shakers-cli 0.16.0 → 0.17.0

package/README.md

@@ -64,14 +64,19 @@ Run `shakers` with no command to see every command.
 ## Privacy
 
 - The `ai-usage` scan runs on your machine and its report is shown there first.
-- Saving it to Shakers is opt-in. You are asked once, after you see the report. Change
-  your decision any time with `shakers ai-usage --consent-status`, `--consent-revoke` or
-  `--consent-email`.
-- What is saved is derived data (counts, categories, tier, detected technologies), never
-  file contents, paths, environment variables or credentials.
+- Saving it to Shakers is opt-in. Every time, before anything is uploaded, you see what
+  would be sent and what Shakers does with it, and it is uploaded only if you say yes. You
+  can leave out agents and text excerpts there. `--consent-revoke` stops future uploads
+  from this computer; it does not delete what was already uploaded. To ask for that, write
+  to talent@shakersworks.com.
+- What is saved is mostly derived data (counts, categories, tier, detected technologies).
+  Two kinds of text travel too, and the review shows how many: the definition text of your
+  AI agents and short excerpts of what you ask the AI (200 characters at most), both with
+  secrets, paths and emails removed. Never your code, your full conversations, the names of
+  your repositories, environment variables or credentials.
 - Certification sends secret-scrubbed samples of your code and your interview answers to
   Shakers to assess them.
-- Read the full policy at <https://shakersworks.com/legal/mcp-privacy>.
+- Read the full policy at <https://www.shakersworks.com/en/politica-de-privacidad>.
 
 ## License
 

package/bin/ai-usage.js

@@ -4,7 +4,9 @@
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { parseArgs } = require('../src/cli-args');
 const { handleOneShotCommand } = require('../src/usage-oneshot-commands');
+const { createLazyStdinAsk } = require('../src/stdin-ask');
 const { computeUsage } = require('../src/usage-scan');
+const { hasAccountTrace } = require('../src/account-trace');
 const {
   resolveRepoScope,
   machineWideToplevels,
@@ -32,18 +34,35 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
   // One-shot commands (consent/endpoint config): act immediately, do NOT scan.
   if (await handleOneShotCommand({ opts, catalog, injectedAsk })) return;
 
-  const { report, maturity, root, gate } = await computeUsage({
-    opts,
-    catalog,
-    lang,
-    inRegistration,
-    prepareIdentity: prepareIdentityAndUsage,
-    resolveConsent: (args) => resolveAiConsent({ ...args, injectedAsk }),
-    resolveScope: (args) => resolveRepoScope({ ...args, injectedAsk }),
-  });
-
-  // 7. Render (or emit --json), persist, optional --build-next-level, auto-share.
-  await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle });
+  if (opts.roadmap && hasAccountTrace()) {
+    process.stdout.write(`\n  ${catalog.cli.roadmapNotForAccounts}\n\n`);
+    return;
+  }
+
+  const ask = injectedAsk || createLazyStdinAsk();
+  try {
+    const { report, maturity, root, gate, repos } = await computeUsage({
+      opts,
+      catalog,
+      lang,
+      inRegistration,
+      prepareIdentity: prepareIdentityAndUsage,
+      resolveConsent: (args) => resolveAiConsent({ ...args, injectedAsk: ask }),
+      resolveScope: async (args) => {
+        if (injectedAsk) return resolveRepoScope({ ...args, injectedAsk });
+        ask.suspend();
+        try {
+          return await resolveRepoScope(args);
+        } finally {
+          ask.resume();
+        }
+      },
+    });
+
+    await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle, repos, injectedAsk: ask });
+  } finally {
+    if (!injectedAsk) ask.close();
+  }
 }
 
 module.exports = { run, resolveRepoScope, machineWideToplevels, promptScope };

package/bin/mcp.js

@@ -2,7 +2,7 @@
 'use strict';
 
 const { createMcpServer } = require('../src/mcp-server');
-const { makeAiUsageTool } = require('../src/mcp-ai-usage-tool');
+const { makeAiUsageTools } = require('../src/mcp-ai-usage-tool');
 const { makeAiUsageResultTool } = require('../src/mcp-ai-usage-result-tool');
 const { makeCertifyDimensionTools } = require('../src/mcp-certify-dimension-tools');
 const { makeFindProjectsTools } = require('../src/mcp-find-projects-tools');
@@ -43,7 +43,7 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `  Usage: shakers mcp\n\n`
   + `  This command speaks JSON-RPC on stdio; it is meant to be launched by an\n`
   + `  MCP client, not run by hand.\n`
-  + `  Tools: ai_usage, ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
+  + `  Tools: ai_usage, ai_usage_upload, ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
   + `         list_addable, add_skill, add_agent,\n`
   + `         add_project, signup_start, signup_email, signup_draft, signup_create_account,\n`
   + `         signup_status, update_existing_profile, import_profile, save_profile_details, open_web,\n`
@@ -61,13 +61,14 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
 
 // The LOCAL (filesystem/machine) tools — the only ones the .mcpb bundle exposes; the
 // server-backed tools belong to the remote connector.
-const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_result', 'read_cv', 'suggest_register_context']);
+const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_upload', 'ai_usage_result', 'read_cv', 'suggest_register_context']);
 
 // `localOnly` builds the scan-only server for the Claude .mcpb bundle, reusing the SAME
 // tool registry (just filtered) — no duplicate registration.
 function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp' }), makeInterviewClient = null } = {}) {
   const lang = detectFlowLang();
-  const allTools = [makeAiUsageTool(), makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
+  const aiUsage = makeAiUsageTools();
+  const allTools = [aiUsage.usage, aiUsage.upload, makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
   const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
   // Slash-command prompts, kept to the tools actually registered in this mode.
   const prompts = makePrompts(new Set(tools.map((t) => t.name)), lang);

package/bin/register.js

@@ -122,9 +122,10 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       }
       return { fullTimeSelected: true, fullTimeAmount, fullTimeCurrency, partTimeSelected, partTimeAmount, partTimeCurrency };
     },
-    askAvailability: async (c) => {
+    askAvailability: async (c, { onLocation = () => {} } = {}) => {
       const available = isYes(await ask(`  ${c.availableAsk} `));
       const monthlyHours = await promptSelect({ ask, stdinIsTTY, out: selectOut, items: MONTHLY_HOURS, header: `  ${c.monthlyHoursAsk}` });
+      onLocation();
       const workModes = await promptMultiSelect({
         ask,
         stdinIsTTY,

package/bin/shakers-cli.js

@@ -92,7 +92,7 @@ const HANDLERS = {
   login: runLogin,
   logout: runLogout,
   superadmin: runSuperadmin,
-  mcp: () => require('../src/mcp-install').runMcpInstall(),
+  mcp: (args) => require('../src/mcp-install').runMcpInstall({ args }),
 };
 
 const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma', 'update']);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/account-marker.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { getConfigDir } = require('./config-dir');
+
+const MARKER_FILE_NAME = 'account-marker.json';
+const MARKER_FILE_VERSION = 1;
+
+function accountMarkerPath(env = process.env) {
+  return path.join(getConfigDir(env), MARKER_FILE_NAME);
+}
+
+function hasAccountMarker(env = process.env, { fs: fsImpl = fs } = {}) {
+  return fsImpl.existsSync(accountMarkerPath(env));
+}
+
+function recordAccountMarker(kind, env = process.env, { fs: fsImpl = fs } = {}) {
+  if (hasAccountMarker(env, { fs: fsImpl })) return;
+  const target = accountMarkerPath(env);
+  const dir = path.dirname(target);
+  const tmp = path.join(dir, `.${MARKER_FILE_NAME}.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  const payload = `${JSON.stringify({ version: MARKER_FILE_VERSION, kind, at: new Date().toISOString() }, null, 2)}\n`;
+  try {
+    fsImpl.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const fd = fsImpl.openSync(tmp, 'wx', 0o600);
+    try {
+      fsImpl.writeFileSync(fd, payload);
+      try { fsImpl.fsyncSync(fd); } catch {}
+    } finally {
+      fsImpl.closeSync(fd);
+    }
+    fsImpl.renameSync(tmp, target);
+  } catch {
+    try { fsImpl.unlinkSync(tmp); } catch {}
+  }
+}
+
+module.exports = { hasAccountMarker, recordAccountMarker };

package/src/account-trace.js

@@ -0,0 +1,23 @@
+'use strict';
+
+const { hasAuthSessionFile } = require('./auth-session-store');
+const { loadConsentState } = require('./share-consent-state');
+const { loadConfigFile } = require('./config');
+const { hasAccountMarker, recordAccountMarker } = require('./account-marker');
+
+function hasCurrentTrace(env) {
+  const consent = loadConsentState(env);
+  return hasAuthSessionFile(env)
+    || !!(consent && consent.lastSentAt)
+    || require('./report-store').hasRecordedUpload(env)
+    || !!loadConfigFile(env).superadminSession;
+}
+
+function hasAccountTrace(env = process.env) {
+  if (hasAccountMarker(env)) return true;
+  if (!hasCurrentTrace(env)) return false;
+  recordAccountMarker('existing-trace', env);
+  return true;
+}
+
+module.exports = { hasAccountTrace };

package/src/ai-usage-review.js

@@ -0,0 +1,101 @@
+'use strict';
+
+const path = require('path');
+const { derivePayload } = require('./share-payload');
+const { classify } = require('./maturity');
+const { reviewCopy } = require('./signup-copy');
+const { sanitizeRenderText } = require('./sanitize-network-text');
+
+function repoName(repo) {
+  return path.basename(String(repo)) || String(repo);
+}
+
+function uploadFacts({ report, maturity, repos = [] }) {
+  const payload = derivePayload(report, maturity);
+  const sessions = payload.sessions || {};
+  const conversationExcerpts =
+    (payload.steering ? payload.steering.redactedSteeringExcerpts.length : 0)
+    + (payload.decisions ? payload.decisions.redactedDecisionExcerpts.length : 0);
+  const commandExcerpts = Array.isArray(sessions.redactedCommandSample) ? sessions.redactedCommandSample.length : 0;
+  return {
+    tools: (report.tools || []).filter((t) => t && t.detected).map((t) => t.name || t.id),
+    technologies: payload.technologies.filter((t) => typeof t === 'string'),
+    sessionCount: sessions.sessionCount || 0,
+    activeDaysPerWeek: typeof sessions.activeDaysPerWeek === 'number' ? sessions.activeDaysPerWeek : null,
+    commitCount: payload.gitActivity ? payload.gitActivity.commitCount : 0,
+    repos: repos.map(repoName),
+    agents: payload.agents.map((a) => a.name),
+    agentDefinitions: payload.agents.filter((a) => a.definition).length,
+    agentSummaries: payload.agentSynthesis.filter((a) => a.whatItDoes || a.symbolicName).length,
+    conversationExcerpts,
+    commandExcerpts,
+  };
+}
+
+function keepNamed(list, excluded) {
+  return Array.isArray(list) ? list.filter((x) => !(x && excluded.has(x.name))) : list;
+}
+
+function withoutExcluded(report, { agents = [], excerpts = true } = {}) {
+  const excluded = new Set(agents);
+  const next = structuredClone(report);
+  if (excluded.size > 0) {
+    next.agents = keepNamed(next.agents, excluded)
+      .map((a) => (a && excluded.has(a.parent) ? { ...a, parent: null } : a));
+    next.agentDefinitions = keepNamed(next.agentDefinitions, excluded);
+    next.agentDescriptions = keepNamed(next.agentDescriptions, excluded);
+    if (next.agentEvaluation) next.agentEvaluation.evaluations = keepNamed(next.agentEvaluation.evaluations, excluded);
+    if (next.agentSynthesis) next.agentSynthesis.agents = keepNamed(next.agentSynthesis.agents, excluded);
+    if (next.detectionEvidence) next.detectionEvidence.agents = keepNamed(next.detectionEvidence.agents, excluded);
+    if (next.agentUsage && next.agentUsage.byAgent) {
+      for (const name of excluded) delete next.agentUsage.byAgent[name];
+    }
+    if (next.agentCounts) next.agentCounts.agents = Array.isArray(next.agents) ? next.agents.length : 0;
+  }
+  if (!excerpts) {
+    if (next.steering) next.steering.redactedSteeringExcerpts = [];
+    if (next.decisions) next.decisions.redactedDecisionExcerpts = [];
+    if (next.sessions) next.sessions.redactedCommandSample = [];
+  }
+  return { report: next, maturity: classify(next) };
+}
+
+function joined(list) {
+  return list.join(', ');
+}
+
+function summaryText(lang, facts, { sent = false } = {}) {
+  const c = reviewCopy(lang);
+  return [
+    sent ? c.sentTitle : c.title,
+    facts.tools.length ? c.tools(joined(facts.tools)) : null,
+    facts.technologies.length ? c.technologies(joined(facts.technologies)) : null,
+    c.activity(facts.sessionCount, facts.activeDaysPerWeek),
+    facts.repos.length ? c.repos(joined(facts.repos), facts.commitCount) : null,
+    facts.agents.length ? c.agents(joined(facts.agents), facts.agentDefinitions, facts.agentSummaries) : null,
+    facts.conversationExcerpts + facts.commandExcerpts > 0 ? c.excerpts(facts.conversationExcerpts, facts.commandExcerpts) : c.noExcerpts,
+    c.notSent,
+  ].filter(Boolean).map((line, i) => (i === 0 ? line : `- ${line}`)).join('\n');
+}
+
+function explanationText(lang) {
+  const c = reviewCopy(lang);
+  return [c.explanationTitle, ...c.explanation, c.afterwards].join('\n\n');
+}
+
+function resultText(lang, preview) {
+  const c = reviewCopy(lang);
+  if (!preview) return [c.resultPending, c.afterwards].join('\n\n');
+  const m = preview.matrix || {};
+  const lines = [
+    c.resultTitle,
+    m.setupLevel ? c.setupLevel(c.levels[m.setupLevel] || m.setupLevel) : null,
+    preview.setup && preview.setup.explanation,
+    m.usageLevel ? c.usageLevel(c.levels[m.usageLevel] || m.usageLevel) : null,
+    preview.usage && preview.usage.explanation,
+    m.cell ? c.cell(m.cell) : null,
+  ].filter(Boolean).map(sanitizeRenderText);
+  return [lines.join('\n'), c.explanation[0], c.afterwards].join('\n\n');
+}
+
+module.exports = { uploadFacts, withoutExcluded, repoName, summaryText, explanationText, resultText };

package/src/auth-session-store.js

@@ -4,6 +4,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
 // `~/.config/shakers/auth-session.json` — the logged-in Talent's session.
 
@@ -141,6 +142,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
     try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
     throw e;
   }
+  recordAccountMarker(cookie ? 'email' : sessionToken ? 'device' : 'token', env, { fs: fsImpl });
   return target;
 }
 
@@ -174,6 +176,10 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   };
 }
 
+function hasAuthSessionFile(env = process.env, { fs: fsImpl = fs } = {}) {
+  return fsImpl.existsSync(authSessionPath(env));
+}
+
 // Removes the file. Idempotent and never throws — `logout` on no session is a
 // no-op, not a failure.
 function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
@@ -207,6 +213,7 @@ module.exports = {
   authSessionPath,
   saveAuthSession,
   loadAuthSession,
+  hasAuthSessionFile,
   clearAuthSession,
   sessionStatus,
   isLoggedIn,

package/src/backend-request.js

@@ -71,6 +71,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';
@@ -151,6 +152,7 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';

package/src/config.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { readEnv } = require('./env-paths');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
 // Persistent CLI config file.
 function configDir(env = process.env) {
@@ -815,6 +816,7 @@ function saveSuperadminSession(session, env = process.env) {
     expiresAt: session.expiresAt || null,
   };
   saveConfigFile(config, env);
+  recordAccountMarker('superadmin', env);
 }
 
 function clearSuperadminSession(env = process.env) {

package/src/consent-flow.js

@@ -15,10 +15,11 @@ const MAX_ATTEMPTS = 5;
 const YES_RE = /^(y|yes|s|si|sí)$/i;
 const NO_RE = /^(n|no)$/i;
 
-async function askYesNo(ask, question, catalog, { defaultNo = false } = {}) {
+async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false } = {}) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     const raw = String(await ask(question)).trim();
     if (defaultNo && raw === '') return false;
+    if (defaultYes && raw === '') return true;
     if (YES_RE.test(raw)) return true;
     if (NO_RE.test(raw)) return false;
     process.stdout.write(`  ${catalog.consent.invalidAnswer}\n`);
@@ -112,4 +113,4 @@ async function runConsentPrompt({
   return null;
 }
 
-module.exports = { runConsentPrompt, defaultVerifyEmail };
+module.exports = { runConsentPrompt, defaultVerifyEmail, askYesNo };

package/src/i18n.js

@@ -450,7 +450,7 @@ const catalogs = {
       // Shown only when the 4 prose gaps below were actually replaced by a validated, project-adapted response — never on fallback to the curated content.
       roadmapPersonalizedNotice: 'Contenido adaptado a tu proyecto.',
       // Los dos avisos que faltaban, hermanos del `agentsEvalMissing` que añadió la 106.
-      roadmapNotPersonalizedNotice: 'Este roadmap es el genérico de tu tier: esta vez no se ha podido adaptar a tu proyecto. Vuelve a ejecutar `usage` para intentarlo otra vez.',
+      roadmapNotPersonalizedNotice: 'Este roadmap es el genérico de tu tier: esta vez no se ha podido adaptar a tu proyecto. Vuelve a ejecutar `usage --roadmap` para intentarlo otra vez.',
       // El antes y el después del roadmap.
       roadmapNowLabel: 'De dónde partes',
       roadmapProjectionLabel: 'Dónde te deja esta ruta',
@@ -558,6 +558,7 @@ const catalogs = {
       // Roadmap personalization: reuses the
       // same spinner mechanism as synthesizingLabel above.
       personalizingRoadmapLabel: 'Personalizando roadmap…',
+      roadmapNotForAccounts: 'El roadmap no está disponible para cuentas de Shakers: tu nivel sale de certificarte.',
       // Agent definition-quality evaluation (ephemeral LLM call).
       evaluatingAgentsLabel: 'Evaluando la calidad de tus agentes…',
       // "Construir el siguiente nivel ahora": now a SECONDARY, opt-in alternative — the copyable implementation prompt (below) is the PRIMARY "how do I implement this" path.
@@ -575,7 +576,7 @@ const catalogs = {
         + '      --repo             Evalúa solo el repo actual\n'
         + '      --scope machine|repo  Igual que --machine / --repo (salta el selector)\n'
         + '      --all-repos        Alias de --machine\n'
-        + '      --roadmap          Muestra los pasos para subir tu nivel de uso de IA (oculto por defecto)\n'
+        + '      --roadmap          Muestra los pasos para subir tu nivel de uso de IA (solo sin cuenta de Shakers)\n'
         + '      --build-next-level Genera el starter del siguiente tier (alternativa secundaria)\n'
         + '      --force            Junto a --build-next-level, sobrescribe un fichero existente\n'
         + '      --lang es|en       Fuerza el idioma (informe + prompt) en vez de detectarlo del sistema\n'
@@ -647,7 +648,7 @@ const catalogs = {
       // Esta pregunta se pide ahora ANTES de cualquier llamada de IA/egress (agent-synthesis, agent-evaluation, personalización de roadmap), no después.
       noReportWithoutConsent: 'Sin tu consentimiento, este informe no incluirá síntesis, evaluación ni roadmap generados por IA esta vez (el resto del informe se muestra igual). Vuelve a ejecutar `usage` y acepta para incluirlos, o usa --consent-reset si quieres que se te pregunte de nuevo.',
       deniedSaved: 'Entendido, no se guardará nada. Puedes cambiar de opinión más adelante volviendo a ejecutar el comando.',
-      grantedSaved: (email) => `Gracias. A partir de ahora este informe se guardará automáticamente en Shakers (correo: ${email}, máx. 1 vez por hora).`,
+      grantedSaved: (email) => `Gracias. Antes de subir nada a Shakers te enseñaré lo que se enviaría y solo lo subiré si lo apruebas (correo: ${email}, máx. 1 vez por hora).`,
       // Un talento logueado NUNCA ve el prompt de email (su cuenta ya prueba su identidad).
       noSessionEmail: 'No hay un correo asociado a tu sesión todavía, así que no se puede guardar el informe esta vez. Se te preguntará de nuevo la próxima ejecución.',
       skipAlreadyDecided: (decision, path) =>
@@ -972,12 +973,13 @@ const catalogs = {
     },
     mcpInstall: {
       title: 'Conectando el MCP de Shakers',
-      clients: { claudeDesktop: 'Claude Desktop', claudeCode: 'Claude Code', cursor: 'Cursor', geminiCli: 'Gemini CLI', codex: 'Codex (y ChatGPT en modo Codex)', vscode: 'VS Code', windsurf: 'Windsurf' },
+      clients: { claudeDesktop: 'Claude Desktop', claudeCode: 'Claude Code', cursor: 'Cursor', geminiCli: 'Gemini CLI', codex: 'Codex / ChatGPT', vscode: 'VS Code', windsurf: 'Windsurf' },
       status: {
         configured: 'conectado',
         unchanged: 'ya estaba conectado',
         'not-found': 'no instalado en esta máquina',
-        'invalid-json': 'su configuración no es JSON válido; no la he tocado',
+        'invalid-config': 'no puedo editar su configuración con seguridad; no la he tocado',
+        manual: 'ejecuta este comando en tu terminal:',
         failed: 'no se pudo conectar',
       },
       removedLegacy: 'Sustituye a la entrada antigua "shakers-ai-usage".',
@@ -985,7 +987,10 @@ const catalogs = {
       confirm: '¿Conecto Shakers a ellas para que puedas usarlo desde tu IA? [S/n]',
       declined: 'No he tocado nada. Para conectarlo más tarde, vuelve a ejecutar el instalador.',
       noTerminal: 'No hay una terminal donde preguntarte, así que no he tocado nada. Vuelve a ejecutar el instalador en tu terminal para conectarlo.',
-      restart: 'Reinicia las apps que estén abiertas para que carguen Shakers.',
+      restart: (apps) => `Reinicia ${apps} (o recarga sus servidores MCP) para que aparezcan las herramientas de Shakers.`,
+      alreadyConnected: 'Shakers ya estaba conectado. Si no ves sus herramientas, reinicia la app o recarga sus servidores MCP.',
+      yesHint: 'Para conectarlas sin preguntar (por ejemplo, desde un asistente de IA): shakers mcp install --yes',
+      help: 'mcp install — conecta Shakers a las apps de IA de esta máquina (Claude Desktop, Claude Code, Cursor, Gemini CLI, Codex / ChatGPT, VS Code, Windsurf).\n\nUso:\n  shakers mcp install            pregunta en la terminal y conecta las apps encontradas\n  shakers mcp install --yes      conecta sin preguntar (-y; para asistentes de IA y scripts)\n  shakers mcp install --json     imprime el resultado como un único objeto JSON\n\nSin --yes y sin terminal no toca nada. SHAKERS_MCP_INSTALL=1 equivale a --yes.\nAl terminar, reinicia las apps que indique (o recarga sus servidores MCP) para que aparezcan las herramientas de Shakers.',
       noneFound: 'No he encontrado ninguna app de IA compatible en esta máquina.',
       failedAll: 'No he podido conectar Shakers a tus apps de IA. Vuelve a ejecutar el instalador para reintentarlo.',
     },
@@ -1224,7 +1229,7 @@ const catalogs = {
       needInput: 'Se necesitan email y contraseña para iniciar sesión.',
       success: 'Sesión iniciada. Tu informe ya no incluye el roadmap ni las sugerencias de mejora: tu nivel sale de certificarte.',
       expiresAt: (iso) => `La sesión caduca: ${iso}. Cuando expire te lo diré y podrás volver a entrar con \`login\`.`,
-      loggedOut: 'Sesión cerrada. Vuelves a ver el informe completo, con roadmap y sugerencias.',
+      loggedOut: 'Sesión cerrada. Vuelves a ver las sugerencias de mejora en tu informe.',
       notLoggedIn: 'No había ninguna sesión iniciada. No hay nada que cerrar.',
       errorInvalidCredentials: 'Credenciales incorrectas: revisa tu email y contraseña e inténtalo otra vez.',
       errorNoEmailPassword: 'Esta cuenta existe pero no tiene contraseña de email: la registraste con Google o LinkedIn. Si fue con Google, usa `login --google`. Si fue con LinkedIn, entra desde la web para añadir una contraseña por ahora.',
@@ -2094,7 +2099,7 @@ const catalogs = {
       roadmapPersonalizedNotice: 'Content adapted to your project.',
       // See the Spanish catalog for why these say what was lost
       // rather than what went wrong, and when they are allowed to show.
-      roadmapNotPersonalizedNotice: 'This roadmap is the generic one for your tier: it could not be adapted to your project this run. Run `usage` again to retry.',
+      roadmapNotPersonalizedNotice: 'This roadmap is the generic one for your tier: it could not be adapted to your project this run. Run `usage --roadmap` again to retry.',
       // See the Spanish catalog for why the tag sits next to the
       // heading instead of in a footnote.
       roadmapNowLabel: 'Where you start from',
@@ -2198,6 +2203,7 @@ const catalogs = {
       reposScopeAll: 'Evaluating all AI usage on this machine.',
       synthesizingLabel: 'Synthesizing agents with AI…',
       personalizingRoadmapLabel: 'Personalizing roadmap…',
+      roadmapNotForAccounts: 'The roadmap is not available for Shakers accounts: your level comes from certifying.',
       // Agent definition-quality evaluation (ephemeral LLM call).
       evaluatingAgentsLabel: 'Evaluating your agents’ quality…',
       buildNextLevelHint: 'Alternatively, run `usage --build-next-level` to generate the starter file directly in your project.',
@@ -2214,7 +2220,7 @@ const catalogs = {
         + '      --repo             Evaluate the current repo only\n'
         + '      --scope machine|repo  Same as --machine / --repo (skips the picker)\n'
         + '      --all-repos        Alias of --machine\n'
-        + '      --roadmap          Show the steps to raise your AI-usage level (hidden by default)\n'
+        + '      --roadmap          Show the steps to raise your AI-usage level (only without a Shakers account)\n'
         + '      --build-next-level Generate the next tier starter (secondary alternative)\n'
         + '      --force            With --build-next-level, overwrite an existing file\n'
         + '      --lang es|en       Force the language (report + prompt) instead of OS detection\n'
@@ -2287,7 +2293,7 @@ const catalogs = {
       // This question is now asked BEFORE any AI/egress call (agent-synthesis, agent-evaluation, roadmap personalization), not after.
       noReportWithoutConsent: 'Without your consent, this report will not include AI-generated synthesis, evaluation, or roadmap this time (the rest of the report is shown as usual). Run `usage` again and accept to include them, or use --consent-reset if you want to be asked again.',
       deniedSaved: 'Understood, nothing will be saved. You can change your mind later by running the command again.',
-      grantedSaved: (email) => `Thanks. From now on this report will be saved in Shakers automatically (email: ${email}, max. once per hour).`,
+      grantedSaved: (email) => `Thanks. Before anything is uploaded to Shakers I will show you what would be sent, and I will upload it only if you approve it (email: ${email}, at most once an hour).`,
       // A logged-in Talent is NEVER asked for an email (their account already proves identity).
       noSessionEmail: "There's no email on file for your session yet, so this report can't be saved this time. You'll be asked again next run.",
       skipAlreadyDecided: (decision, path) =>
@@ -2609,12 +2615,13 @@ const catalogs = {
     },
     mcpInstall: {
       title: 'Connecting the Shakers MCP',
-      clients: { claudeDesktop: 'Claude Desktop', claudeCode: 'Claude Code', cursor: 'Cursor', geminiCli: 'Gemini CLI', codex: 'Codex (and ChatGPT in Codex mode)', vscode: 'VS Code', windsurf: 'Windsurf' },
+      clients: { claudeDesktop: 'Claude Desktop', claudeCode: 'Claude Code', cursor: 'Cursor', geminiCli: 'Gemini CLI', codex: 'Codex / ChatGPT', vscode: 'VS Code', windsurf: 'Windsurf' },
       status: {
         configured: 'connected',
         unchanged: 'already connected',
         'not-found': 'not installed on this machine',
-        'invalid-json': 'its config is not valid JSON; left untouched',
+        'invalid-config': 'its config cannot be edited safely; left untouched',
+        manual: 'run this command in your terminal:',
         failed: 'could not connect',
       },
       removedLegacy: 'Replaces the old "shakers-ai-usage" entry.',
@@ -2622,7 +2629,10 @@ const catalogs = {
       confirm: 'Connect Shakers to them so you can use it from your AI? [Y/n]',
       declined: 'Nothing touched. To connect it later, run the installer again.',
       noTerminal: 'There is no terminal to ask you on, so nothing was touched. Run the installer again in your terminal to connect it.',
-      restart: 'Restart any of these apps that is open so it loads Shakers.',
+      restart: (apps) => `Restart ${apps} (or reload their MCP servers) so the Shakers tools appear.`,
+      alreadyConnected: 'Shakers was already connected. If its tools do not appear, restart the app or reload its MCP servers.',
+      yesHint: 'To connect them without being asked (for example from an AI assistant): shakers mcp install --yes',
+      help: 'mcp install — connect Shakers to the AI apps on this machine (Claude Desktop, Claude Code, Cursor, Gemini CLI, Codex / ChatGPT, VS Code, Windsurf).\n\nUsage:\n  shakers mcp install            ask on the terminal, then connect every app found\n  shakers mcp install --yes      connect without asking (-y; for AI assistants and scripts)\n  shakers mcp install --json     print the result as one JSON object\n\nWithout --yes and without a terminal, nothing is touched. SHAKERS_MCP_INSTALL=1 works like --yes.\nWhen it finishes, restart the apps it names (or reload their MCP servers) so the Shakers tools appear.',
       noneFound: 'Found no supported AI app on this machine.',
       failedAll: 'Could not connect Shakers to your AI apps. Re-run this installer to retry.',
     },
@@ -2857,7 +2867,7 @@ const catalogs = {
       needInput: 'Email and password are required to log in.',
       success: 'Logged in. Your report no longer includes the roadmap or the improvement suggestions: your level comes from certifying.',
       expiresAt: (iso) => `The session expires: ${iso}. When it does I will tell you, and you can log in again with \`login\`.`,
-      loggedOut: 'Logged out. You are back to the full report, with roadmap and suggestions.',
+      loggedOut: 'Logged out. Your report shows the improvement suggestions again.',
       notLoggedIn: 'No session was active. Nothing to log out of.',
       errorInvalidCredentials: 'Wrong credentials: check your email and password and try again.',
       errorNoEmailPassword: 'This account exists but has no email password: you registered with Google or LinkedIn. If it was Google, use `login --google`. If it was LinkedIn, sign in on the web to add a password for now.',

package/src/mcp-ai-usage-result-tool.js

@@ -52,6 +52,8 @@ async function pollClassifiedInventory({
   }
 }
 
+const RESULT_MESSAGE = 'Print relayVerbatim word for word: the result in "My work with AI", what it means and how to ask for a human review.';
+const PROFILE_PENDING_MESSAGE = 'The profile result is not ready yet: call ai_usage_result again in a few minutes.';
 const READY_MESSAGE = 'Shakers finished classifying the agents.';
 const PENDING_MESSAGE = 'Shakers is still classifying the agents — this is normal, call ai_usage_result again shortly to keep waiting.';
 
@@ -65,6 +67,12 @@ function makeAiUsageResultTool(deps = {}) {
     now = () => Date.now(),
     intervalMs = POLL_INTERVAL_MS,
     capMs = POLL_CAP_MS,
+    resolveAiProfilePreview = require('./ai-profile-preview').resolveAiProfilePreview,
+    getAiProfileEndpoint = require('./config').getAiProfileEndpoint,
+    ensureFreshSession = require('./session-refresh').ensureFreshSession,
+    aiProfileWaitMs = 30000,
+    resultText = require('./ai-usage-review').resultText,
+    lang = () => require('./signup-language').signupLanguage(require('./i18n').detectFlowLang()),
   } = deps;
 
   async function handler() {
@@ -77,27 +85,41 @@ function makeAiUsageResultTool(deps = {}) {
       throw new Error('discovered-inventory endpoint is not configured (set SHAKERS_CLI_INGEST_ENDPOINT).');
     }
 
-    const result = await pollClassifiedInventory({
-      accessToken: session.accessToken,
-      endpoint,
-      requestDiscoveredInventory,
-      sleep,
-      now,
-      intervalMs,
-      capMs,
-    });
+    const [result, aiProfile] = await Promise.all([
+      pollClassifiedInventory({
+        accessToken: session.accessToken,
+        endpoint,
+        requestDiscoveredInventory,
+        sleep,
+        now,
+        intervalMs,
+        capMs,
+      }),
+      resolveAiProfilePreview(
+        { session, endpoint: getAiProfileEndpoint(), timeoutMs: aiProfileWaitMs },
+        {
+          refreshToken: async () => {
+            const fresh = await ensureFreshSession(process.env);
+            return fresh ? { accessToken: fresh.accessToken, hubAccessToken: fresh.hubAccessToken } : null;
+          },
+        },
+      ).catch(() => ({ status: 'unavailable', preview: null })),
+    ]);
+    const profileReady = aiProfile.status === 'ready';
     return {
       ...result,
-      message: result.status === 'ready' ? READY_MESSAGE : PENDING_MESSAGE,
+      aiProfile,
+      relayVerbatim: resultText(lang(), profileReady ? aiProfile.preview : null),
+      message: `${RESULT_MESSAGE} ${result.status === 'ready' ? READY_MESSAGE : PENDING_MESSAGE}${profileReady ? '' : ` ${PROFILE_PENDING_MESSAGE}`}`,
     };
   }
 
   return {
     name: 'ai_usage_result',
     title: 'Results of your AI analysis',
-    description: 'Fetches from Shakers the description of each AI agent found in the analysis you approved. It reads nothing on this computer.',
+    description: 'Fetches from Shakers the result of the AI analysis you approved, what it means, and the description of each AI agent found. It reads nothing on this computer.',
     guidance:
-      "Retrieve the enriched Shakers classification for the talent's agents after ai_usage. Shakers classifies agents and writes their descriptions server-side (no client LLM), so this reads the result: per agent { name, tools, model, category, role, level, code, whatItDoes }. Session-keyed, no arguments. Server-side classification can take a few minutes, so this does a bounded internal poll (~90s max, never a long-held call): returns { status: 'ready', agents } once every agent has been classified, or { status: 'pending', agents } while Shakers is still processing (call it again to keep waiting — 'pending' is normal progress, not an error). Present agents to the talent by NAME and category/role only; the `code` field is an internal handle for add_agent, never show it. Requires an active session.",
+      "Retrieve the result after an approved upload: relayVerbatim is the 'My work with AI' result with its levels and explanation in plain words, and how to ask for a human review; print it word for word. It also returns the enriched Shakers classification for the talent's agents. Shakers classifies agents and writes their descriptions server-side (no client LLM), so this reads the result: per agent { name, tools, model, category, role, level, code, whatItDoes }. Session-keyed, no arguments. Server-side classification can take a few minutes, so this does a bounded internal poll (~90s max, never a long-held call): returns { status: 'ready', agents } once every agent has been classified, or { status: 'pending', agents } while Shakers is still processing (call it again to keep waiting — 'pending' is normal progress, not an error). Present agents to the talent by NAME and category/role only; the `code` field is an internal handle for add_agent, never show it. Requires an active session.",
     inputSchema: RESULT_INPUT_SCHEMA,
     handler,
   };