shakers-cli 0.16.0 → 0.18.0

package/src/mcp-choice.js

@@ -1,8 +1,16 @@
 'use strict';
 
-// Closed questions of the MCP sign-up: a dialog when the client can elicit, otherwise one block the model prints, question last.
+const { signupCopy, legalCopy, termsText } = require('./signup-copy');
+const { CHOICE_RULE, QUESTION_RULE, OPEN_RULE, nextSayRule } = require('./mcp-instructions');
 
-const SAY_MESSAGE = 'Print `say` word for word as your whole reply: it already holds the texts, the question and its options as a list. Present them as a choice and pass back the exact label the talent picks, never a number; add nothing of your own and call no tool until the talent answers.';
+// Closed questions of the MCP sign-up: a dialog when the client can elicit; otherwise a step whose text the model
+// already wrote (handed over one answer earlier as `nextSay`) goes to the chat's question tool as `question` and
+// `options`, and a step whose text only exists now hands it over whole as `say`, the question and its options numbered
+// at its end, and the talent answers by typing.
+
+const CHOICE_MESSAGE = CHOICE_RULE;
+const QUESTION_ONLY_MESSAGE = `${QUESTION_RULE} Call no other tool until the talent answers, and pass back the option they pick (or what they type).`;
+const OPEN_MESSAGE = OPEN_RULE;
 
 // Fixed texts that are not a question ride on the next question block: a model skips a standalone relay.
 const notices = [];
@@ -15,55 +23,136 @@ function takeNotices() {
   return notices.splice(0);
 }
 
-// Fixed texts travel with their question, so a model that skips "show this first" still shows them.
-function sayBlock(texts, question, options) {
-  return [...texts, question, options.map((o) => `- ${o}`).join('\n')].join('\n\n');
+// Texts handed to the model before the turn whose question they belong to: it writes them first in that turn, before
+// any call, the only place a client shows them above its question tool. Each one keeps the question it was handed with
+// (`from`) and the picks that lead to it, and counts as written only once the talent made one of those picks.
+let handed = [];
+
+function handOver(from, { step, ifAnswer, texts }) {
+  const text = texts.join('\n\n');
+  handed = [...handed.filter((h) => h.text !== text), { text, from, ifAnswer, picked: false }];
+  return { step, ifAnswer, text };
+}
+
+// The talent answered `from` with `picked`: a text handed for that pick was written, one for another pick was not.
+function settle(from, picked) {
+  handed = handed
+    .filter((h) => h.from !== from || h.ifAnswer.includes(picked))
+    .map((h) => (h.from === from ? { ...h, picked: true } : h));
+}
+
+// Whether the model wrote this text at the start of the talent's turn.
+function written(text) {
+  return handed.some((h) => h.picked && h.text === text);
+}
+
+// The next question the model asks closes the turn the handed texts were written in: they cover that question only.
+function closeTurn() {
+  handed = [];
 }
 
-function chatChoice(question, options, texts = []) {
-  return { say: sayBlock([...takeNotices(), ...texts], question, options), options, choiceMessage: SAY_MESSAGE };
+// A reply that hands over the next step's text, with what the model does with it; a list when two answers lead to two texts.
+function withNextSay(reply, nextSay) {
+  if (!nextSay) return reply;
+  if (!Array.isArray(nextSay)) return { ...reply, nextSay, message: `${reply.message} ${nextSayRule(nextSay.ifAnswer)}` };
+  const rules = nextSay.map((n, i) => nextSayRule(n.ifAnswer, `nextSay[${i}].text`));
+  return { ...reply, nextSay, message: [reply.message, ...rules].join(' ') };
 }
 
-// The option an answer names: by its label, or by a position number if the talent still types one.
+const numbered = (items) => items.map((item, i) => `${i + 1}. ${item}`).join('\n');
+
+// What the talent has not read yet goes first, then the question and its options numbered; with `listed`, each option
+// is numbered with its own block, the texts after the list follow it and the question comes last. A question whose
+// texts the model already wrote goes alone to the question tool.
+function chatChoice(question, options, texts = [], listed = null, queued = takeNotices()) {
+  const fresh = (blocks) => (blocks.length && written(blocks.join('\n\n')) ? [] : blocks);
+  const own = [...new Set([...fresh(queued), ...fresh(texts)])];
+  closeTurn();
+  if (!own.length && !listed) return { question, options, choiceMessage: QUESTION_ONLY_MESSAGE };
+  const body = listed ? [...listed.blocks.map((block, i) => `${i + 1}. ${block}`), ...listed.after, question] : [question, numbered(options)];
+  return { say: [...own, ...body].join('\n\n'), choiceMessage: CHOICE_MESSAGE };
+}
+
+// What the talent reads or picks from a chat question; its rule travels in the reply's `message`.
+const forChat = ({ choiceMessage: _rule, ...chat }) => chat;
+
+// An open question: the step's text ends with what the talent answers by typing, so it is all `say`.
+function openQuestion(text) {
+  closeTurn();
+  return { say: [...takeNotices(), text].join('\n\n'), message: OPEN_MESSAGE };
+}
+
+const plain = (text) => text.normalize('NFD').replace(/\p{M}/gu, '').toLowerCase().replace(/[^\p{L}\p{N}]+/gu, ' ').trim();
+const NUMBERED = /^(?:(?:opcion|opcao|opzione|option|numero|number|la|el|the)\s+)?(\d+)(?:\s+(.*))?$/;
+
+// The option an answer names: its label, its number, or the talent's own words when they point at one option only:
+// the start of its label, its whole label inside them, or its first word ("si", "no", "backend").
 function optionFor(answer, options) {
   if (typeof answer !== 'string') return null;
-  const text = answer.trim();
-  if (options.includes(text)) return text;
-  const n = /^\d+$/.test(text) ? Number(text) : 0;
-  return n >= 1 && n <= options.length ? options[n - 1] : null;
+  if (options.includes(answer.trim())) return answer.trim();
+  const said = plain(answer);
+  if (!said) return null;
+  const labels = options.map(plain);
+  const n = NUMBERED.exec(said);
+  if (n) {
+    const label = labels[Number(n[1]) - 1];
+    return label !== undefined && (!n[2] || label.startsWith(n[2])) ? options[Number(n[1]) - 1] : null;
+  }
+  const first = (text) => text.split(' ')[0];
+  const readings = [(l) => l === said, (l) => l.startsWith(`${said} `), (l) => ` ${said} `.includes(` ${l} `), (l) => first(l) === first(said)];
+  for (const reads of readings) {
+    const hits = options.filter((_, i) => reads(labels[i]));
+    if (hits.length) return hits.length === 1 ? hits[0] : null;
+  }
+  return null;
+}
+
+function narrationOf(ctx) {
+  return ctx && typeof ctx.narration === 'string' && ctx.narration ? [ctx.narration] : [];
 }
 
 // { answer } from the dialog, { dismissed: <action> } when the talent closed it, or { chat } when there is no dialog.
-async function askChoice(ctx, { texts: own = [], question, options }) {
-  const texts = [...takeNotices(), ...own];
+async function askChoice(ctx, { texts: own = [], question, options, listed = null }) {
+  const queued = takeNotices();
   const elicit = ctx && typeof ctx.elicit === 'function' ? ctx.elicit : null;
   const reply = elicit
     ? await elicit({
-      message: [...texts, question].join('\n\n'),
+      message: [...narrationOf(ctx), ...queued, ...own, ...(listed ? [...listed.blocks, ...listed.after] : []), question].join('\n\n'),
       requestedSchema: { type: 'object', properties: { choice: { type: 'string', title: question, enum: options } }, required: ['choice'] },
     })
     : null;
-  if (!reply) return { chat: chatChoice(question, options, texts) };
+  if (!reply) return { chat: chatChoice(question, options, own, listed, queued) };
   const choice = reply.action === 'accept' && reply.content ? reply.content.choice : undefined;
   if (options.includes(choice)) return { answer: choice };
-  return { dismissed: reply.action, chat: chatChoice(question, options, texts) };
+  return { dismissed: reply.action, chat: chatChoice(question, options, own, listed, queued) };
 }
 
+// The steps whose text went to the chat, keyed by what their answer decides (`about`, the texts by default): an answer
+// counts only after its text was handed over, so the model cannot confirm a draft the talent never read.
+const shownTexts = new Set();
+
 // A closed question after fixed texts: the chat answer the model passed back, else the dialog, else the block to print.
-async function askAfterTexts(ctx, { tool, texts, question, options, answer }) {
-  const picked = optionFor(answer, options);
-  if (picked) return { answer: picked };
-  const asked = ctx && ctx.elicitation ? await askChoice(ctx, { texts, question, options }) : { chat: chatChoice(question, options, texts) };
+async function askAfterTexts(ctx, { tool, texts, question, options, answer, listed = null, about = texts, nextSay = null }) {
+  const withText = texts.length > 0 || !!listed;
+  const key = JSON.stringify([tool, question, options, about]);
+  const picked = withText && !shownTexts.has(key) ? null : optionFor(answer, options);
+  if (picked) {
+    shownTexts.delete(key);
+    settle(key, picked);
+    return { answer: picked };
+  }
+  const asked = ctx && ctx.elicitation ? await askChoice(ctx, { texts, question, options, listed }) : { chat: chatChoice(question, options, texts, listed) };
   if (asked.answer) return { answer: asked.answer };
-  return {
-    reply: {
-      ok: false,
-      reason: 'answer-required',
-      ...(asked.dismissed ? { dismissed: asked.dismissed } : {}),
-      ...asked.chat,
-      message: `${asked.chat.choiceMessage} Then call ${tool} again with answer set to the option they pick.`,
-    },
+  if (withText) shownTexts.add(key);
+  const reply = {
+    ok: false,
+    reason: 'answer-required',
+    ...(asked.dismissed ? { dismissed: asked.dismissed } : {}),
+    ...forChat(asked.chat),
+    message: `${asked.chat.choiceMessage} Then call ${tool} again with answer = what the talent answers: the number, the option or their own words.`,
   };
+  const handed = Array.isArray(nextSay) ? nextSay.map((n) => handOver(key, n)) : nextSay && handOver(key, nextSay);
+  return { reply: nextSay ? withNextSay(reply, handed) : reply };
 }
 
 // Questions this process put to the talent in the chat, keyed by exactly what they would allow:
@@ -71,14 +160,14 @@ async function askAfterTexts(ctx, { tool, texts, question, options, answer }) {
 const pendingConsent = new Set();
 
 // The talent's yes or no before a tool reads this computer or sends data: { granted } or { reply } to return.
-async function askConsent(ctx, { tool, key, question, yes, no, answer }) {
+async function askConsent(ctx, { tool, key, texts = [], question, yes, no, answer, field = 'answer' }) {
   const options = [yes, no];
   const picked = pendingConsent.has(key) ? optionFor(answer, options) : null;
   if (picked) {
     pendingConsent.delete(key);
     return { granted: picked === yes };
   }
-  const asked = ctx && ctx.elicitation ? await askChoice(ctx, { question, options }) : { chat: chatChoice(question, options) };
+  const asked = ctx && ctx.elicitation ? await askChoice(ctx, { texts, question, options }) : { chat: chatChoice(question, options, texts) };
   if (asked.answer) return { granted: asked.answer === yes };
   pendingConsent.add(key);
   return {
@@ -86,10 +175,58 @@ async function askConsent(ctx, { tool, key, question, yes, no, answer }) {
       ok: false,
       reason: 'consent-required',
       ...(asked.dismissed ? { dismissed: asked.dismissed } : {}),
-      ...asked.chat,
-      message: `Nothing was read or sent. ${asked.chat.choiceMessage} Then call ${tool} again with the same arguments and answer set to the option they pick.`,
+      ...forChat(asked.chat),
+      message: `Nothing was read or sent. ${asked.chat.choiceMessage} Then call ${tool} again with the same arguments and ${field} = what the talent answers: the number, the option or their own words.`,
     },
   };
 }
 
-module.exports = { askConsent, askChoice, askAfterTexts, chatChoice, optionFor, queueNotice, takeNotices, SAY_MESSAGE };
+const termsAccepted = new Set();
+
+// The terms block the terms question carries, with its links: the sign-up hands the same text over one answer early.
+function registrationTermsText(lang) {
+  return termsText(lang, (label, url) => `[${label}](${url})`);
+}
+
+async function askRegistrationTerms(ctx, { tool, lang, termsAnswer, newsletterAnswer }) {
+  const c = signupCopy(lang);
+  if (!termsAccepted.has(tool)) {
+    const terms = await askConsent(ctx, {
+      tool,
+      key: `${tool}:terms`,
+      field: 'termsAnswer',
+      texts: [registrationTermsText(lang)],
+      question: c.termsQuestion,
+      yes: c.termsAccept,
+      no: c.termsDecline,
+      answer: termsAnswer,
+    });
+    if (terms.reply) return { reply: terms.reply };
+    if (!terms.granted) return { declined: true };
+    termsAccepted.add(tool);
+  }
+  const newsletter = legalCopy(lang).newsletter;
+  const news = await askConsent(ctx, {
+    tool,
+    key: `${tool}:newsletter`,
+    field: 'newsletterAnswer',
+    question: c.newsletterQuestion,
+    yes: newsletter,
+    no: c.newsletterNo,
+    answer: newsletterAnswer,
+  });
+  if (news.reply) return { reply: news.reply };
+  termsAccepted.delete(tool);
+  return { newsletterConsent: news.granted };
+}
+
+// A new sign-up in the same process starts with nothing queued, shown or asked.
+function resetQuestions() {
+  takeNotices();
+  handed = [];
+  shownTexts.clear();
+  pendingConsent.clear();
+  termsAccepted.clear();
+}
+
+module.exports = { askConsent, askChoice, askAfterTexts, askRegistrationTerms, registrationTermsText, narrationOf, chatChoice, forChat, openQuestion, optionFor, queueNotice, takeNotices, handOver, settle, withNextSay, written, resetQuestions, CHOICE_RULE, CHOICE_MESSAGE, QUESTION_ONLY_MESSAGE, OPEN_MESSAGE };

package/src/mcp-detector.js

@@ -2,7 +2,8 @@
 
 const fs = require('fs');
 const path = require('path');
-const { getHomeDir } = require('./env-paths');
+const { getHomeDir, codexHome, piAgentDir } = require('./env-paths');
+const { OWN_MCP_SERVER_NAMES } = require('./mcp-server-name');
 
 // KEYWORD -> { SERVICE LABEL, CATEGORY }.
 const SERVICE_CATALOG = [
@@ -100,6 +101,11 @@ const MCP_CONFIG_LOCATIONS = [
   // --- Gemini CLI: home was read; the project-level settings file was not ---
   { tool: 'gemini-cli', scope: 'home', keys: ['mcpServers'], confidence: 'medium', file: (root, home) => path.join(home, '.gemini', 'settings.json') },
   { tool: 'gemini-cli', scope: 'project', keys: ['mcpServers'], confidence: 'medium', file: (root) => path.join(root, '.gemini', 'settings.json') },
+  { tool: 'codex-cli', scope: 'home', read: readTomlMcpServerNames, confidence: 'high', file: () => path.join(codexHome(), 'config.toml') },
+  { tool: 'pi', scope: 'home', keys: ['mcpServers'], confidence: 'high', file: () => path.join(piAgentDir(), 'mcp.json') },
+  { tool: 'pi', scope: 'project', keys: ['mcpServers'], confidence: 'high', file: (root) => path.join(root, '.pi', 'mcp.json') },
+  { tool: 'opencode', scope: 'home', keys: ['mcp'], confidence: 'medium', file: (root, home) => path.join(home, '.config', 'opencode', 'opencode.json') },
+  { tool: 'opencode', scope: 'project', keys: ['mcp'], confidence: 'medium', file: (root) => path.join(root, 'opencode.json') },
   // VS Code: `servers`, not `mcpServers`, and three OS-specific user paths.
   { tool: null, scope: 'project', keys: ['servers', 'mcpServers'], confidence: 'medium', file: (root) => path.join(root, '.vscode', 'mcp.json') },
   { tool: null, scope: 'home', keys: ['servers', 'mcpServers'], confidence: 'medium', file: (root, home) => path.join(home, 'Library', 'Application Support', 'Code', 'User', 'mcp.json') },
@@ -134,6 +140,23 @@ function readMcpServerNames(file, keys = ['mcpServers']) {
   return [];
 }
 
+const TOML_MCP_TABLE = /^\s*\[\s*mcp_servers\.(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))/;
+
+function readTomlMcpServerNames(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return [];
+  }
+  const names = new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    const m = TOML_MCP_TABLE.exec(line);
+    if (m) names.add(m[1] || m[2] || m[3]);
+  }
+  return [...names];
+}
+
 // Deterministic (no-LLM) MCP-by-name detection over every location in `MCP_CONFIG_LOCATIONS` (project ∪ home).
 function detectMcpServers(root) {
   const home = getHomeDir();
@@ -148,7 +171,7 @@ function detectMcpServers(root) {
     } catch {
       continue; // an unresolvable home never breaks the other locations
     }
-    const names = readMcpServerNames(file, loc.keys);
+    const names = (loc.read ? loc.read(file) : readMcpServerNames(file, loc.keys)).filter((n) => !OWN_MCP_SERVER_NAMES.has(n));
     if (loc.tool && names.length) {
       // Per-tool count is the union across THAT tool's own locations, so a
       // server configured both in the project and globally counts once for it.
@@ -220,4 +243,5 @@ module.exports = {
   serviceForMcpServerName,
   MCP_CONFIG_LOCATIONS,
   SERVICE_CATALOG,
+  readTomlMcpServerNames,
 };

package/src/mcp-device-login-tools.js

@@ -1,5 +1,10 @@
 'use strict';
 
+const { askRegistrationTerms } = require('./mcp-choice');
+const { signupCopy } = require('./signup-copy');
+const { signupLanguage } = require('./signup-language');
+const { NOOP_FUNNEL } = require('./onboarding-funnel');
+
 // MCP: two provider-agnostic tools (start returns URL+user_code to relay VERBATIM; poll finishes). device_code stays in the local store, never in a result.
 
 const START_SCHEMA = {
@@ -9,6 +14,8 @@ const START_SCHEMA = {
     mode: { type: 'string', enum: ['login', 'register'], description: "Optional. 'login' signs an existing talent in; 'register' creates the account if new (the profile steps come from the register/onboarding tools afterwards). Defaults to 'login'." },
     freelanceType: { type: 'string', description: 'Optional, register only: FREELANCE | EMPLOYEE | AGENCY | POTENTIAL_FREELANCE. Used to complete a new account.' },
     preferredLanguage: { type: 'string', description: 'Optional, register only: es | en | it | pt | fr.' },
+    termsAnswer: { type: 'string', description: 'Register only: the option the talent picked when you printed the terms question this tool returned. Never set it yourself.' },
+    newsletterAnswer: { type: 'string', description: 'Register only: the option the talent picked when you printed the newsletter question this tool returned. Never set it yourself.' },
   },
 };
 
@@ -23,18 +30,30 @@ function makeDeviceLoginTools(deps = {}) {
     startDeviceLogin = require('./device-login').startDeviceLogin,
     pollDeviceToken = require('./device-login').pollDeviceToken,
     finalizeDeviceSession = require('./device-login').finalizeDeviceSession,
-    appendProviderParam = require('./device-login').appendProviderParam,
+    withDeviceParams = require('./device-login').withDeviceParams,
     deviceSessionRecord = require('./device-login').deviceSessionRecord,
     savePendingDevice = require('./device-auth-store').savePendingDevice,
     loadPendingDevice = require('./device-auth-store').loadPendingDevice,
     clearPendingDevice = require('./device-auth-store').clearPendingDevice,
     saveAuthSession = require('./auth-session-store').saveAuthSession,
     buildRegistrationContext = require('./signup-client').buildRegistrationContext,
+    buildRegistrationConsent = require('./signup-client').buildRegistrationConsent,
+    funnel = NOOP_FUNNEL,
   } = deps;
+  const lang = () => signupLanguage(deps.lang || 'en');
 
-  async function start(args = {}) {
+  async function start(args = {}, ctx = {}) {
     const mode = args.mode === 'register' ? 'register' : 'login';
     const provider = args.provider === 'linkedin' ? 'linkedin' : args.provider === 'email' ? 'email' : 'google';
+    let newsletterConsent = false;
+    if (mode === 'register') {
+      const terms = await askRegistrationTerms(ctx, { tool: 'social_signin_start', lang: lang(), termsAnswer: args.termsAnswer, newsletterAnswer: args.newsletterAnswer });
+      if (terms.reply) return terms.reply;
+      if (terms.declined) {
+        return { ok: false, status: 'terms-declined', relayVerbatim: signupCopy(lang()).termsDeclined, message: 'Print relayVerbatim word for word. No account was created and nothing was sent.' };
+      }
+      newsletterConsent = terms.newsletterConsent;
+    }
     const authorizeEndpoint = getDeviceAuthorizeEndpoint();
     const tokenEndpoint = getDeviceTokenEndpoint();
     const authTokenEndpoint = getAuthTokenEndpoint();
@@ -42,10 +61,15 @@ function makeDeviceLoginTools(deps = {}) {
       return { ok: false, reason: 'no-endpoint', message: 'No sign-in endpoint configured — set SHAKERS_CLI_HUB_BASE.' };
     }
 
+    if (mode === 'register') funnel.begin();
+    funnel.viewed('account_creation', { auth_methods_offered: [provider] });
     const authz = await startDeviceLogin({ authorizeEndpoint });
-    if (!authz.ok) return { ok: false, reason: authz.reason || 'authorize-failed' };
+    if (!authz.ok) {
+      funnel.errored('account_creation', authz.reason || 'authorize-failed');
+      return { ok: false, reason: authz.reason || 'authorize-failed' };
+    }
 
-    const verificationUrl = appendProviderParam(authz.verificationUriComplete, provider);
+    const verificationUrl = withDeviceParams(authz.verificationUriComplete, { provider, mode, surface: 'mcp' });
     const expiresAt = new Date(Date.now() + authz.expiresIn * 1000).toISOString();
     try {
       savePendingDevice({
@@ -59,7 +83,7 @@ function makeDeviceLoginTools(deps = {}) {
         mode,
         provider,
         registerContext: mode === 'register'
-          ? { freelanceType: args.freelanceType || null, preferredLanguage: args.preferredLanguage || null }
+          ? { freelanceType: args.freelanceType || null, preferredLanguage: args.preferredLanguage || null, newsletterConsent }
           : null,
       });
     } catch {
@@ -75,7 +99,8 @@ function makeDeviceLoginTools(deps = {}) {
       userCode: authz.userCode,
       expiresInSeconds: authz.expiresIn,
       pollIntervalSeconds: authz.interval,
-      message: `Show the talent this link and code so they can authorize in their own browser — relay both verbatim, do not invent or complete the code:\n\n${verificationUrl}\n\nCode: ${authz.userCode}\n\nThen call social_signin_poll; if it returns status "pending", wait pollIntervalSeconds and call it again.`,
+      relayVerbatim: signupCopy(lang()).windowLink(verificationUrl, authz.userCode),
+      message: 'Print relayVerbatim word for word (it holds the link and the code) — never invent or complete the code. Then call social_signin_poll; if it returns status "pending", wait pollIntervalSeconds and call it again.',
     };
   }
 
@@ -115,13 +140,16 @@ function makeDeviceLoginTools(deps = {}) {
     }
     if (res.status === 'denied') {
       clearPendingDevice();
+      funnel.errored('account_creation', 'device-denied');
       return { ok: false, status: 'denied', message: 'The talent cancelled or did not grant access. No session was started.' };
     }
     if (res.status === 'expired') {
       clearPendingDevice();
+      funnel.errored('account_creation', 'device-expired');
       return { ok: false, status: 'expired', message: 'The sign-in request expired. Call social_signin_start to try again.' };
     }
     if (res.status !== 'authorized') {
+      funnel.errored('account_creation', res.reason || 'poll-failed');
       return { ok: false, status: 'error', reason: res.reason || 'poll-failed' };
     }
 
@@ -129,7 +157,7 @@ function makeDeviceLoginTools(deps = {}) {
     const rc = pending.registerContext || {};
     const registrationContext = buildRegistrationContext({
       preferredLanguage: rc.preferredLanguage || undefined,
-      newsletterConsent: false,
+      newsletterConsent: rc.newsletterConsent === true,
       freelanceType: rc.freelanceType || 'POTENTIAL_FREELANCE',
     });
     const fin = await finalizeDeviceSession({
@@ -138,8 +166,10 @@ function makeDeviceLoginTools(deps = {}) {
       authTokenEndpoint: pending.authTokenEndpoint,
       completeRegistrationEndpoint: getCompleteRegistrationEndpoint(),
       registrationContext,
+      consent: pending.mode === 'register' ? buildRegistrationConsent({ newsletterConsent: rc.newsletterConsent === true }) : null,
     });
     if (!fin.ok) {
+      funnel.errored('account_creation', fin.reason);
       // The authorization was consumed; a re-poll can't recover — never treat this as logged in.
       clearPendingDevice();
       return { ok: false, status: 'error', reason: fin.reason };
@@ -152,6 +182,8 @@ function makeDeviceLoginTools(deps = {}) {
     }
 
     clearPendingDevice();
+    funnel.completed('account_creation', { auth_method: pending.provider || 'google', auth_attempts: 1, is_returning_account: !res.isNewUser });
+    if (funnel.active) funnel.identified({ newAccount: !!res.isNewUser });
     return { ok: true, status: 'authorized', method: pending.provider || 'google', email: res.email || null, isNewUser: !!res.isNewUser };
   }
 
@@ -160,7 +192,7 @@ function makeDeviceLoginTools(deps = {}) {
       name: 'social_signin_start',
       title: 'Sign in to Shakers',
       description: 'Opens a Shakers page in your browser where you sign in with Google, LinkedIn or your email. Your password never goes through the chat.',
-      guidance: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
+      guidance: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. With mode 'register' it first asks the talent to accept the Terms and Privacy Policy and whether they want the newsletter (a dialog, or `say` to print word for word; pass their picks back as termsAnswer and newsletterAnswer, never your own); a decline creates nothing. Returns relayVerbatim with the Shakers link and the code: print it word for word — they open the link, check the code matches and approve in their own browser (you never invent or fill the code). After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, relayVerbatim, ... }.",
       inputSchema: START_SCHEMA,
       handler: start,
     },