shakers-cli-beta 0.11.0 → 0.13.0

package/bin/certify.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
-// `certify` — dimension certification interview over LiveKit (src/certify-dimension-flow.js).
+// `certify` — discover + pick a dimension, then hand over the web link (src/certify-dimension-flow.js).
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');

package/bin/login.js

@@ -4,8 +4,7 @@
 // `login` / `logout` — a registered Talent identifies themselves to the CLI (talents-ai-score, issue 122 / ADR-044).
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
-const { getLoginEndpoint, getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
-const { requestLogin } = require('../src/auth-client');
+const { getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
 const { runDeviceLogin, appendProviderParam } = require('../src/device-login');
 const { buildRegistrationContext } = require('../src/signup-client');
 const { openPath } = require('../src/open-file');
@@ -15,7 +14,7 @@ const {
   loadAuthSession,
   sessionStatus,
 } = require('../src/auth-session-store');
-const { isValidEmail, normalizeEmail, loadConsentState, clearConsentState } = require('../src/share');
+const { normalizeEmail, loadConsentState, clearConsentState } = require('../src/share');
 const { createStdinAsk } = require('../src/stdin-ask');
 const { chooseAuthMethod } = require('../src/auth-method-picker');
 
@@ -50,23 +49,6 @@ async function chooseLoginMethod({ ask, stdinIsTTY, c, input, output }) {
   return chooseAuthMethod({ flow: 'login', ask, stdinIsTTY, catalog: c, input, output });
 }
 
-// The SECRET prompt (issue 102) — falls back to the ordinary line read on a pipe, which `ask()` still services.
-async function promptSecret(ask, label) {
-  const read = typeof ask.secret === 'function' ? ask.secret.bind(ask) : ask;
-  return String(await read(label)).trim();
-}
-
-async function resolveEmail(opts, c, ask) {
-  if (opts.email) return String(opts.email).trim();
-  for (let attempt = 0; attempt < 5; attempt++) {
-    const raw = String(await ask(c.emailPrompt)).trim();
-    if (raw === '') return null; // EOF / empty line / cancel
-    if (isValidEmail(raw)) return raw;
-    process.stdout.write(`  ${c.emailInvalid}\n`);
-  }
-  return null;
-}
-
 async function run(
   argv = process.argv.slice(2),
   { ask: injectedAsk = null, openBrowser = undefined, stdinIsTTY: ttyOverride = undefined, input = undefined, output = undefined, sleep = undefined } = {},
@@ -75,75 +57,42 @@ async function run(
   const lang = opts.lang || detectReportLang();
   const c = getCatalog(lang).login;
 
-  if (opts.google) return runSocial('google', c, { openBrowser, sleep, lang });
-  if (opts.linkedin) return runSocial('linkedin', c, { openBrowser, sleep, lang });
+  // Every method signs in through the real web device flow (RFC 8628): the
+  // Talent reuses an existing web session or signs in on the `/cli-login` page,
+  // so no password is ever read in the terminal. Email now travels the same
+  // path Google/LinkedIn already use; only the `provider` query differs.
+  let method = null;
+  if (opts.google) method = 'google';
+  else if (opts.linkedin) method = 'linkedin';
+  else if (opts.provider === 'email' || !!opts.email) method = 'email';
 
-  // No method flag: offer the picker (ADR-041/046 — Email, Google and LinkedIn; LinkedIn pending Hub OAuth provisioning).
-  if (!hasMethodFlag(opts)) {
+  if (!method) {
     const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
+    // ADR-044: an ACTIVE session is not silently overwritten, and the picker never shows.
+    if (sessionStatus(loadAuthSession()) === 'active') {
+      (output || process.stdout).write(`\n  ${c.alreadyLoggedIn}\n\n`);
+      return;
+    }
     if (stdinIsTTY) {
-      if (sessionStatus(loadAuthSession()) === 'active') {
-        process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
-        return;
-      }
+      // ADR-041/046 — the picker offers Email, Google and LinkedIn.
       const pickerAsk = injectedAsk || createStdinAsk();
-      let method;
       try {
         method = await chooseLoginMethod({ ask: pickerAsk, stdinIsTTY, c, input, output });
       } finally {
         if (!injectedAsk) pickerAsk.close();
       }
       if (method === null) return; // esc/ctrl-c: cancelled, nothing sent
-      if (method === 'google' || method === 'linkedin') return runSocial(method, c, { openBrowser, sleep, lang });
-      // method === 'email' falls through to the unchanged flow below.
+    } else {
+      method = 'email'; // non-interactive default (matches the picker's own non-TTY default)
     }
   }
 
-  const endpoint = getLoginEndpoint();
-  if (!endpoint) {
-    process.stderr.write(`\n  ${c.errorNoEndpoint}\n\n`);
-    process.exitCode = 1;
-    return;
-  }
-
-  // ADR-044: an ACTIVE session is not silently overwritten — the Talent is told, and pointed at `logout` to switch accounts.
-  const status = sessionStatus(loadAuthSession());
-  if (status === 'active') {
-    process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
-    return;
-  }
-  process.stdout.write(`\n  ${status === 'expired' ? c.sessionExpiredIntro : c.intro}\n`);
-
-  const ask = injectedAsk || createStdinAsk();
-  try {
-    const email = await resolveEmail(opts, c, ask);
-    if (!email || !isValidEmail(email)) {
-      process.stderr.write(`\n  ${c.needInput}\n\n`);
-      process.exitCode = 1;
-      return;
-    }
-    const password = await promptSecret(ask, c.passwordPrompt);
-    if (!password) {
-      process.stderr.write(`\n  ${c.needInput}\n\n`);
-      process.exitCode = 1;
-      return;
-    }
-
-    const normalizedEmail = normalizeEmail(email);
-    // better-auth email login: sign-in captures the session cookie, then a hub
-    // JWT is minted from it (auth-client.js). `endpoint` is the sign-in URL.
-    const result = await requestLogin(
-      { email: normalizedEmail, password },
-      { signInEndpoint: endpoint, tokenEndpoint: getAuthTokenEndpoint() },
-    );
-    handleResult(result, c, normalizedEmail);
-  } finally {
-    if (!injectedAsk) ask.close();
-  }
+  return runDeviceFlow(method, c, { openBrowser, sleep, lang, output });
 }
 
 // Shared success path: persist the session (atomic 0600 store) and report.
-function persistAndReport(result, c, email = null) {
+// `output` lets a caller (and tests) redirect the human-facing lines; errors stay on stderr.
+function persistAndReport(result, c, email = null, output = process.stdout) {
   if (email) {
     const prior = loadConsentState();
     if (prior && prior.email && normalizeEmail(prior.email) !== normalizeEmail(email)) {
@@ -167,37 +116,16 @@ function persistAndReport(result, c, email = null) {
     process.exitCode = 1;
     return false;
   }
-  process.stdout.write(`\n  ${c.success}\n`);
-  if (result.expiresAt) process.stdout.write(`  ${c.expiresAt(result.expiresAt)}\n`);
-  process.stdout.write('\n');
+  output.write(`\n  ${c.success}\n`);
+  if (result.expiresAt) output.write(`  ${c.expiresAt(result.expiresAt)}\n`);
+  output.write('\n');
   return true;
 }
 
-// `typedEmail` is what the CALLER typed/passed as `--email` for THIS attempt.
-function handleResult(result, c, typedEmail = null) {
-  if (result.ok) return void persistAndReport(result, c, result.email || typedEmail);
-
-  // One message per contract reason (ADR-044) — each names the cause (issue 109).
-  const messageFor = {
-    'invalid-credentials': c.errorInvalidCredentials,
-    'no-email-password': c.errorNoEmailPassword,
-    upstream: c.errorUpstream,
-    // Creds were good but the hub JWT could not be minted from the cookie.
-    'token-fetch-failed': c.errorUpstream,
-    timeout: c.errorUnreachable,
-    'network-error': c.errorUnreachable,
-    'invalid-url': c.errorConfig,
-    'no-endpoint': c.errorNoEndpoint,
-    'bad-response': c.errorGeneric,
-    'http-error': c.errorGeneric,
-    'local-error': c.errorGeneric,
-  };
-  process.stderr.write(`\n  ${messageFor[result.reason] || c.errorGeneric}\n\n`);
-  process.exitCode = 1;
-}
-
-// `login --google` / `--linkedin` — one device flow (RFC 8628); only the `provider` query on the URL differs.
-async function runSocial(provider, c, { openBrowser = openPath, sleep = undefined, lang = 'en' } = {}) {
+// `login` for one method — one device flow (RFC 8628); only the `provider` query
+// on the `/cli-login` URL differs (google | linkedin | email). Email reuses an
+// existing web session or signs in on the page, with no password in the terminal.
+async function runDeviceFlow(provider, c, { openBrowser = openPath, sleep = undefined, lang = 'en', output = process.stdout } = {}) {
   const authorizeEndpoint = getDeviceAuthorizeEndpoint();
   const tokenEndpoint = getDeviceTokenEndpoint();
   const authTokenEndpoint = getAuthTokenEndpoint();
@@ -206,18 +134,21 @@ async function runSocial(provider, c, { openBrowser = openPath, sleep = undefine
     process.exitCode = 1;
     return;
   }
-  // A new social account also needs complete-registration before the JWT (freelanceType is a transient default).
+  // A new account also needs complete-registration before the JWT (freelanceType is a transient default).
   const completeRegistrationEndpoint = getCompleteRegistrationEndpoint();
   const registrationContext = buildRegistrationContext({ preferredLanguage: lang, newsletterConsent: false, freelanceType: 'POTENTIAL_FREELANCE' });
-  const providerName = provider === 'linkedin' ? c.methodLinkedin : c.methodGoogle;
+  const providerName = provider === 'linkedin' ? c.methodLinkedin : provider === 'email' ? c.methodEmail : c.methodGoogle;
 
-  // Same as email: an ACTIVE session is not silently overwritten.
+  // An ACTIVE session is not silently overwritten.
   const status = sessionStatus(loadAuthSession());
   if (status === 'active') {
-    process.stdout.write(`\n  ${c.alreadyLoggedIn}\n\n`);
+    output.write(`\n  ${c.alreadyLoggedIn}\n\n`);
     return;
   }
-  process.stdout.write(`\n  ${status === 'expired' ? c.sessionExpiredIntro : c.deviceIntro(providerName)}\n`);
+  const intro = status === 'expired'
+    ? c.sessionExpiredIntro
+    : (provider === 'email' ? c.emailDeviceIntro : c.deviceIntro(providerName));
+  output.write(`\n  ${intro}\n`);
 
   const result = await runDeviceLogin(
     { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint, registrationContext },
@@ -225,21 +156,23 @@ async function runSocial(provider, c, { openBrowser = openPath, sleep = undefine
       ...(sleep ? { sleep } : {}),
       onPrompt: ({ verificationUriComplete, userCode }) => {
         const url = appendProviderParam(verificationUriComplete, provider);
-        process.stdout.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        output.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        if (provider === 'email') output.write(`  ${c.deviceApproveHint}\n`);
         try { openBrowser(url); } catch { /* the printed URL covers it */ }
       },
     },
   );
-  handleSocialResult(result, c);
+  handleDeviceResult(result, c, output);
 }
 
-function handleSocialResult(result, c) {
+function handleDeviceResult(result, c, output = process.stdout) {
   if (result.ok) {
     // Map the device-flow JWT to the shared persist shape (no cookie).
     return void persistAndReport(
       { accessToken: result.token, hubAccessToken: result.token, email: result.email || null },
       c,
       result.email || null,
+      output,
     );
   }
 
@@ -264,14 +197,14 @@ function handleSocialResult(result, c) {
 }
 
 // `logout` — local only (no endpoint, no network): forget the stored session.
-async function runLogout(argv = process.argv.slice(2)) {
+async function runLogout(argv = process.argv.slice(2), { output = process.stdout } = {}) {
   const opts = parseArgs(argv);
   const lang = opts.lang || detectReportLang();
   const c = getCatalog(lang).login;
   const had = loadAuthSession() !== null;
   clearAuthSession();
   clearConsentState();
-  process.stdout.write(`\n  ${had ? c.loggedOut : c.notLoggedIn}\n\n`);
+  output.write(`\n  ${had ? c.loggedOut : c.notLoggedIn}\n\n`);
 }
 
 module.exports = { run, runLogout, chooseLoginMethod, parseArgs, hasMethodFlag };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/agents-client.js

@@ -95,7 +95,7 @@ async function requestDeclareAgent(
   return { ok: true, agentId };
 }
 
-// `PATCH {hub}/works/me/agents/:id/portfolios` — DIRECT to Hub (ADR-041), replace-set.
+// DIRECT to Hub (ADR-041), replace-set.
 async function requestRelateAgentPortfolios(
   { agentId, items, hubAccessToken } = {},
   { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},

package/src/ai-profile-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// GET hub `works/me/ai-profile` — the same read model the "My work with AI" front
+// The same read model the "My work with AI" front
 // paints: { setup, usage, cell, isAiNative, traction, vision, howIWork }.
 
 const { postJsonWithTimeout } = require('./backend-request');

package/src/applications-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// My-applications client (hub `works/candidatures/me`, talent Bearer). Lists the
+// My-applications client. Lists the
 // positions the talent applied to, with the candidature status.
 
 const { postJsonWithTimeout } = require('./backend-request');

package/src/authorship-mismatch.js

@@ -0,0 +1,62 @@
+'use strict';
+
+// Display-only authorship-transparency check (talents-ai-score).
+//
+// Warns the talent when their commits in the selected repos are authored under
+// an email that is not their Shakers account email, so their own work would be
+// attributed to nobody. This is a WARNING surface ONLY: it reads each repo's
+// CONFIGURED commit identity (`git config user.email`) and compares counts the
+// attribution path already produced — it NEVER feeds attribution/scoring.
+// git-activity.js owns `authoredCommitCount`; nothing here changes any count.
+
+const { execFileSync } = require('child_process');
+
+// The repo's locally configured commit identity. A plain config read, NOT the
+// authorship log parse — it only names who new commits here would be attributed to.
+function readConfiguredEmail(root) {
+  try {
+    const out = execFileSync('git', ['-C', root, 'config', '--get', 'user.email'], {
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    const value = String(out || '').trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+
+function normalize(email) {
+  return String(email || '').trim().toLowerCase();
+}
+
+// Returns { accountEmail, emails: [configured emails that differ from the account] }
+// when the talent's own commits are plausibly going unattributed, else null.
+//
+// Conservative on purpose (a false warning erodes trust more than a missed one):
+// it fires only when the account email is known, the selection HAS commits, NONE
+// are attributed to the account, and at least one repo is configured under a
+// different email we can name.
+function detectAuthorshipMismatch(toplevels, accountEmail, gitActivity, { readEmail = readConfiguredEmail } = {}) {
+  const account = normalize(accountEmail);
+  if (!account) return null;
+  if (!gitActivity) return null;
+  const commits = gitActivity.commitCount || 0;
+  const authored = gitActivity.authoredCommitCount || 0;
+  if (commits === 0 || authored > 0) return null;
+
+  const emails = [];
+  const seen = new Set();
+  for (const root of Array.isArray(toplevels) ? toplevels : []) {
+    const configured = readEmail(root);
+    const key = normalize(configured);
+    if (!key || key === account || seen.has(key)) continue;
+    seen.add(key);
+    emails.push(String(configured).trim());
+  }
+  if (emails.length === 0) return null;
+  return { accountEmail: String(accountEmail).trim(), emails };
+}
+
+module.exports = { detectAuthorshipMismatch, readConfiguredEmail };

package/src/availability-client.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Availability client. VIEW = GET `works/me/availability`; SET = PUT
-// `works/talents/me/work-details/availability` (the same endpoint register uses).
+// (the same endpoint register uses).
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');

package/src/certifications-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// My-certifications client (hub `works/certifications/me`, talent Bearer). The
+// My-certifications client. The
 // "By role" page: main-role cluster + its dimension rows (state/band) + ratios.
 
 const { postJsonWithTimeout } = require('./backend-request');

package/src/certify-dimension-client.js

@@ -4,7 +4,6 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
-const { toUpperLang } = require('./lang-codes');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -154,87 +153,9 @@ async function discoverOfferableDimensions(deps = {}, { accessToken, hubAccessTo
   return { ok: true, mainRole: mine.mainRole, offerable, unmatched };
 }
 
-async function requestCreateCertificationInterview(
-  { dimensionKey, languageCode, accessToken } = {},
-  { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const body = { dimensionKey };
-  if (languageCode) body.languageCode = toUpperLang(languageCode);
-  let res;
-  try {
-    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) {
-    const reason = reasonForError(res.status, res.raw);
-    if (reason !== 'dimension-on-cooldown') return { ok: false, reason };
-    // certs puts the date in the message only: "... available on 2026-10-28T14:50:38.265Z".
-    const available = String(res.raw || '').match(/available on (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/);
-    return { ok: false, reason, availableOn: available ? available[1] : null };
-  }
-  const data = payloadOf(res.raw);
-  const interviewId = pick(data || {}, ['interviewId', 'id']);
-  if (!interviewId) return { ok: false, reason: 'bad-response' };
-  return { ok: true, interviewId, language: pick(data || {}, ['language', 'languageCode']) || null };
-}
-
-// Poll the verdict; a 2xx/404/425/202 with no band yet resolves `ready:false` (retriable).
-async function requestCertificationReport(
-  { interviewId, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!interviewId) return { ok: false, reason: 'no-interview' };
-  const url = `${base.replace(/\/+$/, '')}/${encodeURIComponent(interviewId)}/report`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status === 404 || res.status === 425 || res.status === 202) return { ok: true, ready: false, report: null };
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (data === undefined || data === null || typeof data !== 'object') return { ok: true, ready: false, report: null };
-  const band = pick(data, ['band', 'level', 'combinedLevel']);
-  // A report with too little evidence for a level has band null; it is still finished.
-  if (!band && !pick(data, ['evaluationId'])) return { ok: true, ready: false, report: null };
-  return { ok: true, ready: true, report: data };
-}
-
-// The case the web preview shows before starting (works `get-dimension-case`): the exercise statement, else the
-// version's brief. `case: null` for a template with neither.
-async function requestDimensionCase(
-  { dimensionKey, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const path = String(dimensionKey).split('/').map(encodeURIComponent).join('/');
-  const url = `${base.replace(/\/+$/, '')}/dimension/${path}/case`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (!data || typeof data !== 'object') return { ok: false, reason: 'bad-response' };
-  const text = (value) => (typeof value === 'string' && value.trim() ? value.trim() : null);
-  const brief = text(data.statement) || text(data.candidateBrief);
-  return { ok: true, case: brief ? { brief, testType: text(data.testType) } : null };
-}
-
 module.exports = {
   requestMyCertifications,
   requestTemplatesByDimension,
-  requestCreateCertificationInterview,
-  requestCertificationReport,
-  requestDimensionCase,
   composeDimensionKey,
   composeOfferableDimensions,
   discoverOfferableDimensions,

package/src/certify-dimension-flow.js

@@ -1,28 +1,33 @@
 'use strict';
 
-// `certify` dimension flow: discover -> pick -> create -> LiveKit interview -> poll verdict.
+// `certify` dimension flow: discover -> pick -> hand over the web deep link. The interview runs on the web.
 
 const { runInteractiveMultiSelect } = require('./interactive-select');
 
 function makeCertifyDimensionDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./certify-dimension-client');
-  const onboardingFlow = require('./onboarding-flow');
   return {
-    getCertificationInterviewsEndpoint: config.getCertificationInterviewsEndpoint,
-    // `{certsBase}/interviews` — shared base for LiveKit start/complete + the report poll.
-    getInterviewsBase: config.getOnboardingInterviewsEndpoint,
+    getTalentProfileUrl: config.getTalentProfileUrl,
     discoverOfferableDimensions: (opts) => client.discoverOfferableDimensions({}, opts),
-    requestCreateCertificationInterview: client.requestCreateCertificationInterview,
-    requestCertificationReport: client.requestCertificationReport,
-    requestDimensionCase: client.requestDimensionCase,
-    conductLivekitInterview: onboardingFlow.conductLivekitInterview,
-    onboardingDeps: onboardingFlow.makeDeps(),
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    buildWebLink,
     ...overrides,
   };
 }
 
+// The web route validates the decoded `dimension` param against `^[^/]+\/[^/]+$`,
+// so the separator slash stays literal and each segment is url-encoded.
+function buildWebLink(profileUrl, { clusterId, slug } = {}) {
+  if (!profileUrl || !clusterId || !slug) return null;
+  let origin;
+  try {
+    origin = new URL(profileUrl).origin;
+  } catch {
+    return null;
+  }
+  return `${origin}/certifications?dimension=${encodeURIComponent(clusterId)}/${encodeURIComponent(slug)}`;
+}
+
 // Numbered fallback when `ask` can't release stdin for raw mode.
 async function askNumberedChoice(ask, promptText, count) {
   const raw = (await ask(promptText)).trim();
@@ -62,53 +67,6 @@ function resolveDimensionArg(arg, items) {
   return items.find((d) => d.dimensionKey === raw || d.slug === raw) || undefined;
 }
 
-// The evaluation lands one to two minutes after the interview ends, four when the queue is busy.
-async function pollReport(deps, { interviewId, accessToken }, { base, attempts = 60, intervalMs = 5000 } = {}) {
-  for (let i = 0; i < attempts; i++) {
-    const res = await deps.requestCertificationReport({ interviewId, accessToken }, { base });
-    if (!res.ok) return { ok: false, reason: res.reason };
-    if (res.ready) return { ok: true, report: res.report };
-    if (i < attempts - 1) await deps.sleep(intervalMs);
-  }
-  return { ok: false, reason: 'timeout' };
-}
-
-function formatDay(iso, lang) {
-  const d = iso ? new Date(iso) : null;
-  if (!d || Number.isNaN(d.getTime())) return null;
-  return d.toLocaleDateString(lang === 'en' ? 'en-GB' : 'es-ES', { day: 'numeric', month: 'long', year: 'numeric' });
-}
-
-function renderVerdict(report, cd) {
-  const lines = [];
-  const band = report.band || report.level || report.combinedLevel;
-  const dimension = report.dimensionName || report.dimension || report.dimensionKey;
-  if (dimension) lines.push(cd.verdictDimension(dimension));
-  if (band) lines.push(cd.verdictBand(band));
-  if (typeof report.certified === 'boolean') lines.push(report.certified ? cd.verdictCertified : cd.verdictNotCertified);
-  const summary = report.summary || report.rationale || report.feedback;
-  if (typeof summary === 'string' && summary.trim()) lines.push(summary.trim());
-  const areas = Array.isArray(report.areas) ? report.areas : null;
-  if (areas && areas.length) {
-    for (const a of areas) {
-      const name = a && (a.name || a.area || a.tag);
-      const note = a && (a.note || a.comment);
-      if (name) lines.push(`- ${name}${note ? `: ${note}` : ''}`);
-    }
-  }
-  return lines.join('\n  ');
-}
-
-// The statement is Markdown; the terminal shows it without the emphasis markers.
-function renderCase(dimensionCase, cd) {
-  const brief = dimensionCase.brief.replace(/(\*\*|__)(.+?)\1/g, '$2');
-  const expectations = cd.caseExpectations[dimensionCase.testType];
-  const lines = brief.split('\n');
-  if (expectations) lines.push('', cd.caseExpectationsTitle, ...Object.values(expectations).map((e) => `- ${e}`));
-  lines.push('', cd.caseBeforeStart);
-  return lines.join('\n  ');
-}
-
 async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog, opts = {}, deps = makeCertifyDimensionDeps() }) {
   const cd = catalog.certifyDimension;
   const accessToken = session ? session.accessToken : null;
@@ -157,60 +115,21 @@ async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog
     }
   }
 
-  const createEndpoint = deps.getCertificationInterviewsEndpoint();
-  const created = await io.withProgress(cd.creating, () =>
-    deps.requestCreateCertificationInterview(
-      { dimensionKey: chosen.dimensionKey, languageCode: lang, accessToken },
-      { endpoint: createEndpoint },
-    ));
-  if (!created.ok) {
-    io.error(created.reason === 'dimension-on-cooldown'
-      ? cd.onCooldown(formatDay(created.availableOn, lang))
-      : cd.createFailed(created.reason));
-    return { ok: false, reason: created.reason, step: 'create' };
-  }
-
-  // A failed read leaves the run as it was before the case existed, like the web preview does.
-  const caseRead = await deps.requestDimensionCase(
-    { dimensionKey: chosen.dimensionKey, accessToken },
-    { base: deps.getInterviewsBase() },
-  );
-  if (caseRead.ok && caseRead.case) {
-    io.section(cd.caseTitle);
-    io.notify(renderCase(caseRead.case, cd));
-    if (stdinIsTTY) await ask(`  ${cd.caseReadyPrompt}`);
-  }
-
-  const interview = await deps.conductLivekitInterview(io, deps.onboardingDeps, {
-    interviewId: created.interviewId,
-    language: lang,
-    plain: true,
-  });
-  if (!interview.ok) {
-    io.warn(interview.reason === 'needs-web' ? cd.needsWeb : cd.interviewUnavailable(interview.reason));
-    return { ok: false, reason: interview.reason, step: 'interview' };
-  }
-
-  const reportBase = deps.getInterviewsBase();
-  const polled = await io.withProgress(cd.reportPolling, () =>
-    pollReport(deps, { interviewId: created.interviewId, accessToken }, { base: reportBase }));
-  if (!polled.ok) {
-    io.warn(polled.reason === 'timeout' ? cd.reportTimeout : cd.reportFailed(polled.reason));
-    return { ok: true, completed: 'interview', verdict: null };
+  const link = deps.buildWebLink(deps.getTalentProfileUrl(), { clusterId: chosen.clusterId, slug: chosen.slug });
+  if (!link) {
+    io.warn(cd.webHandoffNoLink);
+    return { ok: true, handoff: null, dimension: chosen.dimensionKey };
   }
 
-  io.section(cd.verdictTitle);
-  io.notify(renderVerdict(polled.report, cd));
-  io.success(cd.done);
-  return { ok: true, completed: 'interview', verdict: polled.report };
+  io.notify(cd.webHandoff);
+  io.notify(cd.webHandoffLink(link));
+  return { ok: true, handoff: link, dimension: chosen.dimensionKey };
 }
 
 module.exports = {
   makeCertifyDimensionDeps,
   runCertifyDimension,
+  buildWebLink,
   chooseDimension,
   resolveDimensionArg,
-  pollReport,
-  renderVerdict,
-  renderCase,
 };