meta-sovereign 0.50.0 → 0.51.1

package/README.hi.md

@@ -61,6 +61,8 @@ Default UI hosted app है: `serve` उसका पता छापता ह
 
 macOS पर interactive `serve` पूरा setup करता है: इस installation की TLS key को Secure Enclave से protect करता है, certificate trust जाँचता है, जरूरत पर ही trust माँगता है और GitHub Pages app खोलता है। Headless launch: `node js/bin/meta-sovereign.js serve --trust=true --open=true`। `--trust=false` और `--open=false` से opt out करें। Swift helper को macOS Command Line Tools चाहिए; unsupported Mac पर `--hardware-key=false` स्पष्ट रूप से file key चुनता है। Hardware protection disk की key पर लागू है; Node key को memory में उपयोग करता है। नियम और सीमाएँ: [local server setup और security](docs/LOCAL-SERVER-SECURITY.md)।
 
+खुली चैट पहले लोड होती है और लोडिंग या पुनःप्रयास की स्थिति दिखाती है। सभी / निजी / समूह / चैनल फ़िल्टर हर Telegram फ़ोल्डर में उपलब्ध हैं। कॉलम की चौड़ाई ऊर्ध्वाधर डिवाइडर खींचकर बदलें; आकार याद रखे जाते हैं। कॉल मुख्य मेनू में चैट के बाद है और Telegram खाता संपादन प्रोफ़ाइल में है। डार्क थीम में नियंत्रण सफ़ेद रेखा आइकन इस्तेमाल करते हैं। JS सर्वर OS उपयोगकर्ता की ऐप फ़ोल्डर में डेटा रखता है: macOS में `~/Library/Application Support/Meta Sovereign/store`, Windows में `%APPDATA%/Meta Sovereign/store` और Linux में `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store`। पुराने checkout से `serve` चलाने पर `.meta-sovereign` एक बार स्थानांतरित होता है; संदेश, संपर्क, सत्र, मीडिया और प्रमाणपत्र सुरक्षित रहते हैं तथा लिंक पुराने पथ बनाए रखता है। रीस्टार्ट और अलग कार्य निर्देशिका में वही स्टोर इस्तेमाल होता है। `--store` या `META_SOVEREIGN_STORE_DIR` से बदलें। [चैट और डेटा संग्रहण](docs/CHAT-READINESS.md) देखें।
+
 ## SPA को server से जोड़ें
 
 SPA server को इस क्रम में चुनता है ([`js/src/web/discover.js`](js/src/web/discover.js)):
@@ -81,6 +83,7 @@ SPA server को इस क्रम में चुनता है ([`js/src
 - **Telegram के अपने ऐप जैसी चैट**: हर संदेश एक बार भेजा जाता है, डिलीवरी टिक, लाइव अपडेट और अंतराल के बाद catch-up, पढ़ा-चिह्न, cloud ड्राफ़्ट, reload के बाद भी बचे रहने वाले retry ([`docs/CHAT-REFERENCES.hi.md`](docs/CHAT-REFERENCES.hi.md))।
 - **CRM**: किसी संपर्क के बारे में सब कुछ एक दृश्य में, अलग-अलग नेटवर्क पर वही व्यक्ति, communities और सदस्यताएँ, खोज, नियम से ऑडियंस (`friends:vk & chat:vk:… - list:blocked`)।
 - **संपर्क आयात**: macOS Contacts (सिंक किए गए iCloud खातों सहित) या किसी भी प्लेटफ़ॉर्म के vCard निर्यात का पूर्वावलोकन करके आयात करें। दोबारा आयात करने पर रिकॉर्ड की पहचान बनी रहती है। निर्देशिका सिंक के दौरान अपडेट होती है और बिना संदेश वाले लोग भी दिखाती है। [संपर्क आयात](docs/CONTACTS-IMPORT.md) देखें।
+
 - **Outreach, broadcast और ऑटोमेशन**: किसे, कब, किन शर्तों पर और किस पाठ से लिखना है; कौन क्या पाएगा इसका preview; डिफ़ॉल्ट रूप से सुरक्षित ड्राफ़्ट, या quiet hours, हर चैट का cooldown, दैनिक सीमा और opt-out सूची के साथ धीमी गति से स्वचालित भेजना। हर स्वचालित भेजना एक ही outbox से जाता है: अधिक से अधिक एक बार, और अस्पष्ट परिणाम अपने आप दोहराया नहीं जाता ([`docs/USER-GUIDE.hi.md`](docs/USER-GUIDE.hi.md), §11)।
 - **Operator कतार और उत्तर**: अपठित संदेश चैट-दर-चैट, आपके पिछले उत्तरों से सुझाव (Tab एक चुनता है), पैटर्न और उत्तर के रूप, मिलते संदेश पर auto-reply।
 - **व्यवसाय और community खाते**: VK community token Bots Long Poll चलाता है; Telegram Business के quick replies, स्वागत और अनुपस्थिति संदेश, कार्य-समय और chatbots।

package/README.md

@@ -61,6 +61,8 @@ The hosted app is the default UI: `serve` prints its address, <https://link-foun
 
 On macOS, interactive `serve` now handles the full setup: it protects this installation’s TLS key with Secure Enclave, detects existing certificate trust, requests trust only when needed, and opens the GitHub Pages app. For a headless launch use `node js/bin/meta-sovereign.js serve --trust=true --open=true`. `--trust=false` and `--open=false` opt out. The Swift helper needs the macOS Command Line Tools; `--hardware-key=false` explicitly opts into a file key on unsupported Macs. Hardware protection applies to the key on disk; Node uses it in memory. See [local server setup and security](docs/LOCAL-SERVER-SECURITY.md) for the exact access rules and limits.
 
+Open conversations load first and show loading or retry status until their history is ready. All / Private / Groups / Channels filters remain available inside every Telegram folder. Drag the vertical dividers to resize columns; widths are remembered. Calls is in the main menu after Chat, and Telegram account editing is under Profile. The default dark controls use white line icons. The JS server keeps its store under your OS user: `~/Library/Application Support/Meta Sovereign/store` on macOS, `%APPDATA%/Meta Sovereign/store` on Windows, and `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store` on Linux. Starting `serve` from an older checkout migrates its `.meta-sovereign` store once, preserving messages, contacts, sessions, media and certificate; a compatibility link preserves old paths. Restarts and a different working directory reuse the same store. `--store` or `META_SOVEREIGN_STORE_DIR` override it. See [chat readiness and data storage](docs/CHAT-READINESS.md).
+
 ## Connect the SPA to your server
 
 The SPA picks a server in this order ([`js/src/web/discover.js`](js/src/web/discover.js)):
@@ -81,6 +83,7 @@ The full user-facing flow — install nothing, install Rust server, install JS s
 - **Chat that behaves like Telegram's own apps**: each message sent once, delivery ticks, live updates and catch-up after a gap, read marking, cloud drafts, retries that survive a reload. How the open-source Telegram, Signal and Element clients do it, pinned to the commits we read, is in [`docs/CHAT-REFERENCES.md`](docs/CHAT-REFERENCES.md).
 - **CRM**: everything known about a contact in one view, the same person across networks, communities and memberships, search, audiences by rule (`friends:vk & chat:vk:… - list:blocked`).
 - **Contact imports**: preview and import macOS Contacts (including synced iCloud accounts) or vCard exports from any platform; repeated imports keep stable identities. The directory updates during sync and includes people without messages. See [contact imports](docs/CONTACTS-IMPORT.md).
+
 - **Outreach, broadcasts and automations**: who to message, when, on what conditions and with which text; a preview of who gets what; safe drafts by default or paced auto-send with quiet hours, a per-chat cooldown, daily caps and an opt-out list. Every automated send goes through one outbox, so it happens at most once and an unclear result is never retried by itself ([`docs/USER-GUIDE.md` §11](docs/USER-GUIDE.md#11-automations-message-people-by-rule-safely)).
 - **Operator queue and replies**: walk unread messages chat by chat, reply suggestions from your own past answers (Tab takes one), patterns and reply variations, auto-replies on a matching message.
 - **Business and community accounts**: a VK community token runs the Bots Long Poll; Telegram Business quick replies, greeting and away messages, hours and chatbots.

package/README.ru.md

@@ -61,6 +61,8 @@ node js/bin/meta-sovereign.js serve
 
 В macOS интерактивный `serve` выполняет настройку целиком: защищает TLS-ключ этой установки через Secure Enclave, проверяет доверие сертификату, запрашивает его только при необходимости и открывает приложение на GitHub Pages. Без интерактивного терминала: `node js/bin/meta-sovereign.js serve --trust=true --open=true`. `--trust=false` и `--open=false` отключают эти действия. Для Swift-помощника нужны macOS Command Line Tools; `--hardware-key=false` явно выбирает файловый ключ на неподдерживаемом Mac. Аппаратная защита действует на диске; Node использует ключ в памяти. Правила и ограничения: [настройка и безопасность локального сервера](docs/LOCAL-SERVER-SECURITY.md).
 
+Открытый чат загружается первым и показывает загрузку или ожидание повторной попытки. Фильтры Все / Личные / Группы / Каналы доступны внутри каждой папки Telegram. Вертикальные разделители меняют ширину столбцов; размеры запоминаются. Звонки находятся в главном меню после Чата, редактор аккаунта Telegram — в Профиле. В тёмной теме элементы управления используют белые контурные значки. JS-сервер хранит данные в папке пользователя ОС: `~/Library/Application Support/Meta Sovereign/store` в macOS, `%APPDATA%/Meta Sovereign/store` в Windows и `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store` в Linux. Запуск `serve` из старого checkout однократно переносит `.meta-sovereign`, сохраняя сообщения, контакты, сессии, медиа и сертификат; ссылка сохраняет старые пути. Перезапуск и другой рабочий каталог используют то же хранилище. Переопределение: `--store` или `META_SOVEREIGN_STORE_DIR`. См. [чаты и хранение данных](docs/CHAT-READINESS.md).
+
 ## Подключение SPA к серверу
 
 SPA выбирает сервер в таком порядке ([`js/src/web/discover.js`](js/src/web/discover.js)):
@@ -81,6 +83,7 @@ SPA выбирает сервер в таком порядке ([`js/src/web/dis
 - **Чат, который ведёт себя как приложения Telegram**: каждое сообщение отправляется один раз, галочки доставки, живые обновления и догрузка после разрыва, отметки о прочтении, облачные черновики, повторы, переживающие перезагрузку ([`docs/CHAT-REFERENCES.ru.md`](docs/CHAT-REFERENCES.ru.md)).
 - **CRM**: всё о контакте в одном окне, один и тот же человек в разных сетях, сообщества и членства, поиск, аудитории по правилам (`friends:vk & chat:vk:… - list:blocked`).
 - **Импорт контактов**: предпросмотр и импорт из Контактов macOS (включая синхронизированные учётные записи iCloud) или файлов vCard на любой платформе; повторный импорт сохраняет идентичность записей. Список обновляется при синхронизации и включает людей без сообщений. См. [импорт контактов](docs/CONTACTS-IMPORT.md).
+
 - **Рассылки, broadcast и автоматизации**: кому писать, когда, при каких условиях и каким текстом; предпросмотр, кто что получит; по умолчанию безопасные черновики или отправка с паузами, тихими часами, перерывом для каждого чата, дневными лимитами и списком отписавшихся. Каждая автоматическая отправка идёт через один outbox: не больше одного раза, а неясный результат сам не повторяется ([`docs/USER-GUIDE.ru.md`](docs/USER-GUIDE.ru.md), §11).
 - **Очередь оператора и ответы**: непрочитанные сообщения чат за чатом, подсказки ответов из ваших прошлых ответов (Tab берёт подсказку), паттерны и варианты ответов, автоответы на подходящее сообщение.
 - **Аккаунты бизнеса и сообществ**: токен сообщества VK запускает Bots Long Poll; Telegram Business: быстрые ответы, приветствие и сообщение об отсутствии, часы работы, чат-боты.

package/README.zh.md

@@ -61,6 +61,8 @@ node js/bin/meta-sovereign.js serve
 
 在 macOS 交互式终端中，`serve` 会完成整个设置：使用 Secure Enclave 保护本次安装的 TLS 私钥，检测证书是否已受信任，仅在需要时请求信任，并打开 GitHub Pages 应用。无交互终端时可运行 `node js/bin/meta-sovereign.js serve --trust=true --open=true`。`--trust=false` 和 `--open=false` 可关闭相应操作。Swift 辅助程序需要 macOS Command Line Tools；不支持的 Mac 可显式使用 `--hardware-key=false` 选择文件密钥。硬件保护针对磁盘上的密钥；Node 在内存中使用密钥。详见[本地服务器设置与安全](docs/LOCAL-SERVER-SECURITY.md)。
 
+打开的聊天优先加载，并显示加载或重试状态。全部 / 私聊 / 群组 / 频道筛选在每个 Telegram 文件夹内都可用。拖动竖直分隔线调整列宽，尺寸会保存。通话位于主菜单聊天之后，Telegram 账户编辑移到个人资料。默认深色控件使用白色线条图标。 JS 服务器将数据保存在操作系统用户的应用文件夹：macOS 为 `~/Library/Application Support/Meta Sovereign/store`，Windows 为 `%APPDATA%/Meta Sovereign/store`，Linux 为 `${XDG_CONFIG_HOME:-~/.config}/Meta Sovereign/store`。从旧 checkout 启动 `serve` 会一次性迁移 `.meta-sovereign`，保留消息、联系人、会话、媒体和证书，并用兼容目录链接保留旧路径。重启或改变工作目录仍使用同一存储。可通过 `--store` 或 `META_SOVEREIGN_STORE_DIR` 覆盖。参见[聊天就绪与数据存储](docs/CHAT-READINESS.md)。
+
 ## 将 SPA 连接到服务器
 
 SPA 按以下顺序选择服务器（[`js/src/web/discover.js`](js/src/web/discover.js)）：
@@ -81,6 +83,7 @@ SPA 按以下顺序选择服务器（[`js/src/web/discover.js`](js/src/web/disco
 - **像 Telegram 官方应用一样的聊天**：每条消息只发送一次，送达对勾，实时更新与断线后补齐，已读标记，云端草稿，刷新后仍保留的重试（[`docs/CHAT-REFERENCES.zh.md`](docs/CHAT-REFERENCES.zh.md)）。
 - **CRM**：一个视图看到联系人的全部信息，跨网络识别同一个人，社区与成员关系，搜索，按规则定义受众（`friends:vk & chat:vk:… - list:blocked`）。
 - **导入联系人**：预览并导入 macOS 通讯录（包括已同步的 iCloud 账户）或任何平台导出的 vCard；重复导入保留记录身份。目录在同步期间自动更新，也包含没有消息的联系人。参见[联系人导入](docs/CONTACTS-IMPORT.md)。
+
 - **外联、群发与自动化**：给谁发、何时发、在什么条件下发、发什么内容；预览谁会收到什么；默认生成安全草稿，或按节奏自动发送，并有安静时段、每个聊天的冷却期、每日上限和退订名单。每次自动发送都经过同一个发件箱：最多发送一次，结果不明时不会自行重试（[`docs/USER-GUIDE.zh.md`](docs/USER-GUIDE.zh.md) 第 11 节）。
 - **Operator 队列与回复**：逐个聊天处理未读消息，根据您以往的回答给出回复建议（按 Tab 采用），模式与回复变体，对匹配消息自动回复。
 - **企业与社区账号**：VK 社区令牌运行 Bots Long Poll；Telegram Business 的快捷回复、问候与离开消息、营业时间和聊天机器人。

package/js/src/cli/automation-commands.js

@@ -19,6 +19,7 @@
  * the chat menu does); with `--test` the conditions are ignored there.
  */
 
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { promises as fs } from 'node:fs';
 import { createInterface } from 'node:readline/promises';
 import { getSource } from '../sources/index.js';
@@ -383,7 +384,7 @@ const automationsCmd = async (args, log, deps) => {
     log(`unknown subcommand "${sub}"\n${AUTOMATION_HELP}`);
     return 1;
   }
-  const store = await deps.openStore(args.store ?? '.meta-sovereign');
+  const store = await deps.openStore(args.store ?? defaultStoreDir());
   const { runner, close } = runnerFor(store, args, deps);
   try {
     return await handler({

package/js/src/cli/contact-commands.js

@@ -1,4 +1,5 @@
 // Local address-book imports, with the same parser and plan as the app.
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { promises as fs } from 'node:fs';
 import { decodeVcard, parseVcard } from '../sources/vcard.js';
 import { readSystemContacts } from '../sources/system-contacts.js';
@@ -17,7 +18,7 @@ export const createContactCommands = ({ openStore }) => ({
       log('choose --file=<contacts.vcf> or --system');
       return 1;
     }
-    const storeDir = args.store ?? '.meta-sovereign';
+    const storeDir = args.store ?? defaultStoreDir();
     const store = await openStore(storeDir);
     try {
       const rows = system

package/js/src/cli/cv-commands.js

@@ -11,6 +11,7 @@
  * this module importing the entry point back.
  */
 
+import { defaultStoreDir } from '../storage/app-directory.js';
 import {
   compareAllCvs,
   cvPlatformCatalogue,
@@ -147,7 +148,7 @@ const planCmd = async (args, log) => {
 };
 
 const readCmd = async (args, log, openStore, injected) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const ids = parsePlatforms(args.platforms);
   const { entries, failures } = await readAllCvs(
     ids,
@@ -168,7 +169,7 @@ const readCmd = async (args, log, openStore, injected) => {
 };
 
 const diffCmd = async (args, log, openStore) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const entries = await loadStoredCvs(store, parsePlatforms(args.platforms));
   const comparison = compareAllCvs(entries, { prefer: args.prefer ?? null });
   const diffs = diffAllCvs(entries, null);
@@ -213,7 +214,7 @@ const applyConfirmed = async (preview, { args, log, ask, run }) => {
 };
 
 const syncCmd = async (args, log, openStore, injected) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const ids = parsePlatforms(args.platforms);
   const run = (dryRun, confirmed = null) =>
     syncCvAcross(ids, {
@@ -256,7 +257,7 @@ const syncCmd = async (args, log, openStore, injected) => {
 };
 
 const telemetryCmd = async (args, log, openStore) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const events = await loadCvTelemetry(store, {
     runId: args.run ?? null,
     platform: args.platform ?? null,

package/js/src/cli/greetings-commands.js

@@ -11,6 +11,7 @@
  * its own `openStore`, and the tests inject fake source adapters.
  */
 
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { parseList } from './cv-commands.js';
 import { getSource } from '../sources/index.js';
 import {
@@ -40,7 +41,7 @@ const optionalNumber = (value) =>
 
 const asJson = (value) => JSON.stringify(value, null, 2);
 
-const storeOf = (args, openStore) => openStore(args.store ?? '.meta-sovereign');
+const storeOf = (args, openStore) => openStore(args.store ?? defaultStoreDir());
 
 /**
  * `--stickers=vk:21,facebook:369239263222822` → selection entries. The

package/js/src/cli/index.js

@@ -13,6 +13,7 @@
  * entry point unit-testable.
  */
 
+import { defaultStoreDir, resolveUserStore } from '../storage/app-directory.js';
 import path from 'node:path';
 import { maybeOpenHostedApp } from './browser-open.js';
 import { CONTACTS_HELP, createContactCommands } from './contact-commands.js';
@@ -144,14 +145,14 @@ const importCmd = async (args, log) => {
   const file = args.file;
   const archive = await fs.readFile(file, 'utf8');
   const parsed = file.endsWith('.json') ? JSON.parse(archive) : archive;
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const n = await importInto(store, args.source, parsed);
   log(`imported ${n} messages from ${args.source}`);
   return 0;
 };
 
 const exportCmd = async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const links = await store.query();
   await fs.writeFile(args.file, JSON.stringify(links, null, 2));
   log(`exported ${links.length} links to ${args.file}`);
@@ -159,7 +160,7 @@ const exportCmd = async (args, log) => {
 };
 
 const backupCmd = async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const file = await createBackup(store, { archiveDir: args.archive });
   if (args.keep) {
     await pruneBackups({ archiveDir: args.archive, keep: Number(args.keep) });
@@ -175,7 +176,7 @@ const passcodeCmd = async (args, log) => {
     log('usage: meta-sovereign passcode --clear [--store=<dir>]');
     return 1;
   }
-  const cleared = clearPasscode(args.store ?? '.meta-sovereign');
+  const cleared = clearPasscode(args.store ?? defaultStoreDir());
   log(cleared ? 'local passcode cleared' : 'no local passcode was set');
   return 0;
 };
@@ -185,7 +186,7 @@ const restoreCmd = async (args, log) => {
     // Swap the whole log in one step; the store must not be in use (R-Z16).
     const n = await restoreBackupToDir(
       args.file,
-      args.store ?? '.meta-sovereign',
+      args.store ?? defaultStoreDir(),
       {
         replace: true,
       }
@@ -193,7 +194,7 @@ const restoreCmd = async (args, log) => {
     log(`replaced the store with ${n} records from ${args.file}`);
     return 0;
   }
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const n = await restoreBackup(store, args.file);
   log(`restored ${n} links from ${args.file}`);
   return 0;
@@ -235,7 +236,7 @@ const logAddresses = (handle, log) => {
 };
 
 const serveCmd = async (args, log) => {
-  const storeDir = args.store ?? '.meta-sovereign';
+  const storeDir = args.store ?? defaultStoreDir();
   // Verbose logging is on by default: every request, event and error is
   // written to a file in the app folder (and echoed here), so the root
   // cause of any issue is always on disk. `--quiet-logs` opts out.
@@ -313,7 +314,7 @@ const rawEmailTransport = (args, protocol) =>
     : null;
 
 const sourcePullCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const protocol = args.protocol;
   const result = await pullLiveInto(store, args.source, {
     protocol,
@@ -384,7 +385,7 @@ const githubLiveFromArgs = (args) =>
   });
 
 const githubCloneCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const live = githubLiveFromArgs(args);
   const result = await live.cloneRepo({
     owner: args.owner,
@@ -490,7 +491,7 @@ const peoplePerHourMessageCmd = boardMessageCmd(
 );
 
 const audienceCmd = async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const all = await store.query();
   const matched = evalAudience(all, args.query ?? '');
   log(JSON.stringify(matched, null, 2));
@@ -498,7 +499,7 @@ const audienceCmd = async (args, log) => {
 };
 
 const factsCmd = async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const all = await store.query();
   const messages = all.filter((l) => l.id?.startsWith('msg:'));
   const patterns = all
@@ -515,7 +516,7 @@ const factsCmd = async (args, log) => {
 };
 
 const searchCmd = async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const results = await localSearch(store, {
     query: args.query ?? '',
     min: Number(args.min ?? 0.2),
@@ -525,7 +526,7 @@ const searchCmd = async (args, log) => {
 };
 
 const broadcastCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const networks = (args.networks?.split(',') ?? listSources()).filter((n) =>
     listSources().includes(n)
   );
@@ -543,7 +544,7 @@ const broadcastCmd = async (args, log) => {
 };
 
 const listByPrefixCmd = (prefix) => async (args, log) => {
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const all = await store.query();
   log(
     JSON.stringify(
@@ -566,7 +567,7 @@ const patternsInferCmd = async (args, log) => {
 };
 
 const graphsRunCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const persisted = await store.get(args.id);
   if (!persisted) {
     log(`graph ${args.id} not found`);
@@ -589,7 +590,7 @@ const graphsRunCmd = async (args, log) => {
 };
 
 const profileCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   if (args.name || args.bio) {
     const profile = {
       id: 'profile:me',
@@ -619,7 +620,7 @@ const profileCmd = async (args, log) => {
 };
 
 const resumeCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   if (args.title || args.body) {
     const resume = {
       id: 'resume:me',
@@ -648,7 +649,7 @@ const resumeCmd = async (args, log) => {
 };
 
 const syncListenCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const peer = createPeer(store, {
     node: 'cli-listener',
     schemaVersion: CURRENT_SCHEMA,
@@ -662,7 +663,7 @@ const syncListenCmd = async (args, log) => {
 };
 
 const syncConnectCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const peer = createPeer(store, {
     node: 'cli-client',
     schemaVersion: CURRENT_SCHEMA,
@@ -680,7 +681,7 @@ const syncConnectCmd = async (args, log) => {
 };
 
 const outreachCmd = async (args, log) => {
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const all = await store.query();
   const matched = evalAudience(all, args.query ?? '');
   const replyGroup = args.reply
@@ -702,7 +703,7 @@ const exportEncryptedCmd = async (args, log) => {
     log('export-encrypted: --passphrase is required (R-K13)');
     return 1;
   }
-  const store = await openReadOnly(args.store ?? '.meta-sovereign');
+  const store = await openReadOnly(args.store ?? defaultStoreDir());
   const file = await writeEncryptedExport(store, args.file, {
     passphrase: args.passphrase,
   });
@@ -715,7 +716,7 @@ const purgeTombstonesCmd = async (args, log) => {
     log('purge-tombstones: refusing without --confirm=true (R-K4)');
     return 1;
   }
-  const store = await openStore(args.store ?? '.meta-sovereign');
+  const store = await openStore(args.store ?? defaultStoreDir());
   const idPrefix = args['id-prefix'] ?? null;
   const olderThan = args['older-than']
     ? new Date(args['older-than']).toISOString()
@@ -741,7 +742,7 @@ const purgeTombstonesCmd = async (args, log) => {
 };
 
 const vaultFile = (args) =>
-  args.file ?? path.join(args.store ?? '.meta-sovereign', 'vault.json');
+  args.file ?? path.join(args.store ?? defaultStoreDir(), 'vault.json');
 
 const vaultInitCmd = async (args, log) => {
   const file = vaultFile(args);
@@ -860,7 +861,26 @@ export const runCli = async (argv, { log = console.log } = {}) => {
     return 1;
   }
   try {
-    return await handler(parseArgs(rest), log);
+    const args = parseArgs(rest);
+    if (
+      args.store === undefined &&
+      ![
+        'help',
+        '--help',
+        '-h',
+        'version',
+        '--version',
+        '-v',
+        undefined,
+      ].includes(cmd)
+    ) {
+      args.store =
+        ['serve', 'trust'].includes(cmd) &&
+        !process.env.META_SOVEREIGN_STORE_DIR
+          ? await resolveUserStore({ log })
+          : defaultStoreDir();
+    }
+    return await handler(args, log);
   } catch (error) {
     if (error?.code === 'STORE_LOCKED' || SCHEMA_ERROR_CODES.has(error?.code)) {
       log(error.message); // another process owns the store (R-Z2); the schema (R-Z17)

package/js/src/cli/migrate-commands.js

@@ -10,6 +10,7 @@
  * `serve`; this command is for doing it on purpose, or looking first.
  */
 
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { openDualStore } from '../storage/dual-store.js';
 import {
   MIGRATIONS,
@@ -100,7 +101,7 @@ const migrateCmd = async (dir, log) => {
 
 export const createMigrateCommands = () => ({
   migrate: async (args, log) => {
-    const dir = args.store ?? '.meta-sovereign';
+    const dir = args.store ?? defaultStoreDir();
     if (args.status) {
       return statusCmd(dir, log);
     }

package/js/src/cli/trust-commands.js

@@ -11,6 +11,7 @@
  * The runner is injected so the tests never touch a real keychain.
  */
 
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
@@ -62,7 +63,7 @@ export const setupLocalCertificate = async (args, log, options = {}) => {
   if (!enabled(args.tls) || process.env.MS_TLS === 'off' || !supported) {
     return null;
   }
-  const storeDir = args.store ?? '.meta-sovereign';
+  const storeDir = args.store ?? defaultStoreDir();
   const protector =
     enabled(args['hardware-key']) && platform === 'darwin'
       ? await deviceProtector(storeDir)
@@ -128,7 +129,7 @@ export const createTrustCommands = ({
 } = {}) => ({
   trust: async (args, log) => {
     const remove = String(args.remove ?? 'false') !== 'false';
-    const { certPath } = await loadLocalTls(args.store ?? '.meta-sovereign');
+    const { certPath } = await loadLocalTls(args.store ?? defaultStoreDir());
     if (platform !== 'darwin') {
       log(manualSteps(certPath));
       return 0;

package/js/src/cv/browser.js

@@ -15,13 +15,53 @@
 
 import os from 'node:os';
 import path from 'node:path';
+import { promises as fs } from 'node:fs';
+import { defaultStoreDir } from '../storage/app-directory.js';
 
 /** Packages a live run needs, in the order we report them. */
 export const BROWSER_PACKAGES = ['browser-commander', 'playwright'];
 
 /** Default persistent profile directory: sessions must survive runs. */
 export const defaultProfileDir = (platform = 'shared') =>
-  path.join(os.homedir(), '.meta-sovereign', 'browser-profiles', platform);
+  path.join(defaultStoreDir(), 'browser-profiles', platform);
+
+const persistentProfile = async (platform) => {
+  const target = defaultProfileDir(platform);
+  const legacy = path.join(
+    os.homedir(),
+    '.meta-sovereign',
+    'browser-profiles',
+    platform
+  );
+  const exists = (file) =>
+    fs.lstat(file).then(
+      () => true,
+      () => false
+    );
+  if (!(await exists(target)) && (await exists(legacy))) {
+    if (await exists(path.join(legacy, 'SingletonLock'))) {
+      throw Object.assign(
+        new Error(
+          'Close the existing CV browser before migrating its profile.'
+        ),
+        { code: 'browser-profile-in-use' }
+      );
+    }
+    await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    await fs.rename(legacy, target);
+    try {
+      await fs.symlink(
+        target,
+        legacy,
+        process.platform === 'win32' ? 'junction' : 'dir'
+      );
+    } catch (error) {
+      await fs.rename(target, legacy);
+      throw error;
+    }
+  }
+  return target;
+};
 
 const defaultImporters = {
   'browser-commander': () => import('browser-commander'),
@@ -137,7 +177,7 @@ export const openBrowserSession = async ({
         return launchWithCommander({
           bc,
           headless,
-          profileDir: profileDir ?? defaultProfileDir(platform),
+          profileDir: profileDir ?? (await persistentProfile(platform)),
           slowMo,
           locale,
           verbose,

package/js/src/server/cors.js

@@ -140,6 +140,17 @@ export const classifyOrigin = (req, allowed) => {
   return allowed.includes(origin) ? 'allowed' : 'denied';
 };
 
+/** Safe metadata for refused requests, without URLs, cookies or tokens. */
+export const corsContext = (req) => ({
+  origin: toOrigin(req.headers?.origin) ?? null,
+  transport: req.socket?.encrypted ? 'https' : 'http',
+  fetchSite: ['same-origin', 'same-site', 'cross-site', 'none'].includes(
+    req.headers?.['sec-fetch-site']
+  )
+    ? req.headers['sec-fetch-site']
+    : null,
+});
+
 const writeEmpty = (res, status) => {
   res.writeHead(status, { 'content-length': '0' });
   res.end();

package/js/src/server/index.js

@@ -119,6 +119,7 @@ import { createLearnedRoute } from './routes-learned.js';
 import { createGitHubCheck } from '../sources/github-check.js';
 import { handleMetrics } from './metrics.js';
 import { jsonLog } from './log.js';
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { listenLocal } from './local-tls.js';
 import { handlePullRoutes, pullContext } from './routes-pull.js';
 import { createPeer, attachSyncWebSocket } from '../sync/index.js';
@@ -126,6 +127,7 @@ import { attachSignaling } from '../sync/webrtc-signaling.js';
 import { registerDefaultHandlers } from './handlers-bootstrap.js';
 import {
   classifyOrigin,
+  corsContext,
   handleCors,
   hostAllowed,
   parseAllowedOrigins,
@@ -710,6 +712,7 @@ const createHttpServer = (store, ctx, log) =>
         method: req.method,
         path: (req.url ?? '').split('?')[0],
         status: res.statusCode,
+        ...(res.statusCode === 403 ? corsContext(req) : {}),
         duration_ms: Date.now() - start,
       });
     });
@@ -813,7 +816,7 @@ const automationFor = (store, automations, log, telegramAccount, later) =>
 
 export const startServer = async ({
   port = 0,
-  storeDir = '.meta-sovereign',
+  storeDir = defaultStoreDir(),
   archiveDir,
   store: providedStore,
   enableHandlers = true,

package/js/src/server/log.js

@@ -19,6 +19,7 @@
 import { createWriteStream, openSync, statSync, unlinkSync } from 'node:fs';
 import { chmod, mkdir } from 'node:fs/promises';
 import path from 'node:path';
+import { defaultStoreDir } from '../storage/app-directory.js';
 import { redact } from './redact.js';
 import { renameDurableSync } from '../storage/durable.js';
 
@@ -138,7 +139,7 @@ export const createServerLog = async ({
   keep = KEEP_FILES,
   stdout = (line) => process.stdout.write(line),
 } = {}) => {
-  const dir = path.join(storeDir ?? '.meta-sovereign', 'logs');
+  const dir = path.join(storeDir ?? defaultStoreDir(), 'logs');
   await mkdir(dir, { recursive: true, mode: 0o700 });
   await chmod(dir, 0o700).catch(() => {});
   const file = path.join(dir, 'meta-sovereign.log');

package/js/src/server/routes-telegram.js

@@ -194,6 +194,7 @@
  */
 
 import { classifyOrigin } from './cors.js';
+import { telegramRouteError } from './telegram-route-error.js';
 import { bodyFailure, json, readBody } from './util.js';
 import { isTrustedMutation } from './routes-auto-import.js';
 import { DIALOG_ACTIONS } from '../sources/telegram-dialogs.js';
@@ -1482,18 +1483,6 @@ export const handleTelegramRoutes = async (req, res, p, ctx) => {
     if (bodyFailure(error)) {
       throw error; // a bad request body: 400/413, not a 502 (R-Z1)
     }
-    ctx.log?.({
-      level: 'error',
-      event: 'telegram_route_failed',
-      path: p,
-      error: error.message,
-    });
-    return (
-      json(res, 502, {
-        error: error.message,
-        code: error.code,
-        ...(error.retryAfter ? { retryAfter: error.retryAfter } : {}),
-      }) ?? true
-    );
+    return telegramRouteError(res, p, error, ctx.log);
   }
 };