shakers-cli-beta 0.11.0 → 0.13.0

package/src/config.js

@@ -264,7 +264,7 @@ function getAuthTokenEndpoint(env = process.env) {
 function getCompleteRegistrationEndpoint(env = process.env) {
   const explicit = readEnv(env, 'COMPLETE_REGISTRATION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/auth/complete-registration');
+  return deriveFromHub(env, 'works/talent/auth/complete-registration');
 }
 
 // Google via device flow (RFC 8628): the Hub broker owns all Google config; the CLI holds no client_id.
@@ -287,7 +287,7 @@ function getDeviceTokenEndpoint(env = process.env) {
 function getMyCertificationsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CERTIFICATIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me');
+  return deriveFromHub(env, 'works/talent/certifications/me');
 }
 
 // Role/cluster endpoints (hub, talent Bearer). available-roles = the catalog the
@@ -296,19 +296,19 @@ function getMyCertificationsEndpoint(env = process.env) {
 function getAvailableRolesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABLE_ROLES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/available-roles');
+  return deriveFromHub(env, 'works/talent/certifications/me/available-roles');
 }
 
 function getSetMainRoleEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SET_MAIN_ROLE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/certifications/me/main-role');
+  return deriveFromHub(env, 'works/talent/certifications/me/main-role');
 }
 
 function getAssignedClustersEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ASSIGNED_CLUSTERS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/assigned-clusters');
+  return deriveFromHub(env, 'works/talent/me/work-details/assigned-clusters');
 }
 
 function getTemplatesByDimensionEndpoint(env = process.env) {
@@ -326,12 +326,20 @@ function getMyAssessmentsEndpoint(env = process.env) {
   return base ? `${base}/users/me/assessments` : null;
 }
 
+// `certify` creates its dimension interview here (certs, talent Bearer).
+function getCertificationInterviewsEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'CERTIFICATION_INTERVIEWS_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  const base = getCertsBase(env);
+  return base ? `${base}/users/me/certification-interviews` : null;
+}
+
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'FIND_POSITIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/positions/find');
+  return deriveFromHub(env, 'works/talent/positions/find');
 }
 
 // Marketplace read/write (hub, talent Bearer). The id-taking getters return null
@@ -340,20 +348,20 @@ function getPositionDetailEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'POSITION_DETAIL_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/positions/${encodeURIComponent(positionId)}/detail`);
+  return deriveFromHub(env, `works/talent/positions/${encodeURIComponent(positionId)}/detail`);
 }
 
 function getSavePositionEndpoint(env = process.env) {
   const explicit = readEnv(env, 'SAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/saved-positions');
+  return deriveFromHub(env, 'works/talent/saved-positions');
 }
 
 function getUnsavePositionEndpoint(positionId, env = process.env) {
   const explicit = readEnv(env, 'UNSAVE_POSITION_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   if (positionId == null || typeof positionId === 'object') return null;
-  return deriveFromHub(env, `works/saved-positions/${encodeURIComponent(positionId)}`);
+  return deriveFromHub(env, `works/talent/saved-positions/${encodeURIComponent(positionId)}`);
 }
 
 function getReceivedInvitationsEndpoint(env = process.env) {
@@ -365,7 +373,7 @@ function getReceivedInvitationsEndpoint(env = process.env) {
 function getMyCandidaturesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'MY_CANDIDATURES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/candidatures/me');
+  return deriveFromHub(env, 'works/talent/candidatures/me');
 }
 
 function getMeAvailabilityEndpoint(env = process.env) {
@@ -377,13 +385,13 @@ function getMeAvailabilityEndpoint(env = process.env) {
 function getMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile-summary');
 }
 
 function getTalentMeProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/profile');
+  return deriveFromHub(env, 'works/talent/me/profile');
 }
 
 // Alma (the AI assistant) is a SEPARATE service — NOT derived from hubBase.
@@ -444,7 +452,7 @@ function getUsageReportEndpoint(env = process.env) {
 function getAiProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AI_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/ai-profile');
+  return deriveFromHub(env, 'works/talent/me/ai-profile');
 }
 
 // Evidence emission endpoint for the `cli_scan` instrument (talents-ai-score Phase 2).
@@ -476,7 +484,7 @@ function getPortfolioDraftDescriptionEndpoint(env = process.env) {
 function getPortfolioUpdateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PORTFOLIO_UPDATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/portfolios');
+  return deriveFromHub(env, 'works/talent/portfolios');
 }
 
 function getAgentsDeclareEndpoint(env = process.env) {
@@ -502,7 +510,7 @@ function getAgentPortfoliosEndpoint(agentId, env = process.env) {
   // Null on missing/non-scalar id: no bogus URL, and keeps config.test.js's `fn(env)`
   // getter sweep honest when the env object lands in `agentId`.
   if (agentId == null || typeof agentId === 'object') return null;
-  return deriveFromHub(env, `works/me/agents/${encodeURIComponent(agentId)}/portfolios`);
+  return deriveFromHub(env, `works/talent/me/agents/${encodeURIComponent(agentId)}/portfolios`);
 }
 
 // Onboarding endpoints (evaluation-mcp, ADR-011..015/024 — the register flow).
@@ -533,7 +541,7 @@ function getSignUpEndpoint(env = process.env) {
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/import-profile');
+  return deriveFromHub(env, 'works/talent/me/import-profile');
 }
 
 // MCP sign-up (ticket 39540): public UNREGISTERED + claim code, its import status, and the one-time web login.
@@ -542,7 +550,7 @@ function getMcpSignupEndpoint(env = process.env) {
 }
 
 function getMyImportStatusEndpoint(env = process.env) {
-  return deriveFromHub(env, 'works/me/import-profile/status');
+  return deriveFromHub(env, 'works/talent/me/import-profile/status');
 }
 
 function getOneTimeTokenEndpoint(env = process.env) {
@@ -564,25 +572,25 @@ function getOneTimeLoginUrl(token, env = process.env) {
 function getProfessionalDetailsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PROFESSIONAL_DETAILS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me/professional-details');
+  return deriveFromHub(env, 'works/talent/me/professional-details');
 }
 
 function getPricingRateEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PRICING_RATE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/pricing-rate');
+  return deriveFromHub(env, 'works/talent/me/work-details/pricing-rate');
 }
 
 function getSetAvailabilityEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AVAILABILITY_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/availability');
+  return deriveFromHub(env, 'works/talent/me/work-details/availability');
 }
 
 function getLanguagesEndpoint(env = process.env) {
   const explicit = readEnv(env, 'LANGUAGES_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/talents/me/work-details/languages');
+  return deriveFromHub(env, 'works/talent/me/work-details/languages');
 }
 
 function getLanguagesCatalogEndpoint(env = process.env) {
@@ -613,10 +621,18 @@ function getTranslationsEndpoint(env = process.env) {
   return deriveFromHub(env, 'translations');
 }
 
+// The signed-in user as hub sees it (GET only): read back the phone after saving it.
+function getUserMeEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'USER_ME_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  return deriveFromHub(env, 'works/users/me');
+}
+
+// Talent base fields (PATCH name, phone...). works/users/me is GET only.
 function getTalentMeEndpoint(env = process.env) {
   const explicit = readEnv(env, 'TALENT_ME_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'works/me');
+  return deriveFromHub(env, 'works/talent/me');
 }
 
 function getOnboardingInterviewsEndpoint(env = process.env) {
@@ -758,6 +774,7 @@ module.exports = {
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
   getMyAssessmentsEndpoint,
+  getCertificationInterviewsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).
@@ -810,6 +827,7 @@ module.exports = {
   getMePortfoliosEndpoint,
   getTranslationsEndpoint,
   getTalentMeEndpoint,
+  getUserMeEndpoint,
   getOnboardingInterviewsEndpoint,
   getCompleteOnboardingEndpoint,
   getOnboardingRestartEndpoint,

package/src/find-projects-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Find Positions list client (hub `works/positions/find`, talent Bearer). Each
+// Find Positions list client. Each
 // item carries the parent Project's id/name — a "project" here is the Position's
 // parent, not a separate list. Pagination (limit/offset) and filters map to the
 // endpoint's `criteria`; the server orders by match desc and returns the total.

package/src/i18n.js

@@ -355,8 +355,10 @@ const catalogs = {
         subagents: (n) => `${n} ${n === 1 ? 'run' : 'runs'} de subagente`,
         hours: (h) => `${h} h activas (gap idle > 25 min = pausa)`,
         commits: (authored, total) => `${authored}/${total} commits tuyos`,
-        lines: (added, deleted) => `+${added}/-${deleted} líneas`,
-        velocity: (v) => `${v} commits/día`,
+        lines: (added, deleted) => `+${added}/-${deleted} líneas (del repo)`,
+        velocity: (v) => `${v} commits/día (del repo)`,
+        authorshipMismatch: (emails, account) =>
+          `Tus commits en ${emails.length === 1 ? 'este repo' : 'estos repos'} están a nombre de ${emails.join(', ')}, que no es tu email de Shakers (${account}). Puede que tu trabajo no se te atribuya: configura git con tu email de Shakers (git config user.email "${account}") para que cuente.`,
         workStreams: (streams, multiDay, maxSpan) =>
           `${streams} ${streams === 1 ? 'workstream' : 'workstreams'} (${multiDay} multi-día, máx ${maxSpan}d)`,
         tractionLabel: 'Actividad reciente',
@@ -531,7 +533,7 @@ const catalogs = {
         error: 'No se pudo generar el informe.',
       },
       frameworkIntroUsage:
-        'Esto mide tu fluidez con IA en dos ejes: Setup (madurez de tu tooling, T0–T7, determinista) y Usage (cómo lo usas, evaluado en entrevista + código). Te sitúa en el mapa 3×3 (Explorer → AI Native). Completarlo posiciona tu perfil agéntico para los proyectos que valoran cómo trabajas con IA.',
+        'Esto mide tu fluidez con IA en dos ejes: Setup (madurez de tu tooling, T0–T7, determinista) y Usage (cómo lo usas, evaluado en entrevista + código). Te sitúa en el mapa 3×3 (Explorer → AI Native). Completarlo posiciona tu perfil agéntico para los proyectos que valoran cómo trabajas con IA. Por defecto leo el uso de IA de todo este equipo y asumo que es tuyo (un equipo = tú).',
       // Terminal progress feedback (talents-ai-score): stderr-only status
       // during the two slow phases (see src/terminal-progress.js).
       scanningLabel: 'Escaneando entorno y detectores…',
@@ -759,39 +761,9 @@ const catalogs = {
       dimensionInvalid: 'Esa dimensión no está entre las certificables ahora mismo.',
       dimensionOnCooldown: (slug, day) => `Aún no puedes repetir ${slug}: estará disponible el ${day}.`,
       dimensionUsing: (slug) => `Dimensión elegida: ${slug}`,
-      creating: 'Creando la entrevista…',
-      createFailed: (reason) => `No se pudo crear la entrevista (${reason}).`,
-      onCooldown: (day) => (day
-        ? `Ya hiciste esta dimensión hace poco. Podrás repetirla a partir del ${day}.`
-        : 'Ya hiciste esta dimensión hace poco y todavía no se puede repetir.'),
-      needsWeb: 'Esta dimensión lleva un ejercicio que por ahora solo se hace en la web, no por terminal.',
-      interviewUnavailable: (reason) => `La entrevista no pudo completarse (${reason}).`,
-      reportPolling: 'Calculando tu veredicto…',
-      reportTimeout: 'El veredicto todavía se está calculando. Consúltalo en tu perfil en unos minutos.',
-      reportFailed: (reason) => `No se pudo obtener el veredicto (${reason}). Consúltalo en tu perfil.`,
-      verdictTitle: 'Veredicto',
-      verdictDimension: (dim) => `Dimensión: ${dim}`,
-      verdictBand: (band) => `Nivel: ${band}`,
-      verdictCertified: 'Resultado: certificada',
-      verdictNotCertified: 'Resultado: no certificada esta vez',
-      done: 'Certificación completada.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'El caso',
-      caseExpectationsTitle: 'Qué se espera',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'Se evalúa tu razonamiento y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir datos que no están en el caso: di para qué los quieres.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'Se evalúa cómo razonas en la conversación y los supuestos que haces, no una respuesta perfecta.',
-          askForData: 'Puedes pedir a la otra parte datos que no están en el caso.',
-          takeTime: 'Puedes pararte a pensar antes de responder.',
-        },
-      },
-      caseBeforeStart: 'Alma te va a hacer preguntas sobre este caso. Si te falta algún dato, pídeselo durante la entrevista.',
-      caseReadyPrompt: 'Pulsa Enter cuando lo hayas leído para empezar la entrevista.',
+      webHandoff: 'Esta certificación se hace en la web. Abre este enlace para empezar la entrevista:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'No se pudo generar el enlace. Entra en tu perfil de Shakers y abre la sección de certificaciones.',
     },
     findProjects: {
       help:
@@ -1244,7 +1216,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Inicia sesión con tu email y contraseña de Shakers.',
-      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión con tu email y contraseña.',
+      sessionExpiredIntro: 'Tu sesión anterior caducó. Vuelve a iniciar sesión.',
       alreadyLoggedIn: 'Ya has iniciado sesión. Usa `logout` si quieres cambiar de cuenta.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Contraseña:',
@@ -1274,16 +1246,19 @@ const catalogs = {
       googleErrorState: 'La respuesta del navegador no coincidió con lo esperado (posible interferencia). Por seguridad no se inició sesión; inténtalo de nuevo.',
       googleErrorDenied: 'Cancelaste el acceso en Google (o no se concedió). No se inició sesión.',
       googleErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
-      // Google por device flow (RFC 8628): la config de Google la tiene el Hub; abres una URL y escribes un código.
+      // Device flow (RFC 8628) para TODO método (Google, LinkedIn, email): el Hub tiene la config; abres una URL y, si hace falta, escribes un código.
       deviceIntro: (name) => `Inicia sesión con ${name}. Abre el enlace de abajo e introduce el código para autorizar; luego vuelve aquí.`,
+      // Email por device flow: se abre la web de Shakers; reutiliza tu sesión abierta o entra con tu email ahí. Nunca pide contraseña en la terminal.
+      emailDeviceIntro: 'Inicia sesión con tu email. Abrimos la web de Shakers: entra con tu email o aprueba si ya tienes la sesión abierta. No hace falta contraseña aquí.',
       deviceVisit: 'Abre esta página en tu navegador:',
       deviceCodeLabel: (code) => `e introduce este código: ${code}`,
       deviceWaiting: 'Esperando a que autorices en el navegador…',
-      deviceErrorExpired: 'La solicitud de acceso con Google caducó antes de autorizarse. Vuelve a ejecutar `login --google` cuando estés listo.',
-      deviceErrorDenied: 'Se canceló el acceso con Google (o no se concedió). No se inició sesión.',
-      deviceErrorGeneric: 'No se pudo iniciar sesión con Google. Inténtalo de nuevo.',
+      deviceApproveHint: 'Abrimos tu navegador: apruébalo ahí para terminar (o entra con tu email si aún no has iniciado sesión). No hace falta contraseña.',
+      deviceErrorExpired: 'La solicitud de acceso caducó antes de autorizarse. Vuelve a ejecutar `login` cuando estés listo.',
+      deviceErrorDenied: 'Se canceló el acceso (o no se concedió). No se inició sesión.',
+      deviceErrorGeneric: 'No se pudo iniciar sesión. Inténtalo de nuevo.',
       chooseMethodHeading: '¿Cómo quieres iniciar sesión?',
-      methodEmail: 'Email y contraseña',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Flechas ↑/↓ para moverte · enter para elegir · esc para cancelar',
@@ -2028,8 +2003,10 @@ const catalogs = {
         subagents: (n) => `${n} subagent ${n === 1 ? 'run' : 'runs'}`,
         hours: (h) => `${h} active h (idle gap > 25 min = pause)`,
         commits: (authored, total) => `${authored}/${total} commits by you`,
-        lines: (added, deleted) => `+${added}/-${deleted} lines`,
-        velocity: (v) => `${v} commits/day`,
+        lines: (added, deleted) => `+${added}/-${deleted} lines (repo-wide)`,
+        velocity: (v) => `${v} commits/day (repo-wide)`,
+        authorshipMismatch: (emails, account) =>
+          `Your commits in ${emails.length === 1 ? 'this repo' : 'these repos'} are under ${emails.join(', ')}, which is not your Shakers email (${account}). Your work may not be attributed to you: set git to your Shakers email (git config user.email "${account}") so it counts.`,
         workStreams: (streams, multiDay, maxSpan) =>
           `${streams} ${streams === 1 ? 'workstream' : 'workstreams'} (${multiDay} multi-day, max ${maxSpan}d)`,
         tractionLabel: 'Traction',
@@ -2200,7 +2177,7 @@ const catalogs = {
         error: 'Could not generate the report.',
       },
       frameworkIntroUsage:
-        'This measures your AI fluency across two axes: Setup (your tooling\'s maturity, T0–T7, deterministic) and Usage (how you use it, assessed via interview + code). It places you on the 3×3 map (Explorer → AI Native). Completing it positions your agentic profile for projects that value how you work with AI.',
+        'This measures your AI fluency across two axes: Setup (your tooling\'s maturity, T0–T7, deterministic) and Usage (how you use it, assessed via interview + code). It places you on the 3×3 map (Explorer → AI Native). Completing it positions your agentic profile for projects that value how you work with AI. By default it reads the AI usage across this whole machine and assumes it is yours (one machine = you).',
       scanningLabel: 'Scanning environment and detectors…',
       // Loader for the per-selected-repo aggregation phase (git + sessions + steering/decisions + evidence + agent org chart).
       aggregatingLabel: 'Aggregating signals across the selected repos…',
@@ -2421,39 +2398,9 @@ const catalogs = {
       dimensionInvalid: 'That dimension is not among the certifiable ones right now.',
       dimensionOnCooldown: (slug, day) => `You can't retake ${slug} yet: it will be available on ${day}.`,
       dimensionUsing: (slug) => `Chosen dimension: ${slug}`,
-      creating: 'Creating the interview…',
-      createFailed: (reason) => `Could not create the interview (${reason}).`,
-      onCooldown: (day) => (day
-        ? `You took this dimension recently. You can retake it from ${day}.`
-        : 'You took this dimension recently and cannot retake it yet.'),
-      needsWeb: 'This dimension has an exercise that for now is only taken on the web, not in the terminal.',
-      interviewUnavailable: (reason) => `The interview could not be completed (${reason}).`,
-      reportPolling: 'Computing your verdict…',
-      reportTimeout: 'The verdict is still being computed. Check your profile in a few minutes.',
-      reportFailed: (reason) => `Could not fetch the verdict (${reason}). Check your profile.`,
-      verdictTitle: 'Verdict',
-      verdictDimension: (dim) => `Dimension: ${dim}`,
-      verdictBand: (band) => `Level: ${band}`,
-      verdictCertified: 'Result: certified',
-      verdictNotCertified: 'Result: not certified this time',
-      done: 'Certification complete.',
-      // The same case copy the web preview shows (works `certifications.preview`).
-      caseTitle: 'The case',
-      caseExpectationsTitle: 'What is expected',
-      caseExpectations: {
-        CASE_STUDY: {
-          reasoning: 'We assess your reasoning and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask for data that is not in the case: say what you want it for.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-        ROLE_PLAY: {
-          reasoning: 'We assess how you reason in the conversation and the assumptions you make, not a perfect answer.',
-          askForData: 'You can ask the other side for data that is not in the case.',
-          takeTime: 'You can stop to think before you answer.',
-        },
-      },
-      caseBeforeStart: 'Alma is going to ask you questions about this case. If you are missing any data, ask her for it during the interview.',
-      caseReadyPrompt: 'Press Enter once you have read it to start the interview.',
+      webHandoff: 'This certification is done on the web. Open this link to start the interview:',
+      webHandoffLink: (url) => `  ${url}`,
+      webHandoffNoLink: 'Could not build the link. Go to your Shakers profile and open the certifications section.',
     },
     findProjects: {
       help:
@@ -2902,7 +2849,7 @@ const catalogs = {
     // Branded mini-shell chrome (skill-code-certification / ADR-014).
     login: {
       intro: 'Log in with your Shakers email and password.',
-      sessionExpiredIntro: 'Your previous session expired. Log in again with your email and password.',
+      sessionExpiredIntro: 'Your previous session expired. Log in again.',
       alreadyLoggedIn: 'You are already logged in. Use `logout` if you want to switch accounts.',
       emailPrompt: 'Email:',
       passwordPrompt: 'Password:',
@@ -2932,17 +2879,20 @@ const catalogs = {
       googleErrorState: 'The browser response did not match what was expected (possible interference). For safety no session was started; try again.',
       googleErrorDenied: 'You cancelled access in Google (or it was not granted). No session was started.',
       googleErrorGeneric: 'Could not log in with Google. Try again.',
-      // Google via device flow (RFC 8628): the Hub owns Google config; you open a URL and type a code.
+      // Device flow (RFC 8628) for EVERY method (Google, LinkedIn, email): the Hub owns the config; you open a URL and, if needed, type a code.
       deviceIntro: (name) => `Sign in with ${name}. Open the link below and enter the code to authorize; then come back here.`,
+      // Email via device flow: the Shakers web opens; reuse your open session or sign in with your email there. It never asks for a password in the terminal.
+      emailDeviceIntro: 'Sign in with your email. We open the Shakers web: sign in with your email, or approve if you are already signed in. No password is needed here.',
       deviceVisit: 'Open this page in your browser:',
       deviceCodeLabel: (code) => `and enter this code: ${code}`,
       deviceWaiting: 'Waiting for you to authorize in the browser…',
-      deviceErrorExpired: 'The Google sign-in request expired before it was authorized. Run `login --google` again when you are ready.',
-      deviceErrorDenied: 'The Google sign-in was cancelled or not granted. No session was started.',
-      deviceErrorGeneric: 'Could not sign in with Google. Try again.',
+      deviceApproveHint: 'We opened your browser: approve there to finish (or sign in with your email if you are not signed in yet). No password needed.',
+      deviceErrorExpired: 'The sign-in request expired before it was authorized. Run `login` again when you are ready.',
+      deviceErrorDenied: 'The sign-in was cancelled or not granted. No session was started.',
+      deviceErrorGeneric: 'Could not sign in. Try again.',
       // Interactive method picker (`login` with no --email/--google/--provider): reuses the SAME single-select picker `certify agents` uses to choose an agent (src/interactive-select.js).
       chooseMethodHeading: 'How do you want to log in?',
-      methodEmail: 'Email and password',
+      methodEmail: 'Email',
       methodGoogle: 'Google',
       methodLinkedin: 'LinkedIn',
       selectHint: 'Arrows ↑/↓ to move · enter to pick · esc to cancel',

package/src/lang-client.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Languages client. VIEW = GET `works/talents/me/work-details/languages`; the
+// Languages client. The
 // catalog (id<->name) = GET `static-data/languages` (@Public); SET = PATCH the
 // same work-details endpoint (REPLACE-ALL: send the full list of {id, level}).
 

package/src/mcp-auth-form.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const http = require('http');
+const crypto = require('crypto');
 const { openPath } = require('./open-file');
 const flow = require('./onboarding-flow');
 const { methodIdsForFlow } = require('./auth-methods');
@@ -184,7 +185,7 @@ function loginFormHtml(lang, { error } = {}) {
   const c = copy(lang);
   return page(`Shakers · ${c.signin}`, {
     inner: `<h1>${c.signin}</h1>${errorBanner(errorText(c, error))}`
-      + `<form method="post" action="/submit">`
+      + `<form method="post" action="submit">`
       + `<label>${c.email}</label><input name="email" type="email" required autofocus>`
       + `<label>${c.password}</label><input name="password" type="password" required>`
       + `<button type="submit">${c.signin}</button>`
@@ -205,7 +206,7 @@ function registerFormHtml(lang, { error, missing } = {}) {
   return page(`Shakers · ${c.create}`, {
     banner: panel(c.welcome),
     inner: `<h1>${c.create}</h1>${errorBanner(errorText(c, error))}`
-      + `<form method="post" action="/submit">`
+      + `<form method="post" action="submit">`
       + missingIdentityInputs(c, missing).replace('required', 'required autofocus')
       + `<label>${c.password}</label><input name="password" type="password" required minlength="8"${missing && (missing.email || missing.name || missing.lastName) ? '' : ' autofocus'}>`
       + `<label>${c.repeat}</label><input name="passwordConfirm" type="password" required minlength="8">`
@@ -250,9 +251,9 @@ function methodChoiceHtml(mode, lang, methods) {
   const emailLabel = mode === 'register' ? c.continueEmailRegister : c.continueEmail;
   const register = mode === 'register';
   const buttons = WINDOW_METHODS[mode].filter((id) => methods.includes(id)).map((id) => {
-    if (id === 'google') return `<a class="mbtn primary" href="/google${register ? '?legal=1' : ''}">${GOOGLE_G}${c.continueGoogle}</a>`;
-    if (id === 'linkedin') return `<a class="mbtn secondary" href="/linkedin">${LINKEDIN_IN}${c.continueLinkedin}</a>`;
-    return `<a class="mbtn secondary" href="/email">${emailLabel}</a>`;
+    if (id === 'google') return `<a class="mbtn primary" href="google${register ? '?legal=1' : ''}">${GOOGLE_G}${c.continueGoogle}</a>`;
+    if (id === 'linkedin') return `<a class="mbtn secondary" href="linkedin">${LINKEDIN_IN}${c.continueLinkedin}</a>`;
+    return `<a class="mbtn secondary" href="email">${emailLabel}</a>`;
   }).join('');
   return page(`Shakers · ${title}`, {
     inner: `<h1>${title}</h1><div class="actions">${buttons}</div><p class="hint">${c.hint}</p>${register ? legalHtml(lang) : ''}`,
@@ -264,12 +265,12 @@ function existingAccountHtml(lang, { email, error } = {}) {
   const c = copy(lang);
   return page(`Shakers · ${c.signin}`, {
     inner: `<h1>${c.signin}</h1>${errorBanner(error ? errorText(c, error) : c.existing)}`
-      + `<form method="post" action="/submit"><input type="hidden" name="intent" value="login">`
+      + `<form method="post" action="submit"><input type="hidden" name="intent" value="login">`
       + `<label>${c.email}</label><input name="email" type="email" required value="${esc(email || '')}">`
       + `<label>${c.password}</label><input name="password" type="password" required autofocus>`
       + `<button type="submit">${c.signin}</button>`
       + `</form>`
-      + `<div class="actions"><a class="mbtn secondary" href="/google?legal=1">${GOOGLE_G}${c.continueGoogle}</a></div>`
+      + `<div class="actions"><a class="mbtn secondary" href="google?legal=1">${GOOGLE_G}${c.continueGoogle}</a></div>`
       + `<p class="hint">${c.hint}</p>`,
   });
 }
@@ -371,7 +372,25 @@ function runLoopbackAuth(
       resolve(result);
     };
 
+    // Any page in the talent's browser can reach a loopback port, and a rebound DNS name can read it: only this
+    // window's own host, its own origin and its unguessable path get an answer. Every link in the pages is relative.
+    const secretPath = `/${crypto.randomBytes(32).toString('base64url')}`;
+    let port = null;
+    const ownHosts = () => [`127.0.0.1:${port}`, `localhost:${port}`];
+    const forbidden = (req) => {
+      if (!ownHosts().includes(String(req.headers.host || '').toLowerCase())) return true;
+      if (req.method === 'GET') return false;
+      const origin = req.headers.origin;
+      if (origin !== undefined && !ownHosts().map((h) => `http://${h}`).includes(origin)) return true;
+      const site = req.headers['sec-fetch-site'];
+      return site !== undefined && site !== 'same-origin';
+    };
+
     const server = http.createServer(async (req, res) => {
+      if (forbidden(req)) {
+        res.writeHead(403).end();
+        return;
+      }
       let url;
       try {
         url = new URL(req.url, 'http://127.0.0.1');
@@ -379,7 +398,17 @@ function runLoopbackAuth(
         res.writeHead(400).end();
         return;
       }
-      if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '')) {
+      if (url.pathname === secretPath) {
+        res.writeHead(302, { Location: `${secretPath}/${url.search}` });
+        res.end();
+        return;
+      }
+      if (!url.pathname.startsWith(`${secretPath}/`)) {
+        res.writeHead(404).end();
+        return;
+      }
+      url.pathname = url.pathname.slice(secretPath.length);
+      if (req.method === 'GET' && url.pathname === '/') {
         res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
         res.end(showMethodScreen ? methodChoiceHtml(mode, lang, methods) : formHtml(mode, lang, formOpts));
         return;
@@ -440,8 +469,8 @@ function runLoopbackAuth(
     if (timer.unref) timer.unref();
     server.on('error', () => finish({ ok: false, reason: 'local-error' }));
     server.listen(0, '127.0.0.1', () => {
-      const { port } = server.address();
-      const formUrl = `http://127.0.0.1:${port}/`;
+      ({ port } = server.address());
+      const formUrl = `http://127.0.0.1:${port}${secretPath}/`;
       if (typeof onUrl === 'function') onUrl(formUrl);
       try { openBrowser(formUrl); } catch { /* headless: the onUrl fallback covers it */ }
     });

package/src/mcp-choice.js

@@ -2,7 +2,7 @@
 
 // Closed questions of the MCP sign-up: a dialog when the client can elicit, otherwise one block the model prints, question last.
 
-const SAY_MESSAGE = 'Print `say` word for word as your whole reply: it already holds the texts, the question and its numbered options. Add nothing of your own and call no tool until the talent answers.';
+const SAY_MESSAGE = 'Print `say` word for word as your whole reply: it already holds the texts, the question and its options as a list. Present them as a choice and pass back the exact label the talent picks, never a number; add nothing of your own and call no tool until the talent answers.';
 
 // Fixed texts that are not a question ride on the next question block: a model skips a standalone relay.
 const notices = [];
@@ -17,14 +17,14 @@ function takeNotices() {
 
 // Fixed texts travel with their question, so a model that skips "show this first" still shows them.
 function sayBlock(texts, question, options) {
-  return [...texts, question, options.map((o, i) => `${i + 1}. ${o}`).join('\n')].join('\n\n');
+  return [...texts, question, options.map((o) => `- ${o}`).join('\n')].join('\n\n');
 }
 
 function chatChoice(question, options, texts = []) {
   return { say: sayBlock([...takeNotices(), ...texts], question, options), options, choiceMessage: SAY_MESSAGE };
 }
 
-// The option an answer names, by its text or by its number in the printed list.
+// The option an answer names: by its label, or by a position number if the talent still types one.
 function optionFor(answer, options) {
   if (typeof answer !== 'string') return null;
   const text = answer.trim();

package/src/mcp-device-login-tools.js

@@ -5,7 +5,7 @@
 const START_SCHEMA = {
   type: 'object',
   properties: {
-    provider: { type: 'string', enum: ['google', 'linkedin'], description: "Optional social provider. Defaults to 'google'. Same device flow either way; it selects which social button the sign-in page opens." },
+    provider: { type: 'string', enum: ['google', 'linkedin', 'email'], description: "Optional provider. Defaults to 'google'. Same device flow either way; it selects which option the Shakers sign-in page opens — 'email' opens the email sign-in (the talent reuses their open web session or signs in there, never a password in the chat)." },
     mode: { type: 'string', enum: ['login', 'register'], description: "Optional. 'login' signs an existing talent in; 'register' creates the account if new (the profile steps come from the register/onboarding tools afterwards). Defaults to 'login'." },
     freelanceType: { type: 'string', description: 'Optional, register only: FREELANCE | EMPLOYEE | AGENCY | POTENTIAL_FREELANCE. Used to complete a new account.' },
     preferredLanguage: { type: 'string', description: 'Optional, register only: es | en | it | pt | fr.' },
@@ -33,7 +33,7 @@ function makeDeviceLoginTools(deps = {}) {
 
   async function start(args = {}) {
     const mode = args.mode === 'register' ? 'register' : 'login';
-    const provider = args.provider === 'linkedin' ? 'linkedin' : 'google';
+    const provider = args.provider === 'linkedin' ? 'linkedin' : args.provider === 'email' ? 'email' : 'google';
     const authorizeEndpoint = getDeviceAuthorizeEndpoint();
     const tokenEndpoint = getDeviceTokenEndpoint();
     const authTokenEndpoint = getAuthTokenEndpoint();
@@ -157,7 +157,7 @@ function makeDeviceLoginTools(deps = {}) {
   return [
     {
       name: 'social_signin_start',
-      description: "Begin social sign-in (or registration) via the device flow — provider 'google' (default) or 'linkedin'. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
+      description: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
       inputSchema: START_SCHEMA,
       handler: start,
     },