six-degrees 0.4.0-beta.1 → 0.4.0

package/.next/standalone/CHANGELOG.md

@@ -6,6 +6,158 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-09-28
+
+### Added
+- **A cap on profile views.** A circle scan opens the person's profile once, and profile
+  views are what LinkedIn restricted an account for. They now have a cap of their own: 50
+  in any 24 hours by default. The Scan page offers 10, 25, 50 or 100, and there is no "no
+  limit".
+  - **A minute apart:** at least 60 seconds pass between any two profile opens. It's timed
+    from the last one written down, so scans started back to back can't open profiles back
+    to back. The log counts down while it waits, and Stop ends the wait.
+  - **Checked before the profile opens:** at the cap, a scan opens nothing and records
+    nothing about that person. Auto-Bridge stops, as it does at the search budget, and the
+    next run starts with the same person.
+  - **On the Scan page:** "3 of 50 profile views today", with a bar and the picker.
+  - **Re-mapping someone** checks it before deleting their circle. A damaged record counts
+    the day's views as used. An import brings the other computer's setting only when this
+    one has none, like the search budget.
+- **The Scan page asks what field you're in, before your first scan.** One optional step,
+  with the same picks as *Scores → Your sector*: tech, government and defense, dental, and
+  the rest. Companies in your field count for more, so your first scores already use it.
+  *Skip for now* carries on without one. Both stay at the bottom of the window while you
+  look through the list. It's asked once, and never if you already have a network or picked
+  a sector. Change it anytime on the Scores tab.
+- **Bridge Chains opens any circle, as far as your scans reach.** Click someone in a
+  bridge's circle and their own circle opens in place: the people found in it once you
+  connected and scanned it (3rd degree, counted along the chain), and on from there. A
+  trail at the top, and Esc, go back. An empty circle says why and what gets it: connect,
+  then scan their circle. While one is being scanned, it fills in as the scan saves.
+  Someone ready for a scan goes to the Scan page with them picked instead, since their
+  circle is empty until then.
+- **A soft glow on people ready for a scan.** In Bridge Chains, someone you added through
+  a circle whose own circle isn't scanned yet has a soft breathing halo, and their bridge
+  says how many are "ready". A hidden list is greyed with a lock instead. The halo stays
+  still with Reduce Motion on. The old rainbow glow is gone: it looked for them inside the
+  circle they came from, which accepting takes them out of, so it never showed.
+- **Ready to scan (N), in the Degrees panel.** It replaces *Auto-Bridge Next*, which
+  started a scan in one click, by name, with no cost shown, and offered hidden lists again
+  and again. The list is everyone you added through a circle whose circle can be scanned,
+  strongest first, with the circle you found them in and what a scan costs. Hidden lists
+  stay in view, greyed with a lock.
+- **Scan one circle, on the Scan page.** A ready person, from the list or Bridge Chains,
+  opens the Scan page with them picked: the cost (a profile view, then a search a page, up
+  to 100), what's left of the day's budget, how deep to read, and a button. Nothing starts
+  until it's pressed.
+- **A release checks the website's version lines.** Before building anything, the release
+  workflow runs `scripts/check-site-version.mjs`: the site's `softwareVersion` and
+  `llms.txt` must name the version, and its `dateModified` and sitemap `lastmod` can't be
+  older than the release's date in the changelog. A stale site stops the release with a
+  line for each thing to change. A pre-release skips it. Anyone can run it before tagging.
+
+### Changed
+- **A big circle spreads out.** A bridge's circle used to sit on one ring, so a few hundred
+  people were almost a solid line. It now fills rings from the inside out, as many as it
+  needs, with the highest tiers nearest the middle; drag to move, scroll or +/− to zoom.
+  Lots of bridges spread the same way, and so does the preview on hover.
+- **The map picks up a finished scan by itself.** No refresh needed.
+- **One rule for "ready".** Bridge Chains, the Degrees panel, Outlink's new doors and the
+  profile page's mapping bar now agree on who can be scanned next, and all leave hidden
+  lists out.
+- **Photos stay on your Mac.** The app shows a profile photo only from the copy saved on
+  your computer, so looking at your network never contacts LinkedIn. It used to load a
+  photo from LinkedIn until a scan had saved it, and a rescan could put LinkedIn's link
+  back in place of a saved photo. Every page now also tells the browser to load pictures
+  from the app alone, and the scanner fetches photos from LinkedIn's image servers only.
+- **Photos an older version kept as links are saved once.** Until then those people show
+  initials. The next scan saves them at its end, or *Save photos* on the Scan page does it
+  now, without opening a browser. A link more than a few weeks old has expired: that
+  person's photo comes back when they're next scanned. Offline, or with LinkedIn's image
+  server busy, nothing is forgotten, and *Save photos* stops and says why.
+- **Government and military titles are read.** A senator, a governor, a mayor and a cabinet
+  secretary score like a C-suite; their deputies, state legislators, commissioners,
+  ambassadors and judges like a VP; a city councilmember or a sheriff like a director.
+  Officers by rank: a 3–4 star general or admiral 10, a 1–2 star 9, a colonel 7.5, a
+  lieutenant colonel 6.5, a major 5, and a commander by their unit. "(Ret.)" and
+  "Retired" make a role former. They count only where a title is written, and only where
+  their own organization is a government's or a service's: a staffer in an Office of the
+  Secretary, a veteran's civilian job, a city manager at Uber, a Rotary district governor,
+  a team captain or a Kentucky colonel isn't one. A title that doesn't say whose it is
+  ("Mayor", "Police Chief", "Ambassador") needs its government named, or stays "Title
+  unclear": a missed official is a neutral 4, a realtor read as a mayor would be an A.
+  Until now all of them were "Title unclear" (a U.S. senator scored 2.9, C).
+- **One name: Six Degrees.** The header, the welcome screen, the loading and launch pages,
+  the side panel and the Terminal installer said "6 Degrees". They now say Six Degrees, as
+  the window title and the app in Applications already did.
+- **Contributor docs and `.gitignore`.** CONTRIBUTING says npm releases go out through
+  trusted publishing, with no token to set, and that `npm run build:desktop` builds the app
+  releases ship (`build:app` is the old launcher). `.gitignore` keeps a LinkedIn export, a
+  database, a saved copy of a network and the scanner's signed-in browser profile out of a
+  commit, wherever they sit in the tree. A local build keeps them out of the app too, and
+  its list of uncommitted files inside the app now names ignored ones as well.
+- **0.4.0-beta.1, promoted: this is now the Mac app and npm package everyone gets.** It adds:
+  - **Their circle, on every card,** with rarity beside the tier and LinkedIn's own mutual count.
+  - **One scan at a time,** and *Resume* beside *Rescan*.
+  - **Tiers on your own network's curve,** with unknown companies at a neutral 5.
+  - **631 public organizations** the built-in list leaves off, and **scoring 6.**
+  - **Scores, a tab of its own.**
+
+  The details are under 0.4.0-beta.1 below.
+- **The download page** says what's new in 0.4.0.
+- **Degrees' corner toggle says Orbit, which is what it shows.** It said "Galaxy", but
+  the Galaxy is a Network Circle view, so Degrees fell back to Orbit. It switches
+  between Orbit and Bridge Chains, and it's on whenever Orbit is showing.
+
+### Removed
+- **About 630 lines of Galaxy code that never ran:** a Degrees drawing from before Orbit
+  and Bridge Chains. Nothing could open it. The Galaxy draws Network Circle only.
+
+### Fixed
+- **A one-person scan notes a hidden list.** A card's Scan or Rescan that found someone's
+  list hidden said so and noted nothing, so they stayed "not scanned yet" and were offered
+  again forever. Only a batch noted it. Now every read from page 1 does.
+- **A scan reads the list of the person you picked.** A card's Scan and Rescan went by
+  name, so with two connections of the same name the scanner could read the other one's
+  list. Every Scan button now goes by that person's profile, as Resume already did.
+- **A company's name after "at" is no longer read as a title.** "Server at President Hotel"
+  scored as a C-suite (7.3, A), and so did an IT specialist in an "Office of the Chief
+  Information Officer". "Executive Assistant to the General Manager" scored as a VP.
+- **↻ asks before it scans.** The round button in the header started *Check for new* the
+  moment it was clicked. It now says what it will do (open Chrome on your connections list
+  and read it until it reaches people already saved) and what it costs (no search budget,
+  but it is LinkedIn traffic from your account), and waits for OK.
+- **No Scan buttons on the sample or a CSV import.** Every card there offered a scan of
+  that person's circle, and Degrees offered *Auto-Bridge Next*, but both networks live
+  only in the window, so the scan could only fail ("Bridge '…' not found in database").
+  In their place a line says scanning needs your own network.
+- **A CSV import's dates are the day LinkedIn says.** Anywhere east of London, each "Connected
+  On" date landed a day early (28 Sep 2026 became 27 Sep). The import now reads it as the
+  calendar date it is, the way a scan already did, and a date it can't read is left blank
+  rather than guessed.
+- **Opening a panel no longer rebuilds the Galaxy.** Opening or closing the side panel or
+  the Filter panel used to draw the Galaxy again from scratch: the layout started over,
+  the selection ring vanished, and a big network stalled the page. Now the view slides
+  over at the same zoom, so what was in the middle stays in the middle.
+- **The selection ring stays on the person you picked.** It is tied to their dot, and it
+  comes back after a tier filter that still shows them. It used to follow the first dot
+  it found near its old spot, which could be someone else, even You. *Back to list*
+  clears it.
+- **The selection ring pulses gently, as it was always meant to.** Its animation had only
+  ever been written in code that never ran. With Reduce Motion on, it holds still.
+- **Hovering a dot eases it up to 1.5 times its size,** instead of jumping. With Reduce
+  Motion on, it still changes at once.
+- **The Galaxy draws faster on a big network.** Colouring its lines searched every person
+  for every line: about 1.4 s at 30,000 people, on every draw. It now takes under a
+  millisecond.
+- **The main screen no longer stalls when nothing is selected on a big network.** The
+  side panel's Power Rankings counted every tier again for each person in the list, even
+  with the panel closed. At 30,000 people that took about 20 s each time the screen
+  redrew, opening the Filter panel included.
+- **On a laptop, the Galaxy keeps its usual layout with a panel open.** Its fixed phone
+  layout used to switch on whenever the graph was under 768 pixels wide, which a tier
+  filter picked with a panel open could do. It now follows the window, as the page does.
+
 ## [0.4.0-beta.1] - 2026-09-28 (beta: a pre-release, never installed automatically)
 
 ### Added

package/.next/standalone/CONTRIBUTING.md

@@ -42,16 +42,27 @@ run `node scripts/pin-python-packages.mjs`.
 
 Bump the version, tag it, push the tag. `.github/workflows/release.yml` builds the
 Mac app for Apple Silicon and Intel, publishes both `.dmg` files and a `SHA256SUMS`
-file on a GitHub Release (which is what `install.sh` downloads), and publishes to
-npm when an `NPM_TOKEN` secret is set.
+file on a GitHub Release (which is what `install.sh` downloads), and publishes the npm
+package through npm's trusted publishing: npm accepts this repository's
+`release.yml`, and GitHub vouches for each run, so there is no npm token to set or
+keep. A tag with a hyphen (`v0.4.0-beta.1`) is a pre-release on GitHub and goes to npm
+under `next`, so neither `install.sh` nor `npx six-degrees` picks it up.
+
+A full release also bumps the download website's version lines (`docs/SEO.md`, "Release
+checklist"). `node scripts/check-site-version.mjs` says whether they match
+`package.json` and the release's date in `CHANGELOG.md`; the release workflow runs it
+before building anything and stops if they don't. A pre-release skips it.
 
 ```bash
 npm version 0.2.0 --no-git-tag-version
+node scripts/check-site-version.mjs
 git commit -am "Release 0.2.0" && git tag v0.2.0 && git push --follow-tags
 ```
 
-To try a packaged build locally: `npm run build:app`, then
-`SIX_DEGREES_DMG=dist/Six-Degrees-<version>-arm64.dmg bash install.sh`.
+To try a packaged build locally: `npm run build:desktop`, then
+`SIX_DEGREES_DMG=dist/Six-Degrees-<version>-arm64.dmg bash install.sh`. That is the
+Electron app releases ship. `npm run build:app` builds the older classic launcher, kept
+only as a fallback.
 
 The picture behind the `.dmg` window is `scripts/dmg/background.html`. After changing
 it, run `node scripts/make-dmg-background.mjs` (needs Google Chrome) and commit the

package/.next/standalone/README.md

@@ -123,8 +123,7 @@ whose own circles reach the furthest, and the shortest chain from you to a stran
 worth meeting.
 
 It's a Mac app (or `npx six-degrees` on Linux). It runs on your computer, against your own data, with no account and
-no server. (Inside the app the logo reads *6 Degrees*; in Applications it's **Six
-Degrees**.)
+no server.
 
 ## Before you scan LinkedIn
 
@@ -137,8 +136,9 @@ Degrees**.)
 > - Search was blocked after results were read too fast (2026-09-24).
 >
 > The scanner now reads slowly and keeps to a search budget (by default 50 a day and 250
-> a month; you can change it on the Scan page). It locks itself during a cooldown, and
-> stops at the first sign of push-back. The risk is still yours.
+> a month) and a cap on profile views (50 a day, at least a minute apart). You can change
+> both on the Scan page. It locks itself during a cooldown, and stops at the first sign of
+> push-back. The risk is still yours.
 >
 > **The CSV import and the sample network carry no LinkedIn risk at all.** Details:
 > [how scanning works and what it risks](docs/SCRAPING.md).
@@ -147,12 +147,13 @@ Degrees**.)
 
 The app opens on a welcome screen with three ways in, and asks nothing about you:
 
-- **Scan my LinkedIn**: a guided page that ticks each step off as it goes. It sets up
-  the scanner in one click, you sign into LinkedIn yourself in a Chrome window, and then
-  it scans. Needs Google Chrome. The Mac app brings its own Python; with `npx six-degrees`
-  the page uses yours, or sets up a private one with a click. It checks and says what's
-  missing. The app marks this *Recommended* because it's the only way to Degrees and
-  Outlink. Read the warning above first.
+- **Scan my LinkedIn**: a guided page that ticks each step off as it goes. It first asks
+  one optional question, what field you're in (see *Your sector* below), and *Skip for
+  now* is fine. Then it sets up the scanner in one click, you sign into LinkedIn yourself
+  in a Chrome window, and then it scans. Needs Google Chrome. The Mac app brings its own
+  Python; with `npx six-degrees` the page uses yours, or sets up a private one with a
+  click. It checks and says what's missing. The app marks this *Recommended* because
+  it's the only way to Degrees and Outlink. Read the warning above first.
 - **Import my LinkedIn CSV**: LinkedIn's official export, read on your machine. On
   LinkedIn: **Settings & Privacy → Data privacy → Get a copy of your data →
   Connections**. LinkedIn emails a link in about ten minutes; unzip it and drop
@@ -225,7 +226,9 @@ tiers, on the fixed scale:                     S ≥ 7.5   A ≥ 5.5   B ≥ 4.0
 
 - **Title (1–10)** comes from someone's roles in their headline, with former roles at
   70%; current students are capped. Academics have their own ladder (an assistant
-  professor 5 up to a dean 9), an audience of their own counts like a title (100K+
+  professor 5 up to a dean 9), and so do government and the services (a city
+  councilmember or a colonel 7.5 up to a senator or a four-star general 10), read only
+  where a title is written. An audience of their own counts like a title (100K+
   followers 6.5, 1M+ 7.5, 10M+ 9), and a title it can't read counts as an individual
   contributor's (4).
 - **Company score (1–10)** is the one you set (the Scores tab) if there is one. Otherwise
@@ -246,8 +249,9 @@ tiers, on the fixed scale:                     S ≥ 7.5   A ≥ 5.5   B ≥ 4.0
   people you know there, where a job every kind of company has (recruiter, accountant,
   software engineer) doesn't count. An industry includes its sectors, and a company's one
   industry when the known list or the company's name gives it, not when only its people's
-  job titles do. Settings suggests the sectors your network is in and shows what would
-  change before you save.
+  job titles do. Scores suggests the sectors your network is in and shows what would
+  change before you save. The Scan page asks for it once, before your first scan, so your
+  first scores already use it; you can skip it and pick later.
 - Multiplying means seniority counts for more at a bigger company. A VP at a company
   scored 10 gets 9.0; a founder at an unknown company, 7.3.
 - **Reach bonus (up to 1.5)**: investor, YC, an audience in the millions, the top award
@@ -277,8 +281,10 @@ It estimates **network position**, not what anyone is worth as a person.
 - A CSV import is read on your machine and never added to your network. It's held only
   in the app window's own storage, and you import it again next time.
 - The app contacts only these, and only when you act:
-  - **LinkedIn**, while you scan. Also, until a profile photo has been saved to your
-    computer, the app shows it straight from LinkedIn's image server.
+  - **LinkedIn**, while you scan. Each profile photo is saved on your computer as the
+    scan reads it, and the app shows photos only from there, so looking at your network
+    never contacts LinkedIn. (Photos an older version kept as links to LinkedIn show
+    initials until the next scan, or *Save photos* on the Scan page, saves them.)
   - Only without the Mac app (which carries the scanner's Python and add-ons inside it),
     once, when you set the scanner up: **PyPI** (the Python package library) for the
     scanner's add-ons, and, if the computer has no Python the scanner can use, **GitHub**

package/.next/standalone/SECURITY.md

@@ -99,6 +99,14 @@ This app is designed to run **on your own machine, against your own network**.
 - Values stored in the database are treated as untrusted text and escaped
   before rendering. Do not reintroduce `innerHTML` (including d3's `.html()`)
   for anything data-bearing.
+- **Profile photos come from this computer only.** A page shows a photo only
+  from a file saved in the data folder (`/avatars/<name>`, `lib/photos.js`),
+  never from a link, and every page carries
+  `Content-Security-Policy: img-src 'self' data: blob:`, so the browser won't
+  load a picture from anywhere else. The scanner fetches photos only from
+  LinkedIn's image servers (`*.licdn.com`, over https): while it scans, and
+  once each for links older versions stored, which a crafted import could also
+  carry.
 - Do not bind this app to `0.0.0.0` or expose it through a tunnel.
 
 ## Your data
@@ -108,6 +116,8 @@ Everything stays local:
 - A CSV import is parsed in the browser and held for that tab only. It is never
   uploaded and never written to a database.
 - Scanned data and cached avatars are written to your machine and are gitignored.
+  The app shows photos only from those files, so looking at your network never
+  contacts LinkedIn.
 - There is no telemetry, no analytics, and no crash reporting.
 
 If you run the scanner, `chrome-profile/` in the data directory holds a live

package/.next/standalone/app/api/ingest/route.js

@@ -1,6 +1,7 @@
 import { db as supabase } from '../../../lib/db';
 import { uniqueByProfile, splitAlreadyConnected, toIsoDate, refreshNotifications, mutualCountOf } from '../../../lib/ingest';
 import { promoteToFirstDegree } from '../../../lib/promote';
+import { localPhoto } from '../../../lib/photos';
 
 function parseHeadline(h) {
   if (!h) return { role: '', company: '' };
@@ -29,7 +30,11 @@ export async function POST(request) {
         company: (company || (type === 'company' ? companyName : '') || '').substring(0, 100),
         role: role.substring(0, 100),
         profile_url: c.profileUrl?.trim(),
-        profile_image_url: c.imageUrl || null,
+        // Only a photo already saved on this computer. The scanner sends
+        // LinkedIn's link here, then saves the picture and attaches its file
+        // through /api/update-images; kept, the link would replace a saved
+        // photo on every rescan, and the app never shows one (lib/photos.js).
+        profile_image_url: localPhoto(c.imageUrl),
         connected_date: toIsoDate(c.connectedDate),
         // LinkedIn's own count, read off a circle's result card; nothing else sends one.
         mutual_count: degree === 2 ? mutualCountOf(c.mutualCount) : null,

package/.next/standalone/app/api/scraper/route.js

@@ -9,6 +9,8 @@ import { pausedList, readProgress, readUnclear } from '../../../lib/paused';
 import { getDb } from '../../../lib/db-client';
 import { registerScanState } from '../../../lib/scan-state';
 import { pendingImport } from '../../../lib/data-import';
+import { waitingPhotoCount } from '../../../lib/photos';
+import { reachIndex, circleState } from '../../../lib/reach';
 import {
   pythonLooker, thisHostKey, scannerCommand, installSteps, downloadedPython, downloadVerified,
   placeDownloadedPython, sweepSetupLeftovers, megabytes, SETUP_WORK_PREFIX, ScannerSetupError,
@@ -128,6 +130,53 @@ function bridgeSkips() {
   }
 }
 
+/**
+ * What lib/reach.js needs from the scanner's files to tell who is ready for a
+ * circle scan: whose list is hidden, and whose list has been read even though
+ * nothing in it was saved (everyone on it was already yours). Read on its own,
+ * without the machine checks, because the map asks for it when it loads and
+ * again after every scan.
+ */
+function scanNotes() {
+  let read = [];
+  try {
+    const me = resolveProfile({ create: false });
+    if (me) read = Object.keys(readProgress(dataDir(), me.id));
+  } catch {}
+  return { skips: bridgeSkips(), read };
+}
+
+/**
+ * One of your connections, for the Scan page's "Scan one circle" box (Bridge
+ * Chains and the Degrees panel send people there by id): who they are, and how
+ * their circle stands by the same rule the map uses. Null when not found.
+ */
+function pickedPerson(id) {
+  try {
+    const me = resolveProfile({ create: false });
+    if (!me) return { person: null };
+    const db = getDb();
+    const row = db.prepare(
+      `SELECT id, name, tier, power_score, degree, profile_url, unlocked_from_bridge_id, unlocked_from_name
+         FROM linkedin_connections WHERE id = ? AND user_id = ? AND degree = 1`,
+    ).get(String(id ?? ''), me.id);
+    if (!row) return { person: null };
+    const mapped = db.prepare(
+      'SELECT 1 FROM linkedin_connections WHERE user_id = ? AND degree = 2 AND source_connection_id = ? LIMIT 1',
+    ).get(me.id, row.id);
+    const reach = reachIndex([], mapped ? [{ source_connection_id: row.id }] : [], scanNotes());
+    return {
+      person: {
+        id: row.id, name: row.name, tier: row.tier, power_score: row.power_score,
+        unlocked_from_bridge_id: row.unlocked_from_bridge_id, unlocked_from_name: row.unlocked_from_name,
+      },
+      circle: circleState(row, reach),
+    };
+  } catch {
+    return { person: null };
+  }
+}
+
 // The machine checks (Python, Chrome, signed in) spawn processes, so they are
 // cached for a few seconds, and callers that arrive while a look is under way
 // share it rather than each starting their own Pythons. Everything about the
@@ -227,6 +276,10 @@ async function status() {
     me = resolveProfile({ create: false });
     if (me) network = networkCounts(me.id);
   } catch {}
+  // People whose photo is still a link, which the app doesn't load: Save
+  // photos appears while there are any (lib/photos.js).
+  let photosWaiting = 0;
+  try { photosWaiting = waitingPhotoCount(getDb()); } catch {}
 
   const py = m.python;
   return {
@@ -253,6 +306,7 @@ async function status() {
       signedIn: m.signedIn,
     },
     network,
+    photosWaiting,
     ...job(),
     skips: bridgeSkips(),
     linkedin: linkedinState(dataDir()),
@@ -313,6 +367,8 @@ export async function GET(request) {
   const q = new URL(request?.url || 'http://127.0.0.1/api/scraper').searchParams;
   if (q.has('job')) return Response.json(job());
   if (q.has('resume')) return Response.json({ resume: resumePoint(q.get('resume')) });
+  if (q.has('reach')) return Response.json(scanNotes());
+  if (q.has('person')) return Response.json(pickedPerson(q.get('person')));
   return Response.json(await status());
 }
 
@@ -331,7 +387,10 @@ const ACTIONS = {
   // Hidden profiles are remembered so they are not retried forever; this is
   // the way back in without a terminal.
   'auto-bridge-retry': { flag: '--auto-bridge --retry-private', label: 'Mapping every bridge, hidden ones included' },
-  bridge:        { flag: '--bridge',   needsName: true, label: 'Mapping the circle behind' },
+  // One person's circle, from page 1. By profile URL when the page sends their
+  // id, as every Scan button does: two connections can share a name, and by name
+  // the scanner reads whichever was saved first. By name for a caller with no id.
+  bridge:        { flag: '--bridge',   needsName: true, byId: true, label: 'Mapping the circle behind' },
   // Carry on with one person whose read was cut short. By profile URL, not name:
   // two connections can share a name, and Resume must reach the one clicked.
   resume:        { flag: '--bridge-url', needsId: true, label: 'Carrying on with', searches: true },
@@ -339,6 +398,9 @@ const ACTIONS = {
   'resume-all':  { flag: '--auto-bridge --only-unfinished', label: 'Carrying on with every paused list', searches: true },
   rescrape:      { flag: '--rescrape', needsName: true, label: 'Re-mapping the circle behind' },
   company:       { flag: '--company',  needsName: true, label: 'Scanning' },
+  // Photos an older version kept as links to LinkedIn: saved here, once each.
+  // No browser, no search; every scan does the same at its end.
+  photos:        { flag: '--save-photos', label: 'Saving profile photos to this computer' },
 };
 
 /** Only a plain linkedin.com/in/ profile URL becomes an argument. */
@@ -450,7 +512,7 @@ export async function POST(request) {
 
   // The two settings a person changes here. Neither starts anything.
   if (action === 'set-limits') {
-    const limits = writeLimits(dataDir(), { daily: body.daily, monthly: body.monthly });
+    const limits = writeLimits(dataDir(), { daily: body.daily, monthly: body.monthly, profiles: body.profiles });
     return Response.json({ ok: true, limits });
   }
   if (action === 'lift-cooldown') {
@@ -479,16 +541,19 @@ export async function POST(request) {
   const readsCircles = action.startsWith('auto-bridge') || ['bridge', 'rescrape', 'resume', 'resume-all'].includes(action);
   // Carry on with people already mapped, from the page each one stopped at.
   const deeper = body.deeper === true && (action.startsWith('auto-bridge') || action === 'bridge');
+  // Resume, and a circle scan of someone picked by id, go by the connection's
+  // profile URL rather than a name.
+  const byId = spec.needsId || (spec.byId && Boolean(body.id));
   let name = null;
-  if (spec.needsName) {
+  if (spec.needsName && !byId) {
     name = cleanName(body.name);
     if (!name) return Response.json({ error: 'A name is required for this action.' }, { status: 400 });
   }
-  // Resume sends the connection's id; the URL is looked up here, for this
-  // profile, so nothing from the request itself reaches the command line.
+  // The id comes from the page; the URL is looked up here, for this profile, so
+  // nothing from the request itself reaches the command line.
   let profileUrl = null;
   let person = null;
-  if (spec.needsId) {
+  if (byId) {
     try {
       const me = resolveProfile({ create: false });
       person = me && getDb().prepare(
@@ -500,8 +565,8 @@ export async function POST(request) {
   }
   // Who the job is of, so every Scan button can say whose scan is running and a
   // profile card can show its own person's progress. Only ever shown: the id
-  // sent alongside a name never reaches the command line (the name does, as
-  // always), and anything not shaped like one of our ids is dropped.
+  // never reaches the command line (a name or the URL looked up for it does),
+  // and anything not shaped like one of our ids is dropped.
   const hintId = typeof body.id === 'string' && /^[\w-]{1,64}$/.test(body.id) ? body.id : null;
   const target = name || profileUrl ? { id: hintId, name: name || person?.name || null } : null;
   // Nothing that searches LinkedIn starts during a cooldown; the scanner checks
@@ -552,8 +617,11 @@ export async function POST(request) {
     // app is inside the signed app (lib/scanner-python.js scannerCommand).
     plan = [scannerCommand(found.run, path.join(root, 'scripts', 'scrape.py'), [
       // `--flag=value` is one token on purpose: a name beginning with
-      // "-" can then never be read as a flag of its own.
-      ...(name ? [`${spec.flag}=${name}`] : profileUrl ? [`${spec.flag}=${profileUrl}`] : spec.flag.split(' ')),
+      // "-" can then never be read as a flag of its own. Anyone found by
+      // id is --bridge-url, which carries on where their last read stopped
+      // unless told to start at page 1.
+      ...(name ? [`${spec.flag}=${name}`] : profileUrl ? [`--bridge-url=${profileUrl}`] : spec.flag.split(' ')),
+      ...(profileUrl && action === 'bridge' && !deeper ? ['--from-start'] : []),
       ...(maxBridges && (action.startsWith('auto-bridge') || action === 'resume-all') ? [`--max-bridges=${maxBridges}`] : []),
       ...(tiers.length && action.startsWith('auto-bridge') ? [`--tiers=${tiers.join(',')}`] : []),
       ...(action.startsWith('auto-bridge') ? [`--order=${order}`] : []),
@@ -575,7 +643,7 @@ export async function POST(request) {
   state.target = target;
   state.exitCode = null;
   state.startedAt = Date.now();
-  state.log = [spec.label + (name ? ` ${name}…` : '…')];
+  state.log = [spec.label + (target?.name ? ` ${target.name}…` : '…')];
   state.stderrTail = [];
   state.failure = null;
   forgetChecks();

package/.next/standalone/app/api/update-images/route.js

@@ -1,4 +1,6 @@
 import { db as supabase } from '../../../lib/db';
+import { getDb } from '../../../lib/db-client';
+import { localPhoto, waitingPhotos } from '../../../lib/photos';
 
 const CORS_HEADERS = {
   'Access-Control-Allow-Origin': '*',
@@ -10,29 +12,61 @@ export async function OPTIONS() {
   return new Response(null, { status: 204, headers: CORS_HEADERS });
 }
 
+// The photos still kept as links, for the scanner to save: at the end of a
+// scan, and for Save photos on the Scan page (scrape.py save_waiting_photos).
+// A read, so no CORS header: another site's page can't see the answer.
+export async function GET() {
+  try {
+    return Response.json({ waiting: waitingPhotos(getDb()) });
+  } catch (err) {
+    return Response.json({ error: err.message }, { status: 500 });
+  }
+}
+
+// `images`: [{ profileUrl, imageUrl }], each a photo the scanner has saved,
+// attached to every row of that person. Only a saved file's path is stored,
+// never a link (lib/photos.js).
+//
+// `forget`: [{ profileUrl, imageUrl }], links the scanner got a definite no for
+// (expired, not LinkedIn's, not a picture, or the same picture as someone
+// else's), never one it couldn't reach. The link is cleared, and only where it
+// is still that link, so each is tried once and the person shows initials.
 export async function POST(request) {
   try {
-    const { images } = await request.json();
+    const { images, forget } = await request.json();
 
-    if (!images || !Array.isArray(images)) {
+    if ((!images || !Array.isArray(images)) && !Array.isArray(forget)) {
       return Response.json({ error: 'Missing images array' }, { status: 400, headers: CORS_HEADERS });
     }
 
     let updated = 0;
-    for (let i = 0; i < images.length; i += 20) {
-      const batch = images.slice(i, i + 20);
+    const saved = Array.isArray(images) ? images : [];
+    for (let i = 0; i < saved.length; i += 20) {
+      const batch = saved.slice(i, i + 20);
       const promises = batch.map(({ profileUrl, imageUrl }) => {
-        if (!profileUrl || !imageUrl) return Promise.resolve();
+        const photo = localPhoto(imageUrl);
+        if (!profileUrl || !photo) return Promise.resolve();
         return supabase
           .from('linkedin_connections')
-          .update({ profile_image_url: imageUrl })
+          .update({ profile_image_url: photo })
           .eq('profile_url', profileUrl)
           .then(({ error }) => { if (!error) updated++; });
       });
       await Promise.all(promises);
     }
 
-    return Response.json({ success: true, updated }, { headers: CORS_HEADERS });
+    let forgotten = 0;
+    for (const { profileUrl, imageUrl } of Array.isArray(forget) ? forget : []) {
+      if (typeof profileUrl !== 'string' || typeof imageUrl !== 'string' || !imageUrl || localPhoto(imageUrl)) continue;
+      const { data, error } = await supabase
+        .from('linkedin_connections')
+        .update({ profile_image_url: null })
+        .eq('profile_url', profileUrl)
+        .eq('profile_image_url', imageUrl);
+      if (!error && data?.length) forgotten++;
+    }
+
+    return Response.json({ success: true, updated, forgotten }, { headers: CORS_HEADERS });
   } catch (err) {
     return Response.json({ error: err.message }, { status: 500, headers: CORS_HEADERS });
   }

package/.next/standalone/app/avatars/[file]/route.js

@@ -1,12 +1,14 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
 import { dataDir } from '../../../lib/db-client';
-import { AVATAR_FILE } from '../../../lib/data-folder';
+import { AVATAR_FILE } from '../../../lib/photos';
 
 // Avatars are captured by the scraper and live in the user's data directory,
 // never inside the app package — an installed copy must not write into its own
 // files, and real faces must never end up in the repo. Rows store the path
 // `/avatars/<name>.webp`, so this route resolves that to ~/.six-degrees/avatars.
+// It is the only place a page gets a photo from (lib/photos.js): reading one
+// never goes online.
 
 export async function GET(_request, { params }) {
   const { file } = await params;
@@ -26,6 +28,9 @@ export async function GET(_request, { params }) {
         'Content-Type': type,
         // Content-addressed filenames, so they can be cached indefinitely.
         'Cache-Control': 'public, max-age=31536000, immutable',
+        // A photo that came in with an import is only as good as its name: never
+        // let the browser read one as anything but the image type it claims.
+        'X-Content-Type-Options': 'nosniff',
       },
     });
   } catch {

package/.next/standalone/app/components/Avatar.js

@@ -1,6 +1,7 @@
 'use client';
 
 import { initialsFor } from '../../lib/tiers';
+import { localPhoto } from '../../lib/photos';
 
 const FALLBACK = { S: '#FFD700', A: '#9B59B6', B: '#3498DB', C: '#95A5A6', D: '#BDC3C7' };
 
@@ -9,8 +10,10 @@ const FALLBACK = { S: '#FFD700', A: '#9B59B6', B: '#3498DB', C: '#95A5A6', D: '#
 // Most people have no photo, so the initials disc is the common case, not the
 // fallback — and it sits UNDER the photo, so a photo that fails to load just
 // reveals it. No state, and no reaching into a sibling node to un-hide it.
+// Only a photo saved on this computer is drawn (lib/photos.js).
 export default function Avatar({ person, size = 32, tierColors = FALLBACK }) {
   const c = tierColors[person?.tier] || '#666';
+  const photo = localPhoto(person?.profile_image_url);
   return (
     <span style={{
       position: 'relative', display: 'inline-block', width: size, height: size, flexShrink: 0,
@@ -20,9 +23,9 @@ export default function Avatar({ person, size = 32, tierColors = FALLBACK }) {
         position: 'absolute', inset: 0, borderRadius: '50%', display: 'flex', alignItems: 'center', justifyContent: 'center',
         background: `${c}2e`, color: c, fontWeight: 800, fontSize: Math.max(7, Math.round(size * 0.36)), lineHeight: 1,
       }}>{initialsFor(person?.name)}</span>
-      {person?.profile_image_url && (
+      {photo && (
         <img
-          src={person.profile_image_url}
+          src={photo}
           alt=""
           loading="lazy"
           decoding="async"