indiecrm-cli 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.3
+
+- Add an IndieCRM Chrome companion that runs Sales Navigator research in an already signed-in tab through the local CLI relay, without copying browser cookies or asking for a second password.
+- Add `browser:extension` setup guidance and make the existing-browser path the first research quickstart option.
+
 ## 0.2.2
 
 - Finish Salesprompter browser login even when the browser proxy keeps a localhost callback connection open.

package/README.md

@@ -34,11 +34,12 @@ The original Salesprompter research commands are available under the `indiecrm`
 
 ```bash
 indiecrm auth:login
-indiecrm browser:connect
-indiecrm leads:at-companies --brief companies.json --out-dir ./research --resolve-companies --all
+indiecrm browser:extension
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --resolve-companies --all --browser-relay-port 43117
 ```
 
-For example, `companies.json` can contain `{ "companies": [{ "name": "bizforward GmbH", "maxContacts": 20 }] }`. Use `--dry-run` to preview targeting without collecting data. The existing Salesprompter config, workspaces, saved research checkpoints, and service integrations remain supported. See [RESEARCH.md](RESEARCH.md) for the full research workflow and recovery options.
+For example, `companies.json` can contain `{ "companies": [{ "name": "bizforward GmbH", "maxContacts": 20 }] }`. Use `--dry-run` to preview targeting without collecting data. The Chrome companion reuses a signed-in Sales Navigator tab without asking for a second password; `indiecrm browser:connect` remains available for an isolated research profile. The existing Salesprompter config, workspaces, saved research checkpoints, and service integrations remain supported. See [RESEARCH.md](RESEARCH.md) for the full research workflow and recovery options.
 
 ## Development
 

package/RESEARCH.md

@@ -54,11 +54,12 @@ Start with company names; no LinkedIn IDs are needed in your brief:
 
 ```bash
 indiecrm auth:login
-indiecrm browser:connect
-indiecrm leads:at-companies --brief companies.json --out-dir ./research --resolve-companies --all
+indiecrm browser:extension
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --resolve-companies --all --browser-relay-port 43117
 ```
 
-After a successful connection, Chrome is remembered for company research. If names are ambiguous, an interactive terminal shows verified candidate locations, websites and evidence links. Choose a number, then confirm; nothing is preselected. The CLI saves the decision and resumes without editing your brief. Use `--review` to review a saved ambiguity later. Enter 0 or press Enter to leave it unresolved.
+Load the companion once in the Chrome profile already signed in to Sales Navigator, then click its popup and connect to the printed port while the research command runs. See the browser instructions below. If you prefer an isolated research Chrome profile, use `indiecrm browser:connect`; that route requires its own Sales Navigator sign-in and is remembered for future research commands. If names are ambiguous, an interactive terminal shows verified candidate locations, websites and evidence links. Choose a number, then confirm; nothing is preselected. The CLI saves the decision and resumes without editing your brief. Use `--review` to review a saved ambiguity later. Enter 0 or press Enter to leave it unresolved.
 
 JSON, quiet and non-interactive runs never prompt. Their `outcome` is `complete`, `incomplete` or `needs_review`; `nextCommand` gives the terminal command for pending collection or identity review. `collectionComplete` refers only to collection, so it can be true while role review remains. Add `--require-complete` for exit code 2 whenever collection or review is unfinished. Without it, exit 0 means the command ran, not that all research is complete. `--no-interactive` disables prompts in a terminal too.
 
@@ -121,11 +122,20 @@ indiecrm leads:at-companies --brief companies.json --out-dir ./research \
   --resolve-companies --all
 ```
 
+If you are already signed in to Sales Navigator in your everyday Chrome profile, you can reuse that tab without typing a password or copying the profile. Start the research command in one terminal with a free local port:
+
+```bash
+indiecrm leads:at-companies --brief companies.json --out-dir ./research \
+  --resolve-companies --all --browser-relay-port 43117
+```
+
+Run `indiecrm browser:extension` to find the bundled Chrome companion. In the Chrome profile already signed in to Sales Navigator, open `chrome://extensions`, enable Developer mode, choose **Load unpacked**, and select that directory. Return to your Sales Navigator tab, click **IndieCRM Research**, enter `43117`, and click **Connect**. Keep the tab open while research runs; the popup can be closed. The companion asks for access only to the active tab and local `127.0.0.1`, accepts only Sales Navigator company and lead GET requests, sends their results to the CLI, and keeps browser cookies in Chrome. Disconnect in the popup when finished. Rerun the research command with the same output directory to resume saved work. The signed-in tab must have access to Sales Navigator; a regular LinkedIn feed alone is insufficient.
+
 `browser:connect` opens a separate Chrome window and waits up to ten minutes for your manual Sales Navigator sign-in (change with `--wait <seconds>`). It confirms a successful native authenticated request, then closes its own browser. Google Chrome must be installed. The private profile lives at `~/.config/salesprompter/chrome-research` (or under `SALESPROMPTER_CONFIG_DIR`). Your everyday Chrome profile stays untouched. The control connection uses a private OS pipe, not a debugging port. No cookies or browser storage are read/exported. The CLI keeps only allowlisted native request headers in memory.
 
 Research runs reuse that profile in background Chrome, execute the GET requests themselves, and close their own browser when finished. No Codex task, relay worker, extension, or manual request polling is needed. A first sign-in, expired login, or security challenge still requires you: rerun `browser:connect`, then repeat the research command with the same output directory. Rate limits stop immediately without switching accounts. `--browser chrome`, `--browser-relay-port`, and `--wait-for-session` are mutually exclusive. Chrome connects lazily, so completed checkpoints and report-only runs never launch it.
 
-`browser:connect` remembers Chrome only after confirming a successful authenticated request. `browser:connect --check` checks an existing sign-in in background and also remembers it; it does not open a sign-in window. The preference is private and scoped to the CLI configuration directory. Explicit `--browser session` selects extension credentials; without a remembered choice, session remains the fallback. Explicit relay/wait flags take precedence over the preference. Credentials load only for pending requests; on an auth failure the session route tries changed credentials for the same identity once. Add `--wait-for-session 300` for a bounded refresh wait. The optional Codex `--browser-relay-port` route still needs its external worker. Salesprompter workspace authentication applies in every mode.
+`browser:connect` remembers Chrome only after confirming a successful authenticated request. `browser:connect --check` checks an existing sign-in in background and also remembers it; it does not open a sign-in window. The preference is private and scoped to the CLI configuration directory. Explicit `--browser session` selects extension credentials; without a remembered choice, session remains the fallback. Explicit relay/wait flags take precedence over the preference. Credentials load only for pending requests; on an auth failure the session route tries changed credentials for the same identity once. Add `--wait-for-session 300` for a bounded refresh wait. The `--browser-relay-port` route works with the signed-in Chrome worker above or a Codex browser worker. Salesprompter workspace authentication applies in every mode.
 
 Ctrl+C, SIGTERM and terminal hangup stop Chrome research gracefully: completed searches stay saved, the owned browser closes, and the research lock is released before exit. Repeat the same command to resume only pending work. A forced kill or power loss cannot run cleanup; if a stale lock remains, confirm that its process stopped before removing only `.research-lock` as the CLI error explains.
 

package/browser-extension/background.js

@@ -0,0 +1,144 @@
+const STATE_KEY = "indiecrmResearch";
+const ALARM = "indiecrmResearchPoll";
+let pumping = false;
+
+function allowedResearchUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.origin === "https://www.linkedin.com" &&
+      /^\/sales-api\/(?:salesApiAccountSearch|salesApiLeadSearch|salesApiCompanies)(?:\/\d+)?$/.test(url.pathname) &&
+      !url.username && !url.password && !url.hash;
+  } catch { return false; }
+}
+
+async function state() {
+  return (await chrome.storage.session.get(STATE_KEY))[STATE_KEY] || null;
+}
+
+async function setState(value) {
+  await chrome.storage.session.set({ [STATE_KEY]: value });
+}
+
+async function stop(message) {
+  const current = await state();
+  await setState({ port: current?.port || null, message, connected: false });
+  await chrome.alarms.clear(ALARM);
+}
+
+async function requestInTab(url) {
+  if (location.origin !== "https://www.linkedin.com" || !location.pathname.startsWith("/sales/")) {
+    return { status: 401, body: { error: "Sales Navigator tab is no longer signed in" }, retryAfter: null };
+  }
+  const session = document.cookie.match(/(?:^|;\s*)JSESSIONID="?([^";]+)/);
+  const csrf = session && decodeURIComponent(session[1]);
+  if (!csrf) return { status: 401, body: { error: "No Sales Navigator session in this tab" }, retryAfter: null };
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(csrf));
+  const fingerprint = Array.from(new Uint8Array(digest), byte => byte.toString(16).padStart(2, "0")).join("");
+  try {
+    const response = await fetch(url, {
+      method: "GET", credentials: "include", redirect: "error",
+      headers: { accept: "*/*", "x-restli-protocol-version": "2.0.0", "csrf-token": csrf },
+      signal: AbortSignal.timeout(30000)
+    });
+    const text = await response.text();
+    if (text.length > 50 * 1024 * 1024) return { status: 502, body: { error: "Response exceeded 50 MB" }, retryAfter: null, fingerprint };
+    let body;
+    try { body = JSON.parse(text); }
+    catch { body = { error: "Sales Navigator did not return JSON" }; }
+    return { status: response.status, body, retryAfter: response.headers.get("retry-after"), fingerprint };
+  } catch {
+    return { status: 503, body: { error: "Sales Navigator request failed" }, retryAfter: null, fingerprint };
+  }
+}
+
+async function pump() {
+  if (pumping) return;
+  pumping = true;
+  try {
+    while (true) {
+      const current = await state();
+      if (!current?.connected) return;
+      const relay = `http://127.0.0.1:${current.port}`;
+      let task;
+      try {
+        const response = await fetch(relay + "/next", { cache: "no-store", signal: AbortSignal.timeout(5000) });
+        if (!response.ok) throw new Error("Local relay unavailable");
+        task = await response.json();
+      } catch {
+        await stop("Local CLI relay disconnected. Restart the research command, then connect again.");
+        return;
+      }
+      if (task.status === "task") {
+        if (!allowedResearchUrl(task.url) || typeof task.requestId !== "string") {
+          await stop("The local relay requested a URL outside the Sales Navigator allowlist.");
+          return;
+        }
+        let result;
+        try {
+          const injected = await chrome.scripting.executeScript({
+            target: { tabId: current.tabId }, func: requestInTab, args: [task.url]
+          });
+          result = injected[0]?.result;
+          if (!result || typeof result.status !== "number") throw new Error("No result from tab");
+        } catch {
+          result = { status: 401, body: { error: "Sales Navigator tab was closed or navigated away" }, retryAfter: null };
+        }
+        if (current.fingerprint && result.fingerprint && current.fingerprint !== result.fingerprint) {
+          result = { status: 401, body: { error: "Sales Navigator session changed during research" }, retryAfter: null };
+        } else if (!current.fingerprint && result.fingerprint) {
+          await setState({ ...current, fingerprint: result.fingerprint });
+        }
+        delete result.fingerprint;
+        try {
+          const accepted = await fetch(relay + "/result", {
+            method: "POST", headers: { "content-type": "application/json" },
+            body: JSON.stringify({ requestId: task.requestId, ...result }),
+            signal: AbortSignal.timeout(5000)
+          });
+          if (!accepted.ok) throw new Error("Local relay rejected result");
+        } catch {
+          await stop("Local CLI relay disconnected before accepting a result.");
+          return;
+        }
+        if ([401, 403, 429, 999].includes(result.status)) {
+          await stop(`Sales Navigator returned HTTP ${result.status}. Research stopped.`);
+          return;
+        }
+      }
+      await new Promise(resolve => setTimeout(resolve, 1000));
+    }
+  } finally { pumping = false; }
+}
+
+chrome.runtime.onMessage.addListener((message, _sender, respond) => {
+  (async () => {
+    if (message.action === "status") {
+      const current = await state();
+      return current || { connected: false, message: "Open a signed-in Sales Navigator tab to connect." };
+    }
+    if (message.action === "disconnect") {
+      await stop("Disconnected.");
+      return { connected: false, message: "Disconnected." };
+    }
+    if (message.action === "connect") {
+      const port = Number(message.port);
+      if (!Number.isInteger(port) || port < 1 || port > 65535 || !Number.isInteger(message.tabId)) {
+        return { connected: false, message: "Invalid tab or CLI port." };
+      }
+      const tab = await chrome.tabs.get(message.tabId);
+      if (!tab.url?.startsWith("https://www.linkedin.com/sales/")) {
+        return { connected: false, message: "Open Sales Navigator in this tab first." };
+      }
+      const response = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(5000) });
+      if (!response.ok) return { connected: false, message: "Start the CLI research command first." };
+      await setState({ connected: true, tabId: message.tabId, port, message: `Connected to local CLI port ${port}. Keep this tab open.` });
+      await chrome.alarms.create(ALARM, { periodInMinutes: 0.5 });
+      void pump();
+      return { connected: true, port, message: `Connected to local CLI port ${port}. Keep this tab open.` };
+    }
+    return { connected: false, message: "Unknown action." };
+  })().then(respond, error => respond({ connected: false, message: error.message || "Connection failed." }));
+  return true;
+});
+
+chrome.alarms.onAlarm.addListener(alarm => { if (alarm.name === ALARM) void pump(); });

package/browser-extension/manifest.json

@@ -0,0 +1,11 @@
+{
+  "manifest_version": 3,
+  "name": "IndieCRM Research",
+  "version": "0.1.0",
+  "description": "Use your active Sales Navigator tab for local IndieCRM research without copying browser credentials.",
+  "minimum_chrome_version": "120",
+  "permissions": ["activeTab", "scripting", "storage", "alarms"],
+  "host_permissions": ["http://127.0.0.1/*"],
+  "background": { "service_worker": "background.js" },
+  "action": { "default_title": "IndieCRM Research", "default_popup": "popup.html" }
+}

package/browser-extension/popup.html

@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+<meta charset="utf-8">
+<title>IndieCRM Research</title>
+<style>
+  body { width: 290px; margin: 16px; font: 14px system-ui, sans-serif; color: #14272d; }
+  h1 { font-size: 17px; margin: 0 0 8px; }
+  p { line-height: 1.4; }
+  label { display: block; margin: 16px 0 4px; }
+  input { box-sizing: border-box; width: 100%; padding: 8px; font: inherit; }
+  button { padding: 8px 12px; margin: 12px 8px 0 0; cursor: pointer; }
+  #status { min-height: 2.8em; color: #345; }
+</style>
+<h1>IndieCRM Research</h1>
+<p>Use this signed-in Sales Navigator tab for your local research run.</p>
+<label for="port">CLI relay port</label>
+<input id="port" type="number" min="1" max="65535" value="43117">
+<button id="connect">Connect</button><button id="disconnect">Disconnect</button>
+<p id="status" role="status"></p>
+<script src="popup.js"></script>
+</html>

package/browser-extension/popup.js

@@ -0,0 +1,30 @@
+const portField = document.getElementById("port");
+const statusField = document.getElementById("status");
+
+async function refresh() {
+  const state = await chrome.runtime.sendMessage({ action: "status" });
+  if (state.port) portField.value = String(state.port);
+  statusField.textContent = state.message || "Open a signed-in Sales Navigator tab to connect.";
+}
+
+document.getElementById("connect").addEventListener("click", async () => {
+  const port = Number(portField.value);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    statusField.textContent = "Enter the port shown by the CLI (1–65535).";
+    return;
+  }
+  const [tab] = await chrome.tabs.query({ active: true, currentWindow: true });
+  if (!tab?.id || !tab.url?.startsWith("https://www.linkedin.com/sales/")) {
+    statusField.textContent = "Open a signed-in Sales Navigator tab first.";
+    return;
+  }
+  const state = await chrome.runtime.sendMessage({ action: "connect", tabId: tab.id, port });
+  statusField.textContent = state.message;
+});
+
+document.getElementById("disconnect").addEventListener("click", async () => {
+  const state = await chrome.runtime.sendMessage({ action: "disconnect" });
+  statusField.textContent = state.message;
+});
+
+void refresh();

package/dist/cli.js

@@ -9,6 +9,7 @@ import path from "node:path";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
 import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
 import { gzipSync } from "node:zlib";
 import { createClient } from "@supabase/supabase-js";
 import pg from "pg";
@@ -796,6 +797,7 @@ const helpVisibleCommandNames = new Set([
     "wizard",
     "auth:whoami",
     "browser:connect",
+    "browser:extension",
     "llm:ready",
     "leads:download",
     "leads:at-companies",
@@ -15152,12 +15154,24 @@ program
     .action(async (options) => {
     printOutput(await runSalesNavigatorPeopleCollectCommand(options));
 });
+program
+    .command("browser:extension")
+    .description("Show the bundled Chrome companion for an already signed-in Sales Navigator tab.")
+    .action(() => {
+    const directory = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "browser-extension");
+    if (runtimeOutputOptions.json)
+        printOutput({ status: "ok", directory });
+    else
+        process.stdout.write(`Open chrome://extensions in your signed-in Chrome profile, enable Developer mode, choose Load unpacked, and select:\n${directory}\nThen open Sales Navigator, click the IndieCRM Research extension, and connect it to the port printed by your research command.\n`);
+});
 program
     .command("browser:connect")
     .description("Sign in once to the CLI-owned research Chrome; no external browser worker required.")
     .option("--wait <seconds>", "Time allowed for manual LinkedIn sign-in", "600")
     .option("--check", "Check the saved sign-in in background without opening a sign-in window", false)
     .action(async (options) => {
+    if (!options.check)
+        process.stderr.write("This opens an isolated Chrome profile. Already signed in to Sales Navigator in everyday Chrome? Use indiecrm browser:extension with --browser-relay-port instead.\n");
     const browser = createChromeResearchBrowser({ visible: !options.check, loginWaitMs: options.check ? 5000 : z.coerce.number().int().min(1).max(3600).parse(options.wait) * 1000, onProgress: message => process.stderr.write(`${message}\n`) });
     try {
         const connection = await browser.connect();
@@ -15186,7 +15200,7 @@ program
     .option("--continue-partial <mode>", "Resume saved partial pages: quota or exhaustive (2500-result window)")
     .option("--company <name>", "Limit recovery to an exact brief company name; repeat for multiple companies", (value, previous) => [...previous, value], [])
     .option("--wait-for-session <seconds>", "Wait for a refreshed extension session after an auth failure; never retry rate limits", "0")
-    .option("--browser-relay-port <number>", "Use the signed-in Codex browser through a loopback relay")
+    .option("--browser-relay-port <number>", "Use an already signed-in Sales Navigator tab through a loopback relay")
     .option("--browser <mode>", "Override saved connection: chrome or session; browser:connect remembers chrome")
     .option("--dry-run", "Preview targeting and unresolved companies without network calls", false)
     .action(async (options) => {
@@ -15242,6 +15256,8 @@ program
     }
     const port = options.browserRelayPort == null ? null : z.coerce.number().int().min(1).max(65535).parse(options.browserRelayPort);
     const relay = browserMode === "chrome" ? createChromeResearchBrowser({ onProgress: message => process.stderr.write(`${message}\n`) }) : port == null ? null : await createLocalAccountSearchBrowserRelay(port);
+    if (port !== null)
+        writeProgress(`In the signed-in Sales Navigator tab, click the IndieCRM Research extension and connect port ${port}. Run indiecrm browser:extension for installation instructions.`);
     let currentConfig = null;
     const refresh = async () => {
         if (relay || shouldDisableLinkedInDirectLookupAutodiscovery())
@@ -15261,7 +15277,7 @@ program
         }
         catch (error) {
             if (!waitMs && error instanceof Error && error.message.startsWith("Missing LinkedIn direct lookup session"))
-                throw new Error("No LinkedIn session is available. Run indiecrm browser:connect, then rerun this command with --browser chrome and the same --out-dir. No external browser worker is needed.");
+                throw new Error("No LinkedIn session is available. If Sales Navigator is already signed in in Chrome, run indiecrm browser:extension and use --browser-relay-port 43117. Otherwise run indiecrm browser:connect and retry with --browser chrome. Saved work is preserved.");
             if (!waitMs || !(error instanceof Error) || !error.message.startsWith("Missing LinkedIn direct lookup session"))
                 throw error;
             currentConfig = await refresh();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indiecrm-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "IndieCRM CLI for CRM workspaces and Salesprompter research workflows",
   "author": "Daniel Sinewe <hello@danielsinewe.com>",
   "type": "module",
@@ -9,6 +9,7 @@
   },
   "files": [
     "dist",
+    "browser-extension",
     "README.md",
     "RESEARCH.md",
     "CHANGELOG.md",