six-degrees 0.6.0 → 0.8.0

package/.next/standalone/app/api/outreach/route.js

@@ -1,6 +1,7 @@
-import { db as supabase } from '../../../lib/db';
 import { getDb, decodeRow } from '../../../lib/db-client';
-import { resolveProfile } from '../../../lib/profile';
+import {
+  XP_SEND, XP_ACCEPT, awardXP, whose, copiesOf, inList, bestTier, markSent,
+} from '../../../lib/requests';
 
 // Requests you've sent, kept per PERSON.
 //
@@ -13,56 +14,8 @@ import { resolveProfile } from '../../../lib/profile';
 // asked through is kept (so once they accept, their card and circle say who
 // introduced you: lib/promote.js keeps it), XP comes once per person, and Undo
 // takes back all of it. lib/requests-client.js is the one way the pages call this.
-
-// XP rewards by tier
-const XP_SEND = { S: 25, A: 15, B: 10, C: 5, D: 2 };
-const XP_ACCEPT = { S: 100, A: 60, B: 35, C: 15, D: 5 };
-const TIER_ORDER = ['S', 'A', 'B', 'C', 'D'];
-
-async function awardXP(userId, amount) {
-  if (!userId || !amount) return;
-  // Upsert: create if not exists, change if exists. Never below zero: an Undo
-  // takes back what a send gave, including sends from before sends gave any.
-  const { data: existing } = await supabase.from('user_stats').select('xp').eq('id', userId).single();
-  if (existing) {
-    await supabase.from('user_stats').update({ xp: Math.max(0, (existing.xp || 0) + amount) }).eq('id', userId);
-  } else if (amount > 0) {
-    await supabase.from('user_stats').insert([{ id: userId, xp: amount, level: 1 }]).catch(() => {});
-  }
-}
-
-/** The profile a request belongs to: the one sent, else this machine's. */
-function whose(userId) {
-  if (userId) return String(userId);
-  try { return resolveProfile({ create: false })?.id || null; } catch { return null; }
-}
-
-/** Every copy of one person: by the clicked row's profile URL, or the URL given. */
-function copiesOf(db, { connectionId, profileUrl, userId }) {
-  let url = profileUrl ? String(profileUrl) : null;
-  let user = userId ? String(userId) : null;
-  let clicked = null;
-  if (connectionId != null) {
-    clicked = db.prepare('SELECT id, profile_url, user_id FROM linkedin_connections WHERE id = ?').get(String(connectionId)) || null;
-    if (clicked) {
-      url = clicked.profile_url || url;
-      user = user || clicked.user_id || null;
-    }
-  }
-  const cols = 'id, degree, tier, outreach_status, unlock_status, unlocked_from_bridge_id';
-  let rows = [];
-  if (url) {
-    rows = user
-      ? db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ? AND user_id = ?`).all(url, user)
-      : db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE profile_url = ?`).all(url);
-  } else if (clicked) {
-    rows = db.prepare(`SELECT ${cols} FROM linkedin_connections WHERE id = ?`).all(clicked.id);
-  }
-  return { url, user, rows };
-}
-
-const inList = (ids) => ids.map(() => '?').join(', ');
-const bestTier = (rows) => TIER_ORDER.find((t) => rows.some((r) => r.tier === t)) || 'D';
+// The marking itself is lib/requests.js markSent, which Auto's sends use too
+// (app/api/scraper/route.js).
 
 export async function POST(request) {
   try {
@@ -72,33 +25,20 @@ export async function POST(request) {
       return Response.json({ error: 'Unknown action' }, { status: 400 });
     }
     const db = getDb();
+
+    if (action === 'mark-sent') {
+      const { saved, xp, already } = await markSent(db, { connectionId, profileUrl, userId, bridgeId });
+      // Nobody on file (the sample network lives in the browser): nothing to keep.
+      if (!saved) return Response.json({ success: true, saved: 0, xp: 0 });
+      return Response.json({ success: true, saved, xp, already });
+    }
+
     const { user, rows } = copiesOf(db, { connectionId, profileUrl, userId });
     // Nobody on file (the sample network lives in the browser): nothing to keep.
     if (!rows.length) return Response.json({ success: true, saved: 0, xp: 0 });
     const ids = rows.map((r) => r.id);
     const now = new Date().toISOString();
 
-    if (action === 'mark-sent') {
-      const already = rows.some((r) => r.outreach_status === 'sent' || r.outreach_status === 'accepted');
-      db.prepare(`UPDATE linkedin_connections SET outreach_status = 'sent', updated_at = ?
-        WHERE id IN (${inList(ids)}) AND (outreach_status IS NULL OR outreach_status NOT IN ('sent', 'accepted'))`).run(now, ...ids);
-      db.prepare(`UPDATE linkedin_connections SET unlock_status = 'pending', updated_at = ?
-        WHERE id IN (${inList(ids)}) AND (unlock_status IS NULL OR unlock_status = 'locked')`).run(now, ...ids);
-      // Who you asked through: one of your own connections, or nothing.
-      if (bridgeId != null) {
-        const bridge = db.prepare(
-          `SELECT id, name FROM linkedin_connections WHERE id = ? AND degree = 1${user ? ' AND user_id = ?' : ''}`,
-        ).get(...[String(bridgeId), ...(user ? [user] : [])]);
-        if (bridge) {
-          db.prepare(`UPDATE linkedin_connections SET unlocked_from_bridge_id = ?, unlocked_from_name = ?, updated_at = ?
-            WHERE id IN (${inList(ids)}) AND degree = 2 AND unlocked_from_bridge_id IS NULL`).run(bridge.id, bridge.name, now, ...ids);
-        }
-      }
-      const xp = already ? 0 : XP_SEND[bestTier(rows)] || 2;
-      await awardXP(whose(user), xp);
-      return Response.json({ success: true, saved: ids.length, xp, already });
-    }
-
     if (action === 'mark-accepted') {
       db.prepare(`UPDATE linkedin_connections SET outreach_status = 'accepted', updated_at = ? WHERE id IN (${inList(ids)})`).run(now, ...ids);
       return Response.json({ success: true, saved: ids.length, xp: 0, accepts: XP_ACCEPT[bestTier(rows)] || 5 });

package/.next/standalone/app/api/queue/route.js

@@ -59,7 +59,7 @@ export async function POST(request) {
           await supabase.from('notifications').insert([{
             type: 'connection_accepted',
             title: `${item.name} accepted!`,
-            message: `+${item.xp_reward} XP — Ready to scan their cluster`,
+            message: `+${item.xp_reward} XP · Ready to scan their cluster`,
             icon: '🎉',
           }]);
         }

package/.next/standalone/app/api/scraper/route.js

@@ -3,16 +3,21 @@ import { existsSync, readFileSync, mkdirSync, mkdtempSync, rmSync } from 'node:f
 import path from 'node:path';
 import { projectRoot, dataDir } from '../../../lib/paths';
 import { resolveProfile, networkCounts } from '../../../lib/profile';
-import { scanProgress } from '../../../lib/scan-progress';
-import { linkedinState, writeLimits, liftCooldown } from '../../../lib/linkedin-limits';
+import { scanProgress, mappingNow } from '../../../lib/scan-progress';
+import { linkedinState, linkedinUsage, writeLimits, liftCooldown } from '../../../lib/linkedin-limits';
 import { pausedList, readProgress, readUnclear } from '../../../lib/paused';
-import { getDb } from '../../../lib/db-client';
+import { getDb, backUpDailyIfDue } from '../../../lib/db-client';
 import { db as notesDb } from '../../../lib/db';
 import { scanDoneNotification } from '../../../lib/notifications';
-import { registerScanState } from '../../../lib/scan-state';
+import { registerScanState, runningNow } from '../../../lib/scan-state';
 import { pendingImport } from '../../../lib/data-import';
 import { waitingPhotoCount } from '../../../lib/photos';
+import { readSettings } from '../../../lib/settings';
+import { riskAccepted, touchesLinkedIn, RISK_REFUSAL } from '../../../lib/scan-risk';
 import { reachIndex, circleState } from '../../../lib/reach';
+import { chromeInstalled, signedInFrom, SIGNED_IN_FILE, CHROME_REFUSAL } from '../../../lib/scanner-setup';
+import { AUTO_REFUSAL, connectResultIn, connectMarks, inviteRefusal, personRefusal } from '../../../lib/auto-connect';
+import { markSentRows, awardXP, whose, requestStanding } from '../../../lib/requests';
 import {
   pythonLooker, thisHostKey, scannerCommand, installSteps, downloadedPython, downloadVerified,
   placeDownloadedPython, sweepSetupLeftovers, megabytes, SETUP_WORK_PREFIX, ScannerSetupError,
@@ -47,6 +52,9 @@ const state = registerScanState({
   stderrTail: [],
   failure: null,   // the last lines of stderr from a run that failed — its reason
   pages: 0,        // pages the running scan has read: the dots along the header's line (app/components/ScanTrail.js)
+  found: [],       // how many people each of those pages found: the Scan page's cluster (app/components/ScanRadar.js)
+  invitee: null,   // Auto's person: { id, name, profileUrl, userId, bridgeId }, looked up here (connectTarget)
+  outcome: null,   // how Auto's request went: the scanner's "Connect result: …" line (lib/auto-connect.js)
 });
 
 // A page read, as scripts/scrape.py prints it: "  Page 3... " as a circle or a
@@ -54,6 +62,10 @@ const state = registerScanState({
 // people of your own connections list. Counted as the lines arrive, since the
 // log only keeps its last MAX_LOG lines.
 const PAGE_READ = /^\s*Page \d+\.\.\.|\d+\s*\/\s*\d+\s+collected/;
+// What a page found, which the scanner prints after "Page N... " once it's read:
+// "10 found (total: 30)" in a circle, "7 found (2 with images)" for a company.
+const PAGE_FOUND = /(\d+) found \((?:total: \d+|\d+ with images)\)/;
+const MAX_PAGES_KEPT = 400;
 
 /** Stop the running job without orphaning the browser it opened.
  *
@@ -83,7 +95,7 @@ function stopChild() {
     spawn('taskkill', ['/pid', String(pid), '/T'], { stdio: 'ignore', windowsHide: true }).on('error', () => {});
     setTimeout(() => {
       if (state.child && state.child.pid === pid) {
-        push('Still running — forcing it.');
+        push('Still running. Forcing it to stop.');
         spawn('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => {});
       }
     }, 5000);
@@ -94,7 +106,7 @@ function stopChild() {
 
   setTimeout(() => {
     if (state.child && state.child.pid === pid) {
-      push('Still running — forcing it.');
+      push('Still running. Forcing it to stop.');
       try { process.kill(-pid, 'SIGKILL'); }
       catch { try { child.kill('SIGKILL'); } catch {} }
     }
@@ -106,7 +118,17 @@ function push(line) {
     const t = part.replace(/\s+$/, '');
     if (!t) continue;
     state.log.push(t);
-    if (PAGE_READ.test(t)) state.pages += 1;
+    if (PAGE_READ.test(t)) {
+      state.pages += 1;
+      // Fifty of your own list at a time; a page's count comes on its next line.
+      state.found.push(/collected/.test(t) ? 50 : 0);
+      if (state.found.length > MAX_PAGES_KEPT) state.found.splice(0, state.found.length - MAX_PAGES_KEPT);
+    }
+    const got = t.match(PAGE_FOUND);
+    if (got && state.found.length) state.found[state.found.length - 1] = Number(got[1]);
+    // Auto's one line saying how the request went (scrape.py main, --connect).
+    const result = state.action === 'connect' && connectResultIn(t);
+    if (result) state.outcome = result;
   }
   if (state.log.length > MAX_LOG) state.log.splice(0, state.log.length - MAX_LOG);
 }
@@ -208,12 +230,12 @@ function pickedPerson(id) {
   }
 }
 
-// The machine checks (Python, Chrome, signed in) spawn processes, so they are
-// cached for a few seconds, and callers that arrive while a look is under way
-// share it rather than each starting their own Pythons. Everything about the
-// running job — its log, how far it has got — and the counts are read fresh on
-// every call: the page polls every 1.5 s, and a progress bar that moves every
-// 4 s looks stuck.
+// The look for a Python spawns processes, so it is cached for a few seconds,
+// and callers that arrive while a look is under way share it rather than each
+// starting their own Pythons. Everything else (Chrome and signed in, which are
+// file checks; the running job, its log, how far it has got; the counts) is
+// read fresh on every call: the page polls every 1.5 s, a progress bar that
+// moves every 4 s looks stuck, and step 1 ticks the moment Chrome is installed.
 let cached = { at: 0, value: null };
 let looking = null;
 let lookGeneration = 0;
@@ -251,26 +273,38 @@ async function look() {
     host: hostOnce(),
   });
 
-  // Where Playwright's "chrome" channel looks for Google Chrome (Chromium doesn't count).
-  const chrome =
-    process.platform === 'darwin' ? existsSync('/Applications/Google Chrome.app')
-      : process.platform === 'linux' ? existsSync('/opt/google/chrome/chrome')
-        : process.platform === 'win32' ? windowsChrome()
-          : true; // elsewhere Playwright resolves the channel itself
+  return { root, python };
+}
 
-  // Windows' Chrome keeps its cookies one folder down, in Default\Network.
-  const profile = path.join(dataDir(), 'chrome-profile', 'Default');
-  const signedIn = existsSync(path.join(profile, 'Cookies')) || existsSync(path.join(profile, 'Network', 'Cookies'));
+/** Google Chrome, where Playwright's "chrome" channel looks (lib/scanner-setup.js). A file check, so cheap enough for every POST. */
+function chromeHere() {
+  return chromeInstalled({ platform: process.platform, env: process.env, exists: existsSync });
+}
 
-  return { root, python, chrome, signedIn };
+/**
+ * Signed in to LinkedIn in the scanner's Chrome: the scanner's own note once
+ * it has confirmed the session (lib/scanner-setup.js signedInFrom). A folder
+ * from before the note goes by Chrome's cookie file, as it always did; Windows'
+ * Chrome keeps that one folder down, in Default\Network.
+ */
+function signedIn() {
+  const data = dataDir();
+  let note = null;
+  try { note = JSON.parse(readFileSync(path.join(data, SIGNED_IN_FILE), 'utf8')); } catch { /* none yet, or unreadable: the old check */ }
+  const profile = path.join(data, 'chrome-profile', 'Default');
+  return signedInFrom({
+    note,
+    profile: existsSync(path.join(data, 'chrome-profile')),
+    cookies: existsSync(path.join(profile, 'Cookies')) || existsSync(path.join(profile, 'Network', 'Cookies')),
+  });
 }
 
-/** Google Chrome on Windows, where Playwright's "chrome" channel looks: for this user, then for everyone. */
-function windowsChrome() {
-  const env = process.env;
-  return [env.LOCALAPPDATA, env.PROGRAMFILES, env['PROGRAMFILES(X86)']]
-    .filter(Boolean)
-    .some((root) => existsSync(path.join(root, 'Google', 'Chrome', 'Application', 'chrome.exe')));
+// The "I understand" before the first scan: given on the Scan page, or implied by
+// the scanner's own Chrome profile, which only a scan before it could have made.
+function scanRisk() {
+  let acceptedAt = null;
+  try { acceptedAt = readSettings(getDb()).scanRiskAccepted; } catch { /* unreadable: ask */ }
+  return riskAccepted({ acceptedAt, scannedBefore: existsSync(path.join(dataDir(), 'chrome-profile')) });
 }
 
 function machineChecks() {
@@ -309,6 +343,7 @@ function paused(userId) {
 
 async function status() {
   const m = await machineChecks();
+  const chrome = chromeHere();
 
   // How much is already mapped, by degree, so the page can mark the scan step
   // done and offer the way to the galaxy instead of leaving someone on a form.
@@ -325,7 +360,9 @@ async function status() {
 
   const py = m.python;
   return {
-    ready: Boolean(m.root && py.run && m.chrome),
+    ready: Boolean(m.root && py.run && chrome),
+    // Whose circle is being read now, for the Scan page's "Watch it fill in".
+    mapping: mappingWho(me?.id),
     checks: {
       scriptsFound: Boolean(m.root),
       // A Python that runs the scanner, or one Install can build its environment from.
@@ -344,8 +381,10 @@ async function status() {
       systemPython: py.systemFound,
       // What "Set up the scanner" would download, when there is nothing to install from.
       download: py.download ? { version: py.download.version, size: py.download.size, from: 'github.com' } : null,
-      chrome: m.chrome,
-      signedIn: m.signedIn,
+      chrome,
+      signedIn: signedIn(),
+      // The one-time "I understand" before the first scan (lib/scan-risk.js).
+      riskAccepted: scanRisk(),
     },
     network,
     photosWaiting,
@@ -356,6 +395,28 @@ async function status() {
   };
 }
 
+/**
+ * Whose circle the running scan is reading: { id, name } of one of your
+ * connections, or null. A scan of one person knows its target; a batch (Map
+ * 2nd degree, every paused list) prints each person's name as it starts
+ * (lib/scan-progress.js mappingNow), found here among your connections. Two
+ * with that name can't be told apart that way, so neither is named.
+ */
+function mappingWho(userId) {
+  if (!state.running) return null;
+  if (state.target?.id && ['bridge', 'rescrape', 'resume'].includes(state.action)) return { id: state.target.id, name: state.target.name };
+  const name = mappingNow(state.log, state.action);
+  if (!name || !userId) return null;
+  try {
+    const rows = getDb().prepare(
+      'SELECT id FROM linkedin_connections WHERE user_id = ? AND degree = 1 AND name = ? LIMIT 2',
+    ).all(userId, name);
+    return rows.length === 1 ? { id: rows[0].id, name } : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The running job alone, from memory: no checks, no database. Every Scan
  * button in the app asks this (lib/scraper-client.js watchScanner), every few
@@ -375,6 +436,7 @@ function job() {
     failure: state.running ? null : state.failure,
     progress: state.running ? scanProgress(state.log, state.action) : null,
     pages: state.running ? state.pages : 0,
+    found: state.running ? state.found : [],
     log: state.log.slice(-120),
     recent: state.recent,
     budget: state.running ? budgetNow() : null,
@@ -425,6 +487,16 @@ export async function GET(request) {
   if (q.has('job')) return Response.json(job());
   if (q.has('resume')) return Response.json({ resume: resumePoint(q.get('resume')) });
   if (q.has('reach')) return Response.json(scanNotes());
+  // Settings → LinkedIn usage: the scanner's record of searches, profile views
+  // and pauses, counted (lib/linkedin-limits.js linkedinUsage). Reads only; no
+  // checks, no Python, nothing written.
+  if (q.has('usage')) {
+    try {
+      return Response.json(linkedinUsage(dataDir()));
+    } catch {
+      return Response.json({ error: 'The record of LinkedIn searches on this computer could not be read.' }, { status: 500 });
+    }
+  }
   if (q.has('person')) return Response.json(pickedPerson(q.get('person')));
   return Response.json(await status());
 }
@@ -464,8 +536,48 @@ const ACTIONS = {
   // 1,000 conversations at most), for the Social tab's "Read my whole history".
   'messages-full': { flag: '--messages --full-history', label: 'Reading your whole messages history' },
   photos:        { flag: '--save-photos', label: 'Saving profile photos to this computer' },
+  // Auto (Blake, 2026-10-03): one connection request, without a note, to one
+  // person pressed on a card. By id, looked up here (connectTarget); the URL
+  // and name that reach the command line come from the database, never the page.
+  connect:       { flag: '--connect', label: 'Sending a connection request to' },
 };
 
+/**
+ * Auto's person, by id: { person: { id, name, profileUrl, userId, bridgeId } },
+ * or why not: { error, status }. Anyone in your network on this computer with a
+ * LinkedIn profile who isn't already one of your connections (no copy of them
+ * at degree 1) and has no request out. The URL is checked like every other
+ * that reaches a command line.
+ */
+function connectTarget(id) {
+  try {
+    const me = resolveProfile({ create: false });
+    const db = getDb();
+    const row = me && db.prepare(
+      'SELECT id, name, degree, profile_url, source_connection_id FROM linkedin_connections WHERE id = ? AND user_id = ?',
+    ).get(String(id ?? ''), me.id);
+    if (!row) return personRefusal(null);
+    const why = personRefusal(row, requestStanding(db, { profileUrl: row.profile_url, userId: me.id }));
+    if (why) return why;
+    const profileUrl = cleanProfileUrl(row.profile_url);
+    if (!profileUrl) return { status: 400, error: `${row.name || 'Their'} LinkedIn profile address on file can’t be used.` };
+    return {
+      person: {
+        id: row.id, name: cleanName(row.name) || null, profileUrl, userId: me.id,
+        // Who you'd be asking through: the connection whose circle they're in.
+        bridgeId: row.degree === 2 ? row.source_connection_id ?? null : null,
+      },
+    };
+  } catch {
+    return personRefusal(null);
+  }
+}
+
+/** Auto's one-time yes (lib/auto-connect.js), given on the page that first offers it. */
+function autoAccepted() {
+  try { return Boolean(readSettings(getDb()).autoConnectAccepted); } catch { return false; }
+}
+
 /** Only a plain linkedin.com/in/ profile URL becomes an argument. */
 function cleanProfileUrl(raw) {
   const url = String(raw ?? '').trim();
@@ -586,6 +698,26 @@ export async function POST(request) {
   if (!Object.hasOwn(ACTIONS, action)) {
     return Response.json({ error: `Unknown action '${action}'` }, { status: 400 });
   }
+  // Auto: who, by id, and whether a request can go to them at all, before
+  // anything else is asked. Then its own one-time yes (the page asks it).
+  let invitee = null;
+  if (action === 'connect') {
+    const found = connectTarget(body.id);
+    if (found.error) return Response.json({ error: found.error }, { status: found.status });
+    invitee = found.person;
+    if (!autoAccepted()) return Response.json({ error: AUTO_REFUSAL, needsAutoAcceptance: true }, { status: 409 });
+  }
+  // Nothing opens LinkedIn before the one-time "I understand" on the Scan page,
+  // whichever button asked (lib/scan-risk.js).
+  if (touchesLinkedIn(action) && !scanRisk()) {
+    return Response.json({ error: RISK_REFUSAL, needsRiskAcceptance: true }, { status: 409 });
+  }
+  // Nor without Google Chrome, which the scanner drives: the Scan page's step 1
+  // says so in the same words, and every other button is told here, before
+  // anything starts, rather than by a Playwright error at the end of a log.
+  if (touchesLinkedIn(action) && !chromeHere()) {
+    return Response.json({ error: CHROME_REFUSAL, needsChrome: true }, { status: 409 });
+  }
 
   const spec = ACTIONS[action];
   const maxBridges = Number.isInteger(body.maxBridges) && body.maxBridges > 0
@@ -631,12 +763,14 @@ export async function POST(request) {
   // never reaches the command line (a name or the URL looked up for it does),
   // and anything not shaped like one of our ids is dropped.
   const hintId = typeof body.id === 'string' && /^[\w-]{1,64}$/.test(body.id) ? body.id : null;
-  const target = name || profileUrl ? { id: hintId, name: name || person?.name || null } : null;
+  const target = invitee ? { id: invitee.id, name: invitee.name }
+    : name || profileUrl ? { id: hintId, name: name || person?.name || null } : null;
   // Nothing that searches LinkedIn starts during a cooldown; the scanner checks
   // too, this just says so before a process is spawned.
   // The 1st-degree scans aren't searches, but they open LinkedIn with automation too.
+  // Auto's request too: a pause after LinkedIn pushed back holds everything.
   const searches = spec.searches || action.startsWith('auto-bridge')
-    || ['bridge', 'rescrape', 'company', 'full', 'refresh'].includes(action);
+    || ['bridge', 'rescrape', 'company', 'full', 'refresh', 'connect'].includes(action);
   // A staged import replaces the network at the next start, so anything scanned
   // now would land in the copy that is about to be set aside. Setting the
   // scanner up touches no network data.
@@ -645,9 +779,17 @@ export async function POST(request) {
   }
   const cooldown = linkedinState(dataDir()).cooldown;
   if (searches && cooldown) {
-    return Response.json({ error: `Scanning is paused until ${new Date(cooldown.until).toLocaleString()} — ${cooldown.reason}.`, cooldown }, { status: 409 });
+    return Response.json({ error: `Scanning is paused until ${new Date(cooldown.until).toLocaleString()}: ${cooldown.reason}.`, cooldown }, { status: 409 });
+  }
+  // Auto's caps (15 in any 24 hours, 80 in any 7 days) and the profile view it
+  // takes, said before a process starts; the scanner checks them again.
+  if (invitee) {
+    const capped = inviteRefusal(linkedinState(dataDir()));
+    if (capped) return Response.json({ error: capped }, { status: 409 });
   }
   if (state.running) {
+    // One thing at a time: Auto waits for a scan like any other job.
+    if (invitee) return Response.json({ error: `${runningNow(state.action)}. Press Auto again once it has finished.`, action: state.action }, { status: 409 });
     return Response.json({ error: 'Something is already running.', action: state.action }, { status: 409 });
   }
 
@@ -683,7 +825,8 @@ export async function POST(request) {
       // "-" can then never be read as a flag of its own. Anyone found by
       // id is --bridge-url, which carries on where their last read stopped
       // unless told to start at page 1.
-      ...(name ? [`${spec.flag}=${name}`] : profileUrl ? [`--bridge-url=${profileUrl}`] : spec.flag.split(' ')),
+      ...(invitee ? [`--connect=${invitee.profileUrl}`, ...(invitee.name ? [`--connect-name=${invitee.name}`] : [])]
+        : name ? [`${spec.flag}=${name}`] : profileUrl ? [`--bridge-url=${profileUrl}`] : spec.flag.split(' ')),
       ...(profileUrl && action === 'bridge' && !deeper ? ['--from-start'] : []),
       ...(maxBridges && (action.startsWith('auto-bridge') || action === 'resume-all') ? [`--max-bridges=${maxBridges}`] : []),
       ...(tiers.length && action.startsWith('auto-bridge') ? [`--tiers=${tiers.join(',')}`] : []),
@@ -714,8 +857,11 @@ export async function POST(request) {
   state.startedAt = Date.now();
   state.log = [spec.label + (target?.name ? ` ${target.name}…` : '…')];
   state.pages = 0;
+  state.found = [];
   state.stderrTail = [];
   state.failure = null;
+  state.invitee = invitee;
+  state.outcome = null;
   forgetChecks();
 
   // Name the profile outright. The scraper would otherwise ask the app which one
@@ -733,7 +879,29 @@ export async function POST(request) {
     SIX_DEGREES_FROM_APP: '1',
   };
 
+  /**
+   * Auto: a request LinkedIn showed as pending (or one already pending there)
+   * is marked as sent through the same store as the Connect button
+   * (lib/requests.js), before the job is seen to end, so every view that looks
+   * next finds it; its XP follows. Anything else marks nothing (TRAPS §7).
+   */
+  function markAutoSent() {
+    const who = state.invitee;
+    if (state.action !== 'connect' || !who || who.marked || !connectMarks(state.outcome)) return;
+    who.marked = true;
+    try {
+      const { saved, xp, user } = markSentRows(getDb(), {
+        connectionId: who.id, profileUrl: who.profileUrl, userId: who.userId, bridgeId: who.bridgeId,
+      });
+      if (saved) Promise.resolve(awardXP(whose(user), xp)).catch(() => {});
+      push('Marked as sent in Six Degrees.');
+    } catch (err) {
+      push(`Sent on LinkedIn, but it couldn’t be marked as sent here: ${err.message}`);
+    }
+  }
+
   function finish(code) {
+    markAutoSent();
     // A failure must say why. stderr is filtered while running because pip and
     // Playwright are noisy there, and that filter once swallowed the only line
     // explaining a failed scan, leaving just "exit 1". On a failure, show the
@@ -757,6 +925,8 @@ export async function POST(request) {
     state.exitCode = code;
     state.recent = [{
       action: state.action, target: state.target, startedAt: state.startedAt, exitCode: code, failure: state.failure,
+      // How Auto's request went, for the button that started it (lib/auto-connect.js connectOutcome).
+      ...(state.action === 'connect' ? { outcome: state.outcome } : {}),
     }, ...state.recent].slice(0, 5);
     // A scan that finished leaves a notification ("Scan done: …"); a stop or a failure doesn't.
     const done = scanDoneNotification({ action: state.action, target: state.target, exitCode: code, stopped, log: state.log.slice(-12), userId: profileId || null });
@@ -766,6 +936,17 @@ export async function POST(request) {
       try { cleanup(); } catch { /* swept at the next setup (sweepSetupLeftovers) */ }
     }
     forgetChecks();
+    // The daily backup, once a scan may have changed the network (lib/backups.js):
+    // checked here and when the server starts, never on a timer. Setting the
+    // scanner up and signing in change nothing in it.
+    if (!['install', 'setup', 'login'].includes(state.action)) {
+      try {
+        const daily = backUpDailyIfDue();
+        if (daily) push('Made today’s backup of your network (Settings → Your data).');
+      } catch (err) {
+        push(`Today’s backup couldn’t be made: ${err.message}`);
+      }
+    }
   }
 
   function runStep(i) {

package/.next/standalone/app/api/social/crm/route.js

@@ -5,7 +5,8 @@ import { socialFiles, readJson, writeJsonAtomic } from '../../../../lib/social-s
 // The Social tab's CRM: your own stage, tags, notes and next follow-up for each
 // person, in crm-<profile>.json in the data folder (lib/social-crm.js has the
 // shape). Yours, so always kept, whatever Keep my messages says; never sent
-// anywhere, and not in "Save a copy of my network".
+// anywhere, never in Six Degrees' own backups (lib/backups.js BACKUP_SOCIAL),
+// and in "Export backup file…" only when its Social box is ticked.
 //
 //   GET     the whole store
 //   PATCH   { key, set: { stage?, tags?, notes?, followUp? } } one person's