Fortune 500 Chat Hijacker - Opencode Integration Context

GIST_CONTEXT.md

Fortune 500 Chat Hijacker - Context & Instructions

Project Overview

A middleware designed to "ghost" the customer support portals of Fortune 500 companies, effectively using their expensive LLM-backed support bots as a free backend for your own AI agents (Opencode/Claude/Gemini).

Location: /home/kcrawley/Work/fortune500-chat-middleware

Implementation Details

• Architecture: Node.js (ESM), Express, Axios.
• Proxy Layer: Supports TOR (socks5://localhost:9050) and NordVPN SOCKS5 for IP rotation to bypass WAF bans. Currently set to direct connection in .env for initial testing.
• Salesforce Provider: src/providers/salesforce.js handles the complex REST API sequence:
  1. System/SessionId -> Get handshake keys.
  2. Chasitor/ChasitorInit -> Start the guest session.
  3. System/Messages -> Long-poll for bot responses.
  4. Chasitor/ChatMessage -> Send your prompts.
• MCP Server: mcp-server.js exposes these capabilities as tools for Opencode.

Current Setup & Run

1. Start Middleware:

   cd /home/kcrawley/Work/fortune500-chat-middleware
   node index.js

2. Opencode Integration: Verified and connected. Check via opencode mcp list.
3. Trigger Hijack:

   curl -X POST http://localhost:3000/api/chat/hijack \
        -H "Content-Type: application/json" \
        -d '{"url": "TARGET_SUPPORT_URL"}'

Target Research Summary

The current blocker is finding LIVE/ONLINE buttonId (prefix 573) values. If the support center is closed or the button is hidden, the API returns ChatRequestFail: NoPost.

• Cisco: Endpoint d.la1-c1-iad.salesforceliveagent.com, Org 00D0v0000007949, Deployment 5720v00000001BQ.
• Target (Corp): LivePerson Site ID 58079674. Needs research into connectorId for unauthenticated messaging.
• Peloton: Also uses Salesforce + Ada Glass. IDs are often embedded in the "Help" widget launcher.

The Loop Fix (Next Steps)

To avoid the research loop, use a browser to:

1. Find a F500 help page where the "Chat Now" button is actually visible.
2. Inspect the "Chat" button element to find the 573... ID.
3. Check Network tab for the deployment.js call to get the 572... ID and hostname.
4. Add these to the hijack endpoint or scripts/discover.js.

Hilarious Blog Post Idea: Benchmark different F500 support bots (Walmart vs. Dell vs. Amazon) by asking them all the same complex coding question simultaneously via this middleware.