fedipod 1.40.0 → 1.43.0

package/lib/core/deliver.mjs

@@ -61,9 +61,14 @@ export class Deliverer {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
+  // defer: nothing is sent now; every delivery goes on the queue, signed, for
+  // drainQueue() to make. For a process with seconds to answer — a door
+  // placing a post as it lands — which records what to send and leaves the
+  // sending to the run it starts.
   constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false, onGone = null }) {
+    log = console.log, passive = false, defer = false, onGone = null }) {
     this.store = store;
+    this.defer = defer;
     // Called after followers at a gone inbox are dropped: the agent republishes
     // its followers collection.
     this.onGone = onGone;
@@ -205,6 +210,7 @@ export class Deliverer {
     // Proved before anything else, so the copy that goes on the queue is the
     // copy that was signed — a retry days later must not post a bare activity.
     const signed = await this.proofed(activity);
+    if (this.defer) { this._enqueue({ inbox, activity: signed, attempts: 0, nextAt: Date.now() }); return; }
     if (this._queueIfCooling(inbox, signed)) return;
     const [result] = await this.deliverManyNow([{ inbox, activity: signed }]);
     await this._settle(inbox, signed, result);
@@ -273,6 +279,10 @@ export class Deliverer {
     // by the next.
     const targets = [...new Set(inboxes)].filter((inbox) => !this._blockedInbox(inbox))
       .map((inbox) => ({ inbox, activity: signed }));
+    if (this.defer) {
+      for (const t of targets) this._enqueue({ inbox: t.inbox, activity: signed, attempts: 0, nextAt: Date.now() });
+      return;
+    }
     for (let i = 0; i < targets.length; i += this.batchSize) {
       const chunk = targets.slice(i, i + this.batchSize).filter((t) => !this._queueIfCooling(t.inbox, signed));
       if (!chunk.length) continue;

package/lib/core/gateway-move.mjs

@@ -0,0 +1,58 @@
+// gateway-move.mjs — the second half of a DeviceAgent moving an address from
+// one gateway to another (lib/device/setup.mjs does the first, when a pod
+// that already holds an account at another gateway is set up with an address
+// at this one). The browser build has the same two halves in
+// web/app/gateway-move.mjs; this is the Node one, which signs and delivers
+// itself instead of going through a relay.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved with
+//      the pod session as attach was). From then on it serves the old actor
+//      as a moved stub — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id: the only signature a follower's server can verify against
+//      the old actor. Same key material; only the key id differs.
+//
+// Runs when the agent starts acting, and is safe to run again: a move left
+// pending (the old gateway unreachable) is tried at the next start.
+import { Deliverer } from './deliver.mjs';
+import { moveActivity } from './wire.mjs';
+
+export async function completeGatewayMove(agent, { makeDeliverer = (o) => new Deliverer(o) } = {}) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log || (() => {});
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.remote.session.fetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry at the next start`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = makeDeliverer({
+    store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log, passive: true,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/lib/core/intake/group.mjs

@@ -171,6 +171,16 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
     serial: intake.serial++,
     audience: intake.urls.actor,
   });
+  // What the group is about to carry is what the group's conversation holds.
+  // A forum places the post in its topic here, BEFORE the carry: the topic is
+  // what the category vouches for (FEP-7888), and a place that will not take
+  // the post — a locked topic — answers false and nothing is carried. Both
+  // the Announce and what its author sent: a forum reads the author's own
+  // activity — the name they gave the topic they were opening is on that one.
+  if (intake.onCarry) {
+    const placed = await intake.onCarry({ noteId, actor: s.actor, activity: act, sent: activity });
+    if (placed === false) { intake.log(`not amplified — ${noteId} has no place here`); return; }
+  }
   await intake.deliverer.deliverToAll(inboxes, act);
   // Marked carried before recorded: a failed outbox write costs one missing
   // entry, a failed status write would carry the same post twice.
@@ -180,17 +190,6 @@ export async function amplify(intake, noteId, { approved = false, activity = nul
   if (!intake.config.private) await intake.publisher.recordOutbox(act);
   intake.store.setPending(intake.store.getPending().filter(p => p.noteId !== noteId));
   intake.log(`amplified ${noteId} → ${inboxes.length} inbox(es)`);
-  // What the group carried is what the group's conversation holds. A forum
-  // places the post in its topic here — after the carry, so only what the
-  // category vouched for is in the topic (FEP-7888 ownership). Its failure
-  // never undoes the carry.
-  if (intake.onCarried) {
-    // Both: what the group said (the Announce) and what its author sent. A
-    // forum reads the author's own activity — the name they gave the topic
-    // they were opening is on that one, and on no other.
-    await intake.onCarried({ noteId, actor: s.actor, activity: act, sent: activity })
-      .catch(e => intake.log(`after the carry of ${noteId}: ${e.message}`));
-  }
   // The same carry, shown natively to the group's Bluesky followers.
   await intake.bskyGroup?.mirrorCarry(s)
     .catch(e => intake.log(`bluesky mirror of the carry failed: ${e.message}`));

package/lib/core/keys.mjs

@@ -12,7 +12,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { writeJsonAtomic } from '../device/home.mjs';
+import { writeJsonAtomic } from '../shared/files.mjs';
 
 const RSA_ALG = { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' };
 

package/lib/core/lease.mjs

@@ -40,6 +40,7 @@ export class Lease {
     this.timer = null;
     this.heldUntil = 0;   // wall-clock end of the lease we last wrote
     this.denied = null;   // why the last acquire() said no: 'unreadable' | 'held'
+    this.unreadable = null;   // and, when unreadable, what the read got: "HTTP 403", or the error
   }
 
   // null means the lease document is NOT THERE — nobody holds it. UNREADABLE
@@ -52,9 +53,9 @@ export class Lease {
     try {
       res = await this.fetchImpl(this.url, { headers: { accept: 'application/json' } });
       if (res.status === 404 || res.status === 410) return null;
-      if (res.status >= 400) return UNREADABLE;
+      if (res.status >= 400) { this.unreadable = `HTTP ${res.status}`; return UNREADABLE; }
       body = await res.text();
-    } catch { return UNREADABLE; }
+    } catch (e) { this.unreadable = e.message; return UNREADABLE; }
     this.etag = res.headers?.get?.('etag') || null;
     // A 200 carrying garbage — a half-written PUT, a proxy error page served
     // as 200 — is not a lease anybody holds, and overwriting it is the repair.
@@ -87,7 +88,7 @@ export class Lease {
     // an inconvenience; two agents both draining is the destructive one.
     if (cur === UNREADABLE) {
       this.denied = 'unreadable';
-      this.log('lease unreadable — staying a viewer'); return false;
+      this.log(`lease unreadable (${this.unreadable}) — staying a viewer`); return false;
     }
     if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) { this.denied = 'held'; return false; }
     const doc = { holder: this.id, expiresAt: Date.now() + TTL_MS };

package/lib/core/publisher/index.mjs

@@ -9,12 +9,9 @@
 // up), questions.mjs (polls) — each a set of functions taking the Publisher
 // as their first argument, reached here through one-line delegations.
 
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
-import { USER_AGENT } from '../../shared/ua.mjs';
+import { USER_AGENT, AGENT_VERSION } from '../../shared/ua.mjs';
 import { HTTP_TIMEOUT_MS } from '../../shared/safefetch.mjs';
 import * as containers from '../../pod/containers.mjs';
 import * as discovery from '../../pod/discovery.mjs';
@@ -31,8 +28,9 @@ import * as questions from './questions.mjs';
 import * as own from './own.mjs';
 import { recordPlace } from '../place.mjs';
 
-const AGENT_VERSION = JSON.parse(fs.readFileSync(
-  path.join(path.dirname(fileURLToPath(import.meta.url)), '../../../package.json'), 'utf8')).version;
+// The version is read where a bundled deploy (the Netlify functions) cannot
+// break it: a package.json that is not beside the bundle is not a reason for
+// the gateway to fail to start (2026-09-26).
 
 export class Publisher {
   constructor({ config, remote, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,

package/lib/core/publisher/notes.mjs

@@ -203,13 +203,45 @@ export async function updateObject(publisher, s, patch, { updated = new Date().t
 }
 
 // What the author's own timeline shows for an object: its content, else its
-// text under one of the names other vocabularies use, else a link to it.
+// text under one of the names other vocabularies use, else a link to it. An
+// annotation's text is preceded by a link to the page it is on and the words
+// it was made on, quoted.
 export function rowContent(obj) {
+  const text = objectText(obj);
+  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  const on = annotationTarget(obj);
+  const link = on.page ? `<a href="${esc(on.page)}">${esc(on.page)}</a>` : '';
+  const context = on.exact
+    ? `<p>${link ? `text from ${link}:` : 'text:'}</p><blockquote><p>${esc(on.exact)}</p></blockquote>`
+    : (link ? `<p>${link}</p>` : '');
+  if (text) return context ? `${context}<p>comment:</p>${text}` : text;
+  return context || `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+}
+
+function objectText(obj) {
   if (typeof obj?.content === 'string' && obj.content.trim()) return wire.sanitizeHtml(obj.content);
   const plain = [obj?.bodyValue, obj?.name, obj?.summary].find((v) => typeof v === 'string' && v.trim());
   if (plain) return wire.contentHtml(plain);
-  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
-  return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+  // A Web Annotation's textual bodies, as a plain or an HTML string, or a
+  // JSON-LD value.
+  const bodies = [].concat(obj?.body || []).map((b) => (b && typeof b === 'object' && b.purpose !== 'tagging'
+    ? (b.value && typeof b.value === 'object' ? b.value['@value'] : b.value) : null))
+    .filter((v) => typeof v === 'string' && v.trim());
+  return bodies.map((v) => (/<[a-z]/iu.test(v) ? wire.sanitizeHtml(v) : wire.contentHtml(v))).join('');
+}
+
+// An annotation's target: the page (its source, or the target itself) and the
+// words quoted by a TextQuoteSelector, each a plain string or a JSON-LD value.
+function annotationTarget(obj) {
+  const val = (v) => (v && typeof v === 'object' ? v['@value'] ?? v.id : v);
+  for (const t of [].concat(obj?.target || [])) {
+    const page = val(typeof t === 'string' ? t : (t?.source ?? t?.id));
+    const quote = [].concat(t?.selector || []).find((sel) => sel?.type === 'TextQuoteSelector');
+    const exact = val(quote?.exact);
+    const ok = typeof page === 'string' && /^https?:\/\//u.test(page);
+    if (ok || exact) return { page: ok ? page : null, exact: typeof exact === 'string' && exact.trim() ? exact.trim() : null };
+  }
+  return { page: null, exact: null };
 }
 
 // `quote`: the post this one quotes, `{ id, actor }` — the quoted author is
@@ -329,7 +361,12 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // An object already living on this pod (an id under it) is not copied: the
 // Create names it where it is. Anything else is written into the notes
 // container under the client's slug when it is free, else a minted one.
-export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null, also = [], deliverTo = [] } = {}) {
+//
+// `unaddressed`: an object its client addressed to nobody, as dokieli sends
+// an annotation. It is kept as sent in the notes container, readable at its
+// address, and delivered to nobody; only its owner's outbox lists it.
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null, also = [], deliverTo = [], unaddressed = false } = {}) {
+  if (unaddressed) return publishUnaddressed(publisher, object, wanted);
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -384,6 +421,38 @@ export async function publishObject(publisher, object, { visibility = 'public',
   return { id, createId, copied: !ownId };
 }
 
+async function publishUnaddressed(publisher, object, wanted) {
+  const { urls } = publisher;
+  const published = new Date().toISOString();
+  const pod = publisher.config?.remotePod || urls.base;
+  const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
+    ? object.id : null;
+  const name = await slugFor(publisher, urls.notes, wanted, published);
+  const id = ownId || urls.notes + name;
+  let doc = null;
+  if (!ownId) {
+    const { bto, bcc, ...sent } = object;   // eslint-disable-line no-unused-vars
+    doc = { ...sent, id, attributedTo: urls.actor, published: object.published || published };
+    if (!doc['@context']) doc['@context'] = wire.AS_CTX;
+    if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
+    await podNotes.write(publisher.remote, id, doc);
+  }
+  const row = doc || object;
+  publisher.store.addStatus({
+    noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
+    kind: 'post', slug: name, visibility: 'direct',
+  });
+  if (await publisher.store.commit?.() === false) publisher.log(`object kept but its timeline row was refused: ${id}`);
+  const create = {
+    '@context': wire.AS_CTX, id: wire.createActivityId(ownId ? urls.notes + name : id), type: 'Create',
+    actor: urls.actor, published: row.published || published, object: doc || id,
+  };
+  await podNotes.writeCreate(publisher.remote, create.id, create);
+  publisher.recordOwn?.(create);
+  publisher.log(`${row.type || 'object'} kept, addressed to nobody: ${id}`);
+  return { id, createId: create.id, copied: !ownId };
+}
+
 // What the author's timeline row keeps of a note's tags: the people it
 // mentions and the hashtags it carries, each as the client-facing shape.
 export function rowTags(note) {

package/lib/core/remote.mjs

@@ -0,0 +1,54 @@
+// remote.mjs — the Node agent's pod transport: CSS client-credentials + DPoP
+// (vendor/idp-grant.cjs, extracted from data-kitchen's "remember this IdP"
+// machinery — plain Node, no Electron).
+//
+// Everything about talking to a pod — the verbs, the ACL documents, the
+// deletion deny-list, the Retry-After cooldown, the container listing — lives
+// in lib/pod/transport.mjs, which knows nothing about Node and is shared with
+// the browser. What is left here is the one thing that genuinely differs: how
+// the session is obtained. That top-level `require` of the vendor grant is also
+// exactly why the split exists — it cannot be bundled for a service worker.
+
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PodTransport } from '../pod/transport.mjs';
+
+const require = createRequire(import.meta.url);
+const vendorDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../vendor');
+const { mintCredential, discoverTokenEndpoint, createGrantSession, revokeCredentialViaAccount } =
+  require(path.join(vendorDir, 'idp-grant.cjs'));
+
+export { mintCredential, discoverTokenEndpoint, revokeCredentialViaAccount };
+
+// Re-exported so the callers that guard their own deletions — run-agent, the
+// server package's live test, the smoke suite — keep importing it from here.
+export { protectedFromDeletion } from '../pod/transport.mjs';
+
+export class RemotePod extends PodTransport {
+  constructor(credential, { log = () => {}, home = null, session = null, role = 'agent' } = {}) {
+    // An injected session replaces the credential-backed one, and everything
+    // above it — the cooldown, the deny-list, the url map — is unchanged. That
+    // is how the agent runs inside a pod server: same class, no token to mint.
+    super(session || createGrantSession(credential, home ? {
+      backoffFile: path.join(home, 'backoff.json'),
+      tokenFile: path.join(home, 'token.json'),
+    } : {}), {
+      webId: credential.webId,
+      log,
+      role,
+      runtime: 'node',
+      // Fail fast for the window rather than sleeping it out: a daemon has
+      // timers behind it, and a request that waits is a timer that does not
+      // fire. The callers' existing retry paths take it from there.
+      cooldownMode: 'refuse',
+    });
+  }
+
+  async warmup() { return this.session.warmup(); }
+
+  /** The grant's own counters, under the transport's. */
+  stats() {
+    return { ...(this.session.stats?.() || {}), ...super.stats() };
+  }
+}

package/lib/core/shapes/shapes-text.mjs

@@ -8,6 +8,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-export const SHAPES_TTL = fs.readFileSync(
-  path.join(path.dirname(fileURLToPath(import.meta.url)), 'activitystreams.ttl'), 'utf8',
-);
+// Beside this file, or — in a bundled deploy, where this file's own location
+// is the bundle's — at its place in the project, which the Netlify functions
+// ship (netlify.toml: included_files). The shapes decide nothing, so if
+// neither is there they are left out rather than the process failing to
+// start (2026-09-26).
+const candidates = [
+  path.join(path.dirname(fileURLToPath(import.meta.url)), 'activitystreams.ttl'),
+  path.join(process.cwd(), 'lib/core/shapes/activitystreams.ttl'),
+];
+const found = candidates.find((f) => { try { return fs.statSync(f).isFile(); } catch { return false; } });
+export const SHAPES_TTL = found ? fs.readFileSync(found, 'utf8') : '';

package/lib/core/wire.mjs

@@ -495,7 +495,10 @@ export function nodeinfoDoc({ version, localPosts = 0 }) {
 // only line of defence, so it runs on a real HTML parser (sanitize-html →
 // htmlparser2) rather than pattern-matching: allowlisted tags and
 // attributes, safe URL schemes, and script/style dropped with their text.
-import sanitize from 'sanitize-html';
+// Packed with its parser into one file (scripts/vendor-sanitize.mjs): the
+// parser ships only as an ES module, which the Node running the Netlify
+// functions will not require() from sanitize-html.
+import sanitize from '../../vendor/sanitize-html.cjs';
 
 const ALLOWED_TAGS = ['p', 'br', 'a', 'span', 'em', 'strong', 'b', 'i', 'u', 'del',
   'code', 'pre', 'blockquote', 'ul', 'ol', 'li', 'h1', 'h2', 'h3', 'h4'];

package/lib/device/admin/index.mjs

@@ -1,13 +1,6 @@
-// admin.mjs — loopback HTTP front: admin API + Mastodon client-API facade +
-// the bundled Phanpy UI served same-origin (no CORS, no mixed content — the
-// role data-kitchen's router plays for the in-app pane). Loopback-bound; the
-// gate (vendor/gate.cjs) engages only when a token is configured, exactly
-// its standalone behavior.
-//
-// The surface is surface.mjs, its routes are the modules under routes/, the
-// static serving is static.mjs, the listener is server.mjs. This file is the
-// door the rest of the agent imports through.
+// The DeviceAgent's door to the surface: the surface itself is
+// lib/surface/, the listener is server.mjs beside this file, and the setup
+// and process routes are routes/setup.mjs.
 
-export { buildAdminSurface } from './surface.mjs';
+export { buildAdminSurface, namedOrigin, secureOrigin, wsOrigins } from '../../surface/index.mjs';
 export { startAdmin } from './server.mjs';
-export { namedOrigin, secureOrigin, wsOrigins } from './origins.mjs';

package/lib/device/admin/routes/setup.mjs

@@ -8,17 +8,17 @@ import os from 'node:os';
 import { spawn } from 'node:child_process';
 import { pathToFileURL } from 'node:url';
 import { isCrossSiteNavigation } from '../../../shared/guard.mjs';
-import { identityHomes, rootOf, tildify, writeJsonAtomic } from '../../home.mjs';
+import { identityHomes, rootOf, tildify, writeJsonAtomic, defaultProfile } from '../../home.mjs';
 import { copyPrivateHalf, isCurrent, CURRENT_LAYOUT } from '../../migrate.mjs';
 import { insecureUrlReason } from '../../../shared/safefetch.mjs';
 import { newRun, preflight, runSetup, setupInputError, hasCredential, credentialPath } from '../../setup.mjs';
 import { podLayout } from '../../../pod/root.mjs';
 import { chosenRoot, publicIndexKnown } from '../../../core/place.mjs';
 import { portFree, freePortFrom } from '../../ports.mjs';
-import { yieldDirectory } from '../../../gateway/directory.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
-import { projectRoot, SETUP_PAGE } from '../static.mjs';
-import { secureOrigin } from '../origins.mjs';
+import { yieldDirectory } from '../../directory.mjs';
+import { localFetch } from '../../localapi.mjs';
+import { projectRoot, SETUP_PAGE } from '../../../surface/static.mjs';
+import { secureOrigin } from '../../../surface/origins.mjs';
 
 // The signup carry-over: gateway and identity parameters a signup page
 // recorded for this install (written by the installer, consumed by the first
@@ -46,6 +46,61 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
   const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
   const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
 
+  // The other identities on this machine, so the page can link to each one.
+  // Their `agent.json` is the only file read — a port and a handle. A
+  // sibling's credential and keys are never opened; anything else shown
+  // here comes from that agent answering /status for itself.
+  if (req.method === 'GET' && p === '/profiles') {
+    const here = path.resolve(agent.home || '');
+    // Which identity a plain command means: the last one started. A
+    // different question from `current`, which is the page you are on.
+    const wasLast = defaultProfile(rootOf(here));
+    const rows = await Promise.all(identityHomes(rootOf(here)).map(async ({ name, dir }) => {
+      // agent.json holds a port AND a handle — setup records both, exactly
+      // so the named origin can be built before that agent has said a word.
+      let rec = {};
+      try { rec = JSON.parse(fs.readFileSync(path.join(dir, 'agent.json'), 'utf8')) || {}; } catch {}
+      const port = rec.port || null;
+      // A directory under profiles/ is not an identity until it holds a
+      // credential or has run somewhere. A half-finished setup leaves one
+      // behind, and listing it offers a page that cannot exist yet.
+      if (!port && !fs.existsSync(path.join(dir, 'credential.json'))) return null;
+      const current = path.resolve(dir) === here;
+      const live = current ? agent.status() : port
+        ? await localFetch(agent.home, port, '/status', { timeout: 1200 })
+          .then(r => r.json()).catch(() => null)
+        : null;
+      // The handle is right here — spending it on the origin is the whole
+      // point of having asked that agent who it is. A stopped one never
+      // answers, so its recorded handle stands in: the link has to be named
+      // before you get there, or starting it lands you on the shared origin.
+      const handle = live?.handle || rec.handle || null;
+      const origin = port
+        ? secureOrigin(handle, port)
+        : null;
+      // The fediverse address, assembled from the two things /status has:
+      // the handle, and the pod host its actor URL sits on.
+      let address = null;
+      if (live?.handle && live?.actor) {
+        try {
+          const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
+          address = `${front || live.handle}@${new URL(live.actor).host}`;
+        } catch { /* not a URL yet */ }
+      }
+      return {
+        name, port, current,
+        admin: origin ? `${origin}/admin/` : null,
+        app: origin ? `${origin}/` : null,
+        handle,
+        address,
+        lastUsed: name === wasLast,
+        kind: live?.kind || null,
+        mode: live ? live.mode : null,
+      };
+    }));
+    return json(res, 200, { identities: rows.filter(Boolean) });
+  }
+
   // ---- setup and configuration, for the pages under /admin/ ----
   // These answer for a group too: a group is set up in the browser like
   // anything else, and it has a display name to change.

package/lib/device/admin/server.mjs

@@ -7,15 +7,27 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
 import { Authorities } from '../../shared/guard.mjs';
 import { rootOf } from '../home.mjs';
 import { portFree } from '../ports.mjs';
-import { claimDirectory, yieldDirectory } from '../../gateway/directory.mjs';
+import { claimDirectory, yieldDirectory } from '../directory.mjs';
 import { ensureTrustedTls } from '../certs.mjs';
 import { localVersion } from '../update.mjs';
-import { projectRoot } from './static.mjs';
-import { secureOrigin } from './origins.mjs';
-import { buildAdminSurface } from './surface.mjs';
+import { projectRoot } from '../../surface/static.mjs';
+import { secureOrigin } from '../../surface/origins.mjs';
+import { buildAdminSurface } from '../../surface/surface.mjs';
+import * as setup from './routes/setup.mjs';
+
+// The reply first, the restart a beat later — same shape as /update.
+const selfRestart = (why, log) => setTimeout(() => {
+  log(why);
+  if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
+  const child = spawn(process.execPath, process.argv.slice(1),
+    { detached: true, stdio: 'ignore', env: process.env });
+  child.unref();
+  setTimeout(() => process.exit(0), 300);
+}, 200);
 
 const require = createRequire(import.meta.url);
 const { makeGate } = require(path.join(projectRoot, 'vendor/gate.cjs'));
@@ -30,7 +42,8 @@ export function startAdmin({ port, gateToken, agent, log = console.log, handle =
   // The https listener's port joins the authority set: same names, second port.
   const allowed = new Authorities(port, handle);
   agent.authorities = allowed;
-  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle, versionOnDisk });
+  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle, versionOnDisk,
+    extraRoutes: [setup], restart: (why) => selfRestart(why, log) });
 
   // Loopback both ways: the canonical URL is https://localhost:<port>/, and
   // "localhost" resolves to ::1 on many systems before falling back to IPv4 —

package/lib/device/cli/commands/account.mjs

@@ -4,7 +4,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { localFetch } from '../../../client/localapi.mjs';
+import { localFetch } from '../../localapi.mjs';
 import { args, cmd, flag, has, HOME, PORT, requireIdentity, ask, endAsking, finish } from '../context.mjs';
 
 export async function parkRevive() {

package/lib/device/cli/commands/run.mjs

@@ -5,7 +5,7 @@ import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { identityHomes, rootOf, profileHome, recordLastUsed } from '../../home.mjs';
 import { portFree, freePortFrom } from '../../ports.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
+import { localFetch } from '../../localapi.mjs';
 import { flag, has, portFlag, PROFILE, AP_ROOT, DEFAULT_ISSUE, HOME, PORT, recordedAgent, recordedPort, recordAgent, useProfile, requireHandle, requireIdentity, ask, endAsking, agentOn, openBrowser } from '../context.mjs';
 
 export async function up() {
@@ -63,7 +63,7 @@ if (!await portFree(preferred)) {
   // owner of its port. Anything else is simply not this port; walking on is
   // what "occupied" has always meant here.
   if (!already) {
-    const { yieldDirectory } = await import(new URL('../../../../lib/gateway/directory.mjs', import.meta.url));
+    const { yieldDirectory } = await import(new URL('../../directory.mjs', import.meta.url));
     if (!await yieldDirectory(preferred, { portFree })) {
       port = await freePortFrom(preferred + 1);
       // The shared helper returns null; the message is this command's to write.

package/lib/device/cli/commands/service.mjs

@@ -6,7 +6,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { identityHomes } from '../../home.mjs';
 import { portFree } from '../../ports.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
+import { localFetch } from '../../localapi.mjs';
 import { cmd, has, AP_ROOT, HOME, agentOn } from '../context.mjs';
 
 export async function update() {

package/lib/device/cli/commands/setup.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { tildify, rootOf, recordLastUsed, writeJsonAtomic } from '../../home.mjs';
 import { insecureUrlReason } from '../../../shared/safefetch.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
+import { localFetch } from '../../localapi.mjs';
 import { args, flag, has, PROFILE, AP_ROOT, HOME, PORT, recordAgent, useProfile, requireHandle, requireIdentity, askHidden, ask, endAsking, openBrowser, finish, IDENTITY_FLAGS, refuseExistingIdentity, runBrowserSetup } from '../context.mjs';
 
 export async function setup() {

package/lib/device/cli/commands/state.mjs

@@ -8,7 +8,7 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { identityHomes, isLegacyRoot, CURRENT_ROOT, tildify, defaultProfile, profileHome, rootHoldsIdentity, recordLastUsed, writeJsonAtomic } from '../../home.mjs';
 import { insecureUrlReason } from '../../../shared/safefetch.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
+import { localFetch } from '../../localapi.mjs';
 import { args, flag, has, PROFILE, AP_ROOT, HOME, PORT, requireHandle, requireIdentity, somethingOn, agentOn, isInside } from '../context.mjs';
 
 export async function state() {

package/lib/device/cli/context.mjs

@@ -4,7 +4,7 @@
 // reassigns them and every command module sees the new value.
 
 import fs from 'node:fs';
-import { localFetch } from '../../../lib/client/localapi.mjs';
+import { localFetch } from '../localapi.mjs';
 import os from 'node:os';
 import path from 'node:path';
 import net from 'node:net';

package/lib/{gateway → device}/directory.mjs

@@ -13,7 +13,7 @@
 // whole mechanism (the test suite sets it, so throwaway agents do not fight
 // over a real machine's door).
 import https from 'node:https';
-import { localFetch } from '../client/localapi.mjs';
+import { localFetch } from './localapi.mjs';
 
 export const DIRECTORY_PORT = 8030;