six-degrees 0.3.0 → 0.4.0

package/.next/standalone/app/api/outreach/route.js

@@ -1,80 +1,143 @@
 import { db as supabase } from '../../../lib/db';
+import { getDb, decodeRow } from '../../../lib/db-client';
+import { resolveProfile } from '../../../lib/profile';
+
+// Requests you've sent, kept per PERSON.
+//
+// A person has one row per bridge whose circle holds them (the table's key is
+// profile + bridge + user), and a request used to mark only the copy that was
+// clicked. The other copies still offered "Add", the Pending count counted
+// copies, and every click awarded XP again. And the card's link wrote a second
+// column (unlock_status) through another route, which Undo never took back.
+// Now a request marks every copy of the person, in both columns, the bridge you
+// asked through is kept (so once they accept, their card and circle say who
+// introduced you: lib/promote.js keeps it), XP comes once per person, and Undo
+// takes back all of it. lib/requests-client.js is the one way the pages call this.
 
 // XP rewards by tier
 const XP_SEND = { S: 25, A: 15, B: 10, C: 5, D: 2 };
 const XP_ACCEPT = { S: 100, A: 60, B: 35, C: 15, D: 5 };
+const TIER_ORDER = ['S', 'A', 'B', 'C', 'D'];
 
 async function awardXP(userId, amount) {
   if (!userId || !amount) return;
-  // Upsert: create if not exists, increment if exists
+  // Upsert: create if not exists, change if exists. Never below zero: an Undo
+  // takes back what a send gave, including sends from before sends gave any.
   const { data: existing } = await supabase.from('user_stats').select('xp').eq('id', userId).single();
   if (existing) {
-    await supabase.from('user_stats').update({ xp: (existing.xp || 0) + amount }).eq('id', userId);
-  } else {
+    await supabase.from('user_stats').update({ xp: Math.max(0, (existing.xp || 0) + amount) }).eq('id', userId);
+  } else if (amount > 0) {
     await supabase.from('user_stats').insert([{ id: userId, xp: amount, level: 1 }]).catch(() => {});
   }
 }
 
+/** The profile a request belongs to: the one sent, else this machine's. */
+function whose(userId) {
+  if (userId) return String(userId);
+  try { return resolveProfile({ create: false })?.id || null; } catch { return null; }
+}
+
+/** Every copy of one person: by the clicked row's profile URL, or the URL given. */
+function copiesOf(db, { connectionId, profileUrl, userId }) {
+  let url = profileUrl ? String(profileUrl) : null;
+  let user = userId ? String(userId) : null;
+  let clicked = null;
+  if (connectionId != null) {
+    clicked = db.prepare('SELECT id, profile_url, user_id FROM linkedin_connections WHERE id = ?').get(String(connectionId)) || null;
+    if (clicked) {
+      url = clicked.profile_url || url;
+      user = user || clicked.user_id || null;
+    }
+  }
+  const cols = 'id, degree, tier, outreach_status, unlock_status, unlocked_from_bridge_id';
+  let rows = [];
+  if (url) {
+    rows = user
+      ? db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ? AND user_id = ?`).all(url, user)
+      : db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ?`).all(url);
+  } else if (clicked) {
+    rows = db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE id = ?`).all(clicked.id);
+  }
+  return { url, user, rows };
+}
+
+const inList = (ids) => ids.map(() => '?').join(', ');
+const bestTier = (rows) => TIER_ORDER.find((t) => rows.some((r) => r.tier === t)) || 'D';
+
 export async function POST(request) {
   try {
     const body = await request.json();
-    const { action, connectionId, profileUrl, userId } = body;
+    const { action, connectionId, profileUrl, userId, bridgeId } = body;
+    if (!['mark-sent', 'mark-accepted', 'undo'].includes(action)) {
+      return Response.json({ error: 'Unknown action' }, { status: 400 });
+    }
+    const db = getDb();
+    const { user, rows } = copiesOf(db, { connectionId, profileUrl, userId });
+    // Nobody on file (the sample network lives in the browser): nothing to keep.
+    if (!rows.length) return Response.json({ success: true, saved: 0, xp: 0 });
+    const ids = rows.map((r) => r.id);
+    const now = new Date().toISOString();
 
     if (action === 'mark-sent') {
-      // Get the person's tier for XP calculation
-      let tierQuery = supabase.from('linkedin_connections').select('tier');
-      tierQuery = connectionId ? tierQuery.eq('id', connectionId) : tierQuery.eq('profile_url', profileUrl);
-      const { data: person } = await tierQuery.single();
-      const tier = person?.tier || 'D';
-
-      let query = supabase.from('linkedin_connections').update({ outreach_status: 'sent' });
-      query = connectionId ? query.eq('id', connectionId) : query.eq('profile_url', profileUrl);
-      if (userId) query = query.eq('user_id', userId);
-      const { error } = await query;
-      if (error) return Response.json({ error: error.message }, { status: 500 });
-
-      // Award XP for sending request
-      await awardXP(userId, XP_SEND[tier] || 2);
-
-      return Response.json({ success: true, xp: XP_SEND[tier] || 2 });
+      const already = rows.some((r) => r.outreach_status === 'sent' || r.outreach_status === 'accepted');
+      db.prepare(`UPDATE linkedin_connections SET outreach_status = 'sent', updated_at = ?
+        WHERE id IN (${inList(ids)}) AND (outreach_status IS NULL OR outreach_status NOT IN ('sent', 'accepted'))`).run(now, ...ids);
+      db.prepare(`UPDATE linkedin_connections SET unlock_status = 'pending', updated_at = ?
+        WHERE id IN (${inList(ids)}) AND (unlock_status IS NULL OR unlock_status = 'locked')`).run(now, ...ids);
+      // Who you asked through: one of your own connections, or nothing.
+      if (bridgeId != null) {
+        const bridge = db.prepare(
+          `SELECT id, name FROM linkedin_connections WHERE id = ? AND degree = 1${user ? ' AND user_id = ?' : ''}`,
+        ).get(...[String(bridgeId), ...(user ? [user] : [])]);
+        if (bridge) {
+          db.prepare(`UPDATE linkedin_connections SET unlocked_from_bridge_id = ?, unlocked_from_name = ?, updated_at = ?
+            WHERE id IN (${inList(ids)}) AND degree = 2 AND unlocked_from_bridge_id IS NULL`).run(bridge.id, bridge.name, now, ...ids);
+        }
+      }
+      const xp = already ? 0 : XP_SEND[bestTier(rows)] || 2;
+      await awardXP(whose(user), xp);
+      return Response.json({ success: true, saved: ids.length, xp, already });
     }
 
     if (action === 'mark-accepted') {
-      let query = supabase.from('linkedin_connections').update({ outreach_status: 'accepted' });
-      query = connectionId ? query.eq('id', connectionId) : query.eq('profile_url', profileUrl);
-      if (userId) query = query.eq('user_id', userId);
-      const { error } = await query;
-      if (error) return Response.json({ error: error.message }, { status: 500 });
-      return Response.json({ success: true });
+      db.prepare(`UPDATE linkedin_connections SET outreach_status = 'accepted', updated_at = ? WHERE id IN (${inList(ids)})`).run(now, ...ids);
+      return Response.json({ success: true, saved: ids.length, xp: 0, accepts: XP_ACCEPT[bestTier(rows)] || 5 });
     }
 
-    if (action === 'undo') {
-      let query = supabase.from('linkedin_connections').update({ outreach_status: null });
-      query = connectionId ? query.eq('id', connectionId) : query.eq('profile_url', profileUrl);
-      if (userId) query = query.eq('user_id', userId);
-      const { error } = await query;
-      if (error) return Response.json({ error: error.message }, { status: 500 });
-      return Response.json({ success: true });
-    }
-
-    return Response.json({ error: 'Unknown action' }, { status: 400 });
+    // undo
+    const wasSent = rows.some((r) => r.outreach_status === 'sent');
+    db.prepare(`UPDATE linkedin_connections SET outreach_status = NULL, updated_at = ?
+      WHERE id IN (${inList(ids)}) AND outreach_status = 'sent'`).run(now, ...ids);
+    db.prepare(`UPDATE linkedin_connections SET unlock_status = 'locked', updated_at = ?
+      WHERE id IN (${inList(ids)}) AND unlock_status = 'pending'`).run(now, ...ids);
+    const xp = wasSent ? -(XP_SEND[bestTier(rows)] || 2) : 0;
+    await awardXP(whose(user), xp);
+    return Response.json({ success: true, saved: ids.length, xp });
   } catch (err) {
     console.error('Outreach error:', err);
     return Response.json({ error: err.message }, { status: 500 });
   }
 }
 
+/** Everyone with a request out, once each (the newest copy), newest first. */
 export async function GET(request) {
   try {
     const { searchParams } = new URL(request.url);
-    const userId = searchParams.get('userId');
-
-    let query = supabase.from('linkedin_connections').select('*').eq('outreach_status', 'sent').order('created_at', { ascending: false });
-    if (userId) query = query.eq('user_id', userId);
-
-    const { data, error } = await query;
-    if (error) return Response.json({ error: error.message }, { status: 500 });
-    return Response.json({ pending: data || [] });
+    const user = whose(searchParams.get('userId'));
+    const rows = getDb().prepare(
+      `SELECT * FROM linkedin_connections
+        WHERE (outreach_status = 'sent' OR unlock_status = 'pending')${user ? ' AND user_id = ?' : ''}
+        ORDER BY created_at DESC`,
+    ).all(...(user ? [user] : []));
+    const seen = new Set();
+    const pending = [];
+    for (const row of rows) {
+      const key = row.profile_url || `id:${row.id}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
+      pending.push(decodeRow('linkedin_connections', row));
+    }
+    return Response.json({ pending });
   } catch (err) {
     return Response.json({ error: err.message }, { status: 500 });
   }

package/.next/standalone/app/api/scraper/route.js

@@ -9,6 +9,8 @@ import { pausedList, readProgress, readUnclear } from '../../../lib/paused';
 import { getDb } from '../../../lib/db-client';
 import { registerScanState } from '../../../lib/scan-state';
 import { pendingImport } from '../../../lib/data-import';
+import { waitingPhotoCount } from '../../../lib/photos';
+import { reachIndex, circleState } from '../../../lib/reach';
 import {
   pythonLooker, thisHostKey, scannerCommand, installSteps, downloadedPython, downloadVerified,
   placeDownloadedPython, sweepSetupLeftovers, megabytes, SETUP_WORK_PREFIX, ScannerSetupError,
@@ -32,6 +34,8 @@ const MAX_LOG = 500;
 const state = registerScanState({
   running: false,
   action: null,
+  target: null,    // who a scan is of: { id, name } (either may be null), or null for scans of no one
+  recent: [],      // the last few finished jobs, newest first: how each one ended
   log: [],
   startedAt: null,
   exitCode: null,
@@ -126,6 +130,53 @@ function bridgeSkips() {
   }
 }
 
+/**
+ * What lib/reach.js needs from the scanner's files to tell who is ready for a
+ * circle scan: whose list is hidden, and whose list has been read even though
+ * nothing in it was saved (everyone on it was already yours). Read on its own,
+ * without the machine checks, because the map asks for it when it loads and
+ * again after every scan.
+ */
+function scanNotes() {
+  let read = [];
+  try {
+    const me = resolveProfile({ create: false });
+    if (me) read = Object.keys(readProgress(dataDir(), me.id));
+  } catch {}
+  return { skips: bridgeSkips(), read };
+}
+
+/**
+ * One of your connections, for the Scan page's "Scan one circle" box (Bridge
+ * Chains and the Degrees panel send people there by id): who they are, and how
+ * their circle stands by the same rule the map uses. Null when not found.
+ */
+function pickedPerson(id) {
+  try {
+    const me = resolveProfile({ create: false });
+    if (!me) return { person: null };
+    const db = getDb();
+    const row = db.prepare(
+      `SELECT id, name, tier, power_score, degree, profile_url, unlocked_from_bridge_id, unlocked_from_name
+         FROM linkedin_connections WHERE id = ? AND user_id = ? AND degree = 1`,
+    ).get(String(id ?? ''), me.id);
+    if (!row) return { person: null };
+    const mapped = db.prepare(
+      'SELECT 1 FROM linkedin_connections WHERE user_id = ? AND degree = 2 AND source_connection_id = ? LIMIT 1',
+    ).get(me.id, row.id);
+    const reach = reachIndex([], mapped ? [{ source_connection_id: row.id }] : [], scanNotes());
+    return {
+      person: {
+        id: row.id, name: row.name, tier: row.tier, power_score: row.power_score,
+        unlocked_from_bridge_id: row.unlocked_from_bridge_id, unlocked_from_name: row.unlocked_from_name,
+      },
+      circle: circleState(row, reach),
+    };
+  } catch {
+    return { person: null };
+  }
+}
+
 // The machine checks (Python, Chrome, signed in) spawn processes, so they are
 // cached for a few seconds, and callers that arrive while a look is under way
 // share it rather than each starting their own Pythons. Everything about the
@@ -225,6 +276,10 @@ async function status() {
     me = resolveProfile({ create: false });
     if (me) network = networkCounts(me.id);
   } catch {}
+  // People whose photo is still a link, which the app doesn't load: Save
+  // photos appears while there are any (lib/photos.js).
+  let photosWaiting = 0;
+  try { photosWaiting = waitingPhotoCount(getDb()); } catch {}
 
   const py = m.python;
   return {
@@ -251,20 +306,69 @@ async function status() {
       signedIn: m.signedIn,
     },
     network,
+    photosWaiting,
+    ...job(),
+    skips: bridgeSkips(),
+    linkedin: linkedinState(dataDir()),
+    paused: paused(me?.id),
+  };
+}
+
+/**
+ * The running job alone, from memory: no checks, no database. Every Scan
+ * button in the app asks this (lib/scraper-client.js watchScanner), every few
+ * seconds, so it must cost nothing.
+ *
+ * `recent` is how the last few jobs ended. A page following one job can then
+ * learn how it ended even when another job started before it looked again;
+ * with only the latest job's exit code, that one would never seem to finish.
+ */
+function job() {
+  return {
     running: state.running,
     action: state.action,
+    target: state.target,
     startedAt: state.startedAt,
     exitCode: state.exitCode,
     failure: state.running ? null : state.failure,
     progress: state.running ? scanProgress(state.log, state.action) : null,
     log: state.log.slice(-120),
-    skips: bridgeSkips(),
-    linkedin: linkedinState(dataDir()),
-    paused: paused(me?.id),
+    recent: state.recent,
   };
 }
 
-export async function GET() {
+/**
+ * Where Resume would carry on with one of your connections, for their profile
+ * card: { nextPage, pagesRead, legacy }, or null when there is nothing to carry
+ * on with (never mapped, read to the end, hidden). The Paused list's own rules
+ * (lib/paused.js), so the card and the Scan page can't disagree.
+ */
+function resumePoint(id) {
+  try {
+    const me = resolveProfile({ create: false });
+    if (!me) return null;
+    const db = getDb();
+    const row = db.prepare(
+      `SELECT id, name, tier, profile_url, connected_date, created_at
+         FROM linkedin_connections WHERE id = ? AND user_id = ? AND degree = 1`,
+    ).get(String(id ?? ''), me.id);
+    if (!row) return null;
+    const mapped = db.prepare(
+      'SELECT 1 FROM linkedin_connections WHERE user_id = ? AND degree = 2 AND source_connection_id = ? LIMIT 1',
+    ).get(me.id, row.id);
+    const [p] = pausedList([row], new Set(mapped ? [row.id] : []), readProgress(dataDir(), me.id), readUnclear(dataDir()));
+    return p ? { nextPage: p.nextPage, pagesRead: p.pagesRead, legacy: p.legacy } : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function GET(request) {
+  const q = new URL(request?.url || 'http://127.0.0.1/api/scraper').searchParams;
+  if (q.has('job')) return Response.json(job());
+  if (q.has('resume')) return Response.json({ resume: resumePoint(q.get('resume')) });
+  if (q.has('reach')) return Response.json(scanNotes());
+  if (q.has('person')) return Response.json(pickedPerson(q.get('person')));
   return Response.json(await status());
 }
 
@@ -283,7 +387,10 @@ const ACTIONS = {
   // Hidden profiles are remembered so they are not retried forever; this is
   // the way back in without a terminal.
   'auto-bridge-retry': { flag: '--auto-bridge --retry-private', label: 'Mapping every bridge, hidden ones included' },
-  bridge:        { flag: '--bridge',   needsName: true, label: 'Mapping the circle behind' },
+  // One person's circle, from page 1. By profile URL when the page sends their
+  // id, as every Scan button does: two connections can share a name, and by name
+  // the scanner reads whichever was saved first. By name for a caller with no id.
+  bridge:        { flag: '--bridge',   needsName: true, byId: true, label: 'Mapping the circle behind' },
   // Carry on with one person whose read was cut short. By profile URL, not name:
   // two connections can share a name, and Resume must reach the one clicked.
   resume:        { flag: '--bridge-url', needsId: true, label: 'Carrying on with', searches: true },
@@ -291,6 +398,9 @@ const ACTIONS = {
   'resume-all':  { flag: '--auto-bridge --only-unfinished', label: 'Carrying on with every paused list', searches: true },
   rescrape:      { flag: '--rescrape', needsName: true, label: 'Re-mapping the circle behind' },
   company:       { flag: '--company',  needsName: true, label: 'Scanning' },
+  // Photos an older version kept as links to LinkedIn: saved here, once each.
+  // No browser, no search; every scan does the same at its end.
+  photos:        { flag: '--save-photos', label: 'Saving profile photos to this computer' },
 };
 
 /** Only a plain linkedin.com/in/ profile URL becomes an argument. */
@@ -402,7 +512,7 @@ export async function POST(request) {
 
   // The two settings a person changes here. Neither starts anything.
   if (action === 'set-limits') {
-    const limits = writeLimits(dataDir(), { daily: body.daily, monthly: body.monthly });
+    const limits = writeLimits(dataDir(), { daily: body.daily, monthly: body.monthly, profiles: body.profiles });
     return Response.json({ ok: true, limits });
   }
   if (action === 'lift-cooldown') {
@@ -431,24 +541,34 @@ export async function POST(request) {
   const readsCircles = action.startsWith('auto-bridge') || ['bridge', 'rescrape', 'resume', 'resume-all'].includes(action);
   // Carry on with people already mapped, from the page each one stopped at.
   const deeper = body.deeper === true && (action.startsWith('auto-bridge') || action === 'bridge');
+  // Resume, and a circle scan of someone picked by id, go by the connection's
+  // profile URL rather than a name.
+  const byId = spec.needsId || (spec.byId && Boolean(body.id));
   let name = null;
-  if (spec.needsName) {
+  if (spec.needsName && !byId) {
     name = cleanName(body.name);
     if (!name) return Response.json({ error: 'A name is required for this action.' }, { status: 400 });
   }
-  // Resume sends the connection's id; the URL is looked up here, for this
-  // profile, so nothing from the request itself reaches the command line.
+  // The id comes from the page; the URL is looked up here, for this profile, so
+  // nothing from the request itself reaches the command line.
   let profileUrl = null;
-  if (spec.needsId) {
+  let person = null;
+  if (byId) {
     try {
       const me = resolveProfile({ create: false });
-      const row = me && getDb().prepare(
-        'SELECT profile_url FROM linkedin_connections WHERE id = ? AND user_id = ? AND degree = 1',
+      person = me && getDb().prepare(
+        'SELECT name, profile_url FROM linkedin_connections WHERE id = ? AND user_id = ? AND degree = 1',
       ).get(String(body.id ?? ''), me.id);
-      profileUrl = row?.profile_url && cleanProfileUrl(row.profile_url);
+      profileUrl = person?.profile_url && cleanProfileUrl(person.profile_url);
     } catch { profileUrl = null; }
     if (!profileUrl) return Response.json({ error: 'That connection could not be found.' }, { status: 400 });
   }
+  // Who the job is of, so every Scan button can say whose scan is running and a
+  // profile card can show its own person's progress. Only ever shown: the id
+  // never reaches the command line (a name or the URL looked up for it does),
+  // and anything not shaped like one of our ids is dropped.
+  const hintId = typeof body.id === 'string' && /^[\w-]{1,64}$/.test(body.id) ? body.id : null;
+  const target = name || profileUrl ? { id: hintId, name: name || person?.name || null } : null;
   // Nothing that searches LinkedIn starts during a cooldown; the scanner checks
   // too, this just says so before a process is spawned.
   // The 1st-degree scans aren't searches, but they open LinkedIn with automation too.
@@ -497,8 +617,11 @@ export async function POST(request) {
     // app is inside the signed app (lib/scanner-python.js scannerCommand).
     plan = [scannerCommand(found.run, path.join(root, 'scripts', 'scrape.py'), [
       // `--flag=value` is one token on purpose: a name beginning with
-      // "-" can then never be read as a flag of its own.
-      ...(name ? [`${spec.flag}=${name}`] : profileUrl ? [`${spec.flag}=${profileUrl}`] : spec.flag.split(' ')),
+      // "-" can then never be read as a flag of its own. Anyone found by
+      // id is --bridge-url, which carries on where their last read stopped
+      // unless told to start at page 1.
+      ...(name ? [`${spec.flag}=${name}`] : profileUrl ? [`--bridge-url=${profileUrl}`] : spec.flag.split(' ')),
+      ...(profileUrl && action === 'bridge' && !deeper ? ['--from-start'] : []),
       ...(maxBridges && (action.startsWith('auto-bridge') || action === 'resume-all') ? [`--max-bridges=${maxBridges}`] : []),
       ...(tiers.length && action.startsWith('auto-bridge') ? [`--tiers=${tiers.join(',')}`] : []),
       ...(action.startsWith('auto-bridge') ? [`--order=${order}`] : []),
@@ -517,9 +640,10 @@ export async function POST(request) {
   state.running = true;
   state.stopping = false;
   state.action = action;
+  state.target = target;
   state.exitCode = null;
   state.startedAt = Date.now();
-  state.log = [spec.label + (name ? ` ${name}…` : '…')];
+  state.log = [spec.label + (target?.name ? ` ${target.name}…` : '…')];
   state.stderrTail = [];
   state.failure = null;
   forgetChecks();
@@ -560,6 +684,9 @@ export async function POST(request) {
     state.child = null;
     state.abort = null;
     state.exitCode = code;
+    state.recent = [{
+      action: state.action, target: state.target, startedAt: state.startedAt, exitCode: code, failure: state.failure,
+    }, ...state.recent].slice(0, 5);
     // A setup's private folder (the download and what was unpacked from it).
     if (cleanup) {
       try { cleanup(); } catch { /* swept at the next setup (sweepSetupLeftovers) */ }
@@ -625,5 +752,7 @@ export async function POST(request) {
 
   runStep(0);
 
-  return Response.json({ ok: true, action });
+  // Which job this is, so the page that started it can tell its end from the
+  // end of whatever runs next (lib/scraper-client.js runScrape).
+  return Response.json({ ok: true, action, startedAt: state.startedAt });
 }

package/.next/standalone/app/api/settings/sector-preview/route.js

@@ -1,8 +1,8 @@
 import { getDb } from '../../../../lib/db-client';
-import { companyOverrides, readForScoring, scoringRows, sectorFocusOf } from '../../../../lib/rpc';
+import { companyOverrides, readForScoring, scoringRows, sectorFocusOf, tierScaleOf } from '../../../../lib/rpc';
 import { parseSectorFocus, previewSectorFocus } from '../../../../lib/sector-focus';
 
-// Settings → Your sector, before you save: what a sector focus would change,
+// Scores → Your sector, before you save: what a sector focus would change,
 // against the one saved now. It reads the network once and scores it twice in
 // memory, with the inputs rescoreAll() uses (readForScoring: each company's
 // industry and its sectors from the directory), and writes nothing. A save
@@ -31,6 +31,7 @@ export async function POST(request) {
       read: readForScoring(rows),
       from: sectorFocusOf(db),
       to,
+      tierScale: tierScaleOf(db),
     }));
   } catch (err) {
     return Response.json({ error: err.message }, { status: 500 });

package/.next/standalone/app/api/settings/sector-suggestions/route.js

@@ -2,7 +2,7 @@ import { getDb } from '../../../../lib/db-client';
 import { readForScoring, scoringRows } from '../../../../lib/rpc';
 import { suggestSectors } from '../../../../lib/sector-directory';
 
-// Settings → Your sector: "Suggested from your network". The directory's
+// Scores → Your sector: "Suggested from your network". The directory's
 // sectors most of your scanned people work in, counted here from the rows
 // with the same read rescoring uses, so a suggestion's companies are the ones
 // picking it would lean. Its own read-only GET, not part of GET

package/.next/standalone/app/api/update-images/route.js

@@ -1,4 +1,6 @@
 import { db as supabase } from '../../../lib/db';
+import { getDb } from '../../../lib/db-client';
+import { localPhoto, waitingPhotos } from '../../../lib/photos';
 
 const CORS_HEADERS = {
   'Access-Control-Allow-Origin': '*',
@@ -10,29 +12,61 @@ export async function OPTIONS() {
   return new Response(null, { status: 204, headers: CORS_HEADERS });
 }
 
+// The photos still kept as links, for the scanner to save: at the end of a
+// scan, and for Save photos on the Scan page (scrape.py save_waiting_photos).
+// A read, so no CORS header: another site's page can't see the answer.
+export async function GET() {
+  try {
+    return Response.json({ waiting: waitingPhotos(getDb()) });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}
+
+// `images`: [{ profileUrl, imageUrl }], each a photo the scanner has saved,
+// attached to every row of that person. Only a saved file's path is stored,
+// never a link (lib/photos.js).
+//
+// `forget`: [{ profileUrl, imageUrl }], links the scanner got a definite no for
+// (expired, not LinkedIn's, not a picture, or the same picture as someone
+// else's), never one it couldn't reach. The link is cleared, and only where it
+// is still that link, so each is tried once and the person shows initials.
 export async function POST(request) {
   try {
-    const { images } = await request.json();
+    const { images, forget } = await request.json();
 
-    if (!images || !Array.isArray(images)) {
+    if ((!images || !Array.isArray(images)) && !Array.isArray(forget)) {
       return Response.json({ error: 'Missing images array' }, { status: 400, headers: CORS_HEADERS });
     }
 
     let updated = 0;
-    for (let i = 0; i < images.length; i += 20) {
-      const batch = images.slice(i, i + 20);
+    const saved = Array.isArray(images) ? images : [];
+    for (let i = 0; i < saved.length; i += 20) {
+      const batch = saved.slice(i, i + 20);
       const promises = batch.map(({ profileUrl, imageUrl }) => {
-        if (!profileUrl || !imageUrl) return Promise.resolve();
+        const photo = localPhoto(imageUrl);
+        if (!profileUrl || !photo) return Promise.resolve();
         return supabase
           .from('linkedin_connections')
-          .update({ profile_image_url: imageUrl })
+          .update({ profile_image_url: photo })
           .eq('profile_url', profileUrl)
           .then(({ error }) => { if (!error) updated++; });
       });
       await Promise.all(promises);
     }
 
-    return Response.json({ success: true, updated }, { headers: CORS_HEADERS });
+    let forgotten = 0;
+    for (const { profileUrl, imageUrl } of Array.isArray(forget) ? forget : []) {
+      if (typeof profileUrl !== 'string' || typeof imageUrl !== 'string' || !imageUrl || localPhoto(imageUrl)) continue;
+      const { data, error } = await supabase
+        .from('linkedin_connections')
+        .update({ profile_image_url: null })
+        .eq('profile_url', profileUrl)
+        .eq('profile_image_url', imageUrl);
+      if (!error && data?.length) forgotten++;
+    }
+
+    return Response.json({ success: true, updated, forgotten }, { headers: CORS_HEADERS });
   } catch (err) {
     return Response.json({ error: err.message }, { status: 500, headers: CORS_HEADERS });
   }

package/.next/standalone/app/avatars/[file]/route.js

@@ -1,12 +1,14 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { dataDir } from '../../../lib/db-client';
-import { AVATAR_FILE } from '../../../lib/data-folder';
+import { AVATAR_FILE } from '../../../lib/photos';
 
 // Avatars are captured by the scraper and live in the user's data directory,
 // never inside the app package — an installed copy must not write into its own
 // files, and real faces must never end up in the repo. Rows store the path
 // `/avatars/<name>.webp`, so this route resolves that to ~/.six-degrees/avatars.
+// It is the only place a page gets a photo from (lib/photos.js): reading one
+// never goes online.
 
 export async function GET(_request, { params }) {
   const { file } = await params;
@@ -26,6 +28,9 @@ export async function GET(_request, { params }) {
         'Content-Type': type,
         // Content-addressed filenames, so they can be cached indefinitely.
         'Cache-Control': 'public, max-age=31536000, immutable',
+        // A photo that came in with an import is only as good as its name: never
+        // let the browser read one as anything but the image type it claims.
+        'X-Content-Type-Options': 'nosniff',
       },
     });
   } catch {

package/.next/standalone/app/components/Avatar.js

@@ -1,6 +1,7 @@
 'use client';
 
 import { initialsFor } from '../../lib/tiers';
+import { localPhoto } from '../../lib/photos';
 
 const FALLBACK = { S: '#FFD700', A: '#9B59B6', B: '#3498DB', C: '#95A5A6', D: '#BDC3C7' };
 
@@ -9,8 +10,10 @@ const FALLBACK = { S: '#FFD700', A: '#9B59B6', B: '#3498DB', C: '#95A5A6', D: '#
 // Most people have no photo, so the initials disc is the common case, not the
 // fallback — and it sits UNDER the photo, so a photo that fails to load just
 // reveals it. No state, and no reaching into a sibling node to un-hide it.
+// Only a photo saved on this computer is drawn (lib/photos.js).
 export default function Avatar({ person, size = 32, tierColors = FALLBACK }) {
   const c = tierColors[person?.tier] || '#666';
+  const photo = localPhoto(person?.profile_image_url);
   return (
     <span style={{
       position: 'relative', display: 'inline-block', width: size, height: size, flexShrink: 0,
@@ -20,9 +23,9 @@ export default function Avatar({ person, size = 32, tierColors = FALLBACK }) {
         position: 'absolute', inset: 0, borderRadius: '50%', display: 'flex', alignItems: 'center', justifyContent: 'center',
         background: `${c}2e`, color: c, fontWeight: 800, fontSize: Math.max(7, Math.round(size * 0.36)), lineHeight: 1,
       }}>{initialsFor(person?.name)}</span>
-      {person?.profile_image_url && (
+      {photo && (
         <img
-          src={person.profile_image_url}
+          src={photo}
           alt=""
           loading="lazy"
           decoding="async"