@melaya/runner 1.0.65 → 1.0.66

package/dist/connection.js

@@ -25,6 +25,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 import { ensureSharedModules, getSharedDir } from "./sharedVendor.js";
 import { startLumaBrowserBridge } from "./lumaBrowserBridge.js";
+import { startLinkedInBrowserBridge } from "./linkedinBrowserBridge.js";
 const HEARTBEAT_INTERVAL = 30_000;
 const activeProcesses = new Map();
 export async function connect(opts) {
@@ -61,6 +62,28 @@ export async function connect(opts) {
             console.log(chalk.yellow(`  ⚠ Luma browser bridge failed to start: ${e?.message || e}`));
         }
     };
+    // LinkedIn browser bridge — drives a logged-in Playwright session for the
+    // SDUI-only surfaces (home feed read, comment read/write, and react/comment
+    // AS A PAGE) that the aiohttp path in social_linkedin.py cannot reach. Unlike
+    // Luma it needs no saved storage state: the Python tool injects the session
+    // cookies (LINKEDIN_LI_AT / LINKEDIN_JSESSIONID) per request, so we boot it
+    // unconditionally and let it lazy-launch Chromium on first use.
+    let linkedinBridge = null;
+    const _ensureLinkedInBridge = async () => {
+        if (linkedinBridge)
+            return;
+        try {
+            linkedinBridge = await startLinkedInBrowserBridge({
+                log: (m) => {
+                    if (opts.verbose)
+                        console.log(chalk.gray(`  [linkedin-bridge] ${m}`));
+                },
+            });
+        }
+        catch (e) {
+            console.log(chalk.yellow(`  ⚠ LinkedIn browser bridge failed to start: ${e?.message || e}`));
+        }
+    };
     socket.on("connect", async () => {
         spinner.succeed(chalk.green("Connected to Melaya"));
         // Report detected models
@@ -76,6 +99,7 @@ export async function connect(opts) {
         // effort — failure here means Luma POSTs fall back to aiohttp
         // (which 403s under the bot rule) but reads still work.
         await _ensureLumaBridge();
+        await _ensureLinkedInBridge();
         console.log(chalk.gray("  Waiting for pipeline runs...\n"));
     });
     socket.on("connect_error", (err) => {
@@ -349,6 +373,14 @@ export async function connect(opts) {
                         MEL_LUMA_BROWSER_TOKEN: lumaBridge.token,
                     }
                     : {}),
+                // LinkedIn browser bridge — shared/tools/social_linkedin.py routes
+                // feed/read/react-as-page/comment-as-page through Playwright when set.
+                ...(linkedinBridge
+                    ? {
+                        MEL_LINKEDIN_BROWSER_URL: linkedinBridge.url,
+                        MEL_LINKEDIN_BROWSER_TOKEN: linkedinBridge.token,
+                    }
+                    : {}),
                 // Per-model profile from preflight detection. Empty when
                 // preflight didn't classify (cloud-spawn or capable model with
                 // defaults intact). When set, shared/runtime/model.py reads

package/dist/linkedinBrowserBridge.d.ts

@@ -0,0 +1,50 @@
+/**
+ * LinkedIn browser bridge — localhost HTTP server that drives a persistent
+ * Playwright Chromium context authenticated with the user's LinkedIn session,
+ * exposing high-level DOM actions the headless aiohttp path cannot do.
+ *
+ * Why this exists (vs. the cookie/aiohttp path in social_linkedin.py)
+ * ──────────────────────────────────────────────────────────────────
+ * LinkedIn's 2024 web rewrite moved feed reading, comment reading/writing, and
+ * "react/comment AS A PAGE" onto a Server-Driven-UI (SDUI) surface whose acting
+ * identity lives in CLIENT React (`MemoryNamespace`) state set by the on-canvas
+ * actor switcher. A replayed cookie request (even from inside the page) can't
+ * assert that — verified live 2026-06-17: every cookie-auth reaction recorded as
+ * the member, never the page. The only way to act as the page, read the home
+ * feed, or read/post comments is to drive the REAL UI in a logged-in browser.
+ *
+ * Unlike the Luma bridge (a stateless fetch-forwarder), this bridge keeps ONE
+ * persistent context + page so:
+ *   - the home feed scroll position and lazy-loaded cards accumulate, and
+ *   - a page-actor selection made via the switcher persists across subsequent
+ *     react/comment actions in the same session.
+ *
+ * How it works
+ * ────────────
+ * 1. At runner startup the bridge boots an HTTP server on 127.0.0.1:<free port>,
+ *    mints a per-session bearer token, and exposes both via env vars
+ *    `MEL_LINKEDIN_BROWSER_URL` + `MEL_LINKEDIN_BROWSER_TOKEN` to the spawned
+ *    Python pipeline subprocess. Unlike Luma it boots even with no saved state,
+ *    because the Python tool injects the session cookies per request (it already
+ *    holds LINKEDIN_LI_AT / LINKEDIN_JSESSIONID from the credential store).
+ * 2. Python POSTs `{action, args, cookies}` to `${URL}/linkedin/action` with
+ *    `Authorization: Bearer ${TOKEN}`. On the first call the bridge launches
+ *    Chromium, builds the context, and injects the cookies. Subsequent calls
+ *    reuse the same page.
+ * 3. Actions: `feed` (scroll + extract post cards), `post` (read one post +
+ *    top comments), `react` (optionally as a page), `comment` (optionally as a
+ *    page), and `debug_dom` (selector iteration helper).
+ *
+ * Security
+ * ────────
+ * - Binds 127.0.0.1 only; random per-session token; cookies never logged.
+ * - Only linkedin.com origins are navigated.
+ */
+export interface LinkedInBrowserBridge {
+    url: string;
+    token: string;
+    shutdown: () => Promise<void>;
+}
+export declare function startLinkedInBrowserBridge(opts: {
+    log: (msg: string) => void;
+}): Promise<LinkedInBrowserBridge | null>;

package/dist/linkedinBrowserBridge.js

@@ -0,0 +1,429 @@
+/**
+ * LinkedIn browser bridge — localhost HTTP server that drives a persistent
+ * Playwright Chromium context authenticated with the user's LinkedIn session,
+ * exposing high-level DOM actions the headless aiohttp path cannot do.
+ *
+ * Why this exists (vs. the cookie/aiohttp path in social_linkedin.py)
+ * ──────────────────────────────────────────────────────────────────
+ * LinkedIn's 2024 web rewrite moved feed reading, comment reading/writing, and
+ * "react/comment AS A PAGE" onto a Server-Driven-UI (SDUI) surface whose acting
+ * identity lives in CLIENT React (`MemoryNamespace`) state set by the on-canvas
+ * actor switcher. A replayed cookie request (even from inside the page) can't
+ * assert that — verified live 2026-06-17: every cookie-auth reaction recorded as
+ * the member, never the page. The only way to act as the page, read the home
+ * feed, or read/post comments is to drive the REAL UI in a logged-in browser.
+ *
+ * Unlike the Luma bridge (a stateless fetch-forwarder), this bridge keeps ONE
+ * persistent context + page so:
+ *   - the home feed scroll position and lazy-loaded cards accumulate, and
+ *   - a page-actor selection made via the switcher persists across subsequent
+ *     react/comment actions in the same session.
+ *
+ * How it works
+ * ────────────
+ * 1. At runner startup the bridge boots an HTTP server on 127.0.0.1:<free port>,
+ *    mints a per-session bearer token, and exposes both via env vars
+ *    `MEL_LINKEDIN_BROWSER_URL` + `MEL_LINKEDIN_BROWSER_TOKEN` to the spawned
+ *    Python pipeline subprocess. Unlike Luma it boots even with no saved state,
+ *    because the Python tool injects the session cookies per request (it already
+ *    holds LINKEDIN_LI_AT / LINKEDIN_JSESSIONID from the credential store).
+ * 2. Python POSTs `{action, args, cookies}` to `${URL}/linkedin/action` with
+ *    `Authorization: Bearer ${TOKEN}`. On the first call the bridge launches
+ *    Chromium, builds the context, and injects the cookies. Subsequent calls
+ *    reuse the same page.
+ * 3. Actions: `feed` (scroll + extract post cards), `post` (read one post +
+ *    top comments), `react` (optionally as a page), `comment` (optionally as a
+ *    page), and `debug_dom` (selector iteration helper).
+ *
+ * Security
+ * ────────
+ * - Binds 127.0.0.1 only; random per-session token; cookies never logged.
+ * - Only linkedin.com origins are navigated.
+ */
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+const MAX_BODY_BYTES = 256 * 1024;
+const NAV_TIMEOUT_MS = 30_000;
+const SETTLE_MS = 1800;
+const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+    "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36";
+export async function startLinkedInBrowserBridge(opts) {
+    let playwright;
+    try {
+        playwright = await import("playwright");
+    }
+    catch {
+        opts.log("LinkedIn browser bridge: playwright module unavailable, skipping.");
+        return null;
+    }
+    const token = randomBytes(24).toString("hex");
+    let browser = null;
+    let context = null;
+    let page = null;
+    let cookiesInjected = false;
+    // Serialize actions — one shared page can't run two automations at once.
+    let chain = Promise.resolve();
+    async function _ensurePage(cookies) {
+        if (!browser || !browser.isConnected()) {
+            browser = await playwright.chromium.launch({
+                headless: true,
+                args: ["--disable-blink-features=AutomationControlled", "--disable-dev-shm-usage"],
+            });
+            context = null;
+            page = null;
+            cookiesInjected = false;
+        }
+        if (!context) {
+            context = await browser.newContext({
+                userAgent: UA,
+                viewport: { width: 1280, height: 1400 },
+            });
+            page = null;
+            cookiesInjected = false;
+        }
+        if (!cookiesInjected && cookies && cookies.li_at) {
+            const jar = [
+                { name: "li_at", value: cookies.li_at, domain: ".linkedin.com", path: "/", httpOnly: true, secure: true },
+            ];
+            if (cookies.jsessionid) {
+                jar.push({
+                    name: "JSESSIONID",
+                    value: cookies.jsessionid.replace(/^"|"$/g, ""),
+                    domain: ".linkedin.com", path: "/", secure: true,
+                });
+            }
+            await context.addCookies(jar);
+            cookiesInjected = true;
+        }
+        if (!page || page.isClosed()) {
+            page = await context.newPage();
+        }
+        return page;
+    }
+    // ── DOM action implementations ──────────────────────────────────────────
+    // Selectors are intentionally resilient (multiple fallbacks + attribute
+    // anchors over class names, since LinkedIn rotates hashed classes). The
+    // `debug_dom` action exists to re-derive them live when they drift.
+    // VALIDATED LIVE 2026-06-17 (Tokano session, my IP — cookie auth works off
+    // the user's machine, no checkpoint). KEY FINDING: the home feed is fully
+    // SDUI/RSC — every post card uses ROTATING HASHED classes (`_03e8acd7…`) and
+    // carries NO `urn:li:activity` DOM attribute. CSS-selector scraping (the impl
+    // below) returns 0 posts. The post urns live only in the NETWORK payloads.
+    // The proven approach is response interception: attach `context.on("response")`,
+    // collect bodies from `flagship-web/rsc-action/...` + `/feed/` (regex
+    // `urn:li:activity:\d+` → 4 urns from the initial doc), and trigger the feed
+    // pager via scroll to accumulate more. TODO(next session): replace the DOM
+    // extraction below with interception + RSC parsing (urn + commentary + author),
+    // and capture the `pagers.feed.mainFeed` server-requests for pagination.
+    async function _feed(p, args) {
+        const limit = Math.min(Math.max(Number(args.limit) || 10, 1), 200);
+        await p.goto("https://www.linkedin.com/feed/", { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
+        await p.waitForTimeout(SETTLE_MS);
+        // Scroll until we have >= limit distinct update cards or scrolling stalls.
+        const seen = new Set();
+        let stalls = 0;
+        for (let i = 0; i < 80 && seen.size < limit && stalls < 4; i++) {
+            const urns = await p.evaluate(() => Array.from(document.querySelectorAll("[data-urn],[data-id]"))
+                .map((e) => e.getAttribute("data-urn") || e.getAttribute("data-id") || "")
+                .filter((u) => u.includes("urn:li:activity")));
+            const before = seen.size;
+            urns.forEach((u) => seen.add(u));
+            if (seen.size === before)
+                stalls++;
+            else
+                stalls = 0;
+            await p.evaluate(() => window.scrollBy(0, window.innerHeight * 1.5));
+            await p.waitForTimeout(900);
+        }
+        // Extract structured cards.
+        const posts = await p.evaluate((max) => {
+            const out = [];
+            const cards = Array.from(document.querySelectorAll('div.feed-shared-update-v2, [data-urn*="urn:li:activity"]'));
+            const pushed = new Set();
+            for (const card of cards) {
+                const urn = card.getAttribute("data-urn") ||
+                    card.querySelector("[data-urn]")?.getAttribute("data-urn") ||
+                    "";
+                const activity = (urn.match(/urn:li:activity:\d+/) || [])[0] || "";
+                if (!activity || pushed.has(activity))
+                    continue;
+                const actorEl = card.querySelector(".update-components-actor__title, .update-components-actor__name, span.feed-shared-actor__name");
+                const author = (actorEl?.innerText || "").split("\n")[0].trim();
+                const subEl = card.querySelector(".update-components-actor__description");
+                const textEl = card.querySelector(".update-components-text, .feed-shared-update-v2__description, .update-components-update-v2__commentary");
+                const text = (textEl?.innerText || "").trim();
+                out.push({
+                    urn: activity,
+                    author,
+                    author_subtitle: (subEl?.innerText || "").trim(),
+                    text: text.slice(0, 2000),
+                    url: `https://www.linkedin.com/feed/update/${activity}/`,
+                });
+                pushed.add(activity);
+                if (out.length >= max)
+                    break;
+            }
+            return out;
+        }, limit);
+        return { count: posts.length, posts };
+    }
+    async function _post(p, args) {
+        const activity = String(args.urn || args.post || "").match(/urn:li:activity:\d+/)?.[0] || String(args.urn || "");
+        const url = activity.startsWith("urn:li:activity")
+            ? `https://www.linkedin.com/feed/update/${activity}/`
+            : String(args.url || args.urn);
+        await p.goto(url, { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
+        await p.waitForTimeout(SETTLE_MS);
+        // Expand "see more" if present.
+        try {
+            const more = p.locator('button:has-text("see more"), button[aria-label*="see more" i]').first();
+            if (await more.count())
+                await more.click({ timeout: 2000 }).catch(() => { });
+        }
+        catch { /* ignore */ }
+        const maxComments = Math.min(Math.max(Number(args.max_comments) || 10, 0), 50);
+        if (maxComments > 0) {
+            try {
+                const cbtn = p.locator('button[aria-label*="comment" i]:has-text("Comment"), button:has-text("Comments")').first();
+                if (await cbtn.count())
+                    await cbtn.click({ timeout: 2000 }).catch(() => { });
+                await p.waitForTimeout(1200);
+            }
+            catch { /* ignore */ }
+        }
+        const data = await p.evaluate((maxC) => {
+            const textEl = document.querySelector(".update-components-text, .feed-shared-update-v2__description, .update-components-update-v2__commentary");
+            const actorEl = document.querySelector(".update-components-actor__title, .update-components-actor__name");
+            const comments = Array.from(document.querySelectorAll("article.comments-comment-entity, .comments-comment-item")).slice(0, maxC).map((c) => {
+                const a = c.querySelector(".comments-comment-meta__description-title, .comments-post-meta__name-text");
+                const t = c.querySelector(".comments-comment-item__main-content, .update-components-text");
+                return { author: (a?.innerText || "").trim(), text: (t?.innerText || "").trim().slice(0, 1000) };
+            });
+            return {
+                author: (actorEl?.innerText || "").split("\n")[0].trim(),
+                text: (textEl?.innerText || "").trim(),
+                comments,
+            };
+        }, maxComments);
+        return { url, ...data };
+    }
+    /** Select the org page in the on-canvas "react/comment as" switcher so the
+     *  subsequent action runs as the page. Returns true if a page actor was set. */
+    async function _selectActor(p, asPage) {
+        if (!asPage)
+            return false;
+        // The switcher is a button showing the current actor's avatar/name near the
+        // comment box / reaction bar. Clicking opens a menu listing the member and
+        // each admined page. We pick the entry whose text matches the page name/urn.
+        const needle = String(asPage).toLowerCase();
+        const triggers = [
+            'button[aria-label*="Change" i][aria-label*="post as" i]',
+            'button[aria-label*="comment as" i]',
+            'button[aria-label*="react as" i]',
+            '.comments-comment-box__detour-container button',
+            'button.update-components-actor__meta-link',
+        ];
+        for (const sel of triggers) {
+            const t = p.locator(sel).first();
+            if (await t.count()) {
+                await t.click({ timeout: 3000 }).catch(() => { });
+                await p.waitForTimeout(800);
+                // Menu options
+                const opt = p.locator(`[role="menuitem"], [role="option"], li, button`).filter({ hasText: new RegExp(needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "i") }).first();
+                if (await opt.count()) {
+                    await opt.click({ timeout: 3000 }).catch(() => { });
+                    await p.waitForTimeout(800);
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    async function _react(p, args) {
+        await _post(p, args); // navigate to the post
+        const asPage = args.as_page ? String(args.as_page) : "";
+        let actedAsPage = false;
+        if (asPage)
+            actedAsPage = await _selectActor(p, asPage);
+        // Open the reaction bar and click the requested reaction (default Like).
+        const reaction = String(args.reaction || "Like");
+        const likeBtn = p.locator('button[aria-label*="React" i], button:has-text("Like")').first();
+        if (!(await likeBtn.count()))
+            return { error: "react_button_not_found" };
+        if (reaction.toLowerCase() === "like") {
+            await likeBtn.click({ timeout: 4000 });
+        }
+        else {
+            await likeBtn.hover();
+            await p.waitForTimeout(700);
+            const r = p.locator(`button[aria-label*="${reaction}" i]`).first();
+            if (await r.count())
+                await r.click({ timeout: 3000 });
+            else
+                await likeBtn.click({ timeout: 4000 });
+        }
+        await p.waitForTimeout(1000);
+        return { reacted: true, reaction, as_page: actedAsPage ? asPage : null };
+    }
+    async function _comment(p, args) {
+        const text = String(args.text || "").trim();
+        if (!text)
+            return { error: "comment_text_required" };
+        await _post(p, args);
+        const asPage = args.as_page ? String(args.as_page) : "";
+        let actedAsPage = false;
+        // Open the comment box first (some layouts require it before the switcher).
+        const openCbox = p.locator('button[aria-label*="Comment" i]').first();
+        if (await openCbox.count())
+            await openCbox.click({ timeout: 3000 }).catch(() => { });
+        await p.waitForTimeout(800);
+        if (asPage)
+            actedAsPage = await _selectActor(p, asPage);
+        const editor = p.locator('div.ql-editor[contenteditable="true"], div[role="textbox"][contenteditable="true"]').first();
+        if (!(await editor.count()))
+            return { error: "comment_editor_not_found" };
+        await editor.click({ timeout: 3000 });
+        await editor.type(text, { delay: 12 });
+        await p.waitForTimeout(500);
+        const postBtn = p.locator('button.comments-comment-box__submit-button, button:has-text("Post")').filter({ hasNotText: "Repost" }).first();
+        if (!(await postBtn.count()))
+            return { error: "comment_post_button_not_found" };
+        await postBtn.click({ timeout: 4000 });
+        await p.waitForTimeout(1500);
+        return { commented: true, as_page: actedAsPage ? asPage : null, text_len: text.length };
+    }
+    async function _debugDom(p, args) {
+        if (args.url) {
+            await p.goto(String(args.url), { waitUntil: "domcontentloaded", timeout: NAV_TIMEOUT_MS });
+            await p.waitForTimeout(SETTLE_MS);
+        }
+        const sel = String(args.selector || "body");
+        return await p.evaluate(({ sel, want }) => {
+            const els = Array.from(document.querySelectorAll(sel)).slice(0, Number(want) || 5);
+            return els.map((e) => ({
+                tag: e.tagName,
+                cls: e.className?.toString().slice(0, 200),
+                aria: e.getAttribute("aria-label"),
+                text: (e.innerText || "").slice(0, 200),
+                html: e.outerHTML.slice(0, 400),
+            }));
+        }, { sel, want: args.limit });
+    }
+    async function _dispatch(req) {
+        try {
+            if (req.action === "ping")
+                return { ok: true, data: { ready: true } };
+            const p = await _ensurePage(req.cookies);
+            const args = req.args || {};
+            let data;
+            switch (req.action) {
+                case "feed":
+                    data = await _feed(p, args);
+                    break;
+                case "post":
+                    data = await _post(p, args);
+                    break;
+                case "react":
+                    data = await _react(p, args);
+                    break;
+                case "comment":
+                    data = await _comment(p, args);
+                    break;
+                case "debug_dom":
+                    data = await _debugDom(p, args);
+                    break;
+                default: return { ok: false, error: `unknown_action: ${req.action}` };
+            }
+            return { ok: true, data };
+        }
+        catch (e) {
+            return { ok: false, error: `bridge_error: ${e?.message || e}` };
+        }
+    }
+    // Serialize through the chain so concurrent calls don't fight over the page.
+    function dispatch(req) {
+        const run = chain.then(() => _dispatch(req));
+        chain = run.catch(() => { });
+        return run;
+    }
+    // ── HTTP server ───────────────────────────────────────────────────────────
+    const server = createServer(async (req, res) => {
+        res.setHeader("Cache-Control", "no-store");
+        if (req.method !== "POST") {
+            res.statusCode = 405;
+            res.end(JSON.stringify({ ok: false, error: "method_not_allowed" }));
+            return;
+        }
+        const auth = String(req.headers["authorization"] || "");
+        const expected = `Bearer ${token}`;
+        if (auth.length !== expected.length || auth !== expected) {
+            res.statusCode = 401;
+            res.end(JSON.stringify({ ok: false, error: "unauthorized" }));
+            return;
+        }
+        if (req.url !== "/linkedin/action") {
+            res.statusCode = 404;
+            res.end(JSON.stringify({ ok: false, error: "not_found" }));
+            return;
+        }
+        const chunks = [];
+        let total = 0, oversized = false;
+        for await (const chunk of req) {
+            total += chunk.length;
+            if (total > MAX_BODY_BYTES) {
+                oversized = true;
+                break;
+            }
+            chunks.push(chunk);
+        }
+        if (oversized) {
+            res.statusCode = 413;
+            res.end(JSON.stringify({ ok: false, error: "payload_too_large" }));
+            return;
+        }
+        let payload;
+        try {
+            payload = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+        }
+        catch {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ ok: false, error: "invalid_json" }));
+            return;
+        }
+        if (!payload || typeof payload !== "object" || !payload.action) {
+            res.statusCode = 400;
+            res.end(JSON.stringify({ ok: false, error: "missing_action" }));
+            return;
+        }
+        const out = await dispatch(payload);
+        res.statusCode = 200;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify(out));
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const addr = server.address();
+    if (!addr || typeof addr === "string") {
+        server.close();
+        return null;
+    }
+    opts.log(`LinkedIn browser bridge ready on http://127.0.0.1:${addr.port}.`);
+    return {
+        url: `http://127.0.0.1:${addr.port}`,
+        token,
+        shutdown: async () => {
+            try {
+                server.close();
+            }
+            catch { /* ignore */ }
+            if (browser) {
+                try {
+                    await browser.close();
+                }
+                catch { /* ignore */ }
+            }
+        },
+    };
+}

package/dist/linkedinLogin.js

@@ -149,7 +149,17 @@ export async function runLinkedInLoginFlow(progress) {
             viewport: { width: 1280, height: 820 },
         });
         const page = await context.newPage();
-        await page.goto("https://www.linkedin.com/login", { waitUntil: "domcontentloaded" });
+        // LinkedIn's login page is heavy; "domcontentloaded" routinely exceeds the
+        // default 30 s and aborts the whole flow with login_flow_error. "commit"
+        // resolves as soon as the navigation commits — the headed window keeps
+        // loading and the user signs in normally — and we don't fail the flow on a
+        // slow first paint: the poll loop below waits for the logged-in URL anyway.
+        try {
+            await page.goto("https://www.linkedin.com/login", { waitUntil: "commit", timeout: 60000 });
+        }
+        catch (e) {
+            progress(`Login page is slow to load (${(e?.message || e).toString().split("\n")[0]}); the window is open — sign in there.`);
+        }
         progress("Sign in with your LinkedIn account in the window that just opened.");
         // 3. Wait for the user to finish signing in. Two terminal conditions:
         //    (a) URL becomes a logged-in LinkedIn path → success.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.65",
+  "version": "1.0.66",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,