@melaya/runner 1.0.69 → 1.0.70

package/dist/linkedinLogin.js

@@ -143,26 +143,52 @@ export async function runLinkedInLoginFlow(progress) {
     catch (e) {
         return { ok: false, error: "playwright_unavailable", detail: e?.message };
     }
-    try {
-        await _installChromium(progress);
-    }
-    catch (e) {
-        return { ok: false, error: "chromium_install_failed", detail: e?.message };
-    }
-    // 2. Launch a headed Chromium window. Use a fresh context (no profile
-    //    reuse) so the user always sees a clean LinkedIn login page even
-    //    if they have an old / wrong account session lying around.
+    // 2. Launch a headed browser window. Prefer the user's REAL system Chrome
+    //    (channel:"chrome") — validated 2026-06-22 as the only reliable way to
+    //    render LinkedIn's login page (the bundled Chromium served a blank /
+    //    never-painting page; system Chrome renders the form, accepts password
+    //    + 2FA, and reaches /feed/). System Chrome also needs no 140 MB download.
+    //    Fall back to bundled Chromium only if Chrome isn't installed.
+    //    Fresh context (no profile reuse) so the user always sees a clean login.
+    //
+    //    We KEEP the fixed Chrome/127 UA override below: LinkedIn's anti-bot binds
+    //    cookie issuance to the client fingerprint (UA among others), and every
+    //    Voyager call in shared/tools/social_linkedin.py sends that exact UA
+    //    constant. Minting li_at/JSESSIONID under a DIFFERENT UA than the tools
+    //    later replay triggers a redirect-loop on /voyager/api/me
+    //    (aiohttp.TooManyRedirects) — verified 2026-06-22 when an interim
+    //    native-UA attempt broke list_connections / search / resolve_profile /
+    //    list_conversations while session_status still worked. Keep this string
+    //    in lock-step with social_linkedin.py USER_AGENT.
     let browser = null;
     try {
         progress("Opening LinkedIn login window…");
-        browser = await playwright.chromium.launch({
-            headless: false,
-            args: [
-                "--disable-blink-features=AutomationControlled",
-            ],
-        });
+        try {
+            browser = await playwright.chromium.launch({
+                headless: false,
+                channel: "chrome",
+                args: ["--disable-blink-features=AutomationControlled"],
+            });
+        }
+        catch (chromeErr) {
+            progress(`System Chrome not available (${(chromeErr?.message || chromeErr).toString().split("\n")[0]}); ` +
+                `falling back to the bundled browser.`);
+            try {
+                await _installChromium(progress);
+            }
+            catch (e) {
+                return { ok: false, error: "chromium_install_failed", detail: e?.message };
+            }
+            browser = await playwright.chromium.launch({
+                headless: false,
+                args: ["--disable-blink-features=AutomationControlled"],
+            });
+        }
         _activeLoginBrowser = browser;
         const context = await browser.newContext({
+            // MUST stay byte-for-byte equal to shared/tools/social_linkedin.py
+            // USER_AGENT (Chrome/127). See the fingerprint-binding note above —
+            // a mismatch causes aiohttp.TooManyRedirects on Voyager endpoints.
             userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
                 "(KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36",
             viewport: { width: 1280, height: 820 },

package/dist/lumaBrowserBridge.js

@@ -128,13 +128,23 @@ export async function startLumaBrowserBridge(opts) {
         if (browserLaunching)
             return browserLaunching;
         browserLaunching = (async () => {
-            const b = await playwright.chromium.launch({
-                headless: true,
-                args: [
-                    "--disable-blink-features=AutomationControlled",
-                    "--disable-dev-shm-usage",
-                ],
-            });
+            // Prefer the user's real system Chrome (channel:"chrome"). Its TLS/JA3
+            // fingerprint matches the headed login that minted cf_clearance, so the
+            // Cloudflare-gated POST /event/register is far more likely to pass — and
+            // it skips the 140 MB bundled-Chromium download. Fall back to bundled
+            // Chromium when Chrome isn't installed.
+            const launchArgs = [
+                "--disable-blink-features=AutomationControlled",
+                "--disable-dev-shm-usage",
+            ];
+            let b;
+            try {
+                b = await playwright.chromium.launch({ headless: true, channel: "chrome", args: launchArgs });
+            }
+            catch {
+                opts.log("Luma browser bridge: system Chrome unavailable, using bundled Chromium.");
+                b = await playwright.chromium.launch({ headless: true, args: launchArgs });
+            }
             browser = b;
             browserLaunching = null;
             return b;
@@ -168,6 +178,10 @@ export async function startLumaBrowserBridge(opts) {
             const storageState = await _readStorageState();
             ctx = await b.newContext({
                 storageState: storageState,
+                // MUST stay in lock-step with lumaLogin.ts and shared/tools/luma.py
+                // USER_AGENT. cf_clearance is UA-bound: it was minted under this exact
+                // string at login, so every replay (here + the direct aiohttp reads)
+                // must present the same UA or Cloudflare rejects it with a 403.
                 userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
                     "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
                 viewport: { width: 1280, height: 820 },

package/dist/lumaLogin.js

@@ -112,21 +112,47 @@ export async function runLumaLoginFlow(progress) {
     catch (e) {
         return { ok: false, error: "playwright_unavailable", detail: e?.message };
     }
-    try {
-        await _installChromium(progress);
-    }
-    catch (e) {
-        return { ok: false, error: "chromium_install_failed", detail: e?.message };
-    }
+    // Prefer the user's REAL system Chrome (channel:"chrome"). Validated for the
+    // LinkedIn login flow 2026-06-22 as the only reliable way to render a headed
+    // provider login (bundled Chromium served a blank page). For Luma it's doubly
+    // important: Luma is behind Cloudflare Turnstile and only issues cf_clearance
+    // (required for POST /event/register) after a challenge passes — a genuine
+    // Chrome clears that far more reliably than bundled Chromium, and it needs no
+    // 140 MB download. Fall back to bundled Chromium only if Chrome isn't present.
+    //
+    // We DO keep the fixed UA override below: cf_clearance is bound to the exact
+    // UA that minted it, and the replay paths (lumaBrowserBridge.ts and the direct
+    // aiohttp reads in shared/tools/luma.py) both send this same fixed string.
+    // Turnstile is solved under this overridden UA, so the binding stays internally
+    // consistent across mint + every replay. Keep all three in lock-step.
     let browser = null;
     try {
         progress("Opening Luma login window…");
-        browser = await playwright.chromium.launch({
-            headless: false,
-            args: ["--disable-blink-features=AutomationControlled"],
-        });
+        try {
+            browser = await playwright.chromium.launch({
+                headless: false,
+                channel: "chrome",
+                args: ["--disable-blink-features=AutomationControlled"],
+            });
+        }
+        catch (chromeErr) {
+            progress(`System Chrome not available (${(chromeErr?.message || chromeErr).toString().split("\n")[0]}); ` +
+                `falling back to the bundled browser.`);
+            try {
+                await _installChromium(progress);
+            }
+            catch (e) {
+                return { ok: false, error: "chromium_install_failed", detail: e?.message };
+            }
+            browser = await playwright.chromium.launch({
+                headless: false,
+                args: ["--disable-blink-features=AutomationControlled"],
+            });
+        }
         _activeLoginBrowser = browser;
         const context = await browser.newContext({
+            // MUST stay in lock-step with shared/tools/luma.py USER_AGENT and
+            // lumaBrowserBridge.ts — cf_clearance is UA-bound (see comment above).
             userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
                 "(KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
             viewport: { width: 1280, height: 820 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.0.69",
+  "version": "1.0.70",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "UNLICENSED",
   "private": false,
@@ -22,15 +22,15 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "socket.io-client": "^4.8.0",
-    "commander": "^12.0.0",
     "chalk": "^5.3.0",
+    "commander": "^12.0.0",
     "ora": "^8.0.0",
-    "playwright": "^1.47.0"
+    "playwright": "^1.47.0",
+    "socket.io-client": "^4.8.0"
   },
   "devDependencies": {
-    "typescript": "^5.5.0",
-    "@types/node": "^20.0.0"
+    "@types/node": "^20.0.0",
+    "typescript": "^5.5.0"
   },
   "engines": {
     "node": ">=18"