shakers-cli 0.14.2 → 0.16.0

package/src/interactive-select.js

@@ -3,7 +3,7 @@
 const { palette, styleQuestion } = require('./ansi');
 const { BRAND_ANSI } = require('./brand-ansi');
 
-// Zero-dependency interactive multi-select (skill-code-certification, issue 011).
+// Zero-dependency interactive multi-select.
 
 // COLOUR goes through the one gate (src/ansi.js).
 const ANSI = palette({

package/src/interview-client.js

@@ -100,7 +100,7 @@ class InterviewClient {
 
     // The end of the interview is a protocol message, not a sentence: matching the
     // goodbye text never fired (certs sends no closingMessage), so the CLI kept
-    // asking for answers until its turn-timeout (new-works, 2026-09-25).
+    // asking for answers until its turn-timeout.
     if (RoomEvent && RoomEvent.DataReceived && typeof room.on === 'function') {
       room.on(RoomEvent.DataReceived, (payload, _participant, _kind, topic) => {
         if (topic !== PROTOCOL_TOPIC) return;
@@ -216,8 +216,13 @@ class InterviewClient {
   }
 }
 
+function createInterviewClient(opts) {
+  return new InterviewClient(opts);
+}
+
 module.exports = {
   InterviewClient,
+  createInterviewClient,
   LiveKitNotInstalledError,
   loadLiveKitSdk,
   CHAT_TOPIC,

package/src/interview-transcript.js

@@ -4,7 +4,7 @@
 
 // Upper case: certs validates the role against its AGENT/USER enum and 400s the
 // whole PATCH otherwise, so every terminal onboarding lost its transcript
-// ("no se pudo guardar la transcripcion (http-400)", new-works 2026-09-25).
+// ("no se pudo guardar la transcripcion (http-400)").
 const ROLE_AGENT = 'AGENT';
 const ROLE_USER = 'USER';
 

package/src/legal-notice.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Shared PRESENTATION for the CLI's legal/consent disclosures (talents-ai-score).
+// Shared PRESENTATION for the CLI's legal/consent disclosures.
 
 const { palette, colorEnabled } = require('./ansi');
 const { BRAND_ANSI } = require('./brand-ansi');

package/src/maturity.js

@@ -12,7 +12,7 @@ const LEVELS = [
   { level: 4, key: 'orchestrator', name: 'Orquestador', emoji: '●' },
 ];
 
-// DECISION (talents-ai-score, signal expansion): the level definitions (LEVELS, HANDOFF §4) have NOT been touched.
+// DECISION: the level definitions (LEVELS) have NOT been touched.
 function depthTotals(tools) {
   let instructions = 0; // project instructions/rules files
   let mcp = 0; // configured MCP servers
@@ -30,7 +30,7 @@ function depthTotals(tools) {
   return { instructions, mcp, custom, hooks };
 }
 
-// Score model 0-100 for the visual meter — RECALIBRATED (ADR-008, skill-code-certification).
+// Score model 0-100 for the visual meter — RECALIBRATED.
 const SCORE_MODEL = [
   { key: 'breadth', weight: 12, full: 3 }, // number of AI tools detected
   { key: 'context', weight: 16, full: 2 }, // instructions + config files
@@ -61,7 +61,7 @@ function classify(report) {
       ? report.agentCounts.agents
       : 0;
 
-  // Score scope reverted to PROJECT ∪ HOME (skill-code-certification / ADR-010, which reverts ADR-009).
+  // Score scope reverted to PROJECT ∪ HOME.
   const score = computeScore({
     breadth,
     context: d.instructions, // depthTotals already folds `config` into instructions
@@ -72,7 +72,7 @@ function classify(report) {
     multiAgent: agentCount,
   });
 
-  // Band 0-4 derived from the tier engine (issue 019, single source of truth).
+  // Band 0-4 derived from the tier engine (single source of truth).
   const tierResult = computeTierResult(report);
   const level = tierResult.band;
   const meta = LEVELS[level];
@@ -87,11 +87,11 @@ function classify(report) {
     depth: d,
     hasAgentic,
     next: nextStep(level, { breadth, ...d, hasAgentic }),
-    // Tier (T0-T7, issue 019): the fine-grained axis the band is derived from.
+    // Tier (T0-T7): the fine-grained axis the band is derived from.
     tier: tierResult.tier,
     tierKey: tierResult.tierKey,
     tierName: tierResult.tierName,
-    // Setup Level (ADR-016): the 3-value rollup shown to the talent, derived
+    // Setup Level: the 3-value rollup shown to the talent, derived
     // from the tier. `{key, code, rank, emoji}`; label localized via i18n.
     setupLevel: tierResult.setupLevel,
   };

package/src/mcp-ai-usage-tool.js

@@ -77,7 +77,7 @@ function buildArgv({ root, repoScope, lang }) {
 
 function makeAiUsageTool(deps = {}) {
   const {
-    scanUsage = (argv) => require('../bin/ai-usage').scanUsage(argv),
+    scanUsage = (argv) => require('./usage-scan').scanUsage(argv),
     autoShare = require('./share').autoShare,
     recordConsent = require('./share').recordConsent,
     isValidEmail = require('./share').isValidEmail,

package/src/mcp-auth-form.js

@@ -244,7 +244,7 @@ const LINKEDIN_IN = '<svg class="g" viewBox="0 0 24 24" aria-hidden="true">'
 // Each window offers these methods, in this order. The sign-up window has no LinkedIn: only Google carries the claim code there.
 const WINDOW_METHODS = { login: ['google', 'linkedin', 'email'], register: ['google', 'email'] };
 
-// The method-choice screen (talents-ai-score) — the FIRST screen of the loopback form when more than one method is offered for this flow.
+// The method-choice screen — the FIRST screen of the loopback form when more than one method is offered for this flow.
 function methodChoiceHtml(mode, lang, methods) {
   const c = copy(lang);
   const title = mode === 'register' ? c.chooseTitleRegister : c.chooseTitleLogin;

package/src/mcp-detector.js

@@ -4,7 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { getHomeDir } = require('./env-paths');
 
-// KEYWORD -> { SERVICE LABEL, CATEGORY } (issue 110).
+// KEYWORD -> { SERVICE LABEL, CATEGORY }.
 const SERVICE_CATALOG = [
   // --- data ---
   { kw: 'postgresql', label: 'Postgres', category: 'data' },
@@ -87,7 +87,7 @@ function serviceForMcpServerName(name) {
   return hit && hit.label ? hit.label : null;
 }
 
-// THE single inventory of MCP config locations (issue 112).
+// THE single inventory of MCP config locations.
 const MCP_CONFIG_LOCATIONS = [
   // --- Claude Code (already read before 112) ---
   { tool: 'claude-code', scope: 'project', keys: ['mcpServers'], confidence: 'high', file: (root) => path.join(root, '.mcp.json') },
@@ -181,7 +181,7 @@ function detectMcpServers(root) {
         // 'project' wins when a server is declared in both: the most specific
         // scope is the honest label for "this repo uses it".
         scope: entry.scopes.has('project') ? 'project' : 'home',
-        // Issue 110: the PRODUCT, derived from the name only. `null` when the
+        // The PRODUCT, derived from the name only. `null` when the
         // name carries none — a state, not a hole.
         service: serviceForMcpServerName(name),
       };

package/src/mcp-device-login-tools.js

@@ -24,6 +24,7 @@ function makeDeviceLoginTools(deps = {}) {
     pollDeviceToken = require('./device-login').pollDeviceToken,
     finalizeDeviceSession = require('./device-login').finalizeDeviceSession,
     appendProviderParam = require('./device-login').appendProviderParam,
+    deviceSessionRecord = require('./device-login').deviceSessionRecord,
     savePendingDevice = require('./device-auth-store').savePendingDevice,
     loadPendingDevice = require('./device-auth-store').loadPendingDevice,
     clearPendingDevice = require('./device-auth-store').clearPendingDevice,
@@ -144,7 +145,7 @@ function makeDeviceLoginTools(deps = {}) {
       return { ok: false, status: 'error', reason: fin.reason };
     }
     try {
-      saveAuthSession({ accessToken: fin.token, hubAccessToken: fin.token, email: res.email || pending.email || null });
+      saveAuthSession(deviceSessionRecord({ token: fin.token, sessionToken: res.accessToken, sessionExpiresIn: res.expiresIn, email: res.email || pending.email || null }));
     } catch {
       clearPendingDevice();
       return { ok: false, status: 'error', reason: 'session-persist-failed' };

package/src/mcp-find-projects-tools.js

@@ -3,8 +3,7 @@
 // MCP: list the Positions/Projects available to the talent (Find Positions),
 // paginated + filtered server-side. Same params as the CLI so an agent can page.
 
-const { TABS, ATTENDANCE, DEFAULT_LIMIT } = require('./find-projects-client');
-const { splitRecommended } = require('./find-projects-flow');
+const { TABS, ATTENDANCE, DEFAULT_LIMIT, splitRecommended } = require('./find-projects-client');
 
 const FIND_PROJECTS_SCHEMA = {
   type: 'object',

package/src/mcp-onboarding-tools.js

@@ -76,6 +76,7 @@ function makeOnboardingTools(deps = {}) {
     requestDiscoveredInventory = require('./inventory-client').requestDiscoveredInventory,
     requestDiscoveredInventoryWithRefresh = require('./inventory-client').requestDiscoveredInventoryWithRefresh,
     ensureFreshSession = require('./session-refresh').ensureFreshSession,
+    endSession = require('./session-refresh').endSession,
     requestDeclareSkill = require('./skills-client').requestDeclareSkill,
     requestDeclareAgent = require('./agents-client').requestDeclareAgent,
     requestListAgents = require('./agents-client').requestListAgents,
@@ -86,7 +87,7 @@ function makeOnboardingTools(deps = {}) {
     getRemoteUrl = require('./portfolio-git-info').getRemoteUrl,
     getCommitDateRange = require('./portfolio-git-info').getCommitDateRange,
     consentCopy = () => require('./signup-copy').signupCopy(require('./signup-language').signupLanguage(require('./i18n').detectFlowLang())).consent,
-    normalizeDomain = require('./start-add-portfolio').normalizeDomain,
+    normalizeDomain = require('./portfolio-client').normalizeDomain,
     isValidEmail = require('./share').isValidEmail,
     normalizeEmail = require('./share').normalizeEmail,
   } = deps;
@@ -115,8 +116,7 @@ function makeOnboardingTools(deps = {}) {
   };
 
   async function logout() {
-    const wasLoggedIn = loadAuthSession() !== null;
-    try { clearAuthSession(); } catch { /* idempotent — nothing to clear */ }
+    const wasLoggedIn = await endSession(process.env, { loadAuthSession, clearAuthSession });
     return { ok: true, wasLoggedIn };
   }
 
@@ -251,7 +251,7 @@ function makeOnboardingTools(deps = {}) {
     const relatedInput = Array.isArray(args.relatedPortfolios) ? args.relatedPortfolios : [];
     if (relatedInput.length === 0 || !agentId) return { ...base, portfolios };
 
-    // ADR-041 replace-set: validate every portfolioId against the talent's own
+    // Replace-set: validate every portfolioId against the talent's own
     // list, then PATCH the whole set in ONE call.
     const items = [];
     const relateFailures = [];

package/src/mcp-prompts.js

@@ -37,10 +37,10 @@ const PROMPTS = [
   },
   {
     name: 'certify',
-    description: 'See which role dimensions you can certify and start a certification.',
+    description: 'See which role dimensions you can certify; the certification itself is taken on the Shakers web.',
     tools: ['list_certifiable_dimensions'],
     buildMessages: () => userText(
-      'Help me certify on Shakers: call `list_certifiable_dimensions`, present the dimensions I can certify by name, and guide me through certifying the one I pick.',
+      'Help me certify on Shakers: call `list_certifiable_dimensions` and present the dimensions I can certify by name, and when I can retry the others. The certification interview is taken on the Shakers web, not in this chat: offer to open it with `open_web`. Never show internal ids/codes.',
     ),
   },
   {

package/src/mcp-register-tools.js

@@ -204,6 +204,7 @@ function makeRegisterTools(deps = {}) {
 
   // Creates the interview, joins its room and reads the greeting; `room` lets a timed-out caller close what opened late.
   async function openRoom(args, room) {
+    if (typeof resolved.makeInterviewClient !== 'function') return onWeb('connect', 'livekit-not-installed');
     const start = await flow.createAndStartLivekitOnboarding(resolved, {
       candidateId: args.candidateId,
       language: args.language || lang,

package/src/mcp-server.js

@@ -34,7 +34,7 @@ function errorResponse(id, code, message, data) {
   return { jsonrpc: JSONRPC, id: id === undefined ? null : id, error };
 }
 
-function createMcpServer({ tools = [], prompts = [], serverInfo = {}, protocolVersion, beforeCall = null, onInitialize = null, instructions = null, elicitationTimeoutMs = ELICITATION_TIMEOUT_MS } = {}) {
+function createMcpServer({ tools = [], prompts = [], serverInfo = {}, protocolVersion, beforeCall = null, afterCall = null, onInitialize = null, instructions = null, elicitationTimeoutMs = ELICITATION_TIMEOUT_MS } = {}) {
   const registry = new Map();
   for (const t of tools) {
     if (!t || !t.name || typeof t.handler !== 'function') {
@@ -185,6 +185,10 @@ function createMcpServer({ tools = [], prompts = [], serverInfo = {}, protocolVe
         content: [{ type: 'text', text: `${name} tool error: ${e && e.message ? e.message : String(e)}` }],
         isError: true,
       };
+    } finally {
+      if (typeof afterCall === 'function') {
+        try { afterCall(name); } catch { /* hook must never break a tool call */ }
+      }
     }
   }
 

package/src/mcp-signup-client.js

@@ -2,12 +2,12 @@
 
 const { postJsonWithTimeout, postMultipartWithTimeout } = require('./backend-request');
 
-// Hub calls of the MCP sign-up (ticket 39540): public sign-up + claim code, the signed-in talent's import status, and the one-time web login token.
+// Hub calls of the MCP sign-up: public sign-up + claim code, the signed-in talent's import status, and the one-time web login token.
 
 const SIGNUP_TIMEOUT_MS = 60000;
 const DEFAULT_TIMEOUT_MS = 15000;
 
-// Hub's coded errors on the sign-up, verified against the works-ai exception filter (hub MR !2198); none says whether an account exists.
+// Hub's coded errors on the sign-up; none says whether an account exists.
 const CODE_TO_REASON = {
   MISSING_SOURCE: 'missing-source',
   INVALID_CV: 'invalid-cv',

package/src/mcp-signup-tools.js

@@ -13,7 +13,7 @@ const { askAfterTexts, askConsent, optionFor, queueNotice, takeNotices } = requi
 const { expandHome, tildify } = require('./env-paths');
 const { NOOP_FUNNEL, weeklyHours, rateTypes, workSituationValue } = require('./onboarding-funnel');
 
-// MCP sign-up (ticket 39540): hub imports into an UNREGISTERED profile that the local window claims with a code kept only in memory.
+// MCP sign-up: hub imports into an UNREGISTERED profile that the local window claims with a code kept only in memory.
 
 const SIGNUP_WINDOW_TIMEOUT_MS = 15 * 60 * 1000;
 // The browser opens this long after the tool answers, so the AI's reply is on screen first.
@@ -302,6 +302,7 @@ function makeSignupTools(deps = {}) {
     pollDeviceToken = require('./device-login').pollDeviceToken,
     finalizeDeviceSession = require('./device-login').finalizeDeviceSession,
     appendProviderParam = require('./device-login').appendProviderParam,
+    deviceSessionRecord = require('./device-login').deviceSessionRecord,
     buildRegistrationContext = require('./signup-client').buildRegistrationContext,
     runLoopbackAuth = require('./mcp-auth-form').runLoopbackAuth,
     checkOnboardingCompleted = require('./onboarding-availability').checkOnboardingCompleted,
@@ -347,6 +348,10 @@ function makeSignupTools(deps = {}) {
       funnel.completed('account_creation', { auth_method: next.via, is_returning_account: next.state === 'existing' });
       funnel.identified();
     }
+    if (next.state === 'failed' && before !== 'failed') {
+      funnel.errored('account_creation', next.reason);
+      funnel.flush();
+    }
     if (state.wake) state.wake();
   }
 
@@ -385,7 +390,7 @@ function makeSignupTools(deps = {}) {
       }
       const email = res.email || emailFromHubToken(fin.token);
       try {
-        resolved.saveAuthSession({ accessToken: fin.token, hubAccessToken: fin.token, email });
+        resolved.saveAuthSession(deviceSessionRecord({ token: fin.token, sessionToken: res.accessToken, sessionExpiresIn: res.expiresIn, email }));
       } catch {
         setAccount({ state: 'failed', reason: 'session-persist-failed' });
         return;
@@ -576,6 +581,7 @@ function makeSignupTools(deps = {}) {
       return { ok: false, reason: 'draft-sources-required', message: "The draft needs sources: 'cv' if you read their CV, 'linkedin' only if you have their LinkedIn URL. Then call signup_draft again." };
     }
     if (!state.firstDraft) state.firstDraft = draft;
+    trackDraftShown(draft);
     const asked = await askAfterTexts(ctx, {
       tool: 'signup_draft',
       texts: [renderDraft(lang(), draft), legalCopy(lang()).signupNotice(sources), knownAccount() ? c.windowNoticeSignIn : c.windowNotice],
@@ -951,6 +957,20 @@ function makeSignupTools(deps = {}) {
     return c.ratesSaved(shown, !(state.draft && state.draft.ratesFromTalent));
   }
 
+  function trackDraftShown(draft) {
+    funnel.viewed('work_situation', { is_prefilled: true });
+    funnel.viewed('availability');
+    funnel.viewed('rates', { suggested_rate_shown: draft.ratesFromTalent !== true });
+    funnel.viewed('languages');
+    funnel.viewed('location');
+    funnel.viewed('profile_summary');
+  }
+
+  function draftFieldsEdited() {
+    if (!state.firstDraft || !state.draft) return undefined;
+    return DRAFT_FIELDS.filter((key) => String(state.firstDraft[key] ?? '') !== String(state.draft[key] ?? '')).length;
+  }
+
   function wasEdited(step) {
     if (!state.firstDraft || !state.draft) return undefined;
     return STEP_DRAFT_FIELDS[step].some((key) => String(state.firstDraft[key] ?? '') !== String(state.draft[key] ?? ''));
@@ -982,6 +1002,10 @@ function makeSignupTools(deps = {}) {
       const codes = details.languages.map((row) => String(row.language || '').trim().toLowerCase()).filter(Boolean);
       step('languages', { languages_count: codes.length, languages: codes });
     }
+    const sections = Object.entries(results).filter(([name]) => name !== 'phone');
+    if (sections.length && sections.every(([, r]) => r.ok === true)) {
+      funnel.completed('profile_summary', { fields_edited_count: draftFieldsEdited() });
+    }
     funnel.flush();
   }
 

package/src/memory-structure-detector.js

@@ -4,7 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { getHomeDir } = require('./env-paths');
 
-// Deterministic (no-LLM) memory STRUCTURE detector (talents-ai-score, issue 016 / ADR-013-014).
+// Deterministic (no-LLM) memory STRUCTURE detector.
 
 const MAX_FILE_BYTES = 2_000_000; // safety cap: never read a pathologically huge file
 const MAX_IMPORT_DEPTH = 5; // mirrors Claude Code's own documented import-hop limit

package/src/model-call-record.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// What happened with each model call, written down (talents-ai-score, issue 109).
+// What happened with each model call, written down.
 
 // The three keys.
 const MODEL_CALL = Object.freeze({
@@ -163,7 +163,7 @@ function callPartial(report, key) {
   return !!c && c.ok === true && Array.isArray(c.omitted) && c.omitted.length > 0;
 }
 
-// THE CALL LOST TIME TO A DEADLINE — and this is NOT `reason === TIMEOUT` (issue 116, found by measuring, not by reading).
+// THE CALL LOST TIME TO A DEADLINE — and this is NOT `reason === TIMEOUT` (found by measuring, not by reading).
 function callTimedOut(report, key) {
   const c = modelCall(report, key);
   if (!c || c.ok !== false) return false;

package/src/onboarding-flow.js

@@ -168,7 +168,7 @@ function normalizeAmount(value) {
   return cents / 100;
 }
 
-// Pricing input (ADR-024).
+// Pricing input.
 function validatePricing(input = {}) {
   const fullSelected = input.fullTimeSelected === true;
   const partSelected = input.partTimeSelected === true;
@@ -212,7 +212,7 @@ function buildPricingUpsert({ fullSelected, fullAmount, fullCurrency, partSelect
   };
 }
 
-// Availability + location (ADR-028).
+// Availability + location.
 function validateAvailability(input = {}) {
   const body = { confirmed: true };
   if (typeof input.available === 'boolean') body.available = input.available;
@@ -299,7 +299,6 @@ function makeDeps(overrides = {}) {
     runMainRoleStep: require('./roles-flow').runOnboardingMainRoleStep,
     makeRolesDeps: require('./roles-flow').makeRolesDeps,
     requestDiscoveredInventory: inventory.requestDiscoveredInventory,
-    makeInterviewClient: (opts) => new (require('./interview-client').InterviewClient)(opts),
     // Used by reattachConsentIdentity (A) to re-anchor the ingest identity.
     recordConsent: require('./share-consent-state').recordConsent,
     ...overrides,
@@ -371,7 +370,7 @@ async function establishSessionFromCredentials(deps, { email, password } = {}) {
 
 // Register a talent via a social provider (device flow, RFC 8628); a live session results either way.
 async function registerWithSocialAccount(deps, { provider = 'google', freelanceType, language } = {}, { openBrowser, onAuthUrl } = {}) {
-  const { appendProviderParam } = require('./device-login');
+  const { appendProviderParam, deviceSessionRecord } = require('./device-login');
   const authorizeEndpoint = deps.getDeviceAuthorizeEndpoint();
   const tokenEndpoint = deps.getDeviceTokenEndpoint();
   const authTokenEndpoint = typeof deps.getAuthTokenEndpoint === 'function' ? deps.getAuthTokenEndpoint() : null;
@@ -397,13 +396,8 @@ async function registerWithSocialAccount(deps, { provider = 'google', freelanceT
   );
   if (!result.ok) return { ok: false, reason: result.reason || 'register-failed' };
 
-  // Persist the API JWT the exchange minted (no cookie), like the retired Google flow did.
   try {
-    deps.saveAuthSession({
-      accessToken: result.token,
-      hubAccessToken: result.token,
-      email: result.email || null,
-    });
+    deps.saveAuthSession(deviceSessionRecord(result));
   } catch {
     return { ok: false, reason: 'session-persist-failed' };
   }
@@ -698,6 +692,12 @@ async function runOnboarding(io, deps = makeDeps(), { method = 'email', openBrow
   funnel.completed('start');
   io.section(c.signupTitle);
   funnel.viewed('account_creation');
+  funnel.flush();
+  const accountFailed = (reason) => {
+    funnel.errored('account_creation', reason);
+    funnel.flush();
+    return { ok: false, reason, step: 'signup' };
+  };
 
   if (method === 'google' || method === 'linkedin') {
     // The provider supplies name/email; freelanceType is derived later from work situation.
@@ -709,7 +709,7 @@ async function runOnboarding(io, deps = makeDeps(), { method = 'email', openBrow
     );
     if (!reg.ok) {
       io.error(c.signupError);
-      return { ok: false, reason: reg.reason, step: 'signup' };
+      return accountFailed(reg.reason);
     }
     funnel.completed('account_creation', { auth_method: method, is_returning_account: reg.kind === 'account-already-exists' });
     funnel.identified();
@@ -721,23 +721,23 @@ async function runOnboarding(io, deps = makeDeps(), { method = 'email', openBrow
     notifyOk(io, c.accountReady);
   } else {
     const account = await io.askSignUp(c);
-    if (!account || !account.email) return { ok: false, reason: 'missing-fields', step: 'signup' };
+    if (!account || !account.email) return accountFailed('missing-fields');
     if (!isAcceptablePassword(account.password)) {
       io.error(c.weakPassword);
-      return { ok: false, reason: 'weak-password', step: 'signup' };
+      return accountFailed('weak-password');
     }
 
     const su = await signUp(deps, { ...account, preferredLanguage: account.preferredLanguage || io.lang });
     if (!su.ok) {
       io.error(su.message || c.signupError);
-      return { ok: false, reason: su.reason, step: 'signup' };
+      return accountFailed(su.reason);
     }
 
     if (su.accountExists) {
       // Existing account: sign them in, then STOP — no wizard re-run.
       io.warn(c.accountExists);
       const logged = await io.login(account.email);
-      if (!logged) return { ok: false, reason: 'login-failed', step: 'signup' };
+      if (!logged) return accountFailed('login-failed');
       funnel.completed('account_creation', { auth_method: 'email', is_returning_account: true });
       funnel.identified();
       return { ok: true, alreadyRegistered: true };
@@ -745,7 +745,7 @@ async function runOnboarding(io, deps = makeDeps(), { method = 'email', openBrow
     const sess = await establishSessionFromCredentials(deps, { email: account.email, password: account.password });
     if (!sess.ok) {
       io.error(c.sessionError);
-      return { ok: false, reason: sess.reason, step: 'signup' };
+      return accountFailed(sess.reason);
     }
     funnel.completed('account_creation', { auth_method: 'email', is_returning_account: false });
     funnel.identified();