six-degrees 0.5.0 → 0.6.0

package/.next/standalone/scripts/build-desktop.mjs

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+// Build the desktop app for Windows or Linux (docs/brain/DESKTOP.md D3).
+//
+//   node scripts/build-desktop.mjs --platform=win32   # on Windows: dist/Six-Degrees-<v>-win-x64-Setup.exe
+//   node scripts/build-desktop.mjs --platform=linux   # on Linux:   dist/six-degrees_<v>_amd64.deb and a .tar.gz
+//   --fast   reuse the existing Next build (only while working on the packaging itself)
+//
+// The same app as the Mac's (scripts/build-app.mjs, left untouched): the same
+// standalone server on the same bundled Node, the same Electron shell
+// (desktop/), and the scanner's own Python with its packages installed, so
+// nothing needs installing before a scan. What differs is only the packaging:
+//   Windows  @electron/packager, then Inno Setup (preinstalled on GitHub's
+//            windows runners) for a one-click, per-user Setup.exe with Start
+//            Menu and Desktop shortcuts. No admin rights asked for.
+//   Linux    @electron/packager, then a .deb (chrome-sandbox setuid root, which
+//            Electron needs on Ubuntu 24.04 and later) and a plain .tar.gz.
+// Unsigned, like the Mac app until D4: Windows shows SmartScreen's "More info →
+// Run anyway" the first time.
+//
+// Built on the platform it is for (release.yml has a job each): pip installs
+// the Python's packages by running that Python. No new npm dependency: packager
+// is the Mac build's, the icons come from sharp (Next's), Inno Setup and
+// dpkg-deb are the runners' own.
+
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  mkdirSync, rmSync, cpSync, writeFileSync, existsSync, readFileSync, readdirSync, renameSync, chmodSync, symlinkSync,
+  realpathSync, statSync,
+} from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { standaloneBuild, downloadVerified, IMPORTS } from '../lib/scanner-python.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PLATFORM = (process.argv.find((a) => a.startsWith('--platform='))?.split('=')[1]) || process.platform;
+if (!['win32', 'linux'].includes(PLATFORM)) {
+  console.error('Usage: node scripts/build-desktop.mjs --platform=win32|linux (the Mac app is scripts/build-app.mjs)');
+  process.exit(2);
+}
+if (PLATFORM !== process.platform) {
+  console.error(`Build the ${PLATFORM} app on ${PLATFORM}: pip installs its Python's packages by running that Python.`);
+  process.exit(2);
+}
+const WIN = PLATFORM === 'win32';
+const ARCH = 'x64';
+const pkg = JSON.parse(readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+const VERSION = pkg.version;
+const APP_NAME = 'Six Degrees';
+const OUT = path.join(ROOT, 'dist');
+const STAGE = path.join(OUT, 'stage');
+const CACHE = path.join(os.homedir(), '.cache', 'six-degrees-build');
+// Windows' own tar (bsdtar): it reads .zip as well, and a bash step's PATH finds
+// Git's GNU tar first, which takes "C:" for a remote host.
+const TAR = WIN ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') : 'tar';
+
+// The same Node as the Mac app's server, pinned by its SHA-256 from nodejs.org's SHASUMS256.txt.
+const NODE_VERSION = 'v24.21.0';
+const NODE = WIN
+  ? { file: `node-${NODE_VERSION}-win-x64.zip`, sha256: '158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541', size: 37618919, member: `node-${NODE_VERSION}-win-x64/node.exe` }
+  : { file: `node-${NODE_VERSION}-linux-x64.tar.gz`, sha256: '6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff', size: 58088022, member: `node-${NODE_VERSION}-linux-x64/bin/node` };
+
+function step(msg) { console.log(`\n▸ ${msg}`); }
+function run(cmd, args, opts = {}) {
+  execFileSync(cmd, args, { stdio: 'inherit', ...opts });
+}
+function sha256File(file) {
+  return createHash('sha256').update(readFileSync(file)).digest('hex');
+}
+async function fetchPinned({ url, file, sha256, size }, what) {
+  const archive = path.join(CACHE, file);
+  mkdirSync(CACHE, { recursive: true });
+  if (existsSync(archive) && sha256File(archive) === sha256) {
+    console.log(`  ${what}: using the cached download (its SHA-256 matches the pinned one)`);
+  } else {
+    rmSync(archive, { force: true });
+    await downloadVerified(url, archive, { sha256, size, idleMs: 60000, from: new URL(url).host });
+    console.log(`  ${what}: downloaded, and its SHA-256 matches the pinned one`);
+  }
+  return archive;
+}
+function findDirs(dir, match) {
+  const found = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const at = path.join(dir, entry.name);
+    if (match(entry.name)) found.push(at);
+    else found.push(...findDirs(at, match));
+  }
+  return found;
+}
+function* walk(dir) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const at = path.join(dir, entry.name);
+    if (entry.isDirectory()) yield* walk(at);
+    else yield at;
+  }
+}
+
+// ---- 1. the app itself (always rebuilt: build-app.mjs says why) -------------
+rmSync(OUT, { recursive: true, force: true });
+step('Building the app');
+if (process.argv.includes('--fast') && existsSync(path.join(ROOT, '.next', 'standalone', 'server.js'))) {
+  console.log('  --fast: reusing the existing build (make sure it is current)');
+} else {
+  // node, not npm: execFile can't start npm.cmd on Windows.
+  run(process.execPath, [path.join(ROOT, 'scripts', 'next.mjs'), 'build'], { cwd: ROOT });
+  run(process.execPath, [path.join(ROOT, 'scripts', 'prepare-standalone.mjs')], { cwd: ROOT });
+}
+
+step('Assembling the server');
+const SERVER_DIR = path.join(STAGE, 'server');
+mkdirSync(STAGE, { recursive: true });
+cpSync(path.join(ROOT, '.next', 'standalone'), SERVER_DIR, { recursive: true, verbatimSymlinks: true });
+if (existsSync(path.join(SERVER_DIR, '.git'))) rmSync(path.join(SERVER_DIR, '.git'), { recursive: true, force: true });
+// The files the app runs from scripts/, by name (TRAPS §27). Not apply-update.sh:
+// only the Mac app replaces itself; here an update is the new installer, and a
+// missing helper is one more thing that keeps the Mac swap from ever running.
+for (const rel of ['scripts/scrape.py', 'scripts/image_store.py', 'scripts/requirements.txt', 'scripts/audit-avatars.mjs']) {
+  mkdirSync(path.join(SERVER_DIR, path.dirname(rel)), { recursive: true });
+  cpSync(path.join(ROOT, rel), path.join(SERVER_DIR, rel));
+}
+
+// ---- 2. the runtime ----------------------------------------------------------
+step(`Fetching Node ${NODE_VERSION}`);
+const nodeArchive = await fetchPinned({ url: `https://nodejs.org/dist/${NODE_VERSION}/${NODE.file}`, ...NODE }, 'Node');
+run(TAR, ['-xf', nodeArchive, '-C', CACHE, NODE.member]);
+const NODE_OUT = path.join(STAGE, WIN ? 'node.exe' : 'node');
+cpSync(path.join(CACHE, NODE.member), NODE_OUT);
+if (!WIN) chmodSync(NODE_OUT, 0o755);
+
+// ---- 3. the icon ---------------------------------------------------------------
+// From desktop/icon/icon.svg, like the Mac's .icns (not app/favicon.ico: that is
+// Next's default, Vercel's mark). A .ico is PNGs in a small directory; sharp makes the PNGs.
+step('Making the icon');
+const { default: sharp } = await import('sharp');
+const svg = path.join(ROOT, 'desktop', 'icon', 'icon.svg');
+const png = async (size) => sharp(svg, { density: 288 }).resize(size, size).png().toBuffer();
+let ICON;
+if (WIN) {
+  const sizes = [16, 24, 32, 48, 64, 128, 256];
+  const images = await Promise.all(sizes.map(png));
+  const header = Buffer.alloc(6 + 16 * sizes.length);
+  header.writeUInt16LE(0, 0); header.writeUInt16LE(1, 2); header.writeUInt16LE(sizes.length, 4);
+  let offset = header.length;
+  sizes.forEach((size, i) => {
+    const at = 6 + 16 * i;
+    header.writeUInt8(size >= 256 ? 0 : size, at); header.writeUInt8(size >= 256 ? 0 : size, at + 1);
+    header.writeUInt8(0, at + 2); header.writeUInt8(0, at + 3);
+    header.writeUInt16LE(1, at + 4); header.writeUInt16LE(32, at + 6);
+    header.writeUInt32LE(images[i].length, at + 8); header.writeUInt32LE(offset, at + 12);
+    offset += images[i].length;
+  });
+  ICON = path.join(STAGE, 'six-degrees.ico');
+  writeFileSync(ICON, Buffer.concat([header, ...images]));
+} else {
+  ICON = path.join(STAGE, 'six-degrees.png');
+  writeFileSync(ICON, await png(512));
+}
+
+// ---- 4. the Electron shell ---------------------------------------------------
+step('Building the Electron app');
+const { packager } = await import('@electron/packager');
+const electronVersion = JSON.parse(readFileSync(path.join(ROOT, 'node_modules', 'electron', 'package.json'), 'utf8')).version;
+const shellSrc = path.join(STAGE, 'shell');
+cpSync(path.join(ROOT, 'desktop'), shellSrc, { recursive: true, filter: (p) => !p.split(path.sep).includes('icon') });
+const shellPkg = JSON.parse(readFileSync(path.join(shellSrc, 'package.json'), 'utf8'));
+writeFileSync(path.join(shellSrc, 'package.json'), `${JSON.stringify({ ...shellPkg, version: VERSION }, null, 2)}\n`);
+const [built] = await packager({
+  dir: shellSrc,
+  out: path.join(STAGE, 'out'),
+  overwrite: true,
+  name: APP_NAME,
+  platform: PLATFORM,
+  arch: ARCH,
+  electronVersion,
+  appVersion: VERSION.replace(/-.*/, ''),
+  icon: ICON,
+  asar: true,
+  prune: false,
+  junk: true,
+  extraResource: [SERVER_DIR, NODE_OUT],
+  ...(WIN
+    ? { win32metadata: { CompanyName: 'Six Degrees', ProductName: APP_NAME, FileDescription: APP_NAME, OriginalFilename: `${APP_NAME}.exe` } }
+    : { executableName: 'six-degrees' }),
+});
+const APP_DIR = path.join(OUT, WIN ? 'Six Degrees' : `six-degrees-${VERSION}-linux-x64`);
+renameSync(built, APP_DIR);
+console.log(`  Electron ${electronVersion} (${PLATFORM} ${ARCH})`);
+const RES = path.join(APP_DIR, 'resources');
+
+// ---- 5. the scanner's Python (DESKTOP.md D2, D3) ------------------------------
+const build = standaloneBuild(WIN ? 'win32-x64' : 'linux-x64');
+const xy = build.version.split('.').slice(0, 2).join('.');
+step(`Fetching Python ${build.version}`);
+const pyArchive = await fetchPinned(build, 'Python');
+const PY = path.join(RES, 'python');
+rmSync(PY, { recursive: true, force: true });
+run(TAR, ['-xzf', pyArchive, '-C', RES]);
+const python = WIN ? path.join(PY, 'python.exe') : path.join(PY, 'bin', 'python3');
+const SITE = WIN ? path.join(PY, 'Lib', 'site-packages') : path.join(PY, 'lib', `python${xy}`, 'site-packages');
+// Only this Python's own packages and settings: nothing from the build machine's
+// user site-packages, PYTHONPATH or pip configuration. Windows' Python can't start without SYSTEMROOT.
+const pyEnv = WIN
+  ? Object.fromEntries(Object.entries({
+    SYSTEMROOT: process.env.SYSTEMROOT, WINDIR: process.env.WINDIR, TEMP: process.env.TEMP, TMP: process.env.TMP,
+    USERPROFILE: process.env.USERPROFILE, LOCALAPPDATA: process.env.LOCALAPPDATA, APPDATA: process.env.APPDATA,
+    PATH: path.join(process.env.SYSTEMROOT || 'C:\\Windows', 'System32'),
+    PYTHONNOUSERSITE: '1', PYTHONDONTWRITEBYTECODE: '1', PYTHONUTF8: '1',
+  }).filter(([, v]) => v))
+  : { HOME: os.homedir(), TMPDIR: os.tmpdir(), PATH: '/usr/bin:/bin', LANG: 'C.UTF-8', PYTHONNOUSERSITE: '1', PYTHONDONTWRITEBYTECODE: '1' };
+
+step('Installing the scanner\'s packages into it');
+run(python, ['-E', '-s', '-m', 'pip', '--isolated', 'install', '--disable-pip-version-check', '--no-input',
+  '--no-warn-script-location', '--no-compile', '--index-url', 'https://pypi.org/simple',
+  '--cache-dir', path.join(CACHE, 'pip'), '--require-hashes', '--only-binary', ':all:',
+  '-r', path.join(ROOT, 'scripts', 'requirements.txt')], { env: pyEnv });
+run(python, ['-E', '-s', '-m', 'pip', '--isolated', 'check', '--disable-pip-version-check'], { env: pyEnv });
+
+step('Trimming what the scanner never uses');
+const libDir = WIN ? path.join(PY, 'Lib') : path.join(PY, 'lib', `python${xy}`);
+const remove = [
+  ...['idlelib', 'tkinter', 'turtledemo', 'turtle.py', 'lib2to3', 'ensurepip', 'test'].map((n) => path.join(libDir, n)),
+  ...readdirSync(SITE).filter((n) => n === 'pip' || /^pip-.*\.dist-info$/.test(n)).map((n) => path.join(SITE, n)),
+  ...(WIN
+    ? ['Scripts', 'include', 'libs', 'tcl', path.join('DLLs', '_tkinter.pyd'), path.join('DLLs', 'tcl86t.dll'), path.join('DLLs', 'tk86t.dll')].map((n) => path.join(PY, n))
+    : [
+      ...['include', 'share', path.join('lib', 'pkgconfig')].map((n) => path.join(PY, n)),
+      ...readdirSync(path.join(PY, 'lib')).filter((n) => /^(libtcl|libtk|tcl|tk|itcl|thread)/.test(n)).map((n) => path.join(PY, 'lib', n)),
+      ...readdirSync(libDir).filter((n) => n.startsWith('config-')).map((n) => path.join(libDir, n)),
+      ...readdirSync(path.join(libDir, 'lib-dynload')).filter((n) => n.startsWith('_tkinter.')).map((n) => path.join(libDir, 'lib-dynload', n)),
+      ...readdirSync(path.join(PY, 'bin')).filter((n) => ![`python${xy}`, 'python3', 'python'].includes(n)).map((n) => path.join(PY, 'bin', n)),
+    ]),
+];
+for (const p of remove) rmSync(p, { recursive: true, force: true });
+for (const dir of [...findDirs(PY, (n) => n === '__pycache__'), ...findDirs(SITE, (n) => n === 'tests')]) rmSync(dir, { recursive: true, force: true });
+
+// Linux: Playwright's driver carries its own Node; when it is byte for byte the
+// app's, it becomes a relative link to it (as on the Mac). Not on Windows, where
+// a symlink needs admin rights.
+const driverNode = path.join(SITE, 'playwright', 'driver', WIN ? 'node.exe' : 'node');
+if (!WIN && existsSync(driverNode) && sha256File(driverNode) === sha256File(path.join(RES, 'node'))) {
+  rmSync(driverNode);
+  symlinkSync(path.relative(path.dirname(driverNode), path.join(RES, 'node')), driverNode);
+  if (realpathSync(driverNode) !== realpathSync(path.join(RES, 'node'))) throw new Error('The driver\'s link to the app\'s Node is wrong.');
+  console.log('  Playwright runs on the app\'s own Node');
+}
+
+step('Checking the Python inside the app');
+// As the app runs it (lib/scanner-python.js OWN_PYTHON_FLAGS), with a "→" to
+// prove its output is UTF-8 on Windows too.
+const check = `${IMPORTS}; import sys, zoneinfo; zoneinfo.ZoneInfo('America/Los_Angeles'); from importlib.metadata import version as v; print('→ Python', sys.version.split()[0], '· Playwright', v('playwright'))`;
+run(python, ['-E', '-s', '-B', '-u', '-X', 'utf8', '-c', check], { env: pyEnv });
+run(driverNode, [path.join(SITE, 'playwright', 'driver', 'package', 'cli.js'), '--version'], { env: { ...pyEnv } });
+for (const dir of findDirs(PY, (n) => n === '__pycache__')) rmSync(dir, { recursive: true, force: true });
+
+// Windows' 260-character path limit: installed under
+// C:\Users\<name>\AppData\Local\Programs\Six Degrees\ (about 70), the deepest file must still fit.
+if (WIN) {
+  let longest = '';
+  for (const f of walk(APP_DIR)) { const rel = path.relative(APP_DIR, f); if (rel.length > longest.length) longest = rel; }
+  console.log(`  longest path inside the app: ${longest.length} characters`);
+  if (longest.length > 170) throw new Error(`${longest} is too long for Windows once installed.`);
+}
+
+// ---- 6. the packages ---------------------------------------------------------------
+if (WIN) {
+  step('Building Setup.exe (Inno Setup)');
+  const iscc = [
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Inno Setup 6', 'ISCC.exe'),
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Inno Setup 6', 'ISCC.exe'),
+  ].find((p) => existsSync(p));
+  if (!iscc) throw new Error('Inno Setup 6 (ISCC.exe) isn\'t installed.');
+  const numeric = `${VERSION.replace(/-.*/, '')}.0`;
+  run(iscc, ['/Qp', `/DAppVersion=${VERSION}`, `/DNumericVersion=${numeric}`, `/DSourceDir=${APP_DIR}`,
+    `/DOutputDir=${OUT}`, `/DIconFile=${ICON}`, path.join(ROOT, 'scripts', 'windows', 'six-degrees.iss')]);
+  const setup = path.join(OUT, `Six-Degrees-${VERSION}-win-x64-Setup.exe`);
+  if (!existsSync(setup)) throw new Error('Inno Setup didn\'t write Setup.exe.');
+  console.log(`  ${path.relative(ROOT, setup)} (${Math.round(statSync(setup).size / 1e6)} MB)`);
+} else {
+  step('Building the .tar.gz and the .deb');
+  // Readable by everyone, writable by the owner: packager's output folder is
+  // private (700, it's made as a temporary folder), and installed as root from
+  // the .deb that left /opt/six-degrees unreadable to the user who runs it.
+  run('chmod', ['-R', 'u+rwX,go+rX,go-w', APP_DIR]);
+  run('tar', ['-C', OUT, '-czf', path.join(OUT, `Six-Degrees-${VERSION}-linux-x64.tar.gz`), path.basename(APP_DIR)]);
+  const deb = path.join(STAGE, 'deb');
+  rmSync(deb, { recursive: true, force: true });
+  mkdirSync(path.join(deb, 'opt'), { recursive: true });
+  // cp -a, not cpSync: links stay relative (TRAPS §37).
+  run('cp', ['-a', APP_DIR, path.join(deb, 'opt', 'six-degrees')]);
+  // Electron's sandbox helper must be root's and setuid on Ubuntu 24.04 and later,
+  // or the app won't start (dpkg-deb --root-owner-group makes it root's).
+  chmodSync(path.join(deb, 'opt', 'six-degrees', 'chrome-sandbox'), 0o4755);
+  mkdirSync(path.join(deb, 'usr', 'bin'), { recursive: true });
+  symlinkSync('../../opt/six-degrees/six-degrees', path.join(deb, 'usr', 'bin', 'six-degrees'));
+  mkdirSync(path.join(deb, 'usr', 'share', 'applications'), { recursive: true });
+  writeFileSync(path.join(deb, 'usr', 'share', 'applications', 'six-degrees.desktop'), [
+    '[Desktop Entry]', 'Type=Application', 'Name=Six Degrees', 'Comment=See your LinkedIn network as a galaxy, on your own computer',
+    'Exec=/opt/six-degrees/six-degrees %U', 'Icon=six-degrees', 'Terminal=false', 'Categories=Office;Network;', 'StartupWMClass=Six Degrees', '',
+  ].join('\n'));
+  mkdirSync(path.join(deb, 'usr', 'share', 'icons', 'hicolor', '512x512', 'apps'), { recursive: true });
+  cpSync(ICON, path.join(deb, 'usr', 'share', 'icons', 'hicolor', '512x512', 'apps', 'six-degrees.png'));
+  mkdirSync(path.join(deb, 'DEBIAN'), { recursive: true });
+  // A hyphen would be read as a Debian revision: 0.5.1-beta.1 is 0.5.1~beta.1 (which sorts before 0.5.1).
+  const debVersion = VERSION.replace('-', '~');
+  const kb = Number(execFileSync('du', ['-sk', path.join(deb, 'opt')]).toString().split(/\s+/)[0]);
+  writeFileSync(path.join(deb, 'DEBIAN', 'control'), [
+    'Package: six-degrees', `Version: ${debVersion}`, 'Architecture: amd64', 'Section: utils', 'Priority: optional',
+    'Maintainer: Six Degrees <noreply@sixdegreesapp.com>', 'Homepage: https://sixdegreesapp.com',
+    `Installed-Size: ${kb}`,
+    'Depends: libgtk-3-0t64 | libgtk-3-0, libnss3, libxss1, libxtst6, libasound2t64 | libasound2, libgbm1, libdrm2, xdg-utils',
+    'Recommends: google-chrome-stable',
+    'Description: See your LinkedIn network as a galaxy, on your own computer',
+    ' Six Degrees maps the people you know and the people they know, ranks who can',
+    ' introduce you to whom, and keeps all of it on this computer. Scanning drives',
+    ' your own Google Chrome, which it needs for that part only.', '',
+  ].join('\n'));
+  const debFile = path.join(OUT, `six-degrees_${debVersion}_amd64.deb`);
+  run('dpkg-deb', ['--root-owner-group', '-Zxz', '--build', deb, debFile]);
+  console.log(`  ${path.relative(ROOT, debFile)} (${Math.round(statSync(debFile).size / 1e6)} MB)`);
+}
+rmSync(STAGE, { recursive: true, force: true });
+console.log('\n✓ done');

package/.next/standalone/scripts/build-site.mjs

@@ -24,7 +24,7 @@ import { execFileSync } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import {
-  generate, fill, fullReleases, parseChangelog, changeCounts, highlights, longDate, countTests,
+  generate, fill, fullReleases, parseChangelog, changeCounts, highlights, longDate, countTests, anchor, releaseChartHtml,
 } from './site-news.mjs';
 import { markdown, frontMatter, htmlFrontMatter, escapeHtml, plainText } from './site-markdown.mjs';
 
@@ -36,7 +36,6 @@ const TEASERS = 3;
 
 const read = (root, f) => readFileSync(path.join(root, f), 'utf8');
 const shortDate = (iso) => longDate(iso).replace(/ (\w{3})\w* /, ' $1 ');
-const anchor = (version) => `v${version}`;
 
 // ---------------------------------------------------------------- loading
 
@@ -289,18 +288,82 @@ ${post.html}
 }
 
 /**
- * The generations before this codebase, shown on /releases/ under "Before 0.1".
- * Dates and one line each: their repositories are private, so they're never
- * linked. Not in the releases feed: they aren't releases of this app.
+ * What came before 0.1.0, shown on /releases/ under "Before 0.1", newest first:
+ * the first build (June, "Alpha"), the static version (July, "Beta") and the
+ * open-source rebuild's first month (August and September, "Preview"), one
+ * entry for each day the work landed (Blake, 2026-10-02: showing it as one
+ * block "doesn't represent it properly"). Taken from each repository's commit
+ * history, with the dates the commits carry. They were never downloads, and
+ * the first two repositories are private, so nothing here links to them.
+ * Not in the releases feed: they aren't releases of this app.
+ *
+ * `commits` sizes each one's bar in the chart at the top of /releases/ (Blake,
+ * 2026-10-03: the chart began at "a really stacked 0.1.0"): the commits that
+ * landed for it, from the day after the one before up to its own, counted by
+ * the day in Florida, in that milestone's own repository (the first build's
+ * repository, the static version's, then this one). There was no changelog to
+ * count changes from yet.
  */
 export const BEFORE = [
   {
-    id: 'beta-static', stage: 'Beta', date: '2026-07-12', title: 'The static version',
+    id: 'preview-6', commits: 14, stage: 'Preview', date: '2026-09-10', title: 'Preview 6: one-command updates',
+    text: 'Updating became one command that can\'t half-succeed, the app said when its server was older than its files, and the front page told the truth about how to run it.',
+  },
+  {
+    id: 'preview-5', commits: 23, stage: 'Preview', date: '2026-09-09', title: 'Preview 5: the scanner, end to end',
+    text: 'Who introduced whom was remembered, with a note when they accepted; each photo matched to the right person; the dial paged through every bridge; and the map said how much of the network was actually mapped.',
+  },
+  {
+    id: 'preview-4', commits: 4, stage: 'Preview', date: '2026-09-01', title: 'Preview 4: open source',
+    text: 'The rebuild went public on GitHub, and the earlier versions\' repositories went private.',
+  },
+  {
+    id: 'preview-3', commits: 4, stage: 'Preview', date: '2026-08-25', title: 'Preview 3: signing in first',
+    text: 'The scanner waited for you to sign in to LinkedIn yourself before reading anything, a first scan read your whole list, and loading the sample network could be undone.',
+  },
+  {
+    id: 'preview-2', commits: 9, stage: 'Preview', date: '2026-08-24', title: 'Preview 2: one command to run it',
+    text: 'Packaged to run with one command, with an invented sample network and a real empty state, and two security holes closed (a cross-site write and stored script injection).',
+  },
+  {
+    id: 'preview-1', commits: 10, stage: 'Preview', date: '2026-08-21', title: 'Preview 1: the open-source rebuild begins',
+    text: 'This codebase starts: the hosted database replaced by a local one on your own computer, the scanner\'s last ties to the cloud cut, and checks that keep secrets and personal data out of the code.',
+  },
+  {
+    id: 'beta-3', commits: 2, stage: 'Beta', date: '2026-07-15', title: 'Beta 3: scanning from inside the app',
+    text: 'The scanner ran from the app itself, with its progress shown live, and one command started everything.',
+  },
+  {
+    id: 'beta-2', commits: 6, stage: 'Beta', date: '2026-07-13', title: 'Beta 2: local-first, for real',
+    text: 'A local database server on your own computer, a hardened scanner, and the first build\'s features brought back where they were safe for a demo.',
+  },
+  {
+    id: 'beta-static', commits: 7, stage: 'Beta', date: '2026-07-12', title: 'Beta 1: the static version',
     text: 'Your LinkedIn network as a galaxy, with leverage tiers, bridges and introduction paths. Local-first and entirely static: the first version where your data never left your device.',
   },
   {
-    id: 'alpha-first-build', stage: 'Alpha', date: '2026-06-11', title: 'The first build',
-    text: '"6 Degrees of Separation": a LinkedIn network research tool with a force-directed D3 graph, hosted online. Where Six Degrees started.',
+    id: 'alpha-6', commits: 12, stage: 'Alpha', date: '2026-06-18', title: 'Alpha 6: on your phone, and a launch page',
+    text: 'A layout for phones, with a touch dial for spinning through a bridge\'s circle, and a showcase page for the launch.',
+  },
+  {
+    id: 'alpha-5', commits: 48, stage: 'Alpha', date: '2026-06-16', title: 'Alpha 5: chains',
+    text: 'The Chain view, where Bridge Chains began: hover a bridge to see their circle, and the people in it who could lead one step further.',
+  },
+  {
+    id: 'alpha-4', commits: 66, stage: 'Alpha', date: '2026-06-15', title: 'Alpha 4: more than one network',
+    text: 'Each person\'s network kept apart from everyone else\'s, a bulk import, company scores of your own, and Paths reading companies from headlines.',
+  },
+  {
+    id: 'alpha-3', commits: 20, stage: 'Alpha', date: '2026-06-14', title: 'Alpha 3: who to add next',
+    text: 'A ranked list of who to add next (where Outlink began), a profile page with a level, points and milestones, and cluster cards you could open.',
+  },
+  {
+    id: 'alpha-2', commits: 25, stage: 'Alpha', date: '2026-06-12', title: 'Alpha 2: photos and clusters',
+    text: 'Profile photos on the map and the cards, the most valuable clusters ranked, and your bridges orbiting you by tier.',
+  },
+  {
+    id: 'alpha-first-build', commits: 58, stage: 'Alpha', date: '2026-06-11', title: 'Alpha 1: the first build',
+    text: '"6 Degrees of Separation": a LinkedIn network research tool with a force-directed D3 graph, hosted online, with a setup page and a launcher you could double-click. Where Six Degrees started.',
     archive: 'https://six-degrees-linkedin.vercel.app/',
     image: { src: '/img/first-build-june-2026.jpg', alt: 'The first build\'s welcome screen: 6 Degrees of Separation, Map your LinkedIn power network', width: 800, height: 500, caption: 'The first build, June 2026' },
   },
@@ -309,7 +372,7 @@ export const BEFORE = [
 export function beforeHtml() {
   const entries = BEFORE.map((b) => `      <article class="release archive" id="${b.id}">
         <header>
-          <h2><a href="#${b.id}">${escapeHtml(b.title)}</a> <span class="tag stage">${b.stage}</span></h2>
+          <h2><a href="#${b.id}">${escapeHtml(b.title)}</a> <span class="tag stage s-${b.stage.toLowerCase()}">${b.stage}</span></h2>
           <p class="post-meta"><time datetime="${b.date}">${longDate(b.date)}</time></p>${b.archive ? `
           <p class="release-links"><a href="${b.archive}">Archive: the original prototype (June 2026), kept as it was</a></p>` : ''}
         </header>
@@ -318,8 +381,10 @@ export function beforeHtml() {
       </article>`).join('\n');
   return `      <section class="before" id="before-0-1" aria-labelledby="before-h">
         <h2 id="before-h">Before 0.1</h2>
-        <p class="fine">The generations before this codebase. The open-source rebuild began on
-          <time datetime="2026-08-21">21 August 2026</time> and led to 0.1.0. <a href="/roadmap/#how-it-started">How it started</a>.</p>
+        <p class="fine">Three and a half months before the first release, from the day each piece of work landed: the first
+          build in June (Alpha), the static version in July (Beta), and the open-source rebuild from
+          <time datetime="2026-08-21">21 August 2026</time> (Preview), which led to 0.1.0. Milestones taken from the
+          code's history, not downloads. <a href="/roadmap/#how-it-started">How it started</a>.</p>
 ${entries}
       </section>`;
 }
@@ -355,18 +420,23 @@ ${notes}
         </div>
       </article>`;
   }).join('\n');
-  const toc = `${full.map((r) => `<a href="#${anchor(r.version)}">${escapeHtml(r.version)}</a>`).join(' ')} <a href="#before-0-1">Before 0.1</a>`;
+  // The stages before 0.1 are in the list too, each at its newest milestone.
+  const stages = ['Preview', 'Beta', 'Alpha'].map((st) => BEFORE.find((b) => b.stage === st)).filter(Boolean);
+  const toc = `${full.map((r) => `<a href="#${anchor(r.version)}">${escapeHtml(r.version)}</a>`).join(' ')} <a href="#before-0-1">Before 0.1:</a> ${stages.map((b) => `<a class="stage-link s-${b.stage.toLowerCase()}" href="#${b.id}">${b.stage}</a>`).join(' ')}`;
   const title = 'Release notes: every version of Six Degrees';
   const description = `Everything added, changed and fixed in each of Six Degrees' ${full.length} releases, from ${full.at(-1).version} to ${full[0].version}, newest first.`;
   const main = `${pageHead({ kicker: 'Releases', title: 'Release notes', lede: `Every version, newest first, from the <a href="${REPO}/blob/main/CHANGELOG.md">changelog</a>. Downloads for each are on <a href="${REPO}/releases">GitHub Releases</a>.` })}
     <div class="panel chart-group releases-chart">
       <div class="panel-head">
-        <h2>Every release, by what it changed</h2>
-        <p class="fine">${values['change-count']} changes in ${values['release-count']} releases since ${values['first-release']}. Betas are counted in the release they became.</p>
+        <h2>Every release, and what came before</h2>
+        <p class="fine">${values['change-count']} changes in ${values['release-count']} releases since ${values['first-release']}. Betas are counted in the release they became.
+          Before that, ${BEFORE.length} milestones back to <time datetime="${BEFORE.at(-1).date}">${longDate(BEFORE.at(-1).date)}</time>: the first build (Alpha),
+          the static version (Beta) and the open-source rebuild (Preview), each by the commits that landed for it, as there was no changelog yet. Tap a bar for its notes.</p>
       </div>
       <div class="chart">
-        <div class="bars-box tall">${values['release-chart']}</div>
+        <div class="bars-box tall">${releaseChartHtml(full, BEFORE)}</div>
         <ul class="legend inline" role="list">${KINDS.slice(0, 5).map((k) => `<li class="k-${k}">${k[0].toUpperCase()}${k.slice(1)}</li>`).join('')}</ul>
+        <ul class="legend inline stages" role="list">${['Alpha', 'Beta', 'Preview'].map((s) => `<li class="k-${s.toLowerCase()}">${s}</li>`).join('')}<li class="note">before 0.1, in commits</li></ul>
       </div>
     </div>
     <nav class="release-toc" aria-label="Versions"><span>Jump to</span> ${toc}</nav>

package/.next/standalone/scripts/gen-test-network.mjs

@@ -0,0 +1,93 @@
+// A large, entirely invented network for checking the UI at scale, written
+// straight into a scratch data folder with the app's own schema. Every name,
+// company and profile link comes from the fixed word lists below: nobody real.
+// Never point it at your own data folder (~/.six-degrees): it deletes the
+// database in the folder you give it.
+//
+//   node scripts/gen-test-network.mjs . /tmp/sd-test [--d1 1500] [--bridges 320] [--seed 7]
+//   SIX_DEGREES_HOME=/tmp/sd-test npx next dev -p 3457
+//
+// 1st degree, the first --bridges of them with a scanned circle (a few big ones,
+// then 25 to 175 people), about one in seven 2nd-degree people found through a
+// second bridge as well, eight company scans (3rd degree) and 3,000 ties between
+// your connections.
+import { DatabaseSync } from 'node:sqlite';
+import { mkdirSync, rmSync, existsSync } from 'node:fs';
+import path from 'node:path';
+
+const [repo, home] = process.argv.slice(2);
+if (!repo || !home) { console.error('Usage: node scripts/gen-test-network.mjs <repo> <scratch-folder> [--d1 N] [--bridges N] [--seed N]'); process.exit(2); }
+if (path.resolve(home) === path.resolve(process.env.HOME || '', '.six-degrees')) { console.error('That is your real data folder. Pick a scratch folder.'); process.exit(2); }
+const arg = (k, d) => { const i = process.argv.indexOf(k); return i > -1 ? Number(process.argv[i + 1]) : d; };
+const D1 = arg('--d1', 1500), BRIDGES = arg('--bridges', 320), SEED = arg('--seed', 7);
+const { SCHEMA_SQL } = await import(path.resolve(repo, 'db/schema.js'));
+
+function rng(seed) { let a = seed >>> 0; return () => { a = (a + 0x6d2b79f5) >>> 0; let t = Math.imul(a ^ (a >>> 15), 1 | a); t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t; return ((t ^ (t >>> 14)) >>> 0) / 4294967296; }; }
+const rand = rng(SEED);
+const pick = (a) => a[Math.floor(rand() * a.length)];
+
+const FIRST = 'Ada Bo Cleo Dev Esme Finn Gia Hugo Iris Jai Kira Lev Mina Nils Otto Pia Quinn Rune Sana Tobias Ula Vero Wren Xanthe Yuki Zane Amara Bodhi Cassia Dario Elio Freya Gideon Halle Ines Jonah Kaya Liora Marek Nadia Oona Paolo Rhea Soren Tamsin Ursa Viggo Wilder Ximena Yusuf Zora Callum Delphine Emeka Fiora Gustav Hana Idris Juno Kepler Linnea Mateo Noor'.split(' ');
+const LAST = 'Ashworth Baptiste Calloway Delacroix Eriksen Farrow Gallagher Halvorsen Ibarra Jansson Kowalczyk Lindqvist Marchetti Nakamura Okonkwo Pereira Quintero Rasmussen Silvestri Thorne Ueda Vasquez Whitlock Ximenes Yamamoto Zabala Brennan Castellan Dumont Espinoza Fontaine Grimaldi Hollis Ingram Jokinen Kristiansen Lindgren Moreau Nyberg Ostrowski Petrov Rosales Stavros Tsegaye Varga Weatherby'.split(' ');
+const PRE = 'Northwind Halcyon Verity Lumen Kestrel Meridian Orchard Tessellate Bright Harbor Ironwood Sable Cobalt Fernhill Ridgeline Aperture Quarry Blue Larch Everly Pinecrest Solace Amberly Quillon Vantor Brisk Ostara Calder Wynd Marlow Tamber Juniper Oberon Kinetic Sterling Driftwood Lanternfish Copperleaf Silvergate Redfern Hollow Crestline Bramble Mossbank'.split(' ');
+const SUF = ['Labs','Health','Capital','Media','Foods','University','Consulting','Robotics','Studios','Energy','Realty','Analytics','Software','Bank','Logistics','Group','Partners','Ventures','Clinic','Games','Foundation','Systems','Retail','Law'];
+const COMPANIES = [];
+for (const p of PRE) for (const s of SUF) if (rand() < 0.55) COMPANIES.push(`${p} ${s}`);
+// Zipf-ish: a few big employers, a long tail.
+const weights = COMPANIES.map((_, i) => 1 / Math.pow(i + 1, 0.8));
+const wTotal = weights.reduce((a, b) => a + b, 0);
+function company() { let r = rand() * wTotal; for (let i = 0; i < COMPANIES.length; i++) if ((r -= weights[i]) < 0) return COMPANIES[i]; return COMPANIES[0]; }
+const TITLES = ['Chief Executive Officer','Founder','Co-Founder','President','Chief Technology Officer','CFO','VP of Engineering','VP of Marketing','SVP of Operations','Managing Director','Partner','Director of Product','Director of Engineering','Head of Growth','Head of Design','Senior Engineering Manager','Group Product Manager','Engineering Manager','Principal Engineer','Staff Software Engineer','Lead Data Scientist','Senior Software Engineer','Senior Product Designer','Senior Manager, Partnerships','Account Manager','Client Partner','Brand Strategist','Software Engineer','Product Designer','Data Analyst','Program Coordinator','Registered Nurse','Associate Attorney','Recruiter','Marketing Intern','Research Assistant','Student'];
+function headline(title, co) {
+  const r = rand();
+  if (!co) return title;
+  if (r < 0.55) return `${title} at ${co}`;
+  if (r < 0.7) return `${title} @ ${co} | Building the future of ${pick(['health','payments','media','AI','logistics'])}`;
+  if (r < 0.82) return `${title} | ${co} | ex-${company()}`;
+  if (r < 0.92) return `${title}, ${co}`;
+  return `${title} at ${co} · Former ${pick(TITLES)} at ${company()}`;
+}
+
+const dbFile = path.join(home, 'six-degrees.sqlite');
+mkdirSync(home, { recursive: true });
+for (const f of [dbFile, dbFile + '-wal', dbFile + '-shm']) if (existsSync(f)) rmSync(f);
+const db = new DatabaseSync(dbFile);
+db.exec(SCHEMA_SQL);
+const userId = 'perf-user-0001';
+db.prepare('INSERT INTO users (id, name) VALUES (?, ?)').run(userId, 'You');
+const ins = db.prepare(`INSERT INTO linkedin_connections (id, degree, source_connection_id, name, headline, company, role, profile_url, profile_image_url, mutual_count, scanned_company, user_id, unlock_status, influence_signals)
+  VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?, ?, ?, '{}')`);
+let n = 0;
+const person = (degree, source, scanned = null) => {
+  n++;
+  const name = `${pick(FIRST)} ${pick(LAST)}`;
+  const co = rand() < 0.06 ? '' : (scanned || company());
+  const title = pick(TITLES);
+  return { id: `perf-${degree}-${n}`, degree, source, name, headline: headline(title, co), company: co || null, role: title,
+    url: `https://www.linkedin.com/in/${name.toLowerCase().replace(/[^a-z]+/g, '-')}-${n.toString(36)}`, scanned };
+};
+const put = (p) => ins.run(p.id, p.degree, p.source, p.name, p.headline, p.company, p.role, p.url, p.degree === 2 ? Math.floor(rand() * 40) : null, p.scanned, userId, p.degree === 1 ? 'unlocked' : 'locked');
+
+db.exec('BEGIN');
+const d1 = Array.from({ length: D1 }, () => person(1, null));
+d1.forEach(put);
+const bridges = d1.slice(0, BRIDGES);
+const d2 = [];
+for (const b of bridges) {
+  const size = [980, 950, 500, 310, 260, 180][bridges.indexOf(b)] ?? (25 + Math.floor(rand() * 150));
+  for (let i = 0; i < size; i++) { const p = person(2, b.id); put(p); d2.push(p); }
+}
+// About one in seven 2nd-degree people is known by a second bridge: same profile, another row.
+let shared = 0;
+for (const p of d2.slice()) {
+  if (rand() >= 0.15) continue;
+  const b = pick(bridges); if (b.id === p.source) continue;
+  put({ ...p, id: `${p.id}-via`, source: b.id }); shared++;
+}
+// A few company scans (3rd+).
+let d3 = 0;
+for (const co of COMPANIES.slice(0, 8)) for (let i = 0; i < 50; i++) { put(person(3, null, co)); d3++; }
+// Ties between your own connections.
+const tie = db.prepare('INSERT OR IGNORE INTO connection_ties (id, user_id, a_url, b_url) VALUES (?, ?, ?, ?)');
+for (let i = 0; i < 3000; i++) { const [a, b] = [pick(d1).url, pick(d1).url].sort(); if (a !== b) tie.run(`t${i}`, userId, a, b); }
+db.exec('COMMIT');
+console.log(JSON.stringify({ home, companies: COMPANIES.length, d1: d1.length, d2: d2.length + shared, d2People: d2.length, shared, d3 }));

package/.next/standalone/scripts/next.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+// Run the Next CLI with this project's settings, on any OS.
+//
+// package.json used to say `NEXT_TELEMETRY_DISABLED=1 next build`, which is
+// shell syntax Windows does not have — the Windows build failed on exactly
+// that line. Same settings, set here instead:
+//   NEXT_TELEMETRY_DISABLED=1          always
+//   SIX_DEGREES_BIND=127.0.0.1         for dev and start (only this machine)
+
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const args = process.argv.slice(2);
+const env = { ...process.env, NEXT_TELEMETRY_DISABLED: '1' };
+if (['dev', 'start'].includes(args[0])) env.SIX_DEGREES_BIND ??= '127.0.0.1';
+
+const next = createRequire(import.meta.url).resolve('next/dist/bin/next');
+const child = spawn(process.execPath, [next, ...args], { stdio: 'inherit', env });
+child.on('exit', (code, signal) => process.exit(signal ? 1 : code ?? 1));
+for (const sig of ['SIGINT', 'SIGTERM']) process.on(sig, () => child.kill(sig));

package/.next/standalone/scripts/readme_buttons.py

@@ -38,6 +38,9 @@ ARROW = """<svg class="arrow" viewBox="0 0 24 24" width="30" height="30" aria-hi
 BUTTONS = [
     ("download-apple-silicon.png", "Click to download for Mac", "Apple Silicon", "M1 or newer", "green"),
     ("download-intel.png",         "Click to download for Mac", "Intel",         "Macs with an Intel chip", "slate"),
+    # Windows and Linux (DESKTOP.md D3): a beta, on its own pre-release.
+    ("download-windows.png",       "Click to download · beta",  "Windows",       "Windows 10 or 11, one click", "slate"),
+    ("download-linux.png",         "Click to download · beta",  "Linux",         "Ubuntu and Debian · .deb", "slate"),
 ]
 
 CSS = """