shakers-cli 0.16.0 → 0.18.0

package/src/report-gating.js

@@ -2,11 +2,12 @@
 
 const { loadAuthSession, sessionStatus, isPlatformTalent } = require('./auth-session-store');
 const { getProfile } = require('./config');
+const { hasAccountTrace } = require('./account-trace');
 
 // THE ONE LAYER THAT DECIDES WHAT THE REPORT SHOWS ACCORDING TO IDENTITY.
 
 // Pure: identity in, policy out.
-function resolveReportGate({ loggedIn = false, status = null, email = null, userType = null, profile = 'talent' } = {}) {
+function resolveReportGate({ loggedIn = false, accountTrace = false, status = null, email = null, userType = null, profile = 'talent' } = {}) {
   const showEverything = !loggedIn;
   const resolvedProfile = profile === 'external' ? 'external' : 'talent';
   return Object.freeze({
@@ -16,7 +17,7 @@ function resolveReportGate({ loggedIn = false, status = null, email = null, user
     email: loggedIn && typeof email === 'string' && email ? email : null,
     // --roadmap AND its server-side computation/egress (see bin/report.js): a
     // logged-in Talent's roadmap is not merely hidden, it is not requested.
-    showRoadmap: showEverything,
+    showRoadmap: showEverything && !accountTrace,
     // Per-agent "how to improve this agent" tips in the footprint report.
     showAgentSuggestions: showEverything,
     // The copyable remediation prompt in a `certify` verdict.
@@ -35,6 +36,7 @@ function reportGateForIdentity(env = process.env, now = Date.now()) {
   const status = sessionStatus(session, now);
   return resolveReportGate({
     loggedIn: status === 'active',
+    accountTrace: hasAccountTrace(env),
     status,
     email: session ? session.email : null,
     userType: session ? session.userType : null,

package/src/report-store.js

@@ -54,10 +54,10 @@ function migrateFromV1(parsed) {
   return { schemaVersion: SCHEMA_VERSION, updatedAt: (parsed && parsed.updatedAt) || null, projects };
 }
 
-function loadState() {
+function loadState(env = process.env) {
   let parsed;
   try {
-    parsed = JSON.parse(fs.readFileSync(statePath(), 'utf8'));
+    parsed = JSON.parse(fs.readFileSync(statePath(env), 'utf8'));
   } catch {
     return freshState();
   }
@@ -154,6 +154,10 @@ function recordBackendAcceptance({ root, kind, backend }) {
   return stampAndSaveState(state, absRoot);
 }
 
+function hasRecordedUpload(env = process.env) {
+  return Object.values(loadState(env).projects).some((p) => !!(p && p.backendAcceptance && Object.keys(p.backendAcceptance).length));
+}
+
 function loadFootprint({ root } = {}) {
   const absRoot = path.resolve(root || process.cwd());
   const state = loadState();
@@ -220,6 +224,7 @@ module.exports = {
   loadAgentClassifications,
   loadFootprint,
   recordBackendAcceptance,
+  hasRecordedUpload,
   materializeProjectReport,
   certKey,
   SCHEMA_VERSION,

package/src/roles-flow.js

@@ -88,6 +88,7 @@ async function runAddRole({ io, session, catalog, deps = makeRolesDeps() }) {
 // deduped, for setting/switching the MAIN role.
 async function fetchHeldRoles({ deps, hubAccessToken }) {
   const held = [];
+  const assigned = [];
   let mainClusterId = null;
   const certEndpoint = deps.getMyCertificationsEndpoint();
   if (certEndpoint) {
@@ -99,10 +100,11 @@ async function fetchHeldRoles({ deps, hubAccessToken }) {
   }
   const assignedEndpoint = deps.getAssignedClustersEndpoint();
   if (assignedEndpoint) {
-    const assigned = await deps.requestAssignedClusters({ hubAccessToken }, { endpoint: assignedEndpoint });
-    if (assigned.ok) for (const c of assigned.clusters || []) held.push(c);
+    const res = await deps.requestAssignedClusters({ hubAccessToken }, { endpoint: assignedEndpoint });
+    if (res.ok) assigned.push(...(res.clusters || []));
   }
-  return { held: dedupeByCluster(held), mainClusterId };
+  held.push(...assigned);
+  return { held: dedupeByCluster(held), assigned, mainClusterId };
 }
 
 // `change-role`: switch the MAIN role to one of the roles the talent already holds.
@@ -130,12 +132,12 @@ async function runChangeMainRole({ io, session, catalog, deps = makeRolesDeps()
 
 // The onboarding final step: pick a MAIN role from the roles resolved for the
 // talent (interview recommendations + any held). Degrades gracefully to a skip.
-async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRolesDeps() }) {
+async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRolesDeps(), onRolesShown = () => {} }) {
   const r = catalog.roles;
   const hubAccessToken = session ? session.hubAccessToken : null;
 
   io.section(r.mainRoleTitle);
-  const { held, mainClusterId } = await io.withProgress(r.loadingHeld, () => fetchHeldRoles({ deps, hubAccessToken }));
+  const { held, assigned, mainClusterId } = await io.withProgress(r.loadingHeld, () => fetchHeldRoles({ deps, hubAccessToken }));
 
   // Prefer the talent's own/recommended roles; fall back to the catalog for a
   // fresh talent so a main role can always be set (picking one adds it first).
@@ -150,6 +152,7 @@ async function runOnboardingMainRoleStep({ io, session, catalog, deps = makeRole
     io.notify(r.mainRolePending);
     return { ok: true, chosen: null };
   }
+  onRolesShown({ suggested: assigned.filter((c) => c.type === 'RECOMMENDED').map((c) => c.clusterId), clustersCount: assigned.length });
   const choice = await chooseRole({
     io, roles, header: r.mainRolePrompt, hint: r.selectHint, initialClusterId: mainClusterId,
   });

package/src/saved-positions-flow.js

@@ -27,10 +27,10 @@ async function runToggleSave({ io, rawOut, session, catalog, mode, opts = {}, de
   }
   const positionId = resolved.id;
 
-  const label = mode === 'save' ? fp.saving : fp.unsaving;
-  const res = await io.withProgress(label, () => (mode === 'save'
+  const toggle = () => (mode === 'save'
     ? deps.savePosition({ hubAccessToken, positionId })
-    : deps.unsavePosition({ hubAccessToken, positionId })));
+    : deps.unsavePosition({ hubAccessToken, positionId }));
+  const res = opts.json ? await toggle() : await io.withProgress(mode === 'save' ? fp.saving : fp.unsaving, toggle);
   if (!res.ok) {
     io.error(res.reason === 'not-found' ? fp.notFound : fp.failed(res.reason));
     return { ok: false, reason: res.reason };

package/src/scanner.js

@@ -12,7 +12,8 @@ const { detectMcpServers, buildMcpAggregate } = require('./mcp-detector');
 const { analyzeMemoryStructure } = require('./memory-structure-detector');
 const { detectAutomations } = require('./automations-detector');
 const { detectBrowserTools } = require('./browser-tools-detector');
-const { getHomeDir } = require('./env-paths');
+const { getHomeDir, codexHome, piAgentDir } = require('./env-paths');
+const { OWN_SKILL_NAMES } = require('./cli-skill');
 
 /* ---------- existence-check utilities (existence only, never content) ---------- */
 
@@ -85,14 +86,30 @@ function resolveSignalPath(sig, root) {
 
 /* ---------- DEPTH probes: return ONLY numbers ---------- */
 
-function countDirEntries(p) {
+function countSkillDirs(p) {
   try {
-    return fs.readdirSync(p, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+    return fs.readdirSync(p, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && !e.name.startsWith('.') && !OWN_SKILL_NAMES.has(e.name)).length;
   } catch {
     return 0;
   }
 }
 
+function countFilesDeep(p, ext, depth = 3) {
+  let entries;
+  try {
+    entries = fs.readdirSync(p, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let n = 0;
+  for (const e of entries) {
+    if (e.isFile() && e.name.endsWith(ext)) n += 1;
+    else if (e.isDirectory() && depth > 0) n += countFilesDeep(path.join(p, e.name), ext, depth - 1);
+  }
+  return n;
+}
+
 function countFiles(p, ext) {
   try {
     return fs.readdirSync(p).filter((f) => (ext ? f.endsWith(ext) : true)).length;
@@ -113,6 +130,49 @@ function countJsonKeys(file, key) {
   }
 }
 
+function claudeHooks(root) {
+  return (
+    countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks') +
+    countJsonKeys(path.join(root, '.claude', 'settings.local.json'), 'hooks') +
+    countJsonKeys(path.join(getHomeDir(), '.claude', 'settings.json'), 'hooks')
+  );
+}
+
+const TOML_HOOK_TABLE = /^\s*\[\[?\s*hooks\.([A-Za-z]+)/;
+
+function countTomlHookEvents(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return 0;
+  }
+  const events = new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    const m = TOML_HOOK_TABLE.exec(line);
+    if (m && m[1] !== 'state') events.add(m[1]);
+  }
+  return events.size;
+}
+
+function codexHooks(root) {
+  return [codexHome(), path.join(root, '.codex')].reduce(
+    (n, dir) => n + countJsonKeys(path.join(dir, 'hooks.json'), 'hooks') + countTomlHookEvents(path.join(dir, 'config.toml')),
+    0,
+  );
+}
+
+const CLINE_HOOK_TYPES = new Set(['TaskStart', 'TaskResume', 'TaskCancel', 'TaskComplete', 'PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'Notification', 'PreCompact']);
+
+function countClineHooks(dir) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isFile() && CLINE_HOOK_TYPES.has(path.parse(e.name).name)).length;
+  } catch {
+    return 0;
+  }
+}
+
 /* ---------- config footprint: ONLY size in bytes and file count ---------- */
 /* No file name or path is ever stored: only numbers are aggregated.        */
 
@@ -273,17 +333,20 @@ const probes = {
   'claude-code': (root, ctx) => ({
     mcpServers: mcpCount(ctx, 'claude-code'),
     skills:
-      countDirEntries(path.join(root, '.claude', 'skills')) +
-      countDirEntries(path.join(os.homedir(), '.claude', 'skills')),
+      countSkillDirs(path.join(root, '.claude', 'skills')) +
+      countSkillDirs(path.join(getHomeDir(), '.claude', 'skills')),
     commands: countFiles(path.join(root, '.claude', 'commands'), '.md'),
     instructions: exists(path.join(root, 'CLAUDE.md')) ? 1 : 0,
-    hooks: countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks'),
+    hooks: claudeHooks(root),
   }),
   cursor: (root, ctx) => ({
     rules:
       countFiles(path.join(root, '.cursor', 'rules'), '.mdc') +
       (exists(path.join(root, '.cursorrules')) ? 1 : 0),
     mcpServers: mcpCount(ctx, 'cursor'),
+    hooks:
+      countJsonKeys(path.join(root, '.cursor', 'hooks.json'), 'hooks') +
+      countJsonKeys(path.join(getHomeDir(), '.cursor', 'hooks.json'), 'hooks'),
   }),
   'github-copilot': (root) => ({
     instructions: exists(path.join(root, '.github', 'copilot-instructions.md')) ? 1 : 0,
@@ -307,10 +370,41 @@ const probes = {
   'gemini-cli': (root, ctx) => ({
     instructions: exists(path.join(root, 'GEMINI.md')) ? 1 : 0,
     mcpServers: mcpCount(ctx, 'gemini-cli'),
+    commands:
+      countFilesDeep(path.join(root, '.gemini', 'commands'), '.toml') +
+      countFilesDeep(path.join(getHomeDir(), '.gemini', 'commands'), '.toml'),
+    hooks:
+      countJsonKeys(path.join(root, '.gemini', 'settings.json'), 'hooks') +
+      countJsonKeys(path.join(getHomeDir(), '.gemini', 'settings.json'), 'hooks'),
   }),
-  'codex-cli': (root) => ({
+  'codex-cli': (root, ctx) => ({
     instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+    mcpServers: mcpCount(ctx, 'codex-cli'),
+    skills: countSkillDirs(path.join(codexHome(), 'skills')),
+    commands: countFiles(path.join(codexHome(), 'prompts'), '.md'),
+    hooks: codexHooks(root),
   }),
+  cline: (root) => ({
+    hooks:
+      countClineHooks(path.join(root, '.clinerules', 'hooks')) +
+      countClineHooks(path.join(getHomeDir(), 'Documents', 'Cline', 'Hooks')),
+  }),
+  pi: (root, ctx) => ({
+    instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+    mcpServers: mcpCount(ctx, 'pi'),
+    skills: countSkillDirs(path.join(root, '.pi', 'skills')) + countSkillDirs(path.join(piAgentDir(), 'skills')),
+    commands: countFiles(path.join(root, '.pi', 'prompts'), '.md') + countFiles(path.join(piAgentDir(), 'prompts'), '.md'),
+  }),
+  opencode: (root, ctx) => {
+    const home = path.join(getHomeDir(), '.config', 'opencode');
+    const dirs = [path.join(root, '.opencode'), home];
+    return {
+      instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+      mcpServers: mcpCount(ctx, 'opencode'),
+      skills: dirs.reduce((n, d) => n + countSkillDirs(path.join(d, 'skills')) + countSkillDirs(path.join(d, 'skill')), 0),
+      commands: dirs.reduce((n, d) => n + countFiles(path.join(d, 'commands'), '.md') + countFiles(path.join(d, 'command'), '.md'), 0),
+    };
+  },
   trae: (root) => ({
     // Low confidence: `.trae/rules` structure not verified (see detectors.js).
     rules: countFiles(path.join(root, '.trae', 'rules')),
@@ -325,16 +419,14 @@ function agentOrgChartCounts(root, agentsCount, mcp) {
   return {
     agents: agentsCount,
     skills:
-      countDirEntries(path.join(root, '.claude', 'skills')) +
-      countDirEntries(path.join(home, '.claude', 'skills')),
+      countSkillDirs(path.join(root, '.claude', 'skills')) +
+      countSkillDirs(path.join(home, '.claude', 'skills')),
     commands:
       countFiles(path.join(root, '.claude', 'commands'), '.md') +
       countFiles(path.join(home, '.claude', 'commands'), '.md'),
     // The third copy of the MCP paths lived here.
     mcpServers: (mcp && typeof mcp.total === 'number' ? mcp.total : 0),
-    hooks:
-      countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks') +
-      countJsonKeys(path.join(home, '.claude', 'settings.json'), 'hooks'),
+    hooks: claudeHooks(root),
   };
 }
 

package/src/session-gate.js

@@ -1,8 +1,5 @@
 'use strict';
 
-// Whether a non-exempt command may run: an active session, or a durable cookie
-// that can mint a fresh hub JWT right now. Reject only when neither holds.
-
 const { loadAuthSession, sessionStatus } = require('./auth-session-store');
 const { ensureFreshSession } = require('./session-refresh');
 
@@ -20,7 +17,7 @@ async function hasUsableSession(env = process.env, deps = {}) {
 
   const session = load(env);
   if (sessionStatus(session, now) === 'active') return true;
-  if (!session || (!session.cookie && !session.sessionToken)) return false;
+  if (!session || !session.sessionToken) return false;
 
   let refreshed = null;
   try { refreshed = await refresh(env, { now }); } catch { refreshed = null; }

package/src/session-normalizers.js

@@ -26,8 +26,6 @@ function textFromParts(parts) {
 }
 
 // --- Codex (~/.codex/sessions/**/rollout-*.jsonl) ---
-// Reads timestamp, cwd (session_meta), user text, and shell commands; a record matching none
-// of those passes through only its own real timestamp/cwd, else is dropped.
 function codexCommand(args) {
   let a = args;
   if (typeof a === 'string') {
@@ -60,7 +58,15 @@ function normalizeCodexRecord(raw) {
   }
 
   const type = str(raw.type) || str(item.type);
+  if (type === 'turn_context' && item.collaboration_mode && item.collaboration_mode.mode === 'plan') {
+    out.planMode = true;
+    return out;
+  }
   const name = str(item.name) || (type === 'function_call' ? 'shell' : null);
+  if (name === 'update_plan') {
+    out.message = { content: [{ type: 'tool_use', name }] };
+    return out;
+  }
   if (name && /shell|exec|bash|terminal|command/i.test(name)) {
     const command = codexCommand(item.arguments ?? item.input ?? item.args);
     if (command) {
@@ -73,11 +79,16 @@ function normalizeCodexRecord(raw) {
 }
 
 // --- Gemini CLI (~/.gemini/tmp/<project-hash>/chats/logs.json | session-*.jsonl) ---
-// logs.json = JSON array of { type:'user'|'model', message, timestamp }; session-*.jsonl =
-// per-line { role, parts }. No cwd is recorded (the dir is a one-way SHA-256 hash), so cwd
-// stays null — global session/time metrics still count; per-repo scoping can't.
 function normalizeGeminiRecord(raw) {
   if (!raw || typeof raw !== 'object') return null;
+  if (Array.isArray(raw.messages)) {
+    const out = [];
+    for (const m of raw.messages) {
+      const o = normalizeGeminiRecord(m);
+      if (o) out.push(o);
+    }
+    return out;
+  }
   const out = {};
   const ts = str(raw.timestamp) || str(raw.time);
   if (ts) out.timestamp = ts;
@@ -91,6 +102,11 @@ function normalizeGeminiRecord(raw) {
       return out;
     }
   }
+  const calls = Array.isArray(raw.toolCalls) ? raw.toolCalls.map((c) => toolUse(c && c.name)).filter(Boolean) : [];
+  if (calls.length) {
+    out.message = { role: 'assistant', content: calls };
+    return out;
+  }
   return out.timestamp ? out : null;
 }
 
@@ -111,7 +127,7 @@ function normalizeContinueRecord(raw) {
     }
     return null;
   }
-  const out = [];
+  const out = str(raw.mode) === 'plan' ? [cwd ? { cwd, planMode: true } : { planMode: true }] : [];
   for (const entry of history) {
     const msg = entry && entry.message && typeof entry.message === 'object' ? entry.message : entry;
     if (!msg || typeof msg !== 'object') continue;
@@ -127,15 +143,30 @@ function normalizeContinueRecord(raw) {
 }
 
 // --- Cline / Roo Code: VS Code globalStorage .../tasks/<id>/api_conversation_history.json ---
-// One JSON array of Anthropic messages (role/content); no cwd and no timestamp in this file
-// (ui_messages.json has ts) → cwd/time attribution absent. Emits only real user turns.
 function normalizeClineRecord(raw) {
   if (!raw || typeof raw !== 'object') return null;
+  if (str(raw.role) === 'assistant') return clinePlanningTurn(raw.content);
   if (str(raw.role) !== 'user') return null;
   const text = typeof raw.content === 'string' ? raw.content.trim() : textFromParts(raw.content);
   return text ? oneUser(text, null, null) : null;
 }
 
+const CLINE_PLANNING_TAG = /<(plan_mode_respond|update_todo_list)>/g;
+
+function clinePlanningTurn(content) {
+  const blocks = typeof content === 'string' ? [{ type: 'text', text: content }] : (Array.isArray(content) ? content : []);
+  const calls = [];
+  for (const b of blocks) {
+    if (!b || typeof b !== 'object') continue;
+    if (b.type === 'tool_use') calls.push(toolUse(b.name));
+    else if (b.type === 'text' && typeof b.text === 'string') {
+      for (const m of b.text.matchAll(CLINE_PLANNING_TAG)) calls.push(toolUse(m[1]));
+    }
+  }
+  const uses = calls.filter(Boolean);
+  return uses.length ? { message: { role: 'assistant', content: uses } } : null;
+}
+
 // --- Aider: per-repo .aider.chat.history.md (markdown) ---
 // Repo-level source → cwd is the repo toplevel (good attribution). Markdown parse:
 // '# aider chat started at <ts>' sets the session time; '#### <text>' lines are user
@@ -158,6 +189,78 @@ function parseAiderHistory(text, cwd) {
   return out;
 }
 
+function normalizeClineSessionRecord(raw) {
+  if (!raw || typeof raw !== 'object' || !Array.isArray(raw.messages)) return null;
+  const out = [];
+  for (const m of raw.messages) {
+    if (!m || typeof m !== 'object') continue;
+    const ts = Number.isFinite(m.ts) ? new Date(m.ts).toISOString() : null;
+    if (str(m.role) === 'user') {
+      const text = textFromParts((Array.isArray(m.content) ? m.content : []).filter((b) => b && b.type === 'text'));
+      if (text) out.push(oneUser(text, null, ts));
+      continue;
+    }
+    if (str(m.role) !== 'assistant') continue;
+    const uses = (Array.isArray(m.content) ? m.content : []).filter((b) => b && b.type === 'tool_use').map((b) => toolUse(b.name)).filter(Boolean);
+    const o = ts ? { timestamp: ts } : {};
+    if (uses.length) o.message = { role: 'assistant', content: uses };
+    if (o.timestamp || o.message) out.push(o);
+  }
+  return out;
+}
+
+const CURSOR_QUERY = /^\s*<user_query>([\s\S]*?)<\/user_query>\s*$/;
+
+function normalizeCursorRecord(raw) {
+  if (!raw || typeof raw !== 'object' || !raw.message || !Array.isArray(raw.message.content)) return null;
+  const role = str(raw.role);
+  if (role === 'user') {
+    const text = textFromParts(raw.message.content.filter((b) => b && b.type === 'text').map((b) => {
+      const m = CURSOR_QUERY.exec(b.text || '');
+      return m ? m[1] : b.text;
+    }));
+    return text ? oneUser(text, null, null) : null;
+  }
+  if (role !== 'assistant') return null;
+  const uses = raw.message.content.filter((b) => b && b.type === 'tool_use' && str(b.name));
+  return uses.length ? { message: { role: 'assistant', content: uses } } : null;
+}
+
+function normalizePiRecord(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  const ts = str(raw.timestamp);
+  const type = str(raw.type);
+  if (type === 'session') {
+    const cwd = str(raw.cwd);
+    if (!cwd && !ts) return null;
+    const o = {};
+    if (cwd) o.cwd = cwd;
+    if (ts) o.timestamp = ts;
+    return o;
+  }
+  if (type === 'custom' && raw.customType === 'plan-mode' && raw.data && raw.data.enabled === true) {
+    return ts ? { timestamp: ts, planMode: true } : { planMode: true };
+  }
+  if (type !== 'message' || !raw.message || typeof raw.message !== 'object') return null;
+  const role = str(raw.message.role);
+  if (role === 'user') {
+    const text = textFromParts(raw.message.content);
+    return text ? oneUser(text, null, ts) : null;
+  }
+  if (role !== 'assistant') return ts ? { timestamp: ts } : null;
+  const uses = (Array.isArray(raw.message.content) ? raw.message.content : [])
+    .filter((b) => b && b.type === 'toolCall')
+    .map((b) => toolUse(b.name))
+    .filter(Boolean);
+  const o = ts ? { timestamp: ts } : {};
+  if (uses.length) o.message = { role: 'assistant', content: uses };
+  return o.timestamp || o.message ? o : null;
+}
+
+function toolUse(name) {
+  return typeof name === 'string' && name ? { type: 'tool_use', name } : null;
+}
+
 function oneUser(text, cwd, ts) {
   const o = { type: 'user', message: { role: 'user', content: [{ type: 'text', text }] } };
   if (cwd) o.cwd = cwd;
@@ -170,5 +273,8 @@ module.exports = {
   normalizeGeminiRecord,
   normalizeContinueRecord,
   normalizeClineRecord,
+  normalizeClineSessionRecord,
+  normalizeCursorRecord,
+  normalizePiRecord,
   parseAiderHistory,
 };

package/src/session-refresh.js

@@ -1,7 +1,5 @@
 'use strict';
 
-// On-demand hub-JWT minting for an email (better-auth) session.
-
 const REFRESH_MARGIN_MS = 120 * 1000;
 const REVOKED_STATUSES = new Set([401, 403]);
 
@@ -24,13 +22,13 @@ async function ensureFreshSession(env = process.env, deps = {}) {
 
   const session = loadAuthSession(env);
   if (!session) return null;
-  if (!session.cookie && !session.sessionToken) return session;
+  if (!session.sessionToken) return session;
   if (session.accessToken && jwtStillFresh(session.accessTokenExpiresAt, now, marginMs)) return session;
 
   const endpoint = getAuthTokenEndpoint(env);
   if (!endpoint) return session;
 
-  const tok = await requestAuthToken({ cookie: session.cookie, sessionToken: session.sessionToken }, { endpoint });
+  const tok = await requestAuthToken({ sessionToken: session.sessionToken }, { endpoint });
   if (!tok.ok && REVOKED_STATUSES.has(tok.status)) {
     clearAuthSession(env);
     return null;
@@ -44,7 +42,7 @@ async function ensureFreshSession(env = process.env, deps = {}) {
         accessToken: tok.accessToken,
         hubAccessToken: tok.accessToken,
         accessTokenExpiresAt: tok.expiresAt,
-        cookieExpiresAt: session.expiresAt,
+        sessionExpiresAt: session.expiresAt,
       },
       env,
     );
@@ -54,25 +52,16 @@ async function ensureFreshSession(env = process.env, deps = {}) {
   return loadAuthSession(env);
 }
 
-function webOrigin(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return null;
-  }
-}
-
 async function endSession(env = process.env, deps = {}) {
   const {
     loadAuthSession = require('./auth-session-store').loadAuthSession,
     clearAuthSession = require('./auth-session-store').clearAuthSession,
     getSignOutEndpoint = require('./config').getSignOutEndpoint,
-    getTalentProfileUrl = require('./config').getTalentProfileUrl,
     requestSignOut = require('./auth-client').requestSignOut,
   } = deps;
   const session = loadAuthSession(env);
-  if (session && (session.sessionToken || session.cookie)) {
-    await requestSignOut({ cookie: session.cookie, sessionToken: session.sessionToken }, { endpoint: getSignOutEndpoint(env), origin: webOrigin(getTalentProfileUrl(env)) });
+  if (session && session.sessionToken) {
+    await requestSignOut({ sessionToken: session.sessionToken }, { endpoint: getSignOutEndpoint(env) });
   }
   clearAuthSession(env);
   return session !== null;