
 }
 
 function getOneTimeTokenEndpoint(env = process.env) {
@@ -564,25 +572,25 @@ function getOneTimeLoginUrl(token, env = process.env) {
 function getProfessionalDetailsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PROFESSIONAL_DETAILS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/professional-details');
+  return deriveFromHub(env, 'works/talent/me/professional-details');
 }
 
 function getPricingRateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PRICING_RATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/pricing-rate');
+  return deriveFromHub(env, 'works/talent/me/work-details/pricing-rate');
 }
 
 function getSetAvailabilityEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABILITY_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/availability');
+  return deriveFromHub(env, 'works/talent/me/work-details/availability');
 }
 
 function getLanguagesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'LANGUAGES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/languages');
+  return deriveFromHub(env, 'works/talent/me/work-details/languages');
 }
 
 function getLanguagesCatalogEndpoint(env = process.env) {
@@ -616,7 +624,7 @@ function getTranslationsEndpoint(env = process.env) {
 function getTalentMeEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me');
+  return deriveFromHub(env, 'works/users/me');
 }
 
 function getOnboardingInterviewsEndpoint(env = process.env) {
@@ -758,6 +766,7 @@ module.exports = {
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
   getMyAssessmentsEndpoint,
+  getCertificationInterviewsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).

package/src/find-projects-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Find Positions list client (hub `works/positions/find`, talent Bearer). Each
+// Find Positions list client. Each
 // item carries the parent Project's id/name — a "project" here is the Position's
 // parent, not a separate list. Pagination (limit/offset) and filters map to the
 // endpoint's `criteria`; the server orders by match desc and returns the total.

package/src/i18n.js

@@ -759,39 +759,9 @@ const catalogs = {
       dimensionInvalid: 'Esa dimensión no está entre las certificables ahora mismo.',
       dimensionOnCooldown: (slug, day) => `Aún no puedes repetir ${slug}: estará disponible el ${day}.`,
       dimensionUsing: (slug) => `Dimensión elegida: ${slug}`,
-      creating: 'Creando la entrevista…',
-      createFailed: (reason) => `No se pudo crear la entrevista (${reason}).`,
-      onCooldown: (day) => (day
-        ? `Ya hiciste esta dimensión hace poco. Podrás repetirla a partir del ${day}.`
-        : 'Ya hiciste esta dimensión hace poco y todavía no se puede repetir.'),
-      needsWeb: 'Esta dimensión lleva un ejercicio que por ahora solo se hace en la web, no por terminal.',
-      interviewUnavailable: (reason) => `La entrevista no pudo completarse (${reason}).`,
-      reportPolling: 'Calculando tu veredicto…',
-      reportTimeout: 'El veredicto todavía se está calculando. Consúltalo en tu perfil en unos minutos.',
-      reportFailed: (reason) => `No se pudo obtener el veredicto (${reason}). Consúltalo en tu perfil.`,
-      verdictTitle: 'Veredicto',
-      verdictDimension: (dim) => `Dimensión: ${dim}`,
-      verdictBand: (band) => `Nivel: ${band}`,
-      verdictCertified: 'Resultado: certificada',
-      verdictNotCertified: 'Resultado: no certificada esta vez',
-      done: 'Certificación completada.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'El caso',
-      caseExpectationsTitle: 'Qué se espera',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'Se evalúa tu razonamiento y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir datos que no están en el caso: di para qué los quieres.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'Se evalúa cómo razonas en la conversación y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir a la otra parte datos que no están en el caso.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-      },
-      caseBeforeStart: 'Alma te va a hacer preguntas sobre este caso. Si te falta algún dato, pídeselo durante la entrevista.',
-      caseReadyPrompt: 'Pulsa Enter cuando lo hayas leído para empezar la entrevista.',
+      webHandoff: 'Esta certificación se hace en la web. Abre este enlace para empezar la entrevista:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'No se pudo generar el enlace. Entra en tu perfil de Shakers y abre la sección de certificaciones.',
     },
     findProjects: {
       help:
@@ -1244,7 +1214,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Inicia sesión con tu email y contraseña de Shakers.',
-      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión con tu email y contraseña.',
+      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión.',
       alreadyLoggedIn: 'Ya has iniciado sesión. Usa `logout` si quieres cambiar de cuenta.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Contraseña:',
@@ -1274,16 +1244,19 @@ const catalogs = {
       googleErrorState: 'La respuesta del navegador no coincidió con lo esperado (posible interferencia). Por seguridad no se inició sesión; inténtalo de nuevo.',
       googleErrorDenied: 'Cancelaste el acceso en Google (o no se concedió). No se inició sesión.',
       googleErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
-      // Google por device flow (RFC 8628): la config de Google la tiene el Hub; abres una URL y escribes un código.
+      // Device flow (RFC 8628) para TODO método (Google, LinkedIn, email): el Hub tiene la config; abres una URL y, si hace falta, escribes un código.
       deviceIntro: (name) => `Inicia sesión con ${name}. Abre el enlace de abajo e introduce el código para autorizar; luego vuelve aquí.`,
+      // Email por device flow: se abre la web de Shakers; reutiliza tu sesión abierta o entra con tu email ahí. Nunca pide contraseña en la terminal.
+      emailDeviceIntro: 'Inicia sesión con tu email. Abrimos la web de Shakers: entra con tu email o aprueba si ya tienes la sesión abierta. No hace falta contraseña aquí.',
       deviceVisit: 'Abre esta página en tu navegador:',
       deviceCodeLabel: (code) => `e introduce este código: ${code}`,
       deviceWaiting: 'Esperando a que autorices en el navegador…',
-      deviceErrorExpired: 'La solicitud de acceso con Google caducó antes de autorizarse. Vuelve a ejecutar `login --google` cuando estés listo.',
-      deviceErrorDenied: 'Se canceló el acceso con Google (o no se concedió). No se inició sesión.',
-      deviceErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
+      deviceApproveHint: 'Abrimos tu navegador: apruébalo ahí para terminar (o entra con tu email si aún no has iniciado sesión). No hace falta contraseña.',
+      deviceErrorExpired: 'La solicitud de acceso caducó antes de autorizarse. Vuelve a ejecutar `login` cuando estés listo.',
+      deviceErrorDenied: 'Se canceló el acceso (o no se concedió). No se inició sesión.',
+      deviceErrorGeneric: 'No se pudo iniciar sesión. Inténtalo de nuevo.',
       chooseMethodHeading: '¿Cómo quieres iniciar sesión?',
-      methodEmail: 'Email y contraseña',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Flechas ↑/↓ para moverte · enter para elegir · esc para cancelar',
@@ -2421,39 +2394,9 @@ const catalogs = {
       dimensionInvalid: 'That dimension is not among the certifiable ones right now.',
       dimensionOnCooldown: (slug, day) => `You can't retake ${slug} yet: it will be available on ${day}.`,
       dimensionUsing: (slug) => `Chosen dimension: ${slug}`,
-      creating: 'Creating the interview…',
-      createFailed: (reason) => `Could not create the interview (${reason}).`,
-      onCooldown: (day) => (day
-        ? `You took this dimension recently. You can retake it from ${day}.`
-        : 'You took this dimension recently and cannot retake it yet.'),
-      needsWeb: 'This dimension has an exercise that for now is only taken on the web, not in the terminal.',
-      interviewUnavailable: (reason) => `The interview could not be completed (${reason}).`,
-      reportPolling: 'Computing your verdict…',
-      reportTimeout: 'The verdict is still being computed. Check your profile in a few minutes.',
-      reportFailed: (reason) => `Could not fetch the verdict (${reason}). Check your profile.`,
-      verdictTitle: 'Verdict',
-      verdictDimension: (dim) => `Dimension: ${dim}`,
-      verdictBand: (band) => `Level: ${band}`,
-      verdictCertified: 'Result: certified',
-      verdictNotCertified: 'Result: not certified this time',
-      done: 'Certification complete.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'The case',
-      caseExpectationsTitle: 'What is expected',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'We assess your reasoning and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask for data that is not in the case: say what you want it for.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'We assess how you reason in the conversation and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask the other side for data that is not in the case.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-      },
-      caseBeforeStart: 'Alma is going to ask you questions about this case. If you are missing any data, ask her for it during the interview.',
-      caseReadyPrompt: 'Press Enter once you have read it to start the interview.',
+      webHandoff: 'This certification is done on the web. Open this link to start the interview:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'Could not build the link. Go to your Shakers profile and open the certifications section.',
     },
     findProjects: {
       help:
@@ -2902,7 +2845,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Log in with your Shakers email and password.',
-      sessionExpiredIntro: 'Your previous session expired. Log in again with your email and password.',
+      sessionExpiredIntro: 'Your previous session expired. Log in again.',
       alreadyLoggedIn: 'You are already logged in. Use `logout` if you want to switch accounts.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Password:',
@@ -2932,17 +2875,20 @@ const catalogs = {
       googleErrorState: 'The browser response did not match what was expected (possible interference). For safety no session was started; try again.',
       googleErrorDenied: 'You cancelled access in Google (or it was not granted). No session was started.',
       googleErrorGeneric: 'Could not log in with Google. Try again.',
-      // Google via device flow (RFC 8628): the Hub owns Google config; you open a URL and type a code.
+      // Device flow (RFC 8628) for EVERY method (Google, LinkedIn, email): the Hub owns the config; you open a URL and, if needed, type a code.
       deviceIntro: (name) => `Sign in with ${name}. Open the link below and enter the code to authorize; then come back here.`,
+      // Email via device flow: the Shakers web opens; reuse your open session or sign in with your email there. It never asks for a password in the terminal.
+      emailDeviceIntro: 'Sign in with your email. We open the Shakers web: sign in with your email, or approve if you are already signed in. No password is needed here.',
       deviceVisit: 'Open this page in your browser:',
       deviceCodeLabel: (code) => `and enter this code: ${code}`,
       deviceWaiting: 'Waiting for you to authorize in the browser…',
-      deviceErrorExpired: 'The Google sign-in request expired before it was authorized. Run `login --google` again when you are ready.',
-      deviceErrorDenied: 'The Google sign-in was cancelled or not granted. No session was started.',
-      deviceErrorGeneric: 'Could not sign in with Google. Try again.',
+      deviceApproveHint: 'We opened your browser: approve there to finish (or sign in with your email if you are not signed in yet). No password needed.',
+      deviceErrorExpired: 'The sign-in request expired before it was authorized. Run `login` again when you are ready.',
+      deviceErrorDenied: 'The sign-in was cancelled or not granted. No session was started.',
+      deviceErrorGeneric: 'Could not sign in. Try again.',
       // Interactive method picker (`login` with no --email/--google/--provider): reuses the SAME single-select picker `certify agents` uses to choose an agent (src/interactive-select.js).
       chooseMethodHeading: 'How do you want to log in?',
-      methodEmail: 'Email and password',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Arrows ↑/↓ to move · enter to pick · esc to cancel',

package/src/lang-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Languages client. VIEW = GET `works/talents/me/work-details/languages`; the
+// Languages client. The
 // catalog (id<->name) = GET `static-data/languages` (@Public); SET = PATCH the
 // same work-details endpoint (REPLACE-ALL: send the full list of {id, level}).
 

package/src/mcp-device-login-tools.js

@@ -5,7 +5,7 @@
 const START_SCHEMA = {
   type: 'object',
   properties: {
-    provider: { type: 'string', enum: ['google', 'linkedin'], description: "Optional social provider. Defaults to 'google'. Same device flow either way; it selects which social button the sign-in page opens." },
+    provider: { type: 'string', enum: ['google', 'linkedin', 'email'], description: "Optional provider. Defaults to 'google'. Same device flow either way; it selects which option the Shakers sign-in page opens — 'email' opens the email sign-in (the talent reuses their open web session or signs in there, never a password in the chat)." },
     mode: { type: 'string', enum: ['login', 'register'], description: "Optional. 'login' signs an existing talent in; 'register' creates the account if new (the profile steps come from the register/onboarding tools afterwards). Defaults to 'login'." },
     freelanceType: { type: 'string', description: 'Optional, register only: FREELANCE | EMPLOYEE | AGENCY | POTENTIAL_FREELANCE. Used to complete a new account.' },
     preferredLanguage: { type: 'string', description: 'Optional, register only: es | en | it | pt | fr.' },
@@ -33,7 +33,7 @@ function makeDeviceLoginTools(deps = {}) {
 
   async function start(args = {}) {
     const mode = args.mode === 'register' ? 'register' : 'login';
-    const provider = args.provider === 'linkedin' ? 'linkedin' : 'google';
+    const provider = args.provider === 'linkedin' ? 'linkedin' : args.provider === 'email' ? 'email' : 'google';
     const authorizeEndpoint = getDeviceAuthorizeEndpoint();
     const tokenEndpoint = getDeviceTokenEndpoint();
     const authTokenEndpoint = getAuthTokenEndpoint();
@@ -157,7 +157,7 @@ function makeDeviceLoginTools(deps = {}) {
   return [
     {
       name: 'social_signin_start',
-      description: "Begin social sign-in (or registration) via the device flow — provider 'google' (default) or 'linkedin'. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
+      description: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
       inputSchema: START_SCHEMA,
       handler: start,
     },

package/src/mcp-instructions.js

@@ -11,10 +11,10 @@ function buildServerInstructions({ elicitation = false } = {}) {
       ? 'Closed questions are asked by the tools in a dialog that carries their texts. Only if a tool returns `say` (the talent closed the dialog), print it and pass the option they pick back as `answer` (the number or the text).'
       : 'Closed questions come as `say` with their numbered options: print it, then pass the option they pick back as `answer` (the number or the text).',
     'Sign-up flow:',
-    '1. signup_start (welcome and one question: may I look for your CV here?). If yes, find and read their CV (suggest_register_context, read_cv) without asking again; otherwise wait for the CV in the chat.',
+    '1. signup_start (welcome and one question: may I look for your CV here?); a CV path in their first message goes as cvPath and skips the question. If yes, find and read their CV (suggest_register_context, read_cv) without asking again; otherwise wait for the CV in the chat.',
     '2. LinkedIn: take it from the CV. If it has none, ask the linkedinAsk text. Only if they say they do not know where to find it, say the linkedinOpening text and call open_linkedin_profile.',
     '3. signup_email with the best email you know (CV first), or none.',
-    '4. signup_draft with your draft of their profile (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate). It shows the draft, the data notice and how the account window works, and asks them to confirm; if they want changes, ask what and call it again.',
+    '4. signup_draft with your draft of their profile (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate; sources: cv and/or linkedin, only those you have). It shows the draft, the data notice and how the account window works, and asks them to confirm; if they want changes, ask what and call it again.',
     '5. Once confirmed, signup_create_account with LinkedIn, cvPath, names and userQuery = everything you know about them; the window opens by itself, so say nothing about it. Then signup_status (waitSeconds 20) until the account exists, and follow its message (a failed LinkedIn import: its fixed line comes with the next question; retry once, then ask for their website or GitHub).',
     '6. New account: save_profile_details with the confirmed draft, without asking. Existing account (the talent signed in instead): update_existing_profile, which shows what would fill their empty fields and asks; nothing they already set is overwritten.',
     '7. AI usage, a step of its own: ai_usage without consent asks the question with the two disclaimers; nothing is scanned before their yes. On yes it runs in the background: never wait for it. If they skip it, its fixed line comes with the next question.',

package/src/mcp-onboarding-tools.js

@@ -5,7 +5,7 @@ const path = require('path');
 const LOGIN_SCHEMA = {
   type: 'object',
   properties: {
-    method: { type: 'string', enum: ['email', 'google', 'linkedin'], description: "Optional auth method. 'email' opens an email-and-password window in the talent's browser (they type the password there, never in the chat). 'google'/'linkedin' do not sign in here — they point you to social_signin_start/social_signin_poll (the device flow) with that provider. Omit it to open that window." },
+    method: { type: 'string', enum: ['email', 'google', 'linkedin'], description: "Optional auth method. None of them sign in here: this tool points you to social_signin_start/social_signin_poll (the device flow) with that provider. 'email' reuses the talent's open Shakers web session or signs them in on the page (never a password in the chat); 'google'/'linkedin' open that social sign-in. Omit it to default to email (the page still offers Google and LinkedIn)." },
   },
 };
 
@@ -92,7 +92,6 @@ function makeOnboardingTools(deps = {}) {
     normalizeDomain = require('./start-add-portfolio').normalizeDomain,
     isValidEmail = require('./share').isValidEmail,
     normalizeEmail = require('./share').normalizeEmail,
-    runLoopbackAuth = require('./mcp-auth-form').runLoopbackAuth,
   } = deps;
 
   const requireSession = () => {
@@ -118,8 +117,10 @@ function makeOnboardingTools(deps = {}) {
     return endpoint;
   };
 
-  // Google/LinkedIn run through the device flow (start/poll tools); a blocking form can't surface the code.
-  const socialSigninPointer = (mode, provider = 'google') => ({
+  // Every method runs through the device flow (start/poll tools); a blocking form
+  // can't surface the code, and email now reuses the web session there instead of
+  // prompting for a password. The start/poll pair persists the session.
+  const socialSigninPointer = (mode, provider = 'email') => ({
     ok: false,
     reason: 'use-device-flow',
     next: 'social_signin_start',
@@ -128,18 +129,11 @@ function makeOnboardingTools(deps = {}) {
     message: `For ${provider}, call social_signin_start (provider "${provider}", mode "${mode}") to get a URL and code to show the talent, then social_signin_poll.`,
   });
 
-  // No explicit `method`: the loopback form opens on its email/social choice screen.
-  async function loginViaForm({ method = null } = {}) {
-    const result = await runLoopbackAuth(method ? { mode: 'login', method } : { mode: 'login' });
-    if (result.viaSocial) return socialSigninPointer('login', result.provider || 'google');
-    if (!result.ok) return { ok: false, reason: result.reason || 'login-failed' };
-    return { ok: true, method: 'email', email: result.email || null };
-  }
-
+  // Email, Google and LinkedIn all hand off to social_signin_start/poll. Email
+  // defaults when no method is given; the /cli-login page still offers the others.
   async function login(args = {}) {
-    if (args.method === 'google' || args.method === 'linkedin') return socialSigninPointer('login', args.method);
-    if (args.method === 'email') return loginViaForm({ method: 'email' });
-    return loginViaForm();
+    const provider = args.method === 'google' || args.method === 'linkedin' ? args.method : 'email';
+    return socialSigninPointer('login', provider);
   }
 
   async function logout() {
@@ -340,7 +334,7 @@ function makeOnboardingTools(deps = {}) {
   return [
     {
       name: 'login',
-      description: "Sign the talent in to Shakers with email and password and persist the session so the add_* and certify tools can run. The talent types their password into a window in their own browser, never in the chat. For Google or LinkedIn, use social_signin_start + social_signin_poll instead (this tool with method 'google'/'linkedin' just points you there). Returns { ok, method, email } or a structured error.",
+      description: "Start signing the talent in to Shakers so the add_* and certify tools can run. This tool does not sign in itself: it points you to social_signin_start + social_signin_poll (the device flow), which open the Shakers web page and persist the session. Email (the default) reuses the talent's open web session or signs them in on the page — never a password in the chat; 'google'/'linkedin' open that social sign-in. Returns a { ok: false, reason: 'use-device-flow', next, provider } pointer; call social_signin_start next.",
       inputSchema: LOGIN_SCHEMA,
       handler: login,
     },

package/src/mcp-role-tools.js

@@ -22,7 +22,12 @@ const fold = (text) => String(text || '').normalize('NFD').replace(/[\u0300-\u03
 
 const wordsOf = (text) => fold(text).split(/[^a-z0-9+#.]+/).filter((w) => w.length >= 2);
 
-// Catalogue roles by relevance: the exact name first, then shared role words, then stack words; a word many roles share (engineer) counts less.
+// Words that name no specialty: a role sharing only these with the talent does not match.
+const GENERIC_ROLE_WORDS = new Set(['developer', 'developers', 'dev', 'engineer', 'engineering', 'software', 'programmer', 'specialist', 'expert', 'consultant', 'senior', 'junior', 'lead', 'freelance',
+  'desarrollador', 'desarrolladora', 'programador', 'programadora', 'ingeniero', 'ingeniera', 'especialista', 'experto', 'experta', 'consultor', 'consultora',
+  'sviluppatore', 'sviluppatrice', 'programmatore', 'ingegnere', 'esperto', 'consulente', 'desenvolvedor', 'desenvolvedora', 'engenheiro', 'engenheira']);
+
+// Catalogue roles by relevance: the exact name first, then shared role words, then stack words; a word many roles share (engineer) counts less, and only a specific word qualifies a role.
 function rankRoles(roles, said, skills) {
   const names = roles.map((r) => wordsOf(r.name));
   const df = new Map();
@@ -31,13 +36,16 @@ function rankRoles(roles, said, skills) {
   const asked = new Set(wordsOf(said));
   const stack = new Set(wordsOf(skills));
   const exact = fold(said).trim();
-  const shown = (role, words) => words.map((w) => role.name.split(/[^A-Za-z0-9+#.]+/).find((t) => fold(t) === w) || w);
+  const specific = (words) => words.filter((w) => !GENERIC_ROLE_WORDS.has(w));
+  const shown = (role, words) => specific(words).map((w) => role.name.split(/[^A-Za-z0-9+#.]+/).find((t) => fold(t) === w) || w);
   return roles
     .map((role, i) => {
       const byRole = names[i].filter((w) => asked.has(w));
       const byStack = names[i].filter((w) => stack.has(w) && !asked.has(w));
-      const score = (exact && fold(role.name) === exact ? 100 : 0) + weight(byRole) + weight(byStack) / 2;
-      return { role, score, byRole: shown(role, byRole), byStack: shown(role, byStack) };
+      const isExact = !!exact && fold(role.name) === exact;
+      const score = (isExact ? 100 : 0) + weight(byRole) + weight(byStack) / 2;
+      const matches = isExact || specific([...byRole, ...byStack]).length > 0;
+      return { role, score, matches, byRole: shown(role, byRole), byStack: shown(role, byStack) };
     })
     .sort((a, b) => b.score - a.score);
 }
@@ -269,7 +277,7 @@ function makeRoleTools(deps = {}) {
     const roles = byName(available.roles);
     if (!roles.length) return { reply: { ok: false, reason: 'no-roles' } };
     const ranked = rankRoles(roles, said, args.skills);
-    const shown = roles.length <= MAX_ROLE_OPTIONS ? ranked : ranked.filter((m) => m.score > 0).slice(0, MAX_ROLE_OPTIONS);
+    const shown = roles.length <= MAX_ROLE_OPTIONS ? ranked : ranked.filter((m) => m.matches).slice(0, MAX_ROLE_OPTIONS);
     if (!shown.length) return askOwnRole();
     // This call's own list: another call may replace `offered` while the dialog is open.
     const options = shown.map((m) => m.role);

package/src/mcp-signup-client.js

@@ -65,7 +65,7 @@ async function requestMcpSignup(
   return { ok: true, claimCode: data.claimCode, claimCodeExpiresAt: data.claimCodeExpiresAt || null };
 }
 
-// hub works/me/import-profile/status → { state: running | done | failed, sources: { linkedin?, cv? } }, the shape signup_status reports.
+// { state: running | done | failed, sources: { linkedin?, cv? } }, the shape signup_status reports.
 function importStateOf(data) {
   const status = data.profileImportStatus;
   const reported = Array.isArray(data.sources) ? data.sources : [];