shakers-cli 0.15.0 → 0.17.0

package/src/repo-scope.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const { isRefusedWalkRoot } = require('./scan-exclusions');
+const {
+  detectRepos,
+  repoIdentityForCwd,
+  matchReposByFlag,
+  scopeFromSelection,
+  indexOfCurrentRepo,
+} = require('./detect-repos');
+
+const MAX_MACHINE_WIDE_REPOS = 5;
+const SCOPE_MACHINE = 'machine';
+const SCOPE_REPO = 'repo';
+
+function currentRepoToplevel(cwd, repoIdentityFn = repoIdentityForCwd) {
+  try {
+    return repoIdentityFn(cwd).toplevel || cwd;
+  } catch {
+    return cwd;
+  }
+}
+
+// The real git toplevel of `cwd`, or null when `cwd` is not a repo (or is a refused system root like `/`, the MCP `cwd=/` case).
+function cwdRepoToplevel(cwd, repoIdentityFn = repoIdentityForCwd) {
+  if (isRefusedWalkRoot(cwd)) return null;
+  try {
+    return repoIdentityFn(cwd).toplevel || null;
+  } catch {
+    return null;
+  }
+}
+
+// Pure: builds the machine-wide root set.
+function machineWideToplevels(cwdRepoTop, detectedRepos, cap = MAX_MACHINE_WIDE_REPOS) {
+  const ordered = [];
+  const seen = new Set();
+  const push = (t) => {
+    if (typeof t !== 'string' || !t) return;
+    if (isRefusedWalkRoot(t)) return;
+    if (seen.has(t)) return;
+    seen.add(t);
+    ordered.push(t);
+  };
+  push(cwdRepoTop);
+  for (const r of detectedRepos || []) push(r && r.toplevel);
+  const capped = ordered.slice(0, cap);
+  return { toplevels: capped, total: ordered.length, capped: ordered.length > capped.length };
+}
+
+function cwdOnlyScope(repos, cwdToplevel) {
+  const idx = indexOfCurrentRepo(repos, cwdToplevel);
+  if (idx === -1) {
+    return { selectedCwds: new Set(), toplevels: [cwdToplevel], mode: 'cwd' };
+  }
+  const { selectedCwds, selectedToplevels } = scopeFromSelection(repos, [idx]);
+  return {
+    selectedCwds,
+    toplevels: selectedToplevels.length ? selectedToplevels : [cwdToplevel],
+    mode: 'cwd',
+  };
+}
+
+// Resolve which repos feed the AI-usage evaluation.
+async function resolveRepoScope({
+  opts,
+  cwd,
+  injectedAsk,
+  catalog,
+  detectReposFn = detectRepos,
+  repoIdentityFn = repoIdentityForCwd,
+  chooseScope = null,
+  isTTY = !!process.stdin.isTTY && !!process.stdout.isTTY,
+  note = () => {},
+}) {
+  const cwdToplevel = currentRepoToplevel(cwd, repoIdentityFn);
+  const cwdRepoTop = cwdRepoToplevel(cwd, repoIdentityFn);
+  const detect = () => {
+    try {
+      return detectReposFn(process.env);
+    } catch {
+      return { repos: [], unassignedSessionCount: 0 };
+    }
+  };
+
+  // 1. Explicit repo list always wins.
+  if (opts.repos) {
+    const { repos, unassignedSessionCount } = detect();
+    note(catalog.cli.reposDetectedNote(repos.length, unassignedSessionCount));
+    const { indices, unmatched } = matchReposByFlag(repos, opts.repos);
+    if (unmatched.length > 0) {
+      process.stderr.write(`  ${catalog.cli.reposFlagUnmatched(unmatched.join(', '))}\n`);
+    }
+    if (indices.length > 0) {
+      const { selectedCwds, selectedToplevels } = scopeFromSelection(repos, indices);
+      return { selectedCwds, toplevels: [...new Set(selectedToplevels)], mode: 'flag' };
+    }
+    return cwdOnlyScope(repos, cwdToplevel);
+  }
+
+  const wantsMachine = opts.allRepos || opts.machine || opts.scope === SCOPE_MACHINE;
+  const wantsRepo = opts.repo || opts.scope === SCOPE_REPO;
+
+  let choice = null;
+  if (wantsMachine) choice = SCOPE_MACHINE;
+  else if (wantsRepo) choice = SCOPE_REPO;
+  else if (chooseScope && isTTY && !injectedAsk && !opts.json) {
+    choice = await chooseScope({ catalog, stdinIsTTY: true });
+  }
+  if (choice === null) choice = SCOPE_REPO;
+
+  if (choice === SCOPE_MACHINE) {
+    const { repos, unassignedSessionCount } = detect();
+    note(catalog.cli.reposDetectedNote(repos.length, unassignedSessionCount));
+    const mw = machineWideToplevels(cwdRepoTop, repos);
+    if (mw.capped) {
+      process.stderr.write(`\n  ${catalog.cli.reposScopeCapped(mw.toplevels.length, mw.total)}\n`);
+    }
+    note(catalog.cli.reposScopeAll);
+    return {
+      selectedCwds: null,
+      toplevels: mw.toplevels.length ? mw.toplevels : [cwdToplevel],
+      mode: 'all',
+    };
+  }
+
+  // Current repo.
+  const { repos } = detect();
+  return cwdOnlyScope(repos, cwdToplevel);
+}
+
+module.exports = { resolveRepoScope, machineWideToplevels, SCOPE_MACHINE, SCOPE_REPO };

package/src/report-gating.js

@@ -2,11 +2,12 @@
 
 const { loadAuthSession, sessionStatus, isPlatformTalent } = require('./auth-session-store');
 const { getProfile } = require('./config');
+const { hasAccountTrace } = require('./account-trace');
 
-// THE ONE LAYER THAT DECIDES WHAT THE REPORT SHOWS ACCORDING TO IDENTITY (talents-ai-score, issue 123 / ADR-044).
+// THE ONE LAYER THAT DECIDES WHAT THE REPORT SHOWS ACCORDING TO IDENTITY.
 
 // Pure: identity in, policy out.
-function resolveReportGate({ loggedIn = false, status = null, email = null, userType = null, profile = 'talent' } = {}) {
+function resolveReportGate({ loggedIn = false, accountTrace = false, status = null, email = null, userType = null, profile = 'talent' } = {}) {
   const showEverything = !loggedIn;
   const resolvedProfile = profile === 'external' ? 'external' : 'talent';
   return Object.freeze({
@@ -16,7 +17,7 @@ function resolveReportGate({ loggedIn = false, status = null, email = null, user
     email: loggedIn && typeof email === 'string' && email ? email : null,
     // --roadmap AND its server-side computation/egress (see bin/report.js): a
     // logged-in Talent's roadmap is not merely hidden, it is not requested.
-    showRoadmap: showEverything,
+    showRoadmap: showEverything && !accountTrace,
     // Per-agent "how to improve this agent" tips in the footprint report.
     showAgentSuggestions: showEverything,
     // The copyable remediation prompt in a `certify` verdict.
@@ -35,6 +36,7 @@ function reportGateForIdentity(env = process.env, now = Date.now()) {
   const status = sessionStatus(session, now);
   return resolveReportGate({
     loggedIn: status === 'active',
+    accountTrace: hasAccountTrace(env),
     status,
     email: session ? session.email : null,
     userType: session ? session.userType : null,

package/src/report-store.js

@@ -14,8 +14,8 @@ const SCHEMA_VERSION = 2;
 function configDir() {
   return getConfigDir(process.env);
 }
-function statePath() {
-  return path.join(configDir(), 'report-state.json');
+function statePath(env = process.env) {
+  return path.join(getConfigDir(env), 'report-state.json');
 }
 
 // Stable, filesystem-safe per-project file name derived from the absolute path.
@@ -54,10 +54,10 @@ function migrateFromV1(parsed) {
   return { schemaVersion: SCHEMA_VERSION, updatedAt: (parsed && parsed.updatedAt) || null, projects };
 }
 
-function loadState() {
+function loadState(env = process.env) {
   let parsed;
   try {
-    parsed = JSON.parse(fs.readFileSync(statePath(), 'utf8'));
+    parsed = JSON.parse(fs.readFileSync(statePath(env), 'utf8'));
   } catch {
     return freshState();
   }
@@ -84,7 +84,7 @@ function getOrCreateProject(state, absRoot) {
     };
   }
   // Backward-compat: a project persisted before the two-backend chain
-  // existed (talents-ai-score, ADR-020/021).
+  // existed.
   if (!state.projects[absRoot].backendAcceptance) {
     state.projects[absRoot].backendAcceptance = {};
   }
@@ -98,7 +98,7 @@ function renderProjectHtml(project, lang, gate) {
 }
 
 /* ---------- persist (state only) + materialize (render HTML) ---------- */
-// ADR-016 split: `footprint` and `certify` now PERSIST state only (no HTML file, no printed link).
+// Split: `footprint` and `certify` now PERSIST state only (no HTML file, no printed link).
 
 function stampAndSaveState(state, absRoot) {
   state.schemaVersion = SCHEMA_VERSION;
@@ -154,6 +154,10 @@ function recordBackendAcceptance({ root, kind, backend }) {
   return stampAndSaveState(state, absRoot);
 }
 
+function hasRecordedUpload(env = process.env) {
+  return Object.values(loadState(env).projects).some((p) => !!(p && p.backendAcceptance && Object.keys(p.backendAcceptance).length));
+}
+
 function loadFootprint({ root } = {}) {
   const absRoot = path.resolve(root || process.cwd());
   const state = loadState();
@@ -179,12 +183,12 @@ function materializeProjectReport({ root, lang }) {
   const state = loadState();
   const project = state.projects[absRoot];
   if (!hasRenderableData(project)) return { hasData: false };
-  // issue 123 / ADR-044: the shareable HTML is gated by identity AT GENERATION TIME — this is the moment the `report` command produces the file, so this is where the gate is resolved.
+  // The shareable HTML is gated by identity AT GENERATION TIME — this is the moment the `report` command produces the file, so this is where the gate is resolved.
   const gate = reportGateForIdentity();
   return { hasData: true, ...writeProjectHtml(project, absRoot, lang, gate) };
 }
 
-// `upsertFootprint` AND `upsertCertification` WERE HERE, and ADR-035 retired them.
+// `upsertFootprint` AND `upsertCertification` WERE HERE, and were retired.
 
 function certKey(item) {
   if (item && item.skillId != null) return `id:${item.skillId}`;
@@ -220,6 +224,7 @@ module.exports = {
   loadAgentClassifications,
   loadFootprint,
   recordBackendAcceptance,
+  hasRecordedUpload,
   materializeProjectReport,
   certKey,
   SCHEMA_VERSION,

package/src/roadmap-content.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Curated tier roadmap content (talents-ai-score, issue 020 / ADR-013/014).
+// Curated tier roadmap content.
 
 const TIER_JUMPS_ES = {
   T0: {
@@ -201,13 +201,13 @@ const T7_TERMINAL_ES = {
   whatRemains: 'El tier ya no sube, pero el equipamiento no es el trabajo. A partir de aquí el margen está en usar lo que tienes, no en instalar más: documentar tu setup para que otros lo repliquen, podar lo que no usas, y afilar cada agente/comando con el trabajo real. La escala mide cómo tienes montado el banco; que salgan buenas piezas de él depende de ti.',
   consolidationSteps: [
     'Afina tus hooks y agentes con el trabajo real: recorta lo que estorba, acota los matchers y ajusta las tools/límites de cada agente a su rol.',
-    'Poda lo que no usas: revisa qué assets llevas tiempo sin tocar (el CLI expone recency/mtime de forma informativa, no como gate — ADR-003) y elimina lo redundante.',
+    'Poda lo que no usas: revisa qué assets llevas tiempo sin tocar (el CLI expone recency/mtime de forma informativa, no como gate) y elimina lo redundante.',
     'Mantén vivos tus ficheros de contexto (CLAUDE.md, reglas, comandos): actualízalos cuando cambien el stack o las convenciones, o dejan de ayudar.',
     'Empaqueta y contribuye tus skills/comandos a un repo compartido del equipo para que tu setup escale más allá de tu máquina.',
     'Documenta tu organigrama de agentes y compártelo como referencia interna para que otros lo repliquen.',
     'Mide el impacto real (tiempo ahorrado, tareas delegadas de principio a fin) y usa ese dato para decidir qué merece seguir en tu banco.',
   ],
-  honestyNote: 'Estar en T7 significa que tienes el banco de trabajo mejor equipado que el CLI sabe medir. No significa que seas quien mejor usa la IA: el dato es una proxy de setup, indicativa y no verificada (ADR-007). No se lee como "calidad IA del Talent".',
+  honestyNote: 'Estar en T7 significa que tienes el banco de trabajo mejor equipado que el CLI sabe medir. No significa que seas quien mejor usa la IA: el dato es una proxy de setup, indicativa y no verificada. No se lee como "calidad IA del Talent".',
 };
 
 const TIER_JUMPS_EN = {
@@ -409,13 +409,13 @@ const T7_TERMINAL_EN = {
   whatRemains: "The tier no longer rises, but equipment isn't the work. From here the margin is in using what you have, not installing more: documenting your setup so others can replicate it, pruning what you don't use, and sharpening each agent/command with real work. The ladder measures how your bench is set up; whether good pieces come out of it is up to you.",
   consolidationSteps: [
     "Sharpen your hooks and agents against real work: trim what gets in the way, scope the matchers, and tune each agent's tools/limits to its role.",
-    "Prune what you don't use: review which assets you haven't touched in a while (the CLI exposes recency/mtime informatively, not as a gate — ADR-003) and drop the redundant ones.",
+    "Prune what you don't use: review which assets you haven't touched in a while (the CLI exposes recency/mtime informatively, not as a gate) and drop the redundant ones.",
     'Keep your context files (CLAUDE.md, rules, commands) alive: update them when the stack or conventions change, or they stop helping.',
     'Package and contribute your skills/commands to a shared team repo so your setup scales beyond your own machine.',
     'Document your agent org chart and share it as an internal reference so others can replicate it.',
     'Measure the real impact (time saved, tasks delegated end to end) and use that to decide what deserves to stay on your bench.',
   ],
-  honestyNote: 'Being at T7 means you have the best-equipped bench the CLI knows how to measure. It does not mean you\'re the one who uses AI best: the data is a proxy for setup, indicative and unverified (ADR-007). It\'s not read as "the Talent\'s AI quality".',
+  honestyNote: 'Being at T7 means you have the best-equipped bench the CLI knows how to measure. It does not mean you\'re the one who uses AI best: the data is a proxy for setup, indicative and unverified. It\'s not read as "the Talent\'s AI quality".',
 };
 
 const CONTENT_BY_LANG = {

package/src/roadmap-personalization.js

@@ -3,7 +3,7 @@
 const { requestBackend } = require('./backend-request');
 const { reporterFor, REASON } = require('./model-call-record');
 
-// Roadmap personalization client (talents-ai-score, ADR-015).
+// Roadmap personalization client.
 
 const DEFAULT_TIMEOUT_MS = 8000;
 
@@ -38,7 +38,7 @@ function buildRoadmapPersonalizationRequest(curatedEntry, tierResult, report, lo
       mistakes: curatedEntry.commonMistakes,
     },
     signals: buildRoadmapSignals(report, tierResult.signals),
-    // ADR-026: detected report language for the personalized prose.
+    // Detected report language for the personalized prose.
     ...(locale === 'es' || locale === 'en' ? { locale } : {}),
     ...(consentGranted === true ? { traceContentConsent: true } : {}),
   };
@@ -66,7 +66,7 @@ function isValidPersonalizedRoadmap(parsed, curated) {
 
 // Requests the roadmap personalization endpoint.
 async function requestRoadmapPersonalization(requestBody, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS, onOutcome = null } = {}) {
-  // Issue 109 — see agent-synthesis.js#requestAgentSynthesis for the contract.
+  // See agent-synthesis.js#requestAgentSynthesis for the contract.
   const outcome = reporterFor(onOutcome, { timeoutMs });
   if (!endpoint) {
     outcome.skip(REASON.NO_ENDPOINT);

package/src/roadmap-prompt.js

@@ -2,7 +2,7 @@
 
 const { tierName: getTierName } = require('./i18n');
 
-// Deterministic, ready-to-paste "implementation prompt" (talents-ai-score: "next steps -> prompt").
+// Deterministic, ready-to-paste "implementation prompt" ("next steps -> prompt").
 
 const TEMPLATES = {
   es: {
@@ -65,7 +65,7 @@ function buildImplementationPrompt(entry, report, maturity, lang) {
   const frameworks = Array.isArray(r.technologies) ? r.technologies : [];
   const toolNames = Array.isArray(r.tools) ? r.tools.filter((x) => x && x.detected).map((x) => x.name) : [];
   const tierKey = (maturity && maturity.tierKey) || entry.tierKey || '';
-  // talents-ai-score, i18n audit: NEVER maturity.tierName directly — that field comes straight from tier-engine.js and is Spanish-only by design (domain logic, not i18n).
+  // NEVER maturity.tierName directly — that field comes straight from tier-engine.js and is Spanish-only by design (domain logic, not i18n).
   const tierName = getTierName(tierKey, lang);
 
   const lines = [];

package/src/roles-flow.js

@@ -88,6 +88,7 @@ async function runAddRole({ io, session, catalog, deps = makeRolesDeps() }) {
 // deduped, for setting/switching the MAIN role.
 async function fetchHeldRoles({ deps, hubAccessToken }) {
   const held = [];
+  const assigned = [];
   let mainClusterId = null;
   const certEndpoint = deps.getMyCertificationsEndpoint();
   if (certEndpoint) {
@@ -99,10 +100,11 @@ async function fetchHeldRoles({ deps, hubAccessToken }) {
   }
   const assignedEndpoint = deps.getAssignedClustersEndpoint();
   if (assignedEndpoint) {
-    const assigned = await deps.requestAssignedClusters({ hubAccessToken }, { endpoint: assignedEndpoint });
-    if (assigned.ok) for (const c of assigned.clusters || []) held.push(c);
+    const res = await deps.requestAssignedClusters({ hubAccessToken }, { endpoint: assignedEndpoint });
+    if (res.ok) assigned.push(...(res.clusters || []));
   }
-  return { held: dedupeByCluster(held), mainClusterId };
+  held.push(...assigned);
+  return { held: dedupeByCluster(held), assigned, mainClusterId };
 }
 
 // `change-role`: switch the MAIN role to one of the roles the talent already holds.
@@ -130,12 +132,12 @@ async function runChangeMainRole({ io, session, catalog, deps = makeRolesDeps()
 
 // The onboarding final step: pick a MAIN role from the roles resolved for the
 // talent (interview recommendations + any held). Degrades gracefully to a skip.
-async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRolesDeps() }) {
+async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRolesDeps(), onRolesShown = () => {} }) {
   const r = catalog.roles;
   const hubAccessToken = session ? session.hubAccessToken : null;
 
   io.section(r.mainRoleTitle);
-  const { held, mainClusterId } = await io.withProgress(r.loadingHeld, () => fetchHeldRoles({ deps, hubAccessToken }));
+  const { held, assigned, mainClusterId } = await io.withProgress(r.loadingHeld, () => fetchHeldRoles({ deps, hubAccessToken }));
 
   // Prefer the talent's own/recommended roles; fall back to the catalog for a
   // fresh talent so a main role can always be set (picking one adds it first).
@@ -150,6 +152,7 @@ async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRole
     io.notify(r.mainRolePending);
     return { ok: true, chosen: null };
   }
+  onRolesShown({ suggested: assigned.filter((c) => c.type === 'RECOMMENDED').map((c) => c.clusterId), clustersCount: assigned.length });
   const choice = await chooseRole({
     io, roles, header: r.mainRolePrompt, hint: r.selectHint, initialClusterId: mainClusterId,
   });

package/src/scan-exclusions.js

@@ -2,7 +2,7 @@
 
 const path = require('path');
 
-// Directory names never descended into when walking a project tree (skill-code-certification, issue 008).
+// Directory names never descended into when walking a project tree.
 const EXCLUDED_DIRS = new Set([
   'node_modules', 'dist', 'build', '.git', 'vendor', 'coverage', '.next', 'out',
   // Python

package/src/scanner.js

@@ -163,7 +163,7 @@ function aggregateFootprint(paths) {
   return { bytes, files };
 }
 
-// Recency = ONLY mtime of already-detected config files/dirs (ADR-003); never reads
+// Recency = ONLY mtime of already-detected config files/dirs; never reads
 // log/history content.
 
 function latestMtime(paths) {
@@ -317,8 +317,8 @@ const probes = {
   }),
 };
 
-// Agent org-chart counts (ADR-009): deterministic, structure+names only. PROJECT ∪ HOME
-// per ADR-014, since the tier engine's T6 (`agents >= 2`) needs the full picture.
+// Agent org-chart counts: deterministic, structure+names only. PROJECT ∪ HOME
+// since the tier engine's T6 (`agents >= 2`) needs the full picture.
 
 function agentOrgChartCounts(root, agentsCount, mcp) {
   const home = getHomeDir();
@@ -330,7 +330,7 @@ function agentOrgChartCounts(root, agentsCount, mcp) {
     commands:
       countFiles(path.join(root, '.claude', 'commands'), '.md') +
       countFiles(path.join(home, '.claude', 'commands'), '.md'),
-    // Issue 112: the third copy of the MCP paths lived here.
+    // The third copy of the MCP paths lived here.
     mcpServers: (mcp && typeof mcp.total === 'number' ? mcp.total : 0),
     hooks:
       countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks') +
@@ -342,7 +342,7 @@ function agentOrgChartCounts(root, agentsCount, mcp) {
 
 function scan(options = {}) {
   const root = options.root || process.cwd();
-  // MCP detection runs FIRST (issue 112), because the per-tool depth probes now read their `mcpServers` count from it.
+  // MCP detection runs FIRST, because the per-tool depth probes now read their `mcpServers` count from it.
   const mcp = detectMcpServers(root);
   const scanCtx = { mcp };
 
@@ -366,7 +366,7 @@ function scan(options = {}) {
       // Config footprint: ONLY the aggregated size in bytes and file count, never paths or names.
       footprint: null,
       // Recency: ONLY the date derived from the most recent mtime among its
-      // already-detected config files (ADR-003). Never content, logs or history.
+      // already-detected config files. Never content, logs or history.
       recency: { lastModified: null, daysSinceModified: null, bucket: null },
       // Version: only if the tool was detected via a binary on PATH; runs
       // THAT already-detected binary, with `--version` only.
@@ -397,7 +397,7 @@ function scan(options = {}) {
 
   const detectedTools = tools.filter((t) => t.detected);
 
-  // Deterministic (no-LLM) agent org chart (ADR-009): structure + names
+  // Deterministic (no-LLM) agent org chart: structure + names
   // only (name, wired tools, model, hierarchy). Never descriptions/prompts.
   const agents = parseAgentOrgChart(root);
 
@@ -405,7 +405,7 @@ function scan(options = {}) {
 
   const rawDependencyNames = detectRawDependencyNames(root);
 
-  // Deterministic (no-LLM) memory STRUCTURE (talents-ai-score, issue 016 / ADR-013-014): import count, nesting depth, sections, size — from known context files (project ∪ home).
+  // Deterministic (no-LLM) memory STRUCTURE: import count, nesting depth, sections, size — from known context files (project ∪ home).
   const memory = analyzeMemoryStructure(root);
 
   const automations = detectAutomations(root);
@@ -436,19 +436,19 @@ function scan(options = {}) {
       categories: [...new Set(detectedTools.map((t) => t.category))],
     },
     tools,
-    // Agent org chart (ADR-009): structure + names only, never content.
+    // Agent org chart: structure + names only, never content.
     agents,
     agentCounts: agentOrgChartCounts(root, agents.length, mcp),
     // Projects where each detected AI tool has been used (skill-code-
-    // Project technologies (ADR-012): dependency manifest names only.
+    // Project technologies: dependency manifest names only.
     technologies,
-    // MCP servers by name/category (issue 015): never the raw config.
+    // MCP servers by name/category: never the raw config.
     mcp,
-    // Memory structure (issue 016): imports/nesting/sections/size, never text.
+    // Memory structure: imports/nesting/sections/size, never text.
     memory,
-    // Automations (issue 017): script/scheduler signals, never raw content.
+    // Automations: script/scheduler signals, never raw content.
     automations,
-    // Browser tools (issue 018): composition over technologies + mcp.
+    // Browser tools: composition over technologies + mcp.
     browserTools,
   };
 }

package/src/secret-prompt.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// SECRET PROMPT — reads a secret WITHOUT painting it (issue 102).
+// SECRET PROMPT — reads a secret WITHOUT painting it.
 
 const CTRL_C = '\u0003';
 const CTRL_D = '\u0004';

package/src/session-gate.js

@@ -20,7 +20,7 @@ async function hasUsableSession(env = process.env, deps = {}) {
 
   const session = load(env);
   if (sessionStatus(session, now) === 'active') return true;
-  if (!session || !session.cookie) return false;
+  if (!session || (!session.cookie && !session.sessionToken)) return false;
 
   let refreshed = null;
   try { refreshed = await refresh(env, { now }); } catch { refreshed = null; }

package/src/session-refresh.js

@@ -3,6 +3,7 @@
 // On-demand hub-JWT minting for an email (better-auth) session.
 
 const REFRESH_MARGIN_MS = 120 * 1000;
+const REVOKED_STATUSES = new Set([401, 403]);
 
 function jwtStillFresh(accessTokenExpiresAt, now, marginMs) {
   const exp = Date.parse(String(accessTokenExpiresAt || ''));
@@ -14,6 +15,7 @@ async function ensureFreshSession(env = process.env, deps = {}) {
   const {
     loadAuthSession = require('./auth-session-store').loadAuthSession,
     saveAuthSession = require('./auth-session-store').saveAuthSession,
+    clearAuthSession = require('./auth-session-store').clearAuthSession,
     getAuthTokenEndpoint = require('./config').getAuthTokenEndpoint,
     requestAuthToken = require('./auth-client').requestAuthToken,
     now = Date.now(),
@@ -22,13 +24,17 @@ async function ensureFreshSession(env = process.env, deps = {}) {
 
   const session = loadAuthSession(env);
   if (!session) return null;
-  if (!session.cookie) return session;
+  if (!session.cookie && !session.sessionToken) return session;
   if (session.accessToken && jwtStillFresh(session.accessTokenExpiresAt, now, marginMs)) return session;
 
   const endpoint = getAuthTokenEndpoint(env);
   if (!endpoint) return session;
 
-  const tok = await requestAuthToken({ cookie: session.cookie }, { endpoint });
+  const tok = await requestAuthToken({ cookie: session.cookie, sessionToken: session.sessionToken }, { endpoint });
+  if (!tok.ok && REVOKED_STATUSES.has(tok.status)) {
+    clearAuthSession(env);
+    return null;
+  }
   if (!tok.ok) return session;
 
   try {
@@ -48,4 +54,28 @@ async function ensureFreshSession(env = process.env, deps = {}) {
   return loadAuthSession(env);
 }
 
-module.exports = { ensureFreshSession, jwtStillFresh, REFRESH_MARGIN_MS };
+function webOrigin(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+
+async function endSession(env = process.env, deps = {}) {
+  const {
+    loadAuthSession = require('./auth-session-store').loadAuthSession,
+    clearAuthSession = require('./auth-session-store').clearAuthSession,
+    getSignOutEndpoint = require('./config').getSignOutEndpoint,
+    getTalentProfileUrl = require('./config').getTalentProfileUrl,
+    requestSignOut = require('./auth-client').requestSignOut,
+  } = deps;
+  const session = loadAuthSession(env);
+  if (session && (session.sessionToken || session.cookie)) {
+    await requestSignOut({ cookie: session.cookie, sessionToken: session.sessionToken }, { endpoint: getSignOutEndpoint(env), origin: webOrigin(getTalentProfileUrl(env)) });
+  }
+  clearAuthSession(env);
+  return session !== null;
+}
+
+module.exports = { ensureFreshSession, endSession, jwtStillFresh, REFRESH_MARGIN_MS };

package/src/session-scan.js

@@ -12,7 +12,7 @@ const {
   parseAiderHistory,
 } = require('./session-normalizers');
 
-// GLOBAL, machine-wide inventory of AI coding-tool SESSIONS (hybrid evaluation, Slice 1).
+// GLOBAL, machine-wide inventory of AI coding-tool SESSIONS.
 
 const MAX_FILES_PER_TOOL = 2000;
 const MAX_BYTES_PER_FILE = 8 * 1024 * 1024;

package/src/shakers-wordmark.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Shakers hand-drawn "shakers" WORDMARK, inlined VERBATIM from the design asset shakers-hub-frontend/apps/hub/public/images/shakers-text-logo.svg (viewBox 0 0 87 18, 7 glyph <path>s).
+// Shakers hand-drawn "shakers" WORDMARK, inlined VERBATIM from the Shakers text-logo SVG (viewBox 0 0 87 18, 7 glyph <path>s).
 
 const WORDMARK_VIEWBOX = { w: 87, h: 18 };
 

package/src/share-card.js

@@ -70,7 +70,7 @@ function loadProjectFootprint(root, { load = loadState } = {}) {
     score: m.score,
     level: m.level,
     levelKey: m.key,
-    // ADR-016: Setup Level for the card pill (replaces the 0-4 band). Prefer the
+    // Setup Level for the card pill (replaces the 0-4 band). Prefer the
     // persisted `setupLevel`; derive from the tier for older stored reports.
     setupLevelKey: (m.setupLevel && m.setupLevel.key)
       || (typeof m.tier === 'number' ? setupLevelForTier(m.tier).key : 'none'),
@@ -95,7 +95,7 @@ function buildCardModel(fp) {
   const en = getCatalog('en');
   const tierKey = fp.tierKey;
   const tierName = (en.tierNames && en.tierNames[tierKey]) || tierKey;
-  // ADR-016: Setup Level label for the pill (English-fixed like the tier name).
+  // Setup Level label for the pill (English-fixed like the tier name).
   const setupKey = fp.setupLevelKey || 'none';
   const bandName = (en.setupLevels && en.setupLevels[setupKey] && en.setupLevels[setupKey].label) || '';
 

package/src/share-certification.js

@@ -1,13 +1,13 @@
 'use strict';
 
-// Certification-persistence payload (skill-code-certification, issue 005), extracted from src/share.js (structure refactor, issue 020).
+// Certification-persistence payload, extracted from src/share.js.
 
 const { scrubSecrets } = require('./agent-synthesis');
 
 const CERTIFY_SEND_THROTTLE_MS = 60 * 60 * 1000;
 const CERT_SCHEMA_VERSION = 1;
 
-// Strict whitelist: the analyzed RESULT + observability provenance (ADR-017), rebuilt field-by-field (never spread).
+// Strict whitelist: the analyzed RESULT + observability provenance, rebuilt field-by-field (never spread).
 const CERT_DIMENSION_KEYS = ['idiomatic', 'correctness', 'depth', 'structure', 'testing'];
 function deriveDimensionScores(dimensions) {
   if (!dimensions || typeof dimensions !== 'object') return null;
@@ -74,13 +74,13 @@ function deriveCertificationPayload(items, { repository = null, commitRange = nu
               note: typeof f.note === 'string' && f.note ? scrubSecrets(f.note) : null,
             }))
         : [],
-      // ADR-024 rubric dimensions (0-4 or null) — the inputs the server used to
+      // Rubric dimensions (0-4 or null) — the inputs the server used to
       // compute the deterministic score. Rebuilt key-by-key, never spread.
       dimensionScores: deriveDimensionScores(i.result.dimensions),
       };
       const certifyToken = certifyEvidenceTokenOf(i);
       if (certifyToken) assessment.evidenceToken = certifyToken;
-      // ADR-049 / issue 128: the attested combined level, bound ONLY when an
+      // The attested combined level, bound ONLY when an
       // interview ran. Added conditionally so an item without one is byte-identical.
       const token = interviewEvidenceTokenOf(i);
       if (token) assessment.interviewEvidenceToken = token;