@hraness/ghostget 0.17.2 → 0.17.3

package/CHANGELOG.md

@@ -7,6 +7,17 @@ Historical entries retain their original delivery coordinates.
 
 ## Unreleased
 
+## 0.17.3 - 2026-09-10
+
+- Read LinkedIn `contacts.read@1` Contact info from current profile pages:
+  `window.__como_rehydration__` is accepted as either a JSON object or an RSC
+  flight array, flight rows that carry JSON objects or arrays are decoded, and
+  the first-degree relationship binds when `memberDistance`, `networkDistance`,
+  or `distance` of `DISTANCE_1`, `1`, or `"1"` joins the requested vanity or
+  profile URN. Self and non-first-degree profiles still fail closed, Contact
+  info still resolves by `queryName` when the page embeds no decorated
+  `queryId`, and no email is ever invented. Adapter bundle 1.23.0.
+
 ## 0.17.2 - 2026-09-10
 
 - Publish `@hraness/ghostget` to npm as ordinary software by owner decision:

package/README.md

@@ -44,7 +44,7 @@ ghostget plugin list
 
 ## Built-in provider catalog
 
-This v0.17.2 source tree supports executable actions for 20 services: Beeper,
+This v0.17.3 source tree supports executable actions for 20 services: Beeper,
 Bluesky, ClasificadosOnline, Facebook, Facebook Groups, Facebook Marketplace,
 GitHub, Gmail, Hacker News, Instagram, iMessage, LinkedIn, Reddit, Substack,
 Threads, TikTok, Twitch, WhatsApp, X, and YouTube.
@@ -109,7 +109,7 @@ owns the narrow capability boundary that can sit beneath them.
 Wrench is now Ghostget. The package name is `@hraness/ghostget`, and the CLI
 command is `ghostget`. Read the [migration guide](docs/ghostget-migration.md)
 before updating an existing installation. After its optional npm mirror is
-verified public, `@hraness/ghostget@0.17.2` is also available from the registry.
+verified public, `@hraness/ghostget@0.17.3` is also available from the registry.
 
 This README describes the package version in this source tree. Its versioned
 GitHub archive and Agent Skill become a supported public release after the
@@ -120,9 +120,9 @@ The optional npm mirror can follow later without delaying canonical delivery.
 Install the single Ghostget Agent Skill with either runner:
 
 ```sh
-npx skills add hraness/ghostget#v0.17.2
+npx skills add hraness/ghostget#v0.17.3
 # or
-bunx skills add hraness/ghostget#v0.17.2
+bunx skills add hraness/ghostget#v0.17.3
 ```
 
 The skill teaches Codex, Claude Code, Cursor, and other compatible coding
@@ -132,7 +132,7 @@ install the CLI if it is missing. Start a new agent session after installation.
 After the matching immutable Release exists, install this exact canonical archive:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.17.2/hraness-ghostget-0.17.2.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.17.3/hraness-ghostget-0.17.3.tgz
 ghostget adapter sync-bundled --json
 ghostget doctor
 ```
@@ -160,7 +160,7 @@ For that same released coordinate, install Ghostget in an agent or application
 that owns its own model, planning, tool loop, approvals, and interface:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.17.2/hraness-ghostget-0.17.2.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.17.3/hraness-ghostget-0.17.3.tgz
 ```
 
 ```ts

package/dist/apple-photos-client.js

@@ -1,7 +1,7 @@
 // @bun
 import {
   GHOSTGET_VERSION
-} from "./index-axwm9b3v.js";
+} from "./index-rxvsqb3f.js";
 import {
   canonicalJson,
   sha256

package/dist/beeper-client.js

@@ -4,7 +4,7 @@ import {
 } from "./index-26yq8q16.js";
 import {
   GHOSTGET_VERSION
-} from "./index-axwm9b3v.js";
+} from "./index-rxvsqb3f.js";
 import {
   canonicalJson,
   sha256

package/dist/{index-axwm9b3v.js → index-rxvsqb3f.js}

@@ -1,5 +1,5 @@
 // @bun
 // src/version.ts
-var GHOSTGET_VERSION = "0.17.2";
+var GHOSTGET_VERSION = "0.17.3";
 
 export { GHOSTGET_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/ghostget",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Open-source CLI and TypeScript SDK for precise web capabilities for AI agents: page capture, verified media archives, encrypted reads, and typed provider operations.",
   "license": "MIT",
   "type": "module",

package/skills/ghostget/references/install.md

@@ -17,34 +17,34 @@ If Bun is missing, stop and direct the user to the official
 [Bun installation guide](https://bun.sh/docs/installation). Do not switch
 package managers or pipe an unreviewed installer into a shell.
 
-This reference is authored for the exact v0.17.2 release coordinate. Use it
+This reference is authored for the exact v0.17.3 release coordinate. Use it
 only from the matching release-bound Agent Skill after its canonical archive and
 immutable GitHub Release exist. If the coordinate is not public, stop instead
 of substituting `main`, another tag, or a different package version. Install
 that exact release and its reviewed bundled adapter manifests:
 
 ```sh
-bun add --global https://github.com/hraness/ghostget/releases/download/v0.17.2/hraness-ghostget-0.17.2.tgz
+bun add --global https://github.com/hraness/ghostget/releases/download/v0.17.3/hraness-ghostget-0.17.3.tgz
 ghostget adapter sync-bundled --json
 ghostget --help
 ghostget doctor --json
 ```
 
-The package is `@hraness/ghostget`; `@hraness/ghostget@0.17.2` is an optional npm
+The package is `@hraness/ghostget`; `@hraness/ghostget@0.17.3` is an optional npm
 mirror only after verified registry publication. Canonical installation does not
 wait for registry publication.
 
 When upgrading from Wrench, use `ghostget` for new commands and
 `GHOSTGET_STATE_HOME` for an explicit state root. Existing state is selected in
 place; do not rename, copy, or delete a state directory as part of the upgrade.
-The [migration guide](https://github.com/hraness/ghostget/blob/v0.17.2/docs/ghostget-migration.md)
+The [migration guide](https://github.com/hraness/ghostget/blob/v0.17.3/docs/ghostget-migration.md)
 explains the retained state aliases and durable protocol names.
 
 Do not clone the repository merely to run the CLI. Importing the SDK is a
 separate project dependency and does not install a global command:
 
 ```sh
-bun add https://github.com/hraness/ghostget/releases/download/v0.17.2/hraness-ghostget-0.17.2.tgz
+bun add https://github.com/hraness/ghostget/releases/download/v0.17.3/hraness-ghostget-0.17.3.tgz
 ```
 
 `ghostget adapter sync-bundled` upgrades exact bundled baselines, including an

package/skills/ghostget/references/linkedin-adapter.md

@@ -230,10 +230,14 @@ operation fixed and target-bound.
 profile URL. It binds the signed-in viewer, then requires a 1st-degree
 relationship on that vanity from the profile page. Current LinkedIn pages are
 SDUI/RSC and often omit classic `bpr-guid-*` Profile embeds. The binder
-therefore walks both those Voyager code payloads and `window.__como_rehydration__`,
-and treats `memberDistance`, `networkDistance`, or `distance` of `DISTANCE_1`,
+therefore walks both those Voyager code payloads and `window.__como_rehydration__`.
+Current pages assign that global as either a JSON object (`= { … }`) or an RSC
+flight array (`= [ "1:I[…]\\n2:{…}" ]`). The binder accepts both, decodes
+flight rows that carry JSON objects or arrays, and treats
+`memberDistance`, `networkDistance`, or `distance` of `DISTANCE_1`,
 `1`, or `"1"` as first-degree when that value is joined to the requested vanity
-or its profile URN.
+or its profile URN (`entityUrn`, `objectUrn`, `profileUrn`, or `vieweeMemberUrn`).
+Empty, missing, or import-only bootstrap stays fail-closed.
 
 When the same page already embeds Contact-info fields, including a labeled
 Email row, the operation projects those fields and does not issue a second
@@ -260,6 +264,15 @@ Connected since. The same capture had Como rehydration with numeric
 `profileView` returned 410. That drift is why the binder and fetch path
 changed.
 
+A 2026-09-09 signed-in capture of the same 1st-degree path still omitted
+`bpr-guid-*` and `voyagerIdentityDashProfileContactInfo` query IDs. Como
+rehydration had moved from an object assignment to an RSC flight array, so
+object-only parsing treated the page as missing bootstrap. The live flight
+string still carried vanity-joined `networkDistance: 1` next to
+`vieweeMemberUrn` / PROFILE_VIEW breadcrumbs. Adapter 1.23.0 accepts that
+array form and still uses `queryName` when the page embeds no decorated
+queryId.
+
 Self profiles fail closed with guidance to use `profiles.read`. Second-degree,
 third-degree, and out-of-network profiles fail closed because LinkedIn hid
 Contact info from that viewer. The operation never invents a hidden email.

package/skills/ghostget/references/platform-patterns.md

@@ -20,7 +20,7 @@ Leave the state `capture-required` when current evidence is absent, ambiguous, e
 ## LinkedIn
 
 - Use `linkedin-web` with a browser-session/cookie realm for consumer Home feed, a member's recent-activity posts, inbox folders, conversations, and native article-editor surfaces. The separate official `linkedin` OAuth adapter covers approved post, comment, reply, repost, and reaction scopes; it does not supply the consumer Home feed, recent-activity pager, or inbox.
-- Current bundle 1.22.0 observes `linkedin-web profiles.read@1`, `organizations.read@1`, `contacts.read@1`, `feeds.read@2` for `feed=profile-activity`, `articles.draft.save@7`, and image-only `posts.publish@3`. The two profile-stat reads use a path-backed contained Chrome realm, bind the current member before projecting one exact self profile or requested organization Page, and keep the optional private connection read sequential with the self-profile read. `contacts.read@1` uses the same contained Chrome path, requires a 1st-degree relationship on the requested vanity from classic Profile embeds or Como rehydration, and projects Contact-info email plus any shown profile link, connected-since date, phones, websites, or birthday. The profile-activity page uses the same contained Chrome path, binds the signed-in viewer, resolves the live `voyagerFeedDashProfileUpdates` query, and projects one recent-activity page with engagement counts when present; `feed=home` remains capture-required. The fixed browser evaluation performs only bounded, exact-route first-party fetches; it does not click or inspect LinkedIn DOM. A cookie-only standalone client is not a fallback because current live evidence shows LinkedIn invalidates an exported `li_at` outside its browser/device context. The Article contract binds the numeric member subject to the normalized Article-author profile, creates or replaces one exact private draft, keeps a supplied cover in the Article banner rather than the body, and can preserve the independently read existing banner during an exact replacement without another cover upload. It supports paragraphs/H1/H2/native blockquotes, native HTTPS links, and 1–20 bounded inline JPEG/PNG/WebP images with required alt text and optional captions, and verifies the exact unpublished editor-response readback. Its fixed cover and inline-image single-upload registrations, byte transfers, autosaves, and readbacks run inside contained Chrome without DOM automation. The separate post contract stages a real-size optional PNG through bounded ordered commands, admits one exact image transfer and post create, durably retains the accepted share target, and independently verifies it. `linkedin-web media.publish@1` separately reserves an MP4 route but remains capture-required; the official `linkedin posts.publish` OAuth contract already observes MP4.
+- Current bundle 1.23.0 observes `linkedin-web profiles.read@1`, `organizations.read@1`, `contacts.read@1`, `feeds.read@2` for `feed=profile-activity`, `articles.draft.save@7`, and image-only `posts.publish@3`. The two profile-stat reads use a path-backed contained Chrome realm, bind the current member before projecting one exact self profile or requested organization Page, and keep the optional private connection read sequential with the self-profile read. `contacts.read@1` uses the same contained Chrome path, requires a 1st-degree relationship on the requested vanity from classic Profile embeds or Como rehydration (JSON object or RSC flight array), and projects Contact-info email plus any shown profile link, connected-since date, phones, websites, or birthday. The profile-activity page uses the same contained Chrome path, binds the signed-in viewer, resolves the live `voyagerFeedDashProfileUpdates` query, and projects one recent-activity page with engagement counts when present; `feed=home` remains capture-required. The fixed browser evaluation performs only bounded, exact-route first-party fetches; it does not click or inspect LinkedIn DOM. A cookie-only standalone client is not a fallback because current live evidence shows LinkedIn invalidates an exported `li_at` outside its browser/device context. The Article contract binds the numeric member subject to the normalized Article-author profile, creates or replaces one exact private draft, keeps a supplied cover in the Article banner rather than the body, and can preserve the independently read existing banner during an exact replacement without another cover upload. It supports paragraphs/H1/H2/native blockquotes, native HTTPS links, and 1–20 bounded inline JPEG/PNG/WebP images with required alt text and optional captions, and verifies the exact unpublished editor-response readback. Its fixed cover and inline-image single-upload registrations, byte transfers, autosaves, and readbacks run inside contained Chrome without DOM automation. The separate post contract stages a real-size optional PNG through bounded ordered commands, admits one exact image transfer and post create, durably retains the accepted share target, and independently verifies it. `linkedin-web media.publish@1` separately reserves an MP4 route but remains capture-required; the official `linkedin posts.publish` OAuth contract already observes MP4.
 - Every other LinkedIn web operation remains capture-required. Explicit inert reservations cover inbox folders, one bounded page of recommended connections, one connection invitation, Article reads/publication, and other comment/message/repost surfaces. Their retained candidates do not confer executable internal requests.
 - Exclude presence, messaging badges, delivery acknowledgements, seen/read receipts, and notification badge traffic from every R1 contract.
 - Bind the current viewer's person/member identity to the auth realm. `organizations.read` views a Page and does not confer Page-actor authority. For organization actions, additionally bind the administered organization actor selected by the plan.

package/src/assets/adapters/linkedin/wrench-web-adapter.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 4,
   "id": "linkedin-web",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "displayName": "LinkedIn (Authenticated Web API)",
   "surfaceId": "linkedin",
   "origins": [

package/src/beeper-client-types.ts

@@ -96,7 +96,7 @@ export type BeeperContactInteractionExportReceipt = Readonly<{
   implementation: Readonly<{
     producer: Readonly<{
       package: "@hraness/ghostget";
-      version: "0.17.2";
+      version: "0.17.3";
     }>;
     officialCli: Readonly<{
       implementation: "github.com/beeper/cli";

package/src/provider-plugin-contract-identity.ts

@@ -303,8 +303,9 @@ const identities = Object.freeze({
   "linkedin-web": {
     schemaVersion: 1,
     pluginVersion: "1.6.0",
-    implementationSha256: "e4614ab9c7733d7526b8157410e462f1bb48fdaa1c2319a6a4179c18b9e6839d",
+    implementationSha256: "11b52ca3dd9cbafe4829eed9f27d59bdc1c312db943ea29b93cbab6417ac7025",
     legacyCurrentReadImplementationSha256: [
+      "e4614ab9c7733d7526b8157410e462f1bb48fdaa1c2319a6a4179c18b9e6839d",
       "97194dc5a8ec3afc4f4a20152efe51dbdc2fa8a8dde0cd9484b54718c4767f45",
       "64621493e09949fcb9973270140fec1d7398374cf48d3ef150a0c24b882fdeb8",
       "da9d19f6a31d5308579bff7d9b4f77bc458ef69890f0f8c3239cbebeac4bb2a5",
@@ -316,7 +317,6 @@ const identities = Object.freeze({
       "9acb34f9ef5f59dd46b249766af236a3876a4975e0797e330f2975b3fd4ed643",
       "951102310bd87f93ce0863c1a444371d62f412934cc805f82c9981f82edfe50e",
       "4fd6c293984be688a9273acb09bccea64a75134daca745b322fa8d33dfe9f97c",
-      "624e146839f4d20d361a949c3ddb726f0c6b741f4d094e873e82185cf3f03175",
     ],
     legacyReadImplementationSha256: {
       test: "00a99426ec31182f8d37d5cceb819947a09e630b468bb6e3ed8827f5b0fa4628",

package/src/providers/linkedin-web-contact.ts

@@ -39,8 +39,10 @@ const HTML_ENTITY =
   /&(?:nbsp|quot|amp|lt|gt|apos|#(?:[xX][0-9A-Fa-f]{1,6}|[0-9]{1,7}));/gu;
 const MAX_HTML_BYTES = 8 * 1024 * 1024;
 const MAX_CODE_TAGS = 256;
-const MAX_COMO_ROOTS = 8;
+const MAX_COMO_ASSIGNMENTS = 8;
+const MAX_COMO_DECODED_ROOTS = 256;
 const MAX_WALK_NODES = 500_000;
+const RSC_FLIGHT_ROW = /(?:^|\n)(\d+):/u;
 const MAX_PHONES = 8;
 const MAX_WEBSITES = 8;
 const CONTACT_TYPE_SUFFIX = "ProfileContactInfo";
@@ -259,8 +261,16 @@ function htmlAttribute(value: string, name: string): string | null {
   return raw.replace(HTML_ENTITY, (entity) => decodeHtmlEntity(entity));
 }
 
-function extractBalancedJsonObject(source: string, start: number): string | undefined {
-  if (source[start] !== "{") return undefined;
+function skipWhitespace(source: string, start: number): number {
+  let index = start;
+  while (index < source.length && /\s/u.test(source[index] ?? "")) index += 1;
+  return index;
+}
+
+function extractBalancedJsonValue(source: string, start: number): string | undefined {
+  const opener = source[start];
+  if (opener !== "{" && opener !== "[") return undefined;
+  const closer = opener === "{" ? "}" : "]";
   let depth = 0;
   let inString = false;
   let escaped = false;
@@ -284,8 +294,8 @@ function extractBalancedJsonObject(source: string, start: number): string | unde
       inString = true;
       continue;
     }
-    if (character === "{") depth += 1;
-    else if (character === "}") {
+    if (character === opener) depth += 1;
+    else if (character === closer) {
       depth -= 1;
       if (depth === 0) return source.slice(start, index + 1);
     }
@@ -293,34 +303,94 @@ function extractBalancedJsonObject(source: string, start: number): string | unde
   return undefined;
 }
 
+function parseJsonRoot(json: string): unknown {
+  try {
+    return JSON.parse(json) as unknown;
+  } catch {
+    throw new Error("LinkedIn contact-info bootstrap payload contained malformed JSON");
+  }
+}
+
+function looksLikeRscFlight(value: string): boolean {
+  return RSC_FLIGHT_ROW.test(value);
+}
+
+function decodeRscFlightRecords(text: string): unknown[] {
+  const records: unknown[] = [];
+  let index = 0;
+  while (index < text.length && records.length < MAX_COMO_DECODED_ROOTS) {
+    index = skipWhitespace(text, index);
+    const row = /^(\d+):/u.exec(text.slice(index));
+    if (row === null) break;
+    index += row[0].length;
+    const first = text[index];
+    if (first === "{" || first === "[") {
+      const json = extractBalancedJsonValue(text, index);
+      if (json === undefined) {
+        index += 1;
+        continue;
+      }
+      records.push(parseJsonRoot(json));
+      index += json.length;
+      continue;
+    }
+    const nextRow = text.slice(index).search(/\n\d+:/u);
+    index = nextRow === -1 ? text.length : index + nextRow + 1;
+  }
+  return records;
+}
+
+function decodeComoRehydrationValue(value: unknown): unknown[] {
+  if (typeof value === "string") {
+    return looksLikeRscFlight(value) ? decodeRscFlightRecords(value) : [];
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 20_000) {
+      throw new Error("LinkedIn contact-info bootstrap array exceeded its reviewed bound");
+    }
+    const decoded: unknown[] = [];
+    for (const item of value) {
+      if (decoded.length >= MAX_COMO_DECODED_ROOTS) break;
+      if (typeof item === "string") {
+        decoded.push(...decodeComoRehydrationValue(item));
+        continue;
+      }
+      decoded.push(item);
+    }
+    return decoded;
+  }
+  if (isRecord(value)) return [value];
+  return [];
+}
+
 function extractComoRehydrationRoots(html: string): unknown[] {
   const roots: unknown[] = [];
   const marker = "__como_rehydration__";
   let searchFrom = 0;
-  while (searchFrom < html.length && roots.length < MAX_COMO_ROOTS) {
+  let assignments = 0;
+  while (
+    searchFrom < html.length
+    && assignments < MAX_COMO_ASSIGNMENTS
+    && roots.length < MAX_COMO_DECODED_ROOTS
+  ) {
     const markerIndex = html.indexOf(marker, searchFrom);
     if (markerIndex === -1) break;
-    let cursor = markerIndex + marker.length;
-    while (cursor < html.length && /\s/u.test(html[cursor] ?? "")) cursor += 1;
+    let cursor = skipWhitespace(html, markerIndex + marker.length);
     if (html[cursor] !== "=") {
       searchFrom = markerIndex + marker.length;
       continue;
     }
-    cursor += 1;
-    while (cursor < html.length && /\s/u.test(html[cursor] ?? "")) cursor += 1;
-    if (html[cursor] !== "{") {
-      searchFrom = cursor;
-      continue;
-    }
-    const json = extractBalancedJsonObject(html, cursor);
+    cursor = skipWhitespace(html, cursor + 1);
+    const json = extractBalancedJsonValue(html, cursor);
     if (json === undefined) {
       searchFrom = cursor + 1;
       continue;
     }
-    try {
-      roots.push(JSON.parse(json) as unknown);
-    } catch {
-      throw new Error("LinkedIn contact-info bootstrap payload contained malformed JSON");
+    assignments += 1;
+    const decoded = decodeComoRehydrationValue(parseJsonRoot(json));
+    for (const root of decoded) {
+      if (roots.length >= MAX_COMO_DECODED_ROOTS) break;
+      roots.push(root);
     }
     searchFrom = cursor + json.length;
   }
@@ -436,7 +506,7 @@ function vanityFromRecord(record: JsonRecord): string | null {
 }
 
 function profileUrnFromRecord(record: JsonRecord): string | null {
-  for (const key of ["entityUrn", "objectUrn", "profileUrn"] as const) {
+  for (const key of ["entityUrn", "objectUrn", "profileUrn", "vieweeMemberUrn"] as const) {
     const value = record[key];
     if (typeof value !== "string") continue;
     try {
@@ -471,6 +541,24 @@ export function projectLinkedInProfileContactBinding(input: {
     const urn = profileUrnFromRecord(record);
     if (urn !== null) urns.add(urn);
   }
+  if (urns.size < 1) {
+    const joined = new Set<string>();
+    let sawSelf = false;
+    for (const record of records) {
+      const urn = profileUrnFromRecord(record);
+      const distance = distanceValue(record);
+      if (urn === viewer || (distance !== null && isSelfDistance(distance))) {
+        sawSelf = true;
+      }
+      if (urn === null || urn === viewer || distance === null) continue;
+      joined.add(urn);
+    }
+    if (joined.size === 1) {
+      for (const urn of joined) urns.add(urn);
+    } else if (sawSelf && joined.size === 0) {
+      throw selfProfileError();
+    }
+  }
   if (urns.size < 1) {
     throw new Error("LinkedIn contact-info profile page omitted its target identity");
   }

package/src/version.ts

@@ -1,2 +1,2 @@
 /** Canonical immutable Ghostget package release identity. */
-export const GHOSTGET_VERSION = "0.17.2" as const;
+export const GHOSTGET_VERSION = "0.17.3" as const;