shakers-cli 0.16.0 → 0.18.0

package/src/auth-client.js

@@ -1,15 +1,9 @@
 'use strict';
 
-const { postJsonWithTimeout, extractSetCookie } = require('./backend-request');
-
-// Login / token acquisition against the Hub's better-auth email engine.
+const { postJsonWithTimeout } = require('./backend-request');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 const SIGN_OUT_TIMEOUT_MS = 3000;
-const SESSION_COOKIE_NAME = 'better-auth.session_token';
-// Refresh the cookie session's own validity from the Set-Cookie Max-Age; fall
-// back to 7 days (better-auth's default) when the attribute is absent.
-const DEFAULT_COOKIE_TTL_SECONDS = 7 * 24 * 60 * 60;
 
 function parseJson(raw) {
   try { return raw ? JSON.parse(raw) : null; } catch { return null; }
@@ -28,71 +22,10 @@ function expiresAtFromJwt(token) {
   }
 }
 
-// ISO expiry for the session cookie, read from the Set-Cookie `Max-Age` (or
-// `Expires`) of the named cookie; defaults to +7 days when neither is present.
-function cookieExpiresAtFromHeaders(headers, name = SESSION_COOKIE_NAME) {
-  const raw = headers && headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  // Match the base name with or without better-auth's HTTPS `__Secure-`/`__Host-` prefixes.
-  const names = [name, `__Secure-${name}`, `__Host-${name}`];
-  const entry = list.find((e) => typeof e === 'string' && names.some((n) => e.startsWith(`${n}=`)));
-  if (entry) {
-    const maxAge = /(?:^|;\s*)max-age=(\d+)/i.exec(entry);
-    if (maxAge) return new Date(Date.now() + Number(maxAge[1]) * 1000).toISOString();
-    const expires = /(?:^|;\s*)expires=([^;]+)/i.exec(entry);
-    if (expires) {
-      const t = Date.parse(expires[1]);
-      if (Number.isFinite(t)) return new Date(t).toISOString();
-    }
-  }
-  return new Date(Date.now() + DEFAULT_COOKIE_TTL_SECONDS * 1000).toISOString();
-}
-
-function normalizeResponse(status, raw) {
-  if (status >= 200 && status < 300) {
-    let json = null;
-    try { json = raw ? JSON.parse(raw) : null; } catch { json = null; }
-    const payload = json && typeof json.data === 'object' && json.data !== null ? json.data : json;
-    const accessToken = payload && typeof payload.accessToken === 'string' && payload.accessToken ? payload.accessToken : null;
-    if (!accessToken) return { ok: false, reason: 'bad-response', status };
-    const expiresAt = payload && typeof payload.expiresAt === 'string' && payload.expiresAt ? payload.expiresAt : null;
-    const emailRaw = payload && (payload.userEmail || payload.email);
-    const email = typeof emailRaw === 'string' && emailRaw ? emailRaw : null;
-    const hubAccessToken = payload && typeof payload.hubAccessToken === 'string' && payload.hubAccessToken ? payload.hubAccessToken : null;
-    return { ok: true, accessToken, expiresAt, email, hubAccessToken };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Maps the sign-in POST outcome to a captured cookie + email, or a named reason.
-function normalizeSignIn(status, raw, headers) {
-  if (status >= 200 && status < 300) {
-    const cookie = extractSetCookie(headers, SESSION_COOKIE_NAME);
-    if (!cookie) return { ok: false, reason: 'bad-response', status };
-    const body = parseJson(raw);
-    const user = body && typeof body === 'object' ? body.user : null;
-    const emailRaw = user && typeof user.email === 'string' ? user.email : null;
-    return {
-      ok: true,
-      cookie,
-      cookieExpiresAt: cookieExpiresAtFromHeaders(headers),
-      email: emailRaw || null,
-    };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Mints a hub JWT from a better-auth session cookie: `GET {tokenEndpoint}` with the `Cookie` header.
-async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function requestAuthToken({ sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!cookie && !sessionToken) return { ok: false, reason: 'no-cookie' };
-  const credential = cookie ? { Cookie: cookie } : { Authorization: `Bearer ${sessionToken}` };
+  if (!sessionToken) return { ok: false, reason: 'no-session-token' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   let res;
   try {
     res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, credential);
@@ -106,38 +39,9 @@ async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeo
   return { ok: true, accessToken: token, expiresAt: expiresAtFromJwt(token) };
 }
 
-// The full email login: sign-in (capture cookie) -> mint JWT.
-async function requestLogin(
-  { email, password },
-  { signInEndpoint, tokenEndpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!signInEndpoint) return { ok: false, reason: 'no-endpoint' };
-  let signIn;
-  try {
-    const { status, raw, headers } = await postJsonWithTimeout(signInEndpoint, { email, password }, timeoutMs);
-    signIn = normalizeSignIn(status, raw, headers);
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'local-error' };
-  }
-  if (!signIn.ok) return signIn;
-
-  const tok = await requestAuthToken({ cookie: signIn.cookie }, { endpoint: tokenEndpoint, timeoutMs });
-  if (!tok.ok) return { ok: false, reason: 'token-fetch-failed', status: tok.status || null };
-
-  return {
-    ok: true,
-    accessToken: tok.accessToken,
-    hubAccessToken: tok.accessToken,
-    expiresAt: tok.expiresAt,
-    email: signIn.email || (typeof email === 'string' ? email : null),
-    cookie: signIn.cookie,
-    cookieExpiresAt: signIn.cookieExpiresAt,
-  };
-}
-
-async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin = null, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
-  if (!endpoint || (!cookie && !sessionToken)) return { ok: false, reason: 'no-credential' };
-  const credential = cookie ? { Cookie: cookie, ...(origin ? { Origin: origin } : {}) } : { Authorization: `Bearer ${sessionToken}` };
+async function requestSignOut({ sessionToken } = {}, { endpoint, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
+  if (!endpoint || !sessionToken) return { ok: false, reason: 'no-credential' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   try {
     const res = await postJsonWithTimeout(endpoint, {}, timeoutMs, 'POST', null, credential);
     return { ok: res.status >= 200 && res.status < 300, status: res.status };
@@ -148,11 +52,7 @@ async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin
 
 module.exports = {
   requestSignOut,
-  requestLogin,
   requestAuthToken,
-  normalizeSignIn,
-  normalizeResponse,
   expiresAtFromJwt,
-  SESSION_COOKIE_NAME,
   DEFAULT_TIMEOUT_MS,
 };

package/src/auth-session-store.js

@@ -4,6 +4,7 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
 // `~/.config/shakers/auth-session.json` — the logged-in Talent's session.
 
@@ -88,12 +89,11 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
   const explicitHubToken = typeof session.hubAccessToken === 'string' && session.hubAccessToken ? session.hubAccessToken : null;
   const hubAccessToken = explicitHubToken || (typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null);
 
-  const cookie = typeof session.cookie === 'string' && session.cookie ? session.cookie : null;
   const sessionToken = typeof session.sessionToken === 'string' && session.sessionToken ? session.sessionToken : null;
   let expiresAt;
   let accessTokenExpiresAt;
-  if (cookie || sessionToken) {
-    expiresAt = [session.cookieExpiresAt, session.sessionExpiresAt, session.expiresAt]
+  if (sessionToken) {
+    expiresAt = [session.sessionExpiresAt, session.expiresAt]
       .find((v) => typeof v === 'string' && v) || expiresAtFromToken(session.accessToken);
     accessTokenExpiresAt = (typeof session.accessTokenExpiresAt === 'string' && session.accessTokenExpiresAt)
       ? session.accessTokenExpiresAt
@@ -108,7 +108,6 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
       accessToken: typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null,
       expiresAt: expiresAt ?? null,
       accessTokenExpiresAt: accessTokenExpiresAt ?? null,
-      cookie,
       sessionToken,
       email: (typeof session.email === 'string' && session.email ? session.email : null)
         || emailFromHubToken(hubAccessToken),
@@ -141,6 +140,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
     try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
     throw e;
   }
+  recordAccountMarker(sessionToken ? 'device' : 'token', env, { fs: fsImpl });
   return target;
 }
 
@@ -154,19 +154,16 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   }
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
   if (parsed.version !== SESSION_FILE_VERSION) return null;
-  // A usable session needs at least ONE credential: the durable cookie (email/
-  // better-auth) or a JWT (Google/legacy, or an email session whose JWT is cached).
-  const hasCookie = typeof parsed.cookie === 'string' && parsed.cookie;
   const hasToken = typeof parsed.accessToken === 'string' && parsed.accessToken;
   const sessionToken = typeof parsed.sessionToken === 'string' && parsed.sessionToken ? parsed.sessionToken : null;
-  if (!hasCookie && !hasToken && !sessionToken) return null;
+  if (typeof parsed.cookie === 'string' && parsed.cookie && !sessionToken) return null;
+  if (!hasToken && !sessionToken) return null;
   const hubAccessToken = typeof parsed.hubAccessToken === 'string' && parsed.hubAccessToken ? parsed.hubAccessToken : null;
   const email = (typeof parsed.email === 'string' && parsed.email ? parsed.email : null) || emailFromHubToken(hubAccessToken);
   return {
     accessToken: hasToken ? parsed.accessToken : null,
     expiresAt: typeof parsed.expiresAt === 'string' ? parsed.expiresAt : null,
     accessTokenExpiresAt: typeof parsed.accessTokenExpiresAt === 'string' ? parsed.accessTokenExpiresAt : null,
-    cookie: hasCookie ? parsed.cookie : null,
     sessionToken,
     email,
     hubAccessToken,
@@ -174,6 +171,10 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   };
 }
 
+function hasAuthSessionFile(env = process.env, { fs: fsImpl = fs } = {}) {
+  return fsImpl.existsSync(authSessionPath(env));
+}
+
 // Removes the file. Idempotent and never throws — `logout` on no session is a
 // no-op, not a failure.
 function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
@@ -187,8 +188,7 @@ function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
 
 // `none | active | expired`, the three states the caller needs to give the Talent a true message.
 function sessionStatus(session, now = Date.now()) {
-  // A credential is a durable cookie or session token, or a JWT (Google/legacy).
-  const hasCred = !!(session && [session.accessToken, session.cookie, session.sessionToken].some((v) => typeof v === 'string' && v));
+  const hasCred = !!(session && [session.accessToken, session.sessionToken].some((v) => typeof v === 'string' && v));
   if (!hasCred) return 'none';
   const expiry = Date.parse(String(session.expiresAt || ''));
   if (!Number.isFinite(expiry)) return 'expired';
@@ -207,6 +207,7 @@ module.exports = {
   authSessionPath,
   saveAuthSession,
   loadAuthSession,
+  hasAuthSessionFile,
   clearAuthSession,
   sessionStatus,
   isLoggedIn,

package/src/backend-request.js

@@ -71,6 +71,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';
@@ -79,8 +80,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           raw += chunk;
           if (raw.length > MAX_RESPONSE_BYTES) req.destroy();
         });
-        // `headers` is exposed so the better-auth email flow can read `Set-Cookie` (the session cookie it captures and replays); every other caller reads only `{status, raw}` and ignores it.
-        res.on('end', () => resolve({ status: res.statusCode, raw, headers: res.headers }));
+        res.on('end', () => resolve({ status: res.statusCode, raw }));
       },
     );
     req.on('timeout', () => req.destroy(Object.assign(new Error('request timed out'), { kind: 'timeout' })));
@@ -90,27 +90,6 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
   });
 }
 
-// Pulls one `name=value` cookie pair out of a response's `Set-Cookie` header (Node exposes it as an array, or a single string).
-// Accepts the base cookie name with or without the RFC6265 `__Secure-`/`__Host-`
-// prefixes that better-auth applies over HTTPS, and returns the EXACT server-set
-// name (prefix included) so it can be forwarded back verbatim in a `Cookie:` header.
-function extractSetCookie(headers, name) {
-  if (!headers) return null;
-  const raw = headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  const candidates = [name, `__Secure-${name}`, `__Host-${name}`];
-  for (const candidate of candidates) {
-    const prefix = `${candidate}=`;
-    for (const entry of list) {
-      if (typeof entry === 'string' && entry.startsWith(prefix)) {
-        const value = entry.slice(prefix.length).split(';')[0];
-        if (value) return `${candidate}=${value}`;
-      }
-    }
-  }
-  return null;
-}
-
 function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extraHeaders = null) {
   return new Promise((resolve, reject) => {
     let u;
@@ -151,6 +130,7 @@ function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extra
           ...sanitizeExtraHeaders(extraHeaders),
         },
         timeout: timeoutMs,
+        agent: false,
       },
       (res) => {
         let raw = '';
@@ -202,7 +182,6 @@ module.exports = {
   MAX_RESPONSE_BYTES,
   postJsonWithTimeout,
   postMultipartWithTimeout,
-  extractSetCookie,
   requestBackend,
   setClientIdentity,
 };

package/src/cli-skill.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const { SERVER_NAME } = require('./mcp-server-name');
+
+const CLI_SKILL_NAME = 'shakers-cli';
+
+const OWN_SKILL_NAMES = new Set([CLI_SKILL_NAME, SERVER_NAME]);
+
+const CLI_SKILL_DESCRIPTION = 'Use Shakers, the freelance talent marketplace, from the terminal through the `shakers` CLI: find, view and save projects, read the talent profile, certifications, applications and invitations, and get the link to certify a role dimension. Use when the talent wants to work with Shakers from the terminal or mentions the `shakers` command.';
+
+const BODY = `# Shakers CLI
+
+Shakers is a freelance talent marketplace. The \`shakers\` CLI acts on the talent's own account. You run it for the talent, with their permission.
+
+## Rules
+
+- Before running any command, show the talent the exact command and ask them first.
+- Run only the \`shakers\` commands listed in this skill. If \`shakers\` is not on PATH, run the same command as \`npx -y shakers-cli <command>\`.
+- Install only the official npm package \`shakers-cli\`. Never install a package with a similar name.
+- Never run \`shakers update\` without \`--check\` unless the talent explicitly asks to update.
+- Put the command name first (\`shakers me --json\`, not \`shakers --json me\`).
+- Prefer \`--json\` and read ids from the JSON. Never pass the \`N)\` numbers of a printed list: a number refers to the last human listing, not to your JSON.
+- If the Shakers MCP server tools are available in this session and the talent did not ask for the terminal, use those tools instead of this skill.
+
+## Not logged in
+
+A command that needs a session exits 1 and prints on stderr that it requires an active session. Do not try to log in for the talent. Tell them to run \`shakers login\` in their own terminal, then retry the command.
+
+Without \`--json\`, each command first prints on stderr one line saying what Shakers does on this computer and in the account (what it reads, changes or sends). Relay that line to the talent word for word.
+
+## Commands you may run
+
+Projects:
+- \`shakers find-projects --json [--page N] [--limit N] [--tab all|saved] [--attendance remote|hybrid|in-person] [--country ES] [--recommended]\`: projects available to the talent. The id of each item is \`items[].positionId\`.
+- \`shakers show-project <positionId> --json\`: detail of one project.
+- \`shakers save-project <positionId> --json\` and \`shakers unsave-project <positionId> --json\`: add or remove a saved project.
+- \`shakers applications --json\`: projects the talent applied to and their status (\`items[].positionId\`).
+- \`shakers invitations --json\`: the talent's unread project invitations.
+
+Profile (read only):
+- \`shakers me --json\`: profile summary.
+- \`shakers rate --json\`, \`shakers availability --json\`, \`shakers lang --json\`, \`shakers socials --json\`.
+- \`shakers experiences --json\`, \`shakers portfolios --json\`.
+
+Certifications:
+- \`shakers certifications --json\`: certified, uncertified and expired dimensions.
+- \`shakers certify --dimension <key>\`: only when the talent named the dimension. It prints a link; the interview happens on the web. Show the talent the link. It has no \`--json\`.
+
+Account:
+- \`shakers config list\` and \`shakers config get <key>\`: read the CLI configuration.
+- \`shakers update --check --json\`: tells whether a newer version exists. Installs nothing.
+- \`shakers logout\`: only when the talent asks to sign out.
+
+## Hand these to the talent
+
+Never run these yourself. They need the talent at their own keyboard: they ask for consent, reviews or choices, and \`login\` and \`register\` open a Shakers page on shakersworks.com with a code the talent checks and approves (the password is typed only there, never in a terminal). Tell the talent the exact command to run in their own terminal, or point them to the web (https://www.shakersworks.com) or the Shakers MCP server.
+
+- \`shakers register\` and \`shakers onboarding\`: sign-up and the onboarding interview.
+- \`shakers login\`.
+- \`shakers ai-usage\`: the AI-usage analysis and upload. The talent gives consent and reviews what is sent.
+- Profile changes: \`shakers rate --set\`, \`shakers availability --set\`, \`shakers lang --set\`, \`shakers socials --set\`.
+- \`shakers add-agent\`, \`shakers add-skill\`, \`shakers add-project\`, \`shakers add-role\`, \`shakers change-role\`.
+- \`shakers config set\`.
+`;
+
+function cliSkill() {
+  return [
+    '---',
+    `name: ${CLI_SKILL_NAME}`,
+    `description: ${JSON.stringify(CLI_SKILL_DESCRIPTION)}`,
+    '---',
+    '',
+    BODY,
+  ].join('\n');
+}
+
+module.exports = { cliSkill, CLI_SKILL_NAME, OWN_SKILL_NAMES };

package/src/command-audit.js

@@ -1,7 +1,9 @@
 'use strict';
 
+const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
+const { spawn } = require('child_process');
 const { scrubSecrets } = require('./agent-synthesis');
 const { loadAuthSession, decodeJwtPayload } = require('./auth-session-store');
 const { getCertsBase } = require('./config');
@@ -13,6 +15,13 @@ const AUDIT_TIMEOUT_MS = 1500;
 // Capped at 200 chars AFTER scrubbing (mirrors MAX_COMMAND_LEN in session-scan.js) so a secret straddling the cut cannot leak.
 const MAX_ARGS_LEN = 200;
 
+const WORKER = path.join(__dirname, '..', 'bin', 'command-audit-worker.js');
+const PAYLOAD_VAR = 'SHAKERS_CLI_AUDIT_PAYLOAD';
+
+function auditDisabled(env) {
+  return !!env && env.SHAKERS_CLI_NO_AUDIT === '1';
+}
+
 function cliVersion() {
   try {
     return require(path.join(__dirname, '..', 'package.json')).version || null;
@@ -52,7 +61,7 @@ function jwtExpired(token, now) {
 }
 
 // Builds the record + headers; returns null when there is no endpoint to post to.
-function buildAudit(command, argv, env) {
+function buildAudit(command, argv, env, id = null) {
   let base;
   try {
     base = getCertsBase(env);
@@ -66,6 +75,7 @@ function buildAudit(command, argv, env) {
   const token = stored && !jwtExpired(stored, Date.now()) ? stored : null;
 
   const body = {
+    ...(id ? { id } : {}),
     command: String(command || 'unknown').slice(0, 100),
     args: redactArgs(argv),
     cliVersion: cliVersion(),
@@ -85,9 +95,10 @@ function buildAudit(command, argv, env) {
 }
 
 // Emits ONE fire-and-forget audit record; never throws or rejects. Returns the `.catch`-guarded promise so tests can await it (production does not).
-function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
+function emitCommandAudit({ command, argv = [], env = process.env, id = null } = {}) {
   try {
-    const audit = buildAudit(command, argv, env);
+    if (auditDisabled(env)) return Promise.resolve();
+    const audit = buildAudit(command, argv, env, id);
     if (!audit) return Promise.resolve();
     return postJsonWithTimeout(
       audit.endpoint,
@@ -105,4 +116,36 @@ function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
   }
 }
 
-module.exports = { emitCommandAudit, redactArgs, buildAudit };
+async function logCommandRun({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  await emitCommandAudit({ command, argv, env, id });
+  return id;
+}
+
+let runId = null;
+
+function startCommandAudit({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  try {
+    const child = spawn(process.execPath, [WORKER], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+      env: { ...env, [PAYLOAD_VAR]: JSON.stringify({ id, command, args: redactArgs(argv) }) },
+    });
+    child.on('error', () => {});
+    child.unref();
+  } catch {
+    return null;
+  }
+  runId = id;
+  return id;
+}
+
+function currentRunId() {
+  return runId;
+}
+
+module.exports = { emitCommandAudit, startCommandAudit, logCommandRun, currentRunId, redactArgs, buildAudit, PAYLOAD_VAR };

package/src/config.js

@@ -4,6 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { readEnv } = require('./env-paths');
 const { getConfigDir } = require('./config-dir');
+const { recordAccountMarker } = require('./account-marker');
 
 // Persistent CLI config file.
 function configDir(env = process.env) {
@@ -299,14 +300,6 @@ function getAgentEvaluationEndpoint(env = process.env) {
   return deriveFromIngest(env, 'agent-evaluation');
 }
 
-// Login endpoint — better-auth email sign-in: `POST {hubBase}/auth/sign-in/email` with `{email,password}`.
-function getLoginEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'LOGIN_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-in/email');
-}
-
-// better-auth JWT endpoint: `GET {hubBase}/auth/token` with the session cookie → `{token}` (ES256/JWKS, ~15-min TTL).
 function getSignOutEndpoint(env = process.env) {
   return deriveFromHub(env, 'auth/sign-out');
 }
@@ -588,12 +581,6 @@ function deriveFromHub(env, relativePath) {
   return `${base}/${relativePath}`;
 }
 
-function getSignUpEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'SIGNUP_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-up/email');
-}
-
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -815,6 +802,7 @@ function saveSuperadminSession(session, env = process.env) {
     expiresAt: session.expiresAt || null,
   };
   saveConfigFile(config, env);
+  recordAccountMarker('superadmin', env);
 }
 
 function clearSuperadminSession(env = process.env) {
@@ -830,7 +818,6 @@ module.exports = {
   getSynthesisEndpoint,
   getRoadmapEndpoint,
   getAgentEvaluationEndpoint,
-  getLoginEndpoint,
   getAuthTokenEndpoint,
   getSignOutEndpoint,
   getCompleteRegistrationEndpoint,
@@ -882,7 +869,6 @@ module.exports = {
   getCertsBase,
   getHubBase,
   sanitizeStaleBakedEndpoints,
-  getSignUpEndpoint,
   getImportProfileEndpoint,
   getMcpSignupEndpoint,
   getMyImportStatusEndpoint,

package/src/consent-flow.js

@@ -15,10 +15,14 @@ const MAX_ATTEMPTS = 5;
 const YES_RE = /^(y|yes|s|si|sí)$/i;
 const NO_RE = /^(n|no)$/i;
 
-async function askYesNo(ask, question, catalog, { defaultNo = false } = {}) {
+const UNANSWERED = Symbol('unanswered');
+
+async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false, blankUnanswered = false } = {}) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     const raw = String(await ask(question)).trim();
+    if (blankUnanswered && raw === '') return UNANSWERED;
     if (defaultNo && raw === '') return false;
+    if (defaultYes && raw === '') return true;
     if (YES_RE.test(raw)) return true;
     if (NO_RE.test(raw)) return false;
     process.stdout.write(`  ${catalog.consent.invalidAnswer}\n`);
@@ -55,6 +59,7 @@ async function runConsentPrompt({
   sessionEmail = null,
   drainBeforeAsk = false,
   profile = 'talent',
+  requireExplicitAnswer = false,
 }) {
   const c = catalog.consent;
   // Presentation only: framed by src/legal-notice.js on a
@@ -68,7 +73,8 @@ async function runConsentPrompt({
   }
 
   // defaultNo: a blank Enter means "do not save" (legal requirement).
-  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: true });
+  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: !requireExplicitAnswer, blankUnanswered: requireExplicitAnswer });
+  if (accepted === UNANSWERED) return 'unanswered';
   if (accepted === null) {
     process.stdout.write(`  ${c.notObtained}\n\n`);
     return null;
@@ -112,4 +118,4 @@ async function runConsentPrompt({
   return null;
 }
 
-module.exports = { runConsentPrompt, defaultVerifyEmail };
+module.exports = { runConsentPrompt, defaultVerifyEmail, askYesNo };

package/src/detect-repos.js

@@ -2,12 +2,7 @@
 
 const { execFileSync } = require('child_process');
 const path = require('path');
-const {
-  toolSources,
-  listSessionFiles,
-  readSessionObjects,
-  resolveFileCwd,
-} = require('./session-scan');
+const { toolSources, sourceSessions, resolveFileCwd } = require('./session-scan');
 const { normalizeRemote } = require('./authorship');
 
 const GIT_TIMEOUT_MS = 15000;
@@ -37,8 +32,9 @@ function sessionCwdCounts(env = process.env) {
   const counts = new Map();
   let unassigned = 0;
   for (const source of toolSources(env)) {
-    for (const file of listSessionFiles(source.dir)) {
-      const cwd = resolveFileCwd(readSessionObjects(file));
+    if (source.repoLevel) continue;
+    for (const { objects } of sourceSessions(source)) {
+      const cwd = resolveFileCwd(objects);
       if (cwd === null) {
         unassigned += 1;
         continue;

package/src/detectors.js

@@ -115,6 +115,29 @@ const detectors = [
       { type: 'bin', name: 'codex' },
     ],
   },
+  {
+    id: 'pi',
+    name: 'Pi',
+    vendor: 'Earendil Works',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.pi' },
+      { type: 'homePath', path: '.pi/agent' },
+    ],
+  },
+  {
+    id: 'opencode',
+    name: 'OpenCode',
+    vendor: 'OpenCode',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: 'opencode.json' },
+      { type: 'projectPath', path: '.opencode' },
+      { type: 'homePath', path: '.config/opencode' },
+      { type: 'homePath', path: '.local/share/opencode' },
+      { type: 'bin', name: 'opencode' },
+    ],
+  },
   {
     id: 'cody',
     name: 'Cody',

package/src/device-auth-store.js

@@ -26,7 +26,7 @@ function savePendingDevice(pending, env = process.env, { fs: fsImpl = fs } = {})
       interval: typeof pending.interval === 'number' && pending.interval > 0 ? Math.floor(pending.interval) : 5,
       expiresAt: typeof pending.expiresAt === 'string' && pending.expiresAt ? pending.expiresAt : null,
       mode: pending.mode === 'register' ? 'register' : 'login',
-      provider: pending.provider === 'linkedin' ? 'linkedin' : 'google',
+      provider: pending.provider === 'linkedin' || pending.provider === 'email' ? pending.provider : 'google',
       registerContext: pending.registerContext && typeof pending.registerContext === 'object' ? pending.registerContext : null,
       email: typeof pending.email === 'string' && pending.email ? pending.email : null,
       version: DEVICE_FILE_VERSION,
@@ -75,7 +75,7 @@ function loadPendingDevice(env = process.env, { fs: fsImpl = fs } = {}) {
     interval: typeof parsed.interval === 'number' && parsed.interval > 0 ? Math.floor(parsed.interval) : 5,
     expiresAt: typeof parsed.expiresAt === 'string' && parsed.expiresAt ? parsed.expiresAt : null,
     mode: parsed.mode === 'register' ? 'register' : 'login',
-    provider: parsed.provider === 'linkedin' ? 'linkedin' : 'google',
+    provider: parsed.provider === 'linkedin' || parsed.provider === 'email' ? parsed.provider : 'google',
     registerContext: parsed.registerContext && typeof parsed.registerContext === 'object' ? parsed.registerContext : null,
     email: typeof parsed.email === 'string' && parsed.email ? parsed.email : null,
   };