Cue-d · theotarr · Jul 21, 2026
diff --git a/src/platforms/core/auth/chromium-worker.ts b/src/platforms/core/auth/chromium-worker.ts
@@ -1,7 +1,12 @@
 import { execFileSync } from "node:child_process";
 import { mkdirSync } from "node:fs";
-import { type BrowserContext, type Cookie, chromium, type Page, type Request } from "playwright";
+import { type BrowserContext, type Cookie, chromium, type Page } from "playwright";
 import { cuedAuthKeychainService } from "../../../core/identity.js";
+import {
+  captureLinkedInSessionData,
+  LinkedInRealtimeCaptureError,
+} from "../../linkedin/auth/realtime-capture.js";
+import { buildLinkedInRealtimeAuthResult } from "../../linkedin/auth/session-store.js";
 import {
   type ChromiumAuthFailureCode,
   classifyChromiumAuthWaitFailure,
@@ -240,73 +245,6 @@ async function fetchDiscordCurrentUser(token: string): Promise<{
   };
 }
 
-type LinkedInCapture = {
-  pageInstance: string | null;
-  xLiTrack: string | null;
-  serviceVersion: string | null;
-  realtimeQueryMap: string | null;
-  realtimeRecipeMap: string | null;
-};
-
-function captureLinkedInHeaders(capture: LinkedInCapture, request: Request): void {
-  if (!request.url().includes("linkedin.com")) {
-    return;
-  }
-
-  const headers = request.headers();
-  if (!capture.pageInstance && typeof headers["x-li-page-instance"] === "string") {
-    capture.pageInstance = headers["x-li-page-instance"];
-  }
-  if (!capture.xLiTrack && typeof headers["x-li-track"] === "string") {
-    capture.xLiTrack = headers["x-li-track"];
-    try {
-      const parsed = JSON.parse(headers["x-li-track"]) as Record<string, unknown>;
-      if (typeof parsed.mpVersion === "string") {
-        capture.serviceVersion = parsed.mpVersion;
-      } else if (typeof parsed.clientVersion === "string") {
-        capture.serviceVersion = parsed.clientVersion;
-      }
-    } catch {
-      capture.serviceVersion = null;
-    }
-  }
-  if (request.url().includes("/realtime/connect")) {
-    if (!capture.realtimeQueryMap && typeof headers["x-li-query-map"] === "string") {
-      capture.realtimeQueryMap = headers["x-li-query-map"];
-    }
-    if (!capture.realtimeRecipeMap && typeof headers["x-li-recipe-map"] === "string") {
-      capture.realtimeRecipeMap = headers["x-li-recipe-map"];
-    }
-  }
-}
-
-async function captureLinkedInSessionData(
-  context: BrowserContext,
-  page: Page,
-): Promise<LinkedInCapture> {
-  const capture: LinkedInCapture = {
-    pageInstance: null,
-    xLiTrack: null,
-    serviceVersion: null,
-    realtimeQueryMap: null,
-    realtimeRecipeMap: null,
-  };
-  const onRequest = (request: Request) => {
-    captureLinkedInHeaders(capture, request);
-  };
-  context.on("request", onRequest);
-  try {
-    if (!isLinkedInMessagingUrl(page.url())) {
-      await page.goto("https://www.linkedin.com/messaging/", { waitUntil: "domcontentloaded" });
-    }
-    await page.waitForLoadState("domcontentloaded", { timeout: 5_000 }).catch(() => {});
-    await page.waitForTimeout(500);
-    return capture;
-  } finally {
-    context.off("request", onRequest);
-  }
-}
-
 async function extractSlackAuth(
   context: BrowserContext,
   page: Page,
@@ -394,13 +332,7 @@ async function extractLinkedInAuth(
   }
 
   const userAgent = await page.evaluate(() => navigator.userAgent);
-  const captured = await captureLinkedInSessionData(context, page);
-  const realtimeReady = Boolean(
-    captured.pageInstance &&
-      captured.xLiTrack &&
-      captured.realtimeQueryMap &&
-      captured.realtimeRecipeMap,
-  );
+  const captured = await captureLinkedInSessionData(page);
 
   return {
     keychainService: cuedAuthKeychainService("linkedin"),
@@ -431,12 +363,7 @@ async function extractLinkedInAuth(
       runtime: runtimeKind(),
       cookieCount: cookies.length,
       userAgentCaptured: userAgent.length > 0,
-      realtimeReady,
-      pageInstanceCaptured: Boolean(captured.pageInstance),
-      xLiTrackCaptured: Boolean(captured.xLiTrack),
-      realtimeQueryMapCaptured: Boolean(captured.realtimeQueryMap),
-      realtimeRecipeMapCaptured: Boolean(captured.realtimeRecipeMap),
-      serviceVersion: captured.serviceVersion,
+      ...buildLinkedInRealtimeAuthResult(captured),
     },
   };
 }
@@ -608,6 +535,19 @@ async function run(): Promise<void> {
           return;
         } catch (error) {
           lastExtractionError = error instanceof Error ? error.message : String(error);
+          if (error instanceof LinkedInRealtimeCaptureError) {
+            process.stdout.write(
+              JSON.stringify(
+                buildChromiumFailureResult({
+                  args,
+                  errorCode: "auth_extraction_failed",
+                  stage: "linkedin_realtime_capture",
+                  pageSummary: summarizeOpenPages(args.platform, openPages),
+                }),
+              ),
+            );
+            return;
+          }
         }
       }
 

diff --git a/src/platforms/core/state/integration-state.test.ts b/src/platforms/core/state/integration-state.test.ts
@@ -838,6 +838,10 @@ process.exit(44);
           { name: "li_at", value: "li_at-token" },
           { name: "JSESSIONID", value: '"ajax:123"' },
         ],
+        pageInstance: "urn:li:page:messaging;test",
+        xLiTrack: "{}",
+        realtimeQueryMap: "{}",
+        realtimeRecipeMap: "{}",
         savedAt: 1234,
       },
     });
@@ -857,6 +861,7 @@ process.exit(44);
             keychainService: "so.cued.desktop.auth.linkedin",
             keychainAccount: "default",
             importedSavedAt: 1234,
+            authResult: expect.objectContaining({ realtimeReady: true }),
           }),
         }),
       ]),
@@ -870,13 +875,113 @@ process.exit(44);
     db.close();
   });
 
+  it("marks incomplete stored LinkedIn auth as needing authentication", async () => {
+    installSecurityTool({
+      "so.cued.desktop.auth.linkedin:default": {
+        cookies: [
+          { name: "li_at", value: "li_at-token" },
+          { name: "JSESSIONID", value: '"ajax:123"' },
+        ],
+      },
+    });
+    process.env.CUED_SLACK_APP_BINARY = join(createTempDir("cued-no-slack-app-"), "Slack");
+
+    const db = createDb();
+    db.upsertIntegrationState({
+      platform: "linkedin",
+      accountKey: "default",
+      displayName: "LinkedIn",
+      authState: "authenticated",
+      enabled: true,
+      connectionKind: "browser-session",
+      syncCapable: true,
+      launchStrategy: "chromium-auth",
+      launchTarget: "https://www.linkedin.com/login",
+      importedFrom: "local-cli",
+      metadata: {
+        keychainService: "so.cued.desktop.auth.linkedin",
+        keychainAccount: "default",
+      },
+    });
+
+    await refreshManagedIntegrationStates(db);
+
+    expect(listIntegrationStates(db)).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          platform: "linkedin",
+          authState: "needs_auth",
+          syncCapable: false,
+          metadata: expect.objectContaining({
+            authInvalidationReason: "linkedin_realtime_headers_missing",
+          }),
+        }),
+      ]),
+    );
+    db.close();
+  });
+
+  it("repairs realtime metadata from a complete stored LinkedIn session", async () => {
+    installSecurityTool({
+      "so.cued.desktop.auth.linkedin:default": {
+        cookies: [
+          { name: "li_at", value: "li_at-token" },
+          { name: "JSESSIONID", value: '"ajax:123"' },
+        ],
+        pageInstance: "urn:li:page:messaging;test",
+        xLiTrack: "{}",
+        realtimeQueryMap: "{}",
+        realtimeRecipeMap: "{}",
+      },
+    });
+    process.env.CUED_SLACK_APP_BINARY = join(createTempDir("cued-no-slack-app-"), "Slack");
+
+    const db = createDb();
+    db.upsertIntegrationState({
+      platform: "linkedin",
+      accountKey: "default",
+      displayName: "LinkedIn",
+      authState: "authenticated",
+      enabled: true,
+      connectionKind: "browser-session",
+      syncCapable: true,
+      launchStrategy: "chromium-auth",
+      launchTarget: "https://www.linkedin.com/login",
+      importedFrom: "local-cli",
+      metadata: {
+        keychainService: "so.cued.desktop.auth.linkedin",
+        keychainAccount: "default",
+        authResult: { realtimeReady: false },
+      },
+    });
+
+    await refreshManagedIntegrationStates(db);
+
+    expect(listIntegrationStates(db)).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          platform: "linkedin",
+          authState: "authenticated",
+          metadata: expect.objectContaining({
+            authResult: expect.objectContaining({ realtimeReady: true }),
+          }),
+        }),
+      ]),
+    );
+    db.close();
+  });
+
   it("revives user-removed LinkedIn auth only during explicit connect import", () => {
     installSecurityTool({
       "so.cued.desktop.auth.linkedin:default": {
         cookies: [
           { name: "li_at", value: "li_at-token" },
           { name: "JSESSIONID", value: '"ajax:123"' },
         ],
+        pageInstance: "urn:li:page:messaging;test",
+        xLiTrack: "{}",
+        realtimeQueryMap: "{}",
+        realtimeRecipeMap: "{}",
         savedAt: 1234,
       },
     });

diff --git a/src/platforms/linkedin/auth/keychain-import.test.ts b/src/platforms/linkedin/auth/keychain-import.test.ts
@@ -19,6 +19,8 @@ const storedSession = {
   userAgent: "Cued LinkedIn Test/1.0",
   pageInstance: "urn:li:page:messaging_thread;test",
   xLiTrack: '{"clientVersion":"1.0.0"}',
+  realtimeQueryMap: "{}",
+  realtimeRecipeMap: "{}",
 };
 
 describe("LinkedIn stored auth validation", () => {
@@ -56,6 +58,20 @@ describe("LinkedIn stored auth validation", () => {
     });
   });
 
+  it("rejects sessions that cannot start realtime before probing LinkedIn", async () => {
+    loadKeychainSecretMock.mockReturnValue({
+      ...storedSession,
+      realtimeQueryMap: null,
+    });
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    await expect(validateLinkedInStoredAuth("default")).resolves.toEqual({
+      status: "invalid",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   it("returns indeterminate for transient network failures", async () => {
     loadKeychainSecretMock.mockReturnValue(storedSession);
     vi.stubGlobal(

diff --git a/src/platforms/linkedin/auth/keychain-import.ts b/src/platforms/linkedin/auth/keychain-import.ts
@@ -7,11 +7,16 @@ import {
   loadKeychainSecret,
   storeKeychainSecret,
 } from "../../core/secrets/keychain.js";
-import { completeAuthSession } from "../../core/state/mutations.js";
+import { completeAuthSession, invalidateIntegrationAuth } from "../../core/state/mutations.js";
 import { isUserRemovedIntegrationMetadata } from "../../core/state/status.js";
 import { LinkedInClient } from "../api/client.js";
 import { LinkedInAuthError } from "../api/request.js";
-import { type LinkedInSessionSecret, parseLinkedInSessionSecret } from "./session-store.js";
+import {
+  buildLinkedInRealtimeAuthResult,
+  hasLinkedInRealtimeSessionHeaders,
+  type LinkedInSessionSecret,
+  parseLinkedInSessionSecret,
+} from "./session-store.js";
 
 const LINKEDIN_KEYCHAIN_SERVICE = authKeychainService("linkedin");
 const LEGACY_LINKEDIN_KEYCHAIN_SERVICE = legacyAuthKeychainService("linkedin");
@@ -69,7 +74,7 @@ export async function validateLinkedInStoredAuth(
   }
 
   const session = parseLinkedInSessionSecret(secret);
-  if (!hasRequiredCookies(getCookieNames(session))) {
+  if (!hasRequiredCookies(getCookieNames(session)) || !hasLinkedInRealtimeSessionHeaders(session)) {
     return { status: "invalid" };
   }
 
@@ -116,13 +121,49 @@ export function importLinkedInStoredAuth(
   if (userRemoved && !options.reviveUserRemoved) {
     return [];
   }
+  if (!hasLinkedInRealtimeSessionHeaders(parsed)) {
+    if (existing?.auth_state === "authenticated" && !userRemoved) {
+      invalidateIntegrationAuth(db, "linkedin", accountKey, {
+        errorSummary: "LinkedIn realtime headers were not captured during auth",
+        reason: "linkedin_realtime_headers_missing",
+      });
+    }
+    return [];
+  }
+  const realtimeAuthResult = buildLinkedInRealtimeAuthResult(parsed);
   const alreadyImported =
     existing?.auth_state === "authenticated" &&
     typeof existingMetadata.keychainService === "string" &&
     existingMetadata.keychainService === LINKEDIN_KEYCHAIN_SERVICE &&
     typeof existingMetadata.keychainAccount === "string" &&
     existingMetadata.keychainAccount === accountKey;
   if (alreadyImported) {
+    const existingAuthResult =
+      typeof existingMetadata.authResult === "object" && existingMetadata.authResult
+        ? (existingMetadata.authResult as Record<string, unknown>)
+        : {};
+    if (existingAuthResult.realtimeReady !== true) {
+      db.upsertIntegrationState({
+        platform: "linkedin",
+        accountKey,
+        displayName: existing.display_name,
+        authState: existing.auth_state,
+        enabled: existing.enabled === 1,
+        connectionKind: existing.connection_kind,
+        syncCapable: existing.sync_capable === 1,
+        launchStrategy: existing.launch_strategy,
+        launchTarget: existing.launch_target,
+        importedFrom: existing.imported_from,
+        artifactPaths: safeParseJsonStringArray(
+          existing.artifact_paths_json,
+          "integration_states.artifact_paths_json",
+        ),
+        metadata: {
+          ...existingMetadata,
+          authResult: { ...existingAuthResult, ...realtimeAuthResult },
+        },
+      });
+    }
     return [{ platform: "linkedin", accountKey, imported: false }];
   }
 
@@ -168,6 +209,7 @@ export function importLinkedInStoredAuth(
       provider: "linkedin",
       savedAt: parsed.savedAt,
       cookieNames,
+      ...realtimeAuthResult,
     },
   });
 
@@ -179,6 +221,7 @@ export function importLinkedInStoredAuth(
       provider: "linkedin",
       savedAt: parsed.savedAt,
       cookieNames,
+      ...realtimeAuthResult,
     },
   });