fedipod 1.40.0 → 1.43.0

package/lib/server/embed.mjs

@@ -16,12 +16,12 @@ import path from 'node:path';
 
 import { createRequire } from 'node:module';
 
-import { Agent } from '../../run-agent.mjs';
-import { RemotePod } from '../device/remote.mjs';
+import { Agent } from '../core/agent.mjs';
+import { RemotePod } from '../core/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { handleDelivery } from '../gateway/gateway-core.mjs';
-import { writeJsonAtomic } from '../device/home.mjs';
-import { buildAdminSurface } from '../device/admin/index.mjs';
+import { writeJsonAtomic } from '../shared/files.mjs';
+import { buildAdminSurface } from '../surface/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
 import { CONNECTION_PREFIX, fileVault, moveVault, podVault } from '../connections/vault.mjs';
 

package/lib/shared/files.mjs

@@ -0,0 +1,49 @@
+// files.mjs — writing a file without a window in which it is half there, and
+// showing a path the way a person types it.
+//
+// The files written this way are the ones nothing can rebuild: keys.json is
+// the private key remote servers have cached, and credential.json holds a
+// secret a Solid server mints once and will not mint again. A plain
+// writeFileSync truncates first, so a crash, a power loss or a full disk
+// between truncate and write leaves an empty or half-written file where the
+// identity used to be.
+//
+// rename(2) is atomic on POSIX, so a reader — or a backup running at the wrong
+// moment — sees either the old file or the new one. fsync before it, so the
+// content is on the platter and not merely in the page cache when the rename
+// lands. Windows has no atomic rename over an existing file; there the copy
+// path is still better than a truncate, and this is a best effort by design.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export function writeFileAtomic(file, body, { mode = 0o600 } = {}) {
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+  const fd = fs.openSync(tmp, 'w', mode);
+  try {
+    fs.writeFileSync(fd, body);
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
+  }
+  fs.renameSync(tmp, file);
+}
+
+// The same, for the JSON these files all happen to be.
+export function writeJsonAtomic(file, obj, opts) {
+  writeFileAtomic(file, JSON.stringify(obj, null, 2) + '\n', opts);
+}
+
+// A path for display: the home directory becomes `~`, a `file:` URL is shown
+// as the path it is. Never used to build a path — `~` is the shell's, not the
+// filesystem's, and anything that resolves one must expand it first.
+export function tildify(p, homedir = os.homedir()) {
+  if (!p) return p;
+  let s = String(p);
+  if (s.startsWith('file://')) { try { s = fileURLToPath(s); } catch { return s; } }
+  if (s === homedir) return '~';
+  return s.startsWith(homedir + path.sep) ? '~' + s.slice(homedir.length) : s;
+}

package/lib/shared/ua.mjs

@@ -27,3 +27,6 @@ try {
 // Renamed 2026-07-31, once solidcommunity.net was back up and both actors there
 // were retired: the name in their logs no longer has to match the name in here.
 export const USER_AGENT = `fedipod/${version} (+https://github.com/jeff-zucker/FediPod)`;
+// The same version, for anything else that reports it (the publisher's
+// nodeinfo and status), read the same best-effort way.
+export const AGENT_VERSION = version;

package/lib/surface/index.mjs

@@ -0,0 +1,7 @@
+// The identity's HTTP surface: the Mastodon client API and OAuth, the
+// ActivityPub client-to-server door, nodeinfo, the owner's door and routes,
+// and the pages and client served off disk. buildAdminSurface returns one
+// request handler; whatever listens hands it requests.
+
+export { buildAdminSurface } from './surface.mjs';
+export { namedOrigin, secureOrigin, wsOrigins } from './origins.mjs';

package/lib/{device/admin → surface}/origins.mjs

@@ -1,7 +1,7 @@
 // origins.mjs — the addresses an identity answers on, as a browser must be
 // sent to them.
 
-import { allowedAuthorities, hostLabel } from '../../shared/guard.mjs';
+import { allowedAuthorities, hostLabel } from '../shared/guard.mjs';
 
 // The origin a browser should be sent to for an identity. A browser keys
 // storage per ORIGIN, so linking every identity at localhost:<port> files them

package/lib/{device/admin → surface}/routes/gateway.mjs

@@ -4,10 +4,9 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawn } from 'node:child_process';
 
 export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
+  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup, restart } = ctx;   // eslint-disable-line no-unused-vars
   const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
   switch (p) {
     // The inbox gateway lifecycle (opt-in). `configure` points at a
@@ -50,15 +49,10 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         const root = cfg.root ? (cfg.root.endsWith('/') ? cfg.root : `${cfg.root}/`) : 'fedipod/';
         return `${base}${root}ap/actor`;
       };
-      // The reply first, the restart a beat later — same shape as /update.
-      const selfRestart = (why) => setTimeout(() => {
-        log(why);
-        if (process.env.INVOCATION_ID) { process.exit(1); return; }   // systemd: Restart=on-failure respawns
-        const child = spawn(process.execPath, process.argv.slice(1),
-          { detached: true, stdio: 'ignore', env: process.env });
-        child.unref();
-        setTimeout(() => process.exit(0), 300);
-      }, 200);
+      // Fronting and un-fronting rename every id, which only a restart
+      // applies. A host that cannot restart itself refuses them.
+      const selfRestart = restart;
+      const noRestart = { error: 'this identity runs inside its pod server, which cannot restart for it — front it, or un-front it, from a standalone agent' };
       if (body.action === 'configure') {
         if (!/^https:\/\/\S+$/.test(String(body.url || ''))) return json(res, 400, { error: 'gateway url must be https' });
         if (!/^https?:\/\/\S+$/.test(String(body.webId || ''))) return json(res, 400, { error: 'gateway webId must be a URL' });
@@ -121,6 +115,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         if (agent.embedded) {
           return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
         }
+        if (body.fronted === true && !selfRestart) return json(res, 400, noRestart);
         const named = !!String(body.handle || '').trim();
         let handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
         if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
@@ -177,6 +172,7 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       if (body.action === 'forget') {
         const wasLocked = g.mode === 'locked';
         const wasFronted = !!g.frontActor;
+        if (wasFronted && !selfRestart) return json(res, 400, noRestart);
         delete cfg.gateway; agent.store.setConfig(cfg);
         if (agent.publisher) agent.publisher.config.gateway = undefined;
         await agent.store.flush();

package/lib/{device/admin → surface}/routes/lifecycle.mjs

@@ -2,9 +2,9 @@
 // pruning the inbox, rebuilding posts, republishing, parking and reviving,
 // rotating the key, moving, aliases, importing, retiring.
 
-import { resolveHandle } from '../../../core/social.mjs';
-import { webfingerHost } from '../../../core/wire.mjs';
-import { normalizeImport, IMPORT_KINDS } from '../../../connections/import.mjs';
+import { resolveHandle } from '../../core/social.mjs';
+import { webfingerHost } from '../../core/wire.mjs';
+import { normalizeImport, IMPORT_KINDS } from '../../connections/import.mjs';
 
 export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
   const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars

package/lib/{device/admin → surface}/routes/owner.mjs

@@ -3,13 +3,11 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { announceModeration } from '../../../core/social.mjs';
-import { addRemoveActivity, publicHandle } from '../../../core/wire.mjs';
-import { hashPassword } from '../../../client/masto/index.mjs';
-import { identityHomes, rootOf, tildify, defaultProfile } from '../../home.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
+import { announceModeration } from '../../core/social.mjs';
+import { addRemoveActivity, publicHandle } from '../../core/wire.mjs';
+import { hashPassword } from '../../client/masto/index.mjs';
+import { tildify } from '../../shared/files.mjs';
 import { AGENT_VERSION } from '../static.mjs';
-import { secureOrigin } from '../origins.mjs';
 
 // The identity itself. Changing any of these means a different actor at a
 // different address, which is a new setup, not an edit.
@@ -42,60 +40,6 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
       stats: agent.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
     });
   }
-  // The other identities on this machine, so the page can link to each one.
-  // Their `agent.json` is the only file read — a port and a handle. A
-  // sibling's credential and keys are never opened; anything else shown
-  // here comes from that agent answering /status for itself.
-  if (req.method === 'GET' && p === '/profiles') {
-    const here = path.resolve(agent.home || '');
-    // Which identity a plain command means: the last one started. A
-    // different question from `current`, which is the page you are on.
-    const wasLast = defaultProfile(rootOf(here));
-    const rows = await Promise.all(identityHomes(rootOf(here)).map(async ({ name, dir }) => {
-      // agent.json holds a port AND a handle — setup records both, exactly
-      // so the named origin can be built before that agent has said a word.
-      let rec = {};
-      try { rec = JSON.parse(fs.readFileSync(path.join(dir, 'agent.json'), 'utf8')) || {}; } catch {}
-      const port = rec.port || null;
-      // A directory under profiles/ is not an identity until it holds a
-      // credential or has run somewhere. A half-finished setup leaves one
-      // behind, and listing it offers a page that cannot exist yet.
-      if (!port && !fs.existsSync(path.join(dir, 'credential.json'))) return null;
-      const current = path.resolve(dir) === here;
-      const live = current ? agent.status() : port
-        ? await localFetch(agent.home, port, '/status', { timeout: 1200 })
-          .then(r => r.json()).catch(() => null)
-        : null;
-      // The handle is right here — spending it on the origin is the whole
-      // point of having asked that agent who it is. A stopped one never
-      // answers, so its recorded handle stands in: the link has to be named
-      // before you get there, or starting it lands you on the shared origin.
-      const handle = live?.handle || rec.handle || null;
-      const origin = port
-        ? secureOrigin(handle, port)
-        : null;
-      // The fediverse address, assembled from the two things /status has:
-      // the handle, and the pod host its actor URL sits on.
-      let address = null;
-      if (live?.handle && live?.actor) {
-        try {
-          const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
-          address = `${front || live.handle}@${new URL(live.actor).host}`;
-        } catch { /* not a URL yet */ }
-      }
-      return {
-        name, port, current,
-        admin: origin ? `${origin}/admin/` : null,
-        app: origin ? `${origin}/` : null,
-        handle,
-        address,
-        lastUsed: name === wasLast,
-        kind: live?.kind || null,
-        mode: live ? live.mode : null,
-      };
-    }));
-    return json(res, 200, { identities: rows.filter(Boolean) });
-  }
   if (req.method === 'GET' && p === '/blocks') return json(res, 200, agent.store.getBlocklist());
   if (req.method === 'GET' && p === '/log') return json(res, 200, { lines: agent.logLines(200) });
   if (req.method === 'GET' && p === '/deadletter') return json(res, 200, { items: agent.store.getDeadLetters() });

package/lib/{device/admin → surface}/routes/social.mjs

@@ -2,7 +2,7 @@
 // moderating: posting, the tag feed, follows, mutes, blocks, ejecting,
 // retracting, review, joins, the moderation queue.
 
-import { followHandle, followActor, unfollowActor, ejectFollower, retractAnnouncement, admitRequest, refuseRequest, applyModeration } from '../../../core/social.mjs';
+import { followHandle, followActor, unfollowActor, ejectFollower, retractAnnouncement, admitRequest, refuseRequest, applyModeration } from '../../core/social.mjs';
 
 export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
   const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars

package/lib/{device/admin → surface}/static.mjs

@@ -10,7 +10,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { wsOrigins } from './origins.mjs';
 
-export const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+export const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
 
 const PHANPY_DIR = path.join(projectRoot, 'phanpy/dist');
 // The vendored client is upstream's build, byte for byte, so the integrity
@@ -63,6 +63,11 @@ export const webMount = (pathname) => {
 export const SETUP_PAGE = '/admin/setup/';
 
 export const AGENT_VERSION = JSON.parse(fs.readFileSync(path.join(projectRoot, 'package.json'), 'utf8')).version;
+// Read again on each ask: the checkout can move while a process stays up.
+export const readVersionOnDisk = () => {
+  try { return JSON.parse(fs.readFileSync(path.join(projectRoot, 'package.json'), 'utf8')).version || null; }
+  catch { return null; }
+};
 
 const MIME = {
   '.html': 'text/html; charset=utf-8', '.js': 'text/javascript', '.css': 'text/css',

package/lib/{device/admin → surface}/surface.mjs

@@ -8,17 +8,14 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { MastoApi } from '../../client/masto/index.mjs';
-import { C2S } from '../../client/c2s.mjs';
-import { makeC2sAuth } from '../../client/oidc-auth.mjs';
-import { Streaming } from '../../client/streaming.mjs';
-import { nodeinfoPointer, nodeinfoDoc } from '../../core/wire.mjs';
-import { checkRequest } from '../../shared/guard.mjs';
-import { hasCredential } from '../setup.mjs';
-import { localVersion } from '../update.mjs';
-import { projectRoot, AGENT_VERSION, SETUP_PAGE, securityHeaders, sendJson, serveStatic, serveWeb, webDirRedirect, webMount } from './static.mjs';
+import { MastoApi } from '../client/masto/index.mjs';
+import { C2S } from '../client/c2s.mjs';
+import { makeC2sAuth } from '../client/oidc-auth.mjs';
+import { Streaming } from '../client/streaming.mjs';
+import { nodeinfoPointer, nodeinfoDoc } from '../core/wire.mjs';
+import { checkRequest } from '../shared/guard.mjs';
+import { projectRoot, AGENT_VERSION, SETUP_PAGE, readVersionOnDisk, securityHeaders, sendJson, serveStatic, serveWeb, webDirRedirect, webMount } from './static.mjs';
 import * as owner from './routes/owner.mjs';
-import * as setup from './routes/setup.mjs';
 import * as lifecycle from './routes/lifecycle.mjs';
 import * as gateway from './routes/gateway.mjs';
 import * as social from './routes/social.mjs';
@@ -65,9 +62,8 @@ function readBody(req) {
   });
 }
 
-// The routes, in the order the one if-chain and the one switch used to be
-// read: the first module that answers a path wins.
-const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
+// Whether this home has been set up: the credential FILE, never configured().
+const hasCredential = (home) => fs.existsSync(path.join(home, 'credential.json'));
 
 // The whole admin/facade surface as one request handler, with nothing that
 // belongs to a process of its own. startAdmin wraps it in listeners; the CSS
@@ -83,10 +79,17 @@ const SESSION_FILES = {
   '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
 };
 
+// `extraRoutes` are the routes a host process adds after the owner's — the
+// DeviceAgent's setup and process routes; a pod server adds none. `restart`
+// restarts the host process, for the changes that need one; a host that
+// cannot passes nothing, and those changes are refused.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/', mount = '',
-  publicOrigin = null, scheme = null,
-  versionOnDisk = () => localVersion(projectRoot) }) {
+  publicOrigin = null, scheme = null, extraRoutes = [], restart = null,
+  versionOnDisk = readVersionOnDisk }) {
+  // The routes, in the order the one if-chain and the one switch used to be
+  // read: the first module that answers a path wins.
+  const ROUTES = [owner, ...extraRoutes, lifecycle, gateway, social, connections];
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
   const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount,
     throughDoor: (req) => Boolean(gate?.upgradeOk?.(req)) });
@@ -123,7 +126,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   const atPath = (p_) => mount + (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
 
   // What every route may reach: the agent and the deployment's facts.
-  const ctx = { agent, log, allowed, embedded, port, handle, publicOrigin, versionOnDisk, isGroup, json, setup: setup_ };
+  const ctx = { agent, log, allowed, embedded, port, handle, publicOrigin, versionOnDisk, isGroup, json, setup: setup_, restart };
 
   const handler = async (req, res) => {
     const url = new URL(req.url, 'http://localhost');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.40.0",
+  "version": "1.43.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -14,6 +14,24 @@
   "bin": {
     "fedipod": "bin/fedipod.mjs"
   },
+  "exports": {
+    "./embed": "./lib/server/embed.mjs",
+    "./front": "./lib/gateway/front-core.mjs",
+    "./front-pages": "./lib/gateway/front-pages.mjs",
+    "./surface": "./lib/surface/index.mjs",
+    "./agent": "./lib/core/agent.mjs",
+    "./remote": "./lib/core/remote.mjs",
+    "./place": "./lib/core/place.mjs",
+    "./core/*": "./lib/core/*",
+    "./pod/*": "./lib/pod/*",
+    "./client/*": "./lib/client/*",
+    "./connections/*": "./lib/connections/*",
+    "./gateway/*": "./lib/gateway/*",
+    "./shared/*": "./lib/shared/*",
+    "./surface/*": "./lib/surface/*",
+    "./vendor/*": "./vendor/*",
+    "./package.json": "./package.json"
+  },
   "files": [
     "bin",
     "lib",
@@ -30,22 +48,22 @@
     "architecture.svg",
     "device-agent.md",
     "architecture.md",
-    "gateway.md",
-    "browser.svg"
+    "gateway.md"
   ],
   "scripts": {
     "start": "node bin/fedipod.mjs up",
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test packages/fedipod-bb/test/*.test.mjs && node scripts/check-sizes.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node packages/fedipod-bb/scripts/link-fedipod.mjs && node --test packages/fedipod-bb/test/*.test.mjs && node scripts/check-sizes.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",
     "build:app": "npm run build:sw && npm run build:boot",
     "stage": "node scripts/stage-site.mjs",
     "audit": "npm audit --omit=dev",
-    "agent": "node run-agent.mjs"
+    "agent": "node run-agent.mjs",
+    "vendor:sanitize": "node scripts/vendor-sanitize.mjs"
   },
   "dependencies": {
     "@fedify/fedify": "^2.3.4",