shakers-cli 0.15.0 → 0.16.0

package/src/auth-client.js

@@ -2,9 +2,10 @@
 
 const { postJsonWithTimeout, extractSetCookie } = require('./backend-request');
 
-// Login / token acquisition against the Hub's better-auth email engine (owner decision, supersedes ADR-031 for the email path).
+// Login / token acquisition against the Hub's better-auth email engine.
 
 const DEFAULT_TIMEOUT_MS = 20000;
+const SIGN_OUT_TIMEOUT_MS = 3000;
 const SESSION_COOKIE_NAME = 'better-auth.session_token';
 // Refresh the cookie session's own validity from the Set-Cookie Max-Age; fall
 // back to 7 days (better-auth's default) when the attribute is absent.
@@ -88,12 +89,13 @@ function normalizeSignIn(status, raw, headers) {
 }
 
 // Mints a hub JWT from a better-auth session cookie: `GET {tokenEndpoint}` with the `Cookie` header.
-async function requestAuthToken({ cookie } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!cookie) return { ok: false, reason: 'no-cookie' };
+  if (!cookie && !sessionToken) return { ok: false, reason: 'no-cookie' };
+  const credential = cookie ? { Cookie: cookie } : { Authorization: `Bearer ${sessionToken}` };
   let res;
   try {
-    res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, { Cookie: cookie });
+    res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, credential);
   } catch (e) {
     return { ok: false, reason: (e && e.kind) || 'network-error' };
   }
@@ -133,7 +135,19 @@ async function requestLogin(
   };
 }
 
+async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin = null, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
+  if (!endpoint || (!cookie && !sessionToken)) return { ok: false, reason: 'no-credential' };
+  const credential = cookie ? { Cookie: cookie, ...(origin ? { Origin: origin } : {}) } : { Authorization: `Bearer ${sessionToken}` };
+  try {
+    const res = await postJsonWithTimeout(endpoint, {}, timeoutMs, 'POST', null, credential);
+    return { ok: res.status >= 200 && res.status < 300, status: res.status };
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+}
+
 module.exports = {
+  requestSignOut,
   requestLogin,
   requestAuthToken,
   normalizeSignIn,

package/src/auth-method-picker.js

@@ -3,7 +3,7 @@
 const { runInteractiveMultiSelect } = require('./interactive-select');
 const { methodsForFlow, methodLabel } = require('./auth-methods');
 
-// The shared interactive method picker for the CLI (talents-ai-score).
+// The shared interactive method picker for the CLI.
 async function askNumberedChoice(ask, promptText, count) {
   const raw = (await ask(promptText)).trim();
   if (!raw) return null;

package/src/auth-methods.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// The SINGLE source of truth for which auth methods exist and where each one is offered (talents-ai-score).
+// The SINGLE source of truth for which auth methods exist and where each one is offered.
 const AUTH_METHODS = [
   { id: 'email', labelKey: 'methodEmail', availableFor: { login: true, register: true } },
   { id: 'google', labelKey: 'methodGoogle', availableFor: { login: true, register: true } },

package/src/auth-session-store.js

@@ -5,7 +5,7 @@ const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('./config-dir');
 
-// `~/.config/shakers/auth-session.json` — the logged-in Talent's session (talents-ai-score, issue 122 / ADR-044).
+// `~/.config/shakers/auth-session.json` — the logged-in Talent's session.
 
 // Hub's `UserSubtypeEnum` (shared/domain/enum/user-subtype.enum.ts), copied VERBATIM — this repo never invents a value the wire does not send.
 const PLATFORM_TALENT_USER_TYPES = new Set(['WORKS_TALENT', 'WORKS_PARTNER']);
@@ -89,12 +89,12 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
   const hubAccessToken = explicitHubToken || (typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null);
 
   const cookie = typeof session.cookie === 'string' && session.cookie ? session.cookie : null;
+  const sessionToken = typeof session.sessionToken === 'string' && session.sessionToken ? session.sessionToken : null;
   let expiresAt;
   let accessTokenExpiresAt;
-  if (cookie) {
-    expiresAt = (typeof session.cookieExpiresAt === 'string' && session.cookieExpiresAt)
-      ? session.cookieExpiresAt
-      : (typeof session.expiresAt === 'string' && session.expiresAt ? session.expiresAt : null);
+  if (cookie || sessionToken) {
+    expiresAt = [session.cookieExpiresAt, session.sessionExpiresAt, session.expiresAt]
+      .find((v) => typeof v === 'string' && v) || expiresAtFromToken(session.accessToken);
     accessTokenExpiresAt = (typeof session.accessTokenExpiresAt === 'string' && session.accessTokenExpiresAt)
       ? session.accessTokenExpiresAt
       : expiresAtFromToken(session.accessToken);
@@ -109,6 +109,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
       expiresAt: expiresAt ?? null,
       accessTokenExpiresAt: accessTokenExpiresAt ?? null,
       cookie,
+      sessionToken,
       email: (typeof session.email === 'string' && session.email ? session.email : null)
         || emailFromHubToken(hubAccessToken),
       hubAccessToken,
@@ -157,7 +158,8 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   // better-auth) or a JWT (Google/legacy, or an email session whose JWT is cached).
   const hasCookie = typeof parsed.cookie === 'string' && parsed.cookie;
   const hasToken = typeof parsed.accessToken === 'string' && parsed.accessToken;
-  if (!hasCookie && !hasToken) return null;
+  const sessionToken = typeof parsed.sessionToken === 'string' && parsed.sessionToken ? parsed.sessionToken : null;
+  if (!hasCookie && !hasToken && !sessionToken) return null;
   const hubAccessToken = typeof parsed.hubAccessToken === 'string' && parsed.hubAccessToken ? parsed.hubAccessToken : null;
   const email = (typeof parsed.email === 'string' && parsed.email ? parsed.email : null) || emailFromHubToken(hubAccessToken);
   return {
@@ -165,6 +167,7 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
     expiresAt: typeof parsed.expiresAt === 'string' ? parsed.expiresAt : null,
     accessTokenExpiresAt: typeof parsed.accessTokenExpiresAt === 'string' ? parsed.accessTokenExpiresAt : null,
     cookie: hasCookie ? parsed.cookie : null,
+    sessionToken,
     email,
     hubAccessToken,
     userType: typeof parsed.userType === 'string' && KNOWN_USER_TYPES.has(parsed.userType) ? parsed.userType : null,
@@ -184,8 +187,8 @@ function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
 
 // `none | active | expired`, the three states the caller needs to give the Talent a true message.
 function sessionStatus(session, now = Date.now()) {
-  // A credential is either the durable cookie (email) or a JWT (Google/legacy).
-  const hasCred = !!(session && ((typeof session.accessToken === 'string' && session.accessToken) || (typeof session.cookie === 'string' && session.cookie)));
+  // A credential is a durable cookie or session token, or a JWT (Google/legacy).
+  const hasCred = !!(session && [session.accessToken, session.cookie, session.sessionToken].some((v) => typeof v === 'string' && v));
   if (!hasCred) return 'none';
   const expiry = Date.parse(String(session.expiresAt || ''));
   if (!Number.isFinite(expiry)) return 'expired';

package/src/authorship-mismatch.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Display-only authorship-transparency check (talents-ai-score).
+// Display-only authorship-transparency check.
 //
 // Warns the talent when their commits in the selected repos are authored under
 // an email that is not their Shakers account email, so their own work would be

package/src/authorship.js

@@ -3,7 +3,7 @@
 const { execFileSync } = require('child_process');
 const path = require('path');
 
-// Git AUTHORSHIP + provenance for the certify phase (skill-code-certification, ADR-017).
+// Git AUTHORSHIP + provenance for the certify phase.
 
 const { takePrefetchedGitLog } = require('./git-log-prefetch');
 
@@ -164,7 +164,7 @@ function buildAttributionPredicate(verifiedEmail, authorizedSet) {
   };
 }
 
-// Applies the ADR-017 gate (with the ADR-023 widening for test identities) to ONE sampled Skill.
+// Applies the authorship gate (widened for test identities) to ONE sampled Skill.
 function attributeSample(sample, verifiedEmail, authorship, authorizedSet = null) {
   const isAttributable = buildAttributionPredicate(verifiedEmail, authorizedSet);
   const files = Array.isArray(sample.files) ? sample.files : [];

package/src/automations-detector.js

@@ -5,7 +5,7 @@ const path = require('path');
 const { execFileSync } = require('child_process');
 const { getHomeDir } = require('./env-paths');
 
-// Deterministic (no-LLM) automations detector (talents-ai-score, issue 017 / ADR-013-014).
+// Deterministic (no-LLM) automations detector.
 
 const AI_CLI_NAMES = ['claude', 'aider', 'gemini', 'codex'];
 const AI_CLI_RE = new RegExp(`\\b(${AI_CLI_NAMES.join('|')})\\b`, 'i');

package/src/backend-request.js

@@ -5,7 +5,7 @@ const https = require('https');
 const crypto = require('crypto');
 const { getHubBase } = require('./config');
 
-// ONE BACKEND: the certifications service (talents-ai-score, ADR-042).
+// ONE BACKEND: the certifications service.
 
 const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
 
@@ -31,7 +31,7 @@ function profileUpdateSourceHeader(url, method) {
   return { 'X-Profile-Update-Source': clientIdentity };
 }
 
-// Extra request headers, sanitized (talents-ai-score, issue 038 — the agent certification interview needs `Authorization: Bearer <sessionToken>`).
+// Extra request headers, sanitized (the agent certification interview needs `Authorization: Bearer <sessionToken>`).
 const UNSAFE_HEADER_VALUE_RE = /[\r\n\0]/;
 
 function sanitizeExtraHeaders(extraHeaders) {
@@ -183,7 +183,7 @@ async function requestBackend({
     throw Object.assign(new Error('no endpoint configured'), { kind: 'no-endpoint' });
   }
 
-  // Optional trace (talents-ai-score, issue 109).
+  // Optional trace.
   const note = (entry) => {
     if (Array.isArray(trace)) trace.push(entry);
   };

package/src/brand-ansi.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// BRAND_ANSI — the Shakers brand palette, reincarnated as ANSI 256-colour SGR codes (talents-ai-score, terminal design-consistency pass).
+// BRAND_ANSI — the Shakers brand palette, reincarnated as ANSI 256-colour SGR codes.
 
 const BRAND_ANSI = {
   primary: '\x1b[38;5;73m',

package/src/browser-tools-detector.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Deterministic (no-LLM) browser tools detector (talents-ai-score, issue 018 / ADR-013-014).
+// Deterministic (no-LLM) browser tools detector.
 
 const BROWSER_DEPENDENCY_NAMES = new Set(['playwright', '@playwright/test', 'puppeteer', 'puppeteer-core']);
 

package/src/certify-disclaimer.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Legal disclaimer + EXPLICIT acceptance gate (ADR-001), shown before egress. Skill-code certify was retired (certify is now a dimension LiveKit interview); consumers today are the add-skill/add-agent/add-project consent gates.
+// Legal disclaimer + EXPLICIT acceptance gate, shown before egress. Skill-code certify was retired (certify is now a dimension LiveKit interview); consumers today are the add-skill/add-agent/add-project consent gates.
 
 const { renderLegalNotice } = require('./legal-notice');
 const { styleQuestion } = require('./ansi');

package/src/certify-remediation-prompt.js

@@ -2,7 +2,7 @@
 
 const { getCatalog } = require('./i18n');
 
-// Client-side "remediation prompt" for the certify report (skill-code- certification, issue 011).
+// Client-side "remediation prompt" for the certify report.
 function buildRemediationPrompt(item, lang) {
   const r = getCatalog(lang).certify.report;
   const improvements =

package/src/cli-args.js

@@ -39,7 +39,7 @@ function parseArgs(argv) {
     repo: false,
     scope: null,
     noAi: false,
-    // Issue 103: turns the section reveal off. Same name in both parsers, and the
+    // Turns the section reveal off. Same name in both parsers, and the
     // env var `NO_ANIMATION` does the same thing (the `NO_COLOR` pattern of 079).
     noAnimation: false,
   };
@@ -59,7 +59,7 @@ function parseArgs(argv) {
     else if (a === '--show-endpoint') opts.showEndpoint = true;
     else if (a === '--build-next-level') opts.buildNextLevel = true;
     else if (a === '--force') opts.force = true;
-    // ADR-016: the tier roadmap / "next steps" block is removed from the
+    // The tier roadmap / "next steps" block is removed from the
     // default footprint output; `--roadmap` (alias `--next`) shows it again.
     else if (a === '--roadmap' || a === '--next') opts.roadmap = true;
     else if (a === '--lang') opts.lang = VALID_LANGS.has(argv[++i]) ? argv[i] : null;

package/src/command-audit.js

@@ -3,7 +3,7 @@
 const os = require('os');
 const path = require('path');
 const { scrubSecrets } = require('./agent-synthesis');
-const { loadAuthSession } = require('./auth-session-store');
+const { loadAuthSession, decodeJwtPayload } = require('./auth-session-store');
 const { getCertsBase } = require('./config');
 const { postJsonWithTimeout } = require('./backend-request');
 
@@ -46,6 +46,11 @@ function machineHint() {
   return { osUser, hostname };
 }
 
+function jwtExpired(token, now) {
+  const payload = decodeJwtPayload(token);
+  return !!payload && typeof payload.exp === 'number' && payload.exp * 1000 <= now;
+}
+
 // Builds the record + headers; returns null when there is no endpoint to post to.
 function buildAudit(command, argv, env) {
   let base;
@@ -57,10 +62,8 @@ function buildAudit(command, argv, env) {
   if (!base) return null;
 
   const session = loadAuthSession(env);
-  const token =
-    session && (session.accessToken || session.hubAccessToken)
-      ? session.accessToken || session.hubAccessToken
-      : null;
+  const stored = (session && (session.accessToken || session.hubAccessToken)) || null;
+  const token = stored && !jwtExpired(stored, Date.now()) ? stored : null;
 
   const body = {
     command: String(command || 'unknown').slice(0, 100),

package/src/config-dir.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { getHomeDir, readEnv } = require('./env-paths');
 
-// Single source of truth for the CLI's config directory (ADR-045).
+// Single source of truth for the CLI's config directory.
 
 const DIR_NAME = 'shakers';
 const LEGACY_DIR_NAME = 'ai-footprint';