@dench.com/cli 2.1.4 → 2.2.0

package/dench.ts

@@ -296,9 +296,34 @@ function throwIfCliError(value: unknown) {
   }
 }
 
+/**
+ * Production Convex deployments mask `error.message` ("[Request ID: …]
+ * Server Error") but forward `ConvexError.data` verbatim. Prefer the data
+ * payload so agents see the actionable message instead of the mask.
+ */
+function convexErrorData(error: unknown): string | undefined {
+  if (!error || typeof error !== "object" || !("data" in error)) {
+    return undefined;
+  }
+  const data = (error as { data?: unknown }).data;
+  if (typeof data === "string" && data.trim()) return data;
+  if (data && typeof data === "object") {
+    const message = (data as { message?: unknown }).message;
+    if (typeof message === "string" && message.trim()) return message;
+    try {
+      return JSON.stringify(data);
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
 function normalizeCliError(error: unknown): CliError {
   if (error instanceof CliError) return error;
-  const message = error instanceof Error ? error.message : String(error);
+  const message =
+    convexErrorData(error) ??
+    (error instanceof Error ? error.message : String(error));
   if (message.includes("Invalid dev agent key")) {
     return new CliError("Invalid dev agent key", {
       code: "invalid_dev_agent_key",
@@ -486,10 +511,6 @@ Cloud browser (Browserbase, runs entirely in Dench Cloud):
   dench browser stop
   Help: dench browser help
 
-LinkedIn outreach (Browserbase, verified before CRM update):
-  dench linkedin connect <profileUrl> [--entry people:<entryId>] [--json]
-  Help: dench linkedin help
-
 Managed email campaigns (Dench Emailing Service):
   dench email identity verify --from founder@example.com [--json]
   dench email template create --name "Intro" --subject "Hi {{firstName}}" --html-file body.html [--json]
@@ -2351,6 +2372,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: resolveApiHost(host),
+        convexUrl: stored.session.convexUrl,
         client: createCliConvexClient(stored.session.convexUrl),
         sessionToken: stored.session.sessionToken,
         organization: stored.session.organization,
@@ -2397,6 +2419,7 @@ async function getRuntime() {
       return {
         mode: "apiKey" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: apiKey,
         organization: sandboxOrganization,
@@ -2412,6 +2435,7 @@ async function getRuntime() {
       return {
         mode: "session" as const,
         host: apiHost,
+        convexUrl: sandboxConvexUrl,
         client: createCliConvexClient(sandboxConvexUrl),
         sessionToken: sandboxAgentToken,
         organization: sandboxOrganization,
@@ -2981,13 +3005,44 @@ function suggestedWorkFromArtifacts(artifacts: JsonRecord[]) {
   );
 }
 
+/**
+ * The fs daemon authenticates purely from `CONVEX_URL` + `DENCH_API_KEY`
+ * env vars (sandboxes bake them in). Local shells running off an OAuth
+ * agent session have neither — resolve the active session and inject
+ * its convexUrl + `dch_agent_*` token. The server-side files functions
+ * accept the agent-session token in the same `apiKey` slot (prefix
+ * dispatch, like `requireCrmAccess`), so the daemon works unchanged.
+ */
+async function resolveFsDaemonEnv(): Promise<NodeJS.ProcessEnv> {
+  if (process.env.CONVEX_URL?.trim() && process.env.DENCH_API_KEY?.trim()) {
+    return process.env;
+  }
+  try {
+    const runtime = await getRuntime();
+    if (runtime.mode === "session" || runtime.mode === "apiKey") {
+      return {
+        ...process.env,
+        CONVEX_URL: process.env.CONVEX_URL?.trim() || runtime.convexUrl,
+        DENCH_API_KEY:
+          process.env.DENCH_API_KEY?.trim() || runtime.sessionToken,
+      };
+    }
+  } catch {
+    // No saved session / dev env — fall through with the unmodified env;
+    // the daemon prints its own missing-credential error for subcommands
+    // that need Convex access.
+  }
+  return process.env;
+}
+
 async function runFsCommand() {
   const subArgs = args.slice(args.indexOf("fs") + 1);
   const configuredBinary = process.env.DENCH_FS_DAEMON_BIN?.trim();
   const binary = configuredBinary || "dench-fs-daemon";
+  const daemonEnv = await resolveFsDaemonEnv();
   let exitCode: number;
   try {
-    exitCode = await spawnInherited(binary, subArgs);
+    exitCode = await spawnInherited(binary, subArgs, daemonEnv);
   } catch (error) {
     if (configuredBinary || !isCommandNotFound(error)) {
       throw error;
@@ -2995,7 +3050,11 @@ async function runFsCommand() {
     const localDaemon = fileURLToPath(
       new URL("./fs-daemon.ts", import.meta.url),
     );
-    exitCode = await spawnInherited("bun", [localDaemon, ...subArgs]);
+    exitCode = await spawnInherited(
+      "bun",
+      [localDaemon, ...subArgs],
+      daemonEnv,
+    );
   }
   if (exitCode !== 0) {
     process.exitCode = exitCode;
@@ -3025,8 +3084,18 @@ async function requireFilesApiKey(
   runtime: Runtime,
   command: string,
 ): Promise<string> {
-  const auth = await resolveGatewayCommandAuth(runtime, command);
-  return auth.bearerToken;
+  // The Convex files functions accept either a unified Dench API key OR a
+  // `dch_agent_*` OAuth agent-session token in their `apiKey` arg (the
+  // server dispatches on prefix, same as `requireCrmAccess`). So the
+  // runtime's own bearer works directly — no gateway-key exchange, which
+  // used to gate OAuth sessions behind a paid workspace and an extra
+  // host round-trip.
+  if (runtime.mode === "session" || runtime.mode === "apiKey") {
+    return runtime.sessionToken;
+  }
+  const envApiKey = process.env.DENCH_API_KEY?.trim();
+  if (envApiKey) return envApiKey;
+  throw loginRequiredError(command);
 }
 
 type FileTreeRow = {
@@ -3603,11 +3672,15 @@ function sha256HexSync(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-async function spawnInherited(binary: string, commandArgs: string[]) {
+async function spawnInherited(
+  binary: string,
+  commandArgs: string[],
+  env: NodeJS.ProcessEnv = process.env,
+) {
   return await new Promise<number>((resolve, reject) => {
     const child = spawn(binary, commandArgs, {
       stdio: "inherit",
-      env: process.env,
+      env,
     });
     child.on("error", reject);
     child.on("close", (code) => resolve(code ?? 1));
@@ -3661,18 +3734,6 @@ async function main() {
     return;
   }
 
-  if (
-    command === "linkedin" &&
-    (!subcommand || subcommand === "help" || hasFlag("--help"))
-  ) {
-    const { runLinkedInCommand } = await import("./linkedin");
-    await runLinkedInCommand({
-      args: subcommand ? [subcommand] : ["help"],
-      runtime: { host: "", bearerToken: "" },
-    });
-    return;
-  }
-
   if (
     command === "email" &&
     (!subcommand || subcommand === "help" || hasFlag("--help"))
@@ -3991,24 +4052,6 @@ async function main() {
     return;
   }
 
-  if (command === "linkedin") {
-    const subArgs = args.slice(args.indexOf("linkedin") + 1);
-    const { runLinkedInCommand } = await import("./linkedin");
-    const runtime = await getRuntime();
-    const authedRuntime = requireAuthenticatedRuntime(
-      runtime,
-      "dench linkedin",
-    );
-    await runLinkedInCommand({
-      args: subArgs,
-      runtime: {
-        host: authedRuntime.host,
-        bearerToken: authedRuntime.sessionToken,
-      },
-    });
-    return;
-  }
-
   if (command === "chat") {
     const subArgs = args.slice(args.indexOf("chat") + 1);
     const sub = subArgs[0];

package/email.ts

@@ -189,12 +189,17 @@ export function emailHelp() {
 
 Usage:
   dench email identity verify --from founder@example.com [--json]
-  dench email identity verify --domain example.com --from founder@example.com [--json]
+  dench email identity verify --domain example.com [--from founder@example.com] [--json]
+  dench email identity list [--domain example.com] [--json]
+  dench email identity dns --identity <identityId|domain|email> [--json]
   dench email identity status --identity founder@example.com [--json]
   dench email identity status --identity-id <identityId> [--json]
+  dench email send --from founder@example.com --to "Ada <ada@x.com>,bob@y.com" --subject "Hi" (--html-file body.html | --text "...") [--cc ...] [--bcc ...] [--from-name "Ada"] [--reply-to support@x.com] [--reply-message-id <messageId|rfc-id>] [--json]
+  dench email message status --message <messageId> [--json]
+  dench email message list [--limit 25] [--json]
   dench email template create --name "Intro" --subject "Hi {{firstName}}" --html-file body.html [--text-file body.txt] [--json]
   dench email template preview --template <id> --data '{"firstName":"Ada"}' [--json]
-  dench email campaign create --name "Q2 outreach" --identity <id> --template <id> [--json]
+  dench email campaign create --name "Q2 outreach" --identity <identityId|fromEmail> --template <id> [--json]
   dench email campaign recipients add --campaign <id> --file recipients.jsonl [--json]
   dench email campaign preview --campaign <id> [--sample 5] [--json]
   dench email campaign submit --campaign <id> [--json]
@@ -212,6 +217,14 @@ export async function runEmailCommand(ctx: EmailCliContext): Promise<void> {
     await runIdentity(ctx);
     return;
   }
+  if (group === "send") {
+    await runSend(ctx);
+    return;
+  }
+  if (group === "message") {
+    await runMessage(ctx);
+    return;
+  }
   if (group === "template") {
     await runTemplate(ctx);
     return;
@@ -223,11 +236,193 @@ export async function runEmailCommand(ctx: EmailCliContext): Promise<void> {
   throw new EmailCliError(`Unknown dench email subcommand: ${group}`);
 }
 
+/**
+ * Parse a comma-separated address list where each entry is either a bare
+ * email or `Name <email>`.
+ */
+function parseAddressList(
+  value: string | undefined,
+): Array<{ email: string; name?: string }> {
+  if (!value?.trim()) return [];
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => {
+      const match = entry.match(/^(.*)<([^<>\s]+@[^<>\s]+)>$/);
+      if (match) {
+        const name = match[1].trim().replace(/^"|"$/g, "").trim();
+        return { email: match[2].trim(), name: name || undefined };
+      }
+      return { email: entry };
+    });
+}
+
+async function runSend(ctx: EmailCliContext) {
+  const from = requiredFlag(ctx.args, "--from");
+  const to = parseAddressList(requiredFlag(ctx.args, "--to"));
+  if (to.length === 0) {
+    throw new EmailCliError(
+      'No valid --to recipients. Use --to "Ada <ada@x.com>,bob@y.com"',
+    );
+  }
+  const cc = parseAddressList(getFlag(ctx.args, "--cc"));
+  const bcc = parseAddressList(getFlag(ctx.args, "--bcc"));
+  const htmlBody = await readTextFlag(ctx.args, "--html", "--html-file");
+  const textBody = await readTextFlag(ctx.args, "--text", "--text-file");
+  if (!htmlBody && !textBody) {
+    throw new EmailCliError(
+      "Provide a body: --html/--html-file and/or --text/--text-file",
+    );
+  }
+  const payload = (await callAction(
+    ctx,
+    "functions/emailCampaignsNode:sendEmail",
+    {
+      fromEmail: from,
+      fromName: getFlag(ctx.args, "--from-name"),
+      to,
+      cc: cc.length > 0 ? cc : undefined,
+      bcc: bcc.length > 0 ? bcc : undefined,
+      replyToEmail: getFlag(ctx.args, "--reply-to"),
+      subject: requiredFlag(ctx.args, "--subject"),
+      htmlBody,
+      textBody,
+      replyToMessageId: getFlag(ctx.args, "--reply-message-id"),
+      configurationSetName: getFlag(ctx.args, "--configuration-set"),
+    },
+  )) as JsonRecord;
+  out(
+    ctx,
+    payload,
+    `Sent to ${to.length + cc.length + bcc.length} recipient(s). Message: ${payload.messageId}\nCheck opens: dench email message status --message ${payload.messageId}`,
+  );
+}
+
+async function runMessage(ctx: EmailCliContext) {
+  const sub = ctx.args.shift();
+  if (sub === "status") {
+    const messageId = requiredFlag(ctx.args, "--message");
+    const payload = (await callQuery(
+      ctx,
+      "functions/emailCampaigns:getMessage",
+      { messageId },
+    )) as JsonRecord;
+    out(ctx, payload, JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (sub === "list") {
+    const limitRaw = getFlag(ctx.args, "--limit");
+    const status = getFlag(ctx.args, "--status");
+    const payload = (await callQuery(
+      ctx,
+      "functions/emailCampaigns:listMessages",
+      {
+        limit: limitRaw ? Number(limitRaw) : undefined,
+        status,
+      },
+    )) as JsonRecord[];
+    const text =
+      payload.length === 0
+        ? "No raw messages sent yet. Use `dench email send`."
+        : payload
+            .map(
+              (message) =>
+                `${message.messageId}  ${message.status}  from=${message.fromEmail}  subject=${JSON.stringify(message.subject)}  opens=${message.openCount}  clicks=${message.clickCount}`,
+            )
+            .join("\n");
+    out(ctx, { ok: true, messages: payload }, text);
+    return;
+  }
+  throw new EmailCliError("Usage: dench email message status|list");
+}
+
+type DnsRecord = {
+  type: string;
+  name: string;
+  value: string;
+  purpose: string;
+};
+
+function buildDnsRecords(domain: string, dkimTokens: string[]): DnsRecord[] {
+  return [
+    ...dkimTokens.map((token) => ({
+      type: "CNAME",
+      name: `${token}._domainkey.${domain}`,
+      value: `${token}.dkim.amazonses.com`,
+      purpose: "DKIM (required for domain verification)",
+    })),
+    {
+      type: "TXT",
+      name: domain,
+      value: "v=spf1 include:amazonses.com ~all",
+      purpose: "SPF (recommended)",
+    },
+    {
+      type: "TXT",
+      name: `_dmarc.${domain}`,
+      value: `v=DMARC1; p=none; rua=mailto:postmaster@${domain}`,
+      purpose: "DMARC (recommended)",
+    },
+  ];
+}
+
+function asDnsRecords(value: unknown): DnsRecord[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter(
+    (record): record is DnsRecord =>
+      Boolean(record) &&
+      typeof record === "object" &&
+      typeof (record as DnsRecord).type === "string" &&
+      typeof (record as DnsRecord).name === "string" &&
+      typeof (record as DnsRecord).value === "string",
+  );
+}
+
+function formatDnsRecords(records: DnsRecord[]): string {
+  if (records.length === 0) return "";
+  const lines = ["DNS records to add:"];
+  for (const record of records) {
+    lines.push(`  ${record.type}  ${record.name}`);
+    lines.push(`        value: ${record.value}`);
+    if (record.purpose) lines.push(`        (${record.purpose})`);
+  }
+  return lines.join("\n");
+}
+
+async function listIdentitiesQuery(
+  ctx: EmailCliContext,
+  domain?: string,
+): Promise<JsonRecord[]> {
+  const payload = await callQuery(
+    ctx,
+    "functions/emailCampaigns:listIdentities",
+    domain ? { domain } : {},
+  );
+  return Array.isArray(payload) ? (payload as JsonRecord[]) : [];
+}
+
 async function runIdentity(ctx: EmailCliContext) {
   const sub = ctx.args.shift();
   if (sub === "verify") {
-    const domain = getFlag(ctx.args, "--domain");
-    const from = requiredFlag(ctx.args, "--from");
+    const domain = getFlag(ctx.args, "--domain")?.trim().toLowerCase();
+    let from = getFlag(ctx.args, "--from")?.trim();
+    if (!from) {
+      if (!domain) throw new EmailCliError("Missing required --from");
+      // Domain-only verify: reuse the sender mailbox already registered
+      // on this domain so the user doesn't have to repeat --from.
+      const existing = await listIdentitiesQuery(ctx, domain);
+      const preferred =
+        existing.find(
+          (identity) => identity.denchVerificationStatus === "verified",
+        ) ?? existing[0];
+      if (!preferred || typeof preferred.fromEmail !== "string") {
+        throw new EmailCliError(
+          `No sender registered on ${domain} yet. Pass --from <mailbox@${domain}> to register one.`,
+        );
+      }
+      from = preferred.fromEmail;
+    }
     const type = domain ? "domain" : "email";
     const identity = domain ?? from;
     const configurationSetName = getFlag(ctx.args, "--configuration-set");
@@ -243,16 +438,89 @@ async function runIdentity(ctx: EmailCliContext) {
         configurationSetName,
       },
     );
-    const verification = await callAction(
+    const verification = (await callAction(
       ctx,
       "functions/emailCampaignsNode:beginSenderVerification",
       { identityId: (created as JsonRecord).identityId },
-    );
-    out(
-      ctx,
-      { ok: true, created, verification },
+    )) as JsonRecord;
+    const dnsRecords = asDnsRecords(verification.dnsRecords);
+    const text = [
       `Verification started for ${identity}`,
-    );
+      typeof verification.message === "string" ? verification.message : "",
+      formatDnsRecords(dnsRecords),
+    ]
+      .filter(Boolean)
+      .join("\n");
+    out(ctx, { ok: true, created, verification }, text);
+    return;
+  }
+  if (sub === "list") {
+    const domain = getFlag(ctx.args, "--domain")?.trim().toLowerCase();
+    const identities = await listIdentitiesQuery(ctx, domain);
+    const text =
+      identities.length === 0
+        ? "No sending identities yet. Run `dench email identity verify --from you@example.com`."
+        : identities
+            .map(
+              (identity) =>
+                `${identity.identityId}  ${identity.fromEmail}  type=${identity.type}` +
+                `${identity.domain ? ` domain=${identity.domain}` : ""}` +
+                `  delivery=${identity.deliveryVerificationStatus}  workspace=${identity.denchVerificationStatus}`,
+            )
+            .join("\n");
+    out(ctx, { ok: true, identities }, text);
+    return;
+  }
+  if (sub === "dns") {
+    const identity = requiredFlag(ctx.args, "--identity");
+    if (!identity.includes("@") && !identity.includes(".")) {
+      // Identity id: the refresh action returns formatted dnsRecords.
+      const payload = (await callAction(
+        ctx,
+        "functions/emailCampaignsNode:refreshIdentityStatus",
+        { identityId: identity },
+      )) as JsonRecord;
+      const records = asDnsRecords(payload.dnsRecords);
+      const text =
+        records.length > 0
+          ? formatDnsRecords(records)
+          : payload.domainVerified === true
+            ? `Domain ${payload.domain} is verified — no DNS records pending.`
+            : "No DNS records available yet. Run `dench email identity verify --domain <domain>` first.";
+      out(ctx, { ok: true, ...payload }, text);
+      return;
+    }
+    const domain = identity.includes("@")
+      ? identity.slice(identity.lastIndexOf("@") + 1).toLowerCase()
+      : identity.toLowerCase();
+    const status = (await callGateway(
+      ctx,
+      "GET",
+      `/v1/email/identities/${encodeURIComponent(domain)}/status`,
+    )) as JsonRecord;
+    const dkim =
+      status.dkimAttributes && typeof status.dkimAttributes === "object"
+        ? (status.dkimAttributes as JsonRecord)
+        : {};
+    const tokens = Array.isArray(dkim.Tokens)
+      ? dkim.Tokens.filter(
+          (token): token is string => typeof token === "string",
+        )
+      : [];
+    const records = buildDnsRecords(domain, tokens);
+    const verified = status.verifiedForSendingStatus === true;
+    const payload = {
+      ok: true,
+      domain,
+      domainVerified: verified,
+      dnsRecords: records,
+    };
+    const text = verified
+      ? `Domain ${domain} is verified — DNS records below are already in place.\n${formatDnsRecords(records)}`
+      : tokens.length > 0
+        ? formatDnsRecords(records)
+        : `Domain ${domain} has no verification records yet. Run \`dench email identity verify --domain ${domain}\` first.`;
+    out(ctx, payload, text);
     return;
   }
   if (sub === "status") {
@@ -282,7 +550,7 @@ async function runIdentity(ctx: EmailCliContext) {
     out(ctx, shaped, JSON.stringify(shaped, null, 2));
     return;
   }
-  throw new EmailCliError("Usage: dench email identity verify|status");
+  throw new EmailCliError("Usage: dench email identity verify|list|dns|status");
 }
 
 async function runTemplate(ctx: EmailCliContext) {

package/lib/command-registry.ts

@@ -1158,6 +1158,66 @@ const rawApiOperations = [
     responseSchema: anyResponse,
     backend: gateway("GET", "/email/identities/{identity}/status"),
   }),
+  op({
+    id: "email.identity.list",
+    group: "email",
+    summary: "List the workspace's email sending identities.",
+    cli: "dench email identity list",
+    method: "GET",
+    path: "/email/sending-identities",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/emailCampaigns:listIdentities"),
+  }),
+  op({
+    id: "email.identity.dns",
+    group: "email",
+    summary:
+      "Fetch DNS records (DKIM/SPF/DMARC) for a pending domain sender verification.",
+    cli: "dench email identity dns",
+    method: "GET",
+    path: "/email/sending-identities/{identityId}/dns",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex(
+      "action",
+      "functions/emailCampaignsNode:refreshIdentityStatus",
+    ),
+  }),
+  op({
+    id: "email.send",
+    group: "email",
+    summary:
+      "Send one raw email (no campaign): to/cc/bcc, custom from-name and reply-to, optional reply threading via replyToMessageId.",
+    cli: "dench email send",
+    method: "POST",
+    path: "/email/send",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("action", "functions/emailCampaignsNode:sendEmail"),
+  }),
+  op({
+    id: "email.message.get",
+    group: "email",
+    summary: "Read a raw email message's status and open/click counters.",
+    cli: "dench email message status",
+    method: "GET",
+    path: "/email/messages/{messageId}",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/emailCampaigns:getMessage"),
+  }),
+  op({
+    id: "email.message.list",
+    group: "email",
+    summary: "List recent raw email messages for the workspace.",
+    cli: "dench email message list",
+    method: "GET",
+    path: "/email/messages",
+    requestSchema: anyObject,
+    responseSchema: anyResponse,
+    backend: convex("query", "functions/emailCampaigns:listMessages"),
+  }),
   op({
     id: "email.template.create",
     group: "email",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.1.4",
+  "version": "2.2.0",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {
@@ -28,7 +28,6 @@
     "members.ts",
     "cron.ts",
     "browser.ts",
-    "linkedin.ts",
     "search.ts",
     "image.ts",
     "tools.ts",

package/linkedin.ts

@@ -1,210 +0,0 @@
-/**
- * `dench linkedin` — first-class LinkedIn outreach workflows.
- *
- * This is intentionally not a generic browser surface. The CLI sends
- * one high-level command to Dench Cloud, where Browserbase + the
- * LinkedIn-specific verifier do the whole transaction server-side.
- */
-
-import { hasFlag } from "./lib/cli-args";
-
-type RuntimeBundle = {
-  host: string;
-  bearerToken: string;
-};
-
-type LinkedInCliContext = {
-  args: string[];
-  jsonOutput: boolean;
-  runtime: RuntimeBundle;
-};
-
-type LinkedInResponse = Record<string, unknown> & {
-  crmUpdate?: unknown;
-  currentUrl?: string | null;
-  error?: string;
-  message?: string;
-  ok?: boolean;
-  pageTitle?: string | null;
-  profileUrl?: string;
-  status?: string;
-  threadId?: string;
-  threadUrl?: string;
-  verified?: boolean;
-};
-
-class LinkedInCliError extends Error {}
-
-function linkedinHelp(): void {
-  console.log(`Usage: dench linkedin <subcommand>
-
-Connect with a LinkedIn profile using the cloud Browserbase browser:
-  dench linkedin connect <profileUrl> [--entry people:<entryId>] [--thread <threadId>] [--json]
-
-CRM:
-  --entry people:<entryId>      Update that CRM row after verification.
-  --object <object> --entry-id <entryId>
-                               Same as --entry, split into two flags.
-
-Behavior:
-  CRM is marked reached out only when LinkedIn verifies Pending.
-  If LinkedIn asks for login, rate-limits, or shows an unclear modal,
-  the result is manual_review and the browser thread stays live.
-`);
-}
-
-function consumeFlagValue(args: string[], name: string): string | undefined {
-  const idx = args.indexOf(name);
-  if (idx === -1) return undefined;
-  const value = args[idx + 1];
-  args.splice(idx, 2);
-  return value;
-}
-
-function normalizeProfileUrl(input: string | undefined): string {
-  const value = input?.trim();
-  if (!value) {
-    throw new LinkedInCliError(
-      "Usage: dench linkedin connect <profileUrl> [--entry people:<entryId>]",
-    );
-  }
-  if (/^https?:\/\//i.test(value)) return value;
-  return `https://${value}`;
-}
-
-function parseEntry(value: string | undefined) {
-  if (!value) return null;
-  const [objectName, ...rest] = value.split(":");
-  const entryId = rest.join(":").trim();
-  if (!objectName?.trim() || !entryId) {
-    throw new LinkedInCliError("--entry must look like people:<entryId>");
-  }
-  return { objectName: objectName.trim(), entryId };
-}
-
-function buildLinkedInCliUrl(host: string): string {
-  return `${host.replace(/\/+$/, "")}/api/linkedin/cli`;
-}
-
-async function postJson(
-  url: string,
-  bearer: string,
-  body: unknown,
-): Promise<{ ok: boolean; payload: unknown; status: number }> {
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      accept: "application/json",
-      authorization: `Bearer ${bearer}`,
-      "content-type": "application/json",
-    },
-    body: JSON.stringify(body),
-  });
-  const text = await response.text();
-  let payload: unknown;
-  try {
-    payload = text ? JSON.parse(text) : null;
-  } catch {
-    payload = { raw: text };
-  }
-  return { ok: response.ok, payload, status: response.status };
-}
-
-function payloadError(payload: unknown): string {
-  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
-    const error = (payload as { error?: unknown }).error;
-    if (typeof error === "string" && error.trim()) return error;
-  }
-  return "LinkedIn request failed";
-}
-
-function output(ctx: LinkedInCliContext, value: unknown): void {
-  if (ctx.jsonOutput) {
-    console.log(JSON.stringify(value, null, 2));
-    return;
-  }
-  console.log(String(value));
-}
-
-function formatHuman(response: LinkedInResponse) {
-  const lines: string[] = [];
-  const status = response.status ?? "unknown";
-  if (response.ok === false) {
-    lines.push(`LinkedIn connect failed: ${response.error ?? status}`);
-  } else {
-    lines.push(`LinkedIn connect: ${status}`);
-  }
-  if (response.verified !== undefined) {
-    lines.push(`verified: ${response.verified ? "yes" : "no"}`);
-  }
-  if (response.message) lines.push(`result: ${response.message}`);
-  if (response.profileUrl) lines.push(`profile: ${response.profileUrl}`);
-  if (response.currentUrl) lines.push(`url: ${response.currentUrl}`);
-  if (response.threadId) lines.push(`threadId: ${response.threadId}`);
-  if (response.crmUpdate) lines.push("crm: updated");
-  if (response.threadUrl) {
-    lines.push("");
-    lines.push(`Open in Dench: ${response.threadUrl}`);
-  }
-  return lines.join("\n");
-}
-
-async function runConnectCommand(ctx: LinkedInCliContext) {
-  const threadId = consumeFlagValue(ctx.args, "--thread");
-  const entry = parseEntry(consumeFlagValue(ctx.args, "--entry"));
-  const objectName =
-    consumeFlagValue(ctx.args, "--object") ?? entry?.objectName;
-  const entryId = consumeFlagValue(ctx.args, "--entry-id") ?? entry?.entryId;
-  const profileUrl = normalizeProfileUrl(ctx.args.shift());
-
-  const body = {
-    action: "connect",
-    profileUrl,
-    threadId,
-    ...(objectName ? { crmObjectName: objectName } : {}),
-    ...(entryId ? { crmEntryId: entryId } : {}),
-  };
-
-  const result = await postJson(
-    buildLinkedInCliUrl(ctx.runtime.host),
-    ctx.runtime.bearerToken,
-    body,
-  );
-  if (!result.ok) {
-    throw new LinkedInCliError(
-      `${payloadError(result.payload)} (${result.status})`,
-    );
-  }
-
-  const response =
-    result.payload && typeof result.payload === "object"
-      ? (result.payload as LinkedInResponse)
-      : ({} as LinkedInResponse);
-
-  output(ctx, ctx.jsonOutput ? response : formatHuman(response));
-}
-
-export async function runLinkedInCommand(opts: {
-  args: string[];
-  runtime: RuntimeBundle;
-}): Promise<void> {
-  const args = [...opts.args];
-  const jsonOutput = hasFlag(args, "--json");
-  const ctx: LinkedInCliContext = {
-    args,
-    jsonOutput,
-    runtime: opts.runtime,
-  };
-  const subcommand = args.shift();
-  if (!subcommand || subcommand === "help" || subcommand === "--help") {
-    linkedinHelp();
-    return;
-  }
-  if (subcommand === "connect") {
-    await runConnectCommand(ctx);
-    return;
-  }
-  throw new LinkedInCliError(`Unknown linkedin subcommand: ${subcommand}`);
-}
-
-export { LinkedInCliError };