shakers-cli 0.17.0 → 0.19.0

package/README.md

@@ -69,11 +69,21 @@ Run `shakers` with no command to see every command.
   can leave out agents and text excerpts there. `--consent-revoke` stops future uploads
   from this computer; it does not delete what was already uploaded. To ask for that, write
   to talent@shakersworks.com.
-- What is saved is mostly derived data (counts, categories, tier, detected technologies).
-  Two kinds of text travel too, and the review shows how many: the definition text of your
-  AI agents and short excerpts of what you ask the AI (200 characters at most), both with
-  secrets, paths and emails removed. Never your code, your full conversations, the names of
-  your repositories, environment variables or credentials.
+- What is sent is mostly derived data (counts, categories, tier, detected technologies,
+  sessions, active days, commits and lines changed). Literal text travels too, and the review
+  shows how much: up to 40 fragments of your messages to AI assistants and 20 commands they
+  ran (200 characters at most each), and the definition (up to 2,000 characters) and short
+  description of each of your AI agents, all after removing anything that looks like a
+  secret, a path or an email. The fragments come from the conversations in the repositories
+  analysed, or from every conversation on this computer when you analyse the whole machine
+  (registration always does). Never your code, your full conversations, the names of your
+  repositories, environment variables or credentials.
+- An AI model from an external provider (OpenAI, Google or Anthropic) analyses that text
+  automatically for Shakers to compute your evaluation, and then it is discarded. Only the result is stored: levels, scores, counts and the names
+  of your tools and agents.
+- Do not run it on a machine or with conversations that hold information you are not
+  allowed to share: client, employer or third-party data. Secret removal is automatic and
+  best effort; names or business details you wrote can remain in the fragments.
 - Certification sends secret-scrubbed samples of your code and your interview answers to
   Shakers to assess them.
 - Read the full policy at <https://www.shakersworks.com/en/politica-de-privacidad>.

package/bin/add-agent.js

@@ -11,19 +11,21 @@ const VALID_LANGS = new Set(['es', 'en']);
 
 const COPY = {
   es: {
-    help: 'add-agent — añade a tu perfil de Talento un agente de tu inventario descubierto. Uso: add-agent [--lang es|en] [--accept-disclaimer]',
+    help: 'add-agent — añade a tu perfil de Talento un agente de tu inventario descubierto, o todos los nuevos con --all. Uso: add-agent [--all [--yes]] [--lang es|en] [--accept-disclaimer]',
     gate: '"add-agent" requiere una sesión activa.\n  Falta: iniciar sesión. Ejecuta primero: shakers login',
     missingAccept: 'Modo no interactivo: falta --accept-disclaimer.\n  add-agent es un flujo interactivo (elegir agente, editar campos) y su borrado por IA envía datos.\n  Reejecuta con --accept-disclaimer, aportando las respuestas por stdin.',
+    missingYes: 'Modo no interactivo: falta --yes.\n  add-agent --all añade a tu perfil todos los agentes detectados que aún no tienes.\n  Reejecuta con --all --yes para confirmarlo sin terminal.',
   },
   en: {
-    help: 'add-agent — add an agent from your discovered inventory to your Talent profile. Usage: add-agent [--lang es|en] [--accept-disclaimer]',
+    help: 'add-agent — add an agent from your discovered inventory to your Talent profile, or every new one with --all. Usage: add-agent [--all [--yes]] [--lang es|en] [--accept-disclaimer]',
     gate: '"add-agent" requires an active session.\n  Missing: sign-in. Run `shakers login` first.',
     missingAccept: 'Non-interactive mode: --accept-disclaimer is missing.\n  add-agent is an interactive flow (pick an agent, edit fields) and its AI draft sends data.\n  Re-run with --accept-disclaimer, feeding the answers over stdin.',
+    missingYes: 'Non-interactive mode: --yes is missing.\n  add-agent --all adds every detected agent you do not have yet to your profile.\n  Re-run with --all --yes to confirm it without a terminal.',
   },
 };
 
 function parseArgs(argv) {
-  const o = { root: null, lang: null, help: false, acceptDisclaimer: false };
+  const o = { root: null, lang: null, help: false, acceptDisclaimer: false, all: false, yes: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--root') o.root = argv[++i];
@@ -31,6 +33,8 @@ function parseArgs(argv) {
     else if (a === '--lang') o.lang = VALID_LANGS.has(argv[++i]) ? argv[i] : null;
     else if (a.startsWith('--lang=')) { const v = a.slice(7); o.lang = VALID_LANGS.has(v) ? v : null; }
     else if (a === '--accept-disclaimer') o.acceptDisclaimer = true;
+    else if (a === '--all') o.all = true;
+    else if (a === '--yes' || a === '-y') o.yes = true;
     else if (a === '--help' || a === '-h') o.help = true;
   }
   return o;
@@ -59,21 +63,23 @@ async function run(
 
   const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
 
-  if (!stdinIsTTY && !o.acceptDisclaimer) {
-    process.stderr.write(`\n  ${c.missingAccept}\n\n`);
+  if (!stdinIsTTY && (o.all ? !o.yes : !o.acceptDisclaimer)) {
+    process.stderr.write(`\n  ${o.all ? c.missingYes : c.missingAccept}\n\n`);
     process.exitCode = 1;
     return;
   }
 
   const ask = injectedAsk || createStdinAsk();
   try {
-    await runAddAgents({
+    return await runAddAgents({
       ask,
       catalog,
       root: o.root || process.cwd(),
       session,
       stdinIsTTY,
       preAccepted: o.acceptDisclaimer,
+      all: o.all,
+      yes: o.yes,
       deps: { runLogin },
     });
   } finally {

package/bin/ai-usage.js

@@ -17,6 +17,7 @@ const {
   resolveAiConsent,
   renderAndFinalize,
 } = require('../src/usage-run-steps');
+const { run: runLogin } = require('./login');
 
 // Shared by the dispatcher and register flow: an injected `ask` is caller-owned, `bypassThrottle` is register-only.
 async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypassThrottle = false, inRegistration = false } = {}) {
@@ -59,7 +60,7 @@ async function run(argv = process.argv.slice(2), { ask: injectedAsk = null, bypa
       },
     });
 
-    await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle, repos, injectedAsk: ask });
+    await renderAndFinalize({ report, maturity, lang, opts, root, gate, catalog, bypassThrottle, repos, injectedAsk: ask, offerAgents: inRegistration ? null : { runLogin } });
   } finally {
     if (!injectedAsk) ask.close();
   }

package/bin/apply.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+'use strict';
+
+const { detectReportLang, getCatalog } = require('../src/i18n');
+const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');
+const { createStdinAsk } = require('../src/stdin-ask');
+const { makeIo } = require('./register');
+const { runApply, makeApplyDeps } = require('../src/apply-flow');
+
+function parseApplyArgs(argv = []) {
+  const o = { lang: null, help: false, id: null };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h') o.help = true;
+    else if (a === '--lang') { const v = argv[++i]; o.lang = v === 'es' || v === 'en' ? v : null; }
+    else if (a.startsWith('--lang=')) { const v = a.slice(7); o.lang = v === 'es' || v === 'en' ? v : null; }
+    else if (a === '--id') o.id = argv[++i] != null ? argv[i] : null;
+    else if (a.startsWith('--id=')) o.id = a.slice('--id='.length);
+    else if (!a.startsWith('-') && o.id == null) o.id = a;
+  }
+  return o;
+}
+
+async function run(
+  argv = process.argv.slice(2),
+  { ask: injectedAsk = null, stdinIsTTY: ttyOverride = undefined, deps = null, session: injectedSession = null, out = null, input, output } = {},
+) {
+  const opts = parseApplyArgs(argv);
+  const lang = opts.lang || detectReportLang();
+  const catalog = getCatalog(lang);
+  const fp = catalog.apply;
+  const write = out || ((s) => process.stdout.write(s));
+
+  if (opts.help) {
+    write(fp.help + '\n');
+    return;
+  }
+
+  const session = injectedSession || loadAuthSession();
+  if (sessionStatus(session) !== 'active') {
+    process.stderr.write(`\n  ${fp.loginRequired}\n\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const stdinIsTTY = ttyOverride !== undefined ? ttyOverride : !!process.stdin.isTTY;
+  const ask = injectedAsk || createStdinAsk();
+  try {
+    const io = makeIo({ ask, lang, out: write, stdinIsTTY });
+    const result = await runApply({
+      io, ask, session, catalog,
+      opts: { id: opts.id, stdinIsTTY, input, output },
+      deps: deps || makeApplyDeps(),
+    });
+    if (result && result.ok === false) process.exitCode = 1;
+    return result;
+  } finally {
+    if (!injectedAsk) ask.close();
+  }
+}
+
+module.exports = { run, parseApplyArgs };
+
+if (require.main === module) {
+  run();
+}

package/bin/command-audit-worker.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+'use strict';
+
+const { ensureFreshSession } = require('../src/session-refresh');
+const { emitCommandAudit, PAYLOAD_VAR } = require('../src/command-audit');
+
+async function main() {
+  let payload;
+  try {
+    payload = JSON.parse(process.env[PAYLOAD_VAR]);
+  } catch {
+    return;
+  }
+  if (!payload || typeof payload.command !== 'string') return;
+  await ensureFreshSession(process.env).catch(() => null);
+  await emitCommandAudit({ command: payload.command, argv: payload.args ? [payload.args] : [], env: process.env, id: typeof payload.id === 'string' ? payload.id : null });
+}
+
+main();

package/bin/login.js

@@ -5,7 +5,7 @@
 
 const { detectReportLang, getCatalog } = require('../src/i18n');
 const { getAuthTokenEndpoint, getDeviceAuthorizeEndpoint, getDeviceTokenEndpoint, getCompleteRegistrationEndpoint } = require('../src/config');
-const { runDeviceLogin, appendProviderParam, deviceSessionRecord } = require('../src/device-login');
+const { runDeviceLogin, withDeviceParams, deviceSessionRecord } = require('../src/device-login');
 const { buildRegistrationContext } = require('../src/signup-client');
 const { openPath } = require('../src/open-file');
 const { endSession } = require('../src/session-refresh');
@@ -100,14 +100,10 @@ function persistAndReport(result, c, email = null, output = process.stdout) {
     }
   }
   try {
-    // `cookie`/`cookieExpiresAt` are present for the email (better-auth) flow and
-    // absent for Google (auth-works JWT) — saveAuthSession picks the right model.
     saveAuthSession({
       accessToken: result.accessToken,
       expiresAt: result.expiresAt,
       accessTokenExpiresAt: result.expiresAt,
-      cookie: result.cookie || null,
-      cookieExpiresAt: result.cookieExpiresAt || null,
       sessionToken: result.sessionToken || null,
       sessionExpiresAt: result.sessionExpiresAt || null,
       email,
@@ -120,7 +116,7 @@ function persistAndReport(result, c, email = null, output = process.stdout) {
   }
   output.write(`\n  ${c.success}\n`);
   if (result.expiresAt) output.write(`  ${c.expiresAt(result.expiresAt)}\n`);
-  output.write('\n');
+  output.write(`\n  ${c.deviceGranted}\n\n`);
   return true;
 }
 
@@ -157,8 +153,8 @@ async function runDeviceFlow(provider, c, { openBrowser = openPath, sleep = unde
     {
       ...(sleep ? { sleep } : {}),
       onPrompt: ({ verificationUriComplete, userCode }) => {
-        const url = appendProviderParam(verificationUriComplete, provider);
-        output.write(`\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
+        const url = withDeviceParams(verificationUriComplete, { provider, mode: 'login', surface: 'cli' });
+        output.write(`\n  ${c.deviceTrust}\n\n  ${c.deviceVisit}\n  ${url}\n\n  ${c.deviceCodeLabel(userCode)}\n\n  ${c.deviceWaiting}\n`);
         if (provider === 'email') output.write(`  ${c.deviceApproveHint}\n`);
         try { openBrowser(url); } catch { /* the printed URL covers it */ }
       },

package/bin/mcp.js

@@ -8,6 +8,7 @@ const { makeCertifyDimensionTools } = require('../src/mcp-certify-dimension-tool
 const { makeFindProjectsTools } = require('../src/mcp-find-projects-tools');
 const { makeShowProjectTools } = require('../src/mcp-show-project-tools');
 const { makeSavedPositionsTools } = require('../src/mcp-saved-positions-tools');
+const { makeApplyTools } = require('../src/mcp-apply-tools');
 const { makeInvitationsTools } = require('../src/mcp-invitations-tools');
 const { makeApplicationsTools } = require('../src/mcp-applications-tools');
 const { makeAvailabilityTools } = require('../src/mcp-availability-tools');
@@ -23,13 +24,20 @@ const { makeRoleTools } = require('../src/mcp-role-tools');
 const { makeDeviceLoginTools } = require('../src/mcp-device-login-tools');
 const { makeRegisterTools } = require('../src/mcp-register-tools');
 const { makeSignupTools } = require('../src/mcp-signup-tools');
+const { makeSignupTool, outsideSignup, narratedTool, narrationLanguage, ABSORBED_TOOLS } = require('../src/mcp-signup-flow');
 const { detectFlowLang } = require('../src/i18n');
 const { makeReportTools } = require('../src/mcp-report-tools');
 const { makePrompts } = require('../src/mcp-prompts');
 const { buildServerInstructions } = require('../src/mcp-instructions');
+const { mcpNarration } = require('../src/trust-narration');
 const { ensureFreshSession } = require('../src/session-refresh');
+const { emitCommandAudit } = require('../src/command-audit');
 const { createFunnel } = require('../src/onboarding-funnel');
 
+function narrateTool(lang) {
+  return (name, { failed = false, args } = {}) => mcpNarration(narratedTool(name, args), narrationLanguage(name, args, lang), { failed });
+}
+
 let VERSION = '';
 try {
   VERSION = require('../package.json').version || '';
@@ -43,19 +51,17 @@ const HELP = `\n  shakers mcp — local MCP server (stdio)\n\n`
   + `  Usage: shakers mcp\n\n`
   + `  This command speaks JSON-RPC on stdio; it is meant to be launched by an\n`
   + `  MCP client, not run by hand.\n`
-  + `  Tools: ai_usage, ai_usage_upload, ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
-  + `         list_addable, add_skill, add_agent,\n`
-  + `         add_project, signup_start, signup_email, signup_draft, signup_create_account,\n`
-  + `         signup_status, update_existing_profile, import_profile, save_profile_details, open_web,\n`
-  + `         open_linkedin_profile,\n`
-  + `         suggest_register_context, read_cv, onboarding_interview_start,\n`
-  + `         onboarding_interview_turn, onboarding_interview_complete,\n`
-  + `         repeat_onboarding_interview, onboarding_finish,\n`
-  + `         list_available_roles, add_role, list_my_roles, set_main_role,\n`
-  + `         report, share,\n`
-  + `         list_certifiable_dimensions, find_projects, show_project,\n`
-  + `         save_project, unsave_project, list_invitations,\n`
-  + `         list_applications, get_availability,\n`
+  + `  Tools: signup (the whole sign-up, step by step), ai_usage, ai_usage_upload,\n`
+  + `         ai_usage_result, logout, social_signin_start, social_signin_poll,\n`
+  + `         list_addable, add_skill, add_agent, add_detected_agents,\n`
+  + `         add_project, open_web,\n`
+  + `         onboarding_interview_start, onboarding_interview_turn,\n`
+  + `         onboarding_interview_complete, repeat_onboarding_interview,\n`
+  + `         onboarding_finish, list_available_roles, add_role, list_my_roles,\n`
+  + `         set_main_role, report, share, list_certifiable_dimensions,\n`
+  + `         find_projects, show_project, save_project, unsave_project,\n`
+  + `         prepare_application, apply_to_project,\n`
+  + `         list_invitations, list_applications, get_availability,\n`
   + `         list_certifications, get_profile, get_rate, get_languages,\n`
   + `         list_socials, list_experiences, list_portfolios, alma_chat, alma_decision.\n\n`;
 
@@ -68,8 +74,11 @@ const LOCAL_ONLY_TOOL_NAMES = new Set(['ai_usage', 'ai_usage_upload', 'ai_usage_
 function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp' }), makeInterviewClient = null } = {}) {
   const lang = detectFlowLang();
   const aiUsage = makeAiUsageTools();
-  const allTools = [aiUsage.usage, aiUsage.upload, makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools(), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
-  const tools = localOnly ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name)) : allTools;
+  const allTools = [aiUsage.usage, aiUsage.upload, makeAiUsageResultTool(), ...makeOnboardingTools(), ...makeRoleTools({ lang, funnel }), ...makeDeviceLoginTools({ lang, funnel }), ...makeSignupTools({ lang, funnel }), ...makeRegisterTools({ lang, funnel, flowDeps: { makeInterviewClient } }), ...makeReportTools(), ...makeCertifyDimensionTools(), ...makeFindProjectsTools(), ...makeShowProjectTools(), ...makeSavedPositionsTools(), ...makeApplyTools(), ...makeInvitationsTools(), ...makeApplicationsTools(), ...makeAvailabilityTools(), ...makeCertificationsTools(), ...makeProfileTools(), ...makeRateTools(), ...makeLangTools(), ...makeSocialsTools(), ...makePortfolioTools(), ...makeAlmaTools()];
+  // The sign-up runs through one tool (`signup`), so Claude Desktop asks the talent once instead of once per step.
+  const tools = localOnly
+    ? allTools.filter((t) => LOCAL_ONLY_TOOL_NAMES.has(t.name))
+    : [makeSignupTool(allTools), ...allTools.filter((t) => !ABSORBED_TOOLS.has(t.name)).map(outsideSignup)];
   // Slash-command prompts, kept to the tools actually registered in this mode.
   const prompts = makePrompts(new Set(tools.map((t) => t.name)), lang);
   return createMcpServer({
@@ -77,10 +86,14 @@ function buildServer({ localOnly = false, funnel = createFunnel({ surface: 'mcp'
     prompts,
     serverInfo: { name: localOnly ? 'Shakers (local scan)' : 'Shakers', version: VERSION || '0.0.0' },
     instructions: localOnly ? null : (client) => buildServerInstructions(client),
-    // Long-lived server: refresh the email session's hub JWT from the stored
-    // cookie before each tool call so a stale (~15-min) JWT never reaches a tool.
     beforeCall: () => ensureFreshSession(process.env),
-    afterCall: () => { funnel.flush(); },
+    afterCall: (name) => {
+      funnel.flush();
+      ensureFreshSession(process.env)
+        .catch(() => null)
+        .then(() => emitCommandAudit({ command: `mcp:${name}`, env: process.env }));
+    },
+    narrate: narrateTool(lang),
     onInitialize: ({ clientInfo }) => funnel.setMcpClient(clientInfo.name),
   });
 }
@@ -122,7 +135,7 @@ async function run(argv = process.argv.slice(2), { makeInterviewClient = null }
   await funnel.settle();
 }
 
-module.exports = { run, buildServer, buildServerInstructions, prepareProcess };
+module.exports = { run, buildServer, buildServerInstructions, prepareProcess, narrateTool };
 
 if (require.main === module) {
   run();

package/bin/register.js

@@ -2,9 +2,7 @@
 'use strict';
 
 const { detectFlowLang, getCatalog } = require('../src/i18n');
-const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');
 const { createStdinAsk } = require('../src/stdin-ask');
-const { run: runLogin } = require('./login');
 const { run: runAiUsage } = require('./ai-usage');
 const {
   runOnboarding, makeDeps, CURRENCIES, MONTHLY_HOURS, normalizeAmount,
@@ -20,6 +18,7 @@ const { BRAND_ANSI } = require('../src/brand-ansi');
 const { typeOut } = require('../src/typewriter');
 const { withSpinner } = require('../src/terminal-progress');
 const { openPath } = require('../src/open-file');
+const { termsText, legalCopy } = require('../src/signup-copy');
 const { c: fmt } = require('../src/terminal-format');
 const { createFunnel } = require('../src/onboarding-funnel');
 const red = (s) => `${fmt.danger}${s}${fmt.reset}`;
@@ -151,26 +150,11 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       const telephoneNumber = (await ask(`  ${c.phoneNumberAsk} `)).trim();
       return { available, monthlyHours, workModes, country, subdivision, timezone, longFullTimeProjects, telephoneCode, telephoneNumber };
     },
-    askSignUp: async (c) => {
-      const name = (await ask(`  ${c.askName} `)).trim();
-      const lastName = (await ask(`  ${c.askLastName} `)).trim();
-      const email = (await ask(`  ${c.askEmail} `)).trim();
-      const askSecret = (prompt) => (typeof ask.secret === 'function' ? ask.secret(`  ${prompt} `) : ask(`  ${prompt} `).then((v) => v.trim()));
-      let password;
-      for (;;) {
-        password = await askSecret(c.askPassword);
-        const again = await askSecret(c.askPasswordConfirm);
-        if (password === again) break;
-        writeErr(c.passwordMismatch);
-      }
-      const newsletterConsent = isYes(await ask(`  ${c.askNewsletter} `));
-      // freelanceType is NOT asked here anymore: it is derived from the work
-      // situation (asked once, after the sources) and sent via professional-details.
-      return { name, lastName, email, password, newsletterConsent };
-    },
-    askGoogleSignUp: async () => {
-      // Nothing to ask: Google supplies name/email; freelanceType is derived later.
-      return {};
+    askTerms: async (c) => {
+      out(`\n  ${termsText(lang, (label, url) => `${label} (${url})`)}\n`);
+      if (!isYes(await ask(`  ${c.termsAsk} `))) return { accepted: false };
+      const newsletterConsent = isYes(await ask(`  ${c.newsletterAsk(legalCopy(lang).newsletter)} `));
+      return { accepted: true, newsletterConsent };
     },
     askWorkSituation: async (c) => {
       const situation = await promptSelect({
@@ -242,13 +226,9 @@ function makeIo({ ask, lang, out, acceptDisclaimer, stdinIsTTY = false }) {
       }
       return rows;
     },
-    onGoogleAuthUrl: (url, userCode) => {
+    onAuthUrl: (url, userCode) => {
       const g = getCatalog(lang).login;
-      out(`\n  ${g.deviceVisit}\n  ${url}\n\n  ${g.deviceCodeLabel(userCode)}\n\n  ${g.deviceWaiting}\n`);
-    },
-    login: async () => {
-      await runLogin(['--lang', lang], { ask });
-      return sessionStatus(loadAuthSession()) === 'active';
+      out(`\n  ${g.deviceTrust}\n\n  ${g.deviceVisit}\n  ${url}\n\n  ${g.deviceCodeLabel(userCode)}\n\n  ${g.deviceWaiting}\n`);
     },
     // Registration always measures the whole machine (--all-repos).
     runUsage: async () => { await runAiUsage(['--lang', lang, '--all-repos'], { ask, bypassThrottle: true, inRegistration: true }); },
@@ -332,7 +312,8 @@ async function run(
     const io = makeIo({ ask, lang, out: write, acceptDisclaimer: o.acceptDisclaimer, stdinIsTTY });
     // At a terminal the profile opens in the browser at the end; piped runs, tests and --no-open only print it.
     const openProfile = stdinIsTTY && !o.noOpen ? (openBrowser || openPath) : undefined;
-    const result = await runOnboarding(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { method, openBrowser, onAuthUrl: io.onGoogleAuthUrl, openProfile, funnel: registrationFunnel });
+    const openAuth = openBrowser || (deps || o.noOpen ? undefined : openPath);
+    const result = await runOnboarding(io, deps || makeDeps({ makeInterviewClient: createInterviewClient }), { method, openBrowser: openAuth, onAuthUrl: io.onAuthUrl, openProfile, funnel: registrationFunnel });
     if (!result.ok) {
       process.stderr.write(`\n  ${red(`register: ${result.reason}${result.step ? ` (${result.step})` : ''}`)}\n\n`);
       process.exitCode = 1;

package/bin/shakers-cli.js

@@ -21,6 +21,7 @@ const { run: runChangeRole } = require('./change-role');
 const { run: runFindProjects } = require('./find-projects');
 const { run: runShowProject } = require('./show-project');
 const { run: runSave, runUnsave } = require('./save');
+const { run: runApply } = require('./apply');
 const { run: runInvitations } = require('./invitations');
 const { run: runApplications } = require('./applications');
 const { run: runAvailability } = require('./availability');
@@ -37,9 +38,10 @@ const { run: runOnboarding } = require('./onboarding');
 const { run: runConfig } = require('./config');
 const { run: runUpdate } = require('./update');
 const { checkOnboardingCompleted } = require('../src/onboarding-availability');
-const { emitCommandAudit } = require('../src/command-audit');
+const { startCommandAudit } = require('../src/command-audit');
 const { readPackageInfo } = require('../src/update-flow');
 const { isSuppressed, maybeNotify, triggerBackgroundCheck } = require('../src/update-notifier');
+const { cliNarration, changedNothing } = require('../src/trust-narration');
 
 let VERSION = '';
 try {
@@ -73,6 +75,7 @@ const HANDLERS = {
   'show-project': runShowProject,
   'save-project': runSave,
   'unsave-project': runUnsave,
+  apply: runApply,
   invitations: runInvitations,
   applications: runApplications,
   availability: runAvailability,
@@ -93,9 +96,10 @@ const HANDLERS = {
   logout: runLogout,
   superadmin: runSuperadmin,
   mcp: (args) => require('../src/mcp-install').runMcpInstall({ args }),
+  skill: (args) => require('../src/skill-install').runSkillInstall({ args }),
 };
 
-const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'share', 'alma', 'update']);
+const SESSION_EXEMPT = new Set(['ai-usage', 'register', 'config', 'login', 'logout', 'superadmin', 'mcp', 'skill', 'share', 'alma', 'update']);
 
 // Command FAMILIES — a navigation layer over the flat commands (which all stay
 // valid as aliases). `shakers <family> <sub>` resolves to the flat handler; every
@@ -109,7 +113,7 @@ const FAMILIES = {
     certifications: 'certifications',
   },
   projects: {
-    find: 'find-projects', show: 'show-project', save: 'save-project', unsave: 'unsave-project',
+    find: 'find-projects', show: 'show-project', save: 'save-project', unsave: 'unsave-project', apply: 'apply',
     invitations: 'invitations', applications: 'applications',
   },
   usage: { run: 'ai-usage', report: 'report', share: 'share' },
@@ -178,7 +182,8 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `  Público (sin sesión):\n`
       + `    ai-usage     Escanea este proyecto + tu máquina y puntúa tu setup de IA\n`
       + `    register     Registro completo: perfil, precio, uso de IA y entrevista\n`
-      + `    mcp          Servidor MCP local (stdio) para apps de IA de escritorio\n\n`
+      + `    mcp          Servidor MCP local (stdio) para apps de IA de escritorio\n`
+      + `    skill install Instala la skill shakers-cli en Claude Code y Codex\n\n`
       + `  Requieren sesión (ejecuta antes: shakers login):\n`
       + onboardingLine
       + `    certify      Certifica una dimensión de tu rol (entrevista por LiveKit)\n`
@@ -190,6 +195,7 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `    find-projects Lista los proyectos/posiciones disponibles para ti\n`
       + `    show-project Detalle de un proyecto/posición por id\n`
       + `    save-project/unsave-project  Guarda o quita un proyecto de tus guardados\n`
+      + `    apply        Aplica a un proyecto/posición con tu mensaje y respuestas\n`
       + `    invitations  Tus invitaciones a proyectos\n`
       + `    applications Proyectos a los que has aplicado + estado\n`
       + `    availability Ver o fijar tu disponibilidad\n`
@@ -211,7 +217,7 @@ function usageText(lang, { hideOnboarding = false } = {}) {
       + `  Familias (agrupan los comandos de arriba; los nombres planos siguen valiendo como alias):\n`
       + `    add <skill|agent|project|role>     ·  role <add|change>\n`
       + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
-      + `    projects <find|show|save|unsave|invitations|applications>\n`
+      + `    projects <find|show|save|unsave|apply|invitations|applications>\n`
       + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
       + `    Ejecuta \`shakers <familia>\` (sin subcomando) para ver sus subcomandos.\n\n`
       + `  Ejecuta shakers <comando> --help para las opciones de cada comando.\n\n`;
@@ -222,7 +228,8 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `  Public (no session):\n`
     + `    ai-usage     Scan this project + machine and score your AI setup\n`
     + `    register     Full registration: profile, pricing, AI usage and interview\n`
-    + `    mcp          Local MCP server (stdio) for desktop AI apps\n\n`
+    + `    mcp          Local MCP server (stdio) for desktop AI apps\n`
+    + `    skill install Install the shakers-cli skill into Claude Code and Codex\n\n`
     + `  Require a session (run \`shakers login\` first):\n`
     + onboardingLine
     + `    certify      Certify a dimension of your role (LiveKit interview)\n`
@@ -234,6 +241,7 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `    find-projects List the Projects/Positions available to you\n`
     + `    show-project Detail of a project/position by id\n`
     + `    save-project/unsave-project  Save or remove a project from your saved list\n`
+    + `    apply        Apply to a project/position with your message and answers\n`
     + `    invitations  Your project invitations\n`
     + `    applications Projects you applied to + status\n`
     + `    availability View or set your availability\n`
@@ -255,7 +263,7 @@ function usageText(lang, { hideOnboarding = false } = {}) {
     + `  Families (group the commands above; the flat names still work as aliases):\n`
     + `    add <skill|agent|project|role>     ·  role <add|change>\n`
     + `    profile <show|rate|languages|socials|experiences|portfolios|availability|certifications>\n`
-    + `    projects <find|show|save|unsave|invitations|applications>\n`
+    + `    projects <find|show|save|unsave|apply|invitations|applications>\n`
     + `    usage <run|report|share>  ·  certs <list|certify>  ·  account <login|logout|register|config|update>\n`
     + `    Run \`shakers <family>\` (no subcommand) to list its subcommands.\n\n`
     + `  Run \`shakers <command> --help\` for a command's options.\n\n`;
@@ -287,15 +295,13 @@ async function main() {
 
   migrateLegacyConfigDir(process.env);
   sanitizeStaleBakedEndpoints(process.env);
-  // Mint a fresh hub JWT from the stored cookie once per command (email sessions only; a no-op for Google/legacy or when no session exists).
   try { await ensureFreshSession(process.env); } catch { /* never blocks a command */ }
 
   const token = argv.find((a) => !a.startsWith('-'));
 
-  // Single dispatch choke-point: audit EXACTLY once before branching, fire-and-forget (never awaited). MCP tool calls run in-process and never reach here.
   const auditCommand =
     !token || token.toLowerCase() === 'help' ? 'help' : token.toLowerCase();
-  emitCommandAudit({ command: auditCommand, argv, env: process.env });
+  startCommandAudit({ command: auditCommand, argv, env: process.env });
 
   // Non-blocking update notice: reads a cached version synchronously, registry check runs in a detached worker; stderr-only, suppressed for --json/non-TTY/CI/update/opt-out.
   if (!isSuppressed({ argv, command: auditCommand, env: process.env })) {
@@ -346,7 +352,10 @@ async function main() {
     await remindAccountForAiUsage(lang, args);
   }
 
-  await handler(args);
+  const narration = wantsHelp || args.includes('--json') ? { before: null, after: null } : cliNarration(command, args, lang);
+  if (narration.before) process.stderr.write(`\n  ${narration.before}\n`);
+  const outcome = await handler(args);
+  if (narration.after && !process.exitCode && !changedNothing(outcome)) process.stderr.write(`\n  ${narration.after}\n\n`);
 }
 
-module.exports = { main };
+module.exports = { main, HANDLERS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shakers-cli",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Shakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).",
   "type": "commonjs",
   "bin": {

package/src/agents-client.js

@@ -54,6 +54,7 @@ async function requestListAgents({ accessToken, hubAccessToken } = {}, { endpoin
     .map((entry) => ({
       name: entry && typeof entry.name === 'string' ? entry.name : null,
       id: entry && (typeof entry.id === 'string' || typeof entry.id === 'number') ? String(entry.id) : null,
+      source: entry && typeof entry.source === 'string' ? entry.source : null,
     }))
     .filter((a) => a.name !== null);
   return { ok: true, agents };

package/src/ai-usage-review.js

@@ -83,9 +83,11 @@ function explanationText(lang) {
   return [c.explanationTitle, ...c.explanation, c.afterwards].join('\n\n');
 }
 
-function resultText(lang, preview) {
+// `explained`: the talent already read what the two axes mean and how to disagree (the review in the sign-up), so they are not repeated.
+function resultText(lang, preview, { explained = false } = {}) {
   const c = reviewCopy(lang);
-  if (!preview) return [c.resultPending, c.afterwards].join('\n\n');
+  const after = explained ? [] : [c.afterwards];
+  if (!preview) return [c.resultPending, ...after].join('\n\n');
   const m = preview.matrix || {};
   const lines = [
     c.resultTitle,
@@ -95,7 +97,7 @@ function resultText(lang, preview) {
     preview.usage && preview.usage.explanation,
     m.cell ? c.cell(m.cell) : null,
   ].filter(Boolean).map(sanitizeRenderText);
-  return [lines.join('\n'), c.explanation[0], c.afterwards].join('\n\n');
+  return [lines.join('\n'), ...(explained ? [] : [c.explanation[0]]), ...after].join('\n\n');
 }
 
 module.exports = { uploadFacts, withoutExcluded, repoName, summaryText, explanationText, resultText };