shakers-cli 0.17.0 → 0.18.0

package/src/mcp-device-login-tools.js

@@ -1,5 +1,10 @@
 'use strict';
 
+const { askRegistrationTerms } = require('./mcp-choice');
+const { signupCopy } = require('./signup-copy');
+const { signupLanguage } = require('./signup-language');
+const { NOOP_FUNNEL } = require('./onboarding-funnel');
+
 // MCP: two provider-agnostic tools (start returns URL+user_code to relay VERBATIM; poll finishes). device_code stays in the local store, never in a result.
 
 const START_SCHEMA = {
@@ -9,6 +14,8 @@ const START_SCHEMA = {
     mode: { type: 'string', enum: ['login', 'register'], description: "Optional. 'login' signs an existing talent in; 'register' creates the account if new (the profile steps come from the register/onboarding tools afterwards). Defaults to 'login'." },
     freelanceType: { type: 'string', description: 'Optional, register only: FREELANCE | EMPLOYEE | AGENCY | POTENTIAL_FREELANCE. Used to complete a new account.' },
     preferredLanguage: { type: 'string', description: 'Optional, register only: es | en | it | pt | fr.' },
+    termsAnswer: { type: 'string', description: 'Register only: the option the talent picked when you printed the terms question this tool returned. Never set it yourself.' },
+    newsletterAnswer: { type: 'string', description: 'Register only: the option the talent picked when you printed the newsletter question this tool returned. Never set it yourself.' },
   },
 };
 
@@ -23,18 +30,30 @@ function makeDeviceLoginTools(deps = {}) {
     startDeviceLogin = require('./device-login').startDeviceLogin,
     pollDeviceToken = require('./device-login').pollDeviceToken,
     finalizeDeviceSession = require('./device-login').finalizeDeviceSession,
-    appendProviderParam = require('./device-login').appendProviderParam,
+    withDeviceParams = require('./device-login').withDeviceParams,
     deviceSessionRecord = require('./device-login').deviceSessionRecord,
     savePendingDevice = require('./device-auth-store').savePendingDevice,
     loadPendingDevice = require('./device-auth-store').loadPendingDevice,
     clearPendingDevice = require('./device-auth-store').clearPendingDevice,
     saveAuthSession = require('./auth-session-store').saveAuthSession,
     buildRegistrationContext = require('./signup-client').buildRegistrationContext,
+    buildRegistrationConsent = require('./signup-client').buildRegistrationConsent,
+    funnel = NOOP_FUNNEL,
   } = deps;
+  const lang = () => signupLanguage(deps.lang || 'en');
 
-  async function start(args = {}) {
+  async function start(args = {}, ctx = {}) {
     const mode = args.mode === 'register' ? 'register' : 'login';
     const provider = args.provider === 'linkedin' ? 'linkedin' : args.provider === 'email' ? 'email' : 'google';
+    let newsletterConsent = false;
+    if (mode === 'register') {
+      const terms = await askRegistrationTerms(ctx, { tool: 'social_signin_start', lang: lang(), termsAnswer: args.termsAnswer, newsletterAnswer: args.newsletterAnswer });
+      if (terms.reply) return terms.reply;
+      if (terms.declined) {
+        return { ok: false, status: 'terms-declined', relayVerbatim: signupCopy(lang()).termsDeclined, message: 'Print relayVerbatim word for word. No account was created and nothing was sent.' };
+      }
+      newsletterConsent = terms.newsletterConsent;
+    }
     const authorizeEndpoint = getDeviceAuthorizeEndpoint();
     const tokenEndpoint = getDeviceTokenEndpoint();
     const authTokenEndpoint = getAuthTokenEndpoint();
@@ -42,10 +61,15 @@ function makeDeviceLoginTools(deps = {}) {
       return { ok: false, reason: 'no-endpoint', message: 'No sign-in endpoint configured — set SHAKERS_CLI_HUB_BASE.' };
     }
 
+    if (mode === 'register') funnel.begin();
+    funnel.viewed('account_creation', { auth_methods_offered: [provider] });
     const authz = await startDeviceLogin({ authorizeEndpoint });
-    if (!authz.ok) return { ok: false, reason: authz.reason || 'authorize-failed' };
+    if (!authz.ok) {
+      funnel.errored('account_creation', authz.reason || 'authorize-failed');
+      return { ok: false, reason: authz.reason || 'authorize-failed' };
+    }
 
-    const verificationUrl = appendProviderParam(authz.verificationUriComplete, provider);
+    const verificationUrl = withDeviceParams(authz.verificationUriComplete, { provider, mode, surface: 'mcp' });
     const expiresAt = new Date(Date.now() + authz.expiresIn * 1000).toISOString();
     try {
       savePendingDevice({
@@ -59,7 +83,7 @@ function makeDeviceLoginTools(deps = {}) {
         mode,
         provider,
         registerContext: mode === 'register'
-          ? { freelanceType: args.freelanceType || null, preferredLanguage: args.preferredLanguage || null }
+          ? { freelanceType: args.freelanceType || null, preferredLanguage: args.preferredLanguage || null, newsletterConsent }
           : null,
       });
     } catch {
@@ -75,7 +99,8 @@ function makeDeviceLoginTools(deps = {}) {
       userCode: authz.userCode,
       expiresInSeconds: authz.expiresIn,
       pollIntervalSeconds: authz.interval,
-      message: `Show the talent this link and code so they can authorize in their own browser — relay both verbatim, do not invent or complete the code:\n\n${verificationUrl}\n\nCode: ${authz.userCode}\n\nThen call social_signin_poll; if it returns status "pending", wait pollIntervalSeconds and call it again.`,
+      relayVerbatim: signupCopy(lang()).windowLink(verificationUrl, authz.userCode),
+      message: 'Print relayVerbatim word for word (it holds the link and the code) — never invent or complete the code. Then call social_signin_poll; if it returns status "pending", wait pollIntervalSeconds and call it again.',
     };
   }
 
@@ -115,13 +140,16 @@ function makeDeviceLoginTools(deps = {}) {
     }
     if (res.status === 'denied') {
       clearPendingDevice();
+      funnel.errored('account_creation', 'device-denied');
       return { ok: false, status: 'denied', message: 'The talent cancelled or did not grant access. No session was started.' };
     }
     if (res.status === 'expired') {
       clearPendingDevice();
+      funnel.errored('account_creation', 'device-expired');
       return { ok: false, status: 'expired', message: 'The sign-in request expired. Call social_signin_start to try again.' };
     }
     if (res.status !== 'authorized') {
+      funnel.errored('account_creation', res.reason || 'poll-failed');
       return { ok: false, status: 'error', reason: res.reason || 'poll-failed' };
     }
 
@@ -129,7 +157,7 @@ function makeDeviceLoginTools(deps = {}) {
     const rc = pending.registerContext || {};
     const registrationContext = buildRegistrationContext({
       preferredLanguage: rc.preferredLanguage || undefined,
-      newsletterConsent: false,
+      newsletterConsent: rc.newsletterConsent === true,
       freelanceType: rc.freelanceType || 'POTENTIAL_FREELANCE',
     });
     const fin = await finalizeDeviceSession({
@@ -138,8 +166,10 @@ function makeDeviceLoginTools(deps = {}) {
       authTokenEndpoint: pending.authTokenEndpoint,
       completeRegistrationEndpoint: getCompleteRegistrationEndpoint(),
       registrationContext,
+      consent: pending.mode === 'register' ? buildRegistrationConsent({ newsletterConsent: rc.newsletterConsent === true }) : null,
     });
     if (!fin.ok) {
+      funnel.errored('account_creation', fin.reason);
       // The authorization was consumed; a re-poll can't recover — never treat this as logged in.
       clearPendingDevice();
       return { ok: false, status: 'error', reason: fin.reason };
@@ -152,6 +182,8 @@ function makeDeviceLoginTools(deps = {}) {
     }
 
     clearPendingDevice();
+    funnel.completed('account_creation', { auth_method: pending.provider || 'google', auth_attempts: 1, is_returning_account: !res.isNewUser });
+    if (funnel.active) funnel.identified({ newAccount: !!res.isNewUser });
     return { ok: true, status: 'authorized', method: pending.provider || 'google', email: res.email || null, isNewUser: !!res.isNewUser };
   }
 
@@ -160,7 +192,7 @@ function makeDeviceLoginTools(deps = {}) {
       name: 'social_signin_start',
       title: 'Sign in to Shakers',
       description: 'Opens a Shakers page in your browser where you sign in with Google, LinkedIn or your email. Your password never goes through the chat.',
-      guidance: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. Returns a verificationUrl and a userCode: show BOTH to the talent verbatim — they open the URL and enter the code in their own browser (they never type anything in the chat, and you never invent or fill the code). Pass mode 'register' to create the account if it is new. After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, ... }.",
+      guidance: "Begin sign-in (or registration) via the device flow — provider 'google' (default), 'linkedin' or 'email'. Email goes through the SAME web flow: the talent reuses their open Shakers session or signs in with their email on the page, never a password in the chat. With mode 'register' it first asks the talent to accept the Terms and Privacy Policy and whether they want the newsletter (a dialog, or `say` to print word for word; pass their picks back as termsAnswer and newsletterAnswer, never your own); a decline creates nothing. Returns relayVerbatim with the Shakers link and the code: print it word for word — they open the link, check the code matches and approve in their own browser (you never invent or fill the code). After showing them, call social_signin_poll. Returns { ok, status, provider, verificationUrl, userCode, pollIntervalSeconds, relayVerbatim, ... }.",
       inputSchema: START_SCHEMA,
       handler: start,
     },

package/src/mcp-install.js

@@ -10,9 +10,7 @@ const path = require('path');
 const { spawnSync } = require('child_process');
 const { buildServerInstructions } = require('./mcp-instructions');
 
-const SERVER_NAME = 'shakers';
-// The name the first published setup guide used.
-const LEGACY_SERVER_NAME = 'shakers-ai-usage';
+const { SERVER_NAME, LEGACY_SERVER_NAME } = require('./mcp-server-name');
 const FORWARDED_ENV = [
   'SHAKERS_PROFILE',
   'SHAKERS_CLI_CERTS_BASE',
@@ -306,7 +304,7 @@ function codexSkill() {
     '',
     '# Shakers',
     '',
-    'Every Shakers action is a tool of the `shakers` MCP server. They are deferred: they are not in your tool list, but `exec` has them as `tools.mcp__shakers__<name>` and lists them in `ALL_TOOLS` (filter by `name.startsWith(\'mcp__shakers__\')`). Never say you have no Shakers tools without checking `ALL_TOOLS`. The tool names below are those `<name>`s: to sign the talent up, call `tools.mcp__shakers__signup_start` first.',
+    'Every Shakers action is a tool of the `shakers` MCP server. They are deferred: they are not in your tool list, but `exec` has them as `tools.mcp__shakers__<name>` and lists them in `ALL_TOOLS` (filter by `name.startsWith(\'mcp__shakers__\')`). Never say you have no Shakers tools without checking `ALL_TOOLS`. The tool names below are those `<name>`s: to sign the talent up, call `tools.mcp__shakers__signup` with step "start" first, and every later sign-up step through it.',
     '',
     '## Server instructions',
     '',
@@ -318,7 +316,7 @@ function codexSkill() {
 function installCodexSkill({ env, homedir }) {
   const dir = path.join(codexHomeDir({ env, homedir }), 'skills', SERVER_NAME);
   fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(path.join(dir, 'SKILL.md'), codexSkill());
+  writeFileAtomic(path.join(dir, 'SKILL.md'), codexSkill(), 0o600);
 }
 
 const codexHomeDir = ({ env, homedir }) => env.CODEX_HOME || path.join(homedir, '.codex');
@@ -341,11 +339,17 @@ function vscodeUserDir({ platform, homedir, env }) {
   return path.join(homedir, '.config', 'Code', 'User');
 }
 
+function cliOnPath(spawn, bin) {
+  const probe = spawn(bin, ['--version'], { encoding: 'utf8' });
+  return !probe.error && probe.status === 0;
+}
+
+function codexDetected({ env, platform, homedir, spawn }) {
+  return fs.existsSync(codexHomeDir({ env, homedir })) || cliOnPath(spawn, 'codex') || chatgptAppInstalled({ platform, homedir });
+}
+
 function clientTable({ env, platform, homedir, spawn }) {
-  const hasCli = (bin) => {
-    const probe = spawn(bin, ['--version'], { encoding: 'utf8' });
-    return !probe.error && probe.status === 0;
-  };
+  const hasCli = (bin) => cliOnPath(spawn, bin);
   const jsonClient = (client, file, key, shape = (entry) => entry) => ({
     client,
     found: () => fs.existsSync(path.dirname(file)),
@@ -364,7 +368,7 @@ function clientTable({ env, platform, homedir, spawn }) {
     jsonClient('geminiCli', path.join(homedir, '.gemini', 'settings.json')),
     {
       client: 'codex',
-      found: () => fs.existsSync(codexHomeDir({ env, homedir })) || hasCli('codex') || chatgptAppInstalled({ platform, homedir }),
+      found: () => codexDetected({ env, platform, homedir, spawn }),
       install: (entry) => installIntoCodex(entry, { env, homedir }),
     },
     // VS Code keys servers under "servers" and wants the transport spelled out.
@@ -507,4 +511,4 @@ async function runMcpInstall({ args = [], out = (s) => process.stdout.write(s),
   return outcome;
 }
 
-module.exports = { installCodexSkill, removeTomlServers, tomlServerBlock, detectMcpClients, installMcpClients, stableNodePath, runMcpInstall, serverEntry, claudeDesktopConfigPath, SERVER_NAME, LEGACY_SERVER_NAME };
+module.exports = { askTerminal, cliOnPath, codexDetected, codexHomeDir, writeFileAtomic, installCodexSkill, removeTomlServers, tomlServerBlock, detectMcpClients, installMcpClients, stableNodePath, runMcpInstall, serverEntry, claudeDesktopConfigPath, SERVER_NAME, LEGACY_SERVER_NAME };

package/src/mcp-instructions.js

@@ -1,27 +1,53 @@
 'use strict';
 
-// The sign-up spans several tools and clients that load tool schemas lazily only see the first one, so the flow lives here; every talent-facing text comes from the tools, in the talent's language.
+const { SIGNUP_LANGUAGES, trustCopy } = require('./signup-copy');
+
+const HEADINGS = SIGNUP_LANGUAGES.map((lang) => `"${trustCopy(lang).heading}"`).join(' or ');
+
+// Claude Desktop shows the text a model writes before its first call of a turn, and the text that ends the turn; what it
+// writes between a call and the chat's question tool is folded away. So a step's own text reaches the model one answer
+// early, as `nextSay`, and the model writes it first in the talent's next turn, before any call, which then ends with
+// the question in the question tool. A text that only exists in that same turn comes whole as `say`, right after the
+// step's narration in the same first block of the result, with the question and its options numbered at its end, and
+// the talent answers by typing. The welcome comes as `say` too, as the tools load lazily and the first turn always
+// opens with a call, and ends with an open line the talent answers in their own words. A server cannot open that tool,
+// and the talent never sees tool results. Every answer repeats the rule, as client instructions may be dropped.
+const QUESTION_TOOL = 'your own tool for questions with clickable options (ask_user_input_v0 in claude.ai and Claude Desktop, AskUserQuestion in Claude Code and Cowork)';
+const SAY_RULE = "The talent does NOT see tool results. The first text of the result (the narration block, then `say`) is your whole message: write it word for word, with its line breaks, and end your turn there. In this step do NOT use your tool for questions with options and do not call any other tool until the talent answers.";
+// A question with the step's text, a short one without it, and an open question, whose `say` ends with what the talent answers by typing.
+const CHOICE_RULE = `${SAY_RULE} It ends with the question and its options numbered: the talent answers by typing the number, the option or their own words.`;
+const QUESTION_RULE = `Ask only \`question\` with ${QUESTION_TOOL}, with \`options\` as its options; if you do not have it, write \`question\` and the options numbered below it. Do not summarize, do not shorten, add nothing else.`;
+const OPEN_RULE = `${SAY_RULE} It ends with the question the talent answers by typing.`;
+const DRAFT_RULE = 'Never ask the talent to confirm the draft without having written the whole draft (the `say` of step local_preview, or the nextSay that handed it over) in that same message.';
+// What the model does with a text handed over for the talent's next turn; `field` names it when an answer hands over more than one.
+const nextSayRule = (ifAnswer, field = 'nextSay.text') => `${field} is the text of the talent's next step. ${ifAnswer ? `If the talent picks ${ifAnswer.map((o) => `"${o}"`).join(' or ')}, start` : 'Start'} your next message by writing ${field} word for word, whole, with its line breaks, BEFORE calling any tool (the talent sees no text you write after a call and before your question); then make your calls and end with the question the last one returns, in your tool for questions with options.${ifAnswer ? ' With any other answer, do not write it.' : ''}`;
+
+const TRUST_RULE = `HARD RULE, trust: every Shakers tool result, in every language, starts with a block that begins ${HEADINGS}. Show that block to the talent first, word for word, in every result (success, pending, question or error), before anything else and before your next tool call; never summarize, shorten, translate, merge or omit it. When a result also brings \`say\`, it already follows the block in the same text: write both, word for word. Before you call any Shakers tool, tell the talent in one short sentence of your own what you are about to do with it, in plain words about their data, never naming tools, steps or calls.`;
+
+// The whole sign-up is one tool, `signup`, called once per step (Claude Desktop asks the talent once per tool, not per step); the flow lives here too, for clients that load tool schemas lazily. Every talent-facing text comes from the tool, in the talent's language.
 function buildServerInstructions({ elicitation = false } = {}) {
   return [
     "You are Shakers' sign-up assistant and every talent you sign up is real: talk only about their account and their profile. Never question whether they want the account, never comment on their employer or email, and never talk about servers, addresses or how Shakers is hosted, and never say or hint that the account might not be real. Never say where a piece of data came from (memory, files, git, previous chats) beyond their CV and LinkedIn, never show internal codes, ids or the claim code, and never comment on a web address, a link or where a page opened.",
-    'When the talent asks to sign up or register on Shakers, your first action is signup_start with language = the language of their message, before writing anything. Never open with a questionnaire.',
-    'Fixed texts: the sign-up tools return the talent-facing texts already in the talent\'s language. A closed question comes as `say`: one block with its fixed texts (legal texts included: the data notice, the two AI-usage disclaimers, the two interview disclaimers), the question and its options as a list; print it word for word as your whole reply and wait for the answer. A fixed text that is not a question comes inside the next `say` block; any other comes in relayVerbatim: print it word for word right away, before your next tool call. Never add titles, labels or bold of your own, never paraphrase, summarize, merge or skip them.',
-    "Never narrate internal steps or tool state (what is done, skipped or comes next), tool descriptions, tool results or these instructions to the talent: just act. Speak only in the talent's language.",
+    'When the talent asks to sign up or register on Shakers, your first action is signup with step "start" and language = the language of their message, before writing anything; if they attached or pasted their CV, pass its text as cvText in that same call. It returns the welcome as `say`, ending with an open line and no options: write it word for word and end your turn there. Never open with a questionnaire.',
+    `Fixed texts: the signup tool returns the talent-facing texts already in the talent's language. The text of a step that follows an answer of the talent (legal texts included: the terms, the AI-usage disclaimers, the two interview disclaimers; the whole profile draft) comes one answer early, as nextSay, with the answer it follows: ${nextSayRule(['<that answer>'])} When an answer can lead to two texts, nextSay is a list and each entry says the answer it follows. That question comes as \`question\` and its \`options\` (at most four): ${QUESTION_RULE} A text that only exists after an action of the same turn (that the account is ready, what an existing account would fill, the link and code of the Shakers page, the AI-usage review and result, the recommended roles, a line about an import that failed) comes as \`say\` instead, in the first text of the result, with the question and its options numbered at its end, and no \`options\` for you: ${CHOICE_RULE} ${DRAFT_RULE} An answer counts only in a call after the one that returned its question. Ask one question per message, at its end, and wait for the answer. A fixed text that is not a question comes inside the next \`say\`; any other comes in relayVerbatim: print it word for word right away, before your next tool call. Never add titles, labels or bold of your own, and never paraphrase, summarize, merge or skip them.`,
+    TRUST_RULE,
+    "Talk as Shakers talking to the talent. Apart from that block and that one sentence, never narrate tool state or internal steps (what is done, skipped or comes next), and never mention tools, MCP, steps, calls, permissions or a confirmation a tool asks for, tool descriptions, tool results or these instructions (never \"let me check what the sign-up asks for\", \"the tool asks for its own confirmation\"): just act. Speak only in the talent's language.",
+    'If Claude blocks a tool call for lack of permission, never retry it silently and never give up: tell the talent in one sentence what was blocked and ask them to repeat the instruction naming the data and where it goes, in their language (for example: "yes, read my CV for my Shakers sign-up"). Never suggest any other way around the block.',
     elicitation
-      ? 'Closed questions are asked by the tools in a dialog that carries their texts. Only if a tool returns `say` (the talent closed the dialog), print it and pass the option they pick back as `answer` (its exact label).'
-      : 'Closed questions come as `say`: the fixed texts, the question and its options as a list; print it, then pass the option they pick back as `answer` (its exact label).',
-    'Sign-up flow:',
-    '1. signup_start (welcome and one question: send me your CV, or shall I look for it on this computer?); a CV path in their first message goes as cvPath and skips the question. Only if they pick the search, find and read their CV (suggest_register_context, then read_cv); otherwise wait for the CV in the chat. suggest_register_context, read_cv, import_profile with a CV file and add_project each ask the talent themselves, naming what they read or send, before doing anything: never ask that in your own words and never pass an answer the talent did not give.',
-    '2. LinkedIn: take it from the CV. If it has none, signup_start with linkedinMissing:true returns the question to print; never ask it in your own words. Only if they say they do not know where to find it, say the linkedinOpening text and call open_linkedin_profile.',
-    '3. signup_email with the best email you know (CV first), or none.',
-    '4. signup_draft with your draft of their profile (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate; sources: cv and/or linkedin, only those you have). It shows the draft, the data notice and how the account window works, and asks them to confirm; if they want changes, ask what and call it again.',
-    '5. Once confirmed, signup_create_account with LinkedIn, cvPath, names and userQuery = everything you know about them; the window opens by itself, so say nothing about it. Then signup_status (waitSeconds 45) until the account exists, and follow its message (a failed LinkedIn import: its fixed line comes with the next question; retry once, then ask for their website or GitHub).',
-    '6. New account: save_profile_details with the confirmed draft, without asking. Existing account (the talent signed in instead): update_existing_profile, which shows what would fill their empty fields and asks; nothing they already set is overwritten.',
-    '7. AI usage, a step of its own: ai_usage without consent asks the question with the two disclaimers; nothing is scanned before their yes. On yes it scans in the background and sends nothing. Then ai_usage_upload (waitSeconds 30) shows the talent what would be sent and what Shakers does with it, and asks; it uploads only on their own pick, and in the chat confirm:true only after they picked the upload option. If it answers scan-running, carry on and call it again right after the interview step. If they skip the analysis, its fixed line comes with the next question.',
-    '8. Onboarding interview: skip it if signup_status says it is completed; otherwise onboarding_interview_start without disclaimerAcknowledged (here now or later on the web, default here), then how they want to answer (drafted, own, full), asked with the interview disclaimers. In drafted mode, show each question verbatim with your proposed answer and send it only after the talent approves or edits it; only if they explicitly ask you to answer everything yourself ("hazla entera", "do it all"), complete the remaining questions without per-answer approval and tell them at the end. Full mode is that from the first question. Own mode sends only their words. Never call onboarding_finish in this flow.',
-    '9. Main role, also when they skip the interview: list_my_roles (waitSeconds 45, again while pending), then, only when its next is set_main_role, set_main_role without clusterId and with evidence = one concrete fact per recommended role from their CV, the interview or the AI-usage analysis (with nothing recommended: answer = the role their CV names and skills = their stack). Never set a main role the talent did not pick.',
+      ? 'Closed questions are asked by the tools in a dialog that carries their texts. Only if it returns the question for the chat (the talent closed the dialog), ask it as above and pass what the talent answers back as `answer` (the number, the option or their own words), calling the same step again.'
+      : 'Ask each closed question as above, then pass what the talent answers back as `answer` (the number, the option or their own words), calling the same step again.',
+    'Sign-up flow, every step a call to signup with that `step`, the interview included: from start to open_web you call no other tool (the onboarding_interview_* tools are only for repeating the interview after the sign-up). Each answer says the next step, a step out of order is refused with the one to call, and the waits happen inside the tool:',
+    '1. start (the welcome, ending with an open line: send me your CV and your LinkedIn, or I look for your CV on this computer); a CV path in their first message goes as cvPath and skips it, and a CV attached or pasted in the chat goes as cvText (its text as you see it, word for word): never run commands, code or other tools to read an attached file. The talent answers in their own words: call start again with answer = what they wrote, plus cvText, cvPath, linkedinUrl or search:true as it applies. Only if they ask for the search, find and read their CV (find_cv, then read_cv); otherwise use the CV they gave, or wait for it in the chat. find_cv, read_cv, import with a CV file and add_project each ask the talent themselves, naming what they read or send, before doing anything: never ask that in your own words and never pass an answer the talent did not give.',
+    '2. LinkedIn: take it from the CV. If it has none, start with linkedinMissing:true returns the question to print; never ask it in your own words. Only if they say they do not know where to find it, say the linkedinOpening text and run open_linkedin.',
+    '3. email with the best email you know (CV first), or none, and your draft of their profile in `preview` (the fields of step local_preview), so its answer brings the draft as nextSay.',
+    '4. local_preview with your draft of their profile in `preview` (name, role, city, years, stack, languages, work mode, hours, hourly and annual rate in euros, both always: the talent\'s figures with ratesFromTalent:true, else your estimate; sources: cv and/or linkedin, only those you have). It only shows it here and sends nothing: the whole draft (every field that will be sent) and the data notice, handed over as the nextSay of step email (or, when the email was typed or the draft changed, in its own `say`), and asks them to confirm, and nothing reaches Shakers before they confirm. If they want changes, ask what and run it again.',
+    '5. Once confirmed, create_account with LinkedIn, cvPath, names and userQuery = everything you know about them. It first asks the talent to accept the Terms (their text comes as the nextSay of the draft confirmation) and about the newsletter; pass each pick back as `answer`. If they decline, nothing is created. Then it returns as `say` how the account is created on the Shakers website, the link and the code: write it as your whole message and end your turn; the page also opens by itself. When the talent comes back, status until the account exists, and follow its message (a failed LinkedIn import: its fixed line comes with the next question; retry once, then ask for their website or GitHub).',
+    '6. New account: save_details with the confirmed draft as `details`, without asking. Existing account (the talent signed in instead): update_existing, which shows what would fill their empty fields and asks; nothing they already set is overwritten. That the account is ready comes with the next question.',
+    '7. AI usage, a step of its own: ai_usage without consent asks one short question; only if they say yes, its disclaimers come as the nextSay of that yes, written before the scan starts; nothing is scanned before their yes. On yes it scans in the background and sends nothing. Then ai_usage_upload shows the talent what would be sent and what Shakers does with it, and asks; it uploads only on their own pick, and in the chat confirm:true only after they picked the upload option. After the upload the result of the analysis comes with the next question. If it answers scan-running, carry on and run it again right after the interview step. If they skip the analysis, its fixed line comes as the nextSay of that skip.',
+    '8. Onboarding interview: skip it if status says it is completed; otherwise interview without disclaimerAcknowledged (here now or later on the web, default here), then how they want to answer (drafted, own, full), whose interview disclaimers come as the nextSay of the here-or-later question. In drafted mode, show each question verbatim with your proposed answer and send it only after the talent approves or edits it; only if they explicitly ask you to answer everything yourself ("hazla entera", "do it all"), complete the remaining questions without per-answer approval and tell them at the end. Full mode is that from the first question. Own mode sends only their words. Each answer goes through interview_turn until ended, then interview_complete. If it has to be done on the web, go on with nextStep: open_web at the end opens it. Never call onboarding_finish in this flow.',
+    '9. Main role, also when they skip the interview: roles (again while pending), then, only when its next is set_main_role, set_main_role without clusterId and with evidence = one concrete fact per recommended role from their CV, the interview or the AI-usage analysis (with nothing recommended: answer = the role their CV names and skills = their stack). Each recommended role comes numbered with why it fits, and the question at the end; the talent types the number or the role, and if they type another role instead, pass what they type as answer. Never set a main role the talent did not pick.',
     '10. Finish with open_web: it opens Shakers with the talent signed in.',
   ].join('\n');
 }
 
-module.exports = { buildServerInstructions };
+module.exports = { buildServerInstructions, nextSayRule, SAY_RULE, CHOICE_RULE, QUESTION_RULE, OPEN_RULE, DRAFT_RULE, TRUST_RULE };

package/src/mcp-onboarding-tools.js

@@ -59,7 +59,6 @@ const ADD_PROJECT_SCHEMA = {
 
 function makeOnboardingTools(deps = {}) {
   const {
-    getLoginEndpoint = require('./config').getLoginEndpoint,
     clearAuthSession = require('./auth-session-store').clearAuthSession,
     getUsageDiscoveredInventoryEndpoint = require('./config').getUsageDiscoveredInventoryEndpoint,
     getSkillsDeclareEndpoint = require('./config').getSkillsDeclareEndpoint,
@@ -69,7 +68,6 @@ function makeOnboardingTools(deps = {}) {
     getPortfoliosListEndpoint = require('./config').getPortfoliosListEndpoint,
     getPortfolioUpdateEndpoint = require('./config').getPortfolioUpdateEndpoint,
     getAgentPortfoliosEndpoint = require('./config').getAgentPortfoliosEndpoint,
-    requestLogin = require('./auth-client').requestLogin,
     saveAuthSession = require('./auth-session-store').saveAuthSession,
     loadAuthSession = require('./auth-session-store').loadAuthSession,
     sessionStatus = require('./auth-session-store').sessionStatus,
@@ -362,7 +360,7 @@ function makeOnboardingTools(deps = {}) {
       name: 'add_project',
       title: 'Add this project to your portfolio',
       description: 'Reads the name of the project folder open here, the web address of its code and the dates of its first and last change. It asks you first, naming all of them, and only then sends them to Shakers as a new portfolio project.',
-      guidance: "Add the current repository to the talent's Shakers portfolio as a project. Name and URL default to the repo directory and its git remote, and the start/end dates are derived from the repo's git history. Optionally pass clientName and clientDomain (the client's website/domain, e.g. 'acme.com' — Shakers fetches the client logo from it). The tool asks the talent first, naming the folder, web address, dates and client it will send (a dialog when the client has one, otherwise it returns `say` to print word for word as your whole reply); nothing is sent until they answer yes. After a `say`, call it again with the same arguments and answer set to the option they pick. Never answer for them. Requires an active session. Any ids/codes in the result are internal handles for tools only — never show or mention them to the talent.",
+      guidance: "Add the current repository to the talent's Shakers portfolio as a project. Name and URL default to the repo directory and its git remote, and the start/end dates are derived from the repo's git history. Optionally pass clientName and clientDomain (the client's website/domain, e.g. 'acme.com' — Shakers fetches the client logo from it). The tool asks the talent first, naming the folder, web address, dates and client it will send (a dialog when the client has one, otherwise it returns the question to ask as its message says); nothing is sent until they answer yes. After asking it in the chat, call it again with the same arguments and answer set to the option they pick. Never answer for them. Requires an active session. Any ids/codes in the result are internal handles for tools only — never show or mention them to the talent.",
       inputSchema: ADD_PROJECT_SCHEMA,
       handler: addProject,
     },

package/src/mcp-prompts.js

@@ -4,8 +4,10 @@
 // telling the assistant which Shakers tool(s) to use — the logic stays in the tools, so
 // there is no duplication. `buildMessages(args)` returns the prompts/get message list.
 
+const TRUST_RULE = 'Every Shakers tool result starts with a "What Shakers does in this step" block (in Spanish: "Qué hace Shakers en este paso"): show it to me word for word and first, every time, never summarized or skipped, and tell me in one short sentence before each Shakers tool call what you are about to do.';
+
 function userText(text) {
-  return [{ role: 'user', content: { type: 'text', text } }];
+  return [{ role: 'user', content: { type: 'text', text: `${text} ${TRUST_RULE}` } }];
 }
 
 // Only reference tools that exist in the FULL server; `available(toolNames)` hides a prompt
@@ -21,10 +23,10 @@ const PROMPTS = [
   },
   {
     name: 'onboarding',
-    description: 'Sign up on Shakers from this chat: your CV and LinkedIn, a password or Google, and your profile filled in for you.',
-    tools: ['signup_start'],
+    description: 'Sign up on Shakers from this chat: your CV and LinkedIn, an account created on the Shakers website (Google, LinkedIn or email), and your profile filled in for you.',
+    tools: ['signup'],
     buildMessages: (_args, lang) => userText(
-      `Sign me up on Shakers following the sign-up flow in your Shakers instructions. Start with \`signup_start\` (language: the one I write in; "${lang}" if I have not written anything yet) and show me its texts word for word. Ask me only the questions the tools return, with their options, and nothing you can infer. Never narrate internal steps or tool state to me, and speak only in my language.`,
+      `Sign me up on Shakers following the sign-up flow in your Shakers instructions. Start with \`signup\` (step: start, language: the one I write in; "${lang}" if I have not written anything yet) and run every sign-up step through it, the interview included, without calling any other tool; show me its texts word for word. Ask me only the questions the tools return, with their options, and nothing you can infer. Apart from those blocks, never narrate internal steps or tool state to me, and speak only in my language.`,
     ),
   },
   {

package/src/mcp-register-tools.js

@@ -2,10 +2,11 @@
 
 const { TranscriptBuffer } = require('./interview-transcript');
 const path = require('path');
-const { askChoice, askConsent } = require('./mcp-choice');
+const { askChoice, askConsent, forChat, handOver, settle, withNextSay } = require('./mcp-choice');
 const { expandHome, tildify } = require('./env-paths');
 
 const ANSWER_MODES = ['drafted', 'own', 'full'];
+const WHERE_QUESTION = 'interview:where';
 
 const INTERVIEW_START_SCHEMA = {
   type: 'object',
@@ -123,10 +124,14 @@ function makeRegisterTools(deps = {}) {
     return { ok: false, reason: 'interview-later', message: 'The talent does the interview later on the web: skip it here and go on with the main role, then open_web.' };
   }
 
+  // The talent's answer to the interview disclaimers counts only after they went to the chat with the answer-mode question.
+  let disclaimersShown = false;
+
   async function askWhere(args, ctx) {
+    const c = copy();
+    if (args.where === 'here' || args.where === 'later') settle(WHERE_QUESTION, args.where === 'here' ? c.interviewHere : c.interviewLater);
     if (args.where === 'here') return { here: true };
     if (args.where === 'later') return { here: false };
-    const c = copy();
     const asked = await askChoice(ctx, { question: c.interviewWhereQuestion, options: [c.interviewHere, c.interviewLater] });
     if (asked.answer) return { here: asked.answer === c.interviewHere };
     return { chat: asked.chat, dismissed: asked.dismissed };
@@ -160,30 +165,35 @@ function makeRegisterTools(deps = {}) {
     if (!CHAT_INTERVIEW_LANGUAGES.has(textLang())) {
       return { ok: false, reason: 'interview-on-web', relayVerbatim: copy().interviewOnWeb, message: 'Print relayVerbatim word for word now. The interview is not offered here in this language: skip it, go on with the main role, then open_web.' };
     }
-    const acknowledged = args.disclaimerAcknowledged === true;
+    const acknowledged = args.disclaimerAcknowledged === true && disclaimersShown;
+    // One acknowledgement per interview: the next one shows its disclaimers again.
+    if (acknowledged) disclaimersShown = false;
     if (!acknowledged) {
       track(() => funnel.viewed('pre_interview'));
       const where = await askWhere(args, ctx);
       if (where.here === false) return interviewLater();
       if (where.chat) {
-        return {
+        // "Here" leads to the answer-mode question, whose disclaimers go to the model now.
+        const disclaimers = handOver(WHERE_QUESTION, { step: 'interview', ifAnswer: [copy().interviewHere], texts: Object.values(flow.interviewDisclaimers(textLang())) });
+        return withNextSay({
           ok: false,
           reason: 'where-required',
           ...(where.dismissed ? { dismissed: where.dismissed } : {}),
-          ...where.chat,
+          ...forChat(where.chat),
           message: `${where.chat.choiceMessage} Then call onboarding_interview_start again with where:"here" for the first option or where:"later" for the second.`,
-        };
+        }, disclaimers);
       }
     }
     // The two disclaimers travel with the answer-mode question, so they are read before the talent answers it.
     const disclaimers = acknowledged ? [] : Object.values(flow.interviewDisclaimers(textLang()));
     const answer = await askAnswerMode(acknowledged ? args : {}, ctx, disclaimers);
     if (answer.chat) {
+      if (disclaimers.length) disclaimersShown = true;
       return {
         ok: false,
         reason: 'answer-mode-required',
         ...(answer.dismissed ? { dismissed: answer.dismissed } : {}),
-        ...answer.chat,
+        ...forChat(answer.chat),
         message: `${answer.chat.choiceMessage} Then call onboarding_interview_start again with where:"here", disclaimerAcknowledged:true and answerMode: drafted for the first option, own for the second, full for the third.`,
       };
     }
@@ -283,7 +293,7 @@ function makeRegisterTools(deps = {}) {
       return { ok: false, reason: 'unknown-interview', message: 'No live interview for that interviewId (the server may have restarted). Nothing to complete; start again if the talent still wants the interview.' };
     }
     const saved = await teardownInterview(args.interviewId, { persist: true });
-    if (!saved.ok) return { ok: false, reason: saved.reason || 'complete-failed' };
+    if (!saved.ok) return { ok: false, reason: saved.reason || 'complete-failed', message: 'The interview could not be saved: it stays pending and the talent can take it later on the web. Do not retry it; go on with the main role (list_my_roles, then set_main_role).' };
     lastCompletedInterview = { interviewId: args.interviewId, completedAt: Date.now() };
     track(() => funnel.completed('interview', { interview_mode: 'text' }));
     return { ok: true, state: 'taken', message: catalog.interviewComplete };
@@ -325,7 +335,7 @@ function makeRegisterTools(deps = {}) {
   // Content-free context the model may PROPOSE to the talent (never auto-write), searched only after the talent says yes.
   async function suggestContext(args = {}, ctx = {}) {
     const c = copy().consent;
-    const asked = await askConsent(ctx, { tool: 'suggest_register_context', key: 'suggest_register_context', question: c.cvSearch, yes: c.yes, no: c.no, answer: args.answer });
+    const asked = await askConsent(ctx, { tool: 'suggest_register_context', key: 'suggest_register_context', question: c.cvSearch, yes: c.cvSearchYes, no: c.no, answer: args.answer });
     if (asked.reply) return asked.reply;
     if (!asked.granted) return { ok: false, reason: 'consent-declined', message: 'The talent said no: nothing was searched. Do not look for the CV on this computer; ask them to attach it in the chat.' };
     const read = deps.readRegisterContextSuggestions || require('./register-context').readRegisterContextSuggestions;
@@ -346,11 +356,12 @@ function makeRegisterTools(deps = {}) {
     if (typeof args.path !== 'string' || !args.path.trim()) return { ok: false, reason: 'cv-not-found', message: 'Pass the path of the CV file.' };
     const file = path.resolve(expandHome(args.path.trim()));
     const c = copy().consent;
-    const asked = await askConsent(ctx, { tool: 'read_cv', key: `read_cv:${file}`, question: c.cvRead(tildify(file)), yes: c.yes, no: c.no, answer: args.answer });
+    const asked = await askConsent(ctx, { tool: 'read_cv', key: `read_cv:${file}`, question: c.cvRead(tildify(file)), yes: c.cvReadYes(path.basename(file)), no: c.no, answer: args.answer });
     if (asked.reply) return asked.reply;
     if (!asked.granted) return { ok: false, reason: 'consent-declined', message: 'The talent said no: the file was not read. Do not read it; ask them to attach their CV in the chat or tell you what it says.' };
     const read = deps.readCvText || require('./cv-text').readCvText;
     const result = read(file, { talentName: args.talentName });
+    if (!result.ok && result.reason === 'not-found') return { ...result, message: 'That file is not on this computer. If the talent attached their CV to this chat, use the text you see there: in the sign-up pass it as cvText to signup_start, with the answer they gave. Never run commands, code or other tools to read an attached file.' };
     if (!result.ok) return { ...result, message: 'Could not read the CV text here. Ask the talent to attach the CV to the chat, or to tell you what it says.' };
     // Someone else's CV (a candidate they downloaded): never hand its contents over.
     if (result.mentionsTalent === false) return { ok: true, mentionsTalent: false, note: "This CV does not name the talent: it belongs to someone else. Do not use, quote or describe it; try the next candidate." };
@@ -362,7 +373,7 @@ function makeRegisterTools(deps = {}) {
       name: 'suggest_register_context',
       title: 'Look for your CV on this computer',
       description: 'Asks you first, then lists the names of PDF and Word files in your Desktop, Documents, Downloads and iCloud Drive folders that look like a CV and reads your time zone and the name, email and GitHub user saved by your coding tools. It does not open those files or send anything.',
-      guidance: "SUGGESTIONS for the sign-up read on this machine (no network, no file contents): timezone, git name/email, the gh CLI GitHub login, and cvCandidates: PDF/DOC/DOCX files in Desktop, Documents, Downloads and iCloud Drive whose NAME looks like a CV or carries the talent's name, each with nameMatch (null when their name is unknown) and generic flags. A candidate is only a lead (people who hire keep other people's CVs): confirm it with read_cv. Pass talentName to sharpen the match. The tool asks the talent first (a dialog when the client has one, otherwise it returns `say` to print word for word as your whole reply); nothing is searched until they answer yes. After a `say`, call it again with answer set to the option they pick. Never answer for them.",
+      guidance: "SUGGESTIONS for the sign-up read on this machine (no network, no file contents): timezone, git name/email, the gh CLI GitHub login, and cvCandidates: PDF/DOC/DOCX files in Desktop, Documents, Downloads and iCloud Drive whose NAME looks like a CV or carries the talent's name, each with nameMatch (null when their name is unknown) and generic flags. A candidate is only a lead (people who hire keep other people's CVs): confirm it with read_cv. Pass talentName to sharpen the match. The tool asks the talent first (a dialog when the client has one, otherwise it returns the question to ask as its message says); nothing is searched until they answer yes. After asking it in the chat, call it again with answer set to the option they pick. Never answer for them.",
       inputSchema: { type: 'object', properties: { talentName: { type: 'string', description: "The talent's full name as you know it (memory, chat); improves CV matching." }, answer: { type: 'string', description: 'The option the talent picked when you printed the question this tool returned. Never set it yourself.' } } },
       handler: suggestContext,
     },
@@ -370,7 +381,7 @@ function makeRegisterTools(deps = {}) {
       name: 'read_cv',
       title: 'Read your CV',
       description: 'Asks you first, then reads the text of the CV file you allow to prepare your profile draft. This step sends nothing to Shakers.',
-      guidance: "Read the TEXT of a CV file (PDF, DOC, DOCX) on this machine, with talentName set. The tool asks the talent first, naming the file (a dialog when the client has one, otherwise it returns `say` to print word for word as your whole reply); nothing is read until they answer yes. After a `say`, call it again with the same path and answer set to the option they pick. Never answer for them. Returns { mentionsTalent, links: { linkedin, github, emails, phones }, text } for the talent's own CV; a CV that does not name them returns only mentionsTalent:false: it is someone else's, drop it, never describe it, try the next candidate. Nothing is uploaded by this tool: pass the confirmed path to signup_start (or import_profile) as cvPath, use the text for userQuery and the email, and links.linkedin as their LinkedIn URL.",
+      guidance: "Read the TEXT of a CV file (PDF, DOC, DOCX) on this machine, with talentName set. The tool asks the talent first, naming the file (a dialog when the client has one, otherwise it returns the question to ask as its message says); nothing is read until they answer yes. After asking it in the chat, call it again with the same path and answer set to the option they pick. Never answer for them. Returns { mentionsTalent, links: { linkedin, github, emails, phones }, text } for the talent's own CV; a CV that does not name them returns only mentionsTalent:false: it is someone else's, drop it, never describe it, try the next candidate. Nothing is uploaded by this tool: pass the confirmed path to signup_start (or import_profile) as cvPath, use the text for userQuery and the email, and links.linkedin as their LinkedIn URL.",
       inputSchema: {
         type: 'object',
         properties: {
@@ -386,7 +397,7 @@ function makeRegisterTools(deps = {}) {
       name: 'onboarding_interview_start',
       title: 'Start your onboarding interview',
       description: 'Starts the short Shakers interview here in the chat, after asking you where and how you want to answer it. Your answers go to Shakers to get to know your profile.',
-      guidance: "Start the onboarding interview, here in the chat. Offer it only when signup_status says onboardingInterview.completed is not true. Call it first without disclaimerAcknowledged: it asks 'here now or later on the web?' (in a dialog when the client has one, otherwise it returns `say` to print word for word; default here), then how they want to answer, with the two interview disclaimers in that same question. reason 'interview-later' means they chose the web: skip the interview. reason 'interview-on-web' (a sign-up language the chat interview does not speak) is the same: print relayVerbatim and skip it. If it returns reason 'interview-already-started' (begun elsewhere and not finished), call open_web so they continue on the web. It runs over LiveKit and the server agent conducts it; the client does not decide its branch. When it returns `say`, print it word for word as your whole reply (it holds the disclaimers and the question) and, once they answer, call with where:'here', disclaimerAcknowledged:true and answerMode. Returns { interviewId, answerMode, greeting, ended }: relay the greeting VERBATIM, then drive it with onboarding_interview_turn. ANSWER MODES. For drafted and full, first gather everything you know (memory, a search of past conversations if you have that tool, their CV, the ai_usage report, the sign-up data) and show ONE short sheet 'esto es lo que se de ti' (roles and projects with concrete facts, stack, languages, what they want next); let them correct it once; those corrections override your memory. Your answers are first person, one or two short sentences in their plain voice, built only from facts on the confirmed sheet: no embellishment, no adjectives, metrics or claims they did not give, no repeating a fact already said unless asked; for wishes, preferences or opinions give your best guess and say it is a guess. (1) drafted: show each question VERBATIM with your proposed answer and send it only after the talent approves or edits it; if the sheet does not cover a question, ask them briefly instead of guessing. Only if the talent explicitly asks you to answer everything yourself (for example 'hazla entera' or 'contéstalas tú todas'), answer the remaining questions without asking for each approval, as in full. (2) full (they chose it, or asked for it as above): answer every question yourself without per-answer approval, still showing each question and your answer, and when the interview ends tell them in one line that you answered those questions yourself. (3) own: you are a pure CONDUIT: show every question VERBATIM and pass back only their REAL, VERBATIM words. In every mode never reword, summarize or translate the questions. `interviewId` is internal: never show it. If it fails with next:'open_web', print relayVerbatim word for word and call open_web so they do the interview on the web.",
+      guidance: "Start the onboarding interview, here in the chat. Offer it only when signup_status says onboardingInterview.completed is not true. Call it first without disclaimerAcknowledged: it asks 'here now or later on the web?' (in a dialog when the client has one, otherwise it returns the question to ask as its message says; default here), then how they want to answer, with the two interview disclaimers in that same question. reason 'interview-later' means they chose the web: skip the interview. reason 'interview-on-web' (a sign-up language the chat interview does not speak) is the same: print relayVerbatim and skip it. If it returns reason 'interview-already-started' (begun elsewhere and not finished), call open_web so they continue on the web. It runs over LiveKit and the server agent conducts it; the client does not decide its branch. When it returns a question, ask it as its message says (its `say` holds the disclaimers) and, once they answer, call with where:'here', disclaimerAcknowledged:true and answerMode. Returns { interviewId, answerMode, greeting, ended }: relay the greeting VERBATIM, then drive it with onboarding_interview_turn. ANSWER MODES. For drafted and full, first gather everything you know (memory, a search of past conversations if you have that tool, their CV, the ai_usage report, the sign-up data) and show ONE short sheet 'esto es lo que se de ti' (roles and projects with concrete facts, stack, languages, what they want next); let them correct it once; those corrections override your memory. Your answers are first person, one or two short sentences in their plain voice, built only from facts on the confirmed sheet: no embellishment, no adjectives, metrics or claims they did not give, no repeating a fact already said unless asked; for wishes, preferences or opinions give your best guess and say it is a guess. (1) drafted: show each question VERBATIM with your proposed answer and send it only after the talent approves or edits it; if the sheet does not cover a question, ask them briefly instead of guessing. Only if the talent explicitly asks you to answer everything yourself (for example 'hazla entera' or 'contéstalas tú todas'), answer the remaining questions without asking for each approval, as in full. (2) full (they chose it, or asked for it as above): answer every question yourself without per-answer approval, still showing each question and your answer, and when the interview ends tell them in one line that you answered those questions yourself. (3) own: you are a pure CONDUIT: show every question VERBATIM and pass back only their REAL, VERBATIM words. In every mode never reword, summarize or translate the questions. `interviewId` is internal: never show it. If it fails with next:'open_web', print relayVerbatim word for word and call open_web so they do the interview on the web.",
       inputSchema: INTERVIEW_START_SCHEMA,
       handler: interviewStart,
       available: async () => {
@@ -409,7 +420,7 @@ function makeRegisterTools(deps = {}) {
       name: 'onboarding_interview_complete',
       title: 'Finish the interview',
       description: 'Closes the interview and saves it on Shakers.',
-      guidance: "Close the onboarding interview once the turns report ended:true: the buffered transcript is saved and the live room is disconnected. `interviewId` is internal: never show it. Returns { state:'taken' }. If it returns reason 'unknown-interview' the room was already gone (server restart): nothing to complete. In the sign-up flow, go on to the main role (list_my_roles with waitSeconds, then set_main_role) and finish with open_web; do NOT call onboarding_finish there.",
+      guidance: "Close the onboarding interview once the turns report ended:true, or earlier when the talent asks to end it: the buffered transcript is saved and the live room is disconnected. `interviewId` is internal: never show it. Returns { state:'taken' }. If it returns reason 'unknown-interview' the room was already gone (server restart): nothing to complete. In the sign-up flow, go on to the main role (signup step \"roles\", then signup step \"set_main_role\") and finish with signup step \"open_web\"; do NOT call onboarding_finish there.",
       inputSchema: INTERVIEW_COMPLETE_SCHEMA,
       handler: interviewComplete,
     },