fedipod 0.10.0 → 0.13.0

package/bin/fedipod.mjs

@@ -1518,7 +1518,7 @@ if (cmd === 'up') {
       if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
       if (body.frontActor) {
         console.log(`attached — this identity now publishes as ${body.address || body.frontActor}`);
-        console.log('Restart the agent (or `fedipod up`) to republish under the front.');
+        console.log('The agent is restarting itself to publish under the front.');
       } else {
         console.log(`attached — your mail now arrives through ${body.url}, filtered; your name has not moved.`);
         console.log('Starting in shadow: the door filters, and the agent measures how much');

package/cli.md

@@ -198,8 +198,8 @@ fedipod gateway --detach
 `--attach` asks the gateway itself: the agent proves the pod with its own
 credential, and the gateway answers with the door and the receipt secret.
 `--name` defaults to your handle; `--fronted` takes a gateway-based name,
-published at the next restart. The admin page's Gateway panel is the same
-action with the name checked as you type.
+and the agent restarts itself to publish under it. The admin page's Gateway
+row offers the same action with the name checked as you type.
 Attaching points your actor's advertised inbox at a gateway's door, so
 deliveries are verified and de-junked before they reach your pod; your name,
 key and data stay on your pod. The URL and secret come from the gateway's

package/gui.md

@@ -74,14 +74,18 @@ accepting automatically.
 
 ## The gateway
 
-The **Gateway** panel attaches this account to a mail-filtering gateway (a
-fedipod.net-style front), shows what its door has verified, and detaches it.
-Give the gateway's address and the name you want there — the panel checks the
-name is free as you type — and choose a pod-based name (`@you@your.pod`) or a
-gateway-based name (`@you@the-gateway`); the gateway account is created
-automatically either way. Attaching proves the pod with the agent's own
-credential, so no password is typed anywhere. Detaching republishes your
-actor with your pod's own inbox.
+The **gateway** row on the record (under **software**) attaches this account
+to a mail-filtering gateway (a fedipod.net-style front) and detaches it; when
+attached it names the gateway, and the handle there when you took one. Both
+buttons open a popup. Attaching offers the choice of handle: keep your
+pod-based handle (`@you@your.pod` — you can drop the gateway any time and
+keep everything), or create a handle at the gateway (`@you@the-gateway` —
+your address lives on the gateway's domain, but not your data or key), typed
+straight into the blank of the address with a free/taken check as you type.
+The gateway account is created automatically with either choice, and the
+agent proves the pod with its own credential, so no password is typed
+anywhere. Taking or leaving a gateway handle restarts the agent by itself;
+detaching republishes your actor with your pod's own inbox.
 
 ## Moving here from another server
 

package/lib/admin.mjs

@@ -16,7 +16,7 @@ import os from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { followHandle, followActor, unfollowActor, ejectFollower, retractAnnouncement,
   admitRequest, refuseRequest, resolveHandle, applyModeration, announceModeration } from './social.mjs';
-import { addRemoveActivity, webfingerHost } from './wire.mjs';
+import { addRemoveActivity, webfingerHost , publicHandle } from './wire.mjs';
 import { MastoApi, hashPassword } from './mastoapi.mjs';
 import { C2S } from './c2s.mjs';
 import { makeC2sAuth } from './oidc-auth.mjs';
@@ -490,7 +490,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // the handle, and the pod host its actor URL sits on.
           let address = null;
           if (live?.handle && live?.actor) {
-            try { address = `${live.handle}@${new URL(live.actor).host}`; } catch { /* not a URL yet */ }
+            try {
+              const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+              address = `${front || live.handle}@${new URL(live.actor).host}`;
+            } catch { /* not a URL yet */ }
           }
           return {
             name, port, current,
@@ -568,6 +571,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         if (!cfg) return json(res, 409, { error: 'agent not configured — set it up at /admin/setup/' });
         const urls = agent.urls || agent.publisher?.urls || null;
         const wfHost = urls ? new URL(urls.base).host : null;
+        // A fronted identity's address is its name AT THE FRONT — the front
+        // serves the actor under that name, whatever this pod calls it.
+        const address = cfg.gateway?.frontActor
+          ? `@${publicHandle(cfg)}@${new URL(cfg.gateway.frontActor).host}`
+          : (wfHost ? `@${cfg.handle}@${wfHost}` : null);
         return json(res, 200, {
           // permanent
           handle: cfg.handle, remotePod: cfg.remotePod, issuer: cfg.issuer,
@@ -578,7 +586,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           // same way every other id is — computed here rather than in the page,
           // which has no business knowing how they are made.
           accountId: urls?.actor ? agent.store.idFor(urls.actor) : null,
-          address: wfHost ? `@${cfg.handle}@${wfHost}` : null,
+          address,
           // editable
           name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
           image: cfg.image || null, fields: cfg.fields || [],
@@ -1445,6 +1453,31 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (agent.publisher) agent.publisher.config.gateway = g;
             await agent.store.flush();
           };
+          // Fronting renames the actor's ids; the signing key is the same
+          // identity's and moves with it, wherever the key record lives.
+          const restampKeys = async (actorId) => {
+            try {
+              const kp = path.join(agent.home, 'keys.json');
+              const rec = JSON.parse(fs.readFileSync(kp, 'utf8'));
+              if (rec.mintedFor) { rec.mintedFor = actorId; fs.writeFileSync(kp, JSON.stringify(rec)); return; }
+            } catch { /* not local — try pod state */ }
+            const podRec = agent.store.read('keys.json', null);
+            if (podRec?.mintedFor) { podRec.mintedFor = actorId; agent.store.write('keys.json', podRec); await agent.store.flush(); }
+          };
+          const podActorId = () => {
+            const base = cfg.remotePod.endsWith('/') ? cfg.remotePod : `${cfg.remotePod}/`;
+            const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'activitypods-js/';
+            return `${base}${root}ap/actor`;
+          };
+          // The reply first, the restart a beat later — same shape as /update.
+          const selfRestart = (why) => setTimeout(() => {
+            log(why);
+            if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
+            const child = spawn(process.execPath, process.argv.slice(1),
+              { detached: true, stdio: 'ignore', env: process.env });
+            child.unref();
+            setTimeout(() => process.exit(0), 300);
+          }, 200);
           if (body.action === 'configure') {
             if (!/^https:\/\/\S+$/.test(String(body.url || ''))) return json(res, 400, { error: 'gateway url must be https' });
             if (!/^https?:\/\/\S+$/.test(String(body.webId || ''))) return json(res, 400, { error: 'gateway webId must be a URL' });
@@ -1507,18 +1540,29 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (agent.embedded) {
               return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
             }
-            const handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
+            const named = !!String(body.handle || '').trim();
+            let handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
             if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
             const fronted = body.fronted === true;
-            const frontActor = `${front}/u/${handle}/ap/actor`;
-            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
-              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
-            }
             // Availability first, for a clean answer before anything is created.
-            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(handle)}`,
+            const avail = async (h) => fetch(`${front}/api/handle?handle=${encodeURIComponent(h)}`,
               { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            let chk = await avail(handle);
             if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            // An unnamed door name is plumbing nobody reads: walk to a free
+            // variant instead of failing over a label the user never chose.
+            if (!chk.available && !named) {
+              for (let i = 2; i <= 9 && !chk.available; i++) {
+                const cand = `${handle}${i}`;
+                const c = await avail(cand);
+                if (c?.available) { handle = cand; chk = c; }
+              }
+            }
             if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
+            const frontActor = `${front}/u/${handle}/ap/actor`;
+            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
+              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
+            }
             const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
               method: 'POST', headers: { 'content-type': 'application/json' },
               body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
@@ -1535,21 +1579,35 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             if (!g.mode || g.mode === 'off') g.mode = 'shadow';
             await persist();
             // Inbox-only applies live: the actor republishes advertising the
-            // door. A front carries new ids, which are wired at startup — that
-            // attach persists and owes a restart.
+            // door. A front carries new ids, which are wired at startup — so a
+            // fronted attach restarts this agent itself, the reply going out
+            // first so it is not taken down with the process.
             if (!fronted) {
               await agent.publisher?.publishProfile();
               await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
+              return json(res, 200, { ok: true, mode: g.mode, url: g.url });
             }
-            return json(res, 200, { ok: true, mode: g.mode, url: g.url,
-              ...(fronted ? { frontActor: g.frontActor, address: d.address || null, restart: true } : {}) });
+            await restampKeys(g.frontActor);
+            json(res, 200, { ok: true, mode: g.mode, url: g.url,
+              frontActor: g.frontActor, address: d.address || null, restarting: true });
+            selfRestart('restarting to publish under the front');
+            return;
           }
           if (body.action === 'forget') {
             const wasLocked = g.mode === 'locked';
+            const wasFronted = !!g.frontActor;
             delete cfg.gateway; agent.store.setConfig(cfg);
             if (agent.publisher) agent.publisher.config.gateway = undefined;
             await agent.store.flush();
             if (wasLocked && inboxUrl) await agent.remote.setAcl(inboxUrl, ['Append']).catch(() => {});
+            if (wasFronted) {
+              // Going home renames every id back to the pod: key and process
+              // follow, the same way attach came.
+              await restampKeys(podActorId());
+              json(res, 200, { ok: true, mode: 'off', forgotten: true, restarting: true });
+              selfRestart('restarting under the pod\'s own ids');
+              return;
+            }
             await agent.publisher?.publishProfile();   // re-advertise the pod inbox
             return json(res, 200, { ok: true, mode: 'off', forgotten: true });
           }

package/lib/front-core.mjs

@@ -130,6 +130,8 @@ function identFor(rec, policy = null) {
 //   host        the front's own host, e.g. "fedipod.net" (for WebFinger subjects)
 //   frontOrigin "https://fedipod.net"
 //   lookup(handle) -> record | null       the directory
+//   listDirectory() -> { handle: record }  every row, for the admin roster
+//   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
 //   podGet(url) -> Response                read a user's pod (public reads; plain fetch is fine)
 export async function routeFront(request, ctx) {
@@ -155,6 +157,51 @@ export async function routeFront(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
   }
 
+  // The admin page: the host reading who has accounts here. The page signs in
+  // and calls the roster API below; a deploy with no admin supplies no page.
+  if (pathname === '/admin') {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+    if (!ctx.adminPage) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
+  }
+
+  // The roster: every directory row, secrets stripped, for the host's own
+  // eyes. The reader proves themself the way attach proves a pod — a
+  // Solid-OIDC token — and must be the WebID the deploy names as admin.
+  if (pathname === '/api/roster') {
+    if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+    const rows = await ctx.listDirectory();
+    const accounts = Object.values(rows)
+      .map((r) => ({
+        handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
+        podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
+        address: `@${r.handle}@${ctx.host}`,
+      }))
+      .sort((a, b) => a.handle.localeCompare(b.handle));
+    return j(200, { host: ctx.host, accounts });
+  }
+
+  // Revoke: the admin removes an account's row, so the server stops answering
+  // for the name. Nothing on the user's pod is touched. Attach-created rows go
+  // for good; a row seeded in the deploy's environment can only be removed there.
+  if (pathname === '/api/revoke' && request.method === 'POST') {
+    if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    if (!(await ctx.lookup(handle))) return j(404, { error: 'no such account' });
+    const removed = (await ctx.removeDirectory(handle)) === true;
+    return j(200, removed ? { handle, removed }
+      : { handle, removed: false,
+          reason: 'this row is seeded in the deploy environment (FEDIPOD_DIRECTORY_JSON) — remove it there and redeploy' });
+  }
+
   // Live handle check for the page: valid shape AND not already in the
   // directory. Also tells the page whether this host offers pods.
   if (pathname === '/api/handle') {

package/lib/mastoapi.mjs

@@ -12,7 +12,7 @@
 
 import crypto from 'node:crypto';
 import * as social from './social.mjs';
-import { sanitizeHtml, followsNeedApproval } from './wire.mjs';
+import { sanitizeHtml, followsNeedApproval, publicHandle } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
@@ -201,7 +201,7 @@ export class MastoApi {
     // No fallback handle. `account()` already reads config for self, so a
     // literal here only ever supplies a name that is not this actor's — and it
     // was a real person's, so every install with no handle called itself jeff.
-    return this.account(this.urls.actor, { selfAcct: this.store.getConfig()?.handle || null });
+    return this.account(this.urls.actor, { selfAcct: publicHandle(this.store.getConfig()) });
   }
 
   account(actorUrl, { selfAcct } = {}) {
@@ -209,7 +209,7 @@ export class MastoApi {
     let host = '', user = cached.preferredUsername || '';
     try { host = new URL(actorUrl).host; if (!user) user = new URL(actorUrl).pathname.split('/').pop(); } catch {}
     const self = actorUrl === this.urls?.actor;
-    if (self) user = selfAcct || this.store.getConfig()?.handle || user;
+    if (self) user = selfAcct || publicHandle(this.store.getConfig()) || user;
     return {
       id: this.store.idFor(actorUrl),
       username: user,

package/lib/publisher.mjs

@@ -75,7 +75,7 @@ export class Publisher {
     const gw = this.config.gateway;
     const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
     const actorDoc = wire.actorDoc({
-      urls, handle: this.config.handle, name: this.config.name, publicKeyPem: this.publicKeyPem,
+      urls, handle: wire.publicHandle(this.config), name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo: this.config.movedTo || null, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,
@@ -173,7 +173,7 @@ export class Publisher {
     await this.remote.setAcl(urls.notes, ['Read']);
 
     await this.publishCollections({ ...ALL_COLLECTIONS, force });
-    const updated = await this.announceProfileChange(actor);
+    const updated = await this.announceProfileChange(actor, { force });
     await this.local.writeSettings({ handle: this.config.handle, actorUrl: urls.actor });
     await this.ensurePrivateAcls();
     const unreachable = await this.verifyPublicSurface();
@@ -188,9 +188,13 @@ export class Publisher {
       this.store.write('published.json',
         { ...this.store.read('published.json', {}), surfaceDigest: surface });
     }
-    this.log(wire.webfingerHost(urls.base)
-      ? `profile published: @${this.config.handle}@${host} → ${urls.actor}`
-      : `profile published → ${urls.actor} — NOT discoverable as @${this.config.handle}@${host}: `
+    // Named as the fediverse sees it: a fronted actor's name and host are the
+    // front's, not the pod's.
+    const pubName = wire.publicHandle(this.config);
+    const pubHost = this.config.gateway?.frontActor ? new URL(this.config.gateway.frontActor).host : host;
+    this.log(this.config.gateway?.frontActor || wire.webfingerHost(urls.base)
+      ? `profile published: @${pubName}@${pubHost} → ${urls.actor}`
+      : `profile published → ${urls.actor} — NOT discoverable as @${pubName}@${pubHost}: `
         + 'this pod is a path on a shared host, and WebFinger is only answered at a host root');
     return { unreachable, updated };
   }
@@ -208,10 +212,12 @@ export class Publisher {
   // A silent first publish was considered and is WRONG here: it would spend a
   // real edit doing nothing but recording a digest, and that edit is exactly the
   // one whose invisibility this fixes.
-  async announceProfileChange(actor) {
+  async announceProfileChange(actor, { force = false } = {}) {
     const digest = crypto.createHash('sha256').update(JSON.stringify(actor)).digest('hex').slice(0, 32);
     const seen = this.store.read('published.json', {});
-    if (seen.actorDigest === digest) return 0;
+    // A forced republish is the operator saying TELL THE WORLD — the digest
+    // gate is for silent no-op saves, not for that.
+    if (seen.actorDigest === digest && !force) return 0;
     this.store.write('published.json', { ...seen, actorDigest: digest, at: new Date().toISOString() });
     const inboxes = [...new Set(this.store.getContacts().followers
       .map(f => f.sharedInbox || f.inbox).filter(Boolean))];
@@ -350,7 +356,7 @@ export class Publisher {
     this.config.movedTo = target;                       // so the republish below carries it
     this.store.setConfig({ ...this.store.getConfig(), movedTo: target, movedAt: at });
     await this.remote.putJson(urls.actor, wire.actorDoc({
-      urls, handle: this.config.handle, name: this.config.name,
+      urls, handle: wire.publicHandle(this.config), name: this.config.name,
       publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
       approveJoins: wire.followsNeedApproval(this.config),
       assertionKey: this.assertionKey,

package/lib/wire.mjs

@@ -21,6 +21,12 @@ export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 // passing advertised ids and the writes still land on the pod. With no
 // `publicBase` the returned object is byte-identical to before — the invariant
 // the smoke suite pins.
+// The handle the fediverse sees: a fronted identity's name is the front's.
+export function publicHandle(config) {
+  return config?.gateway?.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1]
+    || config?.handle || null;
+}
+
 export function apUrls(remotePod, root = 'activitypods-js/', { publicBase = null } = {}) {
   const base = remotePod.endsWith('/') ? remotePod : remotePod + '/';
   const home = base + (!root || root.endsWith('/') ? root : root + '/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.10.0",
+  "version": "0.13.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -47,7 +47,7 @@ import { Lease } from './lib/lease.mjs';
 import { startAdmin } from './lib/admin.mjs';
 import { exposureProblem, hostLabel } from './lib/guard.mjs';
 import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls, assertionKeyId } from './lib/wire.mjs';
+import { apUrls, assertionKeyId , publicHandle } from './lib/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
 
 export class Agent {
@@ -539,7 +539,9 @@ export class Agent {
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.
     this.importer?.resume();
-    this.log(`federating as @${this.store.getConfig()?.handle}@${new URL(this.urls.base).host}`);
+    // The identity the fediverse actually sees: a fronted actor's name and
+    // host are the front's, not the pod's.
+    this.log(`federating as @${publicHandle(this.store.getConfig())}@${new URL(this.urls.actor).host}`);
     if (this.renamed) {
       // The display name lives in the actor document, so a rename only
       // reaches other servers once that is republished.

package/web/admin/admin.js

@@ -142,6 +142,7 @@ function render() {
       .replace(/\/$/, '')],
   ];
   if (config.version || config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
+  rows.push(['gateway', 'ctl']);
   if (config.quiescedAt) rows.push(['parked since', config.quiescedAt]);
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
@@ -185,6 +186,11 @@ function render() {
       FOLLOWS_CTL.hidden = false;
       FOLLOWS_PICK.value = config.autoAcceptFollows ? 'auto' : 'approve';
     }
+    if (k === 'gateway') {
+      dd.textContent = '';
+      dd.append(GATEWAY_CTL);
+      refreshGateway();
+    }
     if (k === 'software') {
       dd.textContent = '';
       dd.append(UPDATE_CTL);
@@ -237,7 +243,6 @@ function render() {
   renderAliases();
   renderOthers();
   renderInbox();
-  renderGateway();
   if (config.kind === 'group') {
     // Its lists have no bound, so this page scrolls — see body.group in the CSS.
     document.body.classList.add('group');
@@ -937,35 +942,62 @@ async function renderInbox() {
   panel.hidden = false;
 }
 
-// The gateway panel: attach through a multi-user front with this agent's own
-// credential, see what the door has verified, detach back to the pod inbox.
-let gwTimer = null;
-async function renderGateway() {
+// The gateway, as a facts row under software: attach through a multi-user
+// front with this agent's own credential, detach back to the pod inbox. The
+// forms live in the floating window, like every other disclosure.
+const GATEWAY_CTL = $('gateway-ctl');           // held: it rides into a generated row
+const GATEWAY_WORD = $('gateway-word');
+const GW_OPEN_ATTACH = $('gateway-open-attach');
+const GW_OPEN_DETACH = $('gateway-open-detach');
+let gwState = null;
+async function refreshGateway() {
   const { status, json: g } = await api('/gateway');
-  if (status !== 200 || !g) return;              // no answer, no surface
-  $('pane-gateway').hidden = false;
+  if (status !== 200 || !g) return;
+  gwState = g;
+  GATEWAY_CTL.hidden = false;
   if (g.configured) {
-    const host = (() => { try { return new URL(g.url).host; } catch { return g.url; } })();
-    const st = g.stats || {};
-    $('gateway-summary').textContent = `Attached to ${host} (mode ${g.mode})`
-      + (g.frontActor ? `, publishing as ${g.frontActor}` : '')
-      + ` — ${st.verified || 0} deliveries verified, ${st.unverified || 0} unverified.`;
-    $('gateway-attach-form').hidden = true;
-    $('gateway-attached').hidden = false;
+    let host = g.url;
+    try { host = new URL(g.url).host; } catch { /* show it as-is */ }
+    const frontName = g.frontActor?.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+    GATEWAY_WORD.textContent = frontName ? `${host} — publishing as @${frontName}@${host}` : host;
+    GW_OPEN_ATTACH.hidden = true;
+    GW_OPEN_DETACH.hidden = false;
   } else {
-    $('gateway-summary').textContent = 'Mail arrives directly at your pod\'s own inbox.';
-    $('gateway-attach-form').hidden = false;
-    $('gateway-attached').hidden = true;
-    if (!$('gw-name').value && config?.handle) $('gw-name').value = config.handle;
+    GATEWAY_WORD.textContent = '';
+    GW_OPEN_ATTACH.hidden = false;
+    GW_OPEN_DETACH.hidden = true;
   }
 }
+const gwShape = () => document.querySelector('input[name=gwShape]:checked')?.value || 'pod';
+function gwPreviews() {
+  $('gw-pod-preview').textContent = config?.address || `@${config?.handle || 'you'}@your.pod`;
+  try { $('gw-front-host').textContent = new URL($('gw-front').value.trim()).host; }
+  catch { /* not a URL yet — the placeholder host stands */ }
+}
+function gwShapeChanged() { gwPreviews(); gwCheck(); }
+for (const r of document.querySelectorAll('input[name=gwShape]')) r.addEventListener('change', gwShapeChanged);
+// Typing in the blank IS choosing that shape.
+$('gw-name').addEventListener('focus', () => {
+  const r = document.querySelector('input[name=gwShape][value=front]');
+  if (!r.checked) { r.checked = true; gwShapeChanged(); }
+});
+GW_OPEN_ATTACH.addEventListener('click', () => {
+  gwShapeChanged();
+  solWindow.show('gateway-attach-form', 'Attach to a gateway');
+});
+GW_OPEN_DETACH.addEventListener('click', () => {
+  $('gw-detach-fronted').hidden = !gwState?.frontActor;
+  $('gw-detach-plain').hidden = !!gwState?.frontActor;
+  solWindow.show('gateway-detach-form', 'Detach from gateway');
+});
 // Live availability, asked through the agent (the front answers it without CORS).
+let gwTimer = null;
 function gwCheck() {
   clearTimeout(gwTimer);
   const front = $('gw-front').value.trim().replace(/\/+$/, '');
   const name = $('gw-name').value.trim().toLowerCase();
   $('gw-name-msg').textContent = ''; $('gw-name-msg').className = 'hint';
-  if (!front || !name) return;
+  if (gwShape() !== 'front' || !front || !name) return;
   gwTimer = setTimeout(async () => {
     const { status, json } = await postJson('/gateway', { action: 'check', front, handle: name });
     if (status !== 200 || !json) return;
@@ -975,24 +1007,30 @@ function gwCheck() {
     $('gw-name-msg').className = json.available ? 'hint' : 'warn';
   }, 300);
 }
-$('gw-front').addEventListener('input', gwCheck);
-$('gw-name').addEventListener('input', gwCheck);
-$('gw-attach').onclick = async () => {
+$('gw-front').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-name').addEventListener('input', () => { gwPreviews(); gwCheck(); });
+$('gw-attach').addEventListener('click', async () => {
   const front = $('gw-front').value.trim().replace(/\/+$/, '');
-  const fronted = $('gw-shape').value === 'front';
+  const fronted = gwShape() === 'front';
+  const name = $('gw-name').value.trim().toLowerCase();
+  if (fronted && !name) { say('give the handle you want at the gateway', 'err'); return; }
   $('gw-attach').disabled = true;
+  // Pod-based sends no name: the door's label is the agent's business, not
+  // the user's, and the agent picks a free variant by itself.
   const r = await write('/gateway',
-    { action: 'attach', front, handle: $('gw-name').value.trim().toLowerCase(), fronted },
-    fronted ? 'attached — restart the agent to publish under the gateway name'
+    { action: 'attach', front, ...(fronted ? { handle: name, fronted: true } : {}) },
+    fronted ? 'attached — the agent is restarting to publish under the gateway handle; reload in a moment'
       : 'attached — your mail now arrives through the gateway, filtered');
   $('gw-attach').disabled = false;
-  if (r) renderGateway();
-};
-$('gw-detach').onclick = async () => {
+  if (r) { closePanels(); refreshGateway(); }
+});
+$('gw-detach').addEventListener('click', async () => {
+  const fronted = !!gwState?.frontActor;
   const r = await write('/gateway', { action: 'forget' },
-    'detached — the actor was republished advertising your pod\'s own inbox');
-  if (r) renderGateway();
-};
+    fronted ? 'detached — the agent is restarting under your pod\'s own name; reload in a moment'
+      : 'detached — the actor was republished advertising your pod\'s own inbox');
+  if (r) { closePanels(); refreshGateway(); }
+});
 
 $('inbox-keep').addEventListener('click', () => {
   dismissed = true;

package/web/admin/index.html

@@ -15,14 +15,14 @@
 :root { color-scheme: light dark; font-size: 112.5%;
   --bar-col: 1280px;                 /* the bar centres on the same column */
   --link: #1a4f8a; --heading: #5b3a8e;
-  --ink: #1b1c1e; --muted: #5f6368;
+  --ink: #1b1c1e; --muted: #4a4e53;
   --btn-bg: #f4efe6; --btn-bg-hover: #ece3d2; --btn-bg-active: #e2d5bd; --btn-edge: #8a7a61;
   --field-bg: #ffffff; --field-bg-hover: #f7f4ee; --field-edge: #767676;
   --danger: #b00020; --ring: var(--link);
   --chevron: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' width='10' height='6'><path d='M1 1l4 4 4-4' fill='none' stroke='%23444444' stroke-width='1.6' stroke-linecap='round'/></svg>"); }
 @media (prefers-color-scheme: dark) {
   :root { --link: #7fb3e8; --heading: #b9a3e3;
-    --ink: #e8eaed; --muted: #a5a9ad;
+    --ink: #e8eaed; --muted: #b9bdc2;
     --btn-bg: #35302a; --btn-bg-hover: #423b31; --btn-bg-active: #4d4436; --btn-edge: #9a8d7a;
     --field-bg: #383d44; --field-bg-hover: #40464e; --field-edge: #9aa0a6;
     --danger: #ff8a8a;
@@ -98,7 +98,8 @@ p { margin: .5rem 0; }
 fieldset { border: 1px solid #bbb; border-radius: .4rem; margin: 1rem 0; padding: .75rem 1rem 1rem; }
 legend { padding: 0 .3rem; font-weight: 600; color: var(--heading); }
 label { display: block; margin: .75rem 0 .2rem; }
-.hint { color: var(--muted); font-size: .9rem; margin: .15rem 0 0; }
+.hint { color: var(--muted); font-size: 1rem; margin: .15rem 0 0; }
+.choice input[type=text] { width: 9ch; display: inline-block; padding: .15rem .3rem; }
 /* SETTINGS: light wells, unmistakably fields, in both schemes. */
 input[type=text], input[type=email], input[type=url], input[type=password], textarea {
   font: inherit; width: 100%; padding: .5rem; box-sizing: border-box;
@@ -314,36 +315,13 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   </span>
 </section>
 
-<!-- The inbox gateway: a mail filter for an account that stays yours. -->
-<section id="pane-gateway" hidden>
-  <h2><span class="hlabel">Gateway</span></h2>
-  <p id="gateway-summary"></p>
-  <div id="gateway-attach-form" hidden>
-    <p class="hint">A gateway filters your fediverse mail before it reaches your pod: your
-      actor advertises the gateway's door as its inbox, each delivery is verified there,
-      spam is dropped, and the rest lands in your pod as before. Attaching proves the pod
-      with this agent's own credential — no password leaves this machine.</p>
-    <p>
-      <label for="gw-front">Gateway</label>
-      <input type="url" id="gw-front" placeholder="https://fedipod.net" autocomplete="off">
-      <label for="gw-name">Your name there</label>
-      <input type="text" id="gw-name" autocomplete="off" autocapitalize="off" spellcheck="false">
-    </p>
-    <p id="gw-name-msg" class="hint"></p>
-    <p>
-      <select id="gw-shape" aria-label="Name shape" title="   Which address the fediverse sees — the pod-based name keeps everything on your pod; a gateway-based name survives changing pods">
-        <option value="pod">keep my pod-based name</option>
-        <option value="front">use a gateway-based name</option>
-      </select>
-      <button id="gw-attach" class="primary" title="   Create the gateway account and point your mail through its door">Attach</button>
-    </p>
-  </div>
-  <div id="gateway-attached" hidden>
-    <p>
-      <button id="gw-detach" class="inline danger" title="   Republish the actor with your pod's own inbox and forget the gateway">Detach</button>
-    </p>
-  </div>
-</section>
+<span id="gateway-ctl" hidden>
+  <span id="gateway-word"></span>
+  <button type="button" id="gateway-open-attach" class="inline" hidden
+    title="   Attach this account to a mail-filtering gateway">Attach to a gateway</button>
+  <button type="button" id="gateway-open-detach" class="inline danger" hidden
+    title="   Go back to your pod's own inbox">Detach from gateway</button>
+</span>
 
 <section id="pane-group" hidden>
   <!-- Both queues are consequences of a moderation setting: with the setting off
@@ -448,6 +426,45 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <!-- Every consequence is written here rather than assembled in script: the
      page asking "are you sure" has to say what it is sure about, and this is
      the only record of it. Script picks which block to show, nothing else. -->
+<!-- The gateway popups: attach proves the pod with this agent's own credential;
+     detach republishes the pod's own inbox. -->
+<form id="gateway-attach-form" hidden>
+  <p class="hint">A gateway filters your fediverse mail before it reaches your pod: each
+    delivery is verified at its door, spam is dropped, and the rest lands in your pod as
+    before. Attaching proves the pod with this agent's own credential — no password
+    leaves this machine.</p>
+  <label for="gw-front">gateway</label>
+  <input type="url" id="gw-front" placeholder="https://fedipod.net" autocomplete="off">
+  <fieldset>
+    <legend>Your fediverse handle</legend>
+    <label class="choice"><input type="radio" name="gwShape" value="pod" checked>
+      Keep my pod-based handle: <strong id="gw-pod-preview"></strong><br>
+      <span class="hint">Your address stays tied to your own pod — you can drop the
+        gateway any time and keep everything.</span></label>
+    <label class="choice"><input type="radio" name="gwShape" value="front">
+      Create a handle at the gateway:
+      @<input type="text" id="gw-name" placeholder="name" autocomplete="off"
+        autocapitalize="off" spellcheck="false">@<span id="gw-front-host">fedipod.net</span><br>
+      <span class="hint">Your address lives on the gateway's domain, but not your data
+        or key; you can change pods later and keep the handle.</span>
+      <span id="gw-name-msg" class="hint"></span></label>
+  </fieldset>
+  <p>
+    <button id="gw-attach" type="button" class="primary"
+      title="   Create the gateway account and point your mail through its door">Attach</button>
+  </p>
+</form>
+<form id="gateway-detach-form" hidden>
+  <p class="hint" id="gw-detach-plain">Deliveries go back to your pod's own inbox — the
+    actor is republished advertising it. Your name and data never moved.</p>
+  <p class="warn" id="gw-detach-fronted" hidden>This identity publishes under the gateway's
+    name. Detaching moves every published id back to the pod — a rename other servers
+    see, not just a mail change.</p>
+  <p>
+    <button id="gw-detach" type="button" class="primary"
+      title="   Forget the gateway and republish the actor with the pod inbox">Detach</button>
+  </p>
+</form>
 <form id="confirm-form" hidden>
   <div id="warn-rotate-key" class="warn" hidden>
     <p>A new keypair replaces the one in this home and the actor is republished so other

package/web/front/admin.html

@@ -0,0 +1,129 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — accounts on this server</title>
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; } }
+  body { font: 19px/1.6 system-ui, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
+  input[type=url] { width: 100%; padding: .5rem .6rem; font: inherit;
+    border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
+    padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
+  .primary[disabled] { opacity: .5; cursor: not-allowed; }
+  button { font: inherit; cursor: pointer; }
+  [hidden] { display: none !important; }
+  table { border-collapse: collapse; width: 100%; margin: 1.2rem 0; }
+  th, td { text-align: left; padding: .5rem .7rem; border-bottom: 1px solid var(--line); }
+  th { font-weight: 600; }
+</style>
+</head>
+<body>
+<h1>Accounts on this server</h1>
+<p class="lede">Every name this server answers for: accounts whose identity lives here, and
+accounts that only use it as their gateway. Sign in as the server's admin to see them.</p>
+
+<form id="roster-form">
+  <p class="field">
+  <label for="roster-issuer">Your identity provider</label>
+  <input type="url" id="roster-issuer" autocomplete="off" value="https://solidcommunity.net">
+  </p>
+  <p class="actions">
+    <button type="submit" id="roster-signin" class="primary">Sign in &amp; list accounts</button>
+  </p>
+  <p class="hint" id="roster-note" hidden></p>
+</form>
+
+<table id="roster-table" hidden>
+  <thead>
+    <tr><th>Account</th><th>Kind</th><th>Identity</th><th>Pod</th><th>Remove</th></tr>
+  </thead>
+  <tbody id="roster-rows"></tbody>
+</table>
+
+<script src="/solid-client-authn.bundle.js"></script>
+<script>
+  const $ = (id) => document.getElementById(id);
+  const note = (text) => { const n = $('roster-note'); n.hidden = !text; n.textContent = text || ''; };
+
+  $('roster-issuer').addEventListener('input', () => {
+    $('roster-signin').disabled = !/^https?:\/\/\S+/.test($('roster-issuer').value.trim());
+  });
+
+  $('roster-form').addEventListener('submit', (ev) => {
+    ev.preventDefault();
+    const auth = window.solidClientAuthentication;
+    if (!auth) { note('the sign-in library did not load — reload and try again'); return; }
+    auth.login({
+      oidcIssuer: $('roster-issuer').value.trim(),
+      redirectUrl: location.origin + '/admin',
+      clientName: 'FediPod admin',
+    }).catch((e) => note('sign-in failed to start: ' + e.message));
+  });
+
+  // Back from the identity provider: read the roster with the proven login.
+  (async () => {
+    const auth = window.solidClientAuthentication;
+    if (!auth) return;
+    const info = await auth.handleIncomingRedirect().catch(() => null);
+    if (!info?.isLoggedIn) return;
+
+    // Signed fetches build a DPoP proof from the URL, so it must be absolute.
+    const load = async () => {
+      let res;
+      try { res = await auth.fetch(location.origin + '/api/roster'); }
+      catch (e) { note('the roster request failed: ' + e.message); return; }
+      const d = await res.json().catch(() => ({}));
+      if (res.status === 403) { note('signed in as ' + info.webId + ', which is not this server’s admin'); return; }
+      if (res.status === 501) { note('this server names no admin — set FEDIPOD_ADMIN_WEBID and redeploy'); return; }
+      if (res.status !== 200) { note('roster unavailable: ' + (d.error || 'HTTP ' + res.status)); return; }
+      const rows = $('roster-rows');
+      rows.textContent = '';
+      for (const a of d.accounts || []) {
+        const tr = document.createElement('tr');
+        const cell = (child) => { const td = document.createElement('td'); td.append(child); tr.append(td); };
+        cell(a.address);
+        cell(a.kind);
+        cell(a.fronted ? 'lives here' : 'gateway only');
+        const pod = document.createElement('a');
+        pod.href = a.podHome; pod.textContent = new URL(a.podHome).host;
+        cell(pod);
+        const rm = document.createElement('button');
+        rm.type = 'button'; rm.textContent = 'Remove';
+        rm.onclick = () => revoke(a);
+        cell(rm);
+        rows.append(tr);
+      }
+      $('roster-table').hidden = false;
+      note((d.accounts || []).length + ' account(s) on ' + d.host);
+    };
+
+    const revoke = async (a) => {
+      if (!confirm('Remove ' + a.address + ' from this server? The name stops resolving here; nothing on their pod is touched.')) return;
+      let res;
+      try {
+        res = await auth.fetch(location.origin + '/api/revoke', {
+          method: 'POST', headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ handle: a.handle }),
+        });
+      } catch (e) { note('the remove request failed: ' + e.message); return; }
+      const d = await res.json().catch(() => ({}));
+      if (res.status !== 200) { note('remove refused: ' + (d.error || 'HTTP ' + res.status)); return; }
+      if (!d.removed) { note(a.address + ' stays: ' + d.reason); return; }
+      await load();
+      note('removed ' + a.address);
+    };
+
+    note('signed in as ' + info.webId + ' — reading the roster…');
+    await load();
+  })();
+</script>
+<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
+</body>
+</html>

package/web/front/run.html

@@ -114,7 +114,8 @@ you to keep running. Sign in with your pod to prove it is yours.</p>
     const n = $('run-note');
     n.hidden = false;
     n.textContent = 'signed in as ' + info.webId + ' — asking the server…';
-    const res = await auth.fetch('/api/agent', {
+    // The signed fetch builds a DPoP proof from the URL, so it must be absolute.
+    const res = await auth.fetch(location.origin + '/api/agent', {
       method: 'POST', headers: { 'content-type': 'application/json' },
       body: JSON.stringify({ action: p.action, podBase: p.podBase }),
     }).catch(() => null);