shakers-cli-beta 0.8.0-beta.0 → 0.8.0-beta.2

package/bin/config.js

@@ -15,24 +15,26 @@ const {
 const VALID_LANGS = new Set(['es', 'en']);
 const ENDPOINT_KEYS = new Set(['certsBase', 'hubBase', 'ingestEndpoint', 'profileUrl']);
 const PROFILE_VALUES = new Set(['external', 'talent']);
-const SETTABLE = new Set([...ENDPOINT_KEYS, 'profile']);
+const SETTABLE = new Set([...ENDPOINT_KEYS, 'profile', 'lang']);
 
 const COPY = {
   es: {
-    help: 'config — lee/escribe la configuracion NO sensible del CLI (bases de hub/certs, perfil). Uso: shakers config <list|get [clave]|set clave valor>\n  Claves: certsBase, hubBase, ingestEndpoint, profileUrl, profile.\n  Los secretos (tokens/credenciales) NUNCA se guardan aqui: se obtienen con `shakers login` o por entorno.',
+    help: 'config — lee/escribe la configuracion NO sensible del CLI (bases de hub/certs, perfil, idioma). Uso: shakers config <list|get [clave]|set clave valor>\n  Claves: certsBase, hubBase, ingestEndpoint, profileUrl, profile, lang.\n  Los secretos (tokens/credenciales) NUNCA se guardan aqui: se obtienen con `shakers login` o por entorno.',
     unknownKey: (k) => `clave desconocida: ${k}. Claves validas: ${[...SETTABLE].join(', ')}.`,
     needValue: 'set necesita <clave> <valor>.',
     badEndpoint: (k, r) => `valor invalido para ${k} (${r}). Debe ser una URL http de loopback o https.`,
     badProfile: 'profile debe ser "external" o "talent".',
+    badLang: 'lang debe ser "es" o "en".',
     saved: (k, v) => `guardado ${k} = ${v}`,
     resolvedHeading: 'Resueltos (env > config.json > default local):',
   },
   en: {
-    help: 'config — read/write the CLI NON-sensitive configuration (hub/certs bases, profile). Usage: shakers config <list|get [key]|set key value>\n  Keys: certsBase, hubBase, ingestEndpoint, profileUrl, profile.\n  Secrets (tokens/credentials) are NEVER stored here: get them via `shakers login` or the environment.',
+    help: 'config — read/write the CLI NON-sensitive configuration (hub/certs bases, profile, language). Usage: shakers config <list|get [key]|set key value>\n  Keys: certsBase, hubBase, ingestEndpoint, profileUrl, profile, lang.\n  Secrets (tokens/credentials) are NEVER stored here: get them via `shakers login` or the environment.',
     unknownKey: (k) => `unknown key: ${k}. Valid keys: ${[...SETTABLE].join(', ')}.`,
     needValue: 'set needs <key> <value>.',
     badEndpoint: (k, r) => `invalid value for ${k} (${r}). Must be a loopback http URL or https.`,
     badProfile: 'profile must be "external" or "talent".',
+    badLang: 'lang must be "es" or "en".',
     saved: (k, v) => `saved ${k} = ${v}`,
     resolvedHeading: 'Resolved (env > config.json > local default):',
   },
@@ -98,6 +100,8 @@ async function run(argv = process.argv.slice(2), { env = process.env, out = null
     if (!SETTABLE.has(key)) { line(c.unknownKey(key)); process.exitCode = 1; return; }
     if (key === 'profile') {
       if (!PROFILE_VALUES.has(value)) { line(c.badProfile); process.exitCode = 1; return; }
+    } else if (key === 'lang') {
+      if (!VALID_LANGS.has(value)) { line(c.badLang); process.exitCode = 1; return; }
     } else if (key !== 'profileUrl') {
       const v = validateEndpoint(value);
       if (!v.ok) { line(c.badEndpoint(key, v.reason)); process.exitCode = 1; return; }

package/bin/mcp.js

@@ -74,7 +74,7 @@ async function run(argv = process.argv.slice(2)) {
     return;
   }
 
-  require('../src/config').ensureLocalConfigDefaults(process.env, { force: true });
+  require('../src/config').sanitizeStaleBakedEndpoints(process.env);
 
   const server = buildServer();
   const rl = server.start({

package/bin/register.js

@@ -8,10 +8,10 @@ const { run: runLogin } = require('./login');
 const { run: runAiUsage } = require('./ai-usage');
 const {
   runOnboarding, makeDeps, CURRENCIES, MONTHLY_HOURS, normalizeAmount,
-  WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS, CHANGE_MOTIVATORS,
+  WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS, CHANGE_MOTIVATORS, WORK_MODES,
   LANGUAGE_CODES, LANGUAGE_LEVELS, showsFreelanceOpinion, showsChangeMotivators,
 } = require('../src/onboarding-flow');
-const { promptSelect } = require('../src/prompt-select');
+const { promptSelect, promptMultiSelect } = require('../src/prompt-select');
 const { chooseAuthMethod } = require('../src/auth-method-picker');
 const { methodIdsForFlow } = require('../src/auth-methods');
 const { palette } = require('../src/ansi');
@@ -123,7 +123,16 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
     askAvailability: async (c) => {
       const available = isYes(await ask(`  ${c.availableAsk} `));
       const monthlyHours = await promptSelect({ ask, stdinIsTTY, out: selectOut, items: MONTHLY_HOURS, header: `  ${c.monthlyHoursAsk}` });
-      const onlyRemote = isYes(await ask(`  ${c.onlyRemoteAsk} `));
+      const workModes = await promptMultiSelect({
+        ask,
+        stdinIsTTY,
+        out: selectOut,
+        items: WORK_MODES,
+        labelFor: (v) => c.workModeLabels[v] || v,
+        header: `  ${c.workModesAsk}`,
+        hint: c.workModesHint,
+      });
+      if (workModes.length === 1 && workModes[0] === 'REMOTE') selectOut(c.onlyRemoteNote);
       let country = '';
       for (;;) {
         country = (await ask(`  ${c.countryAsk} `)).trim().toUpperCase();
@@ -137,7 +146,7 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       const longFullTimeProjects = isYes(await ask(`  ${c.longFullTimeAsk} `));
       const telephoneCode = (await ask(`  ${c.phonePrefixAsk} `)).trim();
       const telephoneNumber = (await ask(`  ${c.phoneNumberAsk} `)).trim();
-      return { available, monthlyHours, onlyRemote, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
+      return { available, monthlyHours, workModes, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
     },
     askSignUp: async (c) => {
       const name = (await ask(`  ${c.askName} `)).trim();

package/bin/shakers.js

@@ -14,7 +14,7 @@ const { detectReportLang, getCatalog } = require('../src/i18n');
 const { promptSelect } = require('../src/prompt-select');
 const { createStdinAsk } = require('../src/stdin-ask');
 const { migrateLegacyConfigDir } = require('../src/config-dir');
-const { ensureLocalConfigDefaults } = require('../src/config');
+const { sanitizeStaleBakedEndpoints } = require('../src/config');
 const { ensureFreshSession } = require('../src/session-refresh');
 const { hasUsableSession } = require('../src/session-gate');
 const { run: runAiUsage } = require('./ai-usage');
@@ -290,7 +290,7 @@ async function main() {
   const lang = parseLang(argv) || detectReportLang();
 
   migrateLegacyConfigDir(process.env);
-  ensureLocalConfigDefaults(process.env);
+  sanitizeStaleBakedEndpoints(process.env);
   // Mint a fresh hub JWT from the stored cookie once per command (email sessions only; a no-op for Google/legacy or when no session exists).
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.8.0-beta.0",
+  "version": "0.8.0-beta.2",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/availability-client.js

@@ -5,6 +5,7 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
+const { WORK_MODES } = require('./onboarding-flow');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -36,7 +37,7 @@ function normalizeAvailability(data) {
     available: bool(it.available),
     // A numeric hours value (incl. 0) must survive, not be dropped as "absent".
     monthlyHours: typeof it.monthlyHours === 'number' ? String(it.monthlyHours) : str(it.monthlyHours),
-    onlyRemote: bool(it.onlyRemote),
+    workModes: Array.isArray(it.workModes) ? it.workModes.filter((m) => WORK_MODES.includes(m)) : [],
     country: str(it.country),
     subdivision: str(it.subdivision),
     timezone: str(it.timezone),

package/src/availability-flow.js

@@ -4,6 +4,7 @@
 // (interactive, explicit confirmation — it writes your profile). Talent Bearer.
 
 const { styleLabelPrefix } = require('./ansi');
+const { WORK_MODES, validateAvailability } = require('./onboarding-flow');
 
 function makeAvailabilityDeps(overrides = {}) {
   const client = require('./availability-client');
@@ -11,10 +12,15 @@ function makeAvailabilityDeps(overrides = {}) {
     fetchAvailability: (opts) => client.fetchAvailability({}, opts),
     saveAvailability: (opts) => client.saveAvailability({}, opts),
     promptSelect: (opts) => require('./prompt-select').promptSelect(opts),
+    promptMultiSelect: (opts) => require('./prompt-select').promptMultiSelect(opts),
     ...overrides,
   };
 }
 
+function workModesLine(fp, modes) {
+  return modes && modes.length ? modes.map((m) => fp.workModeLabels[m] || m).join(', ') : fp.unknown;
+}
+
 function locationLine(a) {
   return [a.country, a.subdivision, a.timezone].filter(Boolean).join(' · ') || null;
 }
@@ -23,7 +29,7 @@ function renderView(io, fp, a) {
   io.section(fp.title);
   io.notify(styleLabelPrefix(fp.openToWork(a.available === true ? fp.yes : a.available === false ? fp.no : fp.unknown)));
   io.notify(styleLabelPrefix(fp.monthlyHours(a.monthlyHours != null ? a.monthlyHours : fp.unknown)));
-  io.notify(styleLabelPrefix(fp.onlyRemote(a.onlyRemote === true ? fp.yes : a.onlyRemote === false ? fp.no : fp.unknown)));
+  io.notify(styleLabelPrefix(fp.workModes(workModesLine(fp, a.workModes))));
   const loc = locationLine(a);
   if (loc) io.notify(styleLabelPrefix(fp.location(loc)));
   if (a.availabilityExpiringDate) io.notify(styleLabelPrefix(fp.expires(a.availabilityExpiringDate)));
@@ -57,18 +63,31 @@ async function runSet({ io, ask, session, catalog, opts, deps }) {
   const available = openPick.value;
   const hoursRaw = (await io.ask(fp.askMonthlyHours)).trim();
   if (hoursRaw && !/^\d{1,3}$/.test(hoursRaw)) { io.error(fp.monthlyHoursInvalid); return { ok: false, reason: 'bad-hours' }; }
-  const remotePick = await pickYesNo(fp.askOnlyRemote);
-  if (!remotePick) { io.notify(fp.setCancelled); return { ok: true, cancelled: true }; }
-  const onlyRemote = remotePick.value;
+  const pickedModes = await deps.promptMultiSelect({
+    ask,
+    stdinIsTTY: opts.stdinIsTTY,
+    out: selOut,
+    items: WORK_MODES,
+    labelFor: (v) => fp.workModeLabels[v] || v,
+    header: fp.workModesAsk,
+    hint: fp.workModesHint,
+    initialMarked: (current && Array.isArray(current.workModes)) ? current.workModes.map((m) => WORK_MODES.indexOf(m)).filter((i) => i >= 0) : [],
+    input: opts.input,
+    output: opts.output,
+  });
+  // Reuse the register validation (dedupe/upcase, enum check) — no duplicated logic.
+  const workModes = validateAvailability({ workModes: pickedModes }).availability.workModes || [];
+  if (workModes.length === 1 && workModes[0] === 'REMOTE') io.notify(fp.onlyRemoteNote);
 
   // Only the asked fields ride the partial upsert.
-  const body = { available, onlyRemote };
+  const body = { available };
   if (hoursRaw) body.monthlyHours = hoursRaw;
+  if (workModes.length) body.workModes = workModes;
 
   io.notify(fp.setDiff(
     `${available ? fp.yes : fp.no}`,
     hoursRaw || (current && current.monthlyHours) || fp.unknown,
-    `${onlyRemote ? fp.yes : fp.no}`,
+    workModesLine(fp, workModes),
   ));
   const confirmed = await io.confirm(fp.setConfirm);
   if (!confirmed) { io.notify(fp.setCancelled); return { ok: true, cancelled: true }; }

package/src/backend-request.js

@@ -39,6 +39,13 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
         method,
         headers: {
           Accept: 'application/json',
+          // Lets the backend (and Datadog) tell CLI/MCP traffic apart from the
+          // browser without touching auth — same value regardless of which
+          // bin/ entrypoint is running, since none of them plumb through here
+          // separately today. Set unconditionally so no caller can drop it via
+          // extraHeaders (sanitizeExtraHeaders runs after this, so it can only
+          // add headers, not remove this one).
+          'X-Shakers-Client': 'cli',
           // Only declared when there IS a body — see the bodyless note above.
           ...(data ? { 'Content-Type': 'application/json', 'Content-Length': data.length } : {}),
           ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
@@ -109,6 +116,8 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
         method,
         headers: {
           Accept: 'application/json',
+          // See postJsonWithTimeout's identical header for why.
+          'X-Shakers-Client': 'cli',
           'Content-Type': `multipart/form-data; boundary=${boundary}`,
           'Content-Length': data.length,
           ...sanitizeExtraHeaders(extraHeaders),

package/src/config.js

@@ -36,6 +36,18 @@ function isTalentProfile(env = process.env) {
   return getProfile(env) === 'talent';
 }
 
+// Explicit UI-language preference: SHAKERS_CLI_LANG env > config.json `lang`.
+// Returns 'es' | 'en', or null when neither is set (OS detection then fills it, see i18n.js).
+const VALID_UI_LANGS = new Set(['es', 'en']);
+
+function getUiLang(env = process.env) {
+  const fromEnv = String(readEnv(env, 'LANG') || '').trim().toLowerCase();
+  if (VALID_UI_LANGS.has(fromEnv)) return fromEnv;
+  const fromFile = String(loadConfigFile(env).lang || '').trim().toLowerCase();
+  if (VALID_UI_LANGS.has(fromFile)) return fromFile;
+  return null;
+}
+
 // config.json holds the superadmin session token (ADR-027) and consent/ endpoint data, so it must never be briefly world/group-readable.
 function saveConfigFile(config, env = process.env) {
   const dir = configDir(env);
@@ -184,7 +196,11 @@ function getCertsBase(env = process.env) {
   }
   const ingest = explicitIngest(env);
   if (ingest) return ingest.replace(/\/usage\/reports\/?$/, '').replace(/\/+$/, '');
-  return null;
+  // No explicit override anywhere -> the baked flavor profile (never null when a
+  // profile exists), so switching the published flavor "just works" without a
+  // seeded config.json (ADR-065 revised).
+  const baked = getEnvProfile(env).certsBase;
+  return baked ? baked.replace(/\/+$/, '') : null;
 }
 
 function getIngestEndpoint(env = process.env) {
@@ -495,9 +511,10 @@ function getHubBase(env = process.env) {
   const fromFile = loadConfigFile(env).hubBase;
   if (fromFile && String(fromFile).trim()) {
     const v = validateEndpoint(String(fromFile).trim());
-    return v.ok ? v.value.replace(/\/+$/, '') : null;
+    if (v.ok) return v.value.replace(/\/+$/, '');
   }
-  return null;
+  const baked = getEnvProfile(env).hubBase;
+  return baked ? baked.replace(/\/+$/, '') : null;
 }
 
 function deriveFromHub(env, relativePath) {
@@ -611,20 +628,39 @@ function getTalentProfileUrl(env = process.env) {
   if (explicit && explicit.trim()) return explicit.trim().replace(/\/+$/, '');
   const fromFile = loadConfigFile(env).profileUrl;
   if (fromFile && String(fromFile).trim()) return String(fromFile).trim().replace(/\/+$/, '');
-  return null;
-}
-
-// First-run local bootstrap: seed config.json with the baked flavor bases (ADR-065)
-// so the talent CLI/MCP works with zero exports; the flavor is resolved per-call
-// (SHAKERS_CLI_ENV > package name > dev) so env overrides still take precedence.
-function ensureLocalConfigDefaults(env = process.env, { force = false } = {}) {
-  if (!force && !isTalentProfile(env)) return false;
-  const defaults = getEnvProfile(env);
+  const baked = getEnvProfile(env).profileUrl;
+  return baked ? baked.replace(/\/+$/, '') : null;
+}
+
+// The endpoint keys a flavor profile owns. config.json must hold only EXPLICIT
+// user overrides of these, never the baked profile itself.
+const PROFILE_ENDPOINT_KEYS = Object.keys(ENV_PROFILES[DEFAULT_ENV_PROFILE]);
+
+// Boot migration (ADR-065 revised). The CLI used to SEED config.json with the
+// baked bases on first run; the getters now fall back to getEnvProfile() directly,
+// so seeding is unnecessary AND harmful: `npm uninstall` leaves the config dir, so
+// a config.json seeded by a previous flavor (e.g. the private @shakers build → dev)
+// survives into a new flavor (the public beta → staging) and pins the old endpoints
+// forever, since config.json wins over the baked profile. This sweep removes any
+// endpoint key whose value is byte-identical to that SAME field in a KNOWN profile
+// OTHER than the baked one — i.e. a value that could only have gotten there by the
+// old seeding of a different flavor. A value that matches no known profile is a
+// genuine user override (set via `shakers config set`) and is left untouched. We
+// never touch env, auth-session.json or consent.json, and never remove the dir.
+function sanitizeStaleBakedEndpoints(env = process.env) {
+  const bakedName = getEnvProfileName(env);
   const config = loadConfigFile(env);
   let changed = false;
-  for (const [key, value] of Object.entries(defaults)) {
-    if (!(config[key] && String(config[key]).trim())) {
-      config[key] = value;
+  for (const key of PROFILE_ENDPOINT_KEYS) {
+    const current = config[key];
+    if (typeof current !== 'string' || !current.trim()) continue;
+    const normalized = current.trim().replace(/\/+$/, '');
+    const matchesForeignProfile = Object.entries(ENV_PROFILES).some(
+      ([name, profile]) =>
+        name !== bakedName && String(profile[key]).replace(/\/+$/, '') === normalized,
+    );
+    if (matchesForeignProfile) {
+      delete config[key];
       changed = true;
     }
   }
@@ -732,7 +768,7 @@ module.exports = {
   // Onboarding / register flow (evaluation-mcp, ADR-011..015/024).
   getCertsBase,
   getHubBase,
-  ensureLocalConfigDefaults,
+  sanitizeStaleBakedEndpoints,
   getSignUpEndpoint,
   getImportProfileEndpoint,
   getProfessionalDetailsEndpoint,
@@ -771,6 +807,9 @@ module.exports = {
   VALID_PROFILES,
   getProfile,
   isTalentProfile,
+  // UI language preference (env SHAKERS_CLI_LANG > config.json `lang`).
+  VALID_UI_LANGS,
+  getUiLang,
   // Baked backend target flavor (staging | dev | local).
   ENV_PROFILES,
   getEnvProfileName,

package/src/i18n.js

@@ -86,7 +86,10 @@ const catalogs = {
       availabilityAsk: 'Quieres indicar tu disponibilidad y ubicacion ahora? (s/n):',
       availableAsk: 'Estas disponible para nuevos proyectos? (s/n):',
       monthlyHoursAsk: 'Cuantas horas al mes?',
-      onlyRemoteAsk: 'Trabajas solo en remoto? (s/n):',
+      workModesAsk: 'En que modalidad quieres trabajar? (marca una o varias)',
+      workModeLabels: { REMOTE: 'Remoto', HYBRID: 'Hibrido', IN_PERSON: 'Presencial' },
+      workModesHint: 'Espacio para marcar/desmarcar · Enter para confirmar',
+      onlyRemoteNote: 'Has marcado solo Remoto: no veras proyectos hibridos ni presenciales.',
       countryAsk: 'Pais (codigo ISO-2 de 2 letras, p.ej. ES):',
       countryInvalid: 'Codigo de pais no valido. Usa 2 letras (p.ej. ES, US, GB).',
       subdivisionAsk: 'Provincia o region (opcional, Enter para omitir):',
@@ -918,7 +921,7 @@ const catalogs = {
       notFound: 'Aún no has definido tu disponibilidad.',
       openToWork: (v) => `Abierto a trabajar: ${v}`,
       monthlyHours: (v) => `Horas al mes: ${v}`,
-      onlyRemote: (v) => `Solo remoto: ${v}`,
+      workModes: (v) => `Modalidad: ${v}`,
       location: (v) => `Ubicación: ${v}`,
       expires: (v) => `Caduca: ${v}`,
       yes: 'sí',
@@ -930,8 +933,11 @@ const catalogs = {
       askOpenToWork: '¿Estás abierto a trabajar?',
       askMonthlyHours: 'Horas al mes (número, p. ej. 40; Enter para no cambiar):',
       monthlyHoursInvalid: 'Horas no válidas. Escribe solo el número (p. ej. 40).',
-      askOnlyRemote: '¿Solo trabajo remoto?',
-      setDiff: (open, hours, remote) => `Nuevo: abierto=${open} · ${hours} h/mes · solo remoto=${remote}`,
+      workModesAsk: 'En que modalidad quieres trabajar? (marca una o varias)',
+      workModeLabels: { REMOTE: 'Remoto', HYBRID: 'Hibrido', IN_PERSON: 'Presencial' },
+      workModesHint: 'Espacio para marcar/desmarcar · Enter para confirmar',
+      onlyRemoteNote: 'Has marcado solo Remoto: no veras proyectos hibridos ni presenciales.',
+      setDiff: (open, hours, modes) => `Nuevo: abierto=${open} · ${hours} h/mes · modalidad=${modes}`,
       setConfirm: 'Esto actualiza tu perfil. ¿Confirmas? (s/n):',
       setCancelled: 'Cancelado. No se cambió tu disponibilidad.',
       setSaving: 'Guardando tu disponibilidad…',
@@ -1696,7 +1702,10 @@ const catalogs = {
       availabilityAsk: 'Do you want to set your availability and location now? (y/n):',
       availableAsk: 'Are you available for new projects? (y/n):',
       monthlyHoursAsk: 'How many hours per month?',
-      onlyRemoteAsk: 'Do you work remote-only? (y/n):',
+      workModesAsk: 'Which work modes do you want? (select one or more)',
+      workModeLabels: { REMOTE: 'Remote', HYBRID: 'Hybrid', IN_PERSON: 'On-site' },
+      workModesHint: 'Space to toggle · Enter to confirm',
+      onlyRemoteNote: 'You selected Remote only: you will not see hybrid or on-site projects.',
       countryAsk: 'Country (2-letter ISO-2 code, e.g. ES):',
       countryInvalid: 'Invalid country code. Use 2 letters (e.g. ES, US, GB).',
       subdivisionAsk: 'State or province (optional, Enter to skip):',
@@ -2520,7 +2529,7 @@ const catalogs = {
       notFound: 'You have not set your availability yet.',
       openToWork: (v) => `Open to work: ${v}`,
       monthlyHours: (v) => `Monthly hours: ${v}`,
-      onlyRemote: (v) => `Remote only: ${v}`,
+      workModes: (v) => `Work modes: ${v}`,
       location: (v) => `Location: ${v}`,
       expires: (v) => `Expires: ${v}`,
       yes: 'yes',
@@ -2532,8 +2541,11 @@ const catalogs = {
       askOpenToWork: 'Are you open to work?',
       askMonthlyHours: 'Monthly hours (number, e.g. 40; Enter to keep):',
       monthlyHoursInvalid: 'Invalid hours. Type only the number (e.g. 40).',
-      askOnlyRemote: 'Remote work only?',
-      setDiff: (open, hours, remote) => `New: open=${open} · ${hours} h/month · remote-only=${remote}`,
+      workModesAsk: 'Which work modes do you want? (select one or more)',
+      workModeLabels: { REMOTE: 'Remote', HYBRID: 'Hybrid', IN_PERSON: 'On-site' },
+      workModesHint: 'Space to toggle · Enter to confirm',
+      onlyRemoteNote: 'You selected Remote only: you will not see hybrid or on-site projects.',
+      setDiff: (open, hours, modes) => `New: open=${open} · ${hours} h/month · work modes=${modes}`,
       setConfirm: 'This updates your profile. Confirm? (y/n):',
       setCancelled: 'Cancelled. Your availability was not changed.',
       setSaving: 'Saving your availability…',
@@ -3238,13 +3250,19 @@ function resolveLang(langCode) {
   return langCode && /^es/i.test(langCode) ? 'es' : 'en';
 }
 
-// Single entry point for report callers (bin/report.js): detects the OS language (see locale.js) and already returns the resolved catalog code ('es' or 'en').
-function detectReportLang(env = process.env) {
-  return resolveLang(detectLangCode(env));
+// Explicit user preference (SHAKERS_CLI_LANG env > config.json `lang`) wins over OS detection; null when unset.
+function preferredUiLang(env = process.env) {
+  return require('./config').getUiLang(env);
 }
 
-function detectFlowLang(env = process.env) {
-  return toLowerLang(detectLangCode(env));
+// Single entry point for report callers (bin/report.js): explicit preference > OS language (see locale.js), resolved to the catalog code ('es' or 'en').
+// `sys` overrides the macOS/Intl readers (tests inject nulls to exercise the env path deterministically).
+function detectReportLang(env = process.env, sys) {
+  return resolveLang(preferredUiLang(env) || detectLangCode(env, sys));
+}
+
+function detectFlowLang(env = process.env, sys) {
+  return toLowerLang(preferredUiLang(env) || detectLangCode(env, sys));
 }
 
 function getCatalog(lang) {

package/src/locale.js

@@ -22,6 +22,22 @@ function langFromEnv(env) {
   return null;
 }
 
+// macOS DISPLAY language (top of "Preferred languages"), e.g. ("en-US", "es-ES").
+// This is the UI-language intent, unlike AppleLocale/LANG which carry the region.
+function langFromAppleLanguages() {
+  if (process.platform !== 'darwin') return null;
+  try {
+    const out = execFileSync('defaults', ['read', '-g', 'AppleLanguages'], {
+      timeout: 2000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString('utf8');
+    const first = out.replace(/[()]/g, '').split(',')[0].replace(/["\s]/g, '');
+    return langFromLocaleString(first);
+  } catch {
+    return null; // key not set, command missing, or any other failure: ignored
+  }
+}
+
 function langFromAppleLocale() {
   if (process.platform !== 'darwin') return null;
   try {
@@ -44,8 +60,13 @@ function langFromIntl() {
 }
 
 // Returns the detected language code ('es', 'en', 'fr', ...) or null if no signal could be resolved.
-function detectLangCode(env = process.env) {
-  return langFromEnv(env) || langFromAppleLocale() || langFromIntl() || null;
+// macOS display language (AppleLanguages) wins over env LANG/LC_ALL (region/format), then AppleLocale, then Intl.
+// `sys` overrides the macOS/Intl readers for deterministic tests (they ignore `env` and read the real host).
+function detectLangCode(env = process.env, sys = {}) {
+  const appleLanguages = sys.appleLanguages || langFromAppleLanguages;
+  const appleLocale = sys.appleLocale || langFromAppleLocale;
+  const intl = sys.intl || langFromIntl;
+  return appleLanguages() || langFromEnv(env) || appleLocale() || intl() || null;
 }
 
 module.exports = { detectLangCode, langFromLocaleString };

package/src/mcp-availability-tools.js

@@ -30,7 +30,7 @@ function makeAvailabilityTools(deps = {}) {
   return [
     {
       name: 'get_availability',
-      description: "View the talent's availability: open-to-work, monthly hours, remote-only, and location. Read-only. Requires an active session. Any internal ids in the result (e.g. numeric city id) are handles for tools only — never show or mention them to the talent.",
+      description: "View the talent's availability: open-to-work, monthly hours, work modes (a combinable array of REMOTE/HYBRID/IN_PERSON), and location. Read-only. Requires an active session. Any internal ids in the result (e.g. numeric city id) are handles for tools only — never show or mention them to the talent.",
       inputSchema: GET_AVAILABILITY_SCHEMA,
       handler: getAvailability,
     },

package/src/mcp-register-tools.js

@@ -2,7 +2,7 @@
 
 const {
   FREELANCE_TYPES, WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS,
-  CHANGE_MOTIVATORS, MONTHLY_HOURS, LANGUAGE_CODES, LANGUAGE_LEVELS,
+  CHANGE_MOTIVATORS, WORK_MODES, MONTHLY_HOURS, LANGUAGE_CODES, LANGUAGE_LEVELS,
 } = require('./onboarding-flow');
 const { getCatalog } = require('./i18n');
 const { TranscriptBuffer } = require('./interview-transcript');
@@ -55,11 +55,11 @@ function buildSchemas(lang) {
 
   const AVAILABILITY_SCHEMA = {
     type: 'object',
-    description: `Availability AND location (ADR-028). ALWAYS ask this — it must not be skipped. There is NO separate location field: the talent's LOCATION (country, timezone, region) lives here. Offer the options: available (yes/no); monthlyHours must be one of ${MONTHLY_HOURS_QUOTED}; onlyRemote (yes/no — accepts only remote work); longFullTimeProjects (yes/no — open to long full-time projects). For location, ask the talent their country and timezone (region is optional). All fields optional/nullable, but collect what you can. monthlyHours is a STRICT enum string (not an int). city is not collected here.`,
+    description: `Availability AND location (ADR-028). ALWAYS ask this — it must not be skipped. There is NO separate location field: the talent's LOCATION (country, timezone, region) lives here. Offer the options: available (yes/no); monthlyHours must be one of ${MONTHLY_HOURS_QUOTED}; workModes is a MULTI-VALUE array, any combination of ${WORK_MODES.join('/')} (the talent can pick several); longFullTimeProjects (yes/no — open to long full-time projects). For location, ask the talent their country and timezone (region is optional). All fields optional/nullable, but collect what you can. monthlyHours is a STRICT enum string (not an int). city is not collected here.`,
     properties: {
       available: { type: 'boolean', description: 'Whether the talent is currently available (yes/no).' },
       monthlyHours: { type: 'string', enum: MONTHLY_HOURS, description: `Monthly hours the talent can work, exactly one of: ${MONTHLY_HOURS_QUOTED} (send '> 160' verbatim, with the space).` },
-      onlyRemote: { type: 'boolean', description: 'Whether the talent accepts only remote work (yes/no).' },
+      workModes: { type: 'array', items: { type: 'string', enum: WORK_MODES }, description: `Work modes the talent accepts — a combinable array, any subset of ${WORK_MODES.join('/')} (e.g. ['REMOTE','HYBRID']). Only REMOTE means the talent will not see hybrid or on-site projects.` },
       country: { type: 'string', description: 'LOCATION — ISO-2 country code, 2 letters (e.g. ES, US, GB).' },
       timezone: { type: 'string', description: 'LOCATION — IANA timezone (e.g. Europe/Madrid, America/New_York). Max 100 chars.' },
       subdivision: { type: 'string', description: 'LOCATION — optional region/state code (e.g. ES-CT). Max 10 chars.' },
@@ -100,7 +100,7 @@ function buildRegisterDescription(lang) {
     + labelledOptions(CHANGE_MOTIVATORS, L.changeMotivatorLabels)
     + " when the talent is or is considering freelance).\n4. Pricing — per-PROJECT price; currency USD, EUR or GBP.\n5. Availability + languages — `availability` (offer monthlyHours "
     + MONTHLY_HOURS_SLASHED
-    + ", onlyRemote yes/no, longFullTimeProjects yes/no, and LOCATION: country as ISO-2 e.g. ES, timezone as IANA e.g. Europe/Madrid) and `languages` (offer "
+    + ", workModes as a combinable array of " + WORK_MODES.join('/') + ", longFullTimeProjects yes/no, and LOCATION: country as ISO-2 e.g. ES, timezone as IANA e.g. Europe/Madrid) and `languages` (offer "
     + labelledOptions(LANGUAGE_CODES, L.languageNames)
     + ", each with a level "
     + labelledOptions(LANGUAGE_LEVELS, L.languageLevelLabels)

package/src/onboarding-flow.js

@@ -10,6 +10,8 @@ const WORK_SITUATIONS = ['FREELANCE', 'EMPLOYED', 'BETWEEN_JOBS', 'STUDYING', 'O
 const EMPLOYMENT_PARTICIPATIONS = ['FULL_TIME', 'PART_TIME'];
 const FREELANCE_OPINIONS = ['WAS_FREELANCE_BEFORE', 'OPEN_TO_FREELANCE', 'NOT_INTERESTED'];
 const CHANGE_MOTIVATORS = ['HIGHER_RATE', 'SPECIFIC_PROJECT', 'LEARNING_CERTIFICATION', 'FLEXIBILITY', 'COMMUNITY', 'LIFESTYLE_CHANGE'];
+// Work modes are combinable (multi-value array), mirroring the hub availability contract.
+const WORK_MODES = ['REMOTE', 'HYBRID', 'IN_PERSON'];
 const LANGUAGE_LEVELS = ['INTERMEDIATE_WRITTEN', 'INTERMEDIATE', 'ADVANCED', 'NATIVE'];
 const LANGUAGE_CODES = ['es', 'en', 'fr', 'ca', 'de', 'eu', 'it', 'pt'];
 
@@ -217,7 +219,17 @@ function validateAvailability(input = {}) {
     if (!mh) return { ok: false, reason: 'bad-monthly-hours' };
     body.monthlyHours = mh;
   }
-  if (typeof input.onlyRemote === 'boolean') body.onlyRemote = input.onlyRemote;
+  // workModes is a multi-value array (REMOTE/HYBRID/IN_PERSON); onlyRemote is derived server-side and no longer sent.
+  if (input.workModes != null) {
+    if (!Array.isArray(input.workModes)) return { ok: false, reason: 'bad-work-modes' };
+    const modes = [];
+    for (const raw of input.workModes) {
+      const mode = typeof raw === 'string' ? raw.trim().toUpperCase() : '';
+      if (!WORK_MODES.includes(mode)) return { ok: false, reason: 'bad-work-modes' };
+      if (!modes.includes(mode)) modes.push(mode);
+    }
+    if (modes.length) body.workModes = modes;
+  }
   if (input.country != null && input.country !== '') {
     const cc = normalizeCountry(input.country);
     if (!cc) return { ok: false, reason: 'bad-country' };
@@ -1025,6 +1037,7 @@ module.exports = {
   EMPLOYMENT_PARTICIPATIONS,
   FREELANCE_OPINIONS,
   CHANGE_MOTIVATORS,
+  WORK_MODES,
   LANGUAGE_LEVELS,
   LANGUAGE_CODES,
   normalizeFreelanceType,

package/src/prompt-select.js

@@ -26,4 +26,41 @@ async function promptSelect({ ask, stdinIsTTY, out, items, labelFor = (x) => Str
   return items.find((it) => labelFor(it).toLowerCase() === lowered || String(it).toLowerCase() === lowered) || null;
 }
 
-module.exports = { promptSelect };
+// Multi-pick variant: SPACE toggles, ENTER confirms; returns the chosen items as
+// an array (possibly empty). Non-TTY fallback accepts space/comma-separated
+// indices or labels.
+async function promptMultiSelect({ ask, stdinIsTTY, out, items, labelFor = (x) => String(x), header = '', hint = '', initialMarked = [], input, output } = {}) {
+  if (stdinIsTTY && typeof ask.suspend === 'function') {
+    ask.suspend();
+    const picked = await runInteractiveMultiSelect({
+      items,
+      labelFor,
+      header,
+      hint,
+      single: false,
+      initialMarked,
+      ...(input ? { input } : {}),
+      ...(output ? { output } : {}),
+    });
+    ask.resume();
+    return Array.isArray(picked) ? picked : [];
+  }
+  if (header) out(header);
+  items.forEach((it, i) => out(`  ${i + 1}) ${labelFor(it)}`));
+  const raw = (await ask('  > ')).trim();
+  if (!raw) return [];
+  const chosen = [];
+  for (const tok of raw.split(/[\s,]+/).filter(Boolean)) {
+    const n = parseInt(tok, 10);
+    let item = null;
+    if (Number.isInteger(n) && n >= 1 && n <= items.length) item = items[n - 1];
+    else {
+      const lowered = tok.toLowerCase();
+      item = items.find((it) => labelFor(it).toLowerCase() === lowered || String(it).toLowerCase() === lowered) || null;
+    }
+    if (item != null && !chosen.includes(item)) chosen.push(item);
+  }
+  return chosen;
+}
+
+module.exports = { promptSelect, promptMultiSelect };

package/src/usage-run-steps.js

@@ -9,6 +9,9 @@ const { persistFootprint } = require('./report-store');
 const {
   loadConsentState,
   getConsentDecision,
+  recordConsent,
+  isValidEmail,
+  normalizeEmail,
   autoShare,
   consentPath,
 } = require('./share');
@@ -117,9 +120,12 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
   });
 
   let aiConsentGranted;
+  // A REUSED grant (skip/--json) carries a stale consent email; a fresh prompt re-anchors itself.
+  let reusedStoredConsent = false;
   if (opts.json) {
     // `--json` never had an interactive prompt — its whole point is a single parseable stdout document, and it does not gain one now.
     aiConsentGranted = decision === 'granted' && (!state || state.emailVerified !== false);
+    reusedStoredConsent = true;
   } else {
     if (consentSkip.message) {
       process.stdout.write(`\n  ${consentSkip.message}\n`);
@@ -128,6 +134,7 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
       // A TERMINAL decision already exists (a prior run's explicit grant or
       // denial) — never re-asked, per ADR-007/011.
       aiConsentGranted = decision === 'granted';
+      reusedStoredConsent = true;
     } else {
       const ask = injectedAsk || createStdinAsk();
       let result;
@@ -145,6 +152,11 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
       process.stdout.write(`\n  ${termColors.warning}${catalog.consent.noReportWithoutConsent}${termColors.reset}\n\n`);
     }
   }
+  // Re-anchor a reused grant to the session's login-proven email (ADR-006): else a stale consent email ingests the report under another account and this session's AI profile never populates.
+  if (reusedStoredConsent && aiConsentGranted && gate.loggedIn
+    && isValidEmail(gate.email) && state && state.email !== normalizeEmail(gate.email)) {
+    recordConsent('granted', gate.email, { verified: true });
+  }
   return aiConsentGranted;
 }