qiksy 1.0.0

package/tools/client-finder/vendor/lib/agent.mjs

@@ -0,0 +1,204 @@
+/**
+ * Headless Claude runner for Client Finder — spawns `claude -p` with stream-json
+ * output, forwards tool events to the caller's log, and returns the final text.
+ *
+ * Lifted from products/work-finder-backend/lib/agent.mjs (same mechanism, same
+ * traps) with one deliberate difference: **no browser**. Stage 0 finds and proves
+ * prospects from public search and company sites, which WebSearch + WebFetch cover
+ * on their own. Adding Playwright would mean logged-in sessions and the ToS
+ * questions that come with them, for research that does not need either.
+ */
+import { spawnClaude } from './spawn-claude.mjs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+// Kill live children when the process ends, so an orphaned `claude` can't keep
+// burning tokens after we're gone.
+const activeChildren = new Set();
+function killAllChildren() {
+  for (const child of activeChildren) {
+    try {
+      child.kill('SIGKILL');
+    } catch {
+      /* already dead */
+    }
+  }
+  activeChildren.clear();
+}
+for (const sig of ['SIGINT', 'SIGTERM']) {
+  process.on(sig, () => {
+    killAllChildren();
+    process.exit(0);
+  });
+}
+process.on('exit', killAllChildren);
+
+const APPROVER_SERVER = {
+  type: 'stdio',
+  command: process.execPath,
+  args: [resolve(ROOT, 'lib/approver-mcp.mjs')],
+};
+
+/**
+ * @param {object} o
+ * @param {string} o.prompt
+ * @param {string[]} [o.allowedTools]  built-in tools the agent may use
+ * @param {string} [o.model]           'sonnet' | 'opus' | …
+ * @param {number} [o.timeoutMs]
+ * @param {(line: string) => void} [o.onEvent]    tool-call log
+ * @param {(obj: unknown) => void} [o.onPartial]  each `PROSPECT: {…}` line, as it lands
+ * @param {AbortSignal|null} [o.signal]
+ */
+export function runClaude({
+  prompt,
+  allowedTools = ['WebSearch', 'WebFetch'],
+  model = 'sonnet',
+  timeoutMs = 20 * 60_000,
+  onEvent = () => {},
+  onPartial = null,
+  signal = null,
+  apiKey = '',
+}) {
+  return new Promise((resolvePromise) => {
+    // The user's global settings put WebSearch/WebFetch in the "ask" list, which
+    // auto-DENIES in -p mode and overrides --allowedTools (and even
+    // --dangerously-skip-permissions). So permissions go through our own approver
+    // MCP server via --permission-prompt-tool, with a whitelist.
+    const args = [
+      '-p', prompt,
+      '--output-format', 'stream-json', '--verbose',
+      '--model', model,
+      '--tools', [...allowedTools, 'ToolSearch'].join(','),
+      '--mcp-config', JSON.stringify({ mcpServers: { approver: APPROVER_SERVER } }),
+      '--strict-mcp-config',
+      '--permission-prompt-tool', 'mcp__approver__approve',
+      '--allowedTools', [...allowedTools, 'ToolSearch'].join(','),
+    ];
+
+    // A nested interactive session is refused; `-p` is fine, but strip the markers
+    // so the child never thinks it is running inside another session.
+    const env = { ...process.env };
+    delete env.CLAUDECODE;
+    delete env.CLAUDE_CODE_ENTRYPOINT;
+    // The seller's own key, handed to the child process and nowhere else: not
+    // stored, not logged, not written to any report. Absent, `claude` falls back
+    // to whatever this machine is already logged in with.
+    if (apiKey) env.ANTHROPIC_API_KEY = apiKey;
+
+    const child = spawnClaude(args, { cwd: ROOT, env, stdio: ['ignore', 'pipe', 'pipe'] });
+    activeChildren.add(child);
+    child.on('close', () => activeChildren.delete(child));
+
+    let resultText = '';
+    let errText = '';
+    let costUsd = null;
+    let settled = false;
+    let partialBuf = '';
+    let partialsEmitted = 0;
+    const t0 = Date.now();
+
+    const finish = (out) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolvePromise({ durationMs: Date.now() - t0, costUsd, ...out });
+    };
+
+    const timer = setTimeout(() => {
+      try {
+        child.kill('SIGKILL');
+      } catch {
+        /* already dead */
+      }
+      finish({ ok: false, error: `timeout after ${Math.round(timeoutMs / 1000)}s` });
+    }, timeoutMs);
+
+    if (signal) {
+      const onAbort = () => {
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          /* already dead */
+        }
+        finish({ ok: false, error: 'cancelled' });
+      };
+      if (signal.aborted) onAbort();
+      else signal.addEventListener('abort', onAbort, { once: true });
+    }
+
+    let buf = '';
+    child.stdout.on('data', (chunk) => {
+      buf += chunk;
+      let nl;
+      while ((nl = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, nl).trim();
+        buf = buf.slice(nl + 1);
+        if (!line) continue;
+        let ev;
+        try {
+          ev = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (ev.type === 'assistant') {
+          for (const block of ev.message?.content || []) {
+            if (block.type === 'tool_use') {
+              const input = JSON.stringify(block.input || {});
+              onEvent(`⚙ ${block.name} ${input.length > 140 ? input.slice(0, 140) + '…' : input}`);
+            } else if (block.type === 'text' && block.text && onPartial) {
+              // Prospects stream as they are found, so a long run shows progress
+              // instead of twenty silent minutes.
+              partialBuf += block.text + '\n';
+              const matches = [...partialBuf.matchAll(/^PROSPECT:\s*(\{.*\})\s*$/gm)];
+              for (let i = partialsEmitted; i < matches.length; i++) {
+                try {
+                  onPartial(JSON.parse(matches[i][1]));
+                } catch {
+                  /* malformed partial — it will still arrive in the final array */
+                }
+              }
+              partialsEmitted = Math.max(partialsEmitted, matches.length);
+            }
+          }
+        } else if (ev.type === 'result') {
+          resultText = ev.result || '';
+          costUsd = ev.total_cost_usd ?? null;
+          if (ev.is_error) errText = resultText || ev.subtype || 'agent error';
+        }
+      }
+    });
+    child.stderr.on('data', (chunk) => {
+      errText += chunk;
+    });
+
+    child.on('error', (err) => finish({ ok: false, error: `spawn failed: ${err.message}` }));
+    child.on('close', (code) => {
+      if (code === 0 && resultText) finish({ ok: true, result: resultText });
+      else finish({ ok: false, error: (errText || `claude exited with code ${code}`).slice(0, 2000) });
+    });
+  });
+}
+
+/** Pull a JSON value out of agent prose: direct parse → fenced block → bracket slice. */
+export function extractJson(text) {
+  if (!text) return null;
+  const attempts = [text.trim()];
+  const fence = text.match(/```(?:json)?\s*([\s\S]*?)```/);
+  if (fence) attempts.push(fence[1].trim());
+  const firstArr = text.indexOf('[');
+  const lastArr = text.lastIndexOf(']');
+  if (firstArr >= 0 && lastArr > firstArr) attempts.push(text.slice(firstArr, lastArr + 1));
+  const firstObj = text.indexOf('{');
+  const lastObj = text.lastIndexOf('}');
+  if (firstObj >= 0 && lastObj > firstObj) attempts.push(text.slice(firstObj, lastObj + 1));
+  for (const candidate of attempts) {
+    try {
+      return JSON.parse(candidate);
+    } catch {
+      /* next */
+    }
+  }
+  return null;
+}

package/tools/client-finder/vendor/lib/approver-mcp.mjs

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * Minimal MCP stdio server: the permission-prompt handler for headless agents.
+ *
+ * The user's global ~/.claude/settings.json puts WebSearch/WebFetch in the "ask"
+ * list, and in `-p` mode "ask" resolves to "deny" — overriding --allowedTools.
+ * This server is passed as `--permission-prompt-tool mcp__approver__approve` and
+ * auto-approves ONLY the tools below. Everything else stays denied, which is what
+ * keeps a research agent from reaching for Bash or the filesystem.
+ */
+const ALLOW = [/^WebSearch$/, /^WebFetch$/, /^ToolSearch$/];
+
+const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
+
+function handle(msg) {
+  const { id, method, params } = msg;
+  if (method === 'initialize') {
+    return send({
+      jsonrpc: '2.0',
+      id,
+      result: {
+        protocolVersion: params?.protocolVersion || '2024-11-05',
+        capabilities: { tools: {} },
+        serverInfo: { name: 'approver', version: '1.0.0' },
+      },
+    });
+  }
+  if (method === 'tools/list') {
+    return send({
+      jsonrpc: '2.0',
+      id,
+      result: {
+        tools: [
+          {
+            name: 'approve',
+            description: 'Auto-approve permission prompts for whitelisted tools',
+            inputSchema: {
+              type: 'object',
+              properties: {
+                tool_name: { type: 'string' },
+                input: { type: 'object' },
+                tool_use_id: { type: 'string' },
+              },
+              required: ['tool_name', 'input'],
+            },
+          },
+        ],
+      },
+    });
+  }
+  if (method === 'tools/call') {
+    const { name, arguments: args = {} } = params || {};
+    if (name !== 'approve') return send({ jsonrpc: '2.0', id, error: { code: -32601, message: 'unknown tool' } });
+    const ok = ALLOW.some((re) => re.test(args.tool_name || ''));
+    const payload = ok
+      ? { behavior: 'allow', updatedInput: args.input || {} }
+      : { behavior: 'deny', message: `tool ${args.tool_name} is not whitelisted for client-finder agents` };
+    return send({ jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(payload) }] } });
+  }
+  if (id !== undefined) send({ jsonrpc: '2.0', id, result: {} });
+}
+
+let buf = '';
+process.stdin.setEncoding('utf8');
+process.stdin.on('data', (chunk) => {
+  buf += chunk;
+  let nl;
+  while ((nl = buf.indexOf('\n')) >= 0) {
+    const line = buf.slice(0, nl).trim();
+    buf = buf.slice(nl + 1);
+    if (!line) continue;
+    try {
+      handle(JSON.parse(line));
+    } catch {
+      /* ignore malformed line */
+    }
+  }
+});

package/tools/client-finder/vendor/lib/browser.mjs

@@ -0,0 +1,108 @@
+/**
+ * "Выход в браузер" — the switch that turns copy-paste into one click.
+ *
+ * OFF (default): drafts land in the panel, you copy and paste them yourself.
+ * ON: we launch (or attach to) a Chrome you are logged into, and each draft can be
+ * opened straight in the right place — a Telegram chat, a Gmail compose window
+ * with subject and body already filled, a LinkedIn profile with the text on your
+ * clipboard. The last action, pressing send, stays yours.
+ *
+ * That last sentence is the product, not a limitation. Tools that pressed send for
+ * the user are the ones whose customers lost their accounts in the 2026 platform
+ * bans — and a browser we drive is YOUR session: it carries your cookies, your
+ * name and your reputation.
+ *
+ * Adapted from products/work-finder-backend/scripts/launch-browser.mjs, which
+ * already solved the awkward parts: probe before launching (never fight a Chrome
+ * that is already serving CDP), keep a persistent profile so logins survive, and
+ * fail with a sentence rather than a stack trace when Chrome isn't where we
+ * guessed.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const PORT = Number(process.env.CF_CDP_PORT) || 9223; // not 9222: leave the WF/QA browser alone
+const PROFILE_DIR = resolve(ROOT, '.cdp-browser-profile');
+
+const CHROME_CANDIDATES = {
+  darwin: [
+    '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+    '/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary',
+    '/Applications/Chromium.app/Contents/MacOS/Chromium',
+  ],
+  linux: ['/usr/bin/google-chrome', '/usr/bin/google-chrome-stable', '/usr/bin/chromium'],
+  win32: [
+    process.env.LOCALAPPDATA ? `${process.env.LOCALAPPDATA}\\Google\\Chrome\\Application\\chrome.exe` : null,
+    'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+  ].filter(Boolean),
+};
+
+async function probe() {
+  try {
+    const res = await fetch(`http://127.0.0.1:${PORT}/json/version`, { signal: AbortSignal.timeout(1200) });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+export async function status() {
+  const v = await probe();
+  return v ? { connected: true, port: PORT, browser: v.Browser || 'Chrome' } : { connected: false, port: PORT };
+}
+
+/** Launch or attach. Returns the same shape as `status`, plus a reason on failure. */
+export async function connect() {
+  const already = await probe();
+  if (already) return { connected: true, port: PORT, browser: already.Browser, reused: true };
+
+  const chromePath =
+    process.env.CHROME_PATH || (CHROME_CANDIDATES[process.platform] || []).find((p) => existsSync(p));
+  if (!chromePath) {
+    return { connected: false, port: PORT, error: 'Chrome не найден — укажите путь в переменной CHROME_PATH.' };
+  }
+
+  const child = spawn(
+    chromePath,
+    [
+      `--remote-debugging-port=${PORT}`,
+      // Its own profile dir: the first time you will log into Telegram/LinkedIn
+      // here once, and those logins persist across runs. Deliberately NOT your
+      // everyday Chrome profile — Chrome refuses a second instance on a profile
+      // that is already open, and we are not touching your main session.
+      `--user-data-dir=${PROFILE_DIR}`,
+      '--no-first-run',
+      '--no-default-browser-check',
+    ],
+    { detached: true, stdio: 'ignore' },
+  );
+  child.unref();
+
+  const t0 = Date.now();
+  while (Date.now() - t0 < 15000) {
+    const v = await probe();
+    if (v) return { connected: true, port: PORT, browser: v.Browser, launched: true };
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  return { connected: false, port: PORT, error: 'Chrome не отозвался на порту за 15 секунд.' };
+}
+
+/** Open a URL in the connected browser, in a new tab, and bring it to the front. */
+export async function openTab(url) {
+  const v = await probe();
+  if (!v) return { ok: false, error: 'Браузер не подключён' };
+  try {
+    const res = await fetch(`http://127.0.0.1:${PORT}/json/new?${encodeURIComponent(url)}`, {
+      method: 'PUT', // Chrome ≥ 111 requires PUT here; GET returns 405
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!res.ok) return { ok: false, error: `CDP ответил ${res.status}` };
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}

package/tools/client-finder/vendor/lib/catalog.mjs

@@ -0,0 +1,86 @@
+/**
+ * What we sell, described the way a SELLER needs it — a pitch, a price, a buyer.
+ *
+ * Deliberately not parsed out of apps/products/src/app/config.ts: that file holds
+ * the storefront's ids, icons and i18n dict keys, and the sales pitch itself lives
+ * in the translation files as UI copy. An agent needs one paragraph that says what
+ * this is and who wants it, which is a different artefact. Kept short and in one
+ * place so it stays true; when a price or a positioning changes, it changes here.
+ */
+export const PRODUCTS = [
+  {
+    id: 'assist',
+    name: 'Qiksy Assist',
+    url: 'https://qiksy.app/assist/',
+    price: 'Free · Start $8/мес ($96/год) · Pro $15/мес ($180/год) · Founding $49/год',
+    pitch:
+      'Чат для сайта, который живёт в Telegram владельца: посетитель пишет в виджет — владелец отвечает свайпом из своей Телеги. Клиенту Telegram не нужен. Одна строка кода на любой сайт (Тильда, WordPress, самопис).',
+    buyer:
+      'Небольшой бизнес с сайтом, который продаёт через переписку: магазин, услуги, студия. Владелец сам отвечает клиентам и живёт в мессенджерах.',
+    hook: 'На сайте нет чата — посетителю некуда написать, кроме формы или телефона.',
+  },
+  {
+    id: 'qa-copilot',
+    name: 'Qiksy QA Copilot',
+    url: 'https://qiksy.app/qa-copilot/',
+    price: '$20 разово = Pro на год',
+    pitch:
+      'Расширение Chrome для ручного QA: умное заполнение форм, живой аудит страницы, готовые к вставке находки. Экономит часы на регрессе и оформлении багов.',
+    buyer: 'QA-инженеры, тест-лиды и небольшие продуктовые команды без автотестов.',
+    hook: 'Ручной регресс и оформление багов руками — там, где это всё ещё делают вручную.',
+  },
+  {
+    id: 'work-finder',
+    name: 'Qiksy Work Finder',
+    url: 'https://qiksy.app/work-finder/',
+    price: 'Free (1 профиль) · Pro $9/мес, без ограничения по людям',
+    pitch:
+      'Агенты Claude сканируют рынок вакансий, подбирают их под профиль и готовят персональные отклики. Работает локально, на своём ключе Anthropic.',
+    buyer: 'Специалисты в IT, которые ищут работу: разработка, QA, PM, дизайн, DevOps.',
+    hook: 'Ищет работу и тратит вечера на отклики.',
+  },
+  {
+    id: 'travel',
+    name: 'Qiksy Travel Assistant',
+    url: 'https://qiksy.app/travel/',
+    price: 'Free (до 3 путешественников) · Pro $9/мес, без ограничения по людям',
+    pitch:
+      'Авиабилеты, отели и трансферы для командировок: агент собирает варианты и готовит маршрут. Локально, на своём ключе.',
+    buyer: 'Компании и агентства, которые часто отправляют людей в командировки.',
+    hook: 'Командировки собираются руками в двадцати вкладках.',
+  },
+  {
+    id: 'multilogin',
+    name: 'MultiLogin Tabs',
+    url: 'https://qiksy.app/multilogin/',
+    price: 'Бесплатно',
+    pitch:
+      'Расширение Chrome: изоляция сессий по вкладкам — несколько аккаунтов одного сервиса открыты одновременно, без окон инкогнито и без выхода из аккаунта.',
+    buyer: 'Все, кто ведёт несколько аккаунтов: SMM, арбитраж, агентства, поддержка.',
+    hook: 'Постоянно перелогинивается между аккаунтами.',
+  },
+  {
+    id: 'pay',
+    name: 'Qiksy Pay',
+    url: 'https://qiksy.app/pay/',
+    price: 'Ранний доступ',
+    pitch: 'Подписки и платежи под ключ поверх собственного эквайринга — биллинг, который не надо писать.',
+    buyer: 'Сервисы с регулярными платежами, которым нужен биллинг, а не банк.',
+    hook: 'Собирает подписки руками или пишет биллинг сам.',
+  },
+  {
+    id: 'custom',
+    name: 'Qiksy Build / Ops',
+    url: 'https://qiksy.app/business/',
+    price: 'от проекта',
+    pitch:
+      'Студия делает продукты и автоматизирует то, как бизнес уже работает: от лендинга и интеграций до собственного инструмента.',
+    buyer: 'Бизнес, которому нужно построить или автоматизировать, а своей команды разработки нет.',
+    hook: 'Процесс держится на людях и таблицах.',
+  },
+];
+
+/** Knowledge file per product — read on demand, see lib/knowledge.mjs. */
+export const knowledgeFile = (id) => `${id}.md`;
+
+export const byId = (id) => PRODUCTS.find((p) => p.id === id) || null;

package/tools/client-finder/vendor/lib/channels.mjs

@@ -0,0 +1,54 @@
+/**
+ * Where to look for buyers — and what each place costs you in risk.
+ *
+ * `browser: true` means the channel is only reachable from a logged-in session, so
+ * the run drives YOUR Chrome over CDP instead of the public web. That is also
+ * where every platform's ToS starts to matter, which is why each channel carries
+ * its own `caution` shown in the panel: the person choosing it should see the
+ * trade-off at the moment of choosing, not in a footnote.
+ *
+ * The rule that does not bend, on any channel: the agent finds, proves and drafts.
+ * A message is sent by a human, from their own session, at human pace. Tools that
+ * automated the sending are the ones whose users lost their accounts in the 2026
+ * bans (see docs/CLIENT-FINDER-BUSINESS.md).
+ */
+export const CHANNELS = [
+  {
+    id: 'web',
+    label: 'Открытый веб',
+    hint: 'Поиск, сайты компаний, каталоги и подборки',
+    browser: false,
+    ready: true,
+    caution: null,
+  },
+  {
+    id: 'linkedin',
+    label: 'LinkedIn',
+    hint: 'Компании и люди в вашей залогиненной сессии',
+    browser: true,
+    ready: true,
+    caution:
+      'LinkedIn запрещает автоматизацию в ToS. Агент только читает и готовит — отправляете вы сами, из своей сессии. Дневной потолок касаний держите в пределах 80–100.',
+  },
+  {
+    id: 'instagram',
+    label: 'Instagram',
+    hint: 'Профили бизнесов и их контакты',
+    browser: true,
+    ready: false,
+    caution: 'Канал ещё не обкатан — включится после LinkedIn.',
+  },
+  {
+    id: 'tiktok',
+    label: 'TikTok',
+    hint: 'Бизнес-аккаунты и их ссылки',
+    browser: true,
+    ready: false,
+    caution: 'Канал ещё не обкатан — включится после LinkedIn.',
+  },
+];
+
+export const channelById = (id) => CHANNELS.find((c) => c.id === id) || null;
+
+/** True when any picked channel needs the logged-in browser. */
+export const needsBrowser = (ids = []) => ids.some((id) => channelById(id)?.browser);

package/tools/client-finder/vendor/lib/deliver.mjs

@@ -0,0 +1,89 @@
+/**
+ * Turning a draft into an open window.
+ *
+ * Some platforms let a URL carry the text (Gmail's compose, wa.me, mailto) — there
+ * the message arrives already typed and the human only reads it and presses send.
+ * Others (Telegram Web, LinkedIn, Instagram) accept no text in the URL, so the best
+ * honest move is: open the exact right place and put the text on the clipboard, so
+ * it is one paste rather than a hunt.
+ *
+ * Nothing here sends. Every path ends with a composed message and a human deciding.
+ */
+
+/** Best-effort contact extraction — the agent stored whatever the site published. */
+function contactValue(draft) {
+  return String(draft?.contact?.value || '').trim();
+}
+
+const isEmail = (v) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v);
+const asTgHandle = (v) => {
+  const m = String(v).match(/(?:t\.me\/|@)([A-Za-z0-9_]{4,32})/);
+  return m ? m[1] : null;
+};
+const asPhone = (v) => {
+  const digits = String(v).replace(/[^\d+]/g, '');
+  return /^\+?\d{9,15}$/.test(digits) ? digits.replace(/^\+/, '') : null;
+};
+
+/**
+ * @returns {{ url: string, prefilled: boolean, note: string }}
+ *   `prefilled` says whether the text travels in the URL; when false the panel
+ *   copies it to the clipboard instead and says so.
+ */
+export function deliveryFor(formatId, draft) {
+  const to = contactValue(draft);
+  const subject = draft.subject || '';
+  const body = draft.body || '';
+  const site = draft.url || '';
+
+  if (formatId === 'email') {
+    if (isEmail(to)) {
+      // Gmail's compose URL carries both fields; it opens in the account already
+      // logged into this browser.
+      const url =
+        'https://mail.google.com/mail/?view=cm&fs=1' +
+        `&to=${encodeURIComponent(to)}&su=${encodeURIComponent(subject)}&body=${encodeURIComponent(body)}`;
+      return { url, prefilled: true, note: 'Gmail откроется с готовым письмом — проверьте и отправьте.' };
+    }
+    return { url: site, prefilled: false, note: 'Почты нет — открываю сайт, текст в буфере.' };
+  }
+
+  if (formatId === 'telegram') {
+    const handle = asTgHandle(to);
+    if (handle) {
+      return {
+        url: `https://web.telegram.org/k/#@${handle}`,
+        prefilled: false,
+        note: 'Telegram Web не принимает текст в ссылке — он в буфере, вставьте и отправьте.',
+      };
+    }
+    const phone = asPhone(to);
+    if (phone) {
+      return {
+        url: `https://web.telegram.org/k/#+${phone}`,
+        prefilled: false,
+        note: 'Открываю чат по номеру — текст в буфере.',
+      };
+    }
+    return { url: site, prefilled: false, note: 'Telegram не указан — открываю сайт, текст в буфере.' };
+  }
+
+  if (formatId === 'contact-form') {
+    return { url: site, prefilled: false, note: 'Открываю их форму — текст в буфере, вставьте в поле сообщения.' };
+  }
+
+  // LinkedIn and Instagram: no text in the URL by design, and we are not going to
+  // type into their DOM on the user's behalf — that is the line between a tool and
+  // the kind of automation that gets accounts restricted.
+  if (formatId.startsWith('linkedin')) {
+    const profile = /linkedin\.com/i.test(to) ? to : `https://www.linkedin.com/search/results/all/?keywords=${encodeURIComponent(draft.company)}`;
+    return { url: profile, prefilled: false, note: 'Текст в буфере — вставьте в заявку или сообщение и отправьте сами.' };
+  }
+
+  if (formatId === 'instagram-dm') {
+    const profile = /instagram\.com/i.test(to) ? to : `https://www.instagram.com/explore/search/keyword/?q=${encodeURIComponent(draft.company)}`;
+    return { url: profile, prefilled: false, note: 'Текст в буфере — вставьте в директ и отправьте сами.' };
+  }
+
+  return { url: site, prefilled: false, note: 'Текст в буфере.' };
+}