shakers-cli 0.17.0 → 0.18.0

package/src/onboarding-flow.js

@@ -249,7 +249,6 @@ function makeDeps(overrides = {}) {
   const ai = require('./ai');
   const inventory = require('./inventory-client');
   const auth = require('./auth-session-store');
-  const authClient = require('./auth-client');
   const signup = require('./signup-client');
   const livekit = require('./onboarding-livekit-client');
   return {
@@ -257,17 +256,14 @@ function makeDeps(overrides = {}) {
     sessionStatus: auth.sessionStatus,
     saveAuthSession: auth.saveAuthSession,
     ensureFreshSession: require('./session-refresh').ensureFreshSession,
-    getSignUpEndpoint: config.getSignUpEndpoint,
     getCompleteRegistrationEndpoint: config.getCompleteRegistrationEndpoint,
-    getLoginEndpoint: config.getLoginEndpoint,
     getAuthTokenEndpoint: config.getAuthTokenEndpoint,
     getDeviceAuthorizeEndpoint: config.getDeviceAuthorizeEndpoint,
     getDeviceTokenEndpoint: config.getDeviceTokenEndpoint,
     runDeviceLogin: require('./device-login').runDeviceLogin,
     requestCompleteRegistration: signup.requestCompleteRegistration,
     buildRegistrationContext: signup.buildRegistrationContext,
-    requestSignUp: signup.requestSignUp,
-    requestLogin: authClient.requestLogin,
+    buildRegistrationConsent: signup.buildRegistrationConsent,
     getImportProfileEndpoint: config.getImportProfileEndpoint,
     getProfessionalDetailsEndpoint: config.getProfessionalDetailsEndpoint,
     getPricingRateEndpoint: config.getPricingRateEndpoint,
@@ -305,7 +301,6 @@ function makeDeps(overrides = {}) {
   };
 }
 
-// Refreshes the email session's hub JWT from its stored cookie when the cached one has lapsed (session-refresh.js), then gates on the durable session status.
 async function requireActiveSession(deps) {
   const session = typeof deps.ensureFreshSession === 'function'
     ? await deps.ensureFreshSession(process.env, { loadAuthSession: deps.loadAuthSession, saveAuthSession: deps.saveAuthSession })
@@ -316,79 +311,26 @@ async function requireActiveSession(deps) {
   return { ok: true, session };
 }
 
-function isAcceptablePassword(password) {
-  return typeof password === 'string' && password.length >= 8;
-}
-
-async function signUp(deps, fields = {}) {
-  // The CLI no longer asks freelanceType at signup → transient default (corrected later from the work situation via professional-details).
-  if (!isAcceptablePassword(fields.password)) return { ok: false, reason: 'weak-password' };
-  const signUpEndpoint = deps.getSignUpEndpoint();
-  if (!signUpEndpoint) return { ok: false, reason: 'no-endpoint' };
-  const completeRegistrationEndpoint = typeof deps.getCompleteRegistrationEndpoint === 'function'
-    ? deps.getCompleteRegistrationEndpoint()
-    : null;
-  return deps.requestSignUp(
-    {
-      name: fields.name,
-      lastName: fields.lastName,
-      email: fields.email,
-      password: fields.password,
-      preferredLanguage: fields.preferredLanguage,
-      newsletterConsent: fields.newsletterConsent === true,
-      freelanceType: normalizeFreelanceType(fields.freelanceType) || DEFAULT_SIGNUP_FREELANCE_TYPE,
-      freelanceIntent: fields.freelanceIntent,
-      claimCode: fields.claimCode || null,
-    },
-    { signUpEndpoint, completeRegistrationEndpoint },
-  );
-}
-
-async function establishSessionFromCredentials(deps, { email, password } = {}) {
-  const signInEndpoint = deps.getLoginEndpoint();
-  if (!signInEndpoint) return { ok: false, reason: 'no-endpoint' };
-  const tokenEndpoint = typeof deps.getAuthTokenEndpoint === 'function' ? deps.getAuthTokenEndpoint() : null;
-  const result = await deps.requestLogin({ email, password }, { signInEndpoint, tokenEndpoint });
-  if (!result.ok) return { ok: false, reason: result.reason || 'login-failed', status: result.status || null };
-  try {
-    // For an email session the durable credential is the cookie; `accessToken` is
-    // the fresh JWT and `expiresAt` its own exp (stored as the refresh horizon).
-    deps.saveAuthSession({
-      accessToken: result.accessToken,
-      expiresAt: result.expiresAt,
-      accessTokenExpiresAt: result.expiresAt,
-      cookie: result.cookie || null,
-      cookieExpiresAt: result.cookieExpiresAt || null,
-      email: result.email || email || null,
-      hubAccessToken: result.hubAccessToken || null,
-    });
-  } catch {
-    return { ok: false, reason: 'session-persist-failed' };
-  }
-  return { ok: true };
-}
-
-// Register a talent via a social provider (device flow, RFC 8628); a live session results either way.
-async function registerWithSocialAccount(deps, { provider = 'google', freelanceType, language } = {}, { openBrowser, onAuthUrl } = {}) {
-  const { appendProviderParam, deviceSessionRecord } = require('./device-login');
+async function registerWithDeviceFlow(deps, { provider = 'email', freelanceType, language, newsletterConsent = false } = {}, { openBrowser, onAuthUrl } = {}) {
+  const { withDeviceParams, deviceSessionRecord } = require('./device-login');
   const authorizeEndpoint = deps.getDeviceAuthorizeEndpoint();
   const tokenEndpoint = deps.getDeviceTokenEndpoint();
   const authTokenEndpoint = typeof deps.getAuthTokenEndpoint === 'function' ? deps.getAuthTokenEndpoint() : null;
   const completeRegistrationEndpoint = typeof deps.getCompleteRegistrationEndpoint === 'function' ? deps.getCompleteRegistrationEndpoint() : null;
   if (!authorizeEndpoint || !tokenEndpoint || !authTokenEndpoint) return { ok: false, reason: 'no-endpoint' };
 
-  // freelanceType is a transient default (corrected later); feeds complete-registration for a new account.
   const registrationContext = deps.buildRegistrationContext({
     preferredLanguage: language,
-    newsletterConsent: false,
+    newsletterConsent: newsletterConsent === true,
     freelanceType: normalizeFreelanceType(freelanceType) || DEFAULT_SIGNUP_FREELANCE_TYPE,
   });
+  const consent = deps.buildRegistrationConsent({ newsletterConsent: newsletterConsent === true });
 
   const result = await deps.runDeviceLogin(
-    { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint, registrationContext },
+    { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint, registrationContext, consent },
     {
       onPrompt: ({ verificationUriComplete, userCode }) => {
-        const url = appendProviderParam(verificationUriComplete, provider);
+        const url = withDeviceParams(verificationUriComplete, { provider, mode: 'register', surface: 'cli' });
         if (typeof onAuthUrl === 'function') onAuthUrl(url, userCode);
         if (typeof openBrowser === 'function') { try { openBrowser(url); } catch { /* printed URL covers it */ } }
       },
@@ -402,7 +344,6 @@ async function registerWithSocialAccount(deps, { provider = 'google', freelanceT
     return { ok: false, reason: 'session-persist-failed' };
   }
 
-  // isNewUser distinguishes a fresh registration from signing an existing account in.
   return { ok: true, kind: result.isNewUser ? 'registered' : 'account-already-exists', email: result.email || null };
 }
 
@@ -697,58 +638,27 @@ async function runOnboarding(io, deps = makeDeps(), { method = 'email', openBrow
     return { ok: false, reason, step: 'signup' };
   };
 
-  if (method === 'google' || method === 'linkedin') {
-    // The provider supplies name/email; freelanceType is derived later from work situation.
-    await io.askGoogleSignUp(c);
-    const reg = await registerWithSocialAccount(
-      deps,
-      { provider: method, language: io.lang },
-      { openBrowser, onAuthUrl },
-    );
-    if (!reg.ok) {
-      io.error(c.signupError);
-      return accountFailed(reg.reason);
-    }
-    funnel.completed('account_creation', { auth_method: method, auth_attempts: 1, is_returning_account: reg.kind === 'account-already-exists' });
-    funnel.identified({ newAccount: reg.kind !== 'account-already-exists' });
-    if (reg.kind === 'account-already-exists') {
-      // Existing account: already signed in — stop, no wizard re-run.
-      io.warn(c.accountExists);
-      return { ok: true, alreadyRegistered: true };
-    }
-    notifyOk(io, c.accountReady);
-  } else {
-    const account = await io.askSignUp(c);
-    if (!account || !account.email) return accountFailed('missing-fields');
-    if (!isAcceptablePassword(account.password)) {
-      io.error(c.weakPassword);
-      return accountFailed('weak-password');
-    }
-
-    const su = await signUp(deps, { ...account, preferredLanguage: account.preferredLanguage || io.lang });
-    if (!su.ok) {
-      io.error(su.message || c.signupError);
-      return accountFailed(su.reason);
-    }
-
-    if (su.accountExists) {
-      // Existing account: sign them in, then STOP — no wizard re-run.
-      io.warn(c.accountExists);
-      const logged = await io.login(account.email);
-      if (!logged) return accountFailed('login-failed');
-      funnel.completed('account_creation', { auth_method: 'email', auth_attempts: 1, is_returning_account: true });
-      funnel.identified({ newAccount: false });
-      return { ok: true, alreadyRegistered: true };
-    }
-    const sess = await establishSessionFromCredentials(deps, { email: account.email, password: account.password });
-    if (!sess.ok) {
-      io.error(c.sessionError);
-      return accountFailed(sess.reason);
-    }
-    funnel.completed('account_creation', { auth_method: 'email', auth_attempts: 1, is_returning_account: false });
-    funnel.identified();
-    notifyOk(io, c.accountReady);
+  const terms = await io.askTerms(c);
+  if (!terms.accepted) {
+    io.warn(c.termsDeclined);
+    return accountFailed('terms-declined');
+  }
+  const reg = await registerWithDeviceFlow(
+    deps,
+    { provider: method, language: io.lang, newsletterConsent: terms.newsletterConsent },
+    { openBrowser, onAuthUrl },
+  );
+  if (!reg.ok) {
+    io.error(c.signupError);
+    return accountFailed(reg.reason);
+  }
+  funnel.completed('account_creation', { auth_method: method, auth_attempts: 1, is_returning_account: reg.kind === 'account-already-exists' });
+  funnel.identified({ newAccount: reg.kind !== 'account-already-exists' });
+  if (reg.kind === 'account-already-exists') {
+    io.warn(c.accountExists);
+    return { ok: true, alreadyRegistered: true };
   }
+  notifyOk(io, c.accountReady);
 
   io.section(c.title);
   funnel.viewed('import_sources', { sources_offered: ['linkedin', 'cv', 'github', 'web_page'] });
@@ -1044,15 +954,13 @@ async function runMainRoleFinalStep(io, deps, { onRolesShown } = {}) {
   }
 }
 
-// Overwrite-repeat: PATCH /interviews/onboarding/restart. Per contract the Bearer is
-// the talent hub JWT (same token roles use); falls back to accessToken when equal.
+// Overwrite-repeat: PATCH /interviews/onboarding/restart. Candidate certs JWT, like its onboarding siblings.
 async function restartOnboarding(deps) {
   const gate = await requireActiveSession(deps);
   if (!gate.ok) return gate;
   const endpoint = deps.getOnboardingRestartEndpoint();
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  const token = gate.session.hubAccessToken || gate.session.accessToken;
-  return deps.requestRestartOnboardingInterview({ accessToken: token }, { endpoint });
+  return deps.requestRestartOnboardingInterview({ accessToken: gate.session.accessToken }, { endpoint });
 }
 
 // `shakers onboarding --repeat`: warn + explicit confirm, then overwrite the prior
@@ -1144,7 +1052,6 @@ module.exports = {
   validatePricing,
   validateAvailability,
   buildPricingUpsert,
-  isAcceptablePassword,
   deriveCurrentEmploymentStatus,
   showsFreelanceOpinion,
   deriveFreelanceIntent,
@@ -1153,9 +1060,7 @@ module.exports = {
   validateLanguageRows,
   validatePhone,
   makeDeps,
-  signUp,
-  establishSessionFromCredentials,
-  registerWithSocialAccount,
+  registerWithDeviceFlow,
   startProfileImport,
   reattachConsentIdentity,
   saveWorkSituation,

package/src/opencode-sessions.js

@@ -0,0 +1,92 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { getHomeDir } = require('./env-paths');
+
+function loadSqlite() {
+  const emitWarning = process.emitWarning;
+  process.emitWarning = (warning, ...rest) => {
+    const type = typeof rest[0] === 'string' ? rest[0] : rest[0] && rest[0].type;
+    if (type === 'ExperimentalWarning' && /sqlite/i.test(String(warning))) return;
+    emitWarning.call(process, warning, ...rest);
+  };
+  try {
+    return require('node:sqlite');
+  } catch {
+    return null;
+  } finally {
+    process.emitWarning = emitWarning;
+  }
+}
+
+function opencodeDbPath(env = process.env) {
+  const dataDir = env.XDG_DATA_HOME
+    ? path.join(env.XDG_DATA_HOME, 'opencode')
+    : path.join(getHomeDir(env), '.local', 'share', 'opencode');
+  if (env.OPENCODE_DB) return path.isAbsolute(env.OPENCODE_DB) ? env.OPENCODE_DB : path.join(dataDir, env.OPENCODE_DB);
+  return path.join(dataDir, 'opencode.db');
+}
+
+const SESSIONS_SQL = 'SELECT id, directory, parent_id AS parentId, agent FROM session ORDER BY time_created DESC LIMIT ?';
+const MESSAGES_SQL = `SELECT id, time_created AS createdAt, json_extract(data, '$.role') AS role, json_extract(data, '$.agent') AS agent
+  FROM message WHERE session_id = ? ORDER BY time_created, id`;
+const PARTS_SQL = `SELECT p.message_id AS messageId, json_extract(p.data, '$.type') AS type, json_extract(p.data, '$.text') AS text,
+  json_extract(p.data, '$.tool') AS tool, json_extract(p.data, '$.synthetic') AS synthetic
+  FROM part p JOIN message m ON m.id = p.message_id WHERE m.session_id = ? ORDER BY p.id`;
+
+function isoOf(ms) {
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+}
+
+function sessionObjects(db, session) {
+  const parts = new Map();
+  for (const p of db.prepare(PARTS_SQL).all(session.id)) {
+    if (!parts.has(p.messageId)) parts.set(p.messageId, []);
+    parts.get(p.messageId).push(p);
+  }
+  const head = {};
+  if (typeof session.directory === 'string' && session.directory) head.cwd = session.directory;
+  if (session.agent === 'plan') head.planMode = true;
+  const objects = [head];
+  for (const m of db.prepare(MESSAGES_SQL).all(session.id)) {
+    const timestamp = isoOf(Number(m.createdAt));
+    const own = parts.get(m.id) || [];
+    if (m.agent === 'plan') head.planMode = true;
+    if (m.role === 'user') {
+      const text = own.filter((p) => p.type === 'text' && !p.synthetic && typeof p.text === 'string').map((p) => p.text).join('').trim();
+      if (text) {
+        objects.push({ type: 'user', timestamp, message: { role: 'user', content: [{ type: 'text', text }] } });
+        continue;
+      }
+    }
+    const uses = own.filter((p) => p.type === 'tool' && typeof p.tool === 'string' && p.tool).map((p) => ({ type: 'tool_use', name: p.tool }));
+    const o = timestamp ? { timestamp } : {};
+    if (uses.length) o.message = { role: 'assistant', content: uses };
+    if (o.timestamp || o.message) objects.push(o);
+  }
+  return objects;
+}
+
+function readOpencodeSessions(env, limit) {
+  const file = opencodeDbPath(env);
+  if (!fs.existsSync(file)) return [];
+  const sqlite = loadSqlite();
+  const Database = sqlite && (sqlite.DatabaseSync || sqlite.Database);
+  if (!Database) return [];
+  let db;
+  try {
+    db = new Database(file, { readOnly: true });
+    return db.prepare(SESSIONS_SQL).all(limit).map((session) => ({
+      file: `${file}#${session.id}`,
+      objects: sessionObjects(db, session),
+      subagent: Boolean(session.parentId),
+    }));
+  } catch {
+    return [];
+  } finally {
+    if (db) db.close();
+  }
+}
+
+module.exports = { readOpencodeSessions, opencodeDbPath };

package/src/profile-agents.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const { requestListAgents } = require('./agents-client');
+const { getAgentsListEndpoint } = require('./config');
+const { ensureFreshSession } = require('./session-refresh');
+
+const TALENT_ADDED_SOURCES = new Set(['DECLARED_BY_TALENT', 'CLI_DETECTED']);
+
+async function fetchProfileAgentNames(env = process.env, deps = {}) {
+  const {
+    refresh = ensureFreshSession,
+    list = requestListAgents,
+    endpoint = getAgentsListEndpoint(env),
+  } = deps;
+  try {
+    const session = await refresh(env);
+    if (!session || !session.hubAccessToken) return [];
+    const listed = await list({ accessToken: session.accessToken, hubAccessToken: session.hubAccessToken }, { endpoint });
+    if (!listed || !listed.ok || !Array.isArray(listed.agents)) return [];
+    return listed.agents.filter((a) => a && TALENT_ADDED_SOURCES.has(a.source) && a.name).map((a) => a.name);
+  } catch {
+    return [];
+  }
+}
+
+module.exports = { fetchProfileAgentNames, TALENT_ADDED_SOURCES };

package/src/saved-positions-flow.js

@@ -27,10 +27,10 @@ async function runToggleSave({ io, rawOut, session, catalog, mode, opts = {}, de
   }
   const positionId = resolved.id;
 
-  const label = mode === 'save' ? fp.saving : fp.unsaving;
-  const res = await io.withProgress(label, () => (mode === 'save'
+  const toggle = () => (mode === 'save'
     ? deps.savePosition({ hubAccessToken, positionId })
-    : deps.unsavePosition({ hubAccessToken, positionId })));
+    : deps.unsavePosition({ hubAccessToken, positionId }));
+  const res = opts.json ? await toggle() : await io.withProgress(mode === 'save' ? fp.saving : fp.unsaving, toggle);
   if (!res.ok) {
     io.error(res.reason === 'not-found' ? fp.notFound : fp.failed(res.reason));
     return { ok: false, reason: res.reason };

package/src/scanner.js

@@ -12,7 +12,8 @@ const { detectMcpServers, buildMcpAggregate } = require('./mcp-detector');
 const { analyzeMemoryStructure } = require('./memory-structure-detector');
 const { detectAutomations } = require('./automations-detector');
 const { detectBrowserTools } = require('./browser-tools-detector');
-const { getHomeDir } = require('./env-paths');
+const { getHomeDir, codexHome, piAgentDir } = require('./env-paths');
+const { OWN_SKILL_NAMES } = require('./cli-skill');
 
 /* ---------- existence-check utilities (existence only, never content) ---------- */
 
@@ -85,14 +86,30 @@ function resolveSignalPath(sig, root) {
 
 /* ---------- DEPTH probes: return ONLY numbers ---------- */
 
-function countDirEntries(p) {
+function countSkillDirs(p) {
   try {
-    return fs.readdirSync(p, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+    return fs.readdirSync(p, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && !e.name.startsWith('.') && !OWN_SKILL_NAMES.has(e.name)).length;
   } catch {
     return 0;
   }
 }
 
+function countFilesDeep(p, ext, depth = 3) {
+  let entries;
+  try {
+    entries = fs.readdirSync(p, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  let n = 0;
+  for (const e of entries) {
+    if (e.isFile() && e.name.endsWith(ext)) n += 1;
+    else if (e.isDirectory() && depth > 0) n += countFilesDeep(path.join(p, e.name), ext, depth - 1);
+  }
+  return n;
+}
+
 function countFiles(p, ext) {
   try {
     return fs.readdirSync(p).filter((f) => (ext ? f.endsWith(ext) : true)).length;
@@ -113,6 +130,49 @@ function countJsonKeys(file, key) {
   }
 }
 
+function claudeHooks(root) {
+  return (
+    countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks') +
+    countJsonKeys(path.join(root, '.claude', 'settings.local.json'), 'hooks') +
+    countJsonKeys(path.join(getHomeDir(), '.claude', 'settings.json'), 'hooks')
+  );
+}
+
+const TOML_HOOK_TABLE = /^\s*\[\[?\s*hooks\.([A-Za-z]+)/;
+
+function countTomlHookEvents(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return 0;
+  }
+  const events = new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    const m = TOML_HOOK_TABLE.exec(line);
+    if (m && m[1] !== 'state') events.add(m[1]);
+  }
+  return events.size;
+}
+
+function codexHooks(root) {
+  return [codexHome(), path.join(root, '.codex')].reduce(
+    (n, dir) => n + countJsonKeys(path.join(dir, 'hooks.json'), 'hooks') + countTomlHookEvents(path.join(dir, 'config.toml')),
+    0,
+  );
+}
+
+const CLINE_HOOK_TYPES = new Set(['TaskStart', 'TaskResume', 'TaskCancel', 'TaskComplete', 'PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'Notification', 'PreCompact']);
+
+function countClineHooks(dir) {
+  try {
+    return fs.readdirSync(dir, { withFileTypes: true })
+      .filter((e) => e.isFile() && CLINE_HOOK_TYPES.has(path.parse(e.name).name)).length;
+  } catch {
+    return 0;
+  }
+}
+
 /* ---------- config footprint: ONLY size in bytes and file count ---------- */
 /* No file name or path is ever stored: only numbers are aggregated.        */
 
@@ -273,17 +333,20 @@ const probes = {
   'claude-code': (root, ctx) => ({
     mcpServers: mcpCount(ctx, 'claude-code'),
     skills:
-      countDirEntries(path.join(root, '.claude', 'skills')) +
-      countDirEntries(path.join(os.homedir(), '.claude', 'skills')),
+      countSkillDirs(path.join(root, '.claude', 'skills')) +
+      countSkillDirs(path.join(getHomeDir(), '.claude', 'skills')),
     commands: countFiles(path.join(root, '.claude', 'commands'), '.md'),
     instructions: exists(path.join(root, 'CLAUDE.md')) ? 1 : 0,
-    hooks: countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks'),
+    hooks: claudeHooks(root),
   }),
   cursor: (root, ctx) => ({
     rules:
       countFiles(path.join(root, '.cursor', 'rules'), '.mdc') +
       (exists(path.join(root, '.cursorrules')) ? 1 : 0),
     mcpServers: mcpCount(ctx, 'cursor'),
+    hooks:
+      countJsonKeys(path.join(root, '.cursor', 'hooks.json'), 'hooks') +
+      countJsonKeys(path.join(getHomeDir(), '.cursor', 'hooks.json'), 'hooks'),
   }),
   'github-copilot': (root) => ({
     instructions: exists(path.join(root, '.github', 'copilot-instructions.md')) ? 1 : 0,
@@ -307,10 +370,41 @@ const probes = {
   'gemini-cli': (root, ctx) => ({
     instructions: exists(path.join(root, 'GEMINI.md')) ? 1 : 0,
     mcpServers: mcpCount(ctx, 'gemini-cli'),
+    commands:
+      countFilesDeep(path.join(root, '.gemini', 'commands'), '.toml') +
+      countFilesDeep(path.join(getHomeDir(), '.gemini', 'commands'), '.toml'),
+    hooks:
+      countJsonKeys(path.join(root, '.gemini', 'settings.json'), 'hooks') +
+      countJsonKeys(path.join(getHomeDir(), '.gemini', 'settings.json'), 'hooks'),
   }),
-  'codex-cli': (root) => ({
+  'codex-cli': (root, ctx) => ({
     instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+    mcpServers: mcpCount(ctx, 'codex-cli'),
+    skills: countSkillDirs(path.join(codexHome(), 'skills')),
+    commands: countFiles(path.join(codexHome(), 'prompts'), '.md'),
+    hooks: codexHooks(root),
   }),
+  cline: (root) => ({
+    hooks:
+      countClineHooks(path.join(root, '.clinerules', 'hooks')) +
+      countClineHooks(path.join(getHomeDir(), 'Documents', 'Cline', 'Hooks')),
+  }),
+  pi: (root, ctx) => ({
+    instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+    mcpServers: mcpCount(ctx, 'pi'),
+    skills: countSkillDirs(path.join(root, '.pi', 'skills')) + countSkillDirs(path.join(piAgentDir(), 'skills')),
+    commands: countFiles(path.join(root, '.pi', 'prompts'), '.md') + countFiles(path.join(piAgentDir(), 'prompts'), '.md'),
+  }),
+  opencode: (root, ctx) => {
+    const home = path.join(getHomeDir(), '.config', 'opencode');
+    const dirs = [path.join(root, '.opencode'), home];
+    return {
+      instructions: exists(path.join(root, 'AGENTS.md')) ? 1 : 0,
+      mcpServers: mcpCount(ctx, 'opencode'),
+      skills: dirs.reduce((n, d) => n + countSkillDirs(path.join(d, 'skills')) + countSkillDirs(path.join(d, 'skill')), 0),
+      commands: dirs.reduce((n, d) => n + countFiles(path.join(d, 'commands'), '.md') + countFiles(path.join(d, 'command'), '.md'), 0),
+    };
+  },
   trae: (root) => ({
     // Low confidence: `.trae/rules` structure not verified (see detectors.js).
     rules: countFiles(path.join(root, '.trae', 'rules')),
@@ -325,16 +419,14 @@ function agentOrgChartCounts(root, agentsCount, mcp) {
   return {
     agents: agentsCount,
     skills:
-      countDirEntries(path.join(root, '.claude', 'skills')) +
-      countDirEntries(path.join(home, '.claude', 'skills')),
+      countSkillDirs(path.join(root, '.claude', 'skills')) +
+      countSkillDirs(path.join(home, '.claude', 'skills')),
     commands:
       countFiles(path.join(root, '.claude', 'commands'), '.md') +
       countFiles(path.join(home, '.claude', 'commands'), '.md'),
     // The third copy of the MCP paths lived here.
     mcpServers: (mcp && typeof mcp.total === 'number' ? mcp.total : 0),
-    hooks:
-      countJsonKeys(path.join(root, '.claude', 'settings.json'), 'hooks') +
-      countJsonKeys(path.join(home, '.claude', 'settings.json'), 'hooks'),
+    hooks: claudeHooks(root),
   };
 }
 

package/src/session-gate.js

@@ -1,8 +1,5 @@
 'use strict';
 
-// Whether a non-exempt command may run: an active session, or a durable cookie
-// that can mint a fresh hub JWT right now. Reject only when neither holds.
-
 const { loadAuthSession, sessionStatus } = require('./auth-session-store');
 const { ensureFreshSession } = require('./session-refresh');
 
@@ -20,7 +17,7 @@ async function hasUsableSession(env = process.env, deps = {}) {
 
   const session = load(env);
   if (sessionStatus(session, now) === 'active') return true;
-  if (!session || (!session.cookie && !session.sessionToken)) return false;
+  if (!session || !session.sessionToken) return false;
 
   let refreshed = null;
   try { refreshed = await refresh(env, { now }); } catch { refreshed = null; }