indiecrm-cli 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,447 @@
+# Changelog
+
+## 0.2.1
+
+- Keep IndieCRM CRM commands outside the inherited Salesprompter research authentication hook.
+- Verify both authentication boundaries through the packaged `indiecrm` executable.
+
+## 0.2.0
+
+- Restore the full Salesprompter research command surface in `indiecrm`, including `leads:at-companies`, browser research, enrichment, scoring, and sync.
+- Keep IndieCRM CRM sign-in and Salesprompter research sign-in separate, with the original research services and saved checkpoints intact.
+- Migrate the research source, tests, docs, extension, plugin, and database migration files into the IndieCRM CLI repository.
+- Update command examples, upgrade guidance, and research documentation for the `indiecrm` executable.
+
+## 0.1.0
+
+- Fork the Salesprompter CLI repository under the IndieCRM name.
+- Add IndieCRM browser OAuth sign-in and commands for workspaces, pipelines, deals, contacts, companies, and activities through IndieCRM's MCP API.
+- Publish only the IndieCRM command and auth implementation in the npm package.
+
+## Salesprompter release history
+
+The following entries document the original research implementation before it was included in `indiecrm-cli`.
+
+## 0.1.84 - 2026-09-08
+
+- Preserve checkpoints and release research locks when a guided review is cancelled with Ctrl+C or EOF.
+
+- Remember the standalone Chrome research connection only after a successful authenticated check. Explicit connection flags override the saved choice; failed auth never silently changes identities. Add background `browser:connect --check`.
+- Guide exact-name company disambiguation in the terminal with verified location, website and source links, explicit selection and confirmation, durable review decisions and immediate checkpoint resume. No hand-edited JSON is needed for supported exact-name ambiguities; uncertain identities remain unapproved.
+- Return `outcome: complete|incomplete|needs_review` and exact next commands. Never prompt in JSON/quiet/non-TTY mode; support `--no-interactive` and `--require-complete` with exit 2 for unfinished collection or review.
+- Cover preference isolation, overrides, invalid candidate evidence, skip/cancel, durable decisions, outcome reporting and guarded executable reruns. Retain exact employer checks, role review, pacing and research-only behavior.
+
+## 0.1.83 - 2026-09-07
+
+- Add native canonical-employer verification, safe presentation/legal-name aliases, and retained source evidence; never relax numeric current-employer identity checks.
+- Add fingerprint-bound `--review-file` decisions for unresolved identities and employer aliases without changing the original brief or discarding collected people.
+- Diagnose failed company resolution with query attempts, candidates and explicit ambiguity, oversized, incomplete and entity-decision reasons. Require complete unique matches and native company-detail evidence for automatic resolution.
+- Add `--continue-partial quota|exhaustive`, per-page checkpoints, raw-offset resume, duplicate/count-drift protection and exact repeatable `--company` scoping. The accessible 2,500-result window is not an exhaustive-coverage guarantee.
+- Tighten software, digital-product/UX and technical-data role classification. Preserve multiple review reasons and identify the selection policy in reports.
+- Verify four canonical employers against Matthias's saved collection, recover 69 shortlist places under the stricter policy, and preserve the original export. No enrichment or outreach is started.
+
+## 0.1.82 - 2026-09-07
+
+- Let Chrome research unwind normally on SIGINT, SIGTERM and SIGHUP instead of exiting before checkpoint-lock cleanup.
+- Close only the owned Chrome process, preserve completed searches, release the research lock and return an explicit interrupted status with the corresponding exit code.
+- Add real-Chrome subprocess tests that interrupt an in-flight request with SIGINT/SIGTERM and prove that restart collects only the pending job.
+
+## 0.1.81 - 2026-09-07
+
+- Require Node.js 22.12+ for the current Chrome driver; Node.js 24 LTS is recommended.
+
+- Add `browser:connect` for one-time manual sign-in to an isolated, persistent research Chrome profile.
+- Add `leads:at-companies --browser chrome`: CLI-owned, lazy background Chrome with a private OS pipe; no external Codex browser worker, extension, cookie export or debugging port.
+- Preserve exact identity checks, sequential pacing, checkpoint reuse, rate-limit stops and research-only boundaries. Fail clearly when sign-in or a security challenge requires the user.
+- Verify fresh Helsing name resolution and two matching contacts against live LinkedIn, followed by a cached rerun without launching Chrome. Add browser transport, profile isolation, connection-mode and real-Chrome regression tests.
+
+## 0.1.80 - 2026-09-07
+
+- Load LinkedIn credentials lazily so completed company research can resume without a live LinkedIn session.
+- Add bounded `--wait-for-session` recovery from refreshed extension credentials; reject identity changes and never retry rate limits.
+- Add `--retry-unresolved` to retry cached identity misses without discarding completed searches or successful resolutions.
+- Test credential waiting, offline checkpoint reuse, command option validation and targeted identity retries. Codex browser relay still requires an external worker.
+
+## 0.1.79 - 2026-09-06
+
+- Execute name-only company resolution and contact collection in one `leads:at-companies --resolve-companies --all` run.
+- Paginate exact Account Search identity checks, reject ambiguity and shared IDs, preserve resolution evidence and reuse the checkpoint without manual brief edits.
+- Keep known-company work first, share session recovery, retain pacing/rate-limit stops and never activate outreach.
+- Verified live from the name Helsing to company ID and two shortlisted contacts; added orchestration and resume regressions.
+
+## 0.1.78 - 2026-09-06
+
+- Report distinct shortlist/review people separately from candidate/function rows, with partial, unknown, pending and unresolved coverage and explicit next actions.
+- Add checkpoint-bound `--report-only` without LinkedIn requests.
+- Support explicit evidence-backed employer-name aliases while retaining exact current-company ID checks and export provenance.
+- Document browser-worker loopback handoff and safe continuation rules in the distributed CLI skill.
+
+## 0.1.77 - 2026-09-06
+
+- Escape punctuation in company query labels; verified against the TKMS HTTP 400 regression.
+- Refresh private shortlist, review and coverage exports after every completed search.
+
+## 0.1.76 - 2026-09-06
+
+- Expand named-company research to talent acquisition, business intelligence, digital workplace, CDO and German department-head titles.
+- Separate broad digital, transformation, communications, operational-technology and mixed-role matches into a private review queue instead of inflating the shortlist.
+- Prefer current-position employer evidence over stale summary IDs and consider all matching current positions. Keep assistant, former-role and junior exclusions.
+- Preserve source employer names and flag name/ID scope conflicts for review, including parent/subsidiary ambiguity.
+- Add regression tests drawn from Matthias's archived role patterns, including ambiguity, employer drift and review-file privacy.
+
+## 0.1.75
+
+- Company research retries rejected LinkedIn authentication once with a different extension-synced session and reuses it for later searches.
+- Preserve checkpoints, stop on rate limits, and explain browser-relay recovery when no working session is available.
+
+All notable user-facing changes to `salesprompter-cli` should be recorded in this file.
+
+The format is intentionally lightweight and release-oriented.
+
+## 0.1.74 - 2026-09-06
+
+### Added
+
+- Native `leads:at-companies` research: a named-company brief, six configurable functions, exact employer checks, senior-role filtering, balanced variable-size shortlists, and private CSV/coverage exports.
+- Workspace-bound resumable checkpoints, bounded search batches, concurrent-run protection, unresolved-company reporting and explicit partial-search evidence. No implicit email enrichment or outreach.
+
+## 0.1.73 - 2026-09-02
+
+### Added
+
+- `affiliate:copy` previews nine Gojiberry variants, compiles native Instantly spintax in subjects and all body fields including link labels, and saves structured JSON plus mobile-width HTML previews.
+- Missing-name fallbacks, exact step-URL preservation, all-choice word/phrase checks, clear opt-outs and a concise paid-link disclosure.
+- Explicit saved-review apply with both local and remote stale-copy checks; active campaigns require `--allow-active`. No implicit draft activation or sender-limit changes.
+
+### Fixed
+
+- Large piped JSON output is flushed before CLI exit so copy reviews cannot be silently truncated.
+
+## 0.1.72 - 2026-08-30
+
+### Added
+
+- Affiliate runs now surface aggregate Hunter verification evidence alongside the existing Instantly verification health.
+
+### Changed
+
+- The A-to-Z affiliate workflow reuses Hunter Email Finder verification evidence and sends recovery-source or evidence-missing addresses through Hunter Email Verifier before campaign import.
+
+### Safety
+
+- New campaigns require Hunter status `valid` and secondary Instantly verification before activation. Catch-all, disposable, webmail, invalid, unknown, claimed, pending, and unresolved addresses fail closed; `--allow-accept-all` is rejected.
+
+## 0.1.71 - 2026-08-30
+
+### Added
+
+- Added `affiliate:finish` to repair stalled verification in bounded batches, quarantine unsafe recipients, activate only after the live safety gate opens, and read the running campaign back.
+
+## 0.1.70 - 2026-08-30
+
+### Added
+
+- `affiliate:status` now reads the linked Instantly campaign live and returns an immediate `done` verdict with campaign state, sender count, lead totals, verification health, and contacted/replied counts.
+
+### Safety
+
+- A campaign is only done after it is running, every active lead is verified, enrichment is complete, and outreach activity has begun. The status payload remains aggregate-only and never exposes recipient data.
+
+## 0.1.69 - 2026-08-26
+
+### Added
+
+- Added local-only `products:collect-details` / `linkedin-products:collect-details` to enrich a proven `products:collect` ranking with public LinkedIn product-page fields through a resumable loopback browser relay.
+- Added external product websites, vendor LinkedIn identities, intended roles, customer companies, features, detail coverage, and a reproducible SHA-256 detail checksum to complete enriched artifacts.
+
+### Safety
+
+- Detail collection is bound to the source artifact's exact query hash, contiguous ranks, canonical product URLs, product count, and order checksum. Authentication loss, challenges, rate limits, interruption, and unexpected pages stop at the checkpoint without emitting a partial enriched artifact.
+- Product unavailability requires bounded `404`/`410` or LinkedIn unavailable-page proof. The relay accepts only allowlisted public product fields and never collects cookies, storage, headers, messaging, connections, or other personalized content.
+
+## 0.1.68 - 2026-08-25
+
+### Added
+
+- Added `affiliate:grow` as the A-to-Z alias for `affiliate:run`, with repeatable `--seed-profile` customer exclusions and a concise stage-by-stage result.
+- Added an authenticated canonical audience readback before any Instantly draft is prepared.
+
+### Changed
+
+- Affiliate people collection now retries a rejected saved session once with the latest extension-synced session and no longer retries deterministic `401`/`403` responses.
+- Affiliate persistence removes within-batch and prior-workspace audience duplicates. Zero-net-new cohorts create no audience, enrichment job, or Instantly campaign.
+
+### Safety
+
+- Session rejection and persistence-count drift fail closed before outreach preparation; activation remains explicit.
+
+## 0.1.67 - 2026-08-25
+
+### Added
+
+- Added local-only `products:collect` / `linkedin-products:collect` for resumable, exact-order LinkedIn product-search collection through a loopback signed-in-browser relay.
+- Added terminal-page proof, public-field allowlisting, contiguous first-seen ranks, query hashing, and a reproducible SHA-256 order checksum to complete artifacts.
+
+### Safety
+
+- Bounded, interrupted, challenged, rate-limited, and identity-drift runs remain incomplete and cannot emit a complete artifact or upload data to Salesprompter.
+
+## 0.1.66 - 2026-08-13
+
+### Added
+
+- Added `leads:collect --defer-email-enrichment` for storing large lead universes without starting email discovery. The CLI verifies app support before collection and confirms the deferred state after import.
+
+### Changed
+
+- Kept the existing `leads:collect` behavior unchanged when the new flag is omitted, and added explicit `emailEnrichmentDeferred` and `outreachStarted` fields to collection output.
+
+## 0.1.65 - 2026-08-13
+
+### Fixed
+
+- Removed recipient-level names, emails, profile URLs, and raw provider import rows from affiliate status output. Status now reports only the reviewed sequence, safe settings, and aggregate counts.
+
+## 0.1.64 - 2026-08-13
+
+### Added
+
+- Added `affiliate:list` for safe workspace-scoped audience and outreach summaries.
+- Added `affiliate:analytics <run-id>` for campaign totals plus step/variant reply and opportunity metrics; meetings and won deals remain campaign-level totals only.
+- Exposed `affiliate:regenerate-sequence` in top-level help and the Outreach pack.
+
+### Changed
+
+- Added `--timing-mode auto|custom` to `affiliate:run`; the default `custom` mode now makes `--daily-limit`, `--send-from`, and `--send-to` effective.
+- Made the fixed three-email sequence contract explicit, rejecting every other `--steps` value before creating an audience or campaign.
+- Validated the 120-character campaign-name limit before audience collection, required complete ordered 3×3 sequences for ready and active responses, and showed unsupported per-step meeting/won metrics as `n/a`.
+
+## 0.1.63 - 2026-08-13
+
+### Fixed
+
+- Hardened browser login callbacks against speculative requests and persistent connections so a completed login returns control to the CLI reliably.
+
+## 0.1.62 - 2026-07-31
+
+### Added
+
+- Added automatic per-query checkpoints for exhaustive Sales Navigator people collection.
+- Resume completed slices and canonical people after interruption or rate limiting, then remove the checkpoint only after workspace persistence succeeds.
+
+### Fixed
+
+- Restrict people normalization to the Sales Navigator response's actual result elements so unrelated `included` records and decorations cannot inflate an import.
+
+## 0.1.61 - 2026-07-31
+
+### Fixed
+
+- Treat a completed company-headcount partition plus residual as coverage proof and persist its canonical profile URL union even when LinkedIn's matching-placement headline is higher.
+- Record the exact `reportedCountDrift` and avoid redundant whole-root recovery passes after an exhaustive partition has completed.
+
+## 0.1.60 - 2026-07-31
+
+### Fixed
+
+- Record an at-most-five reported-count drift when every page of an under-cap people search was fetched but LinkedIn repeated a few profile placements, avoiding unnecessary recovery passes without hiding missing canonical profiles.
+- Keep larger gaps and every oversized aggregate fail-closed until adaptive slicing recovers the full deduplicated result set.
+- Align the checkpointed Account Search collector and all packaged skill references with the 1,000-company native window.
+- Upgrade the npm release workflow to the current checkout and Node setup action majors.
+
+## 0.1.59 - 2026-07-31
+
+### Improved
+
+- Replaced per-child shortfall recursion with bounded whole-root recovery passes, keeping company headcount first and adding another safe dimension only when the deduplicated union is still short.
+- Preserved recursive splitting only for slices that genuinely exceed the applicable result window.
+
+## 0.1.58 - 2026-07-31
+
+### Fixed
+
+- Added adaptive recovery for under-cap Sales Navigator searches whose paginated rows contain duplicate or unstable profile entries.
+- Headcount-slice and deduplicate those short collections before persistence, while keeping the existing fail-closed completeness check.
+
+## 0.1.57 - 2026-07-31
+
+### Changed
+
+- Raised the normal Sales Navigator people-search window to 2,500 while preserving the 1,000-result account and `Connections of` limits.
+- Made unbounded `leads:collect` runs automatically split oversized searches by company headcount, recurse through safe dimensions when needed, and deduplicate by canonical profile URL.
+
+### Improved
+
+- Persisted aggregate imports as one workspace run with per-slice evidence and fail-closed coverage checks.
+- Documented the exhaustive historical-backfill flow and kept enrichment separate from outreach.
+
+## 0.1.56 - 2026-07-31
+
+### Changed
+
+- Raised authenticated local Sales Navigator people collection from 1,000 to 2,000 results by default while preserving the 1,000-result account/company limit.
+- Aligned affiliate people imports with the app's automatic Phantombuster-to-Hunter email processing pipeline.
+
+### Improved
+
+- Documented capped people imports and kept structured completion, truncation, and remaining-result reporting intact at the new limit.
+
+## 0.1.55 - 2026-07-31
+
+### Added
+
+- Added `leads:download` / `leads:export-csv` to download stored leads from the active Salesprompter workspace as CSV.
+- Added run, search, email-only, and output-path filters that match the app's CLI imports export.
+
+## 0.1.54 - 2026-07-29
+
+### Added
+
+- Added `--retry-not-found-companies` for versioned, resumable retries of previous exact company misses without refreshing already enriched profiles.
+- Added Hunter company-name fallback when no unambiguous official domain is available, plus `--no-hunter-company-fallback` for domain-only runs.
+- Added `--retry-failed-emails` so transient or validation failures can be retried without rebilling previous Hunter `not_found` results.
+
+### Improved
+
+- Retry Account Search with a cleaned legal company name while retaining the exact normalized-match requirement.
+- Recover conservative name-formatting failures such as honorifics, credentials, underscores, and quoted names before a second Hunter lookup.
+- Reuse an existing domain only when an exact normalized company name maps to one unique domain in the active organization.
+
+## 0.1.53 - 2026-07-28
+
+### Fixed
+
+- Recognize stale company `404` results whether LinkedIn returns the status in `statuses[id]` or in `errors[id].status`, so exact-name fallback runs for both live response shapes.
+
+## 0.1.52 - 2026-07-28
+
+### Fixed
+
+- Fall back to exact-name Sales Navigator Account Search when an imported company id returns a per-company `404`.
+- Stop reusing stale company ids as shortcuts for name-only aliases, so recoverable companies can receive their official domains before Hunter enrichment.
+
+## 0.1.51 - 2026-07-28
+
+### Added
+
+- Added `leads:enrich-import` for the explicit local Sales Navigator company -> official domain -> Hunter pipeline across one or more stored CLI imports.
+- Added durable, organization-scoped company profile and email-enrichment persistence with staged company-only and Hunter-only operation.
+
+### Changed
+
+- Kept this import-enrichment flow data-only: it never creates sequences, Instantly campaigns, or outreach and reports `outreachStarted = false`.
+
+## 0.1.50 - 2026-07-27
+
+### Fixed
+
+- Added current-request header guidance to signed-in Sales Navigator browser relay tasks so Lead Search recovery can satisfy LinkedIn's CSRF requirement without exporting browser cookies.
+- Made capped people-search imports explicit with `collectionComplete`, `truncated`, and `remainingResults` in the structured CLI result.
+
+## 0.1.44 - 2026-07-20
+
+### Added
+
+- Added the complete affiliate campaign journey: local Sales Navigator people collection, persisted audience runs, email enrichment, draft Instantly campaigns, status checks, and explicit activation.
+- Added `affiliate:enrich <run-id>` to recover additional campaign emails in the background, deduplicate existing leads, and import only new contacts with verification enabled.
+- Added durable Account Search collection, market membership persistence, and prefixed Salesprompter Supabase migrations.
+
+### Changed
+
+- Affiliate email discovery now uses Hunter first and the configured Phantombuster Email Finder for unresolved people.
+- Updated the packaged Salesprompter skill and CLI documentation to match the current local collection and outreach workflows.
+
+## 0.1.43 - 2026-07-01
+
+### Added
+
+- Added `companies:scrape-linkedin` / `linkedin-companies:scrape-local` for locally captured LinkedIn company profile and insights enrichment with timestamped database history.
+- Added `companies:scrape-dealroom` / `dealroom-companies:scrape-local` for locally captured Dealroom company enrichment with timestamped database history.
+
+### Changed
+
+- Added local scrape history tables for LinkedIn company snapshots, LinkedIn company insight rows, and Dealroom company snapshots.
+- Filtered invalid, generic, and image-less LinkedIn account-search profiles out of the reporting view used by the Data Studio account-search dashboard.
+
+## 0.1.42 - 2026-06-28
+
+### Fixed
+
+- Fixed Sales Navigator account-search employee counts to use exact LinkedIn display counts only when provided, and clear stale numeric counts when only a headcount range is available.
+
+## 0.1.36 - 2026-05-11
+
+### Changed
+
+- Restored the repo-local Chrome extension compatibility copy and LinkedIn direct-strategy benchmark script.
+- Added direct LinkedIn workflow updates for target-company inputs and workspace lead generation internals.
+- Tightened Deel/direct-path company-size filtering to map Salesprompter size buckets into employee-count ranges.
+
+## 0.1.35 - 2026-05-11
+
+### Fixed
+
+- Fixed the interactive product-market prompt for very long pasted Sales Navigator URLs by reading that prompt in raw mode, avoiding terminal line-buffer limits that made Return appear to do nothing.
+
+## 0.1.34 - 2026-05-10
+
+### Changed
+
+- Switched `auth:workspace`, the startup workspace chooser, and the wizard `Switch workspace` action to use an in-terminal Salesprompter workspace selector when a cached CLI session exists.
+- Added `--workspace`, `--org-id`, and `--browser` options to `auth:workspace` for direct workspace switches and explicit browser fallback.
+- Kept the browser chooser as a fallback when the app workspace API is unavailable or no cached CLI session exists.
+
+## 0.1.33 - 2026-05-10
+
+### Changed
+
+- Added `auth:workspace` / `auth:switch` so operators can reopen the workspace chooser without restarting or clearing auth manually.
+- Added a wizard-level `Switch workspace` option for changing workspaces before choosing a workflow.
+- Made the product-market wizard detect pasted LinkedIn Sales Navigator people-search URLs and process them directly through the durable Sales Navigator crawl path.
+
+## 0.1.32 - 2026-05-10
+
+### Changed
+
+- Refresh cached wizard sessions through the app before rendering workspace choices, so older tokens can pick up Clerk and Salesprompter workspace metadata.
+- Display Salesprompter workspace client metadata in the wizard when the app returns it.
+
+## 0.1.31 - 2026-05-10
+
+### Changed
+
+- Replaced the cached-workspace yes/no prompt with a workspace selector in the interactive wizard.
+- Show workspace names, slugs, and ids when the cached token includes them, and offer a browser workspace chooser when it does not.
+
+## 0.1.30 - 2026-05-10
+
+### Changed
+
+- Made the interactive wizard show and confirm the cached Salesprompter workspace before starting a workflow.
+- Added a browser-login handoff from the wizard when the user rejects the cached workspace, so multi-workspace users can pick the right CLI workspace.
+
+## 0.1.29 - 2026-04-02
+
+### Changed
+
+- Fixed the durable Sales Navigator crawl loop so `--max-slices` does not keep retry-claiming distinct slices after a retryable failure.
+- Hardened Sales Navigator CLI integration tests to bound subprocess lifetime while still verifying the JSON payloads they emit.
+
+## 0.1.28 - 2026-04-01
+
+### Added
+
+- `companies:resolve-linkedin-urls` for resolving LinkedIn company URLs from pasted company lists.
+- Serper-backed LinkedIn company lookup fallback when `SERPER_API_KEY` or `SALESPROMPTER_SERPER_API_KEY` is configured.
+- Community and governance files: contributing guide, code of conduct, security policy, issue templates, PR template, and funding metadata.
+
+### Changed
+
+- Improved company URL matching to reject weak LinkedIn company false positives with page-level validation.
+- Expanded README and package metadata to better describe the public CLI surface and support channels.
+
+## 0.1.27 - 2026-03-25
+
+### Notes
+
+- Current latest published version on npm.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,35 @@
+# Code of Conduct
+
+## Our standard
+
+We expect contributors and maintainers to keep this project respectful, direct, and constructive.
+
+Examples of expected behavior:
+
+- assume good intent
+- focus feedback on the code and product behavior
+- use factual, reproducible reports
+- be respectful in disagreement
+- help keep the project usable for others
+
+Examples of unacceptable behavior:
+
+- harassment or personal attacks
+- discriminatory language
+- doxxing or publishing private information
+- bad-faith disruption
+- spam, abuse, or intimidation
+
+## Enforcement
+
+Project maintainers may remove, edit, or reject comments, commits, issues, or pull requests that violate this code of conduct.
+
+Repeated or severe violations may result in temporary or permanent exclusion from project spaces.
+
+## Reporting
+
+To report conduct issues, contact:
+
+- `hello@danielsinewe.com`
+
+Please include links, screenshots, or other concrete context where possible.

package/CONTRIBUTING.md

@@ -0,0 +1,7 @@
+# Contributing to IndieCRM CLI
+
+IndieCRM CLI is the terminal client for [IndieCRM](https://indiecrm.app). CRM commands should match tools currently offered by IndieCRM's authenticated MCP API. Research commands inherited from Salesprompter must preserve their current behavior and independent authentication.
+
+Use Node.js 22.12 or newer. Run `npm ci`, `npm test`, and `npm pack --dry-run` before proposing a release. Update the README when commands or authentication change. Do not add credentials, customer data, or local auth files to the repository or test fixtures.
+
+For security reports, use the contact in [SECURITY.md](./SECURITY.md) instead of a public issue.

package/README.md

@@ -1,6 +1,6 @@
 # IndieCRM CLI
 
-The IndieCRM CLI works with the workspaces, pipelines, contacts, companies, and deals in [IndieCRM](https://indiecrm.app). It uses IndieCRM's authenticated MCP API, so data access follows your signed-in account and workspace permissions.
+The IndieCRM CLI works with the workspaces, pipelines, contacts, companies, and deals in [IndieCRM](https://indiecrm.app). It also includes the full Salesprompter research workflow, including the `leads:at-companies` command. CRM access uses IndieCRM's authenticated MCP API; research commands still use Salesprompter services and accounts.
 
 Requires Node.js 22.12 or newer.
 
@@ -28,6 +28,18 @@ indiecrm activity:log <app-id> <deal-id> "Sent proposal" --kind email
 
 Commands print JSON for shell scripts and agents. Start with `indiecrm workspaces` to find the app ID for each workspace. `indiecrm tools` shows the live API tool catalog, and `indiecrm call <tool> --input '{"appId":"..."}'` exposes any supported tool directly. `indiecrm status` checks for a local session; `indiecrm logout` removes it.
 
+## Research existing accounts and leads
+
+The original Salesprompter research commands are available under the `indiecrm` executable. Research sign-in is separate from IndieCRM CRM sign-in:
+
+```bash
+indiecrm auth:login
+indiecrm browser:connect
+indiecrm leads:at-companies --brief companies.json --out-dir ./research --resolve-companies --all
+```
+
+For example, `companies.json` can contain `{ "companies": [{ "name": "bizforward GmbH", "maxContacts": 20 }] }`. Use `--dry-run` to preview targeting without collecting data. The existing Salesprompter config, workspaces, saved research checkpoints, and service integrations remain supported. See [RESEARCH.md](RESEARCH.md) for the full research workflow and recovery options.
+
 ## Development
 
 ```bash
@@ -36,4 +48,4 @@ npm test
 npm pack --dry-run
 ```
 
-This repository was forked from `salesprompter-cli`. The IndieCRM package has its own command, authentication, API connection, and release version. Salesprompter commands are not part of the published package.
+This repository was forked from `salesprompter-cli`. The IndieCRM package has its own command, authentication, API connection, and release version. The new package combines the original research commands with IndieCRM CRM commands, while keeping their sign-in and service boundaries explicit.