shakers-cli 0.17.0 → 0.18.0

package/src/cli-skill.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const { SERVER_NAME } = require('./mcp-server-name');
+
+const CLI_SKILL_NAME = 'shakers-cli';
+
+const OWN_SKILL_NAMES = new Set([CLI_SKILL_NAME, SERVER_NAME]);
+
+const CLI_SKILL_DESCRIPTION = 'Use Shakers, the freelance talent marketplace, from the terminal through the `shakers` CLI: find, view and save projects, read the talent profile, certifications, applications and invitations, and get the link to certify a role dimension. Use when the talent wants to work with Shakers from the terminal or mentions the `shakers` command.';
+
+const BODY = `# Shakers CLI
+
+Shakers is a freelance talent marketplace. The \`shakers\` CLI acts on the talent's own account. You run it for the talent, with their permission.
+
+## Rules
+
+- Before running any command, show the talent the exact command and ask them first.
+- Run only the \`shakers\` commands listed in this skill. If \`shakers\` is not on PATH, run the same command as \`npx -y shakers-cli <command>\`.
+- Install only the official npm package \`shakers-cli\`. Never install a package with a similar name.
+- Never run \`shakers update\` without \`--check\` unless the talent explicitly asks to update.
+- Put the command name first (\`shakers me --json\`, not \`shakers --json me\`).
+- Prefer \`--json\` and read ids from the JSON. Never pass the \`N)\` numbers of a printed list: a number refers to the last human listing, not to your JSON.
+- If the Shakers MCP server tools are available in this session and the talent did not ask for the terminal, use those tools instead of this skill.
+
+## Not logged in
+
+A command that needs a session exits 1 and prints on stderr that it requires an active session. Do not try to log in for the talent. Tell them to run \`shakers login\` in their own terminal, then retry the command.
+
+Without \`--json\`, each command first prints on stderr one line saying what Shakers does on this computer and in the account (what it reads, changes or sends). Relay that line to the talent word for word.
+
+## Commands you may run
+
+Projects:
+- \`shakers find-projects --json [--page N] [--limit N] [--tab all|saved] [--attendance remote|hybrid|in-person] [--country ES] [--recommended]\`: projects available to the talent. The id of each item is \`items[].positionId\`.
+- \`shakers show-project <positionId> --json\`: detail of one project.
+- \`shakers save-project <positionId> --json\` and \`shakers unsave-project <positionId> --json\`: add or remove a saved project.
+- \`shakers applications --json\`: projects the talent applied to and their status (\`items[].positionId\`).
+- \`shakers invitations --json\`: the talent's unread project invitations.
+
+Profile (read only):
+- \`shakers me --json\`: profile summary.
+- \`shakers rate --json\`, \`shakers availability --json\`, \`shakers lang --json\`, \`shakers socials --json\`.
+- \`shakers experiences --json\`, \`shakers portfolios --json\`.
+
+Certifications:
+- \`shakers certifications --json\`: certified, uncertified and expired dimensions.
+- \`shakers certify --dimension <key>\`: only when the talent named the dimension. It prints a link; the interview happens on the web. Show the talent the link. It has no \`--json\`.
+
+Account:
+- \`shakers config list\` and \`shakers config get <key>\`: read the CLI configuration.
+- \`shakers update --check --json\`: tells whether a newer version exists. Installs nothing.
+- \`shakers logout\`: only when the talent asks to sign out.
+
+## Hand these to the talent
+
+Never run these yourself. They need the talent at their own keyboard: they ask for consent, reviews or choices, and \`login\` and \`register\` open a Shakers page on shakersworks.com with a code the talent checks and approves (the password is typed only there, never in a terminal). Tell the talent the exact command to run in their own terminal, or point them to the web (https://www.shakersworks.com) or the Shakers MCP server.
+
+- \`shakers register\` and \`shakers onboarding\`: sign-up and the onboarding interview.
+- \`shakers login\`.
+- \`shakers ai-usage\`: the AI-usage analysis and upload. The talent gives consent and reviews what is sent.
+- Profile changes: \`shakers rate --set\`, \`shakers availability --set\`, \`shakers lang --set\`, \`shakers socials --set\`.
+- \`shakers add-agent\`, \`shakers add-skill\`, \`shakers add-project\`, \`shakers add-role\`, \`shakers change-role\`.
+- \`shakers config set\`.
+`;
+
+function cliSkill() {
+  return [
+    '---',
+    `name: ${CLI_SKILL_NAME}`,
+    `description: ${JSON.stringify(CLI_SKILL_DESCRIPTION)}`,
+    '---',
+    '',
+    BODY,
+  ].join('\n');
+}
+
+module.exports = { cliSkill, CLI_SKILL_NAME, OWN_SKILL_NAMES };

package/src/command-audit.js

@@ -1,7 +1,9 @@
 'use strict';
 
+const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
+const { spawn } = require('child_process');
 const { scrubSecrets } = require('./agent-synthesis');
 const { loadAuthSession, decodeJwtPayload } = require('./auth-session-store');
 const { getCertsBase } = require('./config');
@@ -13,6 +15,13 @@ const AUDIT_TIMEOUT_MS = 1500;
 // Capped at 200 chars AFTER scrubbing (mirrors MAX_COMMAND_LEN in session-scan.js) so a secret straddling the cut cannot leak.
 const MAX_ARGS_LEN = 200;
 
+const WORKER = path.join(__dirname, '..', 'bin', 'command-audit-worker.js');
+const PAYLOAD_VAR = 'SHAKERS_CLI_AUDIT_PAYLOAD';
+
+function auditDisabled(env) {
+  return !!env && env.SHAKERS_CLI_NO_AUDIT === '1';
+}
+
 function cliVersion() {
   try {
     return require(path.join(__dirname, '..', 'package.json')).version || null;
@@ -52,7 +61,7 @@ function jwtExpired(token, now) {
 }
 
 // Builds the record + headers; returns null when there is no endpoint to post to.
-function buildAudit(command, argv, env) {
+function buildAudit(command, argv, env, id = null) {
   let base;
   try {
     base = getCertsBase(env);
@@ -66,6 +75,7 @@ function buildAudit(command, argv, env) {
   const token = stored && !jwtExpired(stored, Date.now()) ? stored : null;
 
   const body = {
+    ...(id ? { id } : {}),
     command: String(command || 'unknown').slice(0, 100),
     args: redactArgs(argv),
     cliVersion: cliVersion(),
@@ -85,9 +95,10 @@ function buildAudit(command, argv, env) {
 }
 
 // Emits ONE fire-and-forget audit record; never throws or rejects. Returns the `.catch`-guarded promise so tests can await it (production does not).
-function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
+function emitCommandAudit({ command, argv = [], env = process.env, id = null } = {}) {
   try {
-    const audit = buildAudit(command, argv, env);
+    if (auditDisabled(env)) return Promise.resolve();
+    const audit = buildAudit(command, argv, env, id);
     if (!audit) return Promise.resolve();
     return postJsonWithTimeout(
       audit.endpoint,
@@ -105,4 +116,36 @@ function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
   }
 }
 
-module.exports = { emitCommandAudit, redactArgs, buildAudit };
+async function logCommandRun({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  await emitCommandAudit({ command, argv, env, id });
+  return id;
+}
+
+let runId = null;
+
+function startCommandAudit({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  try {
+    const child = spawn(process.execPath, [WORKER], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+      env: { ...env, [PAYLOAD_VAR]: JSON.stringify({ id, command, args: redactArgs(argv) }) },
+    });
+    child.on('error', () => {});
+    child.unref();
+  } catch {
+    return null;
+  }
+  runId = id;
+  return id;
+}
+
+function currentRunId() {
+  return runId;
+}
+
+module.exports = { emitCommandAudit, startCommandAudit, logCommandRun, currentRunId, redactArgs, buildAudit, PAYLOAD_VAR };

package/src/config.js

@@ -300,14 +300,6 @@ function getAgentEvaluationEndpoint(env = process.env) {
   return deriveFromIngest(env, 'agent-evaluation');
 }
 
-// Login endpoint — better-auth email sign-in: `POST {hubBase}/auth/sign-in/email` with `{email,password}`.
-function getLoginEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'LOGIN_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-in/email');
-}
-
-// better-auth JWT endpoint: `GET {hubBase}/auth/token` with the session cookie → `{token}` (ES256/JWKS, ~15-min TTL).
 function getSignOutEndpoint(env = process.env) {
   return deriveFromHub(env, 'auth/sign-out');
 }
@@ -589,12 +581,6 @@ function deriveFromHub(env, relativePath) {
   return `${base}/${relativePath}`;
 }
 
-function getSignUpEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'SIGNUP_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-up/email');
-}
-
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -832,7 +818,6 @@ module.exports = {
   getSynthesisEndpoint,
   getRoadmapEndpoint,
   getAgentEvaluationEndpoint,
-  getLoginEndpoint,
   getAuthTokenEndpoint,
   getSignOutEndpoint,
   getCompleteRegistrationEndpoint,
@@ -884,7 +869,6 @@ module.exports = {
   getCertsBase,
   getHubBase,
   sanitizeStaleBakedEndpoints,
-  getSignUpEndpoint,
   getImportProfileEndpoint,
   getMcpSignupEndpoint,
   getMyImportStatusEndpoint,

package/src/consent-flow.js

@@ -15,9 +15,12 @@ const MAX_ATTEMPTS = 5;
 const YES_RE = /^(y|yes|s|si|sí)$/i;
 const NO_RE = /^(n|no)$/i;
 
-async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false } = {}) {
+const UNANSWERED = Symbol('unanswered');
+
+async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false, blankUnanswered = false } = {}) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     const raw = String(await ask(question)).trim();
+    if (blankUnanswered && raw === '') return UNANSWERED;
     if (defaultNo && raw === '') return false;
     if (defaultYes && raw === '') return true;
     if (YES_RE.test(raw)) return true;
@@ -56,6 +59,7 @@ async function runConsentPrompt({
   sessionEmail = null,
   drainBeforeAsk = false,
   profile = 'talent',
+  requireExplicitAnswer = false,
 }) {
   const c = catalog.consent;
   // Presentation only: framed by src/legal-notice.js on a
@@ -69,7 +73,8 @@ async function runConsentPrompt({
   }
 
   // defaultNo: a blank Enter means "do not save" (legal requirement).
-  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: true });
+  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: !requireExplicitAnswer, blankUnanswered: requireExplicitAnswer });
+  if (accepted === UNANSWERED) return 'unanswered';
   if (accepted === null) {
     process.stdout.write(`  ${c.notObtained}\n\n`);
     return null;

package/src/detect-repos.js

@@ -2,12 +2,7 @@
 
 const { execFileSync } = require('child_process');
 const path = require('path');
-const {
-  toolSources,
-  listSessionFiles,
-  readSessionObjects,
-  resolveFileCwd,
-} = require('./session-scan');
+const { toolSources, sourceSessions, resolveFileCwd } = require('./session-scan');
 const { normalizeRemote } = require('./authorship');
 
 const GIT_TIMEOUT_MS = 15000;
@@ -37,8 +32,9 @@ function sessionCwdCounts(env = process.env) {
   const counts = new Map();
   let unassigned = 0;
   for (const source of toolSources(env)) {
-    for (const file of listSessionFiles(source.dir)) {
-      const cwd = resolveFileCwd(readSessionObjects(file));
+    if (source.repoLevel) continue;
+    for (const { objects } of sourceSessions(source)) {
+      const cwd = resolveFileCwd(objects);
       if (cwd === null) {
         unassigned += 1;
         continue;

package/src/detectors.js

@@ -115,6 +115,29 @@ const detectors = [
       { type: 'bin', name: 'codex' },
     ],
   },
+  {
+    id: 'pi',
+    name: 'Pi',
+    vendor: 'Earendil Works',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.pi' },
+      { type: 'homePath', path: '.pi/agent' },
+    ],
+  },
+  {
+    id: 'opencode',
+    name: 'OpenCode',
+    vendor: 'OpenCode',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: 'opencode.json' },
+      { type: 'projectPath', path: '.opencode' },
+      { type: 'homePath', path: '.config/opencode' },
+      { type: 'homePath', path: '.local/share/opencode' },
+      { type: 'bin', name: 'opencode' },
+    ],
+  },
   {
     id: 'cody',
     name: 'Cody',

package/src/device-auth-store.js

@@ -26,7 +26,7 @@ function savePendingDevice(pending, env = process.env, { fs: fsImpl = fs } = {})
       interval: typeof pending.interval === 'number' && pending.interval > 0 ? Math.floor(pending.interval) : 5,
       expiresAt: typeof pending.expiresAt === 'string' && pending.expiresAt ? pending.expiresAt : null,
       mode: pending.mode === 'register' ? 'register' : 'login',
-      provider: pending.provider === 'linkedin' ? 'linkedin' : 'google',
+      provider: pending.provider === 'linkedin' || pending.provider === 'email' ? pending.provider : 'google',
       registerContext: pending.registerContext && typeof pending.registerContext === 'object' ? pending.registerContext : null,
       email: typeof pending.email === 'string' && pending.email ? pending.email : null,
       version: DEVICE_FILE_VERSION,
@@ -75,7 +75,7 @@ function loadPendingDevice(env = process.env, { fs: fsImpl = fs } = {}) {
     interval: typeof parsed.interval === 'number' && parsed.interval > 0 ? Math.floor(parsed.interval) : 5,
     expiresAt: typeof parsed.expiresAt === 'string' && parsed.expiresAt ? parsed.expiresAt : null,
     mode: parsed.mode === 'register' ? 'register' : 'login',
-    provider: parsed.provider === 'linkedin' ? 'linkedin' : 'google',
+    provider: parsed.provider === 'linkedin' || parsed.provider === 'email' ? parsed.provider : 'google',
     registerContext: parsed.registerContext && typeof parsed.registerContext === 'object' ? parsed.registerContext : null,
     email: typeof parsed.email === 'string' && parsed.email ? parsed.email : null,
   };

package/src/device-login.js

@@ -10,15 +10,16 @@ function defaultSleep(ms) {
   return new Promise((resolve) => { setTimeout(resolve, ms); });
 }
 
-// The /cli-login page reads `provider` from the query to pick the social button.
-function appendProviderParam(url, provider) {
-  if (!url || !provider) return url;
+function withDeviceParams(url, params = {}) {
+  const entries = Object.entries(params).filter(([, v]) => typeof v === 'string' && v);
+  if (!url || !entries.length) return url;
   try {
     const u = new URL(url);
-    u.searchParams.set('provider', provider);
+    for (const [k, v] of entries) u.searchParams.set(k, v);
     return u.href;
   } catch {
-    return `${url}${url.includes('?') ? '&' : '?'}provider=${encodeURIComponent(provider)}`;
+    const query = entries.map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join('&');
+    return `${url}${url.includes('?') ? '&' : '?'}${query}`;
   }
 }
 
@@ -32,7 +33,7 @@ async function pollDeviceToken({ deviceCode, tokenEndpoint, clientId, timeoutMs
 
 // ORDER: a NEW user needs complete-registration BEFORE GET /auth/token (else the Hub 500s: no domain user).
 async function finalizeDeviceSession(
-  { sessionToken, isNewUser, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, claimCode = null, timeoutMs } = {},
+  { sessionToken, isNewUser, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, consent = null, claimCode = null, timeoutMs } = {},
   {
     requestCompleteRegistration = require('./signup-client').requestCompleteRegistration,
     requestApiToken: apiToken = requestApiToken,
@@ -42,7 +43,7 @@ async function finalizeDeviceSession(
 
   let claimed = false;
   if (isNewUser && completeRegistrationEndpoint) {
-    const done = await requestCompleteRegistration(registrationContext || {}, { endpoint: completeRegistrationEndpoint, bearerToken: sessionToken, claimCode, timeoutMs });
+    const done = await requestCompleteRegistration(registrationContext || {}, { endpoint: completeRegistrationEndpoint, bearerToken: sessionToken, claimCode, consent, timeoutMs });
     if (!done.ok) return { ok: false, reason: done.reason || 'complete-registration-failed' };
     claimed = done.claimed === true;
   }
@@ -53,7 +54,7 @@ async function finalizeDeviceSession(
 }
 
 async function runDeviceLogin(
-  { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, clientId, scope, timeoutMs } = {},
+  { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, consent = null, clientId, scope, timeoutMs } = {},
   {
     onPrompt = null,
     onWaiting = null,
@@ -92,6 +93,7 @@ async function runDeviceLogin(
         authTokenEndpoint,
         completeRegistrationEndpoint,
         registrationContext,
+        consent,
         timeoutMs,
       });
       if (!fin.ok) return { ok: false, reason: fin.reason };
@@ -124,7 +126,7 @@ module.exports = {
   pollDeviceToken,
   finalizeDeviceSession,
   runDeviceLogin,
-  appendProviderParam,
+  withDeviceParams,
   defaultSleep,
   SLOW_DOWN_STEP_SECONDS,
   DEFAULT_MAX_WAIT_MS,

package/src/env-paths.js

@@ -13,6 +13,14 @@ function getHomeDir(env = process.env) {
   return readEnv(env, 'HOME_DIR') || os.homedir();
 }
 
+function codexHome(env = process.env) {
+  return env.CODEX_HOME || require('path').join(getHomeDir(env), '.codex');
+}
+
+function piAgentDir(env = process.env) {
+  return env.PI_CODING_AGENT_DIR ? expandHome(env.PI_CODING_AGENT_DIR, env) : require('path').join(getHomeDir(env), '.pi', 'agent');
+}
+
 // `~/Documents/cv.pdf` -> absolute, so a model can pass the short form it was shown.
 function expandHome(file, env = process.env) {
   if (typeof file !== 'string') return file;
@@ -27,4 +35,4 @@ function tildify(file, env = process.env) {
   return typeof file === 'string' && file.startsWith(`${home}/`) ? `~/${file.slice(home.length + 1)}` : file;
 }
 
-module.exports = { getHomeDir, readEnv, expandHome, tildify };
+module.exports = { getHomeDir, codexHome, piAgentDir, readEnv, expandHome, tildify };