shakers-cli-beta 0.8.0-beta.0

package/src/consent-flow.js

@@ -0,0 +1,115 @@
+'use strict';
+
+const { isValidEmail, recordConsent } = require('./share');
+const {
+  getEmailVerificationRequestUrl,
+  getEmailVerificationVerifyUrl,
+} = require('./config');
+const { runEmailVerification } = require('./email-verification');
+const { renderLegalNotice } = require('./legal-notice');
+
+// Consent prompt (talents-ai-score, ADR-011 — revises issue 006 / ADR-007's disclosure wall; ADR-051 revises ADR-011's OWN ordering in turn, see below).
+
+const MAX_ATTEMPTS = 5;
+
+const YES_RE = /^(y|yes|s|si|sí)$/i;
+const NO_RE = /^(n|no)$/i;
+
+async function askYesNo(ask, question, catalog) {
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    const raw = String(await ask(question)).trim();
+    if (YES_RE.test(raw)) return true;
+    if (NO_RE.test(raw)) return false;
+    process.stdout.write(`  ${catalog.consent.invalidAnswer}\n`);
+  }
+  return null;
+}
+
+async function askEmail(ask, catalog, question = catalog.consent.emailPrompt) {
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    const raw = String(await ask(question)).trim();
+    if (isValidEmail(raw)) return raw;
+    process.stdout.write(`  ${catalog.consent.invalidEmail}\n`);
+  }
+  return null;
+}
+
+async function defaultVerifyEmail({ email, ask, catalog, env = process.env }) {
+  return runEmailVerification({
+    email,
+    ask,
+    catalog,
+    requestUrl: getEmailVerificationRequestUrl(env),
+    verifyUrl: getEmailVerificationVerifyUrl(env),
+  });
+}
+
+// Runs the short consent-to-persist prompt + (if accepted) email collection + (skill-code-certification / ADR-006) EMAIL-OWNERSHIP VERIFICATION.
+async function runConsentPrompt({
+  ask,
+  catalog,
+  env = process.env,
+  verifyEmail = defaultVerifyEmail,
+  loggedIn = false,
+  sessionEmail = null,
+  drainBeforeAsk = false,
+  profile = 'talent',
+}) {
+  const c = catalog.consent;
+  // Presentation only (talents-ai-score): framed by src/legal-notice.js on a
+  // real TTY, byte-identical (no heading, no rule) otherwise.
+  process.stdout.write(`\n  ${renderLegalNotice(c.persistIntro, catalog)}\n`);
+
+  if (drainBeforeAsk && typeof ask.drain === 'function') ask.drain();
+
+  const accepted = await askYesNo(ask, c.persistQuestion, catalog);
+  if (accepted === null) {
+    process.stdout.write(`  ${c.notObtained}\n\n`);
+    return null;
+  }
+
+  if (!accepted) {
+    recordConsent('denied');
+    process.stdout.write(`  ${c.deniedSaved}\n\n`);
+    return 'denied';
+  }
+
+  if (loggedIn) {
+    if (sessionEmail && isValidEmail(sessionEmail)) {
+      // Identity already proven by the login session — no email prompt, no OTP.
+      recordConsent('granted', sessionEmail, { verified: true });
+      process.stdout.write(`  ${c.grantedSaved(sessionEmail)}\n\n`);
+      return 'granted';
+    }
+    // Logged in, but this session has no cached email — only happens against an older certs deployment that omitted `email` from the login response (see auth-session-store.js).
+    process.stdout.write(`  ${c.noSessionEmail}\n\n`);
+    return null;
+  }
+
+  const email = await askEmail(ask, catalog, profile === 'external' ? c.emailPromptExternal : undefined);
+  if (!email) {
+    process.stdout.write(`  ${c.notObtained}\n\n`);
+    return null;
+  }
+
+  if (profile === 'external') {
+    recordConsent('granted', email, { verified: false });
+    process.stdout.write(`  ${c.grantedSavedExternal(email)}\n\n`);
+    return 'granted';
+  }
+
+  // Prove email ownership BEFORE persisting anything (ADR-006).
+  const verification = await verifyEmail({ email, ask, catalog, env });
+  if (verification && verification.verified) {
+    recordConsent('granted', email, { verified: true });
+    process.stdout.write(`  ${c.grantedSaved(email)}\n\n`);
+    return 'granted';
+  }
+
+  // Not verified: persist nothing, re-ask next run. runEmailVerification
+  // already printed the specific reason (cancelled / technical / exhausted).
+  process.stdout.write(`  ${c.notObtained}\n\n`);
+  return null;
+}
+
+module.exports = { runConsentPrompt, defaultVerifyEmail };

package/src/consent-skip.js

@@ -0,0 +1,27 @@
+'use strict';
+
+// Explains WHY the consent-to-persist prompt is skipped (or might not complete) this run, instead of doing so silently (talents-ai-score, DX).
+function computeConsentSkip({ decision, emailVerified, stdinIsTTY, consentFilePath, catalog } = {}) {
+  const c = catalog && catalog.consent;
+
+  // Only a TERMINAL decision is skippable: an explicit DECLINE, or a GRANT whose email ownership was actually verified.
+  const terminal =
+    decision === 'denied' ||
+    (decision === 'granted' && emailVerified !== false);
+
+  if (terminal) {
+    const message = c && typeof c.skipAlreadyDecided === 'function'
+      ? c.skipAlreadyDecided(decision, consentFilePath)
+      : null;
+    return { skip: true, message };
+  }
+
+  if (!stdinIsTTY) {
+    const message = c ? c.nonInteractiveWarning || null : null;
+    return { skip: false, message };
+  }
+
+  return { skip: false, message: null };
+}
+
+module.exports = { computeConsentSkip };

package/src/decisions-extract.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const { eachHumanText } = require('./transcript-turns');
+const { scrubSecrets } = require('./agent-synthesis');
+
+const MAX_EXCERPTS = 20;
+const MAX_EXCERPT_LEN = 200;
+
+const DECISION_RE =
+  /\b(decid\w*|decision|decisión|vamos a|vamos con|voy con|let'?s|we'?ll|we will|prefer|prefiero|option|opción|elij\w*|choose|chose|choice|pick|go with|descarta\w*|opta|trade-?off|instead of|en vez de|en lugar de|rather than|because|porque|reason|razón)\b/i;
+
+function makeDecisionsAccumulator() {
+  let decisionExchangeCount = 0;
+  const excerpts = [];
+  const seen = new Set();
+  return {
+    add(text) {
+      if (!DECISION_RE.test(text)) return;
+      decisionExchangeCount += 1;
+      if (excerpts.length >= MAX_EXCERPTS) return;
+      const scrubbed = scrubSecrets(text)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_EXCERPT_LEN);
+      if (scrubbed && !seen.has(scrubbed)) {
+        seen.add(scrubbed);
+        excerpts.push(scrubbed);
+      }
+    },
+    result() {
+      if (decisionExchangeCount === 0) return null;
+      return { decisionExchangeCount, redactedDecisionExcerpts: excerpts };
+    },
+  };
+}
+
+function collectDecisions(env = process.env, selectedCwds = null) {
+  const acc = makeDecisionsAccumulator();
+  for (const text of eachHumanText(env, { selectedCwds })) acc.add(text);
+  return acc.result();
+}
+
+module.exports = { collectDecisions, makeDecisionsAccumulator };

package/src/detect-repos.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const { execFileSync } = require('child_process');
+const path = require('path');
+const {
+  toolSources,
+  listSessionFiles,
+  readSessionObjects,
+  resolveFileCwd,
+} = require('./session-scan');
+const { normalizeRemote } = require('./authorship');
+
+const GIT_TIMEOUT_MS = 15000;
+
+function git(cwd, args) {
+  try {
+    const out = execFileSync('git', ['-C', cwd, ...args], {
+      encoding: 'utf8',
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 4 * 1024 * 1024,
+    });
+    return out ? out.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+function repoIdentityForCwd(cwd, gitRunner = git) {
+  const toplevel = gitRunner(cwd, ['rev-parse', '--show-toplevel']) || null;
+  const remoteRaw = gitRunner(cwd, ['config', '--get', 'remote.origin.url']);
+  const remote = remoteRaw && remoteRaw.trim() ? normalizeRemote(remoteRaw.trim()) : null;
+  return { toplevel, remote };
+}
+
+function sessionCwdCounts(env = process.env) {
+  const counts = new Map();
+  let unassigned = 0;
+  for (const source of toolSources(env)) {
+    for (const file of listSessionFiles(source.dir)) {
+      const cwd = resolveFileCwd(readSessionObjects(file));
+      if (cwd === null) {
+        unassigned += 1;
+        continue;
+      }
+      counts.set(cwd, (counts.get(cwd) || 0) + 1);
+    }
+  }
+  return { counts, unassigned };
+}
+
+function labelFor(remote, groupKey) {
+  if (remote) return remote;
+  return path.basename(groupKey) || groupKey;
+}
+
+function detectRepos(env = process.env, { gitRunner = git } = {}) {
+  const { counts, unassigned } = sessionCwdCounts(env);
+
+  const byGroup = new Map();
+  for (const [cwd, sessionCount] of counts) {
+    const { toplevel, remote } = repoIdentityForCwd(cwd, gitRunner);
+    const groupKey = toplevel || cwd;
+    let group = byGroup.get(groupKey);
+    if (!group) {
+      group = {
+        toplevel: toplevel || null,
+        remote: remote || null,
+        cwds: new Set(),
+        sessionCount: 0,
+        resolved: !!toplevel,
+      };
+      byGroup.set(groupKey, group);
+    }
+    group.cwds.add(cwd);
+    group.sessionCount += sessionCount;
+    if (!group.remote && remote) group.remote = remote;
+  }
+
+  const repos = [...byGroup.entries()]
+    .map(([groupKey, g]) => ({
+      id: g.remote || g.toplevel || groupKey,
+      toplevel: g.toplevel,
+      remote: g.remote,
+      label: labelFor(g.remote, groupKey),
+      sessionCount: g.sessionCount,
+      cwds: [...g.cwds].sort(),
+      resolved: g.resolved,
+    }))
+    .sort(
+      (a, b) => b.sessionCount - a.sessionCount || a.label.localeCompare(b.label),
+    );
+
+  return { repos, unassignedSessionCount: unassigned };
+}
+
+function normalizeFlagToken(token) {
+  return String(token || '').trim().toLowerCase().replace(/\/+$/, '');
+}
+
+function repoMatchesToken(repo, token) {
+  const t = normalizeFlagToken(token);
+  if (!t) return false;
+  return [repo.id, repo.remote, repo.toplevel, repo.label, path.basename(repo.toplevel || repo.id)]
+    .filter((x) => typeof x === 'string' && x)
+    .some((x) => normalizeFlagToken(x) === t || normalizeFlagToken(x).endsWith(`/${t}`));
+}
+
+function matchReposByFlag(repos, tokens) {
+  const indices = new Set();
+  const unmatched = [];
+  for (const token of tokens || []) {
+    const idx = repos.findIndex((r) => repoMatchesToken(r, token));
+    if (idx === -1) unmatched.push(token);
+    else indices.add(idx);
+  }
+  return { indices: [...indices].sort((a, b) => a - b), unmatched };
+}
+
+function scopeFromSelection(repos, indices) {
+  const selectedCwds = new Set();
+  const selectedToplevels = [];
+  for (const i of indices) {
+    const repo = repos[i];
+    if (!repo) continue;
+    for (const c of repo.cwds) selectedCwds.add(c);
+    selectedToplevels.push(repo.toplevel || repo.id);
+  }
+  return { selectedCwds, selectedToplevels };
+}
+
+function indexOfCurrentRepo(repos, cwdToplevel) {
+  if (!cwdToplevel) return -1;
+  return repos.findIndex((r) => r.toplevel === cwdToplevel);
+}
+
+module.exports = {
+  detectRepos,
+  repoIdentityForCwd,
+  sessionCwdCounts,
+  matchReposByFlag,
+  repoMatchesToken,
+  scopeFromSelection,
+  indexOfCurrentRepo,
+};

package/src/detected-tools.js

@@ -0,0 +1,15 @@
+'use strict';
+
+// Single source of truth for turning a tools array ({id, name, detected}) into what the report shows.
+
+function detectedTools(tools) {
+  return Array.isArray(tools) ? tools.filter((t) => t && t.detected === true) : [];
+}
+
+function detectedToolNames(tools) {
+  return detectedTools(tools)
+    .map((t) => (t && (t.name || t.id)) || null)
+    .filter(Boolean);
+}
+
+module.exports = { detectedTools, detectedToolNames };

package/src/detection-evidence.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const { collectAuthorship, attributeSample } = require('./authorship');
+const { detectTechnologyManifests } = require('./tech-detector');
+const { agentSourceFilesByName } = require('./agent-org-chart');
+const { classifyVendored, collectProvenance } = require('./detection-noise');
+
+// Per-CANDIDATE authorship + depth (hybrid evaluation, Slice 3c).
+
+const SKILL_DEPTH_SATURATION = 3;
+const AGENT_DEPTH_SATURATION = 8;
+const DEPTH_FLOOR = 0.3;
+
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+
+// Maps a raw count to (0,1]: DEPTH_FLOOR..1, so a detected-but-shallow candidate
+// is ordered DOWN without being excluded. `null` when there is no signal.
+function normalizedDepth(signal, saturation) {
+  if (typeof signal !== 'number' || !Number.isFinite(signal) || signal <= 0) {
+    return null;
+  }
+  const ratio = Math.min(1, signal / saturation);
+  return round2(DEPTH_FLOOR + (1 - DEPTH_FLOOR) * ratio);
+}
+
+function recencyDaysForPaths(relPaths, authorship, nowSeconds) {
+  if (!Array.isArray(relPaths) || relPaths.length === 0) return null;
+  let mostRecent = null;
+  for (const p of relPaths) {
+    const t = authorship.mostRecentCommitTime(p);
+    if (typeof t === 'number' && Number.isFinite(t)) {
+      mostRecent = mostRecent === null ? t : Math.max(mostRecent, t);
+    }
+  }
+  if (mostRecent === null) return null;
+  return Math.max(0, Math.floor((nowSeconds - mostRecent) / 86400));
+}
+
+// Attributes a candidate's evidence files against the talent's own email via the ADR-017 gate.
+function attributionCounts(relPaths, verifiedEmail, authorship) {
+  if (!Array.isArray(relPaths) || relPaths.length === 0) {
+    return { authoredFileCount: 0, totalFileCount: 0, authorshipKnown: false };
+  }
+  const result = attributeSample(
+    { files: relPaths.map((p) => ({ path: p })) },
+    verifiedEmail,
+    authorship,
+  );
+  const totalFileCount = result.fileAttribution.filter(
+    (f) => f.authors.length > 0,
+  ).length;
+  return {
+    authoredFileCount: result.attributableFiles.length,
+    totalFileCount,
+    authorshipKnown: authorship.available && totalFileCount > 0,
+  };
+}
+
+// Builds `report.detectionEvidence` = `{ skills, agents, provenance } | null`.
+function collectDetectionEvidence(root, verifiedEmail, report) {
+  const scanRoot = root || process.cwd();
+  const authorship = collectAuthorship(scanRoot);
+  const nowSeconds = Math.floor(Date.now() / 1000);
+
+  const skills = detectTechnologyManifests(scanRoot).map(
+    ({ tech, manifestPaths }) => ({
+      tech,
+      ...attributionCounts(manifestPaths, verifiedEmail, authorship),
+      depth: normalizedDepth(manifestPaths.length, SKILL_DEPTH_SATURATION),
+      vendored: classifyVendored(manifestPaths),
+      recencyDays: recencyDaysForPaths(manifestPaths, authorship, nowSeconds),
+    }),
+  );
+
+  const sourceByName = agentSourceFilesByName(scanRoot);
+  const reportAgents =
+    report && Array.isArray(report.agents) ? report.agents : [];
+  const agents = reportAgents.map((agent) => {
+    const rel = sourceByName.get(agent.name) || null;
+    const tools = Array.isArray(agent.tools) ? agent.tools : [];
+    const evidencePaths = rel ? [rel] : [];
+    return {
+      name: agent.name,
+      tools,
+      model: agent.model || null,
+      ...attributionCounts(evidencePaths, verifiedEmail, authorship),
+      depth: normalizedDepth(tools.length, AGENT_DEPTH_SATURATION),
+      vendored: classifyVendored(evidencePaths),
+      recencyDays: recencyDaysForPaths(evidencePaths, authorship, nowSeconds),
+    };
+  });
+
+  if (skills.length === 0 && agents.length === 0) return null;
+  return { skills, agents, provenance: collectProvenance(scanRoot) };
+}
+
+module.exports = {
+  collectDetectionEvidence,
+  normalizedDepth,
+  SKILL_DEPTH_SATURATION,
+  AGENT_DEPTH_SATURATION,
+  DEPTH_FLOOR,
+};

package/src/detection-noise.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Anti-noise CLASSIFICATION for detected candidates (hybrid evaluation, Slice 3 — issue 019).
+
+const GIT_TIMEOUT_MS = 15000;
+const README_MAX_BYTES = 8 * 1024;
+
+// Directory segments that mark a path as vendored / generated (dependency trees, build output, virtualenvs, package caches).
+const VENDORED_SEGMENTS = new Set([
+  // JS / general
+  'node_modules', 'bower_components', '.pnp', 'jspm_packages',
+  // generic vendoring
+  'vendor', 'vendored', 'third_party', 'third-party', 'external', 'deps',
+  // build / generated output
+  'dist', 'build', 'out', 'generated', '__generated__',
+  '.next', '.nuxt', '.output', '.svelte-kit', '.turbo', '.cache',
+  // Python
+  '.venv', 'venv', 'virtualenv', 'site-packages', '__pycache__',
+  // iOS / macOS / other package managers
+  'pods', 'carthage',
+  // JVM / Rust build output
+  'target', '.gradle',
+  // IaC provider plugins
+  '.terraform',
+]);
+
+// True when ANY segment of the (root-relative, POSIX) path is a vendored
+// segment. Case-insensitive so `Pods`/`pods` both match.
+function isVendoredPath(relPath) {
+  if (typeof relPath !== 'string' || !relPath) return false;
+  return relPath
+    .split('/')
+    .some((seg) => VENDORED_SEGMENTS.has(seg.toLowerCase()));
+}
+
+// A candidate's evidence is VENDORED-dominated when it has at least one evidence path AND every one of them is vendored.
+function classifyVendored(evidencePaths) {
+  if (!Array.isArray(evidencePaths) || evidencePaths.length === 0) return false;
+  return evidencePaths.every(isVendoredPath);
+}
+
+function runGit(root, args) {
+  try {
+    return execFileSync('git', ['-C', root, ...args], {
+      encoding: 'utf8',
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 4 * 1024 * 1024,
+    });
+  } catch {
+    return null;
+  }
+}
+
+// LOW-CONFIDENCE fork signal: a git remote named `upstream` alongside `origin` is the canonical local convention for a fork's parent.
+function detectFork(root) {
+  const out = runGit(root, ['remote']);
+  if (out === null) return { fork: false, forkSignal: null };
+  const remotes = new Set(
+    out
+      .split('\n')
+      .map((l) => l.trim())
+      .filter(Boolean),
+  );
+  if (remotes.has('upstream')) {
+    return { fork: true, forkSignal: 'upstream-remote' };
+  }
+  return { fork: false, forkSignal: null };
+}
+
+// Scaffolder README signatures.
+const BOILERPLATE_MARKERS = [
+  { id: 'create-react-app', re: /bootstrapped with \[?create react app/i },
+  { id: 'create-next-app', re: /bootstrapped with \[?`?create-next-app/i },
+  { id: 'vite-starter', re: /this template provides a minimal setup to get .*working in vite/i },
+  { id: 'angular-cli', re: /generated with \[?angular ?cli/i },
+  { id: 'nuxt-starter', re: /nuxt[\s\d]*minimal starter/i },
+  { id: 'create-svelte', re: /(create-svelte|everything you need to build a svelte project)/i },
+];
+
+const README_NAMES = ['README.md', 'README', 'readme.md', 'Readme.md'];
+
+function readReadmeHead(root) {
+  for (const name of README_NAMES) {
+    const abs = path.join(root, name);
+    try {
+      const fd = fs.openSync(abs, 'r');
+      try {
+        const buf = Buffer.alloc(README_MAX_BYTES);
+        const bytes = fs.readSync(fd, buf, 0, README_MAX_BYTES, 0);
+        return buf.toString('utf8', 0, bytes);
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch {
+      // try the next candidate name
+    }
+  }
+  return null;
+}
+
+// Repo-level boilerplate flag from an unmodified scaffolder README.
+function detectBoilerplate(root) {
+  const head = readReadmeHead(root);
+  if (!head) return { boilerplate: false, boilerplateMarker: null };
+  for (const { id, re } of BOILERPLATE_MARKERS) {
+    if (re.test(head)) return { boilerplate: true, boilerplateMarker: id };
+  }
+  return { boilerplate: false, boilerplateMarker: null };
+}
+
+// Repo-level provenance context for the whole scan.
+function collectProvenance(root) {
+  const scanRoot = root || process.cwd();
+  return {
+    ...detectFork(scanRoot),
+    ...detectBoilerplate(scanRoot),
+  };
+}
+
+module.exports = {
+  VENDORED_SEGMENTS,
+  isVendoredPath,
+  classifyVendored,
+  detectFork,
+  detectBoilerplate,
+  collectProvenance,
+};