shakers-cli 0.17.0 → 0.19.0

package/src/command-audit.js

@@ -1,7 +1,9 @@
 'use strict';
 
+const crypto = require('crypto');
 const os = require('os');
 const path = require('path');
+const { spawn } = require('child_process');
 const { scrubSecrets } = require('./agent-synthesis');
 const { loadAuthSession, decodeJwtPayload } = require('./auth-session-store');
 const { getCertsBase } = require('./config');
@@ -13,6 +15,13 @@ const AUDIT_TIMEOUT_MS = 1500;
 // Capped at 200 chars AFTER scrubbing (mirrors MAX_COMMAND_LEN in session-scan.js) so a secret straddling the cut cannot leak.
 const MAX_ARGS_LEN = 200;
 
+const WORKER = path.join(__dirname, '..', 'bin', 'command-audit-worker.js');
+const PAYLOAD_VAR = 'SHAKERS_CLI_AUDIT_PAYLOAD';
+
+function auditDisabled(env) {
+  return !!env && env.SHAKERS_CLI_NO_AUDIT === '1';
+}
+
 function cliVersion() {
   try {
     return require(path.join(__dirname, '..', 'package.json')).version || null;
@@ -28,6 +37,16 @@ function redactArgs(argv) {
   return scrubbed || null;
 }
 
+// `apply` takes only the position ref: anything typed after it could be the talent's message, so it never reaches the log.
+function withoutFreeText(argv) {
+  if (!Array.isArray(argv)) return argv;
+  const words = argv.filter((a) => typeof a === 'string' && !a.startsWith('-')).map((w) => w.toLowerCase());
+  const at = words[0] === 'apply' ? 0 : words[0] === 'projects' && words[1] === 'apply' ? 1 : -1;
+  if (at === -1) return argv;
+  const kept = argv.filter((a) => typeof a === 'string' && !a.startsWith('-'));
+  return kept.slice(0, at + 2);
+}
+
 // Anonymous runs carry only a best-effort machine hint; authenticated runs identify via the Bearer instead.
 function machineHint() {
   let osUser = null;
@@ -52,7 +71,7 @@ function jwtExpired(token, now) {
 }
 
 // Builds the record + headers; returns null when there is no endpoint to post to.
-function buildAudit(command, argv, env) {
+function buildAudit(command, argv, env, id = null) {
   let base;
   try {
     base = getCertsBase(env);
@@ -66,8 +85,9 @@ function buildAudit(command, argv, env) {
   const token = stored && !jwtExpired(stored, Date.now()) ? stored : null;
 
   const body = {
+    ...(id ? { id } : {}),
     command: String(command || 'unknown').slice(0, 100),
-    args: redactArgs(argv),
+    args: redactArgs(withoutFreeText(argv)),
     cliVersion: cliVersion(),
     clientTimestamp: new Date().toISOString(),
   };
@@ -85,9 +105,10 @@ function buildAudit(command, argv, env) {
 }
 
 // Emits ONE fire-and-forget audit record; never throws or rejects. Returns the `.catch`-guarded promise so tests can await it (production does not).
-function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
+function emitCommandAudit({ command, argv = [], env = process.env, id = null } = {}) {
   try {
-    const audit = buildAudit(command, argv, env);
+    if (auditDisabled(env)) return Promise.resolve();
+    const audit = buildAudit(command, argv, env, id);
     if (!audit) return Promise.resolve();
     return postJsonWithTimeout(
       audit.endpoint,
@@ -105,4 +126,36 @@ function emitCommandAudit({ command, argv = [], env = process.env } = {}) {
   }
 }
 
-module.exports = { emitCommandAudit, redactArgs, buildAudit };
+async function logCommandRun({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  await emitCommandAudit({ command, argv, env, id });
+  return id;
+}
+
+let runId = null;
+
+function startCommandAudit({ command, argv = [], env = process.env } = {}) {
+  if (auditDisabled(env)) return null;
+  const id = crypto.randomUUID();
+  try {
+    const child = spawn(process.execPath, [WORKER], {
+      detached: true,
+      stdio: 'ignore',
+      windowsHide: true,
+      env: { ...env, [PAYLOAD_VAR]: JSON.stringify({ id, command, args: redactArgs(withoutFreeText(argv)) }) },
+    });
+    child.on('error', () => {});
+    child.unref();
+  } catch {
+    return null;
+  }
+  runId = id;
+  return id;
+}
+
+function currentRunId() {
+  return runId;
+}
+
+module.exports = { emitCommandAudit, startCommandAudit, logCommandRun, currentRunId, redactArgs, withoutFreeText, buildAudit, PAYLOAD_VAR };

package/src/config.js

@@ -300,14 +300,6 @@ function getAgentEvaluationEndpoint(env = process.env) {
   return deriveFromIngest(env, 'agent-evaluation');
 }
 
-// Login endpoint — better-auth email sign-in: `POST {hubBase}/auth/sign-in/email` with `{email,password}`.
-function getLoginEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'LOGIN_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-in/email');
-}
-
-// better-auth JWT endpoint: `GET {hubBase}/auth/token` with the session cookie → `{token}` (ES256/JWKS, ~15-min TTL).
 function getSignOutEndpoint(env = process.env) {
   return deriveFromHub(env, 'auth/sign-out');
 }
@@ -421,6 +413,19 @@ function getUnsavePositionEndpoint(positionId, env = process.env) {
   return deriveFromHub(env, `works/talent/saved-positions/${encodeURIComponent(positionId)}`);
 }
 
+function getPositionApplicationEndpoint(positionId, env = process.env) {
+  const explicit = readEnv(env, 'POSITION_APPLICATION_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  if (positionId == null || typeof positionId === 'object') return null;
+  return deriveFromHub(env, `works/talent/positions/${encodeURIComponent(positionId)}/application`);
+}
+
+function getCandidaturesEndpoint(env = process.env) {
+  const explicit = readEnv(env, 'CANDIDATURES_ENDPOINT');
+  if (explicit && explicit.trim()) return explicit.trim();
+  return deriveFromHub(env, 'works/talent/candidatures');
+}
+
 function getReceivedInvitationsEndpoint(env = process.env) {
   const explicit = readEnv(env, 'RECEIVED_INVITATIONS_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -589,12 +594,6 @@ function deriveFromHub(env, relativePath) {
   return `${base}/${relativePath}`;
 }
 
-function getSignUpEndpoint(env = process.env) {
-  const explicit = readEnv(env, 'SIGNUP_ENDPOINT');
-  if (explicit && explicit.trim()) return explicit.trim();
-  return deriveFromHub(env, 'auth/sign-up/email');
-}
-
 function getImportProfileEndpoint(env = process.env) {
   const explicit = readEnv(env, 'IMPORT_PROFILE_ENDPOINT');
   if (explicit && explicit.trim()) return explicit.trim();
@@ -832,7 +831,6 @@ module.exports = {
   getSynthesisEndpoint,
   getRoadmapEndpoint,
   getAgentEvaluationEndpoint,
-  getLoginEndpoint,
   getAuthTokenEndpoint,
   getSignOutEndpoint,
   getCompleteRegistrationEndpoint,
@@ -852,6 +850,8 @@ module.exports = {
   // Marketplace (show-project / save-project / unsave-project / invitations).
   getPositionDetailEndpoint,
   getSavePositionEndpoint,
+  getPositionApplicationEndpoint,
+  getCandidaturesEndpoint,
   getUnsavePositionEndpoint,
   getReceivedInvitationsEndpoint,
   getMyCandidaturesEndpoint,
@@ -884,7 +884,6 @@ module.exports = {
   getCertsBase,
   getHubBase,
   sanitizeStaleBakedEndpoints,
-  getSignUpEndpoint,
   getImportProfileEndpoint,
   getMcpSignupEndpoint,
   getMyImportStatusEndpoint,

package/src/consent-flow.js

@@ -15,9 +15,12 @@ const MAX_ATTEMPTS = 5;
 const YES_RE = /^(y|yes|s|si|sí)$/i;
 const NO_RE = /^(n|no)$/i;
 
-async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false } = {}) {
+const UNANSWERED = Symbol('unanswered');
+
+async function askYesNo(ask, question, catalog, { defaultNo = false, defaultYes = false, blankUnanswered = false } = {}) {
   for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
     const raw = String(await ask(question)).trim();
+    if (blankUnanswered && raw === '') return UNANSWERED;
     if (defaultNo && raw === '') return false;
     if (defaultYes && raw === '') return true;
     if (YES_RE.test(raw)) return true;
@@ -56,6 +59,7 @@ async function runConsentPrompt({
   sessionEmail = null,
   drainBeforeAsk = false,
   profile = 'talent',
+  requireExplicitAnswer = false,
 }) {
   const c = catalog.consent;
   // Presentation only: framed by src/legal-notice.js on a
@@ -69,7 +73,8 @@ async function runConsentPrompt({
   }
 
   // defaultNo: a blank Enter means "do not save" (legal requirement).
-  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: true });
+  const accepted = await askYesNo(ask, c.persistQuestion, catalog, { defaultNo: !requireExplicitAnswer, blankUnanswered: requireExplicitAnswer });
+  if (accepted === UNANSWERED) return 'unanswered';
   if (accepted === null) {
     process.stdout.write(`  ${c.notObtained}\n\n`);
     return null;

package/src/detect-repos.js

@@ -2,12 +2,7 @@
 
 const { execFileSync } = require('child_process');
 const path = require('path');
-const {
-  toolSources,
-  listSessionFiles,
-  readSessionObjects,
-  resolveFileCwd,
-} = require('./session-scan');
+const { toolSources, sourceSessions, resolveFileCwd } = require('./session-scan');
 const { normalizeRemote } = require('./authorship');
 
 const GIT_TIMEOUT_MS = 15000;
@@ -37,8 +32,9 @@ function sessionCwdCounts(env = process.env) {
   const counts = new Map();
   let unassigned = 0;
   for (const source of toolSources(env)) {
-    for (const file of listSessionFiles(source.dir)) {
-      const cwd = resolveFileCwd(readSessionObjects(file));
+    if (source.repoLevel) continue;
+    for (const { objects } of sourceSessions(source)) {
+      const cwd = resolveFileCwd(objects);
       if (cwd === null) {
         unassigned += 1;
         continue;

package/src/detected-agents.js

@@ -0,0 +1,40 @@
+'use strict';
+
+const { normalizeAgentName } = require('./tier-engine');
+const { scrubSecrets } = require('./agent-synthesis');
+const { requestDeclareAgent } = require('./agents-client');
+
+function detectedAgentsFromReport(report) {
+  const synthesis = report && report.agentSynthesis && Array.isArray(report.agentSynthesis.agents) ? report.agentSynthesis.agents : [];
+  const whatItDoesByName = new Map(synthesis.filter((a) => a && a.name).map((a) => [a.name, a.whatItDoes]));
+  const agents = report && Array.isArray(report.agents) ? report.agents : [];
+  return agents
+    .filter((a) => a && typeof a.name === 'string' && a.name)
+    .map((a) => ({ name: a.name, whatItDoes: whatItDoesByName.get(a.name) || null }));
+}
+
+function newDetectedAgents(candidates, profileAgents) {
+  const taken = new Set((Array.isArray(profileAgents) ? profileAgents : []).map((a) => normalizeAgentName(a && a.name)));
+  const fresh = [];
+  for (const agent of Array.isArray(candidates) ? candidates : []) {
+    const key = normalizeAgentName(agent && agent.name);
+    if (!key || taken.has(key)) continue;
+    taken.add(key);
+    fresh.push({ name: agent.name.trim(), whatItDoes: typeof agent.whatItDoes === 'string' && agent.whatItDoes ? agent.whatItDoes : null });
+  }
+  return fresh;
+}
+
+async function declareDetectedAgents(agents, { accessToken, hubAccessToken }, { endpoint, declare = requestDeclareAgent } = {}) {
+  const added = [];
+  const failed = [];
+  for (const agent of agents) {
+    const whatItDoes = agent.whatItDoes ? scrubSecrets(agent.whatItDoes) : undefined;
+    const result = await declare({ name: agent.name, whatItDoes, accessToken, hubAccessToken }, { endpoint });
+    if (result && result.ok) added.push(agent);
+    else failed.push({ agent, reason: (result && result.reason) || 'declare-failed' });
+  }
+  return { added, failed };
+}
+
+module.exports = { detectedAgentsFromReport, newDetectedAgents, declareDetectedAgents };

package/src/detectors.js

@@ -115,6 +115,29 @@ const detectors = [
       { type: 'bin', name: 'codex' },
     ],
   },
+  {
+    id: 'pi',
+    name: 'Pi',
+    vendor: 'Earendil Works',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: '.pi' },
+      { type: 'homePath', path: '.pi/agent' },
+    ],
+  },
+  {
+    id: 'opencode',
+    name: 'OpenCode',
+    vendor: 'OpenCode',
+    category: CATEGORIES.AGENTIC_CLI,
+    signals: [
+      { type: 'projectPath', path: 'opencode.json' },
+      { type: 'projectPath', path: '.opencode' },
+      { type: 'homePath', path: '.config/opencode' },
+      { type: 'homePath', path: '.local/share/opencode' },
+      { type: 'bin', name: 'opencode' },
+    ],
+  },
   {
     id: 'cody',
     name: 'Cody',

package/src/device-auth-store.js

@@ -26,7 +26,7 @@ function savePendingDevice(pending, env = process.env, { fs: fsImpl = fs } = {})
       interval: typeof pending.interval === 'number' && pending.interval > 0 ? Math.floor(pending.interval) : 5,
       expiresAt: typeof pending.expiresAt === 'string' && pending.expiresAt ? pending.expiresAt : null,
       mode: pending.mode === 'register' ? 'register' : 'login',
-      provider: pending.provider === 'linkedin' ? 'linkedin' : 'google',
+      provider: pending.provider === 'linkedin' || pending.provider === 'email' ? pending.provider : 'google',
       registerContext: pending.registerContext && typeof pending.registerContext === 'object' ? pending.registerContext : null,
       email: typeof pending.email === 'string' && pending.email ? pending.email : null,
       version: DEVICE_FILE_VERSION,
@@ -75,7 +75,7 @@ function loadPendingDevice(env = process.env, { fs: fsImpl = fs } = {}) {
     interval: typeof parsed.interval === 'number' && parsed.interval > 0 ? Math.floor(parsed.interval) : 5,
     expiresAt: typeof parsed.expiresAt === 'string' && parsed.expiresAt ? parsed.expiresAt : null,
     mode: parsed.mode === 'register' ? 'register' : 'login',
-    provider: parsed.provider === 'linkedin' ? 'linkedin' : 'google',
+    provider: parsed.provider === 'linkedin' || parsed.provider === 'email' ? parsed.provider : 'google',
     registerContext: parsed.registerContext && typeof parsed.registerContext === 'object' ? parsed.registerContext : null,
     email: typeof parsed.email === 'string' && parsed.email ? parsed.email : null,
   };

package/src/device-login.js

@@ -10,15 +10,16 @@ function defaultSleep(ms) {
   return new Promise((resolve) => { setTimeout(resolve, ms); });
 }
 
-// The /cli-login page reads `provider` from the query to pick the social button.
-function appendProviderParam(url, provider) {
-  if (!url || !provider) return url;
+function withDeviceParams(url, params = {}) {
+  const entries = Object.entries(params).filter(([, v]) => typeof v === 'string' && v);
+  if (!url || !entries.length) return url;
   try {
     const u = new URL(url);
-    u.searchParams.set('provider', provider);
+    for (const [k, v] of entries) u.searchParams.set(k, v);
     return u.href;
   } catch {
-    return `${url}${url.includes('?') ? '&' : '?'}provider=${encodeURIComponent(provider)}`;
+    const query = entries.map(([k, v]) => `${k}=${encodeURIComponent(v)}`).join('&');
+    return `${url}${url.includes('?') ? '&' : '?'}${query}`;
   }
 }
 
@@ -32,7 +33,7 @@ async function pollDeviceToken({ deviceCode, tokenEndpoint, clientId, timeoutMs
 
 // ORDER: a NEW user needs complete-registration BEFORE GET /auth/token (else the Hub 500s: no domain user).
 async function finalizeDeviceSession(
-  { sessionToken, isNewUser, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, claimCode = null, timeoutMs } = {},
+  { sessionToken, isNewUser, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, consent = null, claimCode = null, timeoutMs } = {},
   {
     requestCompleteRegistration = require('./signup-client').requestCompleteRegistration,
     requestApiToken: apiToken = requestApiToken,
@@ -42,7 +43,7 @@ async function finalizeDeviceSession(
 
   let claimed = false;
   if (isNewUser && completeRegistrationEndpoint) {
-    const done = await requestCompleteRegistration(registrationContext || {}, { endpoint: completeRegistrationEndpoint, bearerToken: sessionToken, claimCode, timeoutMs });
+    const done = await requestCompleteRegistration(registrationContext || {}, { endpoint: completeRegistrationEndpoint, bearerToken: sessionToken, claimCode, consent, timeoutMs });
     if (!done.ok) return { ok: false, reason: done.reason || 'complete-registration-failed' };
     claimed = done.claimed === true;
   }
@@ -53,7 +54,7 @@ async function finalizeDeviceSession(
 }
 
 async function runDeviceLogin(
-  { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, clientId, scope, timeoutMs } = {},
+  { authorizeEndpoint, tokenEndpoint, authTokenEndpoint, completeRegistrationEndpoint = null, registrationContext = null, consent = null, clientId, scope, timeoutMs } = {},
   {
     onPrompt = null,
     onWaiting = null,
@@ -92,6 +93,7 @@ async function runDeviceLogin(
         authTokenEndpoint,
         completeRegistrationEndpoint,
         registrationContext,
+        consent,
         timeoutMs,
       });
       if (!fin.ok) return { ok: false, reason: fin.reason };
@@ -124,7 +126,7 @@ module.exports = {
   pollDeviceToken,
   finalizeDeviceSession,
   runDeviceLogin,
-  appendProviderParam,
+  withDeviceParams,
   defaultSleep,
   SLOW_DOWN_STEP_SECONDS,
   DEFAULT_MAX_WAIT_MS,

package/src/env-paths.js

@@ -13,6 +13,14 @@ function getHomeDir(env = process.env) {
   return readEnv(env, 'HOME_DIR') || os.homedir();
 }
 
+function codexHome(env = process.env) {
+  return env.CODEX_HOME || require('path').join(getHomeDir(env), '.codex');
+}
+
+function piAgentDir(env = process.env) {
+  return env.PI_CODING_AGENT_DIR ? expandHome(env.PI_CODING_AGENT_DIR, env) : require('path').join(getHomeDir(env), '.pi', 'agent');
+}
+
 // `~/Documents/cv.pdf` -> absolute, so a model can pass the short form it was shown.
 function expandHome(file, env = process.env) {
   if (typeof file !== 'string') return file;
@@ -27,4 +35,4 @@ function tildify(file, env = process.env) {
   return typeof file === 'string' && file.startsWith(`${home}/`) ? `~/${file.slice(home.length + 1)}` : file;
 }
 
-module.exports = { getHomeDir, readEnv, expandHome, tildify };
+module.exports = { getHomeDir, codexHome, piAgentDir, readEnv, expandHome, tildify };