shakers-cli-beta 0.8.0-beta.1 → 0.8.0-beta.3

package/bin/mcp.js

@@ -42,7 +42,7 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `  MCP client, not run by hand.\n`
   + `  Tools: ai_usage, ai_usage_result, login, logout, social_signin_start, social_signin_poll,\n`
   + `         list_addable, add_skill, add_agent,\n`
-  + `         add_project, register, register_status, onboarding_interview_start,\n`
+  + `         add_project, suggest_register_context, read_cv, register_preview, register, register_status, onboarding_interview_start,\n`
   + `         onboarding_interview_turn, onboarding_interview_complete,\n`
   + `         repeat_onboarding_interview, onboarding_finish,\n`
   + `         list_available_roles, add_role, list_my_roles, set_main_role,\n`
@@ -74,7 +74,7 @@ async function run(argv = process.argv.slice(2)) {
     return;
   }
 
-  require('../src/config').ensureLocalConfigDefaults(process.env, { force: true });
+  require('../src/config').sanitizeStaleBakedEndpoints(process.env);
 
   const server = buildServer();
   const rl = server.start({

package/bin/register.js

@@ -8,10 +8,10 @@ const { run: runLogin } = require('./login');
 const { run: runAiUsage } = require('./ai-usage');
 const {
   runOnboarding, makeDeps, CURRENCIES, MONTHLY_HOURS, normalizeAmount,
-  WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS, CHANGE_MOTIVATORS,
+  WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS, CHANGE_MOTIVATORS, WORK_MODES,
   LANGUAGE_CODES, LANGUAGE_LEVELS, showsFreelanceOpinion, showsChangeMotivators,
 } = require('../src/onboarding-flow');
-const { promptSelect } = require('../src/prompt-select');
+const { promptSelect, promptMultiSelect } = require('../src/prompt-select');
 const { chooseAuthMethod } = require('../src/auth-method-picker');
 const { methodIdsForFlow } = require('../src/auth-methods');
 const { palette } = require('../src/ansi');
@@ -123,7 +123,16 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
     askAvailability: async (c) => {
       const available = isYes(await ask(`  ${c.availableAsk} `));
       const monthlyHours = await promptSelect({ ask, stdinIsTTY, out: selectOut, items: MONTHLY_HOURS, header: `  ${c.monthlyHoursAsk}` });
-      const onlyRemote = isYes(await ask(`  ${c.onlyRemoteAsk} `));
+      const workModes = await promptMultiSelect({
+        ask,
+        stdinIsTTY,
+        out: selectOut,
+        items: WORK_MODES,
+        labelFor: (v) => c.workModeLabels[v] || v,
+        header: `  ${c.workModesAsk}`,
+        hint: c.workModesHint,
+      });
+      if (workModes.length === 1 && workModes[0] === 'REMOTE') selectOut(c.onlyRemoteNote);
       let country = '';
       for (;;) {
         country = (await ask(`  ${c.countryAsk} `)).trim().toUpperCase();
@@ -137,7 +146,7 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       const longFullTimeProjects = isYes(await ask(`  ${c.longFullTimeAsk} `));
       const telephoneCode = (await ask(`  ${c.phonePrefixAsk} `)).trim();
       const telephoneNumber = (await ask(`  ${c.phoneNumberAsk} `)).trim();
-      return { available, monthlyHours, onlyRemote, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
+      return { available, monthlyHours, workModes, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
     },
     askSignUp: async (c) => {
       const name = (await ask(`  ${c.askName} `)).trim();

package/bin/shakers.js

@@ -14,7 +14,7 @@ const { detectReportLang, getCatalog } = require('../src/i18n');
 const { promptSelect } = require('../src/prompt-select');
 const { createStdinAsk } = require('../src/stdin-ask');
 const { migrateLegacyConfigDir } = require('../src/config-dir');
-const { ensureLocalConfigDefaults } = require('../src/config');
+const { sanitizeStaleBakedEndpoints } = require('../src/config');
 const { ensureFreshSession } = require('../src/session-refresh');
 const { hasUsableSession } = require('../src/session-gate');
 const { run: runAiUsage } = require('./ai-usage');
@@ -290,7 +290,7 @@ async function main() {
   const lang = parseLang(argv) || detectReportLang();
 
   migrateLegacyConfigDir(process.env);
-  ensureLocalConfigDefaults(process.env);
+  sanitizeStaleBakedEndpoints(process.env);
   // Mint a fresh hub JWT from the stored cookie once per command (email sessions only; a no-op for Google/legacy or when no session exists).
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.8.0-beta.1",
+  "version": "0.8.0-beta.3",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/availability-client.js

@@ -5,6 +5,7 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
+const { WORK_MODES } = require('./onboarding-flow');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -36,7 +37,7 @@ function normalizeAvailability(data) {
     available: bool(it.available),
     // A numeric hours value (incl. 0) must survive, not be dropped as "absent".
     monthlyHours: typeof it.monthlyHours === 'number' ? String(it.monthlyHours) : str(it.monthlyHours),
-    onlyRemote: bool(it.onlyRemote),
+    workModes: Array.isArray(it.workModes) ? it.workModes.filter((m) => WORK_MODES.includes(m)) : [],
     country: str(it.country),
     subdivision: str(it.subdivision),
     timezone: str(it.timezone),

package/src/availability-flow.js

@@ -4,6 +4,7 @@
 // (interactive, explicit confirmation — it writes your profile). Talent Bearer.
 
 const { styleLabelPrefix } = require('./ansi');
+const { WORK_MODES, validateAvailability } = require('./onboarding-flow');
 
 function makeAvailabilityDeps(overrides = {}) {
   const client = require('./availability-client');
@@ -11,10 +12,15 @@ function makeAvailabilityDeps(overrides = {}) {
     fetchAvailability: (opts) => client.fetchAvailability({}, opts),
     saveAvailability: (opts) => client.saveAvailability({}, opts),
     promptSelect: (opts) => require('./prompt-select').promptSelect(opts),
+    promptMultiSelect: (opts) => require('./prompt-select').promptMultiSelect(opts),
     ...overrides,
   };
 }
 
+function workModesLine(fp, modes) {
+  return modes && modes.length ? modes.map((m) => fp.workModeLabels[m] || m).join(', ') : fp.unknown;
+}
+
 function locationLine(a) {
   return [a.country, a.subdivision, a.timezone].filter(Boolean).join(' · ') || null;
 }
@@ -23,7 +29,7 @@ function renderView(io, fp, a) {
   io.section(fp.title);
   io.notify(styleLabelPrefix(fp.openToWork(a.available === true ? fp.yes : a.available === false ? fp.no : fp.unknown)));
   io.notify(styleLabelPrefix(fp.monthlyHours(a.monthlyHours != null ? a.monthlyHours : fp.unknown)));
-  io.notify(styleLabelPrefix(fp.onlyRemote(a.onlyRemote === true ? fp.yes : a.onlyRemote === false ? fp.no : fp.unknown)));
+  io.notify(styleLabelPrefix(fp.workModes(workModesLine(fp, a.workModes))));
   const loc = locationLine(a);
   if (loc) io.notify(styleLabelPrefix(fp.location(loc)));
   if (a.availabilityExpiringDate) io.notify(styleLabelPrefix(fp.expires(a.availabilityExpiringDate)));
@@ -57,18 +63,31 @@ async function runSet({ io, ask, session, catalog, opts, deps }) {
   const available = openPick.value;
   const hoursRaw = (await io.ask(fp.askMonthlyHours)).trim();
   if (hoursRaw && !/^\d{1,3}$/.test(hoursRaw)) { io.error(fp.monthlyHoursInvalid); return { ok: false, reason: 'bad-hours' }; }
-  const remotePick = await pickYesNo(fp.askOnlyRemote);
-  if (!remotePick) { io.notify(fp.setCancelled); return { ok: true, cancelled: true }; }
-  const onlyRemote = remotePick.value;
+  const pickedModes = await deps.promptMultiSelect({
+    ask,
+    stdinIsTTY: opts.stdinIsTTY,
+    out: selOut,
+    items: WORK_MODES,
+    labelFor: (v) => fp.workModeLabels[v] || v,
+    header: fp.workModesAsk,
+    hint: fp.workModesHint,
+    initialMarked: (current && Array.isArray(current.workModes)) ? current.workModes.map((m) => WORK_MODES.indexOf(m)).filter((i) => i >= 0) : [],
+    input: opts.input,
+    output: opts.output,
+  });
+  // Reuse the register validation (dedupe/upcase, enum check) — no duplicated logic.
+  const workModes = validateAvailability({ workModes: pickedModes }).availability.workModes || [];
+  if (workModes.length === 1 && workModes[0] === 'REMOTE') io.notify(fp.onlyRemoteNote);
 
   // Only the asked fields ride the partial upsert.
-  const body = { available, onlyRemote };
+  const body = { available };
   if (hoursRaw) body.monthlyHours = hoursRaw;
+  if (workModes.length) body.workModes = workModes;
 
   io.notify(fp.setDiff(
     `${available ? fp.yes : fp.no}`,
     hoursRaw || (current && current.monthlyHours) || fp.unknown,
-    `${onlyRemote ? fp.yes : fp.no}`,
+    workModesLine(fp, workModes),
   ));
   const confirmed = await io.confirm(fp.setConfirm);
   if (!confirmed) { io.notify(fp.setCancelled); return { ok: true, cancelled: true }; }

package/src/backend-request.js

@@ -39,6 +39,13 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
         method,
         headers: {
           Accept: 'application/json',
+          // Lets the backend (and Datadog) tell CLI/MCP traffic apart from the
+          // browser without touching auth — same value regardless of which
+          // bin/ entrypoint is running, since none of them plumb through here
+          // separately today. Set unconditionally so no caller can drop it via
+          // extraHeaders (sanitizeExtraHeaders runs after this, so it can only
+          // add headers, not remove this one).
+          'X-Shakers-Client': 'cli',
           // Only declared when there IS a body — see the bodyless note above.
           ...(data ? { 'Content-Type': 'application/json', 'Content-Length': data.length } : {}),
           ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}),
@@ -98,6 +105,14 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
     const chunks = [];
     for (const [name, value] of Object.entries(fields || {})) {
       if (value === undefined || value === null) continue;
+      // A file part: { filename, contentType, data: Buffer }.
+      if (typeof value === 'object' && Buffer.isBuffer(value.data)) {
+        const filename = String(value.filename || 'file').replace(/["\r\n\0]/g, '');
+        const contentType = String(value.contentType || 'application/octet-stream').replace(UNSAFE_HEADER_VALUE_RE, '');
+        chunks.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${name}"; filename="${filename}"\r\nContent-Type: ${contentType}\r\n\r\n`));
+        chunks.push(value.data, Buffer.from('\r\n'));
+        continue;
+      }
       const clean = String(value).replace(UNSAFE_HEADER_VALUE_RE, '');
       chunks.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${clean}\r\n`));
     }
@@ -109,6 +124,8 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
         method,
         headers: {
           Accept: 'application/json',
+          // See postJsonWithTimeout's identical header for why.
+          'X-Shakers-Client': 'cli',
           'Content-Type': `multipart/form-data; boundary=${boundary}`,
           'Content-Length': data.length,
           ...sanitizeExtraHeaders(extraHeaders),

package/src/config.js

@@ -196,7 +196,11 @@ function getCertsBase(env = process.env) {
   }
   const ingest = explicitIngest(env);
   if (ingest) return ingest.replace(/\/usage\/reports\/?$/, '').replace(/\/+$/, '');
-  return null;
+  // No explicit override anywhere -> the baked flavor profile (never null when a
+  // profile exists), so switching the published flavor "just works" without a
+  // seeded config.json (ADR-065 revised).
+  const baked = getEnvProfile(env).certsBase;
+  return baked ? baked.replace(/\/+$/, '') : null;
 }
 
 function getIngestEndpoint(env = process.env) {
@@ -507,9 +511,10 @@ function getHubBase(env = process.env) {
   const fromFile = loadConfigFile(env).hubBase;
   if (fromFile && String(fromFile).trim()) {
     const v = validateEndpoint(String(fromFile).trim());
-    return v.ok ? v.value.replace(/\/+$/, '') : null;
+    if (v.ok) return v.value.replace(/\/+$/, '');
   }
-  return null;
+  const baked = getEnvProfile(env).hubBase;
+  return baked ? baked.replace(/\/+$/, '') : null;
 }
 
 function deriveFromHub(env, relativePath) {
@@ -623,20 +628,39 @@ function getTalentProfileUrl(env = process.env) {
   if (explicit && explicit.trim()) return explicit.trim().replace(/\/+$/, '');
   const fromFile = loadConfigFile(env).profileUrl;
   if (fromFile && String(fromFile).trim()) return String(fromFile).trim().replace(/\/+$/, '');
-  return null;
-}
-
-// First-run local bootstrap: seed config.json with the baked flavor bases (ADR-065)
-// so the talent CLI/MCP works with zero exports; the flavor is resolved per-call
-// (SHAKERS_CLI_ENV > package name > dev) so env overrides still take precedence.
-function ensureLocalConfigDefaults(env = process.env, { force = false } = {}) {
-  if (!force && !isTalentProfile(env)) return false;
-  const defaults = getEnvProfile(env);
+  const baked = getEnvProfile(env).profileUrl;
+  return baked ? baked.replace(/\/+$/, '') : null;
+}
+
+// The endpoint keys a flavor profile owns. config.json must hold only EXPLICIT
+// user overrides of these, never the baked profile itself.
+const PROFILE_ENDPOINT_KEYS = Object.keys(ENV_PROFILES[DEFAULT_ENV_PROFILE]);
+
+// Boot migration (ADR-065 revised). The CLI used to SEED config.json with the
+// baked bases on first run; the getters now fall back to getEnvProfile() directly,
+// so seeding is unnecessary AND harmful: `npm uninstall` leaves the config dir, so
+// a config.json seeded by a previous flavor (e.g. the private @shakers build → dev)
+// survives into a new flavor (the public beta → staging) and pins the old endpoints
+// forever, since config.json wins over the baked profile. This sweep removes any
+// endpoint key whose value is byte-identical to that SAME field in a KNOWN profile
+// OTHER than the baked one — i.e. a value that could only have gotten there by the
+// old seeding of a different flavor. A value that matches no known profile is a
+// genuine user override (set via `shakers config set`) and is left untouched. We
+// never touch env, auth-session.json or consent.json, and never remove the dir.
+function sanitizeStaleBakedEndpoints(env = process.env) {
+  const bakedName = getEnvProfileName(env);
   const config = loadConfigFile(env);
   let changed = false;
-  for (const [key, value] of Object.entries(defaults)) {
-    if (!(config[key] && String(config[key]).trim())) {
-      config[key] = value;
+  for (const key of PROFILE_ENDPOINT_KEYS) {
+    const current = config[key];
+    if (typeof current !== 'string' || !current.trim()) continue;
+    const normalized = current.trim().replace(/\/+$/, '');
+    const matchesForeignProfile = Object.entries(ENV_PROFILES).some(
+      ([name, profile]) =>
+        name !== bakedName && String(profile[key]).replace(/\/+$/, '') === normalized,
+    );
+    if (matchesForeignProfile) {
+      delete config[key];
       changed = true;
     }
   }
@@ -744,7 +768,7 @@ module.exports = {
   // Onboarding / register flow (evaluation-mcp, ADR-011..015/024).
   getCertsBase,
   getHubBase,
-  ensureLocalConfigDefaults,
+  sanitizeStaleBakedEndpoints,
   getSignUpEndpoint,
   getImportProfileEndpoint,
   getProfessionalDetailsEndpoint,

package/src/cv-text.js

@@ -0,0 +1,57 @@
+'use strict';
+
+// Plain text out of the talent's CV PDF, so the AI can pre-fill from what the CV
+// says. Zero-dependency on purpose (install.sh copies the CLI without npm
+// install): macOS reads it with the system PDFKit through JXA, elsewhere with
+// poppler's pdftotext when it is installed. With neither, the caller asks the
+// talent to attach the CV to the chat instead.
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { expandHome } = require('./env-paths');
+
+const MAX_BYTES = 10 * 1024 * 1024;
+const MAX_CHARS = 20000;
+
+const JXA_PDF_TEXT = 'function run(argv){ObjC.import("PDFKit");'
+  + 'const d=$.PDFDocument.alloc.initWithURL($.NSURL.fileURLWithPath(argv[0]));'
+  + 'return d.isNil()?"":d.string.js}';
+
+function run(cmd, args, exec) {
+  return String(exec(cmd, args, { encoding: 'utf8', timeout: 20000, maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] }) || '');
+}
+
+function extractors(platform) {
+  const list = [];
+  if (platform === 'darwin') list.push({ name: 'pdfkit', cmd: 'osascript', args: (file) => ['-l', 'JavaScript', '-e', JXA_PDF_TEXT, file] });
+  list.push({ name: 'pdftotext', cmd: 'pdftotext', args: (file) => ['-layout', '-q', file, '-'] });
+  return list;
+}
+
+function readCvText(input, { platform = process.platform, exec = execFileSync, env = process.env } = {}) {
+  const file = expandHome(input, env);
+  if (typeof file !== 'string' || !path.isAbsolute(file) || !/\.pdf$/i.test(file)) return { ok: false, reason: 'not-a-pdf-path' };
+  let stat;
+  try {
+    stat = fs.statSync(file);
+  } catch {
+    return { ok: false, reason: 'not-found' };
+  }
+  if (!stat.isFile()) return { ok: false, reason: 'not-found' };
+  if (stat.size > MAX_BYTES) return { ok: false, reason: 'too-large' };
+
+  for (const extractor of extractors(platform)) {
+    let text;
+    try {
+      text = run(extractor.cmd, extractor.args(file), exec).trim();
+    } catch {
+      continue;
+    }
+    if (!text) continue;
+    return { ok: true, extractor: extractor.name, truncated: text.length > MAX_CHARS, text: text.slice(0, MAX_CHARS) };
+  }
+  return { ok: false, reason: 'no-text-extracted' };
+}
+
+module.exports = { readCvText, MAX_CHARS };

package/src/env-paths.js

@@ -13,4 +13,18 @@ function getHomeDir(env = process.env) {
   return readEnv(env, 'HOME_DIR') || os.homedir();
 }
 
-module.exports = { getHomeDir, readEnv };
+// `~/Documents/cv.pdf` -> absolute, so a model can pass the short form it was shown.
+function expandHome(file, env = process.env) {
+  if (typeof file !== 'string') return file;
+  if (file === '~') return getHomeDir(env);
+  if (file.startsWith('~/')) return require('path').join(getHomeDir(env), file.slice(2));
+  return file;
+}
+
+// The short `~/...` form of a path under home, for showing (and copying) without typos.
+function tildify(file, env = process.env) {
+  const home = getHomeDir(env);
+  return typeof file === 'string' && file.startsWith(`${home}/`) ? `~/${file.slice(home.length + 1)}` : file;
+}
+
+module.exports = { getHomeDir, readEnv, expandHome, tildify };

package/src/i18n.js

@@ -86,7 +86,10 @@ const catalogs = {
       availabilityAsk: 'Quieres indicar tu disponibilidad y ubicacion ahora? (s/n):',
       availableAsk: 'Estas disponible para nuevos proyectos? (s/n):',
       monthlyHoursAsk: 'Cuantas horas al mes?',
-      onlyRemoteAsk: 'Trabajas solo en remoto? (s/n):',
+      workModesAsk: 'En que modalidad quieres trabajar? (marca una o varias)',
+      workModeLabels: { REMOTE: 'Remoto', HYBRID: 'Hibrido', IN_PERSON: 'Presencial' },
+      workModesHint: 'Espacio para marcar/desmarcar · Enter para confirmar',
+      onlyRemoteNote: 'Has marcado solo Remoto: no veras proyectos hibridos ni presenciales.',
       countryAsk: 'Pais (codigo ISO-2 de 2 letras, p.ej. ES):',
       countryInvalid: 'Codigo de pais no valido. Usa 2 letras (p.ej. ES, US, GB).',
       subdivisionAsk: 'Provincia o region (opcional, Enter para omitir):',
@@ -918,7 +921,7 @@ const catalogs = {
       notFound: 'Aún no has definido tu disponibilidad.',
       openToWork: (v) => `Abierto a trabajar: ${v}`,
       monthlyHours: (v) => `Horas al mes: ${v}`,
-      onlyRemote: (v) => `Solo remoto: ${v}`,
+      workModes: (v) => `Modalidad: ${v}`,
       location: (v) => `Ubicación: ${v}`,
       expires: (v) => `Caduca: ${v}`,
       yes: 'sí',
@@ -930,8 +933,11 @@ const catalogs = {
       askOpenToWork: '¿Estás abierto a trabajar?',
       askMonthlyHours: 'Horas al mes (número, p. ej. 40; Enter para no cambiar):',
       monthlyHoursInvalid: 'Horas no válidas. Escribe solo el número (p. ej. 40).',
-      askOnlyRemote: '¿Solo trabajo remoto?',
-      setDiff: (open, hours, remote) => `Nuevo: abierto=${open} · ${hours} h/mes · solo remoto=${remote}`,
+      workModesAsk: 'En que modalidad quieres trabajar? (marca una o varias)',
+      workModeLabels: { REMOTE: 'Remoto', HYBRID: 'Hibrido', IN_PERSON: 'Presencial' },
+      workModesHint: 'Espacio para marcar/desmarcar · Enter para confirmar',
+      onlyRemoteNote: 'Has marcado solo Remoto: no veras proyectos hibridos ni presenciales.',
+      setDiff: (open, hours, modes) => `Nuevo: abierto=${open} · ${hours} h/mes · modalidad=${modes}`,
       setConfirm: 'Esto actualiza tu perfil. ¿Confirmas? (s/n):',
       setCancelled: 'Cancelado. No se cambió tu disponibilidad.',
       setSaving: 'Guardando tu disponibilidad…',
@@ -1696,7 +1702,10 @@ const catalogs = {
       availabilityAsk: 'Do you want to set your availability and location now? (y/n):',
       availableAsk: 'Are you available for new projects? (y/n):',
       monthlyHoursAsk: 'How many hours per month?',
-      onlyRemoteAsk: 'Do you work remote-only? (y/n):',
+      workModesAsk: 'Which work modes do you want? (select one or more)',
+      workModeLabels: { REMOTE: 'Remote', HYBRID: 'Hybrid', IN_PERSON: 'On-site' },
+      workModesHint: 'Space to toggle · Enter to confirm',
+      onlyRemoteNote: 'You selected Remote only: you will not see hybrid or on-site projects.',
       countryAsk: 'Country (2-letter ISO-2 code, e.g. ES):',
       countryInvalid: 'Invalid country code. Use 2 letters (e.g. ES, US, GB).',
       subdivisionAsk: 'State or province (optional, Enter to skip):',
@@ -2520,7 +2529,7 @@ const catalogs = {
       notFound: 'You have not set your availability yet.',
       openToWork: (v) => `Open to work: ${v}`,
       monthlyHours: (v) => `Monthly hours: ${v}`,
-      onlyRemote: (v) => `Remote only: ${v}`,
+      workModes: (v) => `Work modes: ${v}`,
       location: (v) => `Location: ${v}`,
       expires: (v) => `Expires: ${v}`,
       yes: 'yes',
@@ -2532,8 +2541,11 @@ const catalogs = {
       askOpenToWork: 'Are you open to work?',
       askMonthlyHours: 'Monthly hours (number, e.g. 40; Enter to keep):',
       monthlyHoursInvalid: 'Invalid hours. Type only the number (e.g. 40).',
-      askOnlyRemote: 'Remote work only?',
-      setDiff: (open, hours, remote) => `New: open=${open} · ${hours} h/month · remote-only=${remote}`,
+      workModesAsk: 'Which work modes do you want? (select one or more)',
+      workModeLabels: { REMOTE: 'Remote', HYBRID: 'Hybrid', IN_PERSON: 'On-site' },
+      workModesHint: 'Space to toggle · Enter to confirm',
+      onlyRemoteNote: 'You selected Remote only: you will not see hybrid or on-site projects.',
+      setDiff: (open, hours, modes) => `New: open=${open} · ${hours} h/month · work modes=${modes}`,
       setConfirm: 'This updates your profile. Confirm? (y/n):',
       setCancelled: 'Cancelled. Your availability was not changed.',
       setSaving: 'Saving your availability…',

package/src/mcp-availability-tools.js

@@ -30,7 +30,7 @@ function makeAvailabilityTools(deps = {}) {
   return [
     {
       name: 'get_availability',
-      description: "View the talent's availability: open-to-work, monthly hours, remote-only, and location. Read-only. Requires an active session. Any internal ids in the result (e.g. numeric city id) are handles for tools only — never show or mention them to the talent.",
+      description: "View the talent's availability: open-to-work, monthly hours, work modes (a combinable array of REMOTE/HYBRID/IN_PERSON), and location. Read-only. Requires an active session. Any internal ids in the result (e.g. numeric city id) are handles for tools only — never show or mention them to the talent.",
       inputSchema: GET_AVAILABILITY_SCHEMA,
       handler: getAvailability,
     },

package/src/mcp-register-tools.js

@@ -2,7 +2,7 @@
 
 const {
   FREELANCE_TYPES, WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS,
-  CHANGE_MOTIVATORS, MONTHLY_HOURS, LANGUAGE_CODES, LANGUAGE_LEVELS,
+  CHANGE_MOTIVATORS, WORK_MODES, MONTHLY_HOURS, LANGUAGE_CODES, LANGUAGE_LEVELS,
 } = require('./onboarding-flow');
 const { getCatalog } = require('./i18n');
 const { TranscriptBuffer } = require('./interview-transcript');
@@ -55,11 +55,11 @@ function buildSchemas(lang) {
 
   const AVAILABILITY_SCHEMA = {
     type: 'object',
-    description: `Availability AND location (ADR-028). ALWAYS ask this — it must not be skipped. There is NO separate location field: the talent's LOCATION (country, timezone, region) lives here. Offer the options: available (yes/no); monthlyHours must be one of ${MONTHLY_HOURS_QUOTED}; onlyRemote (yes/no — accepts only remote work); longFullTimeProjects (yes/no — open to long full-time projects). For location, ask the talent their country and timezone (region is optional). All fields optional/nullable, but collect what you can. monthlyHours is a STRICT enum string (not an int). city is not collected here.`,
+    description: `Availability AND location (ADR-028). ALWAYS ask this — it must not be skipped. There is NO separate location field: the talent's LOCATION (country, timezone, region) lives here. Offer the options: available (yes/no); monthlyHours must be one of ${MONTHLY_HOURS_QUOTED}; workModes is a MULTI-VALUE array, any combination of ${WORK_MODES.join('/')} (the talent can pick several); longFullTimeProjects (yes/no — open to long full-time projects). For location, ask the talent their country and timezone (region is optional). All fields optional/nullable, but collect what you can. monthlyHours is a STRICT enum string (not an int). city is not collected here.`,
     properties: {
       available: { type: 'boolean', description: 'Whether the talent is currently available (yes/no).' },
       monthlyHours: { type: 'string', enum: MONTHLY_HOURS, description: `Monthly hours the talent can work, exactly one of: ${MONTHLY_HOURS_QUOTED} (send '> 160' verbatim, with the space).` },
-      onlyRemote: { type: 'boolean', description: 'Whether the talent accepts only remote work (yes/no).' },
+      workModes: { type: 'array', items: { type: 'string', enum: WORK_MODES }, description: `Work modes the talent accepts — a combinable array, any subset of ${WORK_MODES.join('/')} (e.g. ['REMOTE','HYBRID']). Only REMOTE means the talent will not see hybrid or on-site projects.` },
       country: { type: 'string', description: 'LOCATION — ISO-2 country code, 2 letters (e.g. ES, US, GB).' },
       timezone: { type: 'string', description: 'LOCATION — IANA timezone (e.g. Europe/Madrid, America/New_York). Max 100 chars.' },
       subdivision: { type: 'string', description: 'LOCATION — optional region/state code (e.g. ES-CT). Max 10 chars.' },
@@ -81,14 +81,22 @@ function buildSchemas(lang) {
     required: ['name', 'lastName', 'email', 'freelanceType', 'profile', 'workSituation', 'pricing'],
   };
 
-  return { ACCOUNT_FIELDS, WORK_SITUATION_SCHEMA, LANGUAGES_SCHEMA, AVAILABILITY_SCHEMA, REGISTER_SCHEMA };
+  // Same shape as REGISTER_SCHEMA but NOTHING is required: the preview accepts a
+  // partial, pre-filled payload and reports what is still missing.
+  const PREVIEW_SCHEMA = {
+    type: 'object',
+    description: 'A partial, pre-filled register payload to REVIEW before writing. Every field is optional — fill only what the talent has said or what is verifiable from context, omit the rest. Returns what WOULD be written, what is still missing to ask, and any invalid values. Writes nothing.',
+    properties: { ...REGISTER_SCHEMA.properties },
+  };
+
+  return { ACCOUNT_FIELDS, WORK_SITUATION_SCHEMA, LANGUAGES_SCHEMA, AVAILABILITY_SCHEMA, REGISTER_SCHEMA, PREVIEW_SCHEMA };
 }
 
 // The register tool's own long description, per language: the batched
 // collection guide with friendly labels inline for every choice field.
 function buildRegisterDescription(lang) {
   const L = getCatalog(lang).onboarding;
-  return "The talent registers THEMSELVES on Shakers (self-service; no prior session needed). Your job is to relay the non-secret profile details the talent gives you in the chat as arguments. Credentials never touch the chat or any tool argument: the tool opens a sign-up window on the talent's own machine (127.0.0.1) where they either Continue with Google (no password at all) or type an email and password directly into that local window.\n\nCOLLECT THE DETAILS IN A FEW GROUPED BATCHES, not one field at a time, and for every CHOICE field PRESENT THE VALID OPTIONS so the talent just picks one. For every choice field SHOW THE TALENT THE FRIENDLY LABEL, never the raw code (e.g. show 'Nativo', not 'NATIVE'), and pass the code as the value. Suggested batches:\n1. Identity — name, lastName, email (optional: preferredLanguage, newsletterConsent).\n2. Profile — `profile.linkedinUrl` (required source; optional GitHub/website/CV path).\n3. Work — freelanceType (offer: "
+  return "The talent registers THEMSELVES on Shakers (self-service; no prior session needed). Your job is to relay the non-secret profile details the talent gives you in the chat as arguments. Credentials never touch the chat or any tool argument: the tool opens a sign-up window on the talent's own machine (127.0.0.1) where they either Continue with Google (no password at all) or type an email and password directly into that local window.\n\nSAVE THE TALENT TYPING: first call suggest_register_context (timezone, local git identity, GitHub login, CV files) and PROPOSE those values for them to confirm; then call register_preview with the partial payload to get a review (what would be written, what is still missing) and show the talent a short summary to confirm or correct BEFORE calling register. Pre-fill EVERY field you can reasonably infer from what you know about the talent (your memory of past conversations, the chat, context) — including `pricing` and `workSituation.changeMotivators`. PRICING: whenever you know anything about their role, seniority, stack or location, ALWAYS propose a concrete per-project amount yourself (full-time and/or part-time, in their currency), labelled as your estimate — do not hand the question back to the talent; only ask for it when you know nothing at all about their work. MOTIVATORS: pick the one that best matches what they have told you. What you know about the person outranks suggest_register_context: if the git identity does not match the person you know, ignore it. For each inferred value briefly say where it comes from. Ask ONLY for what you genuinely have no basis for. Use suggest_register_context's githubUrl and cvCandidates to propose profile.githubUrl and profile.cvPath (cvCandidates often include OTHER people's CVs, e.g. candidates they downloaded: propose a CV ONLY if its file name matches the talent's name — nameMatch:true or a name you know — and never one named after someone else; if none matches but there is a generic:true one like cv.pdf, ASK the talent whether it is theirs and whether you may read it and send it with the registration; otherwise ask for the path). Once the talent confirms a CV and allows it, ALWAYS call read_cv BEFORE register_preview and use its text to pre-fill or correct the other fields (languages and levels, experience, location); if the CV adds or changes any value, show the talent just those changes and get their OK before calling register; pass paths exactly as given, the short ~/ form is fine. For optional fields you have no basis for (phone, website, newsletter), do not ask one by one: add a single closing line offering them (e.g. '¿Quieres añadir teléfono o web?'). The goal is that the talent only has to answer 'sí' or correct a value. Never write without the talent's confirmation of the summary. All of this is self-declared profile data.\n\nCOLLECT THE DETAILS IN A FEW GROUPED BATCHES, not one field at a time, and for every CHOICE field PRESENT THE VALID OPTIONS so the talent just picks one. For every choice field SHOW THE TALENT THE FRIENDLY LABEL, never the raw code (e.g. show 'Nativo', not 'NATIVE'), and pass the code as the value. Suggested batches:\n1. Identity — name, lastName, email (optional: preferredLanguage, newsletterConsent).\n2. Profile — `profile.linkedinUrl` (required source; optional GitHub/website/CV path).\n3. Work — freelanceType (offer: "
     + labelledOptions(FREELANCE_TYPES, L.freelanceTypeLabels)
     + ") and `workSituation` (offer situation: "
     + labelledOptions(WORK_SITUATIONS, L.workSituationLabels)
@@ -100,7 +108,7 @@ function buildRegisterDescription(lang) {
     + labelledOptions(CHANGE_MOTIVATORS, L.changeMotivatorLabels)
     + " when the talent is or is considering freelance).\n4. Pricing — per-PROJECT price; currency USD, EUR or GBP.\n5. Availability + languages — `availability` (offer monthlyHours "
     + MONTHLY_HOURS_SLASHED
-    + ", onlyRemote yes/no, longFullTimeProjects yes/no, and LOCATION: country as ISO-2 e.g. ES, timezone as IANA e.g. Europe/Madrid) and `languages` (offer "
+    + ", workModes as a combinable array of " + WORK_MODES.join('/') + ", longFullTimeProjects yes/no, and LOCATION: country as ISO-2 e.g. ES, timezone as IANA e.g. Europe/Madrid) and `languages` (offer "
     + labelledOptions(LANGUAGE_CODES, L.languageNames)
     + ", each with a level "
     + labelledOptions(LANGUAGE_LEVELS, L.languageLevelLabels)
@@ -121,7 +129,7 @@ const PROFILE_SCHEMA = {
   type: 'object',
   properties: {
     linkedinUrl: { type: 'string', description: "The talent's LinkedIn URL. Required — it is the mandatory profile source." },
-    cvPath: { type: 'string', description: 'Absolute path to a CV PDF on the machine (optional).' },
+    cvPath: { type: 'string', description: 'Path to the CV (PDF/DOC/DOCX, max 10 MB) on this machine, absolute or ~/... (optional). Only a CV the talent confirmed is theirs. The FILE is uploaded to Shakers with the profile import.' },
     githubUrl: { type: 'string', description: 'GitHub URL (optional).' },
     websiteUrl: { type: 'string', description: 'Personal website URL (optional).' },
   },
@@ -143,7 +151,7 @@ const PRICING_SCHEMA = {
 
 // Default (English) static exports for callers/tests that read the module-level
 // schemas directly. The live tools rebuild these per session language.
-const { ACCOUNT_FIELDS, WORK_SITUATION_SCHEMA, LANGUAGES_SCHEMA, AVAILABILITY_SCHEMA, REGISTER_SCHEMA } = buildSchemas('en');
+const { ACCOUNT_FIELDS, WORK_SITUATION_SCHEMA, LANGUAGES_SCHEMA, AVAILABILITY_SCHEMA, REGISTER_SCHEMA, PREVIEW_SCHEMA } = buildSchemas('en');
 
 const STATUS_SCHEMA = {
   type: 'object',
@@ -172,7 +180,7 @@ const INTERVIEW_TURN_SCHEMA = {
   type: 'object',
   properties: {
     interviewId: { type: 'string', description: 'Internal handle for this interview — for calling the interview tools ONLY; never shown or mentioned to the talent.' },
-    message: { type: 'string', description: "The talent's REAL, VERBATIM answer to the current question. NEVER invent, infer, complete, translate, or answer on the talent's behalf. If the talent has not answered yet, do NOT call this — wait for their actual words." },
+    message: { type: 'string', description: "The talent's answer to the current question: in conduit mode their REAL, VERBATIM words; in AI-drafted mode (only if the talent opted in) the answer they APPROVED after seeing your draft, with their edits. Never a value they have not seen and confirmed. If they have not answered or approved yet, do NOT call this." },
   },
   required: ['interviewId', 'message'],
 };
@@ -446,6 +454,26 @@ function makeRegisterTools(deps = {}) {
     };
   }
 
+  // PURE preview: reuses the write-path validators, touches no network, no session.
+  async function registerPreview(args = {}) {
+    return flow.buildRegisterPreview(args || {});
+  }
+
+  // Content-free context the model may PROPOSE to the talent (never auto-write).
+  async function suggestContext() {
+    const read = deps.readRegisterContextSuggestions || require('./register-context').readRegisterContextSuggestions;
+    return { ok: true, suggestions: read({}), note: 'Propose these to the talent to confirm; never write them without confirmation.' };
+  }
+
+  // Text of the CV the talent confirmed as theirs, read only with their permission.
+  async function readCv(args = {}) {
+    if (args.talentConsent !== true) return { ok: false, reason: 'consent-required', message: 'Ask the talent first whether this CV is theirs and whether you may read it; call again with talentConsent:true only after they say yes.' };
+    const read = deps.readCvText || require('./cv-text').readCvText;
+    const result = read(args.path);
+    if (!result.ok) return { ...result, message: 'Could not read the CV text here. Ask the talent to attach the CV to the chat, or to tell you what it says.' };
+    return result;
+  }
+
   return [
     {
       name: 'register',
@@ -453,6 +481,31 @@ function makeRegisterTools(deps = {}) {
       inputSchema: schemas.REGISTER_SCHEMA,
       handler: register,
     },
+    {
+      name: 'register_preview',
+      description: "REVIEW a (partial) register payload BEFORE writing — the preferred way to register with the least typing. Fill every field you can reasonably infer, then call this. It writes NOTHING; it returns { wouldWrite: the normalized data per hub endpoint, missingFields: what is still needed (required:true) or just suggested (required:false) to ASK the talent, warnings: any value that is invalid, mustConfirm }. Show the talent a short human summary of wouldWrite and the missing items, let them confirm or correct, then call `register` with the final payload. Pre-fill every field you can reasonably infer (memory, chat, context), including pricing and changeMotivators; omit only what you have no basis for. The talent confirms the whole summary once; fields in `mustConfirm` just need to be visible in that summary, not asked separately. All register data is self-declared profile data.",
+      inputSchema: schemas.PREVIEW_SCHEMA,
+      handler: registerPreview,
+    },
+    {
+      name: 'suggest_register_context',
+      description: "Get local SUGGESTIONS to speed up registration: the environment timezone, the local git identity (user.name / user.email), the GitHub login the gh CLI is signed in with (githubUser/githubUrl), and cvCandidates — PDF files in Desktop/Documents/Downloads whose NAME looks like a CV (names only, never read), each with nameMatch (file name contains the git name). Only propose a CV that is clearly the talent's own; never propose one named after someone else. A generic:true name (cv.pdf, curriculum_2024.pdf) may be theirs: ask 'is this CV yours? may I read it and send it with your registration?'. These are PROPOSALS only — present them to the talent to confirm (e.g. 'I see your timezone is Europe/Madrid and your git email is X — use these?') and never write any of them without the talent's confirmation. No session needed. Use it before register_preview to pre-fill availability.timezone, name/email, profile.githubUrl and profile.cvPath.",
+      inputSchema: { type: 'object', properties: {} },
+      handler: suggestContext,
+    },
+    {
+      name: 'read_cv',
+      description: "Read the TEXT of the talent's CV PDF so you can pre-fill the register and the onboarding from what it says (experience, projects, stack, languages, education). Only for a CV the talent has CONFIRMED is theirs, and only after they gave you PERMISSION to read it — set talentConsent:true only then. Typical path: one of suggest_register_context's cvCandidates. Local only: the file is read on this machine and its text comes back to you; nothing is uploaded by this tool (the CV is sent to Shakers only if the talent also confirms it as profile.cvPath in register). Returns { ok, text, truncated } or { ok:false, reason } — on failure ask the talent to attach the CV to the chat.",
+      inputSchema: {
+        type: 'object',
+        properties: {
+          path: { type: 'string', description: 'Path to the PDF the talent confirmed as their CV, exactly as suggest_register_context gave it (the short ~/ form is fine) or absolute.' },
+          talentConsent: { type: 'boolean', description: 'true ONLY after the talent explicitly agreed that this is their CV and that you may read it.' },
+        },
+        required: ['path', 'talentConsent'],
+      },
+      handler: readCv,
+    },
     {
       name: 'register_status',
       description: 'Check the state of the background profile import started by register. Pass the importJobId (an internal handle — never shown to the talent). Returns { state } (e.g. running | done | failed).',
@@ -461,7 +514,7 @@ function makeRegisterTools(deps = {}) {
     },
     {
       name: 'onboarding_interview_start',
-      description: "Start the onboarding interview (step 5, optional). Runs over LiveKit: the server joins a live room and the agent conducts it, transparently resolving the branch (role/dedication only when AI-usage evidence exists, otherwise the AI-usage blocks too) — the client does NOT decide the branch. You MUST first show the talent BOTH interview disclaimers separately (from register's disclaimers.interview) and only then call with disclaimerAcknowledged:true. Returns { interviewId, greeting, ended }: relay the greeting to the talent VERBATIM, then drive the interview with onboarding_interview_turn. INTERVIEW RULE — you are a pure CONDUIT, never a participant: show every interview question to the talent VERBATIM (do not reword, clarify, summarize, translate, or add your own hints/examples/answers), and only ever pass the talent's REAL, VERBATIM words back. Do NOT opine, guide, correct, interpret, or answer for the talent at any point. `interviewId` is an internal handle for the interview tools only — never show or mention it to the talent. If it returns reason 'livekit-not-installed', relay the `message` (it tells the talent how to install the optional @livekit/rtc-node package). If the talent declines the interview, do not call this — instead run the final main-role step (list_my_roles + set_main_role) and offer them their profile URL from register. If the talent has ALREADY completed onboarding this refuses with an already-completed notice unless confirmRepeat:true; note a completed onboarding interview cannot actually be restarted (it returns reason 'interview-already-started') — in that case just run set_main_role.",
+      description: "Start the onboarding interview (step 5, optional). Runs over LiveKit: the server joins a live room and the agent conducts it, transparently resolving the branch (role/dedication only when AI-usage evidence exists, otherwise the AI-usage blocks too) — the client does NOT decide the branch. You MUST first show the talent BOTH interview disclaimers separately (from register's disclaimers.interview) and only then call with disclaimerAcknowledged:true. Returns { interviewId, greeting, ended }: relay the greeting to the talent VERBATIM, then drive the interview with onboarding_interview_turn. ANSWER MODE — before calling this, ASK the talent once: do they want you to draft their answers from what you already know about them (your memory of past conversations, the chat, the register data), so they only confirm, correct or add their opinion? (1) If they say YES (AI-drafted mode): FIRST gather everything you can know about them — your memory, a search of your past conversations with them if you have such a tool, their CV (read_cv, with their permission, if not read yet), their AI-usage report and the register data — and show ONE short sheet 'esto es lo que sé de ti' (roles and projects with the concrete facts, stack, languages, what they want next). Let them correct it once; those corrections override your memory for every later answer. Then for every interview question show the question VERBATIM and your proposed answer in the first person: one or two short sentences in their plain voice, built only from facts on the confirmed sheet — no embellishment, no adjectives, metrics or claims they did not give, no repeating a fact already said unless asked. If the sheet does not cover the question, do not guess a fact: ask them briefly. Ask them to confirm, edit or add their view. Send ONLY the version they approve — their edits and opinions included — never a draft they have not seen. For questions about wishes, preferences or opinions, give your best guess but make clear it is a guess. (2) If they say NO: you are a pure CONDUIT — show every question VERBATIM and pass only the talent's REAL, VERBATIM words back; do not opine, guide or answer for them. In both modes never reword, summarize or translate the interview's questions. `interviewId` is an internal handle for the interview tools only — never show or mention it to the talent. If it returns reason 'livekit-not-installed', relay the `message` (it tells the talent how to install the optional @livekit/rtc-node package). If the talent declines the interview, do not call this — instead run the final main-role step (list_my_roles + set_main_role) and offer them their profile URL from register. If the talent has ALREADY completed onboarding this refuses with an already-completed notice unless confirmRepeat:true; note a completed onboarding interview cannot actually be restarted (it returns reason 'interview-already-started') — in that case just run set_main_role.",
       inputSchema: INTERVIEW_START_SCHEMA,
       handler: interviewStart,
       available: async () => {
@@ -474,7 +527,7 @@ function makeRegisterTools(deps = {}) {
     },
     {
       name: 'onboarding_interview_turn',
-      description: "Send the talent's answer to the current onboarding-interview question and get the next one. You are a pure CONDUIT: pass ONLY the talent's REAL, VERBATIM answer in `message` — NEVER invent, infer, complete, or answer on their behalf; if they have not answered, do NOT call this, wait for them. Relay the returned `response` (the next question) to the talent VERBATIM — do not reword, clarify, summarize, translate, or add hints/examples/opinions of your own. Keep calling with their next `message` until `ended` is true, then call onboarding_interview_complete. Do NOT show or mention `interviewId` to the talent (internal handle). If it returns reason 'unknown-interview' (the server was restarted and the live room is gone), start again with onboarding_interview_start.",
+      description: "Send the talent's answer to the current onboarding-interview question and get the next one. Follow the ANSWER MODE the talent chose at onboarding_interview_start. AI-drafted mode: `message` is the answer the talent APPROVED after seeing your draft (with their edits/opinion); never send a draft they have not confirmed. Conduit mode: `message` is ONLY the talent's REAL, VERBATIM answer — never invent, infer or complete it. In both modes, if the talent has not answered or approved yet, do NOT call this, wait for them. Relay the returned `response` (the next question) to the talent VERBATIM — do not reword, summarize or translate it. Keep calling with their next `message` until `ended` is true, then call onboarding_interview_complete. Do NOT show or mention `interviewId` to the talent (internal handle). If it returns reason 'unknown-interview' (the server was restarted and the live room is gone), start again with onboarding_interview_start.",
       inputSchema: INTERVIEW_TURN_SCHEMA,
       handler: interviewTurn,
     },
@@ -503,6 +556,7 @@ module.exports = {
   makeRegisterTools,
   ACCOUNT_FIELDS,
   REGISTER_SCHEMA,
+  PREVIEW_SCHEMA,
   STATUS_SCHEMA,
   INTERVIEW_START_SCHEMA,
   INTERVIEW_TURN_SCHEMA,

package/src/onboarding-client.js

@@ -1,8 +1,11 @@
 'use strict';
 
-const { postJsonWithTimeout } = require('./backend-request');
+const fs = require('fs');
+const path = require('path');
+const { postJsonWithTimeout, postMultipartWithTimeout } = require('./backend-request');
 const { WORKS_CODE_TO_REASON } = require('./skills-client');
 const { toLowerLang, toUpperLang } = require('./lang-codes');
+const { expandHome } = require('./env-paths');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 const IMPORT_KICKOFF_TIMEOUT_MS = 90000;
@@ -48,6 +51,28 @@ function buildImportSources({ linkedinUrl, cvPath, githubUrl, websiteUrl, langua
   return sources;
 }
 
+// The CV formats and size hub accepts on import-profile.
+const CV_CONTENT_TYPES = {
+  '.pdf': 'application/pdf',
+  '.doc': 'application/msword',
+  '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+};
+const CV_MAX_BYTES = 10 * 1024 * 1024;
+
+function readCvUpload(input) {
+  const cvPath = expandHome(input);
+  const contentType = CV_CONTENT_TYPES[path.extname(cvPath).toLowerCase()];
+  if (!contentType) return { ok: false, reason: 'cv-bad-format' };
+  let data;
+  try {
+    data = fs.readFileSync(cvPath);
+  } catch {
+    return { ok: false, reason: 'cv-not-found' };
+  }
+  if (data.length > CV_MAX_BYTES) return { ok: false, reason: 'cv-too-large' };
+  return { ok: true, file: { filename: path.basename(cvPath), contentType, data } };
+}
+
 async function requestImportProfile(
   { linkedinUrl, cvPath, githubUrl, websiteUrl, language, accessToken, hubAccessToken } = {},
   { endpoint, timeoutMs = IMPORT_KICKOFF_TIMEOUT_MS } = {},
@@ -59,7 +84,16 @@ async function requestImportProfile(
   const body = buildImportSources({ linkedinUrl, cvPath, githubUrl, websiteUrl, language });
   let res;
   try {
-    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, hubHeaders({ hubAccessToken }));
+    if (body.cvPath) {
+      // Hub reads the CV as an uploaded `cv` file (multipart), never as a local
+      // path: a path on the talent's machine means nothing to the server.
+      const cv = readCvUpload(body.cvPath);
+      if (!cv.ok) return cv;
+      const { cvPath: _localPath, ...fields } = body;
+      res = await postMultipartWithTimeout(endpoint, { ...fields, cv: cv.file }, timeoutMs, 'POST', hubHeaders({ hubAccessToken }));
+    } else {
+      res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, hubHeaders({ hubAccessToken }));
+    }
   } catch (e) {
     return { ok: false, reason: (e && e.kind) || 'network-error' };
   }

package/src/onboarding-flow.js

@@ -10,6 +10,8 @@ const WORK_SITUATIONS = ['FREELANCE', 'EMPLOYED', 'BETWEEN_JOBS', 'STUDYING', 'O
 const EMPLOYMENT_PARTICIPATIONS = ['FULL_TIME', 'PART_TIME'];
 const FREELANCE_OPINIONS = ['WAS_FREELANCE_BEFORE', 'OPEN_TO_FREELANCE', 'NOT_INTERESTED'];
 const CHANGE_MOTIVATORS = ['HIGHER_RATE', 'SPECIFIC_PROJECT', 'LEARNING_CERTIFICATION', 'FLEXIBILITY', 'COMMUNITY', 'LIFESTYLE_CHANGE'];
+// Work modes are combinable (multi-value array), mirroring the hub availability contract.
+const WORK_MODES = ['REMOTE', 'HYBRID', 'IN_PERSON'];
 const LANGUAGE_LEVELS = ['INTERMEDIATE_WRITTEN', 'INTERMEDIATE', 'ADVANCED', 'NATIVE'];
 const LANGUAGE_CODES = ['es', 'en', 'fr', 'ca', 'de', 'eu', 'it', 'pt'];
 
@@ -217,7 +219,17 @@ function validateAvailability(input = {}) {
     if (!mh) return { ok: false, reason: 'bad-monthly-hours' };
     body.monthlyHours = mh;
   }
-  if (typeof input.onlyRemote === 'boolean') body.onlyRemote = input.onlyRemote;
+  // workModes is a multi-value array (REMOTE/HYBRID/IN_PERSON); onlyRemote is derived server-side and no longer sent.
+  if (input.workModes != null) {
+    if (!Array.isArray(input.workModes)) return { ok: false, reason: 'bad-work-modes' };
+    const modes = [];
+    for (const raw of input.workModes) {
+      const mode = typeof raw === 'string' ? raw.trim().toUpperCase() : '';
+      if (!WORK_MODES.includes(mode)) return { ok: false, reason: 'bad-work-modes' };
+      if (!modes.includes(mode)) modes.push(mode);
+    }
+    if (modes.length) body.workModes = modes;
+  }
   if (input.country != null && input.country !== '') {
     const cc = normalizeCountry(input.country);
     if (!cc) return { ok: false, reason: 'bad-country' };
@@ -229,6 +241,120 @@ function validateAvailability(input = {}) {
   return { ok: true, availability: body };
 }
 
+// Fields the talent must ALWAYS confirm explicitly — never inferred/invented by
+// the model (a wrong price or motivation is worse than a gap).
+const MUST_CONFIRM_FIELDS = ['pricing', 'workSituation.changeMotivators'];
+
+// PURE preview of a (possibly partial) register payload: what WOULD be written,
+// what is still missing, and what is invalid — reusing the same validators the
+// write path uses. Touches no network and needs no session, so the model can show
+// the talent a review before the single `register` write.
+function buildRegisterPreview(args = {}) {
+  const wouldWrite = [];
+  const missingFields = [];
+  const warnings = [];
+  const addMissing = (field, required) => missingFields.push({ field, required });
+
+  // --- account (always written at registration; password never in the payload) ---
+  const account = {
+    name: args.name,
+    lastName: args.lastName,
+    email: args.email,
+    freelanceType: args.freelanceType,
+  };
+  if (!isNonEmptyString(account.name)) addMissing('name', true);
+  if (!isNonEmptyString(account.lastName)) addMissing('lastName', true);
+  if (!isNonEmptyString(account.email)) addMissing('email', true);
+  const ftype = normalizeFreelanceType(account.freelanceType);
+  if (!ftype) {
+    if (isNonEmptyString(account.freelanceType)) warnings.push({ field: 'freelanceType', reason: 'bad-freelance-type' });
+    else addMissing('freelanceType', true);
+  }
+  wouldWrite.push({
+    section: 'account',
+    endpoint: 'hub: auth/sign-up/email + works/auth/complete-registration',
+    data: {
+      name: isNonEmptyString(account.name) ? account.name : null,
+      lastName: isNonEmptyString(account.lastName) ? account.lastName : null,
+      email: isNonEmptyString(account.email) ? account.email : null,
+      freelanceType: ftype || null,
+      preferredLanguage: isNonEmptyString(args.preferredLanguage) ? args.preferredLanguage : null,
+      newsletterConsent: args.newsletterConsent === true,
+    },
+    note: 'password is never part of this payload — the talent types it in the local sign-up window',
+  });
+
+  // --- profile import (linkedinUrl is the required source) ---
+  const profile = args.profile && typeof args.profile === 'object' ? args.profile : {};
+  if (!isNonEmptyString(profile.linkedinUrl)) addMissing('profile.linkedinUrl', true);
+  else {
+    const pdata = { linkedinUrl: profile.linkedinUrl };
+    for (const k of ['githubUrl', 'websiteUrl', 'cvPath']) if (isNonEmptyString(profile[k])) pdata[k] = profile[k];
+    wouldWrite.push({ section: 'profile', endpoint: 'hub: works/me/import-profile', data: pdata });
+  }
+
+  // --- work situation (situation required) ---
+  const ws = args.workSituation && typeof args.workSituation === 'object' ? args.workSituation : {};
+  if (!isNonEmptyString(ws.situation)) addMissing('workSituation.situation', true);
+  else {
+    const vws = validateWorkSituation(ws);
+    if (!vws.ok) warnings.push({ field: 'workSituation', reason: vws.reason });
+    else wouldWrite.push({ section: 'workSituation', endpoint: 'hub: works/me/professional-details', data: vws.professionalDetails });
+  }
+
+  // --- pricing (at least one variant; ALWAYS confirm) ---
+  const pricing = args.pricing && typeof args.pricing === 'object' ? args.pricing : {};
+  const pricingEmpty = pricing.fullTimeSelected !== true && pricing.partTimeSelected !== true
+    && pricing.fullTimeAmount == null && pricing.partTimeAmount == null;
+  if (pricingEmpty) addMissing('pricing', true);
+  else {
+    const vp = validatePricing(pricing);
+    if (!vp.ok) warnings.push({ field: 'pricing', reason: vp.reason });
+    else wouldWrite.push({ section: 'pricing', endpoint: 'hub: works/talents/me/work-details/pricing-rate', data: vp.pricing });
+  }
+
+  // --- availability (optional; suggest the sub-fields the talent did not give) ---
+  if (args.availability && typeof args.availability === 'object') {
+    const va = validateAvailability(args.availability);
+    if (!va.ok) warnings.push({ field: 'availability', reason: va.reason });
+    else {
+      wouldWrite.push({ section: 'availability', endpoint: 'hub: works/talents/me/work-details/availability', data: va.availability });
+      for (const k of ['available', 'monthlyHours', 'workModes', 'country', 'timezone']) {
+        if (!(k in va.availability)) addMissing(`availability.${k}`, false);
+      }
+    }
+  } else {
+    addMissing('availability', false);
+  }
+
+  // --- languages (optional; ids resolve at write-time, so the preview shows codes) ---
+  if (Array.isArray(args.languages) && args.languages.length > 0) {
+    const vl = validateLanguageRows(args.languages);
+    if (!vl.ok) warnings.push({ field: 'languages', reason: vl.reason });
+    else wouldWrite.push({ section: 'languages', endpoint: 'hub: works/talents/me/work-details/languages', data: vl.rows, note: 'language codes resolve to ids at write time' });
+  } else {
+    addMissing('languages', false);
+  }
+
+  // --- phone (optional) ---
+  if (args.phone && typeof args.phone === 'object') {
+    const vph = validatePhone(args.phone);
+    if (!vph.ok) warnings.push({ field: 'phone', reason: vph.reason });
+    else wouldWrite.push({ section: 'phone', endpoint: 'hub: works/me', data: { telephoneCode: vph.telephoneCode, telephoneNumber: vph.telephoneNumber } });
+  } else {
+    addMissing('phone', false);
+  }
+
+  return {
+    ok: true,
+    provenance: 'self-declared',
+    wouldWrite,
+    missingFields,
+    warnings,
+    mustConfirm: MUST_CONFIRM_FIELDS,
+  };
+}
+
 function makeDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./onboarding-client');
@@ -1025,6 +1151,7 @@ module.exports = {
   EMPLOYMENT_PARTICIPATIONS,
   FREELANCE_OPINIONS,
   CHANGE_MOTIVATORS,
+  WORK_MODES,
   LANGUAGE_LEVELS,
   LANGUAGE_CODES,
   normalizeFreelanceType,
@@ -1039,6 +1166,8 @@ module.exports = {
   buildPricingUpsert,
   isAcceptablePassword,
   validateRegisterFields,
+  buildRegisterPreview,
+  MUST_CONFIRM_FIELDS,
   deriveCurrentEmploymentStatus,
   showsFreelanceOpinion,
   deriveFreelanceIntent,

package/src/prompt-select.js

@@ -26,4 +26,41 @@ async function promptSelect({ ask, stdinIsTTY, out, items, labelFor = (x) => Str
   return items.find((it) => labelFor(it).toLowerCase() === lowered || String(it).toLowerCase() === lowered) || null;
 }
 
-module.exports = { promptSelect };
+// Multi-pick variant: SPACE toggles, ENTER confirms; returns the chosen items as
+// an array (possibly empty). Non-TTY fallback accepts space/comma-separated
+// indices or labels.
+async function promptMultiSelect({ ask, stdinIsTTY, out, items, labelFor = (x) => String(x), header = '', hint = '', initialMarked = [], input, output } = {}) {
+  if (stdinIsTTY && typeof ask.suspend === 'function') {
+    ask.suspend();
+    const picked = await runInteractiveMultiSelect({
+      items,
+      labelFor,
+      header,
+      hint,
+      single: false,
+      initialMarked,
+      ...(input ? { input } : {}),
+      ...(output ? { output } : {}),
+    });
+    ask.resume();
+    return Array.isArray(picked) ? picked : [];
+  }
+  if (header) out(header);
+  items.forEach((it, i) => out(`  ${i + 1}) ${labelFor(it)}`));
+  const raw = (await ask('  > ')).trim();
+  if (!raw) return [];
+  const chosen = [];
+  for (const tok of raw.split(/[\s,]+/).filter(Boolean)) {
+    const n = parseInt(tok, 10);
+    let item = null;
+    if (Number.isInteger(n) && n >= 1 && n <= items.length) item = items[n - 1];
+    else {
+      const lowered = tok.toLowerCase();
+      item = items.find((it) => labelFor(it).toLowerCase() === lowered || String(it).toLowerCase() === lowered) || null;
+    }
+    if (item != null && !chosen.includes(item)) chosen.push(item);
+  }
+  return chosen;
+}
+
+module.exports = { promptSelect, promptMultiSelect };

package/src/register-context.js

@@ -0,0 +1,128 @@
+'use strict';
+
+// Local context SUGGESTIONS for the register flow: the environment timezone, the
+// local git identity, the GitHub login and CV candidates. These are proposals the
+// model offers the talent to confirm — they are NEVER auto-written. No file
+// content, no commit scanning, no network, no session: CV candidates are file
+// NAMES only. This is deliberately NOT the authorship/evidence path.
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { getHomeDir, tildify } = require('./env-paths');
+
+// Where a talent keeps a CV, and how deep we look under each folder.
+const CV_DIRS = ['Desktop', 'Documents', 'Downloads', 'Escritorio', 'Documentos', 'Descargas'];
+const CV_MAX_DEPTH = 2;
+const CV_MAX_RESULTS = 5;
+const CV_NAME = /(^|[^a-z])(cv|curriculum|curr[ií]culum|resume|r[ée]sum[ée])([^a-z]|$)/i;
+
+function detectTimezone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+  } catch {
+    return null;
+  }
+}
+
+function gitConfig(key, cwd) {
+  try {
+    const out = execFileSync('git', ['config', '--get', key], {
+      encoding: 'utf8',
+      timeout: 5000,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      cwd: cwd || process.cwd(),
+    });
+    const value = String(out || '').trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+
+// The login the GitHub CLI is signed in with, read from its local hosts file
+// (no network), else the conventional `github.user` git key.
+function detectGithubUser(home, cwd) {
+  try {
+    const hosts = fs.readFileSync(path.join(home, '.config', 'gh', 'hosts.yml'), 'utf8');
+    const block = hosts.split(/^github\.com:\s*$/m)[1];
+    const match = block && block.match(/^\s+user:\s*(\S+)\s*$/m);
+    if (match) return match[1];
+  } catch {
+    // no gh CLI config
+  }
+  return gitConfig('github.user', cwd);
+}
+
+const fold = (text) => String(text || '').normalize('NFD').replace(/[\u0300-\u036f]/g, '').toLowerCase();
+
+// Whether a file name carries a token of the person's name. People who hire keep
+// other people's CVs in Downloads; only a name match makes a candidate theirs.
+function matchesName(fileName, personName) {
+  const tokens = fold(personName).split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const file = fold(fileName);
+  return tokens.some((t) => file.includes(t));
+}
+
+// Words that say nothing about whose CV it is: `cv.pdf`, `Curriculum_2024_ES.pdf`,
+// `resume-final-v2.pdf`. Such a file may be the talent's own, so it is worth asking.
+const GENERIC_WORDS = /\b(cv|curriculum|curriculo|resume|vitae|mi|my|el|the|de|of|final|actualizado|updated|nuevo|new|latest|es|en|esp|eng|spanish|english|espanol|ingles|v\d+|copia|copy)\b/g;
+
+function isGenericCvName(fileName) {
+  const rest = fold(fileName.replace(/\.pdf$/i, '')).replace(/[^a-z0-9]+/g, ' ').replace(GENERIC_WORDS, ' ').replace(/\d+/g, ' ');
+  return rest.trim().length === 0;
+}
+
+// PDFs whose NAME looks like a CV: name matches first, then generic names, then
+// newest. Never opens a file.
+function findCvCandidates(home, personName) {
+  const found = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith('.')) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (depth < CV_MAX_DEPTH) walk(full, depth + 1);
+      } else if (entry.isFile() && /\.pdf$/i.test(entry.name) && CV_NAME.test(entry.name.replace(/\.pdf$/i, ''))) {
+        try {
+          found.push({
+            path: full,
+            nameMatch: matchesName(entry.name, personName),
+            generic: isGenericCvName(entry.name),
+            mtimeMs: fs.statSync(full).mtimeMs,
+          });
+        } catch {
+          // vanished between readdir and stat
+        }
+      }
+    }
+  };
+  for (const name of CV_DIRS) walk(path.join(home, name), 1);
+  return found
+    .sort((a, b) => Number(b.nameMatch) - Number(a.nameMatch) || Number(b.generic) - Number(a.generic) || b.mtimeMs - a.mtimeMs)
+    .slice(0, CV_MAX_RESULTS)
+    .map(({ path: cvPath, nameMatch, generic }) => ({ path: tildify(cvPath, { SHAKERS_CLI_HOME_DIR: home }), nameMatch, generic }));
+}
+
+// Returns the signals found, each clearly a SUGGESTION to confirm.
+function readRegisterContextSuggestions({ cwd, env = process.env } = {}) {
+  const home = getHomeDir(env);
+  const githubUser = detectGithubUser(home, cwd);
+  const gitName = gitConfig('user.name', cwd);
+  return {
+    timezone: detectTimezone(),
+    gitName,
+    gitEmail: gitConfig('user.email', cwd),
+    githubUser,
+    githubUrl: githubUser ? `https://github.com/${githubUser}` : null,
+    cvCandidates: findCvCandidates(home, gitName),
+  };
+}
+
+module.exports = { readRegisterContextSuggestions, detectTimezone, findCvCandidates, detectGithubUser, isGenericCvName };

package/src/usage-run-steps.js

@@ -9,6 +9,9 @@ const { persistFootprint } = require('./report-store');
 const {
   loadConsentState,
   getConsentDecision,
+  recordConsent,
+  isValidEmail,
+  normalizeEmail,
   autoShare,
   consentPath,
 } = require('./share');
@@ -117,9 +120,12 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
   });
 
   let aiConsentGranted;
+  // A REUSED grant (skip/--json) carries a stale consent email; a fresh prompt re-anchors itself.
+  let reusedStoredConsent = false;
   if (opts.json) {
     // `--json` never had an interactive prompt — its whole point is a single parseable stdout document, and it does not gain one now.
     aiConsentGranted = decision === 'granted' && (!state || state.emailVerified !== false);
+    reusedStoredConsent = true;
   } else {
     if (consentSkip.message) {
       process.stdout.write(`\n  ${consentSkip.message}\n`);
@@ -128,6 +134,7 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
       // A TERMINAL decision already exists (a prior run's explicit grant or
       // denial) — never re-asked, per ADR-007/011.
       aiConsentGranted = decision === 'granted';
+      reusedStoredConsent = true;
     } else {
       const ask = injectedAsk || createStdinAsk();
       let result;
@@ -145,6 +152,11 @@ async function resolveAiConsent({ opts, catalog, gate, injectedAsk }) {
       process.stdout.write(`\n  ${termColors.warning}${catalog.consent.noReportWithoutConsent}${termColors.reset}\n\n`);
     }
   }
+  // Re-anchor a reused grant to the session's login-proven email (ADR-006): else a stale consent email ingests the report under another account and this session's AI profile never populates.
+  if (reusedStoredConsent && aiConsentGranted && gate.loggedIn
+    && isValidEmail(gate.email) && state && state.email !== normalizeEmail(gate.email)) {
+    recordConsent('granted', gate.email, { verified: true });
+  }
   return aiConsentGranted;
 }