shakers-cli 0.17.0 → 0.18.0

package/README.md

@@ -69,11 +69,21 @@ Run `shakers` with no command to see every command.
   can leave out agents and text excerpts there. `--consent-revoke` stops future uploads
   from this computer; it does not delete what was already uploaded. To ask for that, write
   to talent@shakersworks.com.
-- What is saved is mostly derived data (counts, categories, tier, detected technologies).
-  Two kinds of text travel too, and the review shows how many: the definition text of your
-  AI agents and short excerpts of what you ask the AI (200 characters at most), both with
-  secrets, paths and emails removed. Never your code, your full conversations, the names of
-  your repositories, environment variables or credentials.
+- What is sent is mostly derived data (counts, categories, tier, detected technologies,
+  sessions, active days, commits and lines changed). Literal text travels too, and the review
+  shows how much: up to 40 fragments of your messages to AI assistants and 20 commands they
+  ran (200 characters at most each), and the definition (up to 2,000 characters) and short
+  description of each of your AI agents, all after removing anything that looks like a
+  secret, a path or an email. The fragments come from the conversations in the repositories
+  analysed, or from every conversation on this computer when you analyse the whole machine
+  (registration always does). Never your code, your full conversations, the names of your
+  repositories, environment variables or credentials.
+- An AI model from an external provider (OpenAI, Google or Anthropic) analyses that text
+  automatically for Shakers to compute your evaluation, and then it is discarded. Only the result is stored: levels, scores, counts and the names
+  of your tools and agents.
+- Do not run it on a machine or with conversations that hold information you are not
+  allowed to share: client, employer or third-party data. Secret removal is automatic and
+  best effort; names or business details you wrote can remain in the fragments.
 - Certification sends secret-scrubbed samples of your code and your interview answers to
   Shakers to assess them.
 - Read the full policy at <https://www.shakersworks.com/en/politica-de-privacidad>.

package/bin/command-audit-worker.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+'use strict';
+
+const { ensureFreshSession } = require('../src/session-refresh');
+const { emitCommandAudit, PAYLOAD_VAR } = require('../src/command-audit');
+
+async function main() {
+  let payload;
+  try {
+    payload = JSON.parse(process.env[PAYLOAD_VAR]);
+  } catch {
+    return;
+  }
+  if (!payload || typeof payload.command !== 'string') return;
+  await ensureFreshSession(process.env).catch(() => null);
+  await emitCommandAudit({ command: payload.command, argv: payload.args ? [payload.args] : [], env: process.env, id: typeof payload.id === 'string' ? payload.id : null });
+}
+
+main();

package/bin/login.js

@@ -5,7 +5,7 @@
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
-const { runDeviceLogin, appendProviderParam, deviceSessionRecord } = require('../src/device-login');
+const { runDeviceLogin, withDeviceParams, deviceSessionRecord } = require('../src/device-login');
 const { buildRegistrationContext } = require('../src/signup-client');
 const { openPath } = require('../src/open-file');
 const { endSession } = require('../src/session-refresh');
@@ -100,14 +100,10 @@ function persistAndReport(result, c, email = null, output = process.stdout) {
     }
   }
   try {
-    // `cookie`/`cookieExpiresAt` are present for the email (better-auth) flow and
-    // absent for Google (auth-works JWT) — saveAuthSession picks the right model.
     saveAuthSession({
       accessToken: result.accessToken,
       expiresAt: result.expiresAt,
       accessTokenExpiresAt: result.expiresAt,
-      cookie: result.cookie || null,
-      cookieExpiresAt: result.cookieExpiresAt || null,
       sessionToken: result.sessionToken || null,
       sessionExpiresAt: result.sessionExpiresAt || null,
       email,
@@ -120,7 +116,7 @@ function persistAndReport(result, c, email = null, output = process.stdout) {
   }
   output.write(`\n  ${c.success}\n`);
   if (result.expiresAt) output.write(`  ${c.expiresAt(result.expiresAt)}\n`);
-  output.write('\n');
+  output.write(`\n  ${c.deviceGranted}\n\n`);
   return true;
 }
 
@@ -157,8 +153,8 @@ async function runDeviceFlow(provider, c, { openBrowser = openPath, sleep = unde
     {
       ...(sleep ? { sleep } : {}),
       onPrompt: ({ verificationUriComplete, userCode }) => {
-        const url = appendProviderParam(verificationUriComplete, provider);
-        output.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        const url = withDeviceParams(verificationUriComplete, { provider, mode: 'login', surface: 'cli' });
+        output.write(`\n  ${c.deviceTrust}\n\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
         if (provider === 'email') output.write(`  ${c.deviceApproveHint}\n`);
         try { openBrowser(url); } catch { /* the printed URL covers it */ }
       },

package/bin/mcp.js

@@ -23,13 +23,20 @@ const { makeRoleTools } = require('../src/mcp-role-tools');
 const { makeDeviceLoginTools } = require('../src/mcp-device-login-tools');
 const { makeRegisterTools } = require('../src/mcp-register-tools');
 const { makeSignupTools } = require('../src/mcp-signup-tools');
+const { makeSignupTool, outsideSignup, narratedTool, narrationLanguage, ABSORBED_TOOLS } = require('../src/mcp-signup-flow');
 const { detectFlowLang } = require('../src/i18n');
 const { makeReportTools } = require('../src/mcp-report-tools');
 const { makePrompts } = require('../src/mcp-prompts');
 const { buildServerInstructions } = require('../src/mcp-instructions');
+const { mcpNarration } = require('../src/trust-narration');
 const { ensureFreshSession } = require('../src/session-refresh');
+const { emitCommandAudit } = require('../src/command-audit');
 const { createFunnel } = require('../src/onboarding-funnel');
 
+function narrateTool(lang) {
+  return (name, { failed = false, args } = {}) => mcpNarration(narratedTool(name, args), narrationLanguage(name, args, lang), { failed });
+}
+
 let VERSION = '';
 try {
   VERSION = require('../package.json').version || '';
@@ -43,19 +50,15 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `  Usage: shakers mcp\n\n`
   + `  This command speaks JSON-RPC on stdio; it is meant to be launched by an\n`
   + `  MCP client, not run by hand.\n`
-  + `  Tools: ai_usage, ai_usage_upload, ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
-  + `         list_addable, add_skill, add_agent,\n`
-  + `         add_project, signup_start, signup_email, signup_draft, signup_create_account,\n`
-  + `         signup_status, update_existing_profile, import_profile, save_profile_details, open_web,\n`
-  + `         open_linkedin_profile,\n`
-  + `         suggest_register_context, read_cv, onboarding_interview_start,\n`
-  + `         onboarding_interview_turn, onboarding_interview_complete,\n`
-  + `         repeat_onboarding_interview, onboarding_finish,\n`
-  + `         list_available_roles, add_role, list_my_roles, set_main_role,\n`
-  + `         report, share,\n`
-  + `         list_certifiable_dimensions, find_projects, show_project,\n`
-  + `         save_project, unsave_project, list_invitations,\n`
-  + `         list_applications, get_availability,\n`
+  + `  Tools: signup (the whole sign-up, step by step), ai_usage, ai_usage_upload,\n`
+  + `         ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
+  + `         list_addable, add_skill, add_agent, add_project, open_web,\n`
+  + `         onboarding_interview_start, onboarding_interview_turn,\n`
+  + `         onboarding_interview_complete, repeat_onboarding_interview,\n`
+  + `         onboarding_finish, list_available_roles, add_role, list_my_roles,\n`
+  + `         set_main_role, report, share, list_certifiable_dimensions,\n`
+  + `         find_projects, show_project, save_project, unsave_project,\n`
+  + `         list_invitations, list_applications, get_availability,\n`
   + `         list_certifications, get_profile, get_rate, get_languages,\n`
   + `         list_socials, list_experiences, list_portfolios, alma_chat, alma_decision.\n\n`;
 
@@ -68,8 +71,11 @@ const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_upload', 'ai_usage_
 function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp' }), makeInterviewClient = null } = {}) {
   const lang = detectFlowLang();
   const aiUsage = makeAiUsageTools();
-  const allTools = [aiUsage.usage, aiUsage.upload, makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
-  const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
+  const allTools = [aiUsage.usage, aiUsage.upload, makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools({ lang, funnel }), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
+  // The sign-up runs through one tool (`signup`), so Claude Desktop asks the talent once instead of once per step.
+  const tools = localOnly
+    ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name))
+    : [makeSignupTool(allTools), ...allTools.filter((t) => !ABSORBED_TOOLS.has(t.name)).map(outsideSignup)];
   // Slash-command prompts, kept to the tools actually registered in this mode.
   const prompts = makePrompts(new Set(tools.map((t) => t.name)), lang);
   return createMcpServer({
@@ -77,10 +83,14 @@ function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp'
     prompts,
     serverInfo: { name: localOnly ? 'Shakers (local scan)' : 'Shakers', version: VERSION || '0.0.0' },
     instructions: localOnly ? null : (client) => buildServerInstructions(client),
-    // Long-lived server: refresh the email session's hub JWT from the stored
-    // cookie before each tool call so a stale (~15-min) JWT never reaches a tool.
     beforeCall: () => ensureFreshSession(process.env),
-    afterCall: () => { funnel.flush(); },
+    afterCall: (name) => {
+      funnel.flush();
+      ensureFreshSession(process.env)
+        .catch(() => null)
+        .then(() => emitCommandAudit({ command: `mcp:${name}`, env: process.env }));
+    },
+    narrate: narrateTool(lang),
     onInitialize: ({ clientInfo }) => funnel.setMcpClient(clientInfo.name),
   });
 }
@@ -122,7 +132,7 @@ async function run(argv = process.argv.slice(2), { makeInterviewClient = null }
   await funnel.settle();
 }
 
-module.exports = { run, buildServer, buildServerInstructions, prepareProcess };
+module.exports = { run, buildServer, buildServerInstructions, prepareProcess, narrateTool };
 
 if (require.main === module) {
   run();

package/bin/register.js

@@ -2,9 +2,7 @@
 'use strict';
 
 const { detectFlowLang, getCatalog } = require('../src/i18n');
-const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');
 const { createStdinAsk } = require('../src/stdin-ask');
-const { run: runLogin } = require('./login');
 const { run: runAiUsage } = require('./ai-usage');
 const {
   runOnboarding, makeDeps, CURRENCIES, MONTHLY_HOURS, normalizeAmount,
@@ -20,6 +18,7 @@ const { BRAND_ANSI } = require('../src/brand-ansi');
 const { typeOut } = require('../src/typewriter');
 const { withSpinner } = require('../src/terminal-progress');
 const { openPath } = require('../src/open-file');
+const { termsText, legalCopy } = require('../src/signup-copy');
 const { c: fmt } = require('../src/terminal-format');
 const { createFunnel } = require('../src/onboarding-funnel');
 const red = (s) => `${fmt.danger}${s}${fmt.reset}`;
@@ -151,26 +150,11 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       const telephoneNumber = (await ask(`  ${c.phoneNumberAsk} `)).trim();
       return { available, monthlyHours, workModes, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
     },
-    askSignUp: async (c) => {
-      const name = (await ask(`  ${c.askName} `)).trim();
-      const lastName = (await ask(`  ${c.askLastName} `)).trim();
-      const email = (await ask(`  ${c.askEmail} `)).trim();
-      const askSecret = (prompt) => (typeof ask.secret === 'function' ? ask.secret(`  ${prompt} `) : ask(`  ${prompt} `).then((v) => v.trim()));
-      let password;
-      for (;;) {
-        password = await askSecret(c.askPassword);
-        const again = await askSecret(c.askPasswordConfirm);
-        if (password === again) break;
-        writeErr(c.passwordMismatch);
-      }
-      const newsletterConsent = isYes(await ask(`  ${c.askNewsletter} `));
-      // freelanceType is NOT asked here anymore: it is derived from the work
-      // situation (asked once, after the sources) and sent via professional-details.
-      return { name, lastName, email, password, newsletterConsent };
-    },
-    askGoogleSignUp: async () => {
-      // Nothing to ask: Google supplies name/email; freelanceType is derived later.
-      return {};
+    askTerms: async (c) => {
+      out(`\n  ${termsText(lang, (label, url) => `${label} (${url})`)}\n`);
+      if (!isYes(await ask(`  ${c.termsAsk} `))) return { accepted: false };
+      const newsletterConsent = isYes(await ask(`  ${c.newsletterAsk(legalCopy(lang).newsletter)} `));
+      return { accepted: true, newsletterConsent };
     },
     askWorkSituation: async (c) => {
       const situation = await promptSelect({
@@ -242,13 +226,9 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       }
       return rows;
     },
-    onGoogleAuthUrl: (url, userCode) => {
+    onAuthUrl: (url, userCode) => {
       const g = getCatalog(lang).login;
-      out(`\n  ${g.deviceVisit}\n  ${url}\n\n  ${g.deviceCodeLabel(userCode)}\n\n  ${g.deviceWaiting}\n`);
-    },
-    login: async () => {
-      await runLogin(['--lang', lang], { ask });
-      return sessionStatus(loadAuthSession()) === 'active';
+      out(`\n  ${g.deviceTrust}\n\n  ${g.deviceVisit}\n  ${url}\n\n  ${g.deviceCodeLabel(userCode)}\n\n  ${g.deviceWaiting}\n`);
     },
     // Registration always measures the whole machine (--all-repos).
     runUsage: async () => { await runAiUsage(['--lang', lang, '--all-repos'], { ask, bypassThrottle: true, inRegistration: true }); },
@@ -332,7 +312,8 @@ async function run(
     const io = makeIo({ ask, lang, out: write, acceptDisclaimer: o.acceptDisclaimer, stdinIsTTY });
     // At a terminal the profile opens in the browser at the end; piped runs, tests and --no-open only print it.
     const openProfile = stdinIsTTY && !o.noOpen ? (openBrowser || openPath) : undefined;
-    const result = await runOnboarding(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { method, openBrowser, onAuthUrl: io.onGoogleAuthUrl, openProfile, funnel: registrationFunnel });
+    const openAuth = openBrowser || (deps || o.noOpen ? undefined : openPath);
+    const result = await runOnboarding(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { method, openBrowser: openAuth, onAuthUrl: io.onAuthUrl, openProfile, funnel: registrationFunnel });
     if (!result.ok) {
       process.stderr.write(`\n  ${red(`register: ${result.reason}${result.step ? ` (${result.step})` : ''}`)}\n\n`);
       process.exitCode = 1;

package/bin/shakers-cli.js

@@ -37,9 +37,10 @@ const { run: runOnboarding } = require('./onboarding');
 const { run: runConfig } = require('./config');
 const { run: runUpdate } = require('./update');
 const { checkOnboardingCompleted } = require('../src/onboarding-availability');
-const { emitCommandAudit } = require('../src/command-audit');
+const { startCommandAudit } = require('../src/command-audit');
 const { readPackageInfo } = require('../src/update-flow');
 const { isSuppressed, maybeNotify, triggerBackgroundCheck } = require('../src/update-notifier');
+const { cliNarration, changedNothing } = require('../src/trust-narration');
 
 let VERSION = '';
 try {
@@ -93,9 +94,10 @@ const HANDLERS = {
   logout: runLogout,
   superadmin: runSuperadmin,
   mcp: (args) => require('../src/mcp-install').runMcpInstall({ args }),
+  skill: (args) => require('../src/skill-install').runSkillInstall({ args }),
 };
 
-const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma', 'update']);
+const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'skill', 'share', 'alma', 'update']);
 
 // Command FAMILIES — a navigation layer over the flat commands (which all stay
 // valid as aliases). `shakers <family> <sub>` resolves to the flat handler; every
@@ -178,7 +180,8 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `  Público (sin sesión):\n`
       + `    ai-usage     Escanea este proyecto + tu máquina y puntúa tu setup de IA\n`
       + `    register     Registro completo: perfil, precio, uso de IA y entrevista\n`
-      + `    mcp          Servidor MCP local (stdio) para apps de IA de escritorio\n\n`
+      + `    mcp          Servidor MCP local (stdio) para apps de IA de escritorio\n`
+      + `    skill install Instala la skill shakers-cli en Claude Code y Codex\n\n`
       + `  Requieren sesión (ejecuta antes: shakers login):\n`
       + onboardingLine
       + `    certify      Certifica una dimensión de tu rol (entrevista por LiveKit)\n`
@@ -222,7 +225,8 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `  Public (no session):\n`
     + `    ai-usage     Scan this project + machine and score your AI setup\n`
     + `    register     Full registration: profile, pricing, AI usage and interview\n`
-    + `    mcp          Local MCP server (stdio) for desktop AI apps\n\n`
+    + `    mcp          Local MCP server (stdio) for desktop AI apps\n`
+    + `    skill install Install the shakers-cli skill into Claude Code and Codex\n\n`
     + `  Require a session (run \`shakers login\` first):\n`
     + onboardingLine
     + `    certify      Certify a dimension of your role (LiveKit interview)\n`
@@ -287,15 +291,13 @@ async function main() {
 
   migrateLegacyConfigDir(process.env);
   sanitizeStaleBakedEndpoints(process.env);
-  // Mint a fresh hub JWT from the stored cookie once per command (email sessions only; a no-op for Google/legacy or when no session exists).
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 
   const token = argv.find((a) => !a.startsWith('-'));
 
-  // Single dispatch choke-point: audit EXACTLY once before branching, fire-and-forget (never awaited). MCP tool calls run in-process and never reach here.
   const auditCommand =
     !token || token.toLowerCase() === 'help' ? 'help' : token.toLowerCase();
-  emitCommandAudit({ command: auditCommand, argv, env: process.env });
+  startCommandAudit({ command: auditCommand, argv, env: process.env });
 
   // Non-blocking update notice: reads a cached version synchronously, registry check runs in a detached worker; stderr-only, suppressed for --json/non-TTY/CI/update/opt-out.
   if (!isSuppressed({ argv, command: auditCommand, env: process.env })) {
@@ -346,7 +348,10 @@ async function main() {
     await remindAccountForAiUsage(lang, args);
   }
 
-  await handler(args);
+  const narration = wantsHelp || args.includes('--json') ? { before: null, after: null } : cliNarration(command, args, lang);
+  if (narration.before) process.stderr.write(`\n  ${narration.before}\n`);
+  const outcome = await handler(args);
+  if (narration.after && !process.exitCode && !changedNothing(outcome)) process.stderr.write(`\n  ${narration.after}\n\n`);
 }
 
-module.exports = { main };
+module.exports = { main, HANDLERS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/agents-client.js

@@ -54,6 +54,7 @@ async function requestListAgents({ accessToken, hubAccessToken } = {}, { endpoin
     .map((entry) => ({
       name: entry && typeof entry.name === 'string' ? entry.name : null,
       id: entry && (typeof entry.id === 'string' || typeof entry.id === 'number') ? String(entry.id) : null,
+      source: entry && typeof entry.source === 'string' ? entry.source : null,
     }))
     .filter((a) => a.name !== null);
   return { ok: true, agents };

package/src/ai-usage-review.js

@@ -83,9 +83,11 @@ function explanationText(lang) {
   return [c.explanationTitle, ...c.explanation, c.afterwards].join('\n\n');
 }
 
-function resultText(lang, preview) {
+// `explained`: the talent already read what the two axes mean and how to disagree (the review in the sign-up), so they are not repeated.
+function resultText(lang, preview, { explained = false } = {}) {
   const c = reviewCopy(lang);
-  if (!preview) return [c.resultPending, c.afterwards].join('\n\n');
+  const after = explained ? [] : [c.afterwards];
+  if (!preview) return [c.resultPending, ...after].join('\n\n');
   const m = preview.matrix || {};
   const lines = [
     c.resultTitle,
@@ -95,7 +97,7 @@ function resultText(lang, preview) {
     preview.usage && preview.usage.explanation,
     m.cell ? c.cell(m.cell) : null,
   ].filter(Boolean).map(sanitizeRenderText);
-  return [lines.join('\n'), c.explanation[0], c.afterwards].join('\n\n');
+  return [lines.join('\n'), ...(explained ? [] : [c.explanation[0]]), ...after].join('\n\n');
 }
 
 module.exports = { uploadFacts, withoutExcluded, repoName, summaryText, explanationText, resultText };

package/src/auth-client.js

@@ -1,15 +1,9 @@
 'use strict';
 
-const { postJsonWithTimeout, extractSetCookie } = require('./backend-request');
-
-// Login / token acquisition against the Hub's better-auth email engine.
+const { postJsonWithTimeout } = require('./backend-request');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 const SIGN_OUT_TIMEOUT_MS = 3000;
-const SESSION_COOKIE_NAME = 'better-auth.session_token';
-// Refresh the cookie session's own validity from the Set-Cookie Max-Age; fall
-// back to 7 days (better-auth's default) when the attribute is absent.
-const DEFAULT_COOKIE_TTL_SECONDS = 7 * 24 * 60 * 60;
 
 function parseJson(raw) {
   try { return raw ? JSON.parse(raw) : null; } catch { return null; }
@@ -28,71 +22,10 @@ function expiresAtFromJwt(token) {
   }
 }
 
-// ISO expiry for the session cookie, read from the Set-Cookie `Max-Age` (or
-// `Expires`) of the named cookie; defaults to +7 days when neither is present.
-function cookieExpiresAtFromHeaders(headers, name = SESSION_COOKIE_NAME) {
-  const raw = headers && headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  // Match the base name with or without better-auth's HTTPS `__Secure-`/`__Host-` prefixes.
-  const names = [name, `__Secure-${name}`, `__Host-${name}`];
-  const entry = list.find((e) => typeof e === 'string' && names.some((n) => e.startsWith(`${n}=`)));
-  if (entry) {
-    const maxAge = /(?:^|;\s*)max-age=(\d+)/i.exec(entry);
-    if (maxAge) return new Date(Date.now() + Number(maxAge[1]) * 1000).toISOString();
-    const expires = /(?:^|;\s*)expires=([^;]+)/i.exec(entry);
-    if (expires) {
-      const t = Date.parse(expires[1]);
-      if (Number.isFinite(t)) return new Date(t).toISOString();
-    }
-  }
-  return new Date(Date.now() + DEFAULT_COOKIE_TTL_SECONDS * 1000).toISOString();
-}
-
-function normalizeResponse(status, raw) {
-  if (status >= 200 && status < 300) {
-    let json = null;
-    try { json = raw ? JSON.parse(raw) : null; } catch { json = null; }
-    const payload = json && typeof json.data === 'object' && json.data !== null ? json.data : json;
-    const accessToken = payload && typeof payload.accessToken === 'string' && payload.accessToken ? payload.accessToken : null;
-    if (!accessToken) return { ok: false, reason: 'bad-response', status };
-    const expiresAt = payload && typeof payload.expiresAt === 'string' && payload.expiresAt ? payload.expiresAt : null;
-    const emailRaw = payload && (payload.userEmail || payload.email);
-    const email = typeof emailRaw === 'string' && emailRaw ? emailRaw : null;
-    const hubAccessToken = payload && typeof payload.hubAccessToken === 'string' && payload.hubAccessToken ? payload.hubAccessToken : null;
-    return { ok: true, accessToken, expiresAt, email, hubAccessToken };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Maps the sign-in POST outcome to a captured cookie + email, or a named reason.
-function normalizeSignIn(status, raw, headers) {
-  if (status >= 200 && status < 300) {
-    const cookie = extractSetCookie(headers, SESSION_COOKIE_NAME);
-    if (!cookie) return { ok: false, reason: 'bad-response', status };
-    const body = parseJson(raw);
-    const user = body && typeof body === 'object' ? body.user : null;
-    const emailRaw = user && typeof user.email === 'string' ? user.email : null;
-    return {
-      ok: true,
-      cookie,
-      cookieExpiresAt: cookieExpiresAtFromHeaders(headers),
-      email: emailRaw || null,
-    };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Mints a hub JWT from a better-auth session cookie: `GET {tokenEndpoint}` with the `Cookie` header.
-async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function requestAuthToken({ sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!cookie && !sessionToken) return { ok: false, reason: 'no-cookie' };
-  const credential = cookie ? { Cookie: cookie } : { Authorization: `Bearer ${sessionToken}` };
+  if (!sessionToken) return { ok: false, reason: 'no-session-token' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   let res;
   try {
     res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, credential);
@@ -106,38 +39,9 @@ async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeo
   return { ok: true, accessToken: token, expiresAt: expiresAtFromJwt(token) };
 }
 
-// The full email login: sign-in (capture cookie) -> mint JWT.
-async function requestLogin(
-  { email, password },
-  { signInEndpoint, tokenEndpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!signInEndpoint) return { ok: false, reason: 'no-endpoint' };
-  let signIn;
-  try {
-    const { status, raw, headers } = await postJsonWithTimeout(signInEndpoint, { email, password }, timeoutMs);
-    signIn = normalizeSignIn(status, raw, headers);
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'local-error' };
-  }
-  if (!signIn.ok) return signIn;
-
-  const tok = await requestAuthToken({ cookie: signIn.cookie }, { endpoint: tokenEndpoint, timeoutMs });
-  if (!tok.ok) return { ok: false, reason: 'token-fetch-failed', status: tok.status || null };
-
-  return {
-    ok: true,
-    accessToken: tok.accessToken,
-    hubAccessToken: tok.accessToken,
-    expiresAt: tok.expiresAt,
-    email: signIn.email || (typeof email === 'string' ? email : null),
-    cookie: signIn.cookie,
-    cookieExpiresAt: signIn.cookieExpiresAt,
-  };
-}
-
-async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin = null, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
-  if (!endpoint || (!cookie && !sessionToken)) return { ok: false, reason: 'no-credential' };
-  const credential = cookie ? { Cookie: cookie, ...(origin ? { Origin: origin } : {}) } : { Authorization: `Bearer ${sessionToken}` };
+async function requestSignOut({ sessionToken } = {}, { endpoint, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
+  if (!endpoint || !sessionToken) return { ok: false, reason: 'no-credential' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   try {
     const res = await postJsonWithTimeout(endpoint, {}, timeoutMs, 'POST', null, credential);
     return { ok: res.status >= 200 && res.status < 300, status: res.status };
@@ -148,11 +52,7 @@ async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin
 
 module.exports = {
   requestSignOut,
-  requestLogin,
   requestAuthToken,
-  normalizeSignIn,
-  normalizeResponse,
   expiresAtFromJwt,
-  SESSION_COOKIE_NAME,
   DEFAULT_TIMEOUT_MS,
 };

package/src/auth-session-store.js

@@ -89,12 +89,11 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
   const explicitHubToken = typeof session.hubAccessToken === 'string' && session.hubAccessToken ? session.hubAccessToken : null;
   const hubAccessToken = explicitHubToken || (typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null);
 
-  const cookie = typeof session.cookie === 'string' && session.cookie ? session.cookie : null;
   const sessionToken = typeof session.sessionToken === 'string' && session.sessionToken ? session.sessionToken : null;
   let expiresAt;
   let accessTokenExpiresAt;
-  if (cookie || sessionToken) {
-    expiresAt = [session.cookieExpiresAt, session.sessionExpiresAt, session.expiresAt]
+  if (sessionToken) {
+    expiresAt = [session.sessionExpiresAt, session.expiresAt]
       .find((v) => typeof v === 'string' && v) || expiresAtFromToken(session.accessToken);
     accessTokenExpiresAt = (typeof session.accessTokenExpiresAt === 'string' && session.accessTokenExpiresAt)
       ? session.accessTokenExpiresAt
@@ -109,7 +108,6 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
       accessToken: typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null,
       expiresAt: expiresAt ?? null,
       accessTokenExpiresAt: accessTokenExpiresAt ?? null,
-      cookie,
       sessionToken,
       email: (typeof session.email === 'string' && session.email ? session.email : null)
         || emailFromHubToken(hubAccessToken),
@@ -142,7 +140,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
     try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
     throw e;
   }
-  recordAccountMarker(cookie ? 'email' : sessionToken ? 'device' : 'token', env, { fs: fsImpl });
+  recordAccountMarker(sessionToken ? 'device' : 'token', env, { fs: fsImpl });
   return target;
 }
 
@@ -156,19 +154,16 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   }
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
   if (parsed.version !== SESSION_FILE_VERSION) return null;
-  // A usable session needs at least ONE credential: the durable cookie (email/
-  // better-auth) or a JWT (Google/legacy, or an email session whose JWT is cached).
-  const hasCookie = typeof parsed.cookie === 'string' && parsed.cookie;
   const hasToken = typeof parsed.accessToken === 'string' && parsed.accessToken;
   const sessionToken = typeof parsed.sessionToken === 'string' && parsed.sessionToken ? parsed.sessionToken : null;
-  if (!hasCookie && !hasToken && !sessionToken) return null;
+  if (typeof parsed.cookie === 'string' && parsed.cookie && !sessionToken) return null;
+  if (!hasToken && !sessionToken) return null;
   const hubAccessToken = typeof parsed.hubAccessToken === 'string' && parsed.hubAccessToken ? parsed.hubAccessToken : null;
   const email = (typeof parsed.email === 'string' && parsed.email ? parsed.email : null) || emailFromHubToken(hubAccessToken);
   return {
     accessToken: hasToken ? parsed.accessToken : null,
     expiresAt: typeof parsed.expiresAt === 'string' ? parsed.expiresAt : null,
     accessTokenExpiresAt: typeof parsed.accessTokenExpiresAt === 'string' ? parsed.accessTokenExpiresAt : null,
-    cookie: hasCookie ? parsed.cookie : null,
     sessionToken,
     email,
     hubAccessToken,
@@ -193,8 +188,7 @@ function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
 
 // `none | active | expired`, the three states the caller needs to give the Talent a true message.
 function sessionStatus(session, now = Date.now()) {
-  // A credential is a durable cookie or session token, or a JWT (Google/legacy).
-  const hasCred = !!(session && [session.accessToken, session.cookie, session.sessionToken].some((v) => typeof v === 'string' && v));
+  const hasCred = !!(session && [session.accessToken, session.sessionToken].some((v) => typeof v === 'string' && v));
   if (!hasCred) return 'none';
   const expiry = Date.parse(String(session.expiresAt || ''));
   if (!Number.isFinite(expiry)) return 'expired';

package/src/backend-request.js

@@ -80,8 +80,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           raw += chunk;
           if (raw.length > MAX_RESPONSE_BYTES) req.destroy();
         });
-        // `headers` is exposed so the better-auth email flow can read `Set-Cookie` (the session cookie it captures and replays); every other caller reads only `{status, raw}` and ignores it.
-        res.on('end', () => resolve({ status: res.statusCode, raw, headers: res.headers }));
+        res.on('end', () => resolve({ status: res.statusCode, raw }));
       },
     );
     req.on('timeout', () => req.destroy(Object.assign(new Error('request timed out'), { kind: 'timeout' })));
@@ -91,27 +90,6 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
   });
 }
 
-// Pulls one `name=value` cookie pair out of a response's `Set-Cookie` header (Node exposes it as an array, or a single string).
-// Accepts the base cookie name with or without the RFC6265 `__Secure-`/`__Host-`
-// prefixes that better-auth applies over HTTPS, and returns the EXACT server-set
-// name (prefix included) so it can be forwarded back verbatim in a `Cookie:` header.
-function extractSetCookie(headers, name) {
-  if (!headers) return null;
-  const raw = headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  const candidates = [name, `__Secure-${name}`, `__Host-${name}`];
-  for (const candidate of candidates) {
-    const prefix = `${candidate}=`;
-    for (const entry of list) {
-      if (typeof entry === 'string' && entry.startsWith(prefix)) {
-        const value = entry.slice(prefix.length).split(';')[0];
-        if (value) return `${candidate}=${value}`;
-      }
-    }
-  }
-  return null;
-}
-
 function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extraHeaders = null) {
   return new Promise((resolve, reject) => {
     let u;
@@ -204,7 +182,6 @@ module.exports = {
   MAX_RESPONSE_BYTES,
   postJsonWithTimeout,
   postMultipartWithTimeout,
-  extractSetCookie,
   requestBackend,
   setClientIdentity,
 };