shakers-cli-beta 0.8.0-beta.4 → 0.9.0

package/README.md

@@ -97,7 +97,7 @@ The **usage** signal is entirely local (no network, no model). See
 One line:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/devShakers/ai-usage-evaluator/main/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/devShakers/ai-usage-evaluator/release/install.sh | bash
 ```
 
 The installer:
@@ -135,17 +135,21 @@ env vars and `config.json` always win over the baked default.
 | Flavor | Package name | Registry | Baked target | Publish |
 |---|---|---|---|---|
 | Private (current) | `@shakers/shakers-cli` | GitLab proj 201 (`publishConfig`) | dev (new-works) | `export SHAKERS_GITLAB_TOKEN=<PAT, scope write_registry on proj 201>` then `npm publish` |
-| Public beta | `shakers-cli-beta` | npmjs (public) | staging | `node scripts/prepare-beta.js` → `npm publish --tag beta` → `git checkout -- package.json` |
+| Public beta | `shakers-cli-beta` | npmjs (public) | staging | bump `BETA.version` in `scripts/prepare-beta.js`, then `npm run publish:beta` |
 | Local | (checkout, `@shakers/shakers-cli`) | — | dev, or `SHAKERS_CLI_ENV=local` for localhost | run from the clone; no publish |
 
 Both publishes bump `version` first (the registry rejects re-publishing an
-existing version). The private one publishes from a checked-out `main` with the
-committed `@shakers/shakers-cli` manifest, unchanged. The beta one uses
-`scripts/prepare-beta.js` to stamp `name`/`version`/`publishConfig` (version
-`0.8.0-beta.0`, dist-tag `beta`), publishes, then restores the manifest with
-git. The npmjs org/account for `shakers-cli-beta` must exist and you must be
-`npm login`ed to it (or set `NODE_AUTH_TOKEN`) before publishing — nothing here
-publishes automatically.
+existing version). The private one publishes from a checked-out `release` with the
+committed `@shakers/shakers-cli` manifest, unchanged. For the beta, bump
+`BETA.version` in `scripts/prepare-beta.js` (manual, one line), then run the
+single command `npm run publish:beta`: it stamps `name`/`version`/`publishConfig`,
+runs `npm publish --tag latest`, and restores the private manifest with git. The
+tag is explicit because npm refuses to publish a prerelease (`0.8.0-beta.N`) to
+`latest` without one; `--tag latest` still moves `latest` to the new version, so
+testers install `shakers-cli-beta` bare (which resolves `latest`) with no manual
+`npm dist-tag add` step. The npmjs account for `shakers-cli-beta` must
+exist and you must be `npm login`ed (or set `NODE_AUTH_TOKEN`) first — nothing
+here publishes automatically.
 
 `@livekit/rtc-node` is a real `dependencies` entry, so `npm i` / `npm i -g` of
 either package pulls it automatically (GitLab's packument keeps `dependencies`
@@ -583,9 +587,10 @@ run without a session (that is how you obtain/drop one); `logout` with no
 session is a silent no-op.
 
 ```bash
-shakers login                      # no method flag: interactive picker (Email / Google) on a real TTY
+shakers login                      # no method flag: interactive picker (Email / Google / LinkedIn) on a real TTY
 shakers login --email you@shakers.com   # skip the picker, prompt only for the password
 shakers login --google             # skip the picker, go straight to the Google flow
+shakers login --linkedin           # skip the picker, go straight to the LinkedIn flow
 shakers logout                     # forget the stored session (no-op if none)
 ```
 
@@ -604,7 +609,11 @@ shakers logout                     # forget the stored session (no-op if none)
   your machine — no client id, no loopback server, no secret; the Hub owns all
   Google config and does the token exchange server-side. After you authorize, the
   Hub session is exchanged for the same API JWT the email flow stores.
-- **LinkedIn is parked** (ADR-041/046) — not implemented.
+- **LinkedIn** signs in through the same device flow as Google, with
+  `provider=linkedin`: the `login --linkedin` / `--provider linkedin` flags and
+  the sign-in window served to AI apps (the loopback method-choice screen) both
+  route to it. This reverses the earlier parking (ADR-041/046). Whether it
+  completes depends on the Hub having a LinkedIn OAuth app provisioned.
 - The session (`{ accessToken, expiresAt, email }`) is stored **atomically**,
   permissions `600`, in `~/.config/shakers/auth-session.json`. **Logged in**
   means "an unexpired token is present" — an unparseable or missing

package/bin/ai-usage.js

@@ -6,6 +6,10 @@ const { detectReportLang, getCatalog } = require('../src/i18n');
 const { parseArgs } = require('../src/cli-args');
 const { loadConsentState } = require('../src/share');
 const { handleOneShotCommand } = require('../src/usage-oneshot-commands');
+const { prefetchGitLogs } = require('../src/git-log-prefetch');
+const { GIT_ACTIVITY_LOG_ARGS } = require('../src/git-activity');
+const { WORK_STREAMS_LOG_ARGS } = require('../src/work-streams');
+const { AUTHORSHIP_LOG_ARGS } = require('../src/authorship');
 const {
   resolveRepoScope,
   machineWideToplevels,
@@ -56,6 +60,7 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
   const agentRoots = scope.toplevels;
 
   // 5. Aggregate scoped signals + rebuild scan/org-chart over the selection, re-classify.
+  await prefetchGitLogs(agentRoots, [GIT_ACTIVITY_LOG_ARGS, WORK_STREAMS_LOG_ARGS, AUTHORSHIP_LOG_ARGS]);
   runAggregation({ report, scope, consentEmail, agentRoots, root, catalog });
   const maturity = classify(report);
   const hasAgents = Array.isArray(report.agents) && report.agents.length > 0;

package/bin/login.js

@@ -78,7 +78,7 @@ async function run(
   if (opts.google) return runSocial('google', c, { openBrowser, sleep, lang });
   if (opts.linkedin) return runSocial('linkedin', c, { openBrowser, sleep, lang });
 
-  // No method flag: offer the picker (ADR-041/046 — Email and Google only, LinkedIn stays parked).
+  // No method flag: offer the picker (ADR-041/046 — Email, Google and LinkedIn; LinkedIn pending Hub OAuth provisioning).
   if (!hasMethodFlag(opts)) {
     const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
     if (stdinIsTTY) {

package/bin/mcp.js

@@ -25,6 +25,7 @@ const { makeDeviceLoginTools } = require('../src/mcp-device-login-tools');
 const { makeRegisterTools } = require('../src/mcp-register-tools');
 const { detectFlowLang } = require('../src/i18n');
 const { makeReportTools } = require('../src/mcp-report-tools');
+const { makePrompts } = require('../src/mcp-prompts');
 const { ensureFreshSession } = require('../src/session-refresh');
 
 let VERSION = '';
@@ -57,22 +58,33 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
 // schemas on demand only see the tool the model picked first, so the flow lives
 // here, where the client keeps it in context.
 const SERVER_INSTRUCTIONS = [
-  'Shakers talent tools. When the talent asks to register or sign up on Shakers, the goal is that they type almost nothing: you fill the registration from what you know and they confirm.',
+  'Shakers talent tools. When the talent asks to register or sign up on Shakers, go straight to a filled draft: you fill the registration from what you know and from their CV, and they only confirm. Never open with a questionnaire or a list of what you do not know.',
   'Register flow — load and use these tools in this order:',
-  '1. suggest_register_context: timezone, git name/email, GitHub login and CV file candidates on this machine.',
-  '2. If a CV candidate is clearly theirs (nameMatch) propose it; if only a generic one like cv.pdf exists, ask whether it is theirs and whether you may read it and send it with the registration. With permission call read_cv and use its text.',
-  '3. Pre-fill EVERY register field you can infer from your memory of the talent, the chat, that context and the CV, pricing and motivation included (an estimate, labelled as such). Then call register_preview with that payload.',
-  '4. Show ONE short summary saying where each value comes from, ask only for what you have no basis for, offer unknown optional fields in a single closing line, and let them confirm or correct once.',
-  '5. Only then call register with the confirmed payload.',
-  'Do not open with a questionnaire of empty fields: propose first, ask second.',
+  '1. First reply: ONE short question — may you search for and read their CV on this machine to fill everything in?',
+  '2. With their yes: suggest_register_context (with talentName), then read_cv on the candidates (talentConsent:true, talentName) until one has mentionsTalent:true. Drop any CV with mentionsTalent:false (someone else\'s) without describing it. Take LinkedIn, GitHub, experience, languages and location from their CV.',
+  'No CV, no permission, or none of the CVs is theirs: do NOT fall back to questions. Build the same draft from everything else you know about them: your memory of past conversations, a search of those conversations if you have that tool, this conversation and any context or memory files you can see. The CV adds facts; it is never a precondition.',
+  '3. Infer EVERY field: employment from what you know (a company email or employer means employed there), pricing as a concrete estimate from role, seniority and location, motivation as your best match. Call register_preview.',
+  '4. Show ONE summary saying where each value comes from; only truly unknown required fields as a short question at the end, optional unknowns in one line. The sign-up goes to suggest_register_context\'s `environment`: never call a test environment production.',
+  '5. After their confirmation, call register.',
   'Onboarding interview (onboarding_interview_start / onboarding_interview_turn): follow the ANSWER MODE described in onboarding_interview_start.',
 ].join('\n');
 
-function buildServer() {
+// The LOCAL (filesystem/machine) tools — the only ones the .mcpb bundle exposes; the
+// server-backed tools belong to the remote connector.
+const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_result', 'read_cv', 'suggest_register_context']);
+
+// `localOnly` builds the scan-only server for the Claude .mcpb bundle, reusing the SAME
+// tool registry (just filtered) — no duplicate registration.
+function buildServer({ localOnly = false } = {}) {
+  const allTools = [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools(), ...makeDeviceLoginTools(), ...makeRegisterTools({ lang: detectFlowLang() }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAskTools(), ...makeAlmaTools()];
+  const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
+  // Slash-command prompts, kept to the tools actually registered in this mode.
+  const prompts = makePrompts(new Set(tools.map((t) => t.name)));
   return createMcpServer({
-    tools: [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools(), ...makeDeviceLoginTools(), ...makeRegisterTools({ lang: detectFlowLang() }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAskTools(), ...makeAlmaTools()],
-    serverInfo: { name: 'Shakers', version: VERSION || '0.0.0' },
-    instructions: SERVER_INSTRUCTIONS,
+    tools,
+    prompts,
+    serverInfo: { name: localOnly ? 'Shakers (local scan)' : 'Shakers', version: VERSION || '0.0.0' },
+    instructions: localOnly ? null : SERVER_INSTRUCTIONS,
     // Long-lived server: refresh the email session's hub JWT from the stored
     // cookie before each tool call so a stale (~15-min) JWT never reaches a tool.
     beforeCall: () => ensureFreshSession(process.env),
@@ -92,7 +104,8 @@ async function run(argv = process.argv.slice(2)) {
 
   require('../src/config').sanitizeStaleBakedEndpoints(process.env);
 
-  const server = buildServer();
+  // `--local` = the scan-only server shipped in the Claude .mcpb bundle.
+  const server = buildServer({ localOnly: argv.includes('--local') });
   const rl = server.start({
     input: process.stdin,
     output: process.stdout,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.8.0-beta.4",
+  "version": "0.9.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {
@@ -15,7 +15,9 @@
   "scripts": {
     "start": "node bin/shakers.js",
     "shakers": "node bin/shakers.js",
-    "test": "node --test test/*.test.js"
+    "test": "node --test test/*.test.js",
+    "build:mcpb": "sh scripts/build-mcpb.sh",
+    "publish:beta": "node scripts/prepare-beta.js && npm publish --tag latest && git checkout -- package.json"
   },
   "engines": {
     "node": ">=18"

package/src/authorship.js

@@ -5,9 +5,13 @@ const path = require('path');
 
 // Git AUTHORSHIP + provenance for the certify phase (skill-code-certification, ADR-017).
 
+const { takePrefetchedGitLog } = require('./git-log-prefetch');
+
 const GIT_TIMEOUT_MS = 15000;
 const SHORT_SHA_LEN = 10;
 
+const AUTHORSHIP_LOG_ARGS = ['log', '--no-merges', '--pretty=format:\x01%ae\x1f%at', '--name-only'];
+
 function runGit(root, args) {
   try {
     return execFileSync('git', ['-C', root, ...args], {
@@ -72,12 +76,8 @@ function getRootPrefix(root) {
 function buildPathIndex(root) {
   const authorsByPath = new Map();
   const timeByPath = new Map();
-  const log = runGit(root, [
-    'log',
-    '--no-merges',
-    '--pretty=format:\x01%ae\x1f%at',
-    '--name-only',
-  ]);
+  const prefetched = takePrefetchedGitLog(root, AUTHORSHIP_LOG_ARGS);
+  const log = prefetched !== undefined ? prefetched : runGit(root, AUTHORSHIP_LOG_ARGS);
   if (log === null) return { authorsByPath, timeByPath };
 
   let currentEmail = null;
@@ -196,6 +196,7 @@ function attributeSample(sample, verifiedEmail, authorship, authorizedSet = null
 
 module.exports = {
   collectAuthorship,
+  AUTHORSHIP_LOG_ARGS,
   attributeSample,
   // exported for unit tests
   normalizeRemote,

package/src/certify-dimension-client.js

@@ -4,7 +4,6 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
-const { toUpperLang } = require('./lang-codes');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -154,62 +153,9 @@ async function discoverOfferableDimensions(deps = {}, { accessToken, hubAccessTo
   return { ok: true, mainRole: mine.mainRole, offerable, unmatched };
 }
 
-async function requestCreateCertificationInterview(
-  { dimensionKey, languageCode, accessToken } = {},
-  { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const body = { dimensionKey };
-  if (languageCode) body.languageCode = toUpperLang(languageCode);
-  let res;
-  try {
-    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) {
-    const reason = reasonForError(res.status, res.raw);
-    if (reason !== 'dimension-on-cooldown') return { ok: false, reason };
-    // certs puts the date in the message only: "... available on 2026-10-28T14:50:38.265Z".
-    const available = String(res.raw || '').match(/available on (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/);
-    return { ok: false, reason, availableOn: available ? available[1] : null };
-  }
-  const data = payloadOf(res.raw);
-  const interviewId = pick(data || {}, ['interviewId', 'id']);
-  if (!interviewId) return { ok: false, reason: 'bad-response' };
-  return { ok: true, interviewId, language: pick(data || {}, ['language', 'languageCode']) || null };
-}
-
-// Poll the verdict; a 2xx/404/425/202 with no band yet resolves `ready:false` (retriable).
-async function requestCertificationReport(
-  { interviewId, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!interviewId) return { ok: false, reason: 'no-interview' };
-  const url = `${base.replace(/\/+$/, '')}/${encodeURIComponent(interviewId)}/report`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status === 404 || res.status === 425 || res.status === 202) return { ok: true, ready: false, report: null };
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (data === undefined || data === null || typeof data !== 'object') return { ok: true, ready: false, report: null };
-  const band = pick(data, ['band', 'level', 'combinedLevel']);
-  // A report with too little evidence for a level has band null; it is still finished.
-  if (!band && !pick(data, ['evaluationId'])) return { ok: true, ready: false, report: null };
-  return { ok: true, ready: true, report: data };
-}
-
 module.exports = {
   requestMyCertifications,
   requestTemplatesByDimension,
-  requestCreateCertificationInterview,
-  requestCertificationReport,
   composeDimensionKey,
   composeOfferableDimensions,
   discoverOfferableDimensions,

package/src/certify-dimension-flow.js

@@ -1,23 +1,15 @@
 'use strict';
 
-// `certify` dimension flow: discover -> pick -> create -> LiveKit interview -> poll verdict.
+// `certify` dimension flow: discover -> pick -> hand off to the web interview.
 
 const { runInteractiveMultiSelect } = require('./interactive-select');
 
 function makeCertifyDimensionDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./certify-dimension-client');
-  const onboardingFlow = require('./onboarding-flow');
   return {
-    getCertificationInterviewsEndpoint: config.getCertificationInterviewsEndpoint,
-    // `{certsBase}/interviews` — shared base for LiveKit start/complete + the report poll.
-    getInterviewsBase: config.getOnboardingInterviewsEndpoint,
+    getTalentProfileUrl: config.getTalentProfileUrl,
     discoverOfferableDimensions: (opts) => client.discoverOfferableDimensions({}, opts),
-    requestCreateCertificationInterview: client.requestCreateCertificationInterview,
-    requestCertificationReport: client.requestCertificationReport,
-    conductLivekitInterview: onboardingFlow.conductLivekitInterview,
-    onboardingDeps: onboardingFlow.makeDeps(),
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     ...overrides,
   };
 }
@@ -61,41 +53,19 @@ function resolveDimensionArg(arg, items) {
   return items.find((d) => d.dimensionKey === raw || d.slug === raw) || undefined;
 }
 
-// The evaluation lands one to two minutes after the interview ends, four when the queue is busy.
-async function pollReport(deps, { interviewId, accessToken }, { base, attempts = 60, intervalMs = 5000 } = {}) {
-  for (let i = 0; i < attempts; i++) {
-    const res = await deps.requestCertificationReport({ interviewId, accessToken }, { base });
-    if (!res.ok) return { ok: false, reason: res.reason };
-    if (res.ready) return { ok: true, report: res.report };
-    if (i < attempts - 1) await deps.sleep(intervalMs);
+// Deep link into the talent's Shakers web profile, filtered to the chosen dimension.
+// One dimension can publish more than one assessment, so the filtered catalog is the
+// robust target rather than a single templateId.
+function buildWebLink(profileUrl, dimension) {
+  if (!profileUrl || !dimension || !dimension.clusterId || !dimension.slug) return null;
+  let origin;
+  try {
+    origin = new URL(profileUrl).origin;
+  } catch {
+    return null;
   }
-  return { ok: false, reason: 'timeout' };
-}
-
-function formatDay(iso, lang) {
-  const d = iso ? new Date(iso) : null;
-  if (!d || Number.isNaN(d.getTime())) return null;
-  return d.toLocaleDateString(lang === 'en' ? 'en-GB' : 'es-ES', { day: 'numeric', month: 'long', year: 'numeric' });
-}
-
-function renderVerdict(report, cd) {
-  const lines = [];
-  const band = report.band || report.level || report.combinedLevel;
-  const dimension = report.dimensionName || report.dimension || report.dimensionKey;
-  if (dimension) lines.push(cd.verdictDimension(dimension));
-  if (band) lines.push(cd.verdictBand(band));
-  if (typeof report.certified === 'boolean') lines.push(report.certified ? cd.verdictCertified : cd.verdictNotCertified);
-  const summary = report.summary || report.rationale || report.feedback;
-  if (typeof summary === 'string' && summary.trim()) lines.push(summary.trim());
-  const areas = Array.isArray(report.areas) ? report.areas : null;
-  if (areas && areas.length) {
-    for (const a of areas) {
-      const name = a && (a.name || a.area || a.tag);
-      const note = a && (a.note || a.comment);
-      if (name) lines.push(`- ${name}${note ? `: ${note}` : ''}`);
-    }
-  }
-  return lines.join('\n  ');
+  const key = `${encodeURIComponent(dimension.clusterId)}/${encodeURIComponent(dimension.slug)}`;
+  return `${origin}/certifications?dimension=${key}`;
 }
 
 async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog, opts = {}, deps = makeCertifyDimensionDeps() }) {
@@ -146,41 +116,11 @@ async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog
     }
   }
 
-  const createEndpoint = deps.getCertificationInterviewsEndpoint();
-  const created = await io.withProgress(cd.creating, () =>
-    deps.requestCreateCertificationInterview(
-      { dimensionKey: chosen.dimensionKey, languageCode: lang, accessToken },
-      { endpoint: createEndpoint },
-    ));
-  if (!created.ok) {
-    io.error(created.reason === 'dimension-on-cooldown'
-      ? cd.onCooldown(formatDay(created.availableOn, lang))
-      : cd.createFailed(created.reason));
-    return { ok: false, reason: created.reason, step: 'create' };
-  }
-
-  const interview = await deps.conductLivekitInterview(io, deps.onboardingDeps, {
-    interviewId: created.interviewId,
-    language: lang,
-    plain: true,
-  });
-  if (!interview.ok) {
-    io.warn(interview.reason === 'needs-web' ? cd.needsWeb : cd.interviewUnavailable(interview.reason));
-    return { ok: false, reason: interview.reason, step: 'interview' };
-  }
-
-  const reportBase = deps.getInterviewsBase();
-  const polled = await io.withProgress(cd.reportPolling, () =>
-    pollReport(deps, { interviewId: created.interviewId, accessToken }, { base: reportBase }));
-  if (!polled.ok) {
-    io.warn(polled.reason === 'timeout' ? cd.reportTimeout : cd.reportFailed(polled.reason));
-    return { ok: true, completed: 'interview', verdict: null };
-  }
-
-  io.section(cd.verdictTitle);
-  io.notify(renderVerdict(polled.report, cd));
-  io.success(cd.done);
-  return { ok: true, completed: 'interview', verdict: polled.report };
+  const webLink = buildWebLink(deps.getTalentProfileUrl(), chosen);
+  io.notify(cd.webHandoff);
+  if (webLink) io.success(cd.webHandoffLink(webLink));
+  else io.notify(cd.webHandoffNoLink);
+  return { ok: true, handoff: true, dimensionKey: chosen.dimensionKey, webLink };
 }
 
 module.exports = {
@@ -188,6 +128,5 @@ module.exports = {
   runCertifyDimension,
   chooseDimension,
   resolveDimensionArg,
-  pollReport,
-  renderVerdict,
+  buildWebLink,
 };

package/src/config.js

@@ -318,13 +318,6 @@ function getTemplatesByDimensionEndpoint(env = process.env) {
   return base ? `${base}/templates/by-dimension` : null;
 }
 
-function getCertificationInterviewsEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'CERTIFICATION_INTERVIEWS_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  const base = getCertsBase(env);
-  return base ? `${base}/users/me/certification-interviews` : null;
-}
-
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
@@ -731,7 +724,6 @@ module.exports = {
   getSetMainRoleEndpoint,
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
-  getCertificationInterviewsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).

package/src/cv-text.js

@@ -1,10 +1,10 @@
 'use strict';
 
-// Plain text out of the talent's CV PDF, so the AI can pre-fill from what the CV
-// says. Zero-dependency on purpose (install.sh copies the CLI without npm
-// install): macOS reads it with the system PDFKit through JXA, elsewhere with
-// poppler's pdftotext when it is installed. With neither, the caller asks the
-// talent to attach the CV to the chat instead.
+// Plain text out of the talent's CV (PDF, DOC, DOCX), so the AI can pre-fill from
+// what the CV says. Zero-dependency on purpose (install.sh copies the CLI without
+// npm install): on macOS PDFs go through the system PDFKit (JXA) and Word files
+// through textutil; elsewhere PDFs through poppler's pdftotext when installed.
+// With none, the caller asks the talent to attach the CV to the chat instead.
 
 const fs = require('fs');
 const path = require('path');
@@ -22,16 +22,44 @@ function run(cmd, args, exec) {
   return String(exec(cmd, args, { encoding: 'utf8', timeout: 20000, maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'] }) || '');
 }
 
-function extractors(platform) {
+function extractors(platform, file) {
   const list = [];
-  if (platform === 'darwin') list.push({ name: 'pdfkit', cmd: 'osascript', args: (file) => ['-l', 'JavaScript', '-e', JXA_PDF_TEXT, file] });
-  list.push({ name: 'pdftotext', cmd: 'pdftotext', args: (file) => ['-layout', '-q', file, '-'] });
+  if (/\.docx?$/i.test(file)) {
+    if (platform === 'darwin') list.push({ name: 'textutil', cmd: 'textutil', args: (f) => ['-convert', 'txt', '-stdout', f] });
+    return list;
+  }
+  if (platform === 'darwin') list.push({ name: 'pdfkit', cmd: 'osascript', args: (f) => ['-l', 'JavaScript', '-e', JXA_PDF_TEXT, f] });
+  list.push({ name: 'pdftotext', cmd: 'pdftotext', args: (f) => ['-layout', '-q', f, '-'] });
   return list;
 }
 
-function readCvText(input, { platform = process.platform, exec = execFileSync, env = process.env } = {}) {
+const fold = (text) => String(text || '').normalize('NFD').replace(/[\u0300-\u036f]/g, '').toLowerCase();
+
+// Whether the CV text names the talent: every name token of 3+ letters present.
+// Lets the AI drop a stranger's CV without showing its contents.
+function mentionsName(text, talentName) {
+  const tokens = fold(talentName).split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  if (tokens.length === 0) return null;
+  const body = fold(text);
+  return tokens.every((t) => body.includes(t));
+}
+
+const uniq = (list) => [...new Set(list)];
+
+// Contact links a CV header usually carries, so the AI can fill them directly.
+function extractLinks(text) {
+  const t = String(text || '');
+  return {
+    linkedin: uniq((t.match(/(?:https?:\/\/)?(?:[a-z]{2,3}\.)?linkedin\.com\/in\/[A-Za-z0-9_%-]+/gi) || []).map((u) => `https://www.${u.replace(/^https?:\/\//i, '').replace(/^(?:[a-z]{2,3}\.)?linkedin/i, 'linkedin')}`)),
+    github: uniq((t.match(/(?:https?:\/\/)?github\.com\/[A-Za-z0-9-]+/gi) || []).map((u) => `https://${u.replace(/^https?:\/\//i, '')}`)),
+    emails: uniq(t.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g) || []),
+    phones: uniq((t.match(/\+\d{1,3}[\s.-]?\d[\d\s.-]{6,14}\d/g) || []).map((p) => p.replace(/[\s.-]+/g, ' ').trim())),
+  };
+}
+
+function readCvText(input, { platform = process.platform, exec = execFileSync, env = process.env, talentName = null } = {}) {
   const file = expandHome(input, env);
-  if (typeof file !== 'string' || !path.isAbsolute(file) || !/\.pdf$/i.test(file)) return { ok: false, reason: 'not-a-pdf-path' };
+  if (typeof file !== 'string' || !path.isAbsolute(file) || !/\.(pdf|docx?)$/i.test(file)) return { ok: false, reason: 'not-a-cv-path' };
   let stat;
   try {
     stat = fs.statSync(file);
@@ -41,7 +69,7 @@ function readCvText(input, { platform = process.platform, exec = execFileSync, e
   if (!stat.isFile()) return { ok: false, reason: 'not-found' };
   if (stat.size > MAX_BYTES) return { ok: false, reason: 'too-large' };
 
-  for (const extractor of extractors(platform)) {
+  for (const extractor of extractors(platform, file)) {
     let text;
     try {
       text = run(extractor.cmd, extractor.args(file), exec).trim();
@@ -49,9 +77,16 @@ function readCvText(input, { platform = process.platform, exec = execFileSync, e
       continue;
     }
     if (!text) continue;
-    return { ok: true, extractor: extractor.name, truncated: text.length > MAX_CHARS, text: text.slice(0, MAX_CHARS) };
+    return {
+      ok: true,
+      extractor: extractor.name,
+      mentionsTalent: mentionsName(text, talentName),
+      links: extractLinks(text),
+      truncated: text.length > MAX_CHARS,
+      text: text.slice(0, MAX_CHARS),
+    };
   }
   return { ok: false, reason: 'no-text-extracted' };
 }
 
-module.exports = { readCvText, MAX_CHARS };
+module.exports = { readCvText, extractLinks, mentionsName, MAX_CHARS };

package/src/git-activity.js

@@ -3,9 +3,14 @@
 const { execFileSync } = require('child_process');
 const path = require('path');
 
+const { takePrefetchedGitLog } = require('./git-log-prefetch');
+
 const GIT_TIMEOUT_MS = 15000;
 const MAX_FILE_TYPES = 50;
 
+// The one history read behind the activity numbers (\x01 = commit marker, \x1f = field sep).
+const GIT_ACTIVITY_LOG_ARGS = ['log', '--no-merges', '--numstat', '--pretty=format:\x01%ae\x1f%at'];
+
 function runGit(root, args) {
   try {
     return execFileSync('git', ['-C', root, ...args], {
@@ -56,12 +61,8 @@ function collectGitActivity(root, verifiedEmail) {
 
   const sep = String.fromCharCode(1);
   const unit = String.fromCharCode(31);
-  const log = runGit(root, [
-    'log',
-    '--no-merges',
-    '--numstat',
-    `--pretty=format:${sep}%ae${unit}%at`,
-  ]);
+  const prefetchedLog = takePrefetchedGitLog(root, GIT_ACTIVITY_LOG_ARGS);
+  const log = prefetchedLog !== undefined ? prefetchedLog : runGit(root, GIT_ACTIVITY_LOG_ARGS);
   if (log === null) return null;
 
   const target = String(verifiedEmail || '')
@@ -120,4 +121,4 @@ function collectGitActivity(root, verifiedEmail) {
   };
 }
 
-module.exports = { collectGitActivity, extensionOf, isGitRepo };
+module.exports = { collectGitActivity, extensionOf, isGitRepo, GIT_ACTIVITY_LOG_ARGS };

package/src/git-log-prefetch.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const { execFile } = require('child_process');
+
+// Runs the aggregation's per-repo git logs concurrently with the collectors' exact args; each result is taken once and expires.
+
+const GIT_TIMEOUT_MS = 15000;
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+const MAX_CONCURRENT = 8;
+const TTL_MS = 60 * 1000;
+
+const prefetched = new Map();
+
+const keyOf = (root, args) => JSON.stringify([root, args]);
+
+function runAsync(root, args) {
+  return new Promise((resolve) => {
+    execFile(
+      'git',
+      ['-C', root, ...args],
+      { encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER },
+      (err, stdout) => resolve(err ? null : stdout),
+    );
+  });
+}
+
+// Runs every (root, args) pair, at most MAX_CONCURRENT at a time. Never throws.
+async function prefetchGitLogs(roots, argSets) {
+  const jobs = [];
+  for (const root of roots || []) {
+    for (const args of argSets) jobs.push({ root, args });
+  }
+  let next = 0;
+  const worker = async () => {
+    while (next < jobs.length) {
+      const { root, args } = jobs[next++];
+      const out = await runAsync(root, args);
+      if (out !== null) prefetched.set(keyOf(root, args), { out, at: Date.now() });
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(MAX_CONCURRENT, jobs.length) }, worker));
+}
+
+// The prefetched stdout for exactly this command, once; `undefined` on a miss.
+function takePrefetchedGitLog(root, args) {
+  const key = keyOf(root, args);
+  const hit = prefetched.get(key);
+  if (!hit) return undefined;
+  prefetched.delete(key);
+  return Date.now() - hit.at <= TTL_MS ? hit.out : undefined;
+}
+
+module.exports = { prefetchGitLogs, takePrefetchedGitLog };