shakers-cli-beta 0.8.0-beta.5 → 0.10.0

package/README.md

@@ -97,7 +97,7 @@ The **usage** signal is entirely local (no network, no model). See
 One line:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/devShakers/ai-usage-evaluator/main/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/devShakers/ai-usage-evaluator/release/install.sh | bash
 ```
 
 The installer:
@@ -139,7 +139,7 @@ env vars and `config.json` always win over the baked default.
 | Local | (checkout, `@shakers/shakers-cli`) | — | dev, or `SHAKERS_CLI_ENV=local` for localhost | run from the clone; no publish |
 
 Both publishes bump `version` first (the registry rejects re-publishing an
-existing version). The private one publishes from a checked-out `main` with the
+existing version). The private one publishes from a checked-out `release` with the
 committed `@shakers/shakers-cli` manifest, unchanged. For the beta, bump
 `BETA.version` in `scripts/prepare-beta.js` (manual, one line), then run the
 single command `npm run publish:beta`: it stamps `name`/`version`/`publishConfig`,
@@ -380,15 +380,39 @@ Desktop) can drive the same features as tools. It exposes, among others:
 
 - **AI usage**: `ai_usage`, `ai_usage_result`.
 - **Auth**: `login`, `logout`, `social_signin_start`, `social_signin_poll`.
-- **Register / onboarding**: `register`, `register_status`,
-  `onboarding_interview_start`, `onboarding_interview_turn`,
-  `onboarding_interview_complete`, `repeat_onboarding_interview`
+- **Sign-up** (from the talent's own AI, ticket 39540; copy from UX review
+  39574): every talent-facing text is fixed, comes from the tools in the
+  talent's language (es/en/it/pt, fixed by their first message) and the AI shows
+  it word for word. `signup_start` (welcome and permission to look for the CV),
+  `signup_email` (the email they read most), `signup_draft` (the profile draft
+  and the data notice, confirmed before the account exists),
+  `signup_create_account` (starts the hub import of LinkedIn + CV + what the AI
+  knows and opens the local password/Google window, which claims that profile
+  with a code kept only in memory; if the email already has an account, the
+  window asks the talent to sign in instead), `signup_status`,
+  `update_existing_profile` (shows what would change in an existing profile and
+  re-imports filling only empty fields), `save_profile_details`,
+  `import_profile`, `open_web` (opens the web signed in through a one-time
+  link), `open_linkedin_profile` (only when the talent does not know where to
+  find their LinkedIn URL), plus `suggest_register_context` and `read_cv`.
+  `ai_usage` is the step after the account exists, right after its two
+  disclaimers.
+- **Onboarding interview**: `onboarding_interview_start`,
+  `onboarding_interview_turn`, `onboarding_interview_complete` (if LiveKit
+  cannot load, the talent is sent to the web), `repeat_onboarding_interview`
   (OVERWRITE-repeat — the agent must warn the talent it is irreversible before
-  calling), `onboarding_finish`.
+  calling), `onboarding_finish` (only after a repeat; the sign-up never calls it).
 - **Roles**: `list_available_roles`, `add_role`, `list_my_roles`, `set_main_role`
   — `set_main_role` is the onboarding **final step** (after
   `onboarding_interview_complete`, or if the interview was skipped, offer
   `list_my_roles` and set the picked one).
+- **Closed questions** of the sign-up (AI-usage consent, which email, interview
+  here or later, how to answer it, main role) are answered by picking an option.
+  When the client declares the MCP `elicitation` capability (spec 2025-06-18),
+  the tool asks in the client's own dialog (`elicitation/create`) and gets the
+  pick directly; otherwise it returns `question` and `options` and the AI offers
+  them as buttons or a numbered list. The legal texts are always shown in the
+  chat before any consent dialog.
 - **Profile / skills / agents**: `list_addable`, `add_skill`, `add_agent`,
   `add_project`, `get_profile`, `get_rate`, `get_languages`, `list_socials`,
   `list_experiences`, `list_portfolios`, `get_availability`.
@@ -398,7 +422,8 @@ Desktop) can drive the same features as tools. It exposes, among others:
 - **Alma**: `ask`.
 
 MCP tool names are **stable** (renaming would break existing client configs); the
-role tools above were added, not renamed.
+role tools above were added, not renamed. `register`, `register_preview` and
+`register_status` were removed with the sign-up redesign, not renamed.
 
 ## Try it
 
@@ -587,9 +612,10 @@ run without a session (that is how you obtain/drop one); `logout` with no
 session is a silent no-op.
 
 ```bash
-shakers login                      # no method flag: interactive picker (Email / Google) on a real TTY
+shakers login                      # no method flag: interactive picker (Email / Google / LinkedIn) on a real TTY
 shakers login --email you@shakers.com   # skip the picker, prompt only for the password
 shakers login --google             # skip the picker, go straight to the Google flow
+shakers login --linkedin           # skip the picker, go straight to the LinkedIn flow
 shakers logout                     # forget the stored session (no-op if none)
 ```
 
@@ -608,7 +634,11 @@ shakers logout                     # forget the stored session (no-op if none)
   your machine — no client id, no loopback server, no secret; the Hub owns all
   Google config and does the token exchange server-side. After you authorize, the
   Hub session is exchanged for the same API JWT the email flow stores.
-- **LinkedIn is parked** (ADR-041/046) — not implemented.
+- **LinkedIn** signs in through the same device flow as Google, with
+  `provider=linkedin`: the `login --linkedin` / `--provider linkedin` flags and
+  the sign-in window served to AI apps (the loopback method-choice screen) both
+  route to it. This reverses the earlier parking (ADR-041/046). Whether it
+  completes depends on the Hub having a LinkedIn OAuth app provisioned.
 - The session (`{ accessToken, expiresAt, email }`) is stored **atomically**,
   permissions `600`, in `~/.config/shakers/auth-session.json`. **Logged in**
   means "an unexpired token is present" — an unparseable or missing

package/bin/ai-usage.js

@@ -6,6 +6,10 @@ const { detectReportLang, getCatalog } = require('../src/i18n');
 const { parseArgs } = require('../src/cli-args');
 const { loadConsentState } = require('../src/share');
 const { handleOneShotCommand } = require('../src/usage-oneshot-commands');
+const { prefetchGitLogs } = require('../src/git-log-prefetch');
+const { GIT_ACTIVITY_LOG_ARGS } = require('../src/git-activity');
+const { WORK_STREAMS_LOG_ARGS } = require('../src/work-streams');
+const { AUTHORSHIP_LOG_ARGS } = require('../src/authorship');
 const {
   resolveRepoScope,
   machineWideToplevels,
@@ -20,29 +24,14 @@ const {
   renderAndFinalize,
 } = require('../src/usage-run-steps');
 
-// `run(argv, { ask })`: shared by the dispatcher and register flow; an injected
-// `ask` is caller-owned. `bypassThrottle` (options, not argv) stays register-only.
-async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypassThrottle = false, inRegistration = false } = {}) {
-  const opts = parseArgs(argv);
-
-  // Resolve language first so even --help is localized.
-  const lang = opts.lang || detectReportLang();
-  const catalog = getCatalog(lang);
-
-  if (opts.help) {
-    process.stdout.write(catalog.cli.help);
-    return;
-  }
-
-  // One-shot commands (consent/endpoint config): act immediately, do NOT scan.
-  if (await handleOneShotCommand({ opts, catalog, injectedAsk })) return;
-
+// Steps 1-6 of a run: scan, scope, aggregate, classify; nothing is rendered or sent.
+async function computeUsage({ opts, catalog, lang, injectedAsk = null, inRegistration = false }) {
   // 1. Local scan + classify (always computed and shown, ADR-011/013).
   const { report, root, rootDir } = performScan({ opts, catalog });
 
   // 2. Identity gate + local agent-usage signal. Roadmap only for anonymous runs
   //    (gate.showRoadmap = !loggedIn) AND never during register/onboarding.
-  const { gate: identityGate } = prepareIdentityAndUsage({ report, catalog });
+  const { gate: identityGate } = prepareIdentityAndUsage({ report, catalog, quiet: opts.json === true });
   const gate = (inRegistration && identityGate.showRoadmap)
     ? { ...identityGate, showRoadmap: false }
     : identityGate;
@@ -56,6 +45,7 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
   const agentRoots = scope.toplevels;
 
   // 5. Aggregate scoped signals + rebuild scan/org-chart over the selection, re-classify.
+  await prefetchGitLogs(agentRoots, [GIT_ACTIVITY_LOG_ARGS, WORK_STREAMS_LOG_ARGS, AUTHORSHIP_LOG_ARGS]);
   runAggregation({ report, scope, consentEmail, agentRoots, root, catalog });
   const maturity = classify(report);
   const hasAgents = Array.isArray(report.agents) && report.agents.length > 0;
@@ -68,12 +58,40 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
   await runModelCalls({
     report, maturity, aiConsentGranted, opts, gate, hasAgents, agentRoots, rootDir, lang, catalog,
   });
+  return { report, maturity, root, gate };
+}
+
+// The MCP's scan: same steps, returned instead of printed, since stdout is its JSON-RPC channel.
+async function scanUsage(argv) {
+  const opts = parseArgs(argv);
+  const lang = opts.lang || detectReportLang();
+  const { report, maturity } = await computeUsage({ opts, catalog: getCatalog(lang), lang });
+  return { report, maturity };
+}
+
+// Shared by the dispatcher and register flow: an injected `ask` is caller-owned, `bypassThrottle` is register-only.
+async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypassThrottle = false, inRegistration = false } = {}) {
+  const opts = parseArgs(argv);
+
+  // Resolve language first so even --help is localized.
+  const lang = opts.lang || detectReportLang();
+  const catalog = getCatalog(lang);
+
+  if (opts.help) {
+    process.stdout.write(catalog.cli.help);
+    return;
+  }
+
+  // One-shot commands (consent/endpoint config): act immediately, do NOT scan.
+  if (await handleOneShotCommand({ opts, catalog, injectedAsk })) return;
+
+  const { report, maturity, root, gate } = await computeUsage({ opts, catalog, lang, injectedAsk, inRegistration });
 
   // 7. Render (or emit --json), persist, optional --build-next-level, auto-share.
   await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle });
 }
 
-module.exports = { run, resolveRepoScope, machineWideToplevels, promptScope };
+module.exports = { run, scanUsage, resolveRepoScope, machineWideToplevels, promptScope };
 
 // Auto-run only when executed directly, not when require()'d by the dispatcher.
 if (require.main === module) {

package/bin/login.js

@@ -78,7 +78,7 @@ async function run(
   if (opts.google) return runSocial('google', c, { openBrowser, sleep, lang });
   if (opts.linkedin) return runSocial('linkedin', c, { openBrowser, sleep, lang });
 
-  // No method flag: offer the picker (ADR-041/046 — Email and Google only, LinkedIn stays parked).
+  // No method flag: offer the picker (ADR-041/046 — Email, Google and LinkedIn; LinkedIn pending Hub OAuth provisioning).
   if (!hasMethodFlag(opts)) {
     const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
     if (stdinIsTTY) {

package/bin/mcp.js

@@ -23,8 +23,11 @@ const { makeOnboardingTools } = require('../src/mcp-onboarding-tools');
 const { makeRoleTools } = require('../src/mcp-role-tools');
 const { makeDeviceLoginTools } = require('../src/mcp-device-login-tools');
 const { makeRegisterTools } = require('../src/mcp-register-tools');
+const { makeSignupTools } = require('../src/mcp-signup-tools');
 const { detectFlowLang } = require('../src/i18n');
 const { makeReportTools } = require('../src/mcp-report-tools');
+const { makePrompts } = require('../src/mcp-prompts');
+const { buildServerInstructions } = require('../src/mcp-instructions');
 const { ensureFreshSession } = require('../src/session-refresh');
 
 let VERSION = '';
@@ -42,7 +45,10 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `  MCP client, not run by hand.\n`
   + `  Tools: ai_usage, ai_usage_result, login, logout, social_signin_start, social_signin_poll,\n`
   + `         list_addable, add_skill, add_agent,\n`
-  + `         add_project, suggest_register_context, read_cv, register_preview, register, register_status, onboarding_interview_start,\n`
+  + `         add_project, signup_start, signup_email, signup_draft, signup_create_account,\n`
+  + `         signup_status, update_existing_profile, import_profile, save_profile_details, open_web,\n`
+  + `         open_linkedin_profile,\n`
+  + `         suggest_register_context, read_cv, onboarding_interview_start,\n`
   + `         onboarding_interview_turn, onboarding_interview_complete,\n`
   + `         repeat_onboarding_interview, onboarding_finish,\n`
   + `         list_available_roles, add_role, list_my_roles, set_main_role,\n`
@@ -53,26 +59,23 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `         list_certifications, get_profile, get_rate, get_languages,\n`
   + `         list_socials, list_experiences, list_portfolios, ask.\n\n`;
 
-// The register and onboarding flows span several tools. Clients that load tool
-// schemas on demand only see the tool the model picked first, so the flow lives
-// here, where the client keeps it in context.
-const SERVER_INSTRUCTIONS = [
-  'Shakers talent tools. When the talent asks to register or sign up on Shakers, go straight to a filled draft: you fill the registration from what you know and from their CV, and they only confirm. Never open with a questionnaire or a list of what you do not know.',
-  'Register flow — load and use these tools in this order:',
-  '1. First reply: ONE short question — may you search for and read their CV on this machine to fill everything in?',
-  '2. With their yes: suggest_register_context (with talentName), then read_cv on the candidates (talentConsent:true, talentName) until one has mentionsTalent:true. Drop any CV with mentionsTalent:false (someone else\'s) without describing it. Take LinkedIn, GitHub, experience, languages and location from their CV.',
-  'No CV, no permission, or none of the CVs is theirs: do NOT fall back to questions. Build the same draft from everything else you know about them: your memory of past conversations, a search of those conversations if you have that tool, this conversation and any context or memory files you can see. The CV adds facts; it is never a precondition.',
-  '3. Infer EVERY field: employment from what you know (a company email or employer means employed there), pricing as a concrete estimate from role, seniority and location, motivation as your best match. Call register_preview.',
-  '4. Show ONE summary saying where each value comes from; only truly unknown required fields as a short question at the end, optional unknowns in one line. The sign-up goes to suggest_register_context\'s `environment`: never call a test environment production.',
-  '5. After their confirmation, call register.',
-  'Onboarding interview (onboarding_interview_start / onboarding_interview_turn): follow the ANSWER MODE described in onboarding_interview_start.',
-].join('\n');
+// The LOCAL (filesystem/machine) tools — the only ones the .mcpb bundle exposes; the
+// server-backed tools belong to the remote connector.
+const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_result', 'read_cv', 'suggest_register_context']);
 
-function buildServer() {
+// `localOnly` builds the scan-only server for the Claude .mcpb bundle, reusing the SAME
+// tool registry (just filtered) — no duplicate registration.
+function buildServer({ localOnly = false } = {}) {
+  const lang = detectFlowLang();
+  const allTools = [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang }), ...makeRegisterTools({ lang }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAskTools(), ...makeAlmaTools()];
+  const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
+  // Slash-command prompts, kept to the tools actually registered in this mode.
+  const prompts = makePrompts(new Set(tools.map((t) => t.name)), lang);
   return createMcpServer({
-    tools: [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools(), ...makeDeviceLoginTools(), ...makeRegisterTools({ lang: detectFlowLang() }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAskTools(), ...makeAlmaTools()],
-    serverInfo: { name: 'Shakers', version: VERSION || '0.0.0' },
-    instructions: SERVER_INSTRUCTIONS,
+    tools,
+    prompts,
+    serverInfo: { name: localOnly ? 'Shakers (local scan)' : 'Shakers', version: VERSION || '0.0.0' },
+    instructions: localOnly ? null : (client) => buildServerInstructions(client),
     // Long-lived server: refresh the email session's hub JWT from the stored
     // cookie before each tool call so a stale (~15-min) JWT never reaches a tool.
     beforeCall: () => ensureFreshSession(process.env),
@@ -92,7 +95,8 @@ async function run(argv = process.argv.slice(2)) {
 
   require('../src/config').sanitizeStaleBakedEndpoints(process.env);
 
-  const server = buildServer();
+  // `--local` = the scan-only server shipped in the Claude .mcpb bundle.
+  const server = buildServer({ localOnly: argv.includes('--local') });
   const rl = server.start({
     input: process.stdin,
     output: process.stdout,
@@ -107,7 +111,7 @@ async function run(argv = process.argv.slice(2)) {
   });
 }
 
-module.exports = { run, buildServer };
+module.exports = { run, buildServer, buildServerInstructions };
 
 if (require.main === module) {
   run();

package/bin/mcpb.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+'use strict';
+
+// Claude Desktop's built-in Node imports this entry from its own host, so it starts without a require.main check.
+require('./mcp').run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli-beta",
-  "version": "0.8.0-beta.5",
+  "version": "0.10.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {
@@ -16,13 +16,14 @@
     "start": "node bin/shakers.js",
     "shakers": "node bin/shakers.js",
     "test": "node --test test/*.test.js",
+    "build:mcpb": "sh scripts/build-mcpb.sh",
     "publish:beta": "node scripts/prepare-beta.js && npm publish --tag latest && git checkout -- package.json"
   },
   "engines": {
     "node": ">=18"
   },
   "dependencies": {
-    "@livekit/rtc-node": "^0.13.0"
+    "@livekit/rtc-node": "0.13.35"
   },
   "keywords": [
     "shakers",

package/src/auth-session-store.js

@@ -210,5 +210,6 @@ module.exports = {
   isPlatformTalent,
   PLATFORM_TALENT_USER_TYPES,
   decodeJwtPayload,
+  emailFromHubToken,
   firstNameFromSession,
 };

package/src/authorship.js

@@ -5,9 +5,13 @@ const path = require('path');
 
 // Git AUTHORSHIP + provenance for the certify phase (skill-code-certification, ADR-017).
 
+const { takePrefetchedGitLog } = require('./git-log-prefetch');
+
 const GIT_TIMEOUT_MS = 15000;
 const SHORT_SHA_LEN = 10;
 
+const AUTHORSHIP_LOG_ARGS = ['log', '--no-merges', '--pretty=format:\x01%ae\x1f%at', '--name-only'];
+
 function runGit(root, args) {
   try {
     return execFileSync('git', ['-C', root, ...args], {
@@ -72,12 +76,8 @@ function getRootPrefix(root) {
 function buildPathIndex(root) {
   const authorsByPath = new Map();
   const timeByPath = new Map();
-  const log = runGit(root, [
-    'log',
-    '--no-merges',
-    '--pretty=format:\x01%ae\x1f%at',
-    '--name-only',
-  ]);
+  const prefetched = takePrefetchedGitLog(root, AUTHORSHIP_LOG_ARGS);
+  const log = prefetched !== undefined ? prefetched : runGit(root, AUTHORSHIP_LOG_ARGS);
   if (log === null) return { authorsByPath, timeByPath };
 
   let currentEmail = null;
@@ -196,6 +196,7 @@ function attributeSample(sample, verifiedEmail, authorship, authorizedSet = null
 
 module.exports = {
   collectAuthorship,
+  AUTHORSHIP_LOG_ARGS,
   attributeSample,
   // exported for unit tests
   normalizeRemote,

package/src/backend-request.js

@@ -113,8 +113,8 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
         chunks.push(value.data, Buffer.from('\r\n'));
         continue;
       }
-      const clean = String(value).replace(UNSAFE_HEADER_VALUE_RE, '');
-      chunks.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${clean}\r\n`));
+      // The boundary delimits a part, so a value keeps its line breaks (a multi-line userQuery).
+      chunks.push(Buffer.from(`--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${String(value)}\r\n`));
     }
     chunks.push(Buffer.from(`--${boundary}--\r\n`));
     const data = Buffer.concat(chunks);

package/src/certify-dimension-client.js

@@ -4,7 +4,6 @@
 
 const { postJsonWithTimeout } = require('./backend-request');
 const { reasonForError } = require('./onboarding-client');
-const { toUpperLang } = require('./lang-codes');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 
@@ -154,62 +153,9 @@ async function discoverOfferableDimensions(deps = {}, { accessToken, hubAccessTo
   return { ok: true, mainRole: mine.mainRole, offerable, unmatched };
 }
 
-async function requestCreateCertificationInterview(
-  { dimensionKey, languageCode, accessToken } = {},
-  { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!dimensionKey) return { ok: false, reason: 'no-dimension' };
-  const body = { dimensionKey };
-  if (languageCode) body.languageCode = toUpperLang(languageCode);
-  let res;
-  try {
-    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status < 200 || res.status >= 300) {
-    const reason = reasonForError(res.status, res.raw);
-    if (reason !== 'dimension-on-cooldown') return { ok: false, reason };
-    // certs puts the date in the message only: "... available on 2026-10-28T14:50:38.265Z".
-    const available = String(res.raw || '').match(/available on (\d{4}-\d{2}-\d{2}T[\d:.]+Z)/);
-    return { ok: false, reason, availableOn: available ? available[1] : null };
-  }
-  const data = payloadOf(res.raw);
-  const interviewId = pick(data || {}, ['interviewId', 'id']);
-  if (!interviewId) return { ok: false, reason: 'bad-response' };
-  return { ok: true, interviewId, language: pick(data || {}, ['language', 'languageCode']) || null };
-}
-
-// Poll the verdict; a 2xx/404/425/202 with no band yet resolves `ready:false` (retriable).
-async function requestCertificationReport(
-  { interviewId, accessToken } = {},
-  { base, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!base) return { ok: false, reason: 'no-endpoint' };
-  if (!interviewId) return { ok: false, reason: 'no-interview' };
-  const url = `${base.replace(/\/+$/, '')}/${encodeURIComponent(interviewId)}/report`;
-  let res;
-  try {
-    res = await postJsonWithTimeout(url, null, timeoutMs, 'GET', null, bearerHeaders(accessToken));
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'network-error' };
-  }
-  if (res.status === 404 || res.status === 425 || res.status === 202) return { ok: true, ready: false, report: null };
-  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
-  const data = payloadOf(res.raw);
-  if (data === undefined || data === null || typeof data !== 'object') return { ok: true, ready: false, report: null };
-  const band = pick(data, ['band', 'level', 'combinedLevel']);
-  // A report with too little evidence for a level has band null; it is still finished.
-  if (!band && !pick(data, ['evaluationId'])) return { ok: true, ready: false, report: null };
-  return { ok: true, ready: true, report: data };
-}
-
 module.exports = {
   requestMyCertifications,
   requestTemplatesByDimension,
-  requestCreateCertificationInterview,
-  requestCertificationReport,
   composeDimensionKey,
   composeOfferableDimensions,
   discoverOfferableDimensions,

package/src/certify-dimension-flow.js

@@ -1,23 +1,15 @@
 'use strict';
 
-// `certify` dimension flow: discover -> pick -> create -> LiveKit interview -> poll verdict.
+// `certify` dimension flow: discover -> pick -> hand off to the web interview.
 
 const { runInteractiveMultiSelect } = require('./interactive-select');
 
 function makeCertifyDimensionDeps(overrides = {}) {
   const config = require('./config');
   const client = require('./certify-dimension-client');
-  const onboardingFlow = require('./onboarding-flow');
   return {
-    getCertificationInterviewsEndpoint: config.getCertificationInterviewsEndpoint,
-    // `{certsBase}/interviews` — shared base for LiveKit start/complete + the report poll.
-    getInterviewsBase: config.getOnboardingInterviewsEndpoint,
+    getTalentProfileUrl: config.getTalentProfileUrl,
     discoverOfferableDimensions: (opts) => client.discoverOfferableDimensions({}, opts),
-    requestCreateCertificationInterview: client.requestCreateCertificationInterview,
-    requestCertificationReport: client.requestCertificationReport,
-    conductLivekitInterview: onboardingFlow.conductLivekitInterview,
-    onboardingDeps: onboardingFlow.makeDeps(),
-    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
     ...overrides,
   };
 }
@@ -61,41 +53,19 @@ function resolveDimensionArg(arg, items) {
   return items.find((d) => d.dimensionKey === raw || d.slug === raw) || undefined;
 }
 
-// The evaluation lands one to two minutes after the interview ends, four when the queue is busy.
-async function pollReport(deps, { interviewId, accessToken }, { base, attempts = 60, intervalMs = 5000 } = {}) {
-  for (let i = 0; i < attempts; i++) {
-    const res = await deps.requestCertificationReport({ interviewId, accessToken }, { base });
-    if (!res.ok) return { ok: false, reason: res.reason };
-    if (res.ready) return { ok: true, report: res.report };
-    if (i < attempts - 1) await deps.sleep(intervalMs);
+// Deep link into the talent's Shakers web profile, filtered to the chosen dimension.
+// One dimension can publish more than one assessment, so the filtered catalog is the
+// robust target rather than a single templateId.
+function buildWebLink(profileUrl, dimension) {
+  if (!profileUrl || !dimension || !dimension.clusterId || !dimension.slug) return null;
+  let origin;
+  try {
+    origin = new URL(profileUrl).origin;
+  } catch {
+    return null;
   }
-  return { ok: false, reason: 'timeout' };
-}
-
-function formatDay(iso, lang) {
-  const d = iso ? new Date(iso) : null;
-  if (!d || Number.isNaN(d.getTime())) return null;
-  return d.toLocaleDateString(lang === 'en' ? 'en-GB' : 'es-ES', { day: 'numeric', month: 'long', year: 'numeric' });
-}
-
-function renderVerdict(report, cd) {
-  const lines = [];
-  const band = report.band || report.level || report.combinedLevel;
-  const dimension = report.dimensionName || report.dimension || report.dimensionKey;
-  if (dimension) lines.push(cd.verdictDimension(dimension));
-  if (band) lines.push(cd.verdictBand(band));
-  if (typeof report.certified === 'boolean') lines.push(report.certified ? cd.verdictCertified : cd.verdictNotCertified);
-  const summary = report.summary || report.rationale || report.feedback;
-  if (typeof summary === 'string' && summary.trim()) lines.push(summary.trim());
-  const areas = Array.isArray(report.areas) ? report.areas : null;
-  if (areas && areas.length) {
-    for (const a of areas) {
-      const name = a && (a.name || a.area || a.tag);
-      const note = a && (a.note || a.comment);
-      if (name) lines.push(`- ${name}${note ? `: ${note}` : ''}`);
-    }
-  }
-  return lines.join('\n  ');
+  const key = `${encodeURIComponent(dimension.clusterId)}/${encodeURIComponent(dimension.slug)}`;
+  return `${origin}/certifications?dimension=${key}`;
 }
 
 async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog, opts = {}, deps = makeCertifyDimensionDeps() }) {
@@ -146,41 +116,11 @@ async function runCertifyDimension({ io, ask, stdinIsTTY, session, lang, catalog
     }
   }
 
-  const createEndpoint = deps.getCertificationInterviewsEndpoint();
-  const created = await io.withProgress(cd.creating, () =>
-    deps.requestCreateCertificationInterview(
-      { dimensionKey: chosen.dimensionKey, languageCode: lang, accessToken },
-      { endpoint: createEndpoint },
-    ));
-  if (!created.ok) {
-    io.error(created.reason === 'dimension-on-cooldown'
-      ? cd.onCooldown(formatDay(created.availableOn, lang))
-      : cd.createFailed(created.reason));
-    return { ok: false, reason: created.reason, step: 'create' };
-  }
-
-  const interview = await deps.conductLivekitInterview(io, deps.onboardingDeps, {
-    interviewId: created.interviewId,
-    language: lang,
-    plain: true,
-  });
-  if (!interview.ok) {
-    io.warn(interview.reason === 'needs-web' ? cd.needsWeb : cd.interviewUnavailable(interview.reason));
-    return { ok: false, reason: interview.reason, step: 'interview' };
-  }
-
-  const reportBase = deps.getInterviewsBase();
-  const polled = await io.withProgress(cd.reportPolling, () =>
-    pollReport(deps, { interviewId: created.interviewId, accessToken }, { base: reportBase }));
-  if (!polled.ok) {
-    io.warn(polled.reason === 'timeout' ? cd.reportTimeout : cd.reportFailed(polled.reason));
-    return { ok: true, completed: 'interview', verdict: null };
-  }
-
-  io.section(cd.verdictTitle);
-  io.notify(renderVerdict(polled.report, cd));
-  io.success(cd.done);
-  return { ok: true, completed: 'interview', verdict: polled.report };
+  const webLink = buildWebLink(deps.getTalentProfileUrl(), chosen);
+  io.notify(cd.webHandoff);
+  if (webLink) io.success(cd.webHandoffLink(webLink));
+  else io.notify(cd.webHandoffNoLink);
+  return { ok: true, handoff: true, dimensionKey: chosen.dimensionKey, webLink };
 }
 
 module.exports = {
@@ -188,6 +128,5 @@ module.exports = {
   runCertifyDimension,
   chooseDimension,
   resolveDimensionArg,
-  pollReport,
-  renderVerdict,
+  buildWebLink,
 };

package/src/config.js

@@ -318,13 +318,6 @@ function getTemplatesByDimensionEndpoint(env = process.env) {
   return base ? `${base}/templates/by-dimension` : null;
 }
 
-function getCertificationInterviewsEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'CERTIFICATION_INTERVIEWS_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  const base = getCertsBase(env);
-  return base ? `${base}/users/me/certification-interviews` : null;
-}
-
 // Find Positions list (hub `works/positions/find`, talent Bearer). Serves the
 // All/Recommended/Saved tabs via `criteria.savedByMe`; ordered by match desc.
 function getFindPositionsEndpoint(env = process.env) {
@@ -535,6 +528,31 @@ function getImportProfileEndpoint(env = process.env) {
   return deriveFromHub(env, 'works/me/import-profile');
 }
 
+// MCP sign-up (ticket 39540): public UNREGISTERED + claim code, its import status, and the one-time web login.
+function getMcpSignupEndpoint(env = process.env) {
+  return deriveFromHub(env, 'works-ai/talents/mcp-signup');
+}
+
+function getMyImportStatusEndpoint(env = process.env) {
+  return deriveFromHub(env, 'works/me/import-profile/status');
+}
+
+function getOneTimeTokenEndpoint(env = process.env) {
+  return deriveFromHub(env, 'auth/one-time-token/generate');
+}
+
+// The ONE place the web route that redeems a one-time token is spelled (the route itself is a later works-frontend ticket).
+function getOneTimeLoginUrl(token, env = process.env) {
+  if (typeof token !== 'string' || !token) return null;
+  const profile = getTalentProfileUrl(env);
+  if (!profile) return null;
+  try {
+    return `${new URL(profile).origin}/auth/one-time?token=${encodeURIComponent(token)}`;
+  } catch {
+    return null;
+  }
+}
+
 function getProfessionalDetailsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PROFESSIONAL_DETAILS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -731,7 +749,6 @@ module.exports = {
   getSetMainRoleEndpoint,
   getAssignedClustersEndpoint,
   getTemplatesByDimensionEndpoint,
-  getCertificationInterviewsEndpoint,
   // Find Positions list (`find-projects` command / `find_projects` MCP tool).
   getFindPositionsEndpoint,
   // Marketplace (show-project / save-project / unsave-project / invitations).
@@ -771,6 +788,10 @@ module.exports = {
   sanitizeStaleBakedEndpoints,
   getSignUpEndpoint,
   getImportProfileEndpoint,
+  getMcpSignupEndpoint,
+  getMyImportStatusEndpoint,
+  getOneTimeTokenEndpoint,
+  getOneTimeLoginUrl,
   getProfessionalDetailsEndpoint,
   getPricingRateEndpoint,
   getSetAvailabilityEndpoint,