Implement progression archetype system and enhance Discover gallery

.codegraph/.gitignore

@@ -0,0 +1,16 @@
+# CodeGraph data files
+# These are local to each machine and should not be committed
+
+# Database
+*.db
+*.db-wal
+*.db-shm
+
+# Cache
+cache/
+
+# Logs
+*.log
+
+# Hook markers
+.dirty

.codegraph/daemon.pid

@@ -0,0 +1,6 @@
+{
+  "pid": 2074,
+  "version": "0.9.9",
+  "socketPath": "/home/dlite/charluv/.codegraph/daemon.sock",
+  "startedAt": 1782692670234
+}

.github/workflows/dev-container.yml

@@ -0,0 +1,40 @@
+name: Build DEV container
+
+# Manually build a dev container image from the current branch (e.g.
+# feat/charluv-rewrite) and push it to Docker Hub tagged `:dev`. Run it on
+# dev.charluv.com by pulling demandcluster/charluv:dev.
+on:
+  push:
+    branches:
+      - feat/charluv-rewrite
+  workflow_dispatch:
+
+permissions:
+  packages: write
+  contents: read
+
+jobs:
+  push_dev_image:
+    name: Build and push DEV Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v5
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Build and push DEV image
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          build-args: |
+            SHA=${{ github.sha }}
+          tags: |
+            demandcluster/charluv:dev
+            demandcluster/charluv:dev-${{ github.sha }}

.gitignore

@@ -1,3 +1,4 @@
+/.codegraph
 /.parcel-cache
 /dist
 /node_modules
@@ -24,3 +25,6 @@ settings.json
 !web/pkg/*.js
 !llama3.js
 
+
+# Playwright MCP scratch artifacts
+.playwright-mcp/

.superpowers/sdd/presence-A-report.md

@@ -0,0 +1,60 @@
+# Presence Registry — Task A Report
+
+## Status: GREEN
+
+## TDD Evidence
+
+### RED step (before presence.ts existed)
+Could not run: the file did not exist. The test import `/srv/queue/presence` would have failed with a module-not-found error. The RED phase is implicit: tests were written against the not-yet-created module.
+
+### GREEN step (after presence.ts created and compiled)
+
+```
+presence key derivation
+  ✔ derives user and guest keys
+
+isPresentLocal
+  ✔ user present iff they have a live socket
+  ✔ guest present iff their socket is in allSockets
+  ✔ no identity → present (fail open)
+
+presence redis seam (requires local redis)
+  ✔ mark → present, clear → absent
+  ✔ expired members are reaped → absent
+```
+
+All 5 presence tests PASSED. Redis seam tests RAN (not skipped) against local Redis at 127.0.0.1:6379.
+
+## Test Summary
+
+- Total passing: 106
+- Total failing: 18 (all pre-existing, unrelated to presence)
+- New failures introduced: 0
+
+## Typecheck
+
+`NODE_OPTIONS=--max-old-space-size=6144 pnpm exec tsc -p srv.tsconfig.json --noEmit` → clean (no output, exit 0)
+
+No import cycle issues detected. `presence.ts` imports `bus.ts`; `bus.ts` does NOT import `presence.ts`.
+
+## Prettier
+
+`pnpm exec prettier --check srv/queue/presence.ts tests/queue-presence.spec.ts` → "All matched files use Prettier code style!"
+
+## Files Created
+
+- `/home/dlite/charluv/srv/queue/presence.ts` — registry module (source)
+- `/home/dlite/charluv/srv/queue/presence.js` — compiled output (force-added)
+- `/home/dlite/charluv/srv/queue/presence.js.map` — source map (force-added)
+- `/home/dlite/charluv/tests/queue-presence.spec.ts` — test suite (source)
+- `/home/dlite/charluv/tests/queue-presence.spec.js` — compiled output (force-added)
+- `/home/dlite/charluv/tests/queue-presence.spec.js.map` — source map (force-added)
+
+## Self-Review Checklist
+
+- [x] All exports present with exact signatures (userKey, guestKey, keyFor, PresenceId, PresenceCmd, markRedis, clearRedis, isPresentRedis, isPresentLocal, markPresent, clearPresent, isPresent, startPresenceRefresh)
+- [x] Redis seam tests actually RAN against real redis (not skipped)
+- [x] isPresent fails open (returns true) on errors and when no identity given
+- [x] redisActive() gates redis vs local path
+- [x] Typecheck clean — no import cycle
+- [x] Prettier clean

.superpowers/sdd/presence-C-report.md

@@ -0,0 +1,33 @@
+# Presence Registry Wiring — C Report
+
+## Edits
+
+### `srv/queue/index.ts`
+- Added `import { isPresent, startPresenceRefresh } from './presence'`
+- Changed `inferenceGate` construction to pass `isPresent` as 3rd arg
+- Updated `startQueue()` to call `startPresenceRefresh()`, fold stop-fn into cleanup
+
+### `srv/api/ws/handlers.ts`
+- Added `import { markPresent, clearPresent } from '../../queue/presence'`
+- `login`: added `markPresent({ userId: client.userId }, client.uid)` after `userSockets.set`
+- `logout`: added `clearPresent({ userId }, client.uid)` after `const userId = client.userId`
+
+### `srv/api/ws/handle.ts`
+- Added `import { markPresent, clearPresent } from '../../queue/presence'`
+- End of `handleMessage`: added `markPresent({ socketId: client.uid }, client.uid)` after `allSockets.set`
+- `client.on('close')`: added `clearPresent({ socketId: client.uid }, client.uid)` before `handlers.logout`
+- `client.on('error')`: added `clearPresent({ socketId: client.uid }, client.uid)` before `handlers.logout`
+
+## Typecheck
+`NODE_OPTIONS=--max-old-space-size=6144 pnpm exec tsc -p srv.tsconfig.json --noEmit` — **clean (no output)**
+
+## Prettier
+`pnpm exec prettier --check srv/queue/index.ts srv/api/ws/handlers.ts srv/api/ws/handle.ts` — **All matched files use Prettier code style!**
+
+## Tests
+`pnpm test`: **109 passing, 18 failing** — matches pre-existing baseline; 0 new failures.
+
+## Files Changed
+- `/home/dlite/charluv/srv/queue/index.ts`
+- `/home/dlite/charluv/srv/api/ws/handlers.ts`
+- `/home/dlite/charluv/srv/api/ws/handle.ts`

CLAUDE.md

@@ -0,0 +1,80 @@
+# CLAUDE.md
+
+Guidance for working in this repo. These instructions override default behaviour.
+
+## What this is
+
+Charluv is an AI-companion / dating app — a fork of Agnaistic (Agnai). It carries a lot of
+unused Agnai power-user machinery that is being stripped. Architecture:
+
+- **`web/`** — SolidJS + Tailwind frontend, bundled with **Vite**.
+- **`srv/`** — Express + MongoDB + `ws` backend, compiled with `tsc`.
+- **`common/`** — isomorphic code shared by both (types, prompt building, progression, tokenize).
+- **Inference** — self-hosted **OpenAI-compatible** streaming endpoint for text and a separate
+  self-hosted **SD-compatible** image endpoint. The text model is a custom 24B trained on
+  relationship **stage tokens** `LEVEL("NOVICE" | "BEGINNER" | "LOVER" | "GIRLFRIEND" | "SEX" |
+  "HARDCORE" | "MARRIED" | "DIVORCED" | "BDSM/SLAVE" | "BDSM/DOMINATRIX")`.
+
+## Use codegraph first
+
+A **codegraph** MCP server indexes every symbol/edge/file in the workspace (SQLite knowledge
+graph, sub-ms reads). **Consult it before writing or editing code — do not hand-grep or spawn a
+file-reading sub-agent to explore.**
+
+- Almost any "how does X work / where is X / trace the flow" question → **`codegraph_explore`**
+  (one call returns the verbatim source of the relevant symbols, grouped by file). Usually the
+  only call you need.
+- "What is symbol X" (location only) → `codegraph_search`.
+- "What calls this / what does it call / what breaks if I change it" →
+  `codegraph_callers` / `codegraph_callees` / `codegraph_impact`.
+
+Fall back to Read/Grep only to confirm a specific detail codegraph didn't cover.
+
+## Hard constraints
+
+- **NO data migrations.** `dev.charluv.com` runs on **live production data**. Schema changes must
+  be additive (nullable fields, backward-compatible). Never rename/repurpose a stored id or write
+  a migration job. (E.g. archetype display labels were changed while keeping the stored ids.)
+- **Use `pnpm`, never `npm`** (repo is a pnpm workspace; `npm install` fails).
+- **Moderation runs on the local vision LLM**, not external OpenAI.
+- **Never sexualize minors** — the 18+ safeguard in the levels preamble (`CHARLUV_LEVELS_PROMPT`)
+  applies to all characters.
+- Fix bugs on sight, even pre-existing or unrelated ones — don't just flag them.
+
+## Commands
+
+```bash
+pnpm checks          # format + typecheck + test (run before declaring done)
+pnpm typecheck       # tsc -p tsconfig.json --noEmit (web)
+pnpm test            # mocha tests/**.spec.js
+pnpm start           # concurrently: vite web + watched server + tsc
+```
+
+- **srv typecheck** (heavier, needs more memory):
+  `NODE_OPTIONS=--max-old-space-size=6144 npx tsc -p srv.tsconfig.json --noEmit`
+- Web files can be quickly syntax-checked with `ts.transpileModule` (the bundler is Vite, not tsc).
+- Vite resolves `.ts` before `.js`. Do not check in compiled web `.js`/`.js.map`.
+
+## Domain notes
+
+- **Progression archetypes** (`common/progression.ts`): `ARCHETYPES` (ids `romantic`,
+  `girlfriend`, `casual`, `submissive`, `dominant`) map XP level → stage token. `getArchetype`,
+  `getProgressionSteps`, `resolveStage`. No archetype on a character = **fixed** (no fallback to
+  romantic). Display the `.label`, not the raw id. XP lives on `char.xp`, granted per message.
+- **Credits**: message 10, image gen/regen 25, **create 100** (charged when the AI is finalized
+  on the final wizard step — the hidden draft made on entering that step is free), **edit 30**,
+  LoRA train 300, publish **+500** reward. Free tier refills +5/2min up to 500;
+  premium +20/2min up to 5,000.
+- **Publishing**: any user can make a character public (`published`/`moderation`/`reportCount`
+  fields); auto-publish on the local vision-LLM moderation pass, also surfaced in admin for a
+  second stage; auto-hide at 3 reports.
+
+## Git
+
+- Default branch for PRs is **`trunk`**. Active work is on `feat/charluv-rewrite`.
+- **Commit/push only when explicitly asked.** End commit messages with:
+
+  ```
+  Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
+  Claude-Session: https://claude.ai/code/session_01XXNb2Kcdayr1ZvUpy5a3nA
+  ```

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22.14.0-bullseye-slim
+FROM node:22-bookworm-slim
 
 WORKDIR /app
 VOLUME [ "/app/db" ]
@@ -12,8 +12,15 @@ ARG SHA=unknown
 
 ADD package.json pnpm-lock.yaml ./
 RUN pnpm i --frozen-lockfile
-
-ADD tailwind.config.js tsconfig.json .babelrc .postcssrc .parcelrc .prettierrc srv.tsconfig.json ./
+# pnpm v10 does not run dependency install scripts (even via `pnpm rebuild`), so
+# sharp's native binary — pulled in by @xenova/transformers for long-term memory
+# embeddings — is never fetched. Run sharp's own install script directly to
+# download the prebuilt binary for this platform.
+RUN for d in /app/node_modules/.pnpm/sharp@*/node_modules/sharp; do \
+      if [ -d "$d" ]; then echo "Installing sharp binary in $d"; (cd "$d" && npm run install); fi; \
+    done
+
+ADD tailwind.config.js tsconfig.json .babelrc .postcssrc .prettierrc srv.tsconfig.json vite.config.ts ./
 ADD common/ ./common/
 ADD srv/ ./srv/
 ADD web/ ./web

SECURITY-ACCEPTED.md

@@ -0,0 +1,21 @@
+# Accepted security advisories
+
+These advisories are listed in `package.json` → `pnpm.auditConfig.ignoreGhsas`
+so `pnpm audit` stays clean. Each is genuinely unfixable without breaking the
+build or removing a kept feature, or is non-exploitable in this app. Revisit
+when upstream patches land.
+
+| GHSA | Pkg | Sev | Why accepted |
+|------|-----|-----|--------------|
+| GHSA-848j-6mx2-7j84 | elliptic | low | No patch published (`patched: <0.0.0`). Transitive browser polyfill (`crypto-browserify`). |
+| GHSA-rmmh-p597-ppvv | showdown | mod | No patch published. ReDoS in markdown rendering; swapping to another lib is a core-renderer refactor with regression risk. |
+| GHSA-w5hq-g745-h8pq | uuid | mod | Non-exploitable: advisory affects `v3/v5/v6` with a `buf` arg; this app uses only `v4`. The fix (uuid v11) is ESM-only and breaks the CommonJS server build. |
+| GHSA-4w7w-66w2-5vf9 | vite | mod | Dev-server only (optimized-deps `.map` path traversal). Patched in Vite 6, which breaks `vite-plugin-node-polyfills` (build verified to fail). Dev server is not exposed in prod. |
+| GHSA-v6wh-96g9-6wx3 | vite | mod | Windows-only (launch-editor UNC NTLM). Prod runs Linux. Fix requires Vite 6 (breaks build). |
+| GHSA-fx2h-pf6j-xcff | vite | high | `server.fs.deny` bypass on Windows alternate paths — dev-server + Windows only; prod is Linux and the dev server isn't exposed. Fix requires Vite 6 (breaks build). |
+| GHSA-wgrm-67xf-hhpq | pdfjs-dist | high | Malicious-PDF JS execution. Fix is pdfjs v4 (ESM/worker API break, entangled with `pdfdataextract`). Exploit is self-inflicted — a user importing their **own** PDF for text extraction into their **own** library; no cross-user vector. |
+| GHSA-8fgc-7cc6-rx7x | webpack | low | Transitive **peer** dep of `worker-loader` under `pdfjs-dist`; `pnpm.overrides` don't apply to peer resolution. Tied to the pdfjs-dist item above. |
+| GHSA-38r7-794h-5758 | webpack | low | Same as above. |
+
+All 6 criticals and 59 of 61 highs were eliminated by removals + overrides + bumps
+(audit went 154 → 0 active). See `pnpm.overrides` in `package.json`.

common/abuse.ts

@@ -0,0 +1,16 @@
+/**
+ * Decide how to treat a new registration given whether its device fingerprint
+ * and/or IP already belong to an existing account.
+ *
+ * - both match  -> block   (very high confidence: same person)
+ * - one matches -> restrict (likely duplicate: create, but withhold farmable credits)
+ * - neither     -> allow   (normal signup)
+ */
+export function classifyRegistration(opts: {
+  fpMatch: boolean
+  ipMatch: boolean
+}): 'block' | 'restrict' | 'allow' {
+  if (opts.fpMatch && opts.ipMatch) return 'block'
+  if (opts.fpMatch || opts.ipMatch) return 'restrict'
+  return 'allow'
+}