shakers-cli 0.15.0 → 0.17.0

package/src/config.js

@@ -4,8 +4,9 @@ const fs = require('fs');
 const path = require('path');
 const { readEnv } = require('./env-paths');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
-// Persistent CLI config file (skill-code-certification, endpoint-config task).
+// Persistent CLI config file.
 function configDir(env = process.env) {
   return getConfigDir(env);
 }
@@ -23,7 +24,7 @@ function loadConfigFile(env = process.env) {
   }
 }
 
-// DISTRIBUTION PROFILE (talents-ai-score, ADR-058 fase 1).
+// DISTRIBUTION PROFILE.
 const VALID_PROFILES = new Set(['external', 'talent']);
 const PROFILE_DEFAULT_WHEN_ABSENT = 'talent';
 
@@ -48,7 +49,7 @@ function getUiLang(env = process.env) {
   return null;
 }
 
-// config.json holds the superadmin session token (ADR-027) and consent/ endpoint data, so it must never be briefly world/group-readable.
+// config.json holds the superadmin session token and consent/ endpoint data, so it must never be briefly world/group-readable.
 function saveConfigFile(config, env = process.env) {
   const dir = configDir(env);
   fs.mkdirSync(dir, { recursive: true });
@@ -56,7 +57,7 @@ function saveConfigFile(config, env = process.env) {
   try { fs.chmodSync(configFilePath(env), 0o600); } catch { /* e.g. Windows */ }
 }
 
-// Endpoint safety (skill-code-certification, endpoint-config task) — BOUNDED.
+// Endpoint safety — BOUNDED.
 const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
 const SHAKERS_CLI_DOMAINS = [];
 
@@ -120,7 +121,7 @@ function resolveIngestEndpoint(env = process.env) {
   return { endpoint: null, source: 'none' };
 }
 
-// Baked backend targets per distribution flavor (talents-ai-score, ADR-007/065).
+// Baked backend targets per distribution flavor.
 // Only the DEFAULT bases; per-endpoint SHAKERS_CLI_* env and config.json overrides
 // still win at each getter (env > config.json > baked profile).
 const ENV_PROFILES = {
@@ -130,41 +131,86 @@ const ENV_PROFILES = {
     profileUrl: 'https://app.shakersworks.com/login',
     almaBase: 'https://app.shakersworks.com',
   },
+  dev: {
+    certsBase: 'https://api.dev.certifications.shakersworks.com/api/v1',
+    hubBase: 'https://api.hub.dev.shakersworks.com/api/v1',
+    profileUrl: 'https://works.dev.shakersworks.com/login',
+    almaBase: 'https://works.dev.shakersworks.com',
+  },
+  local: {
+    certsBase: 'http://localhost:3004/api/v1',
+    hubBase: 'http://localhost:3001/api/v1',
+    profileUrl: 'http://localhost:8081/login',
+  },
+};
+
+const RETIRED_ENV_PROFILES = {
   staging: {
     certsBase: 'https://api.staging.certifications.shakersworks.com/api/v1',
     hubBase: 'https://api.hub.staging.shakersworks.com/api/v1',
     profileUrl: 'https://works.staging.shakersworks.com/login',
     almaBase: 'https://works.staging.shakersworks.com',
   },
-  dev: {
-    certsBase: 'https://api.dev.certifications.shakersworks.com/api/v1',
+  'dev-new-works': {
     hubBase: 'https://api.hub.new-works.dev.shakersworks.com/api/v1',
     profileUrl: 'https://works.new-works.dev.shakersworks.com/login',
-  },
-  local: {
-    certsBase: 'http://localhost:3004/api/v1',
-    hubBase: 'http://localhost:3001/api/v1',
-    profileUrl: 'http://localhost:8081/login',
+    almaBase: 'https://works.new-works.dev.shakersworks.com',
   },
 };
 
 // Which flavor is baked: SHAKERS_CLI_ENV override wins, else derived from the
-// published package name (public -> prod, beta -> staging, private -> dev), else dev (safe default).
-const PACKAGE_NAME_ENV = { 'shakers-cli': 'prod', 'shakers-cli-beta': 'staging', '@shakers/shakers-cli': 'dev' };
+// published package name (shakers-cli -> prod, shakers-cli-beta -> dev), else dev (safe default).
+const PACKAGE_NAME_ENV = { 'shakers-cli': 'prod', 'shakers-cli-beta': 'dev' };
 const DEFAULT_ENV_PROFILE = 'dev';
 
-function bakedEnvProfileName() {
+function envProfileForPackageName(name) {
+  return PACKAGE_NAME_ENV[name] || DEFAULT_ENV_PROFILE;
+}
+
+function readPackageJson() {
   try {
-    const name = require('../package.json').name;
-    if (PACKAGE_NAME_ENV[name]) return PACKAGE_NAME_ENV[name];
-  } catch { /* package.json unreadable — fall through to the safe default */ }
-  return DEFAULT_ENV_PROFILE;
+    return require('../package.json');
+  } catch {
+    return {};
+  }
+}
+
+function bakedEnvProfileName() {
+  return envProfileForPackageName(readPackageJson().name);
+}
+
+function envOverrideVariable(env) {
+  const next = env.SHAKERS_CLI_ENV;
+  return next !== undefined && next !== '' ? 'SHAKERS_CLI_ENV' : 'AI_FOOTPRINT_ENV';
+}
+
+class UnknownEnvProfileError extends Error {
+  constructor(variable, value) {
+    const known = Object.keys(ENV_PROFILES).join(', ');
+    super(RETIRED_ENV_PROFILES[value]
+      ? `${variable}=${value} is a retired profile. Use one of ${known}, or unset it.`
+      : `${variable}=${value} is not a known profile. Use one of ${known}, or unset it.`);
+    this.name = 'UnknownEnvProfileError';
+    this.variable = variable;
+    this.value = value;
+  }
 }
 
 function getEnvProfileName(env = process.env) {
-  const override = readEnv(env, 'ENV');
-  if (override && ENV_PROFILES[String(override).trim()]) return String(override).trim();
-  return bakedEnvProfileName();
+  const override = String(readEnv(env, 'ENV') || '').trim();
+  if (!override) return bakedEnvProfileName();
+  if (ENV_PROFILES[override]) return override;
+  throw new UnknownEnvProfileError(envOverrideVariable(env), override);
+}
+
+function envProfileProblem(env = process.env) {
+  try {
+    getEnvProfileName(env);
+    return null;
+  } catch (e) {
+    if (e instanceof UnknownEnvProfileError) return e.message;
+    throw e;
+  }
 }
 
 function getEnvProfile(env = process.env) {
@@ -205,7 +251,7 @@ function getCertsBase(env = process.env) {
   if (ingest) return ingest.replace(/\/usage\/reports\/?$/, '').replace(/\/+$/, '');
   // No explicit override anywhere -> the baked flavor profile (never null when a
   // profile exists), so switching the published flavor "just works" without a
-  // seeded config.json (ADR-065 revised).
+  // seeded config.json.
   const baked = getEnvProfile(env).certsBase;
   return baked ? baked.replace(/\/+$/, '') : null;
 }
@@ -217,11 +263,11 @@ function getIngestEndpoint(env = process.env) {
   return base ? `${base}/usage/reports` : null;
 }
 
-// Agent-synthesis endpoint (talents-ai-score, ADR-010/ADR-011).
+// Agent-synthesis endpoint.
 function getSynthesisEndpoint(env = process.env) {
   const value = readEnv(env, 'SYNTHESIS_ENDPOINT');
   if (value && value.trim()) return value.trim();
-  // Issue 111: derived as an ingest sibling when the override is unset.
+  // Derived as an ingest sibling when the override is unset.
   return deriveFromIngest(env, 'agent-synthesis');
 }
 
@@ -231,7 +277,7 @@ function getRoadmapEndpoint(env = process.env) {
   return deriveFromIngest(env, 'roadmap-personalize');
 }
 
-// Email-verification endpoints (ADR-006): the OTP "prove you own this email" step that gates PERSISTENCE. Sibling-of-ingest resolution (`new URL(relative, base)`); unset ingest -> null.
+// Email-verification endpoints: the OTP "prove you own this email" step that gates PERSISTENCE. Sibling-of-ingest resolution (`new URL(relative, base)`); unset ingest -> null.
 function deriveFromIngest(env, relativePath) {
   const ingest = getIngestEndpoint(env);
   if (!ingest) return null;
@@ -254,7 +300,7 @@ function getAgentEvaluationEndpoint(env = process.env) {
   return deriveFromIngest(env, 'agent-evaluation');
 }
 
-// Login endpoint — better-auth email sign-in (owner decision, supersedes ADR-031 for the email path): `POST {hubBase}/auth/sign-in/email` with `{email,password}`.
+// Login endpoint — better-auth email sign-in: `POST {hubBase}/auth/sign-in/email` with `{email,password}`.
 function getLoginEndpoint(env = process.env) {
   const explicit = readEnv(env, 'LOGIN_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -262,6 +308,10 @@ function getLoginEndpoint(env = process.env) {
 }
 
 // better-auth JWT endpoint: `GET {hubBase}/auth/token` with the session cookie → `{token}` (ES256/JWKS, ~15-min TTL).
+function getSignOutEndpoint(env = process.env) {
+  return deriveFromHub(env, 'auth/sign-out');
+}
+
 function getAuthTokenEndpoint(env = process.env) {
   const explicit = readEnv(env, 'AUTH_TOKEN_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -462,14 +512,14 @@ function getAiProfileEndpoint(env = process.env) {
   return deriveFromHub(env, 'works/talent/me/ai-profile');
 }
 
-// Evidence emission endpoint for the `cli_scan` instrument (talents-ai-score Phase 2).
+// Evidence emission endpoint for the `cli_scan` instrument.
 function getEvidenceCliScanEndpoint(env = process.env) {
   const explicit = readEnv(env, 'EVIDENCE_CLI_SCAN_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
   return deriveFromIngest(env, '../evidence/cli-scan');
 }
 
-// Talent-portfolio endpoints (talents-ai-score, ADR-059 — `start`'s "Add project to portfolio" route, talent-only).
+// Talent-portfolio endpoints (`start`'s "Add project to portfolio" route, talent-only).
 function getPortfoliosDeclareEndpoint(env = process.env) {
   const explicit = readEnv(env, 'PORTFOLIOS_DECLARE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -512,7 +562,7 @@ function getAgentsDraftFieldsEndpoint(env = process.env) {
   return deriveFromIngest(env, '../works/talents/me/agents/draft-fields');
 }
 
-// Agent<->experience relate endpoint (ADR-041, `start`'s "Add agent" relate step / MCP `add_agent.relatedPortfolios`).
+// Agent<->experience relate endpoint (`start`'s "Add agent" relate step / MCP `add_agent.relatedPortfolios`).
 function getAgentPortfoliosEndpoint(agentId, env = process.env) {
   // Null on missing/non-scalar id: no bogus URL, and keeps config.test.js's `fn(env)`
   // getter sweep honest when the env object lands in `agentId`.
@@ -520,7 +570,7 @@ function getAgentPortfoliosEndpoint(agentId, env = process.env) {
   return deriveFromHub(env, `works/talent/me/agents/${encodeURIComponent(agentId)}/portfolios`);
 }
 
-// Onboarding endpoints (evaluation-mcp, ADR-011..015/024 — the register flow).
+// Onboarding endpoints (the register flow).
 function getHubBase(env = process.env) {
   const explicit = readEnv(env, 'HUB_BASE');
   if (explicit && explicit.trim()) return explicit.trim().replace(/\/+$/, '');
@@ -551,7 +601,7 @@ function getImportProfileEndpoint(env = process.env) {
   return deriveFromHub(env, 'works/talent/me/import-profile');
 }
 
-// MCP sign-up (ticket 39540): public UNREGISTERED + claim code, its import status, and the one-time web login.
+// MCP sign-up: public UNREGISTERED + claim code, its import status, and the one-time web login.
 function getMcpSignupEndpoint(env = process.env) {
   return deriveFromHub(env, 'works-ai/talents/mcp-signup');
 }
@@ -564,11 +614,20 @@ function getOnboardingEventsEndpoint(env = process.env) {
   return deriveFromHub(env, 'works/talent/me/onboarding-events');
 }
 
+const AMPLITUDE_HTTP_API = 'https://api.eu.amplitude.com/2/httpapi';
+
+function getAmplitudeIngestion(env = process.env) {
+  const stamped = readPackageJson().amplitude;
+  if (!stamped || typeof stamped.apiKey !== 'string' || !stamped.apiKey.trim()) return null;
+  if (stamped.env !== getEnvProfileName(env)) return null;
+  return { endpoint: AMPLITUDE_HTTP_API, apiKey: stamped.apiKey.trim() };
+}
+
 function getOneTimeTokenEndpoint(env = process.env) {
   return deriveFromHub(env, 'auth/one-time-token/generate');
 }
 
-// The ONE place the web route that redeems a one-time token is spelled (the route itself is a later works-frontend ticket).
+// The ONE place the web route that redeems a one-time token is spelled.
 function getOneTimeLoginUrl(token, env = process.env) {
   if (typeof token !== 'string' || !token) return null;
   const profile = getTalentProfileUrl(env);
@@ -675,7 +734,7 @@ function getOnboardingStatusEndpoint(env = process.env) {
   return base ? `${base}/interviews/onboarding/status` : null;
 }
 
-// Talent profile web URL (evaluation-mcp, ADR-011 — the step-5 skip fallback).
+// Talent profile web URL (the step-5 skip fallback).
 function getTalentProfileUrl(env = process.env) {
   const explicit = readEnv(env, 'PROFILE_URL');
   if (explicit && explicit.trim()) return explicit.trim().replace(/\/+$/, '');
@@ -689,14 +748,14 @@ function getTalentProfileUrl(env = process.env) {
 // user overrides of these, never the baked profile itself.
 const PROFILE_ENDPOINT_KEYS = Object.keys(ENV_PROFILES[DEFAULT_ENV_PROFILE]);
 
-// Boot migration (ADR-065 revised). The CLI used to SEED config.json with the
+// Boot migration. The CLI used to SEED config.json with the
 // baked bases on first run; the getters now fall back to getEnvProfile() directly,
 // so seeding is unnecessary AND harmful: `npm uninstall` leaves the config dir, so
-// a config.json seeded by a previous flavor (e.g. the private @shakers build → dev)
-// survives into a new flavor (the public beta → staging) and pins the old endpoints
+// a config.json seeded by a previous flavor (e.g. the beta when it baked staging)
+// survives into a new flavor (the beta now baking dev) and pins the old endpoints
 // forever, since config.json wins over the baked profile. This sweep removes any
 // endpoint key whose value is byte-identical to that SAME field in a KNOWN profile
-// OTHER than the baked one — i.e. a value that could only have gotten there by the
+// (current or retired) OTHER than the baked one — i.e. a value that could only have gotten there by the
 // old seeding of a different flavor. A value that matches no known profile is a
 // genuine user override (set via `shakers config set`) and is left untouched. We
 // never touch env, auth-session.json or consent.json, and never remove the dir.
@@ -708,7 +767,7 @@ function sanitizeStaleBakedEndpoints(env = process.env) {
     const current = config[key];
     if (typeof current !== 'string' || !current.trim()) continue;
     const normalized = current.trim().replace(/\/+$/, '');
-    const matchesForeignProfile = Object.entries(ENV_PROFILES).some(
+    const matchesForeignProfile = Object.entries({ ...RETIRED_ENV_PROFILES, ...ENV_PROFILES }).some(
       ([name, profile]) =>
         name !== bakedName && String(profile[key]).replace(/\/+$/, '') === normalized,
     );
@@ -735,12 +794,12 @@ function getSuperadminSessionEndpoint(env = process.env) {
   return deriveFromIngest(env, 'superadmin/session');
 }
 
-// Superadmin READ-ONLY certification inspection endpoint (ADR-025, NON-PROD only) — a sibling of the ingest endpoint.
+// Superadmin READ-ONLY certification inspection endpoint (NON-PROD only) — a sibling of the ingest endpoint.
 function getInspectCertificationsEndpoint(env = process.env) {
   return deriveFromIngest(env, 'superadmin/inspect-certifications');
 }
 
-// ADR-027 superadmin SESSION persistence.
+// Superadmin SESSION persistence.
 function loadSuperadminSession(env = process.env) {
   const config = loadConfigFile(env);
   const s = config && typeof config === 'object' ? config.superadminSession : null;
@@ -757,6 +816,7 @@ function saveSuperadminSession(session, env = process.env) {
     expiresAt: session.expiresAt || null,
   };
   saveConfigFile(config, env);
+  recordAccountMarker('superadmin', env);
 }
 
 function clearSuperadminSession(env = process.env) {
@@ -774,6 +834,7 @@ module.exports = {
   getAgentEvaluationEndpoint,
   getLoginEndpoint,
   getAuthTokenEndpoint,
+  getSignOutEndpoint,
   getCompleteRegistrationEndpoint,
   getDeviceAuthorizeEndpoint,
   getDeviceTokenEndpoint,
@@ -807,19 +868,19 @@ module.exports = {
   getUsageDiscoveredInventoryEndpoint,
   getUsageReportEndpoint,
   getAiProfileEndpoint,
-  // Evidence emission (talents-ai-score Phase 2, evidence-based evaluation).
+  // Evidence emission.
   getEvidenceCliScanEndpoint,
-  // Talent-portfolio endpoints (ADR-059).
+  // Talent-portfolio endpoints.
   getPortfoliosDeclareEndpoint,
   getPortfoliosListEndpoint,
   getPortfolioDraftDescriptionEndpoint,
   getPortfolioUpdateEndpoint,
-  // Talent-agent endpoints (talents-ai-score Phase 2 — "Add agent to profile").
+  // Talent-agent endpoints ("Add agent to profile").
   getAgentsDeclareEndpoint,
   getAgentsListEndpoint,
   getAgentsDraftFieldsEndpoint,
   getAgentPortfoliosEndpoint,
-  // Onboarding / register flow (evaluation-mcp, ADR-011..015/024).
+  // Onboarding / register flow.
   getCertsBase,
   getHubBase,
   sanitizeStaleBakedEndpoints,
@@ -828,6 +889,8 @@ module.exports = {
   getMcpSignupEndpoint,
   getMyImportStatusEndpoint,
   getOnboardingEventsEndpoint,
+  getAmplitudeIngestion,
+  AMPLITUDE_HTTP_API,
   getOneTimeTokenEndpoint,
   getOneTimeLoginUrl,
   getProfessionalDetailsEndpoint,
@@ -849,7 +912,7 @@ module.exports = {
   getEmailVerificationVerifyUrl,
   getSuperadminSessionEndpoint,
   getInspectCertificationsEndpoint,
-  // ADR-027 superadmin session persistence.
+  // Superadmin session persistence.
   loadSuperadminSession,
   saveSuperadminSession,
   clearSuperadminSession,
@@ -863,15 +926,18 @@ module.exports = {
   setIngestEndpoint,
   hasRetiredFallbackConfig,
   resolveIngestEndpoint,
-  // Distribution profile (ADR-058 fase 1).
+  // Distribution profile.
   VALID_PROFILES,
   getProfile,
   isTalentProfile,
   // UI language preference (env SHAKERS_CLI_LANG > config.json `lang`).
   VALID_UI_LANGS,
   getUiLang,
-  // Baked backend target flavor (staging | dev | local).
+  // Baked backend target flavor (prod | dev | local).
   ENV_PROFILES,
   getEnvProfileName,
   getEnvProfile,
+  envProfileForPackageName,
+  envProfileProblem,
+  UnknownEnvProfileError,
 };

package/src/consent-flow.js

@@ -8,17 +8,18 @@ const {
 const { runEmailVerification } = require('./email-verification');
 const { renderLegalNotice } = require('./legal-notice');
 
-// Consent prompt (talents-ai-score, ADR-011 — revises issue 006 / ADR-007's disclosure wall; ADR-051 revises ADR-011's OWN ordering in turn, see below).
+// Consent prompt (replaces the earlier disclosure wall; its ordering is revised in turn, see below).
 
 const MAX_ATTEMPTS = 5;
 
 const YES_RE = /^(y|yes|s|si|sí)$/i;
 const NO_RE = /^(n|no)$/i;
 
-async function askYesNo(ask, question, catalog, { defaultNo = false } = {}) {
+async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false } = {}) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     const raw = String(await ask(question)).trim();
     if (defaultNo && raw === '') return false;
+    if (defaultYes && raw === '') return true;
     if (YES_RE.test(raw)) return true;
     if (NO_RE.test(raw)) return false;
     process.stdout.write(`  ${catalog.consent.invalidAnswer}\n`);
@@ -45,7 +46,7 @@ async function defaultVerifyEmail({ email, ask, catalog, env = process.env }) {
   });
 }
 
-// Runs the short consent-to-persist prompt + (if accepted) email collection + (skill-code-certification / ADR-006) EMAIL-OWNERSHIP VERIFICATION.
+// Runs the short consent-to-persist prompt + (if accepted) email collection + EMAIL-OWNERSHIP VERIFICATION.
 async function runConsentPrompt({
   ask,
   catalog,
@@ -57,7 +58,7 @@ async function runConsentPrompt({
   profile = 'talent',
 }) {
   const c = catalog.consent;
-  // Presentation only (talents-ai-score): framed by src/legal-notice.js on a
+  // Presentation only: framed by src/legal-notice.js on a
   // real TTY, byte-identical (no heading, no rule) otherwise.
   process.stdout.write(`\n  ${renderLegalNotice(c.persistIntro, catalog)}\n`);
 
@@ -100,7 +101,7 @@ async function runConsentPrompt({
 
   process.stdout.write(`  ${c.savedUnderEmail(email)}\n`);
 
-  // Prove email ownership BEFORE persisting (ADR-006) — every profile, external included.
+  // Prove email ownership BEFORE persisting — every profile, external included.
   const verification = await verifyEmail({ email, ask, catalog, env });
   if (verification && verification.verified) {
     recordConsent('granted', email, { verified: true });
@@ -112,4 +113,4 @@ async function runConsentPrompt({
   return null;
 }
 
-module.exports = { runConsentPrompt, defaultVerifyEmail };
+module.exports = { runConsentPrompt, defaultVerifyEmail, askYesNo };

package/src/consent-skip.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// Explains WHY the consent-to-persist prompt is skipped (or might not complete) this run, instead of doing so silently (talents-ai-score, DX).
+// Explains WHY the consent-to-persist prompt is skipped (or might not complete) this run, instead of doing so silently.
 function computeConsentSkip({ decision, emailVerified, stdinIsTTY, consentFilePath, catalog } = {}) {
   const c = catalog && catalog.consent;
 

package/src/detection-evidence.js

@@ -5,7 +5,7 @@ const { detectTechnologyManifests } = require('./tech-detector');
 const { agentSourceFilesByName } = require('./agent-org-chart');
 const { classifyVendored, collectProvenance } = require('./detection-noise');
 
-// Per-CANDIDATE authorship + depth (hybrid evaluation, Slice 3c).
+// Per-CANDIDATE authorship + depth.
 
 const SKILL_DEPTH_SATURATION = 3;
 const AGENT_DEPTH_SATURATION = 8;
@@ -38,7 +38,7 @@ function recencyDaysForPaths(relPaths, authorship, nowSeconds) {
   return Math.max(0, Math.floor((nowSeconds - mostRecent) / 86400));
 }
 
-// Attributes a candidate's evidence files against the talent's own email via the ADR-017 gate.
+// Attributes a candidate's evidence files against the talent's own email via the authorship gate.
 function attributionCounts(relPaths, verifiedEmail, authorship) {
   if (!Array.isArray(relPaths) || relPaths.length === 0) {
     return { authoredFileCount: 0, totalFileCount: 0, authorshipKnown: false };

package/src/detection-noise.js

@@ -4,7 +4,7 @@ const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
-// Anti-noise CLASSIFICATION for detected candidates (hybrid evaluation, Slice 3 — issue 019).
+// Anti-noise CLASSIFICATION for detected candidates.
 
 const GIT_TIMEOUT_MS = 15000;
 const README_MAX_BYTES = 8 * 1024;

package/src/detectors.js

@@ -147,7 +147,7 @@ const detectors = [
     ],
   },
 
-  // ---- Expansion (talents-ai-score, more signals) — confidence per entry below ----
+  // ---- Expansion — confidence per entry below ----
   {
     id: 'amazon-q-developer',
     name: 'Amazon Q Developer',

package/src/device-login.js

@@ -95,7 +95,7 @@ async function runDeviceLogin(
         timeoutMs,
       });
       if (!fin.ok) return { ok: false, reason: fin.reason };
-      return { ok: true, token: fin.token, sessionToken: res.accessToken, isNewUser: res.isNewUser, email: res.email || null };
+      return { ok: true, token: fin.token, sessionToken: res.accessToken, sessionExpiresIn: res.expiresIn, isNewUser: res.isNewUser, email: res.email || null };
     }
     if (res.status === 'pending') continue;
     if (res.status === 'slow_down') {
@@ -108,7 +108,18 @@ async function runDeviceLogin(
   }
 }
 
+function deviceSessionRecord({ token, sessionToken = null, sessionExpiresIn = null, email = null }, now = Date.now()) {
+  return {
+    accessToken: token,
+    hubAccessToken: token,
+    sessionToken: sessionToken || null,
+    sessionExpiresAt: sessionExpiresIn ? new Date(now + sessionExpiresIn * 1000).toISOString() : null,
+    email: email || null,
+  };
+}
+
 module.exports = {
+  deviceSessionRecord,
   startDeviceLogin,
   pollDeviceToken,
   finalizeDeviceSession,

package/src/email-verification.js

@@ -2,7 +2,7 @@
 
 const { requestBackend } = require('./backend-request');
 
-// Email-verification client + wait-mode loop (skill-code-certification, ADR-006).
+// Email-verification client + wait-mode loop.
 
 const DEFAULT_TIMEOUT_MS = 15000;
 // Bounded so a Talent who can never produce a matching code can't loop forever — after this many CODE-ENTRY attempts we give up (nothing persisted, asked again next run).
@@ -71,7 +71,7 @@ function classifyVerifyReason(reason) {
 }
 
 // The interactive "modo espera": send a code, then loop reading the pasted code until it verifies, the Talent cancels, or attempts run out.
-// talents-ai-score, ADR-042: `requestUrl`/`verifyUrl` address the ONE backend (the certifications service).
+// `requestUrl`/`verifyUrl` address the ONE backend (the certifications service).
 async function runEmailVerification({
   email,
   ask,
@@ -103,7 +103,7 @@ async function runEmailVerification({
   write(`  ${v.waitHint}\n`);
 
   for (let attempt = 0; attempt < MAX_CODE_ATTEMPTS; ) {
-    // The OTP is a secret too (issue 102): same reader, same echo, and the fix is the same call.
+    // The OTP is a secret too: same reader, same echo, and the fix is the same call.
     const readCode = typeof ask.secret === 'function' ? ask.secret.bind(ask) : ask;
     const raw = String(await readCode(v.codePrompt)).trim();
 

package/src/env-paths.js

@@ -2,7 +2,7 @@
 
 const os = require('os');
 
-// Shared home-directory + env resolution (talents-ai-score, ADR-014 — "Alcance del tier: Talento = proyecto ∪ home", applied uniformly to every category).
+// Shared home-directory + env resolution (tier scope = project ∪ home, applied uniformly to every category).
 function readEnv(env, suffix) {
   const next = env[`SHAKERS_CLI_${suffix}`];
   if (next !== undefined && next !== '') return next;

package/src/find-projects-client.js

@@ -136,6 +136,17 @@ async function countOpenPositions(deps = {}, { hubAccessToken, clusterId, timeou
   return total === null ? { ok: false, reason: 'no-total' } : { ok: true, total };
 }
 
+// `--recommended` is a CLIENT-SIDE filter over the fetched page (the hub has no
+// server-side "recommended" criterion — `match` is output-only). Recommended =
+// items that have a match. If none on this page, fall back to the available
+// items so the user is never left with an empty screen.
+function splitRecommended(items, recommended) {
+  if (!recommended) return { shown: items, mode: null };
+  const rec = items.filter((it) => it.match != null);
+  if (rec.length > 0) return { shown: rec, mode: 'recommended' };
+  return { shown: items, mode: 'fallback' };
+}
+
 module.exports = {
   TABS,
   countOpenPositions,
@@ -145,4 +156,5 @@ module.exports = {
   normalizeItem,
   requestFindProjects,
   fetchFindProjects,
+  splitRecommended,
 };

package/src/find-projects-flow.js

@@ -3,7 +3,7 @@
 // `find-projects` flow: list the Positions/Projects available to the talent,
 // paginated and filtered server-side via the endpoint's `criteria`. Read-only.
 
-const { TABS, ATTENDANCE, DEFAULT_LIMIT } = require('./find-projects-client');
+const { TABS, ATTENDANCE, DEFAULT_LIMIT, splitRecommended } = require('./find-projects-client');
 const { styleLabelPrefix } = require('./ansi');
 
 function makeFindProjectsDeps(overrides = {}) {
@@ -30,17 +30,6 @@ function resolveQuery(opts = {}) {
   return { tab, limit, page, offset, attendance, country, attendanceInvalid, countryInvalid, recommended: !!opts.recommended };
 }
 
-// `--recommended` is a CLIENT-SIDE filter over the fetched page (the hub has no
-// server-side "recommended" criterion — `match` is output-only). Recommended =
-// items that have a match. If none on this page, fall back to the available
-// items so the user is never left with an empty screen.
-function splitRecommended(items, recommended) {
-  if (!recommended) return { shown: items, mode: null };
-  const rec = items.filter((it) => it.match != null);
-  if (rec.length > 0) return { shown: rec, mode: 'recommended' };
-  return { shown: items, mode: 'fallback' };
-}
-
 function budgetLine(item, fp) {
   if (item.budget && item.budget.display) return item.budget.display;
   if (item.budget && (item.budget.from != null || item.budget.to != null)) {
@@ -157,7 +146,6 @@ module.exports = {
   makeFindProjectsDeps,
   runFindProjects,
   resolveQuery,
-  splitRecommended,
   formatItem,
   paginationFooter,
   recommendedFooter,

package/src/git-activity.js

@@ -55,7 +55,7 @@ function round2(n) {
   return Math.round(n * 100) / 100;
 }
 
-// Deterministic git-activity signals for the project where `shakers ai-usage` runs (hybrid evaluation, Slice 1).
+// Deterministic git-activity signals for the project where `shakers ai-usage` runs.
 function collectGitActivity(root, verifiedEmail) {
   if (!isGitRepo(root)) return null;
 

package/src/graph-certs.js

@@ -24,10 +24,10 @@ function buildCertsPayload(project, lang) {
     .filter(Boolean)
     .map((item) => {
       const res = item.result || {};
-      // `skillName` and `technology` both come off the wire (the service's certifiable list / verdict), and `technology` was one of the two fields issue 055 was opened for.
+      // `skillName` and `technology` both come off the wire (the service's certifiable list / verdict).
       const base = sanitizeRenderText(item.skillName) || (item.skillId != null ? String(item.skillId) : 'Skill');
       const name = item.technology ? `${base} · ${sanitizeRenderText(item.technology)}` : base;
-      // ADR-016: named level (Middle/Senior/Expert) instead of the numeric grade.
+      // Named level (Middle/Senior/Expert) instead of the numeric grade.
       const skillReport = (t.certify && t.certify.report) || {};
       const skillLevelNames = skillReport.skillLevels || {};
       const { key: levelKey, band } = levelInfoFromCombinedLevel(res.combinedLevel) || skillLevelForScore(res.score);
@@ -36,7 +36,7 @@ function buildCertsPayload(project, lang) {
         band, // retained for the badge colour (unchanged palette)
         levelKey,
         levelName: levelKey ? (skillLevelNames[levelKey] || levelKey) : (skillLevelNames.na || '—'),
-        // Model-written text off the wire; sanitised (issue 055 — left raw by 052).
+        // Model-written text off the wire; sanitised.
         rationale: typeof res.rationale === 'string' ? sanitizeRenderText(res.rationale) : '',
         improvements: Array.isArray(res.improvements)
           ? res.improvements.map((i) => (typeof i === 'string' ? sanitizeRenderText(i) : i))