@jackwener/opencli 1.7.22 → 1.8.0

package/clis/linkedin/safe-send.js

@@ -0,0 +1,357 @@
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { ArgumentError, AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { createHash } from 'node:crypto';
+
+const LINKEDIN_DOMAIN = 'www.linkedin.com';
+
+function normalizeWhitespace(value) {
+  return String(value ?? '').replace(/[\u00a0\u202f]/g, ' ').replace(/\s+/g, ' ').trim();
+}
+
+function unwrapEvaluateResult(payload) {
+  if (payload && typeof payload === 'object' && 'data' in payload && 'session' in payload) return payload.data;
+  return payload;
+}
+
+function normalizeName(value) {
+  return normalizeWhitespace(value)
+    .replace(/\s*[•·]\s*(?:1st|2nd|3rd\+?|degree connection).*$/i, '')
+    .replace(/\s+LinkedIn.*$/i, '')
+    .toLowerCase();
+}
+
+function isLinkedInHost(hostname) {
+  const host = String(hostname || '').toLowerCase();
+  return host === 'linkedin.com' || host.endsWith('.linkedin.com');
+}
+
+function canonicalizeLinkedInThreadUrl(value) {
+  const raw = normalizeWhitespace(value);
+  if (!raw) return '';
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== 'https:' || url.username || url.password || url.port || !isLinkedInHost(url.hostname)) return '';
+    const match = url.pathname.match(/^\/messaging\/thread\/([^/]+)\/?$/i);
+    if (!match || !match[1]) return '';
+    url.hostname = 'www.linkedin.com';
+    url.hash = '';
+    url.search = '';
+    if (!url.pathname.endsWith('/')) url.pathname += '/';
+    return url.toString();
+  } catch {
+    return '';
+  }
+}
+
+function hashText(value) {
+  return createHash('sha256').update(normalizeWhitespace(value)).digest('hex');
+}
+
+function textContainsNormalized(haystack, needle) {
+  const h = normalizeWhitespace(haystack).toLowerCase();
+  const n = normalizeWhitespace(needle).toLowerCase();
+  return !n || h.includes(n);
+}
+
+function selectBestHeaderName(headerNames, expectedName) {
+  const expected = normalizeName(expectedName);
+  const names = (Array.isArray(headerNames) ? headerNames : [])
+    .map(normalizeWhitespace)
+    .filter(Boolean);
+  return names.find((name) => normalizeName(name) === expected) || names[0] || '';
+}
+
+function assessThreadSafety(probe, expected) {
+  const expectedName = normalizeWhitespace(expected.expectedName);
+  const actualName = selectBestHeaderName(probe?.headerNames, expectedName);
+  const expectedThreadUrl = canonicalizeLinkedInThreadUrl(expected.threadUrl);
+  const actualThreadUrl = canonicalizeLinkedInThreadUrl(probe?.url || '');
+  const bodyText = String(probe?.bodyText || '');
+
+  if (probe?.authRequired) {
+    return { ok: false, blockReason: 'auth_required', expectedValue: expectedName, actualValue: actualName, observedUrl: actualThreadUrl };
+  }
+
+  if (probe?.searchFailure || /we didn't find anything|no results found|no results for/i.test(bodyText)) {
+    return { ok: false, blockReason: 'search_failure_visible', expectedValue: expectedName, actualValue: actualName, observedUrl: actualThreadUrl };
+  }
+
+  if (expectedThreadUrl && actualThreadUrl && expectedThreadUrl !== actualThreadUrl) {
+    return { ok: false, blockReason: 'thread_url_mismatch', expectedValue: expectedThreadUrl, actualValue: actualThreadUrl, observedUrl: actualThreadUrl };
+  }
+
+  if (!actualName || normalizeName(actualName) !== normalizeName(expectedName)) {
+    return { ok: false, blockReason: 'recipient_header_mismatch', expectedValue: expectedName, actualValue: actualName, observedUrl: actualThreadUrl };
+  }
+
+  if (!probe?.composerFound) {
+    return { ok: false, blockReason: 'composer_not_found', expectedValue: expectedName, actualValue: actualName, observedUrl: actualThreadUrl };
+  }
+
+  const expectedLastHash = normalizeWhitespace(expected.expectedLastHash);
+  if (expectedLastHash && expectedLastHash !== probe?.latestMessageHash) {
+    return { ok: false, blockReason: 'latest_message_mismatch', expectedValue: expectedLastHash, actualValue: probe?.latestMessageHash || '', observedUrl: actualThreadUrl };
+  }
+
+  const expectedLastText = normalizeWhitespace(expected.expectedLastText);
+  if (expectedLastText && !textContainsNormalized(bodyText, expectedLastText)) {
+    return { ok: false, blockReason: 'latest_message_mismatch', expectedValue: expectedLastText, actualValue: '', observedUrl: actualThreadUrl };
+  }
+
+  return { ok: true, blockReason: 'verified', expectedValue: expectedName, actualValue: actualName, observedUrl: actualThreadUrl };
+}
+
+function requireStringArg(args, key, label = key) {
+  const value = normalizeWhitespace(args[key]);
+  if (!value) throw new ArgumentError(`${label} is required`);
+  return value;
+}
+
+function requireLinkedInThreadUrl(value, label) {
+  const url = canonicalizeLinkedInThreadUrl(value);
+  if (!url) throw new ArgumentError(`${label} must be an exact https://www.linkedin.com/messaging/thread/<id>/ URL`);
+  return url;
+}
+
+function buildThreadProbeScript() {
+  return String.raw`(() => {
+    const marker = '__OPENCLI_LINKEDIN_PROBE__';
+    void marker;
+    const clean = (s) => String(s || '').replace(/[\u00a0\u202f]/g, ' ').replace(/\s+/g, ' ').trim();
+    const text = document.body ? (document.body.innerText || '') : '';
+    const lower = text.toLowerCase();
+    const authRequired = /\b(sign in|log in|join linkedin)\b/i.test(text)
+      || /linkedin\.com\/(login|checkpoint|authwall)/i.test(location.href)
+      || /captcha|verification required/i.test(text);
+    const searchFailure = /we didn't find anything|no results found|no results for/i.test(text);
+
+    const headerCandidates = [];
+    const selectors = [
+      '.msg-thread__link-to-profile',
+      '.msg-thread__link-to-profile span[aria-hidden="true"]',
+      '.msg-entity-lockup__entity-title',
+      '.msg-conversation-card__participant-names',
+      'main h1',
+      'main h2',
+      '[data-anonymize="person-name"]',
+      'a[href*="/in/"] span[aria-hidden="true"]',
+      'a[href*="/in/"]'
+    ];
+    for (const selector of selectors) {
+      for (const el of Array.from(document.querySelectorAll(selector)).slice(0, 8)) {
+        const value = clean(el.innerText || el.textContent || el.getAttribute('aria-label'));
+        if (value && value.length <= 120 && !/^(message|messaging|send|profile|view profile)$/i.test(value)) {
+          headerCandidates.push(value);
+        }
+      }
+    }
+
+    const composer = Array.from(document.querySelectorAll('[contenteditable="true"][role="textbox"], div.msg-form__contenteditable[contenteditable="true"], [aria-label*="Write a message" i]'))
+      .find((el) => !el.closest('[aria-hidden="true"]') && el.offsetParent !== null);
+
+    const messageText = Array.from(document.querySelectorAll('.msg-s-message-list__event, .msg-s-event-listitem, [data-event-urn], .msg-s-message-group__meta, .msg-s-message-list-content'))
+      .map((el) => clean(el.innerText || el.textContent))
+      .filter(Boolean)
+      .join('\n');
+    const sourceText = messageText || text;
+    const sourceLines = sourceText.split(/\n+/).map(clean).filter(Boolean);
+    const lastMeaningfulLine = [...sourceLines].reverse().find((line) => !/^(send|reply|write a message|press enter to send)$/i.test(line)) || '';
+
+    return {
+      url: location.href,
+      title: document.title || '',
+      headerNames: Array.from(new Set(headerCandidates)).slice(0, 10),
+      bodyText: text,
+      composerFound: Boolean(composer),
+      composerText: composer ? clean(composer.innerText || composer.textContent) : '',
+      authRequired,
+      searchFailure,
+      latestMessageText: lastMeaningfulLine,
+      latestMessageHash: '',
+    };
+  })()`;
+}
+
+function buildFocusComposerScript() {
+  return String.raw`(() => {
+    const marker = '__OPENCLI_LINKEDIN_FOCUS_COMPOSER__';
+    void marker;
+    const clean = (s) => String(s || '').replace(/[\u00a0\u202f]/g, ' ').replace(/\s+/g, ' ').trim();
+    const composer = Array.from(document.querySelectorAll('[contenteditable="true"][role="textbox"], div.msg-form__contenteditable[contenteditable="true"], [aria-label*="Write a message" i]'))
+      .find((el) => !el.closest('[aria-hidden="true"]') && el.offsetParent !== null);
+    if (!composer) return { ok: false, error: 'composer_not_found', composerText: '' };
+    composer.focus();
+    composer.innerHTML = '';
+    composer.dispatchEvent(new InputEvent('input', { bubbles: true, inputType: 'deleteContentBackward', data: null }));
+    return { ok: true, composerText: clean(composer.innerText || composer.textContent) };
+  })()`;
+}
+
+function buildReadComposerScript() {
+  return String.raw`(() => {
+    const marker = '__OPENCLI_LINKEDIN_READ_COMPOSER__';
+    void marker;
+    const clean = (s) => String(s || '').replace(/[\u00a0\u202f]/g, ' ').replace(/\s+/g, ' ').trim();
+    const composer = Array.from(document.querySelectorAll('[contenteditable="true"][role="textbox"], div.msg-form__contenteditable[contenteditable="true"], [aria-label*="Write a message" i]'))
+      .find((el) => !el.closest('[aria-hidden="true"]') && el.offsetParent !== null);
+    return { ok: Boolean(composer), composerText: composer ? clean(composer.innerText || composer.textContent) : '' };
+  })()`;
+}
+
+function buildClickSendScript() {
+  return String.raw`(() => {
+    const marker = '__OPENCLI_LINKEDIN_CLICK_SEND__';
+    void marker;
+    const buttons = Array.from(document.querySelectorAll('button'));
+    const send = buttons.find((button) => {
+      const text = (button.innerText || button.textContent || button.getAttribute('aria-label') || '').trim().toLowerCase();
+      return text === 'send' || text === 'send message';
+    });
+    if (!send) return { ok: false, error: 'send_button_not_found', sent: false };
+    if (send.disabled || send.getAttribute('aria-disabled') === 'true') return { ok: false, error: 'send_button_disabled', sent: false };
+    send.click();
+    return { ok: true, sent: true };
+  })()`;
+}
+
+async function probeThread(page) {
+  const result = unwrapEvaluateResult(await page.evaluate(buildThreadProbeScript()));
+  const latestText = normalizeWhitespace(result?.latestMessageText || '');
+  return {
+    ...(result || {}),
+    latestMessageText: latestText,
+    latestMessageHash: latestText ? hashText(latestText) : '',
+  };
+}
+
+cli({
+  site: 'linkedin',
+  name: 'safe-send',
+  access: 'write',
+  description: 'Fail-closed LinkedIn message sender that verifies exact thread, recipient, and latest message before filling/sending',
+  domain: LINKEDIN_DOMAIN,
+  strategy: Strategy.UI,
+  browser: true,
+  args: [
+    { name: 'thread-url', required: true, help: 'Exact LinkedIn messaging thread URL to open and verify' },
+    { name: 'expected-name', required: true, help: 'Expected visible recipient name in the active thread header' },
+    { name: 'message', required: true, help: 'Message body to send or dry-run' },
+    { name: 'expected-last-text', help: 'Substring expected in the currently visible latest conversation context' },
+    { name: 'expected-last-hash', help: 'SHA-256 hash of expected latest visible message text' },
+    { name: 'send', type: 'bool', default: false, help: 'Actually click Send. Default is dry-run verification only.' },
+    { name: 'screenshot', type: 'bool', default: false, help: 'Capture a screenshot during verification' },
+  ],
+  columns: ['status', 'recipient', 'reason', 'thread_url', 'message_chars', 'screenshot'],
+  func: async (page, args) => {
+    if (!page) throw new CommandExecutionError('Browser session required for linkedin safe-send');
+
+    const threadUrl = requireLinkedInThreadUrl(requireStringArg(args, 'thread-url', '--thread-url'), '--thread-url');
+    const expectedName = requireStringArg(args, 'expected-name', '--expected-name');
+    const message = requireStringArg(args, 'message', '--message');
+
+    await page.goto('https://www.linkedin.com/messaging/');
+    await page.wait(4);
+    await page.goto(threadUrl);
+    // LinkedIn messaging often renders the shell first and hydrates the active
+    // thread header/messages a few seconds later. Wait long enough for the
+    // recipient header to appear so we fail closed on a real mismatch, not on
+    // a premature blank DOM snapshot.
+    await page.wait(12);
+
+    let beforeProbe = await probeThread(page);
+    const expectedLastText = normalizeWhitespace(args['expected-last-text']);
+    for (let attempt = 0; expectedLastText && attempt < 6 && !textContainsNormalized(beforeProbe.bodyText, expectedLastText); attempt += 1) {
+      await page.wait(2);
+      beforeProbe = await probeThread(page);
+    }
+
+    const safety = assessThreadSafety(beforeProbe, {
+      expectedName,
+      threadUrl,
+      expectedLastText: args['expected-last-text'],
+      expectedLastHash: args['expected-last-hash'],
+    });
+
+    if (safety.blockReason === 'auth_required') {
+      throw new AuthRequiredError(LINKEDIN_DOMAIN, 'LinkedIn safe-send requires an active signed-in LinkedIn browser session.');
+    }
+
+    if (!safety.ok) {
+      const observed = [
+        `Expected ${safety.expectedValue}; actual ${safety.actualValue || 'not_visible'} at ${safety.observedUrl || 'url_not_available'}`,
+        `Observed headers: ${(beforeProbe.headerNames || []).join(' | ') || 'no_visible_headers'}`,
+        `Title: ${beforeProbe.title || 'title_not_available'}`,
+        `Body: ${normalizeWhitespace(beforeProbe.bodyText || '').slice(0, 500)}`,
+      ].join('\n');
+      throw new CommandExecutionError(
+        `LinkedIn safe-send blocked: ${safety.blockReason}`,
+        observed,
+      );
+    }
+
+    let screenshot = '';
+    if (args.screenshot && typeof page.screenshot === 'function') {
+      screenshot = await page.screenshot({ fullPage: false });
+    }
+
+    if (!args.send) {
+      return [{
+        status: 'verified_dry_run',
+        recipient: safety.actualValue,
+        reason: safety.blockReason,
+        thread_url: safety.observedUrl,
+        message_chars: message.length,
+        screenshot: screenshot ? 'captured' : '',
+      }];
+    }
+
+    const focus = unwrapEvaluateResult(await page.evaluate(buildFocusComposerScript()));
+    if (!focus?.ok) throw new CommandExecutionError(`LinkedIn safe-send blocked: ${focus?.error || 'composer_focus_failed'}`);
+
+    await page.insertText(message);
+    await page.wait(0.6 + Math.random() * 0.8);
+
+    const composer = unwrapEvaluateResult(await page.evaluate(buildReadComposerScript()));
+    if (!composer?.ok || normalizeWhitespace(composer.composerText) !== normalizeWhitespace(message)) {
+      throw new CommandExecutionError(
+        'LinkedIn safe-send blocked: composer_text_mismatch',
+        `Composer text did not exactly match intended message for ${expectedName}.`,
+      );
+    }
+
+    const afterFillProbe = await probeThread(page);
+    const afterFillSafety = assessThreadSafety(afterFillProbe, {
+      expectedName,
+      threadUrl,
+      expectedLastText: args['expected-last-text'],
+      expectedLastHash: args['expected-last-hash'],
+    });
+    if (!afterFillSafety.ok) {
+      throw new CommandExecutionError(`LinkedIn safe-send blocked after fill: ${afterFillSafety.blockReason}`);
+    }
+
+    const sent = unwrapEvaluateResult(await page.evaluate(buildClickSendScript()));
+    if (!sent?.ok || !sent.sent) {
+      throw new CommandExecutionError(`LinkedIn safe-send blocked: ${sent?.error || 'send_click_failed'}`);
+    }
+
+    await page.wait(0.8 + Math.random() * 1.2);
+    return [{
+      status: 'sent',
+      recipient: safety.actualValue,
+      reason: safety.blockReason,
+      thread_url: safety.observedUrl,
+      message_chars: message.length,
+      screenshot: screenshot ? 'captured' : '',
+    }];
+  },
+});
+
+export const __test__ = {
+  normalizeWhitespace,
+  unwrapEvaluateResult,
+  normalizeName,
+  canonicalizeLinkedInThreadUrl,
+  hashText,
+  assessThreadSafety,
+};

package/clis/linkedin/safe-send.test.js

@@ -0,0 +1,204 @@
+import { describe, expect, it, vi } from 'vitest';
+import { getRegistry } from '@jackwener/opencli/registry';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import './safe-send.js';
+
+const {
+  normalizeWhitespace,
+  normalizeName,
+  canonicalizeLinkedInThreadUrl,
+  hashText,
+  assessThreadSafety,
+} = await import('./safe-send.js').then((m) => m.__test__);
+
+function makeFakePage(probe) {
+  let composerText = probe.composerText || '';
+  return {
+    goto: vi.fn(async () => undefined),
+    wait: vi.fn(async () => undefined),
+    evaluate: vi.fn(async (script) => {
+      const text = String(script);
+      if (text.includes('__OPENCLI_LINKEDIN_PROBE__')) return probe;
+      if (text.includes('__OPENCLI_LINKEDIN_FOCUS_COMPOSER__')) return { ok: true, composerText: '' };
+      if (text.includes('__OPENCLI_LINKEDIN_READ_COMPOSER__')) return { ok: true, composerText };
+      if (text.includes('__OPENCLI_LINKEDIN_CLICK_SEND__')) return { ok: true, sent: true };
+      return undefined;
+    }),
+    insertText: vi.fn(async (text) => {
+      composerText = text;
+    }),
+    pressKey: vi.fn(async () => undefined),
+    screenshot: vi.fn(async () => 'base64-screenshot'),
+  };
+}
+
+describe('linkedin safe-send helpers', () => {
+  it('normalizes whitespace and LinkedIn names for exact-ish comparisons', () => {
+    expect(normalizeWhitespace('  Lokesh\n\tRamesh  ')).toBe('Lokesh Ramesh');
+    expect(normalizeName('Lokesh Ramesh • 1st')).toBe('lokesh ramesh');
+  });
+
+  it('canonicalizes thread URLs while dropping query and hash noise', () => {
+    expect(canonicalizeLinkedInThreadUrl('https://www.linkedin.com/messaging/thread/abc/?foo=1#bar'))
+      .toBe('https://www.linkedin.com/messaging/thread/abc/');
+    expect(canonicalizeLinkedInThreadUrl('https://www.linkedin.com/messaging/thread/abc/extra')).toBe('');
+    expect(canonicalizeLinkedInThreadUrl('https://evil-linkedin.com/messaging/thread/abc/')).toBe('');
+    expect(canonicalizeLinkedInThreadUrl('http://www.linkedin.com/messaging/thread/abc/')).toBe('');
+  });
+
+  it('fails closed when LinkedIn search produced no results even if a composer is visible', () => {
+    const result = assessThreadSafety({
+      url: 'https://www.linkedin.com/messaging/thread/bora/',
+      headerNames: ['Bora Nicholson'],
+      bodyText: "We didn't find anything for Victoria Munoz\nBora Nicholson",
+      searchFailure: true,
+      composerFound: true,
+      latestMessageHash: hashText('hello'),
+    }, {
+      expectedName: 'Victoria Munoz',
+      threadUrl: 'https://www.linkedin.com/messaging/thread/victoria/',
+      expectedLastText: 'hello',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.blockReason).toBe('search_failure_visible');
+  });
+
+  it('fails closed on recipient header mismatch', () => {
+    const result = assessThreadSafety({
+      url: 'https://www.linkedin.com/messaging/thread/bora/',
+      headerNames: ['Bora Nicholson'],
+      bodyText: 'Bora Nicholson\nhello',
+      composerFound: true,
+      latestMessageHash: hashText('hello'),
+    }, {
+      expectedName: 'Victoria Munoz',
+      expectedLastText: 'hello',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.blockReason).toBe('recipient_header_mismatch');
+    expect(result.actualValue).toBe('Bora Nicholson');
+  });
+
+  it('fails closed when the stored latest message is no longer visible', () => {
+    const result = assessThreadSafety({
+      url: 'https://www.linkedin.com/messaging/thread/lokesh/',
+      headerNames: ['Lokesh Ramesh'],
+      bodyText: 'Lokesh Ramesh\na newer inbound arrived',
+      composerFound: true,
+      latestMessageHash: hashText('a newer inbound arrived'),
+    }, {
+      expectedName: 'Lokesh Ramesh',
+      expectedLastText: 'old inbound text',
+    });
+
+    expect(result.ok).toBe(false);
+    expect(result.blockReason).toBe('latest_message_mismatch');
+  });
+
+  it('passes only when recipient, thread, latest text, and composer are all verified', () => {
+    const result = assessThreadSafety({
+      url: 'https://www.linkedin.com/messaging/thread/lokesh/?mini=true',
+      headerNames: ['Lokesh Ramesh'],
+      bodyText: 'Lokesh Ramesh\nI think outside help would fit best for provider doc follow ups',
+      composerFound: true,
+      latestMessageHash: hashText('I think outside help would fit best for provider doc follow ups'),
+    }, {
+      expectedName: 'Lokesh Ramesh',
+      threadUrl: 'https://www.linkedin.com/messaging/thread/lokesh/',
+      expectedLastText: 'provider doc follow ups',
+    });
+
+    expect(result.ok).toBe(true);
+    expect(result.blockReason).toBe('verified');
+  });
+});
+
+describe('linkedin safe-send command', () => {
+  it('registers as a write command with safe output columns', () => {
+    const command = getRegistry().get('linkedin/safe-send');
+    expect(command).toBeDefined();
+    expect(command.access).toBe('write');
+    expect(command.columns).toEqual(expect.arrayContaining(['status', 'recipient', 'reason']));
+  });
+
+  it('does not type or send when verification fails', async () => {
+    const command = getRegistry().get('linkedin/safe-send');
+    const page = makeFakePage({
+      url: 'https://www.linkedin.com/messaging/thread/bora/',
+      headerNames: ['Bora Nicholson'],
+      bodyText: 'Bora Nicholson',
+      composerFound: true,
+      searchFailure: false,
+    });
+
+    await expect(command.func(page, {
+      'thread-url': 'https://www.linkedin.com/messaging/thread/victoria/',
+      'expected-name': 'Victoria Munoz',
+      message: 'hello victoria',
+      send: true,
+    })).rejects.toBeInstanceOf(CommandExecutionError);
+
+    expect(page.insertText).not.toHaveBeenCalled();
+    expect(page.pressKey).not.toHaveBeenCalled();
+  });
+
+  it('rejects non-thread URLs before navigating or typing', async () => {
+    const command = getRegistry().get('linkedin/safe-send');
+    const page = makeFakePage({});
+
+    await expect(command.func(page, {
+      'thread-url': 'https://www.linkedin.com/feed/',
+      'expected-name': 'Victoria Munoz',
+      message: 'hello victoria',
+      send: true,
+    })).rejects.toBeInstanceOf(ArgumentError);
+
+    expect(page.goto).not.toHaveBeenCalled();
+    expect(page.insertText).not.toHaveBeenCalled();
+  });
+
+  it('dry-runs by default after verification without filling or sending', async () => {
+    const command = getRegistry().get('linkedin/safe-send');
+    const page = makeFakePage({
+      url: 'https://www.linkedin.com/messaging/thread/lokesh/',
+      headerNames: ['Lokesh Ramesh'],
+      bodyText: 'Lokesh Ramesh\nprovider doc follow ups',
+      composerFound: true,
+      searchFailure: false,
+    });
+
+    const rows = await command.func(page, {
+      'thread-url': 'https://www.linkedin.com/messaging/thread/lokesh/',
+      'expected-name': 'Lokesh Ramesh',
+      message: 'both, but starting hands on',
+    });
+
+    expect(rows[0]).toMatchObject({ status: 'verified_dry_run', recipient: 'Lokesh Ramesh', reason: 'verified' });
+    expect(page.insertText).not.toHaveBeenCalled();
+    expect(page.pressKey).not.toHaveBeenCalled();
+  });
+
+  it('fills and sends only when --send is explicitly true and post-fill verification matches exactly', async () => {
+    const command = getRegistry().get('linkedin/safe-send');
+    const page = makeFakePage({
+      url: 'https://www.linkedin.com/messaging/thread/lokesh/',
+      headerNames: ['Lokesh Ramesh'],
+      bodyText: 'Lokesh Ramesh\nprovider doc follow ups',
+      composerFound: true,
+      searchFailure: false,
+    });
+
+    const rows = await command.func(page, {
+      'thread-url': 'https://www.linkedin.com/messaging/thread/lokesh/',
+      'expected-name': 'Lokesh Ramesh',
+      message: 'both, but starting hands on',
+      send: true,
+    });
+
+    expect(rows[0]).toMatchObject({ status: 'sent', recipient: 'Lokesh Ramesh', reason: 'verified' });
+    expect(page.insertText).toHaveBeenCalledWith('both, but starting hands on');
+    expect(page.pressKey).not.toHaveBeenCalled();
+  });
+});