shakers-cli 0.15.0 → 0.16.0

package/bin/ai-usage.js

@@ -1,74 +1,21 @@
 #!/usr/bin/env node
 'use strict';
 
-const { classify } = require('../src/maturity');
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { parseArgs } = require('../src/cli-args');
-const { loadConsentState } = require('../src/share');
 const { handleOneShotCommand } = require('../src/usage-oneshot-commands');
-const { prefetchGitLogs } = require('../src/git-log-prefetch');
-const { GIT_ACTIVITY_LOG_ARGS } = require('../src/git-activity');
-const { WORK_STREAMS_LOG_ARGS } = require('../src/work-streams');
-const { AUTHORSHIP_LOG_ARGS } = require('../src/authorship');
+const { computeUsage } = require('../src/usage-scan');
 const {
   resolveRepoScope,
   machineWideToplevels,
   promptScope,
 } = require('../src/usage-repo-scope');
 const {
-  performScan,
   prepareIdentityAndUsage,
   resolveAiConsent,
-  runAggregation,
-  runModelCalls,
   renderAndFinalize,
 } = require('../src/usage-run-steps');
 
-// Steps 1-6 of a run: scan, scope, aggregate, classify; nothing is rendered or sent.
-async function computeUsage({ opts, catalog, lang, injectedAsk = null, inRegistration = false }) {
-  // 1. Local scan + classify (always computed and shown, ADR-011/013).
-  const { report, root, rootDir } = performScan({ opts, catalog });
-
-  // 2. Identity gate + local agent-usage signal. Roadmap only for anonymous runs
-  //    (gate.showRoadmap = !loggedIn) AND never during register/onboarding.
-  const { gate: identityGate } = prepareIdentityAndUsage({ report, catalog, quiet: opts.json === true });
-  const gate = (inRegistration && identityGate.showRoadmap)
-    ? { ...identityGate, showRoadmap: false }
-    : identityGate;
-
-  // 3. Consent gate before any AI/egress call (ADR-051); a decline still renders.
-  const aiConsentGranted = await resolveAiConsent({ opts, catalog, gate, injectedAsk });
-
-  // 4. Repo scoping (exclude client work).
-  const scope = await resolveRepoScope({ opts, cwd: rootDir, injectedAsk, catalog });
-  const consentEmail = (loadConsentState() || {}).email || null;
-  const agentRoots = scope.toplevels;
-
-  // 5. Aggregate scoped signals + rebuild scan/org-chart over the selection, re-classify.
-  await prefetchGitLogs(agentRoots, [GIT_ACTIVITY_LOG_ARGS, WORK_STREAMS_LOG_ARGS, AUTHORSHIP_LOG_ARGS]);
-  runAggregation({ report, scope, consentEmail, agentRoots, root, catalog });
-  const maturity = classify(report);
-  const hasAgents = Array.isArray(report.agents) && report.agents.length > 0;
-  report.analyzedRepos =
-    scope.mode === 'all'
-      ? null
-      : scope.toplevels.map((tl) => tl.split(/[/\\]/).pop() || tl);
-
-  // 6. The three ephemeral model calls, serialized and gated by consent (ADR-051).
-  await runModelCalls({
-    report, maturity, aiConsentGranted, opts, gate, hasAgents, agentRoots, rootDir, lang, catalog,
-  });
-  return { report, maturity, root, gate };
-}
-
-// The MCP's scan: same steps, returned instead of printed, since stdout is its JSON-RPC channel.
-async function scanUsage(argv) {
-  const opts = parseArgs(argv);
-  const lang = opts.lang || detectReportLang();
-  const { report, maturity } = await computeUsage({ opts, catalog: getCatalog(lang), lang });
-  return { report, maturity };
-}
-
 // Shared by the dispatcher and register flow: an injected `ask` is caller-owned, `bypassThrottle` is register-only.
 async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypassThrottle = false, inRegistration = false } = {}) {
   const opts = parseArgs(argv);
@@ -85,13 +32,21 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
   // One-shot commands (consent/endpoint config): act immediately, do NOT scan.
   if (await handleOneShotCommand({ opts, catalog, injectedAsk })) return;
 
-  const { report, maturity, root, gate } = await computeUsage({ opts, catalog, lang, injectedAsk, inRegistration });
+  const { report, maturity, root, gate } = await computeUsage({
+    opts,
+    catalog,
+    lang,
+    inRegistration,
+    prepareIdentity: prepareIdentityAndUsage,
+    resolveConsent: (args) => resolveAiConsent({ ...args, injectedAsk }),
+    resolveScope: (args) => resolveRepoScope({ ...args, injectedAsk }),
+  });
 
   // 7. Render (or emit --json), persist, optional --build-next-level, auto-share.
   await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle });
 }
 
-module.exports = { run, scanUsage, resolveRepoScope, machineWideToplevels, promptScope };
+module.exports = { run, resolveRepoScope, machineWideToplevels, promptScope };
 
 // Auto-run only when executed directly, not when require()'d by the dispatcher.
 if (require.main === module) {

package/bin/login.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 'use strict';
 
-// `login` / `logout` — a registered Talent identifies themselves to the CLI (talents-ai-score, issue 122 / ADR-044).
+// `login` / `logout` — a registered Talent identifies themselves to the CLI.
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
-const { runDeviceLogin, appendProviderParam } = require('../src/device-login');
+const { runDeviceLogin, appendProviderParam, deviceSessionRecord } = require('../src/device-login');
 const { buildRegistrationContext } = require('../src/signup-client');
 const { openPath } = require('../src/open-file');
+const { endSession } = require('../src/session-refresh');
 const {
   saveAuthSession,
-  clearAuthSession,
   loadAuthSession,
   sessionStatus,
 } = require('../src/auth-session-store');
@@ -68,13 +68,13 @@ async function run(
 
   if (!method) {
     const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
-    // ADR-044: an ACTIVE session is not silently overwritten, and the picker never shows.
+    // An ACTIVE session is not silently overwritten, and the picker never shows.
     if (sessionStatus(loadAuthSession()) === 'active') {
       (output || process.stdout).write(`\n  ${c.alreadyLoggedIn}\n\n`);
       return;
     }
     if (stdinIsTTY) {
-      // ADR-041/046 — the picker offers Email, Google and LinkedIn.
+      // The picker offers Email, Google and LinkedIn.
       const pickerAsk = injectedAsk || createStdinAsk();
       try {
         method = await chooseLoginMethod({ ask: pickerAsk, stdinIsTTY, c, input, output });
@@ -108,6 +108,8 @@ function persistAndReport(result, c, email = null, output = process.stdout) {
       accessTokenExpiresAt: result.expiresAt,
       cookie: result.cookie || null,
       cookieExpiresAt: result.cookieExpiresAt || null,
+      sessionToken: result.sessionToken || null,
+      sessionExpiresAt: result.sessionExpiresAt || null,
       email,
       hubAccessToken: result.hubAccessToken || null,
     });
@@ -167,9 +169,8 @@ async function runDeviceFlow(provider, c, { openBrowser = openPath, sleep = unde
 
 function handleDeviceResult(result, c, output = process.stdout) {
   if (result.ok) {
-    // Map the device-flow JWT to the shared persist shape (no cookie).
     return void persistAndReport(
-      { accessToken: result.token, hubAccessToken: result.token, email: result.email || null },
+      deviceSessionRecord(result),
       c,
       result.email || null,
       output,
@@ -196,13 +197,12 @@ function handleDeviceResult(result, c, output = process.stdout) {
   process.exitCode = 1;
 }
 
-// `logout` — local only (no endpoint, no network): forget the stored session.
+// `logout`: revoke the hub session (best-effort) and forget the stored one.
 async function runLogout(argv = process.argv.slice(2), { output = process.stdout } = {}) {
   const opts = parseArgs(argv);
   const lang = opts.lang || detectReportLang();
   const c = getCatalog(lang).login;
-  const had = loadAuthSession() !== null;
-  clearAuthSession();
+  const had = await endSession(process.env);
   clearConsentState();
   output.write(`\n  ${had ? c.loggedOut : c.notLoggedIn}\n\n`);
 }

package/bin/mcp.js

@@ -65,9 +65,9 @@ const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_result', 'read_cv',
 
 // `localOnly` builds the scan-only server for the Claude .mcpb bundle, reusing the SAME
 // tool registry (just filtered) — no duplicate registration.
-function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp' }) } = {}) {
+function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp' }), makeInterviewClient = null } = {}) {
   const lang = detectFlowLang();
-  const allTools = [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
+  const allTools = [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
   const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
   // Slash-command prompts, kept to the tools actually registered in this mode.
   const prompts = makePrompts(new Set(tools.map((t) => t.name)), lang);
@@ -79,6 +79,7 @@ function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp'
     // Long-lived server: refresh the email session's hub JWT from the stored
     // cookie before each tool call so a stale (~15-min) JWT never reaches a tool.
     beforeCall: () => ensureFreshSession(process.env),
+    afterCall: () => { funnel.flush(); },
     onInitialize: ({ clientInfo }) => funnel.setMcpClient(clientInfo.name),
   });
 }
@@ -88,21 +89,23 @@ function prepareProcess(env = process.env) {
   require('../src/backend-request').setClientIdentity('mcp');
 }
 
-async function run(argv = process.argv.slice(2)) {
-  // The installer's last step; not a command the Talent needs to know.
-  if (argv[0] === 'install') {
-    await require('../src/mcp-install').runMcpInstall();
-    return;
-  }
+async function run(argv = process.argv.slice(2), { makeInterviewClient = null } = {}) {
   if (argv.includes('--help') || argv.includes('-h')) {
     process.stdout.write(HELP);
     return;
   }
 
+  const problem = require('../src/config').envProfileProblem(process.env);
+  if (problem) {
+    process.stderr.write(`  [mcp] ${problem}\n`);
+    process.exitCode = 1;
+    return;
+  }
   prepareProcess();
 
   // `--local` = the scan-only server shipped in the Claude .mcpb bundle.
-  const server = buildServer({ localOnly: argv.includes('--local') });
+  const funnel = createFunnel({ surface: 'mcp' });
+  const server = buildServer({ localOnly: argv.includes('--local'), funnel, makeInterviewClient });
   const rl = server.start({
     input: process.stdin,
     output: process.stdout,
@@ -115,6 +118,7 @@ async function run(argv = process.argv.slice(2)) {
     rl.on('close', resolve);
     process.stdin.on('end', () => rl.close());
   });
+  await funnel.settle();
 }
 
 module.exports = { run, buildServer, buildServerInstructions, prepareProcess };

package/bin/mcpb.js

@@ -2,4 +2,4 @@
 'use strict';
 
 // Claude Desktop's built-in Node imports this entry from its own host, so it starts without a require.main check.
-require('./mcp').run();
+require('./mcp').run(process.argv.slice(2), { makeInterviewClient: require('../src/interview-client').createInterviewClient });

package/bin/onboarding.js

@@ -5,6 +5,7 @@ const { detectFlowLang } = require('../src/i18n');
 const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');
 const { createStdinAsk } = require('../src/stdin-ask');
 const { runOnboardingInterview, runRepeatOnboardingInterview, makeDeps } = require('../src/onboarding-flow');
+const { createInterviewClient } = require('../src/interview-client');
 const { checkOnboardingCompleted } = require('../src/onboarding-availability');
 const { makeIo } = require('./register');
 const { c: fmt } = require('../src/terminal-format');
@@ -87,7 +88,7 @@ async function run(
     // Explicit overwrite-repeat: its own warning + confirmation, bypassing the legacy already-completed gate.
     if (o.repeat) {
       const io = makeIo({ ask, lang, out: write, acceptDisclaimer: o.acceptDisclaimer, stdinIsTTY });
-      const result = await runRepeatOnboardingInterview(io, deps || makeDeps(), { confirmed: o.yes });
+      const result = await runRepeatOnboardingInterview(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { confirmed: o.yes });
       if (result && result.ok === false) {
         process.stderr.write(`\n  ${red(`onboarding: ${result.reason}`)}\n\n`);
         process.exitCode = 1;
@@ -116,7 +117,7 @@ async function run(
     }
 
     const io = makeIo({ ask, lang, out: write, acceptDisclaimer: o.acceptDisclaimer, stdinIsTTY });
-    const result = await runOnboardingInterview(io, deps || makeDeps());
+    const result = await runOnboardingInterview(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }));
     if (!result.ok) {
       process.stderr.write(`\n  ${red(`onboarding: ${result.reason}${result.step ? ` (${result.step})` : ''}`)}\n\n`);
       process.exitCode = 1;

package/bin/register.js

@@ -11,6 +11,7 @@ const {
   WORK_SITUATIONS, EMPLOYMENT_PARTICIPATIONS, FREELANCE_OPINIONS, CHANGE_MOTIVATORS, WORK_MODES,
   LANGUAGE_CODES, LANGUAGE_LEVELS, showsFreelanceOpinion, showsChangeMotivators,
 } = require('../src/onboarding-flow');
+const { createInterviewClient } = require('../src/interview-client');
 const { promptSelect, promptMultiSelect } = require('../src/prompt-select');
 const { chooseAuthMethod } = require('../src/auth-method-picker');
 const { methodIdsForFlow } = require('../src/auth-methods');
@@ -305,7 +306,20 @@ async function run(
     return;
   }
 
-  const ask = injectedAsk || createStdinAsk();
+  // Injected deps (tests) bring their own funnel or none.
+  const registrationFunnel = funnel || (deps ? undefined : createFunnel({ surface: 'cli' }));
+  let interrupted = false;
+  const onInterrupt = () => {
+    if (interrupted) process.exit(130);
+    interrupted = true;
+    process.stdout.write('\n');
+    const settled = registrationFunnel ? registrationFunnel.settle() : Promise.resolve();
+    settled.then(() => {
+      ask.close();
+      process.exit(130);
+    });
+  };
+  const ask = injectedAsk || createStdinAsk({ onInterrupt });
   try {
     // Method choice (Email + Google) from the shared auth-methods registry; a
     // valid method flag skips the picker.
@@ -317,9 +331,7 @@ async function run(
     const io = makeIo({ ask, lang, out: write, acceptDisclaimer: o.acceptDisclaimer, stdinIsTTY });
     // At a terminal the profile opens in the browser at the end; piped runs, tests and --no-open only print it.
     const openProfile = stdinIsTTY && !o.noOpen ? (openBrowser || openPath) : undefined;
-    // Injected deps (tests) bring their own funnel or none.
-    const registrationFunnel = funnel || (deps ? undefined : createFunnel({ surface: 'cli' }));
-    const result = await runOnboarding(io, deps || makeDeps(), { method, openBrowser, onAuthUrl: io.onGoogleAuthUrl, openProfile, funnel: registrationFunnel });
+    const result = await runOnboarding(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { method, openBrowser, onAuthUrl: io.onGoogleAuthUrl, openProfile, funnel: registrationFunnel });
     if (!result.ok) {
       process.stderr.write(`\n  ${red(`register: ${result.reason}${result.step ? ` (${result.step})` : ''}`)}\n\n`);
       process.exitCode = 1;
@@ -327,6 +339,7 @@ async function run(
     return result;
   } finally {
     if (!injectedAsk) ask.close();
+    if (registrationFunnel) await registrationFunnel.settle();
   }
 }
 

package/bin/report-html.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 
-// `report` — materializes and OPENS the shareable, cumulative HTML report for the current project (ADR-016).
+// `report` — materializes and OPENS the shareable, cumulative HTML report for the current project.
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { materializeProjectReport } = require('../src/report-store');
@@ -119,7 +119,7 @@ async function run(argv = process.argv.slice(2), { ask } = {}) { // eslint-disab
   const opened = opts.open ? openPath(result.htmlPath) : false;
 
   // Clear "the report was UPDATED" notice (fires once per run — this is the sole
-  // report write point, ADR-016). OSC 8: clickable file:// link where supported.
+  // report write point). OSC 8: clickable file:// link where supported.
   const updatedLabel = lang === 'es' ? 'Report actualizado' : 'Report updated';
   process.stdout.write(`\n  ✓ ${updatedLabel} · ${oscLink(result.fileUrl)}\n`);
   if (opened) process.stdout.write(`  ${r.opening}\n`);