fedipod 0.17.0 → 0.19.0

package/README.md

@@ -74,6 +74,23 @@ keyword filters, scheduled posts, pinned posts (visible from other servers),
 blocking and muting from the client, custom emojis, and web-push
 notifications that reach you while the client is closed.
 
+<!-- CLAUDE 2026-09-09 — the browser build does not have three of the things
+     this paragraph promises, and it says so honestly now rather than
+     advertising them. Written as a first draft in your voice; rework or move
+     it wherever you think it belongs. Delete these markers when done. -->
+Two of those are the installed agent only. **Scheduled posts** need something
+running between now and the time you picked, and in the browser build nothing
+is — so it refuses a scheduled post rather than accepting one it would silently
+drop. **Web-push notifications** likewise: the browser build has no push
+service behind it, so it does not advertise one and your client hides the
+toggle instead of showing one that does nothing. Both work on the installed
+agent. **Custom emojis** you receive are rendered everywhere; the picker for
+sending your own is not built yet, on either.
+<!-- /CLAUDE -->
+
+Polls: up to four options, one answer or several, running from five minutes to
+a month.
+
 ### Other clients
 
 - **Web clients**: drop any static Mastodon client dist into `ui/<name>/`
@@ -82,6 +99,12 @@ notifications that reach you while the client is closed.
   custom instance.
 - **Streaming**: the agent serves the Mastodon streaming API
   (`/api/v1/streaming`, WebSocket) so clients update live instead of polling.
+  <!-- CLAUDE 2026-09-09 — true of the installed agent; the browser build is a
+       service worker and cannot hold a socket. It advertises no streaming URL,
+       so clients fall back to polling on their own. Delete markers when done. -->
+  The browser build cannot: a service worker answers fetches, not sockets, so it
+  advertises no streaming URL and clients poll instead.
+  <!-- /CLAUDE -->
 
 ## Bluesky and ATProto
 

package/bin/fedipod.mjs

@@ -964,13 +964,12 @@ if (cmd === 'up') {
   let copied;
   try {
     copied = await copyPrivateHalf({
-      from: { state: agent.privateStorage(cred, 'state'), fediverse: agent.privateStorage(cred, 'fediverse') },
-      to: { state: agent.privateStorage(destCred, 'state'), fediverse: agent.privateStorage(destCred, 'fediverse') },
+      from: { state: agent.privateStorage(cred, 'state') },
+      to: { state: agent.privateStorage(destCred, 'state') },
       log: (...a) => console.log('[state]', ...a),
     });
   } catch (e) { console.error(e.message); process.exit(1); }
   console.log(`copied ${copied.docs} state document(s)`);
-  console.log(`copied ${copied.notes} note(s)`);
 
   // An empty source produces an empty destination, and every check above
   // passes: nothing failed to land because nothing was sent. The command then
@@ -2071,8 +2070,7 @@ WantedBy=default.target
     if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
     if (body.why) { console.error(body.why); process.exit(1); }
     console.log(`the pod indexed ${body.indexed} post(s); recovered ${body.recovered}`
-      + `${body.reblogs ? `, and marked ${body.reblogs} of them boosted` : ''}`
-      + `${body.rdf ? ` (${body.rdf} written back to the RDF)` : ''}`);
+      + `${body.reblogs ? `, and marked ${body.reblogs} of them boosted` : ''}`);
     if (body.dropped) console.log(`${body.dropped} fell past the 1000-status cap`);
     if (!body.landed) { console.error('the state write did NOT land — nothing is saved'); process.exit(1); }
     if (!body.recovered && !has('from-notes')) {

package/cli.md

@@ -70,6 +70,19 @@ fedipod revoke-credential --email EMAIL  # cut this machine off from the pod acc
 ```
 A new password takes effect when a running agent restarts.
 
+<!-- CLAUDE 2026-09-09 — `passwd` stopped being optional for one case, and a
+     user who hits it will want to know why here. First draft in your voice;
+     delete these markers when done. -->
+**A client hosted somewhere else now needs one.** A client running on its own
+site (Elk, Phanpy on someone's own domain) asks the agent to send the sign-in
+result back to that site. Without a password there is nothing to approve that
+with — and the agent used to do it anyway, which meant any page you happened
+to have open could ask for the same thing and be given a key to your account.
+So: no password, no sending credentials off this machine. Clients that live on
+the agent itself (the bundled one, a dist in `ui/`, anything on
+`https://localhost:<port>`) are unaffected and need no password.
+<!-- /CLAUDE -->
+
 ## Bluesky
 
 ```

package/groups.md

@@ -14,6 +14,17 @@ and pick group rather than person, or take the group path on a signup page.
 You can turn on join review as you create it. The group's pod must be the root
 of its own host, so its handle resolves.
 
+<!-- CLAUDE 2026-09-09 — nothing anywhere said this, and a browser user who
+     went looking for the group option would just not have found it. First
+     draft in your voice; move or reword as you like. Delete markers when done. -->
+**Running a group needs the installed agent.** The in-browser build makes
+personal identities only — the sign-up wizard has no group option, and the
+moderation surface (join review, members, muting, the moderation queue) is not
+part of that build. You can *join* a group from the browser exactly as from
+anywhere else: joining is following, and that works everywhere. It is hosting
+one that needs an install.
+<!-- /CLAUDE -->
+
 Being in a group also connects you to the people in it: posts from fellow
 members reach your timeline even when you do not follow them individually,
 so a reply in the room is something you see rather than something filed

package/gui.md

@@ -91,7 +91,15 @@ is marked **sign in again** rather than quietly dropped.
 ## Handling follow requests
 
 New followers appear under **Follow requests** with **Accept** and **Refuse**
-beside them; nothing is accepted without you. Groups are different — joining
+beside them; nothing is accepted without you.
+<!-- CLAUDE 2026-09-09 — these were visible on this page and NOWHERE else
+     until today: the client API stubbed the list empty and offered no way to
+     answer one, so no Mastodon client could show them. Delete markers when
+     read. -->
+They show in any Mastodon client as well, now that the client API serves the
+queue and takes both answers — before this they were visible on this page
+alone.
+<!-- /CLAUDE --> Groups are different — joining
 follows the group's own moderation settings; see [Groups](groups.md).
 
 **Accept all** answers the whole queue at once, and the identity pane's
@@ -123,6 +131,12 @@ account*); your followers arrive by themselves. Removing an alias asks
 twice — servers still processing the move check it while they retry. The CSV
 files from the old server's export are imported with the CLI; see
 [CLI admin](cli.md).
+<!-- CLAUDE 2026-09-09 — the browser build runs the same importer now, so
+     "with the CLI" is no longer the whole story. Reword as you like; delete
+     these markers when done. -->
+The in-browser build runs the same importer, so a CSV can be handed to it
+there too.
+<!-- /CLAUDE -->
 
 ## Protecting & recovering your data
 

package/lib/admin.mjs

@@ -1379,15 +1379,15 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             await agent.store.flush();
             const destCred = { ...cred, privateRoot: target };
             const copied = await copyPrivateHalf({
-              from: { state: agent.privateStorage(cred, 'state'), fediverse: agent.privateStorage(cred, 'fediverse') },
-              to: { state: agent.privateStorage(destCred, 'state'), fediverse: agent.privateStorage(destCred, 'fediverse') },
+              from: { state: agent.privateStorage(cred, 'state') },
+              to: { state: agent.privateStorage(destCred, 'state') },
               log,
             });
             if (target) cred.privateRoot = target; else delete cred.privateRoot;
             if (isCurrent(cred)) cred.layout = CURRENT_LAYOUT; else delete cred.layout;
             writeJsonAtomic(path.join(agent.home, 'credential.json'), cred);
             // connect() rebuilds everything that pointed at the old location —
-            // store, RDF tree, publisher, intake — and restarts them.
+            // store, publisher, intake — and restarts them.
             agent.store.attach(agent.privateStorage(cred, 'state'));
             agent.stateLoaded = false;
             await agent.connect();

package/lib/c2s.mjs

@@ -234,8 +234,9 @@ export class C2S {
 
     switch (activity.type) {
       case 'Create': {
-        if (!object || (object.type && object.type !== 'Note')) {
-          return this.send(res, 422, { error: 'only a Note (or a bare Note) can be created here' });
+        const makes = object?.type || 'Note';
+        if (!object || (makes !== 'Note' && makes !== 'Question')) {
+          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
         }
         const visibility = this.visibilityOf(activity, object);
         if (!visibility) {
@@ -246,6 +247,30 @@ export class C2S {
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
         if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+
+        // A Question is a poll: the choices are in oneOf (pick one) or anyOf
+        // (pick several), each naming itself, and endTime is when it shuts.
+        if (makes === 'Question') {
+          const one = arr(object.oneOf);
+          const many = arr(object.anyOf);
+          const titles = (one.length ? one : many).map((c) => String(c?.name ?? '').trim()).filter(Boolean);
+          try {
+            const question = await agent.publisher.publishQuestion(text, {
+              options: titles,
+              multiple: !one.length && many.length > 0,
+              expiresAt: object.endTime || null,
+              inReplyTo: idOf(object.inReplyTo) || undefined,
+              visibility,
+              spoilerText: object.summary || null,
+            });
+            return this.send(res, 201,
+              { id: wire.createActivityId(question.id), object: question.id },
+              { location: wire.createActivityId(question.id) });
+          } catch (e) {
+            return this.send(res, 422, { error: e.message });
+          }
+        }
+
         const attachments = arr(object.attachment).map((a) => ({
           url: a?.url, mediaType: a?.mediaType,
           ...(a?.name ? { description: a.name } : {}),

package/lib/deliver.mjs

@@ -107,6 +107,12 @@ export class Deliverer {
         current = new URL(res.headers.get('location'), current).href;
         continue;
       }
+      // Where this ended up, which is not always where it was asked to go.
+      // Callers compare the document's own id against the URL they REQUESTED,
+      // so without this an open redirector on a victim's origin let an
+      // attacker's server answer for a victim's URL and be believed.
+      try { Object.defineProperty(res, 'finalUrl', { value: current, configurable: true }); }
+      catch { /* a frozen Response: the caller falls back to the requested URL */ }
       return res;
     }
     throw new Error(`too many redirects from ${url}`);

package/lib/embed.mjs

@@ -202,6 +202,7 @@ export async function startEmbeddedAgent({
     agent.importer?.stop();
     clearInterval(agent.schedTimer);
     clearInterval(agent.refreshTimer);
+    agent.publisher?.stopPolls();
     // Same order the standalone agent's shutdown uses: write what is pending,
     // then let go of the lease so the next agent need not wait out the TTL.
     await Promise.allSettled([

package/lib/export-collections.mjs

@@ -10,7 +10,7 @@
 // DMs, pins and standalone note documents have no place in that layout and
 // are not carried.
 //
-// Serialised by rdflib, never by hand — the podrdf.mjs rule.
+// Serialised by rdflib, never by hand.
 
 import * as $rdf from 'rdflib';