six-degrees 0.6.0 → 0.7.0

package/.next/standalone/SECURITY.md

@@ -12,21 +12,25 @@ This app is designed to run **on your own machine, against your own network**.
 
 - The web UI binds to localhost. It is not hardened for exposure to the
   internet, and it has no multi-user authentication or per-user authorization.
-- Ten API routes are gated (`admin-delete`, `admin-update`, `delete-cluster`,
-  `setup-profile`, `scraper`, `update`, and Settings → Your data's
-  `data/export`, `data/import`, `data/restart`, `data/reveal`). The first four
-  can irreversibly destroy or rewrite data, `scraper` starts processes, and
-  `update` changes the code that runs next. `data/export` hands over the whole
+- Thirteen API routes are gated (`admin-delete`, `admin-update`, `delete-cluster`,
+  `setup-profile`, `scraper`, `update`, Settings → Your data's
+  `data/export`, `data/import`, `data/restart`, `data/reveal`, `data/backup`,
+  `data/restore`, and `data/csv`). The first four can irreversibly destroy or rewrite data,
+  `scraper` starts processes, and `update` changes the code that runs next. `data/export` hands over the whole
   network in one file, `data/import` replaces it, `data/restart` stops the
-  server, and `data/reveal` starts a process (Finder, or the Linux file
-  browser, on the data folder's own path). While the server is bound to
+  server, `data/reveal` starts a process (Finder, or the Linux file
+  browser, on the data folder's own path or a backup in it), `data/backup`
+  writes the whole network to a file in `backups/`, `data/restore`
+  replaces the network with one of those backups, named as `backups/` lists
+  it, never by a path from the request, and `data/csv` keeps, hands over and
+  removes a LinkedIn CSV import kept in the data folder. While the server is bound to
   127.0.0.1 they need no token — anyone who can reach it can already open the
   database file directly, so a token there adds friction rather than safety. If
   it is bound to any other address, every caller must send `ADMIN_TOKEN` as a
   bearer, including this machine and the app's own buttons, and the routes
   refuse to run when it is unset. Reading the data folder's facts
-  (`GET /api/data`: its path and sizes) changes nothing and stays open, like
-  every other read.
+  (`GET /api/data`: its path, sizes and backups) changes nothing and stays
+  open, like every other read.
 - A localhost-bound service is still reachable by any web page you visit — the
   binding keeps other machines out, not your own browser. Every mutating API
   request is therefore refused when the browser reports it came from another
@@ -113,8 +117,10 @@ This app is designed to run **on your own machine, against your own network**.
 
 Everything stays local:
 
-- A CSV import is parsed in the browser and held for that tab only. It is never
-  uploaded and never written to a database.
+- A CSV import is parsed in the browser. Only what the map needs about each
+  person (no email addresses) goes to the app on this computer, which keeps it
+  in the data folder as `csv-network.json` until you remove it, apart from the
+  database. It is never uploaded anywhere.
 - Scanned data and cached avatars are written to your machine and are gitignored.
   The app shows photos only from those files, so looking at your network never
   contacts LinkedIn.

package/.next/standalone/app/api/data/backup/route.js

@@ -0,0 +1,25 @@
+import { getDb, backupOptions } from '../../../../lib/db-client';
+import { makeBackup, noteBackupFailure } from '../../../../lib/backups';
+import { countPeople } from '../../../../lib/data-export';
+
+// Settings → Your data → Back up now: a backup in backups/ like the daily ones
+// (lib/backups.js), kept until the person deletes it. Nothing is taken from
+// the request. Gated (lib/gate.js) with the routes that hand over or replace
+// the whole network: it writes all of it to a file.
+
+export async function POST() {
+  const db = getDb();
+  if (countPeople(db) === 0) {
+    return Response.json({ error: 'There’s no network here to back up yet.' }, { status: 409 });
+  }
+  try {
+    const made = makeBackup('manual', backupOptions(db));
+    return Response.json({
+      ok: true,
+      backup: { name: made.name, bytes: made.bytes, people: made.people, photos: made.photos, verified: made.verified },
+    });
+  } catch (err) {
+    noteBackupFailure('manual', err);
+    return Response.json({ error: `The backup couldn’t be made: ${err.message}` }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/csv/route.js

@@ -0,0 +1,74 @@
+import { dataDir } from '../../../../lib/db-client';
+import { pendingImport } from '../../../../lib/data-import';
+import { resolveProfile, networkCounts } from '../../../../lib/profile';
+import {
+  readCsvNetwork, writeCsvNetwork, removeCsvNetwork, CsvStoreError, CSV_NETWORK_FILE,
+} from '../../../../lib/csv-store';
+
+// A LinkedIn Connections.csv import, kept in the data folder so it is still
+// there after the window closes (lib/csv-store.js). The page reads the CSV and
+// sends only what the map needs (lib/csv.js packConnections); nothing here
+// sees the file itself.
+//
+// Gated with the other routes under /api/data (lib/gate.js): POST replaces the
+// kept import, DELETE removes it, and GET hands it over, so all three answer
+// only on this computer, as the server's bind address proves, never a header
+// (TRAPS §2). POST and DELETE are writes, so middleware.js also refuses them
+// from another site.
+
+export async function GET() {
+  const { csv, problem } = readCsvNetwork(dataDir());
+  // Your scanned 1st-degree connections, under the profile the map shows
+  // (lib/profile.js): once there are any, pages show them instead of a kept
+  // CSV (lib/csv.js openNetworkSource).
+  let scanned;
+  try {
+    const me = resolveProfile({ create: false });
+    scanned = me ? networkCounts(me.id).first : 0;
+  } catch (err) {
+    return Response.json({ error: `Your network couldn't be read (${err.message}).` }, { status: 500 });
+  }
+  return Response.json({
+    csv,
+    scanned,
+    // Said, never shown as no import at all (TRAPS §7): the welcome screen
+    // puts this on the CSV card.
+    problem: problem ? `Your kept CSV import couldn't be read: ${problem}. Import Connections.csv again to replace it.` : null,
+  });
+}
+
+export async function POST(request) {
+  const dir = dataDir();
+  // An import from another computer waiting for the next start replaces the
+  // network's files, this one included: a CSV kept now would be set aside
+  // with what it replaces.
+  if (pendingImport(dir)) {
+    return Response.json({
+      error: 'A copy of a network is waiting to finish importing. Restart Six Degrees to finish it first (Settings → Your data says how), then import the CSV.',
+    }, { status: 409 });
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return Response.json({ error: "The import didn't arrive whole, so nothing was kept. Try again." }, { status: 400 });
+  }
+  try {
+    return Response.json({ ok: true, ...writeCsvNetwork(dir, body?.connections) });
+  } catch (err) {
+    if (err instanceof CsvStoreError) {
+      return Response.json({ error: `This import can't be kept (${err.message}), so nothing was saved.` }, { status: 400 });
+    }
+    return Response.json({ error: `The import couldn't be saved on this computer (${err.message}).` }, { status: 500 });
+  }
+}
+
+export async function DELETE() {
+  try {
+    return Response.json({ ok: true, removed: removeCsvNetwork(dataDir()) });
+  } catch (err) {
+    return Response.json({
+      error: `The import couldn't be removed (${err.message}). It is ${CSV_NETWORK_FILE} in your data folder.`,
+    }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/export/route.js

@@ -7,7 +7,7 @@ import { EXPORT_WORK_PREFIX, sweepLeftovers } from '../../../../lib/data-folder'
 import { SCHEMA_SQL } from '../../../../db/schema';
 import { APP_VERSION } from '../../../../lib/app-version';
 
-// Save a copy of the network to carry to another computer: one .sixdegrees
+// Export backup file…: a copy of the network to carry to another computer, one .sixdegrees
 // file (lib/data-export.js), sent back as a download. A POST, so it takes a
 // click on the app's own page (the cross-site guard applies), and gated with
 // the other routes that hand over or replace everything (lib/gate.js).

package/.next/standalone/app/api/data/restore/route.js

@@ -0,0 +1,48 @@
+import path from 'node:path';
+import { getDb, dataDir, applySchema, backupsFolder } from '../../../../lib/db-client';
+import { SCHEMA_SQL } from '../../../../db/schema';
+import { APP_VERSION } from '../../../../lib/app-version';
+import { countPeople } from '../../../../lib/data-export';
+import { ImportError, pendingImport } from '../../../../lib/data-import';
+import { findBackup, restoreBackup, restorePreflight } from '../../../../lib/backups';
+import { scannerJob } from '../../../../lib/scan-state';
+
+// Settings → Your data → Restore, on one backup: put that backup's network
+// back. The same as importing it (lib/backups.js restoreBackup, through
+// stageImport): checked first, applied at the next start (Restart now), and
+// what is here kept in backups/ before anything is replaced.
+//
+// The body names a backup, {name, replace}: a name from backups/' own listing
+// (lib/data-folder.js listBackups), never a path. Anything else is refused.
+// `replace` is the number of people the person agreed to replace. Gated
+// (lib/gate.js): it replaces the network.
+
+export async function POST(request) {
+  let body = {};
+  try { body = await request.json(); } catch { /* refused below */ }
+  const name = typeof body?.name === 'string' ? body.name : '';
+
+  // The name first: one the folder doesn't hold is refused before anything else is asked.
+  if (!findBackup(backupsFolder(), name)) {
+    return Response.json({ error: 'There is no backup by that name in the backups folder.' }, { status: 404 });
+  }
+  const dir = path.resolve(dataDir());
+  const currentPeople = countPeople(getDb());
+  const refusal = restorePreflight({
+    scanRunning: scannerJob(),
+    pending: pendingImport(dir),
+    currentPeople,
+    confirmedPeople: Number(body?.replace),
+  });
+  if (refusal) return Response.json({ error: refusal.message, ...refusal.extra }, { status: refusal.status });
+
+  try {
+    const pending = restoreBackup(name, {
+      dir, backupsDir: backupsFolder(), applySchema, schemaSql: SCHEMA_SQL, appVersion: APP_VERSION, replacedPeople: currentPeople,
+    });
+    return Response.json({ ok: true, pending });
+  } catch (err) {
+    if (err instanceof ImportError) return Response.json({ error: err.message, ...err.extra }, { status: err.status });
+    return Response.json({ error: `The backup couldn’t be restored: ${err.message}` }, { status: 500 });
+  }
+}

package/.next/standalone/app/api/data/reveal/route.js

@@ -1,14 +1,27 @@
 import path from 'node:path';
-import { dataDir } from '../../../../lib/db-client';
+import { dataDir, backupsFolder } from '../../../../lib/db-client';
 import { revealFolder } from '../../../../lib/data-folder';
+import { findBackup } from '../../../../lib/backups';
 
-// Show the data folder in Finder (or the Linux file browser). It opens the data
-// folder itself and takes nothing from the request. Gated (lib/gate.js) like
-// every route that starts a process.
+// Show the data folder in Finder (or the Linux file browser), or one backup in
+// it, selected: {backup: name}, a name from backups/' own listing, never a
+// path (lib/backups.js findBackup). Nothing else is taken from the request.
+// Gated (lib/gate.js) like every route that starts a process.
 
-export async function POST() {
+export async function POST(request) {
+  let body = {};
+  try { body = await request.json(); } catch { /* no body: the data folder */ }
+  if (body?.backup !== undefined) {
+    const folder = path.resolve(backupsFolder());
+    const found = findBackup(folder, body.backup, { restorable: false });
+    if (!found) return Response.json({ error: 'There is no backup by that name in the backups folder.' }, { status: 404 });
+    const file = path.join(folder, found.name);
+    const result = await revealFolder(folder, { select: file });
+    if (result.ok) return Response.json({ ok: true });
+    return Response.json({ error: `${result.message} The backup is ${file}`, path: file }, { status: 500 });
+  }
   const dir = path.resolve(dataDir());
   const result = await revealFolder(dir);
   if (result.ok) return Response.json({ ok: true });
-  return Response.json({ error: `${result.message} The folder is ${dir}` }, { status: 500 });
+  return Response.json({ error: `${result.message} The folder is ${dir}`, path: dir }, { status: 500 });
 }

package/.next/standalone/app/api/data/route.js

@@ -1,7 +1,10 @@
 import path from 'node:path';
 import { homedir } from 'node:os';
-import { getDb, dataDir, dbFile, AUTO_BACKUP_PREFIX } from '../../../lib/db-client';
+import { getDb, dataDir, dbFile, backupsFolder, applySchema, AUTO_BACKUP_PREFIX } from '../../../lib/db-client';
 import { folderReport } from '../../../lib/data-folder';
+import { backupReport } from '../../../lib/backups';
+import { SCHEMA_SQL } from '../../../db/schema';
+import { APP_VERSION } from '../../../lib/app-version';
 import { countPeople, referencedPhotos } from '../../../lib/data-export';
 import {
   pendingImport, lastImport, restartCodeFrom, restartAdvice, MAX_IMPORT_BYTES,
@@ -9,9 +12,11 @@ import {
 import { projectRoot, isGitCheckout } from '../../../lib/paths';
 import { installKind } from '../../../lib/release';
 
-// Settings → Your data: where the network is kept, what it takes up, and any
-// import waiting to finish. Sizes come from the file system; nothing in the
-// folder is read, and chrome-profile/ is only reported as there or not. A read
+// Settings → Your data: where the network is kept, what it takes up, the
+// backups, and any import waiting to finish. Sizes come from the file system,
+// and chrome-profile/ is only reported as there or not. The one file read is
+// the newest backup, checked as the importer would check it (once per file per
+// server, lib/backups.js backupReport), so "verified" is never a guess. A read
 // that changes nothing, so it stays open like every other read. The actions
 // live under /api/data/… and are gated (lib/gate.js).
 
@@ -22,8 +27,14 @@ export async function GET() {
     // A git checkout is its own kind here, as on the rest of the Settings page.
     const kind = isGitCheckout() ? 'git' : installKind(process.env, projectRoot());
     const custom = dir !== path.join(homedir(), '.six-degrees');
+    // One entry per backup (a database copy and its folder of photos are one), newest first.
+    const { backups, ...backupStatus } = backupReport(path.resolve(backupsFolder()), {
+      applySchema, schemaSql: SCHEMA_SQL, appVersion: APP_VERSION,
+    });
     return Response.json({
       ...folderReport({ dir, dbFile: path.resolve(dbFile()), autoPrefix: AUTO_BACKUP_PREFIX, inNetwork: referencedPhotos(db) }),
+      backups,
+      backupStatus,
       people: countPeople(db),
       platform: process.platform,
       kind,

package/.next/standalone/app/api/ingest/route.js

@@ -322,7 +322,7 @@ export async function POST(request) {
               user_id: userId || null,
               type: 'request_accepted',
               title: `${p.name} accepted! +${XP_ACCEPT[p.tier] || 5} XP`,
-              message: `${p.tier}-Tier connection — bridge their cluster to reach D3`,
+              message: `${p.tier}-Tier connection: bridge their cluster to reach D3`,
               icon: '🤝',
               data: { personId: p.id, viaId: p.source_connection_id ?? null, tier: p.tier ?? null },
             }))

package/.next/standalone/app/api/queue/route.js

@@ -59,7 +59,7 @@ export async function POST(request) {
           await supabase.from('notifications').insert([{
             type: 'connection_accepted',
             title: `${item.name} accepted!`,
-            message: `+${item.xp_reward} XP — Ready to scan their cluster`,
+            message: `+${item.xp_reward} XP · Ready to scan their cluster`,
             icon: '🎉',
           }]);
         }

package/.next/standalone/app/api/scraper/route.js

@@ -3,16 +3,19 @@ import { existsSync, readFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:f
 import path from 'node:path';
 import { projectRoot, dataDir } from '../../../lib/paths';
 import { resolveProfile, networkCounts } from '../../../lib/profile';
-import { scanProgress } from '../../../lib/scan-progress';
-import { linkedinState, writeLimits, liftCooldown } from '../../../lib/linkedin-limits';
+import { scanProgress, mappingNow } from '../../../lib/scan-progress';
+import { linkedinState, linkedinUsage, writeLimits, liftCooldown } from '../../../lib/linkedin-limits';
 import { pausedList, readProgress, readUnclear } from '../../../lib/paused';
-import { getDb } from '../../../lib/db-client';
+import { getDb, backUpDailyIfDue } from '../../../lib/db-client';
 import { db as notesDb } from '../../../lib/db';
 import { scanDoneNotification } from '../../../lib/notifications';
 import { registerScanState } from '../../../lib/scan-state';
 import { pendingImport } from '../../../lib/data-import';
 import { waitingPhotoCount } from '../../../lib/photos';
+import { readSettings } from '../../../lib/settings';
+import { riskAccepted, touchesLinkedIn, RISK_REFUSAL } from '../../../lib/scan-risk';
 import { reachIndex, circleState } from '../../../lib/reach';
+import { chromeInstalled, signedInFrom, SIGNED_IN_FILE, CHROME_REFUSAL } from '../../../lib/scanner-setup';
 import {
   pythonLooker, thisHostKey, scannerCommand, installSteps, downloadedPython, downloadVerified,
   placeDownloadedPython, sweepSetupLeftovers, megabytes, SETUP_WORK_PREFIX, ScannerSetupError,
@@ -47,6 +50,7 @@ const state = registerScanState({
   stderrTail: [],
   failure: null,   // the last lines of stderr from a run that failed — its reason
   pages: 0,        // pages the running scan has read: the dots along the header's line (app/components/ScanTrail.js)
+  found: [],       // how many people each of those pages found: the Scan page's cluster (app/components/ScanRadar.js)
 });
 
 // A page read, as scripts/scrape.py prints it: "  Page 3... " as a circle or a
@@ -54,6 +58,10 @@ const state = registerScanState({
 // people of your own connections list. Counted as the lines arrive, since the
 // log only keeps its last MAX_LOG lines.
 const PAGE_READ = /^\s*Page \d+\.\.\.|\d+\s*\/\s*\d+\s+collected/;
+// What a page found, which the scanner prints after "Page N... " once it's read:
+// "10 found (total: 30)" in a circle, "7 found (2 with images)" for a company.
+const PAGE_FOUND = /(\d+) found \((?:total: \d+|\d+ with images)\)/;
+const MAX_PAGES_KEPT = 400;
 
 /** Stop the running job without orphaning the browser it opened.
  *
@@ -83,7 +91,7 @@ function stopChild() {
     spawn('taskkill', ['/pid', String(pid), '/T'], { stdio: 'ignore', windowsHide: true }).on('error', () => {});
     setTimeout(() => {
       if (state.child && state.child.pid === pid) {
-        push('Still running — forcing it.');
+        push('Still running. Forcing it to stop.');
         spawn('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => {});
       }
     }, 5000);
@@ -94,7 +102,7 @@ function stopChild() {
 
   setTimeout(() => {
     if (state.child && state.child.pid === pid) {
-      push('Still running — forcing it.');
+      push('Still running. Forcing it to stop.');
       try { process.kill(-pid, 'SIGKILL'); }
       catch { try { child.kill('SIGKILL'); } catch {} }
     }
@@ -106,7 +114,14 @@ function push(line) {
     const t = part.replace(/\s+$/, '');
     if (!t) continue;
     state.log.push(t);
-    if (PAGE_READ.test(t)) state.pages += 1;
+    if (PAGE_READ.test(t)) {
+      state.pages += 1;
+      // Fifty of your own list at a time; a page's count comes on its next line.
+      state.found.push(/collected/.test(t) ? 50 : 0);
+      if (state.found.length > MAX_PAGES_KEPT) state.found.splice(0, state.found.length - MAX_PAGES_KEPT);
+    }
+    const got = t.match(PAGE_FOUND);
+    if (got && state.found.length) state.found[state.found.length - 1] = Number(got[1]);
   }
   if (state.log.length > MAX_LOG) state.log.splice(0, state.log.length - MAX_LOG);
 }
@@ -208,12 +223,12 @@ function pickedPerson(id) {
   }
 }
 
-// The machine checks (Python, Chrome, signed in) spawn processes, so they are
-// cached for a few seconds, and callers that arrive while a look is under way
-// share it rather than each starting their own Pythons. Everything about the
-// running job — its log, how far it has got — and the counts are read fresh on
-// every call: the page polls every 1.5 s, and a progress bar that moves every
-// 4 s looks stuck.
+// The look for a Python spawns processes, so it is cached for a few seconds,
+// and callers that arrive while a look is under way share it rather than each
+// starting their own Pythons. Everything else (Chrome and signed in, which are
+// file checks; the running job, its log, how far it has got; the counts) is
+// read fresh on every call: the page polls every 1.5 s, a progress bar that
+// moves every 4 s looks stuck, and step 1 ticks the moment Chrome is installed.
 let cached = { at: 0, value: null };
 let looking = null;
 let lookGeneration = 0;
@@ -251,26 +266,38 @@ async function look() {
     host: hostOnce(),
   });
 
-  // Where Playwright's "chrome" channel looks for Google Chrome (Chromium doesn't count).
-  const chrome =
-    process.platform === 'darwin' ? existsSync('/Applications/Google Chrome.app')
-      : process.platform === 'linux' ? existsSync('/opt/google/chrome/chrome')
-        : process.platform === 'win32' ? windowsChrome()
-          : true; // elsewhere Playwright resolves the channel itself
+  return { root, python };
+}
 
-  // Windows' Chrome keeps its cookies one folder down, in Default\Network.
-  const profile = path.join(dataDir(), 'chrome-profile', 'Default');
-  const signedIn = existsSync(path.join(profile, 'Cookies')) || existsSync(path.join(profile, 'Network', 'Cookies'));
+/** Google Chrome, where Playwright's "chrome" channel looks (lib/scanner-setup.js). A file check, so cheap enough for every POST. */
+function chromeHere() {
+  return chromeInstalled({ platform: process.platform, env: process.env, exists: existsSync });
+}
 
-  return { root, python, chrome, signedIn };
+/**
+ * Signed in to LinkedIn in the scanner's Chrome: the scanner's own note once
+ * it has confirmed the session (lib/scanner-setup.js signedInFrom). A folder
+ * from before the note goes by Chrome's cookie file, as it always did; Windows'
+ * Chrome keeps that one folder down, in Default\Network.
+ */
+function signedIn() {
+  const data = dataDir();
+  let note = null;
+  try { note = JSON.parse(readFileSync(path.join(data, SIGNED_IN_FILE), 'utf8')); } catch { /* none yet, or unreadable: the old check */ }
+  const profile = path.join(data, 'chrome-profile', 'Default');
+  return signedInFrom({
+    note,
+    profile: existsSync(path.join(data, 'chrome-profile')),
+    cookies: existsSync(path.join(profile, 'Cookies')) || existsSync(path.join(profile, 'Network', 'Cookies')),
+  });
 }
 
-/** Google Chrome on Windows, where Playwright's "chrome" channel looks: for this user, then for everyone. */
-function windowsChrome() {
-  const env = process.env;
-  return [env.LOCALAPPDATA, env.PROGRAMFILES, env['PROGRAMFILES(X86)']]
-    .filter(Boolean)
-    .some((root) => existsSync(path.join(root, 'Google', 'Chrome', 'Application', 'chrome.exe')));
+// The "I understand" before the first scan: given on the Scan page, or implied by
+// the scanner's own Chrome profile, which only a scan before it could have made.
+function scanRisk() {
+  let acceptedAt = null;
+  try { acceptedAt = readSettings(getDb()).scanRiskAccepted; } catch { /* unreadable: ask */ }
+  return riskAccepted({ acceptedAt, scannedBefore: existsSync(path.join(dataDir(), 'chrome-profile')) });
 }
 
 function machineChecks() {
@@ -309,6 +336,7 @@ function paused(userId) {
 
 async function status() {
   const m = await machineChecks();
+  const chrome = chromeHere();
 
   // How much is already mapped, by degree, so the page can mark the scan step
   // done and offer the way to the galaxy instead of leaving someone on a form.
@@ -325,7 +353,9 @@ async function status() {
 
   const py = m.python;
   return {
-    ready: Boolean(m.root && py.run && m.chrome),
+    ready: Boolean(m.root && py.run && chrome),
+    // Whose circle is being read now, for the Scan page's "Watch it fill in".
+    mapping: mappingWho(me?.id),
     checks: {
       scriptsFound: Boolean(m.root),
       // A Python that runs the scanner, or one Install can build its environment from.
@@ -344,8 +374,10 @@ async function status() {
       systemPython: py.systemFound,
       // What "Set up the scanner" would download, when there is nothing to install from.
       download: py.download ? { version: py.download.version, size: py.download.size, from: 'github.com' } : null,
-      chrome: m.chrome,
-      signedIn: m.signedIn,
+      chrome,
+      signedIn: signedIn(),
+      // The one-time "I understand" before the first scan (lib/scan-risk.js).
+      riskAccepted: scanRisk(),
     },
     network,
     photosWaiting,
@@ -356,6 +388,28 @@ async function status() {
   };
 }
 
+/**
+ * Whose circle the running scan is reading: { id, name } of one of your
+ * connections, or null. A scan of one person knows its target; a batch (Map
+ * 2nd degree, every paused list) prints each person's name as it starts
+ * (lib/scan-progress.js mappingNow), found here among your connections. Two
+ * with that name can't be told apart that way, so neither is named.
+ */
+function mappingWho(userId) {
+  if (!state.running) return null;
+  if (state.target?.id && ['bridge', 'rescrape', 'resume'].includes(state.action)) return { id: state.target.id, name: state.target.name };
+  const name = mappingNow(state.log, state.action);
+  if (!name || !userId) return null;
+  try {
+    const rows = getDb().prepare(
+      'SELECT id FROM linkedin_connections WHERE user_id = ? AND degree = 1 AND name = ? LIMIT 2',
+    ).all(userId, name);
+    return rows.length === 1 ? { id: rows[0].id, name } : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The running job alone, from memory: no checks, no database. Every Scan
  * button in the app asks this (lib/scraper-client.js watchScanner), every few
@@ -375,6 +429,7 @@ function job() {
     failure: state.running ? null : state.failure,
     progress: state.running ? scanProgress(state.log, state.action) : null,
     pages: state.running ? state.pages : 0,
+    found: state.running ? state.found : [],
     log: state.log.slice(-120),
     recent: state.recent,
     budget: state.running ? budgetNow() : null,
@@ -425,6 +480,16 @@ export async function GET(request) {
   if (q.has('job')) return Response.json(job());
   if (q.has('resume')) return Response.json({ resume: resumePoint(q.get('resume')) });
   if (q.has('reach')) return Response.json(scanNotes());
+  // Settings → LinkedIn usage: the scanner's record of searches, profile views
+  // and pauses, counted (lib/linkedin-limits.js linkedinUsage). Reads only; no
+  // checks, no Python, nothing written.
+  if (q.has('usage')) {
+    try {
+      return Response.json(linkedinUsage(dataDir()));
+    } catch {
+      return Response.json({ error: 'The record of LinkedIn searches on this computer could not be read.' }, { status: 500 });
+    }
+  }
   if (q.has('person')) return Response.json(pickedPerson(q.get('person')));
   return Response.json(await status());
 }
@@ -586,6 +651,17 @@ export async function POST(request) {
   if (!Object.hasOwn(ACTIONS, action)) {
     return Response.json({ error: `Unknown action '${action}'` }, { status: 400 });
   }
+  // Nothing opens LinkedIn before the one-time "I understand" on the Scan page,
+  // whichever button asked (lib/scan-risk.js).
+  if (touchesLinkedIn(action) && !scanRisk()) {
+    return Response.json({ error: RISK_REFUSAL, needsRiskAcceptance: true }, { status: 409 });
+  }
+  // Nor without Google Chrome, which the scanner drives: the Scan page's step 1
+  // says so in the same words, and every other button is told here, before
+  // anything starts, rather than by a Playwright error at the end of a log.
+  if (touchesLinkedIn(action) && !chromeHere()) {
+    return Response.json({ error: CHROME_REFUSAL, needsChrome: true }, { status: 409 });
+  }
 
   const spec = ACTIONS[action];
   const maxBridges = Number.isInteger(body.maxBridges) && body.maxBridges > 0
@@ -645,7 +721,7 @@ export async function POST(request) {
   }
   const cooldown = linkedinState(dataDir()).cooldown;
   if (searches && cooldown) {
-    return Response.json({ error: `Scanning is paused until ${new Date(cooldown.until).toLocaleString()} — ${cooldown.reason}.`, cooldown }, { status: 409 });
+    return Response.json({ error: `Scanning is paused until ${new Date(cooldown.until).toLocaleString()}: ${cooldown.reason}.`, cooldown }, { status: 409 });
   }
   if (state.running) {
     return Response.json({ error: 'Something is already running.', action: state.action }, { status: 409 });
@@ -714,6 +790,7 @@ export async function POST(request) {
   state.startedAt = Date.now();
   state.log = [spec.label + (target?.name ? ` ${target.name}…` : '…')];
   state.pages = 0;
+  state.found = [];
   state.stderrTail = [];
   state.failure = null;
   forgetChecks();
@@ -766,6 +843,17 @@ export async function POST(request) {
       try { cleanup(); } catch { /* swept at the next setup (sweepSetupLeftovers) */ }
     }
     forgetChecks();
+    // The daily backup, once a scan may have changed the network (lib/backups.js):
+    // checked here and when the server starts, never on a timer. Setting the
+    // scanner up and signing in change nothing in it.
+    if (!['install', 'setup', 'login'].includes(state.action)) {
+      try {
+        const daily = backUpDailyIfDue();
+        if (daily) push('Made today’s backup of your network (Settings → Your data).');
+      } catch (err) {
+        push(`Today’s backup couldn’t be made: ${err.message}`);
+      }
+    }
   }
 
   function runStep(i) {

package/.next/standalone/app/api/social/crm/route.js

@@ -5,7 +5,8 @@ import { socialFiles, readJson, writeJsonAtomic } from '../../../../lib/social-s
 // The Social tab's CRM: your own stage, tags, notes and next follow-up for each
 // person, in crm-<profile>.json in the data folder (lib/social-crm.js has the
 // shape). Yours, so always kept, whatever Keep my messages says; never sent
-// anywhere, and not in "Save a copy of my network".
+// anywhere, never in Six Degrees' own backups (lib/backups.js BACKUP_SOCIAL),
+// and in "Export backup file…" only when its Social box is ticked.
 //
 //   GET     the whole store
 //   PATCH   { key, set: { stage?, tags?, notes?, followUp? } } one person's