shakers-cli 0.17.0 → 0.19.0

package/src/apply-client.js

@@ -0,0 +1,164 @@
+'use strict';
+
+const { postJsonWithTimeout } = require('./backend-request');
+const { reasonForError } = require('./onboarding-client');
+
+const DEFAULT_TIMEOUT_MS = 20000;
+const APPLICATION_SOURCE = 'NO_SOURCE';
+const SELECTED_MESSAGE = 'manual';
+
+const CANDIDATURE_CODE_TO_REASON = {
+  'candidatures.already_exists': 'already-applied',
+  'candidatures.position_not_available_for_application': 'position-unavailable',
+  'candidatures.position_not_found': 'not-found',
+  'candidatures.project_not_found': 'not-found',
+  'candidatures.talent_not_found': 'talent-not-found',
+  'candidatures.creation_failed': 'creation-failed',
+};
+
+function parseJson(raw) {
+  try {
+    return raw ? JSON.parse(raw) : null;
+  } catch {
+    return null;
+  }
+}
+
+function bearerHeaders(accessToken) {
+  const headers = {};
+  if (typeof accessToken === 'string' && accessToken) headers.Authorization = `Bearer ${accessToken}`;
+  return headers;
+}
+
+const text = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null);
+
+function normalizeQuestion(q) {
+  if (!q || !text(q.text)) return null;
+  if (q.type === 'MULTIPLE_CHOICE') {
+    const options = Array.isArray(q.options) ? q.options.map(text).filter(Boolean) : [];
+    return options.length ? { type: 'MULTIPLE_CHOICE', text: q.text.trim(), options } : null;
+  }
+  return { type: 'OPEN', text: q.text.trim() };
+}
+
+async function requestPositionApplication({ hubAccessToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
+  if (!hubAccessToken) return { ok: false, reason: 'no-hub-token' };
+  let res;
+  try {
+    res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, bearerHeaders(hubAccessToken));
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+  if (res.status === 404) return { ok: false, reason: 'not-found' };
+  if (res.status < 200 || res.status >= 300) return { ok: false, reason: reasonForError(res.status, res.raw) };
+  const json = parseJson(res.raw);
+  const data = json && json.status === 'OK' && json.data && typeof json.data === 'object' ? json.data : null;
+  if (!data) return { ok: false, reason: 'bad-response' };
+  if (data.redirectUrl || !data.position) return { ok: true, open: false };
+  const p = data.position;
+  const questions = p.questions && typeof p.questions === 'object' ? p.questions : {};
+  return {
+    ok: true,
+    open: true,
+    title: text(p.title),
+    doubleCheck: text(p.doubleCheck),
+    mainMotivationQuestion: text(questions.mainMotivationQuestion),
+    questions: (Array.isArray(questions.extraQuestions) ? questions.extraQuestions : []).map(normalizeQuestion).filter(Boolean),
+  };
+}
+
+function escapeHtml(s) {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+function toHubMessage(message) {
+  return escapeHtml(message.trim()).replace(/\r\n?/g, '\n').replace(/\n/g, '<br>');
+}
+
+function buildCandidatureBody({ positionId, message, answers = [], mainMotivationQuestion }) {
+  const chat = text(message) ? toHubMessage(message) : null;
+  const extra = answers.filter((a) => a && text(a.question) && (Array.isArray(a.answer) ? a.answer.length > 0 : text(a.answer)));
+  const questions = {};
+  if (chat) questions.main_motivation = { question: mainMotivationQuestion, answer: chat };
+  if (extra.length) questions.extra_questions = extra.map((a) => ({ question: a.question, answer: Array.isArray(a.answer) ? a.answer : a.answer.trim() }));
+  const form = { selectedMessage: SELECTED_MESSAGE };
+  if (Object.keys(questions).length) form.questions = questions;
+  return {
+    positionId,
+    applicationSource: APPLICATION_SOURCE,
+    ...(chat ? { sendPresentationChatMessage: chat } : {}),
+    form,
+  };
+}
+
+async function requestCreateCandidature({ hubAccessToken } = {}, { endpoint, body, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  if (!endpoint) return { ok: false, reason: 'no-endpoint' };
+  if (!hubAccessToken) return { ok: false, reason: 'no-hub-token' };
+  let res;
+  try {
+    res = await postJsonWithTimeout(endpoint, body, timeoutMs, 'POST', null, bearerHeaders(hubAccessToken));
+  } catch (e) {
+    return { ok: false, reason: (e && e.kind) || 'network-error' };
+  }
+  const json = parseJson(res.raw);
+  if (res.status < 200 || res.status >= 300) {
+    const code = json && typeof json.code === 'string' ? json.code : null;
+    const reason = (code && CANDIDATURE_CODE_TO_REASON[code]) || reasonForError(res.status, res.raw);
+    const meta = json && json.meta && typeof json.meta === 'object' ? json.meta : {};
+    return reason === 'already-applied'
+      ? { ok: false, reason, applicationStatus: text(meta.applicationStatus) }
+      : { ok: false, reason };
+  }
+  const data = json && json.status === 'OK' && json.data && typeof json.data === 'object' ? json.data : null;
+  if (!data) return { ok: false, reason: 'bad-response' };
+  return { ok: true, candidatureId: data.candidatureId || null, status: text(data.status), chatId: data.chatId || null };
+}
+
+async function loadApplication(deps = {}, { hubAccessToken, positionId, timeoutMs } = {}) {
+  const {
+    getPositionApplicationEndpoint = require('./config').getPositionApplicationEndpoint,
+    fetchPositionDetail = (opts) => require('./show-project-client').fetchPositionDetail({}, opts),
+    requestPositionApplication: request = requestPositionApplication,
+  } = deps;
+  const endpoint = getPositionApplicationEndpoint(positionId);
+  if (!endpoint) return { ok: false, reason: positionId ? 'no-endpoint' : 'no-id' };
+  const [application, detail] = await Promise.all([
+    request({ hubAccessToken }, { endpoint, timeoutMs }),
+    fetchPositionDetail({ hubAccessToken, positionId }).catch(() => null),
+  ]);
+  if (!application.ok || !application.open) return application;
+  const company = detail && detail.ok && detail.position && detail.position.company ? text(detail.position.company.name) : null;
+  return { ...application, company };
+}
+
+async function submitApplication(deps = {}, { hubAccessToken, positionId, message, answers, mainMotivationQuestion, timeoutMs } = {}) {
+  const {
+    getCandidaturesEndpoint = require('./config').getCandidaturesEndpoint,
+    requestCreateCandidature: request = requestCreateCandidature,
+  } = deps;
+  const body = buildCandidatureBody({ positionId, message, answers, mainMotivationQuestion });
+  return request({ hubAccessToken }, { endpoint: getCandidaturesEndpoint(), body, timeoutMs });
+}
+
+function applicationSummary(t, { title, company, doubleCheck }, { message, answers = [] }) {
+  return [
+    t.summaryTitle,
+    t.titleLine(title || t.untitled),
+    company ? t.companyLine(company) : null,
+    t.messageLine(text(message) || t.empty),
+    ...answers.map((a) => t.answerLine(a.question, Array.isArray(a.answer) ? a.answer.join(', ') : a.answer)),
+    t.sendNotice(title || t.untitled),
+    doubleCheck && doubleCheck !== 'NO' ? t.reviewNotice : null,
+  ].filter(Boolean);
+}
+
+module.exports = {
+  APPLICATION_SOURCE,
+  requestPositionApplication,
+  requestCreateCandidature,
+  buildCandidatureBody,
+  loadApplication,
+  submitApplication,
+  applicationSummary,
+};

package/src/apply-flow.js

@@ -0,0 +1,105 @@
+'use strict';
+
+const { styleLabelPrefix } = require('./ansi');
+const { sanitizeRenderText: clean } = require('./sanitize-network-text');
+const { applicationSummary } = require('./apply-client');
+
+function makeApplyDeps(overrides = {}) {
+  const client = require('./apply-client');
+  return {
+    loadApplication: (opts) => client.loadApplication({}, opts),
+    submitApplication: (opts) => client.submitApplication({}, opts),
+    resolveRef: (raw) => require('./find-projects-cache').resolvePositionRef(raw),
+    promptSelect: (opts) => require('./prompt-select').promptSelect(opts),
+    ...overrides,
+  };
+}
+
+async function askAnswers({ io, ask, fp, questions, opts, deps }) {
+  const answers = [];
+  for (const q of questions) {
+    if (q.type === 'MULTIPLE_CHOICE') {
+      const picked = await deps.promptSelect({
+        ask,
+        stdinIsTTY: true,
+        out: (s) => io.notify(s),
+        header: clean(q.text),
+        hint: fp.choiceHint,
+        items: [...q.options.map((value) => ({ label: clean(value), value })), { label: fp.skipChoice, value: null }],
+        labelFor: (x) => x.label,
+        input: opts.input,
+        output: opts.output,
+      });
+      if (picked && picked.value) answers.push({ question: q.text, answer: [picked.value] });
+    } else {
+      const answer = String(await io.ask(fp.askOpen(clean(q.text)))).trim();
+      if (answer) answers.push({ question: q.text, answer });
+    }
+  }
+  return answers;
+}
+
+function paintedSummary(fp, app, message, answers) {
+  return applicationSummary(fp, {
+    title: app.title && clean(app.title),
+    company: app.company && clean(app.company),
+    doubleCheck: app.doubleCheck,
+  }, {
+    message,
+    answers: answers.map((a) => ({ question: clean(a.question), answer: Array.isArray(a.answer) ? a.answer.map(clean) : a.answer })),
+  });
+}
+
+async function runApply({ io, ask, session, catalog, opts = {}, deps = makeApplyDeps() }) {
+  const fp = catalog.apply;
+  if (!opts.stdinIsTTY) {
+    io.error(fp.needsInteractive);
+    return { ok: false, reason: 'non-interactive' };
+  }
+  const resolved = deps.resolveRef(opts.id);
+  if (!resolved.ok) {
+    io.error(resolved.reason === 'no-cache' ? fp.refNoCache
+      : resolved.reason === 'out-of-range' ? fp.refOutOfRange(resolved.count)
+        : fp.idRequired);
+    return { ok: false, reason: resolved.reason };
+  }
+  const positionId = resolved.id;
+  const hubAccessToken = session ? session.hubAccessToken : null;
+
+  const app = await io.withProgress(fp.loading, () => deps.loadApplication({ hubAccessToken, positionId }));
+  if (!app.ok) {
+    io.error(app.reason === 'not-found' ? fp.notFound : fp.fetchFailed(app.reason));
+    return { ok: false, reason: app.reason };
+  }
+  if (!app.open) {
+    io.notify(fp.notOpen);
+    return { ok: false, reason: 'not-open' };
+  }
+
+  io.section(app.title ? clean(app.title) : fp.untitled);
+  if (app.company) io.notify(styleLabelPrefix(fp.companyLine(clean(app.company))));
+  const mainMotivationQuestion = app.mainMotivationQuestion || fp.mainMotivationFallback;
+  const message = String(await io.ask(fp.askMessage(clean(mainMotivationQuestion)))).trim();
+  const answers = await askAnswers({ io, ask, fp, questions: app.questions, opts, deps });
+
+  const [heading, ...lines] = paintedSummary(fp, app, message, answers);
+  io.section(heading);
+  for (const line of lines) io.notify(line);
+  if (!(await io.confirm(fp.confirm))) {
+    io.notify(fp.cancelled);
+    return { ok: true, cancelled: true };
+  }
+
+  const res = await io.withProgress(fp.sending, () => deps.submitApplication({ hubAccessToken, positionId, message, answers, mainMotivationQuestion }));
+  if (!res.ok) {
+    if (res.reason === 'already-applied') io.notify(fp.alreadyApplied(res.applicationStatus));
+    else if (res.reason === 'position-unavailable') io.error(fp.notOpen);
+    else if (res.reason === 'not-found') io.error(fp.notFound);
+    else io.error(fp.failed(res.reason));
+    return { ok: false, reason: res.reason };
+  }
+  io.success(res.status === 'PENDING' ? fp.sentPending : fp.sent);
+  return { ok: true, status: res.status };
+}
+
+module.exports = { makeApplyDeps, runApply };

package/src/auth-client.js

@@ -1,15 +1,9 @@
 'use strict';
 
-const { postJsonWithTimeout, extractSetCookie } = require('./backend-request');
-
-// Login / token acquisition against the Hub's better-auth email engine.
+const { postJsonWithTimeout } = require('./backend-request');
 
 const DEFAULT_TIMEOUT_MS = 20000;
 const SIGN_OUT_TIMEOUT_MS = 3000;
-const SESSION_COOKIE_NAME = 'better-auth.session_token';
-// Refresh the cookie session's own validity from the Set-Cookie Max-Age; fall
-// back to 7 days (better-auth's default) when the attribute is absent.
-const DEFAULT_COOKIE_TTL_SECONDS = 7 * 24 * 60 * 60;
 
 function parseJson(raw) {
   try { return raw ? JSON.parse(raw) : null; } catch { return null; }
@@ -28,71 +22,10 @@ function expiresAtFromJwt(token) {
   }
 }
 
-// ISO expiry for the session cookie, read from the Set-Cookie `Max-Age` (or
-// `Expires`) of the named cookie; defaults to +7 days when neither is present.
-function cookieExpiresAtFromHeaders(headers, name = SESSION_COOKIE_NAME) {
-  const raw = headers && headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  // Match the base name with or without better-auth's HTTPS `__Secure-`/`__Host-` prefixes.
-  const names = [name, `__Secure-${name}`, `__Host-${name}`];
-  const entry = list.find((e) => typeof e === 'string' && names.some((n) => e.startsWith(`${n}=`)));
-  if (entry) {
-    const maxAge = /(?:^|;\s*)max-age=(\d+)/i.exec(entry);
-    if (maxAge) return new Date(Date.now() + Number(maxAge[1]) * 1000).toISOString();
-    const expires = /(?:^|;\s*)expires=([^;]+)/i.exec(entry);
-    if (expires) {
-      const t = Date.parse(expires[1]);
-      if (Number.isFinite(t)) return new Date(t).toISOString();
-    }
-  }
-  return new Date(Date.now() + DEFAULT_COOKIE_TTL_SECONDS * 1000).toISOString();
-}
-
-function normalizeResponse(status, raw) {
-  if (status >= 200 && status < 300) {
-    let json = null;
-    try { json = raw ? JSON.parse(raw) : null; } catch { json = null; }
-    const payload = json && typeof json.data === 'object' && json.data !== null ? json.data : json;
-    const accessToken = payload && typeof payload.accessToken === 'string' && payload.accessToken ? payload.accessToken : null;
-    if (!accessToken) return { ok: false, reason: 'bad-response', status };
-    const expiresAt = payload && typeof payload.expiresAt === 'string' && payload.expiresAt ? payload.expiresAt : null;
-    const emailRaw = payload && (payload.userEmail || payload.email);
-    const email = typeof emailRaw === 'string' && emailRaw ? emailRaw : null;
-    const hubAccessToken = payload && typeof payload.hubAccessToken === 'string' && payload.hubAccessToken ? payload.hubAccessToken : null;
-    return { ok: true, accessToken, expiresAt, email, hubAccessToken };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Maps the sign-in POST outcome to a captured cookie + email, or a named reason.
-function normalizeSignIn(status, raw, headers) {
-  if (status >= 200 && status < 300) {
-    const cookie = extractSetCookie(headers, SESSION_COOKIE_NAME);
-    if (!cookie) return { ok: false, reason: 'bad-response', status };
-    const body = parseJson(raw);
-    const user = body && typeof body === 'object' ? body.user : null;
-    const emailRaw = user && typeof user.email === 'string' ? user.email : null;
-    return {
-      ok: true,
-      cookie,
-      cookieExpiresAt: cookieExpiresAtFromHeaders(headers),
-      email: emailRaw || null,
-    };
-  }
-  if (status === 401) return { ok: false, reason: 'invalid-credentials', status };
-  if (status === 409 || status === 422) return { ok: false, reason: 'no-email-password', status };
-  if (status === 502 || status === 503) return { ok: false, reason: 'upstream', status };
-  return { ok: false, reason: 'http-error', status };
-}
-
-// Mints a hub JWT from a better-auth session cookie: `GET {tokenEndpoint}` with the `Cookie` header.
-async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function requestAuthToken({ sessionToken } = {}, { endpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   if (!endpoint) return { ok: false, reason: 'no-endpoint' };
-  if (!cookie && !sessionToken) return { ok: false, reason: 'no-cookie' };
-  const credential = cookie ? { Cookie: cookie } : { Authorization: `Bearer ${sessionToken}` };
+  if (!sessionToken) return { ok: false, reason: 'no-session-token' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   let res;
   try {
     res = await postJsonWithTimeout(endpoint, null, timeoutMs, 'GET', null, credential);
@@ -106,38 +39,9 @@ async function requestAuthToken({ cookie, sessionToken } = {}, { endpoint, timeo
   return { ok: true, accessToken: token, expiresAt: expiresAtFromJwt(token) };
 }
 
-// The full email login: sign-in (capture cookie) -> mint JWT.
-async function requestLogin(
-  { email, password },
-  { signInEndpoint, tokenEndpoint, timeoutMs = DEFAULT_TIMEOUT_MS } = {},
-) {
-  if (!signInEndpoint) return { ok: false, reason: 'no-endpoint' };
-  let signIn;
-  try {
-    const { status, raw, headers } = await postJsonWithTimeout(signInEndpoint, { email, password }, timeoutMs);
-    signIn = normalizeSignIn(status, raw, headers);
-  } catch (e) {
-    return { ok: false, reason: (e && e.kind) || 'local-error' };
-  }
-  if (!signIn.ok) return signIn;
-
-  const tok = await requestAuthToken({ cookie: signIn.cookie }, { endpoint: tokenEndpoint, timeoutMs });
-  if (!tok.ok) return { ok: false, reason: 'token-fetch-failed', status: tok.status || null };
-
-  return {
-    ok: true,
-    accessToken: tok.accessToken,
-    hubAccessToken: tok.accessToken,
-    expiresAt: tok.expiresAt,
-    email: signIn.email || (typeof email === 'string' ? email : null),
-    cookie: signIn.cookie,
-    cookieExpiresAt: signIn.cookieExpiresAt,
-  };
-}
-
-async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin = null, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
-  if (!endpoint || (!cookie && !sessionToken)) return { ok: false, reason: 'no-credential' };
-  const credential = cookie ? { Cookie: cookie, ...(origin ? { Origin: origin } : {}) } : { Authorization: `Bearer ${sessionToken}` };
+async function requestSignOut({ sessionToken } = {}, { endpoint, timeoutMs = SIGN_OUT_TIMEOUT_MS } = {}) {
+  if (!endpoint || !sessionToken) return { ok: false, reason: 'no-credential' };
+  const credential = { Authorization: `Bearer ${sessionToken}` };
   try {
     const res = await postJsonWithTimeout(endpoint, {}, timeoutMs, 'POST', null, credential);
     return { ok: res.status >= 200 && res.status < 300, status: res.status };
@@ -148,11 +52,7 @@ async function requestSignOut({ cookie, sessionToken } = {}, { endpoint, origin
 
 module.exports = {
   requestSignOut,
-  requestLogin,
   requestAuthToken,
-  normalizeSignIn,
-  normalizeResponse,
   expiresAtFromJwt,
-  SESSION_COOKIE_NAME,
   DEFAULT_TIMEOUT_MS,
 };

package/src/auth-session-store.js

@@ -89,12 +89,11 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
   const explicitHubToken = typeof session.hubAccessToken === 'string' && session.hubAccessToken ? session.hubAccessToken : null;
   const hubAccessToken = explicitHubToken || (typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null);
 
-  const cookie = typeof session.cookie === 'string' && session.cookie ? session.cookie : null;
   const sessionToken = typeof session.sessionToken === 'string' && session.sessionToken ? session.sessionToken : null;
   let expiresAt;
   let accessTokenExpiresAt;
-  if (cookie || sessionToken) {
-    expiresAt = [session.cookieExpiresAt, session.sessionExpiresAt, session.expiresAt]
+  if (sessionToken) {
+    expiresAt = [session.sessionExpiresAt, session.expiresAt]
       .find((v) => typeof v === 'string' && v) || expiresAtFromToken(session.accessToken);
     accessTokenExpiresAt = (typeof session.accessTokenExpiresAt === 'string' && session.accessTokenExpiresAt)
       ? session.accessTokenExpiresAt
@@ -109,7 +108,6 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
       accessToken: typeof session.accessToken === 'string' && session.accessToken ? session.accessToken : null,
       expiresAt: expiresAt ?? null,
       accessTokenExpiresAt: accessTokenExpiresAt ?? null,
-      cookie,
       sessionToken,
       email: (typeof session.email === 'string' && session.email ? session.email : null)
         || emailFromHubToken(hubAccessToken),
@@ -142,7 +140,7 @@ function saveAuthSession(session, env = process.env, { fs: fsImpl = fs } = {}) {
     try { fsImpl.unlinkSync(tmp); } catch { /* never existed */ }
     throw e;
   }
-  recordAccountMarker(cookie ? 'email' : sessionToken ? 'device' : 'token', env, { fs: fsImpl });
+  recordAccountMarker(sessionToken ? 'device' : 'token', env, { fs: fsImpl });
   return target;
 }
 
@@ -156,19 +154,16 @@ function loadAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
   }
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
   if (parsed.version !== SESSION_FILE_VERSION) return null;
-  // A usable session needs at least ONE credential: the durable cookie (email/
-  // better-auth) or a JWT (Google/legacy, or an email session whose JWT is cached).
-  const hasCookie = typeof parsed.cookie === 'string' && parsed.cookie;
   const hasToken = typeof parsed.accessToken === 'string' && parsed.accessToken;
   const sessionToken = typeof parsed.sessionToken === 'string' && parsed.sessionToken ? parsed.sessionToken : null;
-  if (!hasCookie && !hasToken && !sessionToken) return null;
+  if (typeof parsed.cookie === 'string' && parsed.cookie && !sessionToken) return null;
+  if (!hasToken && !sessionToken) return null;
   const hubAccessToken = typeof parsed.hubAccessToken === 'string' && parsed.hubAccessToken ? parsed.hubAccessToken : null;
   const email = (typeof parsed.email === 'string' && parsed.email ? parsed.email : null) || emailFromHubToken(hubAccessToken);
   return {
     accessToken: hasToken ? parsed.accessToken : null,
     expiresAt: typeof parsed.expiresAt === 'string' ? parsed.expiresAt : null,
     accessTokenExpiresAt: typeof parsed.accessTokenExpiresAt === 'string' ? parsed.accessTokenExpiresAt : null,
-    cookie: hasCookie ? parsed.cookie : null,
     sessionToken,
     email,
     hubAccessToken,
@@ -193,8 +188,7 @@ function clearAuthSession(env = process.env, { fs: fsImpl = fs } = {}) {
 
 // `none | active | expired`, the three states the caller needs to give the Talent a true message.
 function sessionStatus(session, now = Date.now()) {
-  // A credential is a durable cookie or session token, or a JWT (Google/legacy).
-  const hasCred = !!(session && [session.accessToken, session.cookie, session.sessionToken].some((v) => typeof v === 'string' && v));
+  const hasCred = !!(session && [session.accessToken, session.sessionToken].some((v) => typeof v === 'string' && v));
   if (!hasCred) return 'none';
   const expiry = Date.parse(String(session.expiresAt || ''));
   if (!Number.isFinite(expiry)) return 'expired';

package/src/backend-request.js

@@ -80,8 +80,7 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
           raw += chunk;
           if (raw.length > MAX_RESPONSE_BYTES) req.destroy();
         });
-        // `headers` is exposed so the better-auth email flow can read `Set-Cookie` (the session cookie it captures and replays); every other caller reads only `{status, raw}` and ignores it.
-        res.on('end', () => resolve({ status: res.statusCode, raw, headers: res.headers }));
+        res.on('end', () => resolve({ status: res.statusCode, raw }));
       },
     );
     req.on('timeout', () => req.destroy(Object.assign(new Error('request timed out'), { kind: 'timeout' })));
@@ -91,27 +90,6 @@ function postJsonWithTimeout(url, body, timeoutMs, method = 'POST', idempotencyK
   });
 }
 
-// Pulls one `name=value` cookie pair out of a response's `Set-Cookie` header (Node exposes it as an array, or a single string).
-// Accepts the base cookie name with or without the RFC6265 `__Secure-`/`__Host-`
-// prefixes that better-auth applies over HTTPS, and returns the EXACT server-set
-// name (prefix included) so it can be forwarded back verbatim in a `Cookie:` header.
-function extractSetCookie(headers, name) {
-  if (!headers) return null;
-  const raw = headers['set-cookie'];
-  const list = Array.isArray(raw) ? raw : (typeof raw === 'string' && raw ? [raw] : []);
-  const candidates = [name, `__Secure-${name}`, `__Host-${name}`];
-  for (const candidate of candidates) {
-    const prefix = `${candidate}=`;
-    for (const entry of list) {
-      if (typeof entry === 'string' && entry.startsWith(prefix)) {
-        const value = entry.slice(prefix.length).split(';')[0];
-        if (value) return `${candidate}=${value}`;
-      }
-    }
-  }
-  return null;
-}
-
 function postMultipartWithTimeout(url, fields, timeoutMs, method = 'POST', extraHeaders = null) {
   return new Promise((resolve, reject) => {
     let u;
@@ -204,7 +182,6 @@ module.exports = {
   MAX_RESPONSE_BYTES,
   postJsonWithTimeout,
   postMultipartWithTimeout,
-  extractSetCookie,
   requestBackend,
   setClientIdentity,
 };

package/src/cli-skill.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const { SERVER_NAME } = require('./mcp-server-name');
+
+const CLI_SKILL_NAME = 'shakers-cli';
+
+const OWN_SKILL_NAMES = new Set([CLI_SKILL_NAME, SERVER_NAME]);
+
+const CLI_SKILL_DESCRIPTION = 'Use Shakers, the freelance talent marketplace, from the terminal through the `shakers` CLI: find, view and save projects, read the talent profile, certifications, applications and invitations, and get the link to certify a role dimension. Use when the talent wants to work with Shakers from the terminal or mentions the `shakers` command.';
+
+const BODY = `# Shakers CLI
+
+Shakers is a freelance talent marketplace. The \`shakers\` CLI acts on the talent's own account. You run it for the talent, with their permission.
+
+## Rules
+
+- Before running any command, show the talent the exact command and ask them first.
+- Run only the \`shakers\` commands listed in this skill. If \`shakers\` is not on PATH, run the same command as \`npx -y shakers-cli <command>\`.
+- Install only the official npm package \`shakers-cli\`. Never install a package with a similar name.
+- Never run \`shakers update\` without \`--check\` unless the talent explicitly asks to update.
+- Put the command name first (\`shakers me --json\`, not \`shakers --json me\`).
+- Prefer \`--json\` and read ids from the JSON. Never pass the \`N)\` numbers of a printed list: a number refers to the last human listing, not to your JSON.
+- If the Shakers MCP server tools are available in this session and the talent did not ask for the terminal, use those tools instead of this skill.
+
+## Not logged in
+
+A command that needs a session exits 1 and prints on stderr that it requires an active session. Do not try to log in for the talent. Tell them to run \`shakers login\` in their own terminal, then retry the command.
+
+Without \`--json\`, each command first prints on stderr one line saying what Shakers does on this computer and in the account (what it reads, changes or sends). Relay that line to the talent word for word.
+
+## Commands you may run
+
+Projects:
+- \`shakers find-projects --json [--page N] [--limit N] [--tab all|saved] [--attendance remote|hybrid|in-person] [--country ES] [--recommended]\`: projects available to the talent. The id of each item is \`items[].positionId\`.
+- \`shakers show-project <positionId> --json\`: detail of one project.
+- \`shakers save-project <positionId> --json\` and \`shakers unsave-project <positionId> --json\`: add or remove a saved project.
+- \`shakers applications --json\`: projects the talent applied to and their status (\`items[].positionId\`).
+- \`shakers invitations --json\`: the talent's unread project invitations.
+
+Profile (read only):
+- \`shakers me --json\`: profile summary.
+- \`shakers rate --json\`, \`shakers availability --json\`, \`shakers lang --json\`, \`shakers socials --json\`.
+- \`shakers experiences --json\`, \`shakers portfolios --json\`.
+
+Certifications:
+- \`shakers certifications --json\`: certified, uncertified and expired dimensions.
+- \`shakers certify --dimension <key>\`: only when the talent named the dimension. It prints a link; the interview happens on the web. Show the talent the link. It has no \`--json\`.
+
+Account:
+- \`shakers config list\` and \`shakers config get <key>\`: read the CLI configuration.
+- \`shakers update --check --json\`: tells whether a newer version exists. Installs nothing.
+- \`shakers logout\`: only when the talent asks to sign out.
+
+## Hand these to the talent
+
+Never run these yourself. They need the talent at their own keyboard: they ask for consent, reviews or choices, and \`login\` and \`register\` open a Shakers page on shakersworks.com with a code the talent checks and approves (the password is typed only there, never in a terminal). Tell the talent the exact command to run in their own terminal, or point them to the web (https://www.shakersworks.com) or the Shakers MCP server.
+
+- \`shakers register\` and \`shakers onboarding\`: sign-up and the onboarding interview.
+- \`shakers login\`.
+- \`shakers ai-usage\`: the AI-usage analysis and upload. The talent gives consent and reviews what is sent.
+- Profile changes: \`shakers rate --set\`, \`shakers availability --set\`, \`shakers lang --set\`, \`shakers socials --set\`.
+- \`shakers add-agent\`, \`shakers add-skill\`, \`shakers add-project\`, \`shakers add-role\`, \`shakers change-role\`.
+- \`shakers config set\`.
+`;
+
+function cliSkill() {
+  return [
+    '---',
+    `name: ${CLI_SKILL_NAME}`,
+    `description: ${JSON.stringify(CLI_SKILL_DESCRIPTION)}`,
+    '---',
+    '',
+    BODY,
+  ].join('\n');
+}
+
+module.exports = { cliSkill, CLI_SKILL_NAME, OWN_SKILL_NAMES };