fedipod-server 0.6.0 → 0.8.0

package/lib/acctfeed.mjs

@@ -0,0 +1,257 @@
+// acctfeed.mjs — polls each connected fediverse account's home timeline and
+// notifications and merges them into the statuses index as kind 'acct'. View
+// cache only: none of it is written to the pod, which holds followed and own
+// content. Modeled on bskyfeed.mjs, which is modeled on tagfeed.mjs.
+//
+// A note is NOT re-fetched at its origin before being stored. The dereference
+// rule guards material an unauthenticated stranger chose for us; this is the
+// owner's own authenticated account answering with the result of the owner's
+// own follow decisions there — the same trust anchor that lets bskyfeed skip
+// it. A local block still applies, because that is the owner's decision.
+//
+// Config in fediacctfeed.json: { intervalMin, accounts: { <id>: marks } }.
+
+import { sanitizeHtml } from './wire.mjs';
+
+const DEFAULTS = { intervalMin: 5 };
+const PER_SWEEP = 40;
+const MAX_PER_ACCT = 150;
+const MAX_ACCT_ENTRIES = 400;
+const BACKOFF_MIN_MS = 5 * 60_000;
+const BACKOFF_MAX_MS = 2 * 60 * 60_000;
+// Mastodon allows 300 requests per five minutes per token. Four go per sweep,
+// so the floor is only ever reached by something else using the same token.
+const RATE_FLOOR = 20;
+
+const MEDIA_TYPES = {
+  image: 'image/jpeg', gifv: 'image/gif', video: 'video/mp4', audio: 'audio/mpeg',
+};
+
+export class AcctFeed {
+  constructor({ store, accounts, log = console.log, onNotification = null }) {
+    Object.assign(this, { store, accounts, log, onNotification });
+    this.state = new Map();          // account id → { failures, quietUntil }
+    this.lastSweep = null;
+    this.lastAdded = 0;
+  }
+
+  config() { return { ...DEFAULTS, ...this.store.read('fediacctfeed.json', {}) }; }
+
+  setConfig(patch) {
+    const clean = {};
+    if (patch.intervalMin) clean.intervalMin = Math.max(1, Number(patch.intervalMin) || DEFAULTS.intervalMin);
+    this.store.write('fediacctfeed.json', { ...this.config(), ...clean });
+    this.stop();
+    this.start();
+    return this.config();
+  }
+
+  marks(id) { return this.config().accounts?.[id] || {}; }
+
+  setMarks(id, patch) {
+    const cfg = this.config();
+    this.store.write('fediacctfeed.json', {
+      ...cfg, accounts: { ...(cfg.accounts || {}), [id]: { ...(cfg.accounts?.[id] || {}), ...patch } },
+    });
+  }
+
+  start() {
+    this.stopped = false;
+    this.sweep().catch(e => this.log(`acctfeed: ${e.message}`));
+    const tick = () => {
+      this.timer = setTimeout(() => {
+        this.sweep()
+          .catch(e => this.log(`acctfeed: ${e.message}`))
+          .finally(() => { if (!this.stopped) tick(); });
+      }, Math.round(this.config().intervalMin * 60_000 * (0.85 + Math.random() * 0.3)));
+      this.timer.unref?.();
+    };
+    tick();
+  }
+
+  stop() { this.stopped = true; clearTimeout(this.timer); }
+
+  // Per account, not per feed: one server being down must not silence the rest.
+  _stateOf(id) {
+    if (!this.state.has(id)) this.state.set(id, { failures: 0, quietUntil: 0 });
+    return this.state.get(id);
+  }
+
+  _backOff(id, handle, status, retryAfter) {
+    const st = this._stateOf(id);
+    st.failures += 1;
+    const ladder = Math.min(BACKOFF_MIN_MS * 2 ** (st.failures - 1), BACKOFF_MAX_MS);
+    const wait = retryAfter || Math.round(ladder * (0.85 + Math.random() * 0.3));
+    st.quietUntil = Date.now() + wait;
+    this.log(`acctfeed: ${handle} ${status ? `answered ${status}` : 'did not answer'} — not asking again for ${Math.round(wait / 60_000)} min`);
+  }
+
+  // One author into the shared actor cache. `uri` is the ActivityPub id, so a
+  // person the pod already knows from its own inbox stays one actor here.
+  _rememberAuthor(a) {
+    const url = a?.uri || a?.url;
+    if (!url) return null;
+    if (!this.store.getActors()[url]) {
+      this.store.cacheActor(url, {
+        name: a.display_name || a.username, preferredUsername: a.username,
+        icon: a.avatar || null, type: a.bot ? 'Service' : 'Person',
+      });
+    }
+    return url;
+  }
+
+  // One Mastodon status into the statuses index. Never pre-checks for a
+  // duplicate: a repeat sighting is what carries the second account's
+  // provenance, and addStatus is the only thing that knows how to merge it.
+  _mirror(st, { acct, via = null, parents = null }) {
+    const noteId = st.uri;
+    if (!noteId) return false;
+    const actor = this._rememberAuthor(st.account);
+    if (!actor || this.store.isBlocked(actor)) return false;
+    const inReplyTo = st.in_reply_to_id ? parents?.get(String(st.in_reply_to_id)) : null;
+    const out = this.store.addStatus({
+      noteId, actor,
+      content: sanitizeHtml(st.content || ''),
+      published: st.created_at,
+      kind: 'acct',
+      sourceAccts: [{ acct, remoteId: String(st.id) }],
+      ...(st.url && st.url !== noteId ? { link: st.url } : {}),
+      ...(inReplyTo ? { inReplyTo } : {}),
+      ...(via ? { via } : {}),
+      ...(st.spoiler_text ? { spoiler: st.spoiler_text } : {}),
+      ...(st.media_attachments?.length ? {
+        attachments: st.media_attachments.map(m => ({
+          url: m.url, mediaType: MEDIA_TYPES[m.type] || 'image/jpeg', description: m.description || '',
+        })),
+      } : {}),
+    });
+    return !!out?.added;
+  }
+
+  // Mastodon threads by its own local ids, which mean nothing anywhere else.
+  // A parent we already hold from this same account can be resolved locally,
+  // and one we do not hold simply has no parent here rather than a fetch.
+  _parentMap(acct) {
+    const map = new Map();
+    for (const s of this.store.getStatuses()) {
+      for (const v of s.sourceAccts || []) {
+        if (v.acct === acct && v.remoteId) map.set(String(v.remoteId), s.noteId);
+      }
+    }
+    return map;
+  }
+
+  _rateGuard(id, handle, res) {
+    const left = Number(res.headers.get('x-ratelimit-remaining'));
+    if (!Number.isFinite(left) || left > RATE_FLOOR) return false;
+    const reset = Date.parse(res.headers.get('x-ratelimit-reset') || '');
+    const wait = Number.isFinite(reset) ? Math.max(0, reset - Date.now()) : BACKOFF_MIN_MS;
+    this._stateOf(id).quietUntil = Date.now() + wait;
+    this.log(`acctfeed: ${handle} has ${left} requests left — waiting ${Math.round(wait / 1000)}s`);
+    return true;
+  }
+
+  async sweep() {
+    const rows = (this.accounts?.list() || []).filter(r => r.token && r.enabled !== false);
+    if (!rows.length) return;
+    this.lastSweep = new Date().toISOString();
+    let added = 0;
+    // The 300ms debounce cannot coalesce a sweep that awaits between items —
+    // every fetch outlives it — so the whole sweep is one commit boundary.
+    // Without this, statuses.json is serialized whole once per post.
+    this.store.hold();
+    try {
+      for (const rec of rows) {
+        if (this.stopped) break;
+        added += await this._sweepOne(rec).catch((e) => {
+          this._backOff(rec.id, rec.handle, e.status || 0, null);
+          return 0;
+        });
+      }
+      this._prune();
+    } finally {
+      this.store.release();
+    }
+    this.lastAdded = added;
+    if (added) this.log(`acctfeed: +${added} from ${rows.length} connected account(s)`);
+  }
+
+  async _sweepOne(rec) {
+    const st = this._stateOf(rec.id);
+    if (st.quietUntil && Date.now() < st.quietUntil) return 0;
+    const marks = this.marks(rec.id);
+    const parents = this._parentMap(rec.id);
+    let added = 0;
+
+    const homeQ = marks.homeSinceId ? `&since_id=${encodeURIComponent(marks.homeSinceId)}` : '';
+    const homeRes = await this.accounts.api(rec.id, `/api/v1/timelines/home?limit=${PER_SWEEP}${homeQ}`);
+    if (this._rateGuard(rec.id, rec.handle, homeRes)) return 0;
+    const home = await homeRes.json().catch(() => []);
+    if (!Array.isArray(home)) throw new Error(`${rec.handle} answered with no timeline`);
+    for (const item of home) {
+      if (item?.reblog) {
+        // A boost: the inner post is the content, the booster is the carrier —
+        // the same envelope statusOrBoost already renders for our own timeline.
+        const via = this._rememberAuthor(item.account);
+        if (this._mirror(item.reblog, { acct: rec.id, via, parents })) added++;
+      } else if (item?.uri) {
+        if (this._mirror(item, { acct: rec.id, parents })) added++;
+      }
+    }
+    // Mastodon returns newest first, so the first row is the new mark.
+    // Ids are 19-digit snowflakes: opaque strings, never numbers.
+    if (home.length && home[0]?.id) this.setMarks(rec.id, { homeSinceId: String(home[0].id) });
+
+    const notifQ = marks.notifSinceId ? `&since_id=${encodeURIComponent(marks.notifSinceId)}` : '';
+    const notifRes = await this.accounts.api(rec.id, `/api/v1/notifications?limit=${PER_SWEEP}${notifQ}`);
+    if (this._rateGuard(rec.id, rec.handle, notifRes)) return added;
+    const notes = await notifRes.json().catch(() => []);
+    if (Array.isArray(notes)) {
+      for (const n of notes) {
+        if (!n?.account || String(n.account.id) === String(rec.accountId)) continue;
+        const actor = this._rememberAuthor(n.account);
+        if (!actor || this.store.isBlocked(actor)) continue;
+        // The post a favourite or boost is about is one of this account's own,
+        // so it is mirrored first — a notification pointing at nothing is a
+        // row the client drops.
+        if (n.status?.uri) this._mirror(n.status, { acct: rec.id, parents });
+        if (n.type === 'favourite' || n.type === 'reblog') {
+          this.store.addNotification({
+            type: n.type === 'favourite' ? 'favourite' : 'reblog',
+            actor, noteId: n.status?.uri, via: rec.id,
+          });
+        } else if (n.type === 'follow' || n.type === 'follow_request') {
+          this.store.addNotification({ type: 'follow', actor, via: rec.id });
+          await this.onNotification?.(n, { actor, acct: rec.id });
+        } else if (n.type === 'mention') {
+          this.store.addNotification({ type: 'mention', actor, noteId: n.status?.uri, via: rec.id });
+          await this.onNotification?.(n, { actor, acct: rec.id });
+        }
+      }
+      if (notes.length && notes[0]?.id) this.setMarks(rec.id, { notifSinceId: String(notes[0].id) });
+    }
+
+    st.failures = 0;
+    return added;
+  }
+
+  // Two caps. The per-account one keeps a busy account from crowding out a
+  // quiet one; the total keeps every connected account together from evicting
+  // the pod's own posts and the timeline it already had.
+  _prune() {
+    const all = this.store.getStatuses();
+    const mine = all.filter(s => s.kind === 'acct');
+    if (!mine.length) return;
+    const drop = new Set();
+    const seen = new Map();
+    for (const s of mine) {
+      const acct = s.sourceAccts?.[0]?.acct || '?';
+      const n = (seen.get(acct) || 0) + 1;
+      seen.set(acct, n);
+      if (n > MAX_PER_ACCT) drop.add(s.noteId);
+    }
+    for (const s of mine.slice(MAX_ACCT_ENTRIES)) drop.add(s.noteId);
+    if (!drop.size) return;
+    this.store.write('statuses.json', all.filter(s => !drop.has(s.noteId)));
+  }
+}

package/lib/admin.mjs

@@ -16,7 +16,7 @@ import os from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { followHandle, followActor, unfollowActor, ejectFollower, retractAnnouncement,
   admitRequest, refuseRequest, resolveHandle, applyModeration, announceModeration } from './social.mjs';
-import { addRemoveActivity, webfingerHost } from './wire.mjs';
+import { addRemoveActivity, webfingerHost , publicHandle } from './wire.mjs';
 import { MastoApi, hashPassword } from './mastoapi.mjs';
 import { C2S } from './c2s.mjs';
 import { makeC2sAuth } from './oidc-auth.mjs';
@@ -27,7 +27,7 @@ import { identityHomes, rootOf, tildify, defaultProfile, writeJsonAtomic } from
 import { copyPrivateHalf, isCurrent, CURRENT_LAYOUT } from './migrate.mjs';
 import { normalizeImport, IMPORT_KINDS } from './import.mjs';
 import { insecureUrlReason } from './safefetch.mjs';
-import { newRun, preflight, runSetup, setupInputError, hasCredential } from './setup.mjs';
+import { newRun, preflight, runSetup, setupInputError, hasCredential, credentialPath } from './setup.mjs';
 import { portFree, freePortFrom } from './ports.mjs';
 import { claimDirectory, yieldDirectory } from './directory.mjs';
 import { localFetch } from './localapi.mjs';
@@ -39,6 +39,38 @@ const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '
 const { makeGate } = require(path.join(projectRoot, 'vendor/gate.cjs'));
 
 const PHANPY_DIR = path.join(projectRoot, 'phanpy/dist');
+// The vendored client is upstream's build, byte for byte, so the integrity
+// check can say so. The two things it needs changed happen on the way out
+// instead of in the files.
+//
+// vite-plugin-pwa injects this registration into every page it builds. The
+// worker it installs answers navigations from a precache and replays the
+// headers stored at install time, so a CSP change can never reach a browser
+// that already has one.
+const SW_REGISTER = /<script id="vite-plugin-pwa:inline-sw">[\s\S]*?<\/script>/i;
+// Removing it stops new installs. This replaces the worker itself, so the ones
+// already out there clean up: browsers re-fetch sw.js on navigation and
+// install what they find. No fetch handler on purpose — a worker without one
+// never intercepts a request, so pages go straight to the network while it
+// runs.
+const SW_KILL = `self.addEventListener('install', () => self.skipWaiting());
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    for (const key of await caches.keys()) await caches.delete(key);
+    await self.registration.unregister();
+    for (const client of await self.clients.matchAll({ type: 'window' })) {
+      try { await client.navigate(client.url); } catch { /* tab will refresh on its own */ }
+    }
+  })());
+});
+`;
+// Null rather than the original when the tag is gone: an upstream change that
+// silently no-opped here would put the worker back, which is the whole thing
+// this exists to prevent.
+function stripSwRegistration(html) {
+  return SW_REGISTER.test(html) ? html.replace(SW_REGISTER, '') : null;
+}
 const UI_DIR = path.join(projectRoot, 'ui');       // extra client dists: ui/<name>/ → /<name>/
 // Our own pages, kept out of ui/ for two reasons: a client dist dropped in
 // there under the same name would shadow them, and a group serves these and
@@ -80,17 +112,46 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(path.join(projectRoot, 'package
 // /shutdown is here because stopping an agent that was never set up is exactly
 // the case it exists for; it is in LOCAL_ONLY_POSTS below, so it still answers
 // only to this machine.
-const OPEN_POSTS = new Set(['/block', '/unblock', '/setup', '/setup/check', '/shutdown']);
+const OPEN_POSTS = new Set(['/block', '/unblock', '/setup', '/setup/check', '/setup/reset', '/shutdown']);
+
+// The page the other server's redirect lands on. Self-contained on purpose:
+// the browser arrives here from somewhere else, and nothing may load from
+// that somewhere.
+function callbackPage(ok, msg) {
+  const esc = (s) => String(s).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  const head = ok ? 'Account connected' : 'Not connected';
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${head}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.7 system-ui, -apple-system, sans-serif; margin: 0;
+         padding: 2.5rem 2rem; background: #ffffff; color: #1a1a1a; }
+  main { max-width: 32rem; margin: 0 auto; }
+  h1 { font-size: 1.375rem; font-weight: 500; margin: 0 0 1rem; }
+  p { margin: 0 0 1rem; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #16161a; color: #ececf0; }
+  }
+</style></head>
+<body><main>
+<h1>${head}</h1>
+<p>${esc(msg)}</p>
+<p>You can close this tab and go back to FediPod.</p>
+</main></body></html>
+`;
+}
 // Routes that manage a local agent process — spawning siblings, killing this
 // one, moving files on the machine, running setup in a browser. Inside a pod
 // server there is no such process and no such machine: identities come from
 // the server's own configuration, so these are not there to be found.
 const EMBEDDED_CUT = new Set(['/profiles', '/shutdown', '/new-actor', '/start-actor',
-  '/state-move', '/setup', '/setup/check']);
+  '/state-move', '/setup', '/setup/check', '/setup/reset']);
 // AP_ALLOWED_HOSTS may name a tailnet host or a reverse-proxy domain. The
 // fediverse is welcome there; creating accounts and editing the record is for
 // whoever is sitting at the machine.
-const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/gateway', '/alias', '/import', '/update']);
+const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/setup/reset', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/fediacct/connect', '/fediacct/disconnect', '/fediacct', '/gateway', '/alias', '/import', '/update']);
 // The identity itself. Changing any of these means a different actor at a
 // different address, which is a new setup, not an edit.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
@@ -118,7 +179,10 @@ function inlineScriptHashes() {
   if (inlineHashes) return inlineHashes;
   inlineHashes = [];
   try {
-    const html = fs.readFileSync(path.join(PHANPY_DIR, 'index.html'), 'utf8');
+    // The page as it is SERVED, not as it sits on disk: hashing the
+    // registration script we strip would allow a script nobody gets.
+    const raw = fs.readFileSync(path.join(PHANPY_DIR, 'index.html'), 'utf8');
+    const html = stripSwRegistration(raw) ?? raw;
     for (const m of html.matchAll(/<script(?![^>]*\ssrc=)[^>]*>([\s\S]*?)<\/script>/gi)) {
       const digest = crypto.createHash('sha256').update(m[1], 'utf8').digest('base64');
       inlineHashes.push(`'sha256-${digest}'`);
@@ -296,7 +360,23 @@ function sendFile(res, baseDir, rel, auth) {
       res.writeHead(403); res.end(); return true;
     }
     const ext = path.extname(real);
-    const body = fs.readFileSync(real);
+    let body = fs.readFileSync(real);
+    // The vendored client, adjusted on the way out rather than in the files.
+    if (real.startsWith(fs.realpathSync(PHANPY_DIR))) {
+      if (path.basename(real) === 'sw.js') {
+        body = Buffer.from(SW_KILL);
+      } else if (ext === '.html') {
+        const stripped = stripSwRegistration(body.toString('utf8'));
+        if (stripped === null) {
+          console.error(`refusing to serve ${path.basename(real)}: no service-worker `
+            + 'registration to remove — the vendored client changed shape');
+          res.writeHead(500, { 'content-type': 'text/plain', ...securityHeaders(auth, false) });
+          res.end('the bundled client changed shape; refusing to serve it\n');
+          return true;
+        }
+        body = Buffer.from(stripped);
+      }
+    }
     // Our own pages are read straight off disk and change whenever the project
     // does. With no cache headers a browser is free to reuse them without
     // asking, so an edited page keeps rendering the old one and looks like the
@@ -490,7 +570,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // the handle, and the pod host its actor URL sits on.
           let address = null;
           if (live?.handle && live?.actor) {
-            try { address = `${live.handle}@${new URL(live.actor).host}`; } catch { /* not a URL yet */ }
+            try {
+              const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+              address = `${front || live.handle}@${new URL(live.actor).host}`;
+            } catch { /* not a URL yet */ }
           }
           return {
             name, port, current,
@@ -508,6 +591,32 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (req.method === 'GET' && p === '/blocks') return json(res, 200, agent.store.getBlocklist());
       if (req.method === 'GET' && p === '/log') return json(res, 200, { lines: agent.logLines(200) });
       if (req.method === 'GET' && p === '/deadletter') return json(res, 200, { items: agent.store.getDeadLetters() });
+      if (req.method === 'GET' && p === '/fediacct') {
+        return json(res, 200, { accounts: agent.fediaccts?.status() || [] });
+      }
+      // Where the other server sends the browser back. A GET, so it gets none
+      // of the POST branch's local-only protection for free and asks for its
+      // own — a code arriving from anywhere else is not the owner's.
+      if (req.method === 'GET' && p === '/fediacct/callback') {
+        if (!embedded && !allowed.isLocalRequest(req)) {
+          return json(res, 403, { error: 'connecting an account is available on this machine only' });
+        }
+        const q = new URL(req.url, 'https://x.invalid').searchParams;
+        const done = (ok, msg) => {
+          res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html; charset=utf-8' });
+          res.end(callbackPage(ok, msg));
+        };
+        if (q.get('error')) return done(false, q.get('error_description') || q.get('error'));
+        if (!q.get('code') || !q.get('state')) return done(false, 'that sign-in came back incomplete');
+        try {
+          const row = await agent.fediaccts.complete({ state: q.get('state'), code: q.get('code') });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return done(true, `${row.handle} is connected.`);
+        } catch (e) { return done(false, e.message); }
+      }
       if (req.method === 'GET' && p === '/tagfeed') {
         return json(res, 200, agent.tagfeed
           ? { ...agent.tagfeed.config(), lastSweep: agent.tagfeed.lastSweep, lastAdded: agent.tagfeed.lastAdded }
@@ -568,6 +677,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         if (!cfg) return json(res, 409, { error: 'agent not configured — set it up at /admin/setup/' });
         const urls = agent.urls || agent.publisher?.urls || null;
         const wfHost = urls ? new URL(urls.base).host : null;
+        // A fronted identity's address is its name AT THE FRONT — the front
+        // serves the actor under that name, whatever this pod calls it.
+        const address = cfg.gateway?.frontActor
+          ? `@${publicHandle(cfg)}@${new URL(cfg.gateway.frontActor).host}`
+          : (wfHost ? `@${cfg.handle}@${wfHost}` : null);
         return json(res, 200, {
           // permanent
           handle: cfg.handle, remotePod: cfg.remotePod, issuer: cfg.issuer,
@@ -578,7 +692,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // same way every other id is — computed here rather than in the page,
           // which has no business knowing how they are made.
           accountId: urls?.actor ? agent.store.idFor(urls.actor) : null,
-          address: wfHost ? `@${cfg.handle}@${wfHost}` : null,
+          address,
           // editable
           name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
           image: cfg.image || null, fields: cfg.fields || [],
@@ -605,6 +719,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           atproto: cfg.atproto
             ? { ...cfg.atproto, connected: !!agent.atproto?.connected() }
             : null,
+          // Connected fediverse accounts, from the credentials themselves
+          // rather than from config — a roster entry whose file was deleted
+          // should stop being listed, not linger.
+          fediAccounts: agent.fediaccts?.status() || [],
           origins: {
             loopback: publicOrigin
               || `https://localhost:${port}/`,
@@ -730,6 +848,34 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         }
         // ---- setup, driven by the page at /admin/setup/ ----
         case '/setup/check': return json(res, 200, preflight(body));
+        // Discard a credential that never finished setup, so the account and
+        // pod can be entered again. The credential a CSS server mints is shown
+        // once, so a setup that stops after the mint (a wrong pod answers 401
+        // to the first write) leaves the form in "finish" mode with no way to
+        // re-enter what was wrong. This removes it locally and reopens the full
+        // form. It does NOT revoke server-side — that needs the account
+        // password (`fedipod revoke-credential`); the old credential is left on
+        // the account, revocable from its dashboard.
+        case '/setup/reset': {
+          if (isCrossSiteNavigation(req)) return json(res, 403, { error: 'cross-site request' });
+          // A working identity is never swapped out this way — that is a
+          // teardown (`fedipod retire`), not a half-finished setup.
+          if (agent.configured()) {
+            return json(res, 409, { error: 'this home holds a working identity — retire it, do not reset' });
+          }
+          if (setupRun?.phase === 'running') {
+            return json(res, 409, { error: 'setup is running — let it finish or stop it first', phase: 'running' });
+          }
+          const home = agent.home;
+          if (!home) return json(res, 500, { error: 'this agent has no AP_HOME to reset' });
+          const removed = hasCredential(home);
+          if (removed) fs.rmSync(credentialPath(home), { force: true });
+          // Drop the pod handle too, so configured() cannot flicker true off a
+          // stale in-memory session while the fresh form is filled in.
+          agent.remote = null;
+          setupRun = null;
+          return json(res, 200, { ok: true, removed });
+        }
         case '/setup': {
           // A visited page must not be able to navigate this into existence.
           if (isCrossSiteNavigation(req)) return json(res, 403, { error: 'cross-site request' });
@@ -1296,6 +1442,38 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           await agent.store.flush();
           return json(res, 200, { ok: true, atproto: { ...cfg.atproto, crossPost: !!body.crossPost } });
         }
+        case '/fediacct/connect': {
+          // Starts the sign-in at the other server. Loopback-only, and the
+          // redirect returns to the origin the owner is actually using, not a
+          // guess — a client reaches this agent by several names.
+          if (!body.host) return json(res, 400, { error: 'the address of the server is required' });
+          try {
+            const { url } = await agent.fediaccts.begin({
+              host: body.host, redirectUri: `https://${req.headers.host}/fediacct/callback`,
+            });
+            return json(res, 200, { ok: true, authorize: url });
+          } catch (e) { return json(res, 400, { error: e.message }); }
+        }
+        case '/fediacct/disconnect': {
+          if (!body.id) return json(res, 400, { error: 'id required' });
+          if (!agent.fediaccts.remove(body.id)) return json(res, 404, { error: 'no such account' });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return json(res, 200, { ok: true });
+        }
+        case '/fediacct': {
+          // Non-secret settings only — today that is whether it is polled.
+          if (!body.id) return json(res, 400, { error: 'id required' });
+          const row = agent.fediaccts.setEnabled(body.id, !!body.enabled);
+          if (!row) return json(res, 404, { error: 'no such account' });
+          const cfg = agent.store.getConfig();
+          agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+          await agent.store.flush();
+          agent.restartAccts?.();
+          return json(res, 200, { ok: true, account: row });
+        }
         case '/archive': {
           // Whether drained mail's original bytes are kept in the private
           // half's inbox-archive/. Absent means on.
@@ -1445,6 +1623,31 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (agent.publisher) agent.publisher.config.gateway = g;
             await agent.store.flush();
           };
+          // Fronting renames the actor's ids; the signing key is the same
+          // identity's and moves with it, wherever the key record lives.
+          const restampKeys = async (actorId) => {
+            try {
+              const kp = path.join(agent.home, 'keys.json');
+              const rec = JSON.parse(fs.readFileSync(kp, 'utf8'));
+              if (rec.mintedFor) { rec.mintedFor = actorId; fs.writeFileSync(kp, JSON.stringify(rec)); return; }
+            } catch { /* not local — try pod state */ }
+            const podRec = agent.store.read('keys.json', null);
+            if (podRec?.mintedFor) { podRec.mintedFor = actorId; agent.store.write('keys.json', podRec); await agent.store.flush(); }
+          };
+          const podActorId = () => {
+            const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
+            const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+            return `${base}${root}ap/actor`;
+          };
+          // The reply first, the restart a beat later — same shape as /update.
+          const selfRestart = (why) => setTimeout(() => {
+            log(why);
+            if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
+            const child = spawn(process.execPath, process.argv.slice(1),
+              { detached: true, stdio: 'ignore', env: process.env });
+            child.unref();
+            setTimeout(() => process.exit(0), 300);
+          }, 200);
           if (body.action === 'configure') {
             if (!/^https:\/\/\S+$/.test(String(body.url || ''))) return json(res, 400, { error: 'gateway url must be https' });
             if (!/^https?:\/\/\S+$/.test(String(body.webId || ''))) return json(res, 400, { error: 'gateway webId must be a URL' });
@@ -1507,18 +1710,29 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (agent.embedded) {
               return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
             }
-            const handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
+            const named = !!String(body.handle || '').trim();
+            let handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
             if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
             const fronted = body.fronted === true;
-            const frontActor = `${front}/u/${handle}/ap/actor`;
-            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
-              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
-            }
             // Availability first, for a clean answer before anything is created.
-            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(handle)}`,
+            const avail = async (h) => fetch(`${front}/api/handle?handle=${encodeURIComponent(h)}`,
               { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            let chk = await avail(handle);
             if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            // An unnamed door name is plumbing nobody reads: walk to a free
+            // variant instead of failing over a label the user never chose.
+            if (!chk.available && !named) {
+              for (let i = 2; i <= 9 && !chk.available; i++) {
+                const cand = `${handle}${i}`;
+                const c = await avail(cand);
+                if (c?.available) { handle = cand; chk = c; }
+              }
+            }
             if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
+            const frontActor = `${front}/u/${handle}/ap/actor`;
+            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
+              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
+            }
             const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
               method: 'POST', headers: { 'content-type': 'application/json' },
               body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
@@ -1535,21 +1749,35 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (!g.mode || g.mode === 'off') g.mode = 'shadow';
             await persist();
             // Inbox-only applies live: the actor republishes advertising the
-            // door. A front carries new ids, which are wired at startup — that
-            // attach persists and owes a restart.
+            // door. A front carries new ids, which are wired at startup — so a
+            // fronted attach restarts this agent itself, the reply going out
+            // first so it is not taken down with the process.
             if (!fronted) {
               await agent.publisher?.publishProfile();
               await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
+              return json(res, 200, { ok: true, mode: g.mode, url: g.url });
             }
-            return json(res, 200, { ok: true, mode: g.mode, url: g.url,
-              ...(fronted ? { frontActor: g.frontActor, address: d.address || null, restart: true } : {}) });
+            await restampKeys(g.frontActor);
+            json(res, 200, { ok: true, mode: g.mode, url: g.url,
+              frontActor: g.frontActor, address: d.address || null, restarting: true });
+            selfRestart('restarting to publish under the front');
+            return;
           }
           if (body.action === 'forget') {
             const wasLocked = g.mode === 'locked';
+            const wasFronted = !!g.frontActor;
             delete cfg.gateway; agent.store.setConfig(cfg);
             if (agent.publisher) agent.publisher.config.gateway = undefined;
             await agent.store.flush();
             if (wasLocked && inboxUrl) await agent.remote.setAcl(inboxUrl, ['Append']).catch(() => {});
+            if (wasFronted) {
+              // Going home renames every id back to the pod: key and process
+              // follow, the same way attach came.
+              await restampKeys(podActorId());
+              json(res, 200, { ok: true, mode: 'off', forgotten: true, restarting: true });
+              selfRestart('restarting under the pod\'s own ids');
+              return;
+            }
             await agent.publisher?.publishProfile();   // re-advertise the pod inbox
             return json(res, 200, { ok: true, mode: 'off', forgotten: true });
           }