fedipod 1.48.1 → 1.49.1

package/lib/client/masto/accounts.mjs

@@ -8,6 +8,16 @@ import * as podMedia from '../../pod/media.mjs';
 import * as social from '../../core/social.mjs';
 import { readBody, readMultipart } from './body.mjs';
 
+// What a profile picture or header may be: an image of a kind every client
+// shows, stored as that type and named by it, never by the client's filename.
+// Anything else, a web page above all, would be served from the pod's own
+// address and run there when opened.
+const PROFILE_IMAGE_EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/gif': 'gif', 'image/webp': 'webp', 'image/avif': 'avif' };
+const profileImageType = (f) => {
+  const t = String(f?.contentType || '').split(';')[0].trim().toLowerCase();
+  return PROFILE_IMAGE_EXT[t] ? t : null;
+};
+
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
@@ -38,13 +48,17 @@ export async function handle(api, ctx) {
     else form = await readBody(req);
 
     const cfg = { ...api.store.getConfig() };
+    for (const f of [ files.avatar, files.header ]) {
+      if (f?.data?.length && !profileImageType(f)) {
+        return send(422, { error: 'a profile picture or header must be a PNG, JPEG, GIF, WebP or AVIF image' });
+      }
+    }
     const putImage = async (f) => {
-      const ext = (f.filename || '').includes('.')
-        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
-      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+      const type = profileImageType(f);
+      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + PROFILE_IMAGE_EXT[type];
       const url = api.urls.media + slug;
       await api.agent.publisher.ensureMediaContainer();
-      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
+      await podMedia.write(api.agent.remote, url, f.data, type);
       return url;
     };
 

package/lib/client/masto/index.mjs

@@ -84,6 +84,7 @@ export class MastoApi {
       store: this.store,
       subject: () => this.urls?.actor || 'https://localhost/',
       log: this.log,
+      liveKeys: () => new Set(this.tokens().map((t) => this._push.keyOf(t))),
     });
     return this._push;
   }
@@ -177,6 +178,7 @@ export class MastoApi {
   registerApp(...a) { return oauth.registerApp(this, ...a); }
   mintCode(...a) { return oauth.mintCode(this, ...a); }
   consumeCode(...a) { return oauth.consumeCode(this, ...a); }
+  peekCode(...a) { return oauth.peekCode(this, ...a); }
   tokenOf(...a) { return oauth.tokenOf(this, ...a); }
   authed(...a) { return oauth.authed(this, ...a); }
   redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }

package/lib/client/masto/oauth.mjs

@@ -12,6 +12,10 @@ const AUTHZ_WINDOW_MS = 60_000;
 const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
+const MAX_REDIRECTS = 10;                        // return addresses one client may register
+const MAX_REDIRECT_CHARS = 2048;
+const REGISTRATION_WINDOW_MS = 60_000;
+const MAX_REGISTRATIONS = 10;                    // registrations per window, from anyone
 const CLIENT_DOC_TTL_MS = 10 * 60_000;           // how long a fetched client document is trusted
 const CLIENT_DOC_MAX_CACHED = 200;               // ids remembered at once; oldest out
 const CLIENT_DOC_WINDOW_MS = 60_000;
@@ -42,35 +46,38 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
 
+// The account's Fediverse address, @handle@host, or null before it has one.
+const ownAddress = (api) => {
+  const handle = api.store.getConfig()?.handle;
+  return handle && api.host ? `@${handle}@${api.host}` : null;
+};
+
 // The sign-in page for an account whose owner signs in at their pod: no
 // password of ours exists, and none is asked for. The page carries the
 // client's request in its address, signs the owner in at the pod with the
 // fediverse-session library, and proves that sign-in back to /oauth/authorize.
-function sendPodSigninPage(res, client, webId, mount = '') {
-  let asking = '';
-  if (client && (client.name || client.redirect)) {
-    let where = '';
-    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
-    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
-    asking = `<p><strong>${who}</strong> is asking to use your account`
-      + `${where ? `, and you will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
-  }
+function sendPodSigninPage(res, client, webId, mount = '', address = null) {
+  let where = '';
+  try { where = client?.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
+  const app = escapeHtml(client?.name || where || 'this app');
+  const question = `Allow ${app} to access your ${address ? `${escapeHtml(address)} ` : ''}account?`;
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in with your pod</title>
+<title>${question}</title>
 <style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
 body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
 h1{color:var(--heading);font-size:1.5rem}
-code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+h1,p{overflow-wrap:anywhere}
 button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
 button[hidden]{display:none}
+#cancel{background:transparent;color:inherit;border:2px solid currentColor;margin-left:.6rem}
 #signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
-@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+#signin-status:empty{min-height:0;padding:0;border:0;margin:0}
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#4a7a40}}</style></head><body>
 <main>
-<h1>Sign in with your pod</h1>
-${asking}
-<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
-<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<h1>${question}</h1>
+<a id="webid" href="${escapeHtml(webId)}" hidden></a>
+<p><button type="button" id="signin" hidden>Allow</button><button type="button" id="cancel" hidden>Cancel</button></p>
 <p id="signin-status" role="status" aria-live="polite"></p>
 </main>
 <script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
@@ -324,12 +331,53 @@ export function registerApp(api, { name, website, redirectUris, scopes }) {
     clientSecret: crypto.randomBytes(32).toString('base64url'),
     name: String(name || 'client').slice(0, 200),
     website: String(website || '').slice(0, 500),
-    redirectUris, scopes: String(scopes || 'read'), createdAt: Date.now(),
+    redirectUris, scopes: String(scopes || 'read').slice(0, 500), createdAt: Date.now(),
+    // Set when the owner first lets it sign in (touchApp): a client nobody
+    // has used is the first to go when the list is full.
+    usedAt: null,
   };
-  api.store.write('oauth-apps.json', [...api.apps(), app].slice(-MAX_APPS));
+  const kept = api.apps();
+  while (kept.length >= MAX_APPS) kept.splice(kept.indexOf(leastUsed(kept)), 1);
+  api.store.write('oauth-apps.json', [...kept, app]);
   return app;
 }
 
+// The client to push out of a full list: one nobody has signed in with,
+// oldest first; failing that, the one used longest ago. A client registered
+// before `usedAt` existed counts as used when it was made, so a flood of new
+// registrations cannot push out the apps the owner already has.
+function leastUsed(list) {
+  const never = list.filter((a) => a.usedAt === null);
+  const when = (a) => a.usedAt ?? a.createdAt ?? 0;
+  return (never.length ? never : list).reduce((a, b) => (when(b) < when(a) ? b : a));
+}
+
+export function touchApp(api, clientId) {
+  const all = api.apps();
+  const app = all.find((a) => a.clientId === clientId);
+  if (!app) return;
+  app.usedAt = Date.now();
+  api.store.write('oauth-apps.json', all);
+}
+
+// Why a registration's return addresses cannot be kept, or null. Registering
+// needs no sign-in, so its size is the part a stranger controls.
+export function redirectsProblem(raw) {
+  if (Array.isArray(raw) && raw.some((v) => typeof v !== 'string')) return 'redirect_uris must be text';
+  const list = parseRedirects(raw);
+  if (list.length > MAX_REDIRECTS) return `at most ${MAX_REDIRECTS} redirect_uris`;
+  if (list.some((u) => u.length > MAX_REDIRECT_CHARS)) return `a redirect_uri is at most ${MAX_REDIRECT_CHARS} characters`;
+  return null;
+}
+
+export function registrationLimited(api) {
+  const now = Date.now();
+  api.appRegistrations = (api.appRegistrations || []).filter((t) => now - t < REGISTRATION_WINDOW_MS);
+  if (api.appRegistrations.length >= MAX_REGISTRATIONS) return true;
+  api.appRegistrations.push(now);
+  return false;
+}
+
 // A short-lived, single-use authorization code for a registered client, kept
 // apart from masto-tokens.json so the code is NOT a bearer until it is
 // exchanged with the client secret.
@@ -348,6 +396,13 @@ export function mintCode(api, { clientId, redirectUri, scope, challenge = null,
   return code;
 }
 
+// The live record for a code, left in place: the exchange checks it first,
+// so a caller who cannot prove it does not use it up for the one who can.
+export function peekCode(api, code) {
+  const now = Date.now();
+  return api.store.read('oauth-codes.json', []).find(c => c.code === code && now - c.createdAt < CODE_TTL_MS) || null;
+}
+
 export function consumeCode(api, code) {
   const now = Date.now();
   const all = api.store.read('oauth-codes.json', []);
@@ -376,7 +431,11 @@ export function redirectAllowed(api, redirect) {
   try {
     const u = new URL(redirect);
     if (u.protocol !== 'http:' && u.protocol !== 'https:') return false;
-    return api.allowed.has(u.host.toLowerCase());
+    if (!api.allowed.has(u.host.toLowerCase())) return false;
+    // A suffixed pod shares its host with other pods: its own addresses are
+    // those under its path, and the rest of the host is somebody else's.
+    const mount = api.mount || '';
+    return !mount || u.pathname === mount || u.pathname.startsWith(`${mount}/`);
   } catch { return false; }
 }
 
@@ -398,6 +457,13 @@ export async function handle(api, ctx) {
   // authorize step becomes a real login form.
   if (pathname === '/api/v1/apps' && req.method === 'POST') {
     const body = await readBody(req);
+    const problem = redirectsProblem(body.redirect_uris);
+    if (problem) return send(422, { error: problem });
+    if (registrationLimited(api)) {
+      api.log('app registration refused: too many this minute');
+      return send(429, { error: 'too many apps registered just now — try again in a minute' },
+        { 'retry-after': String(REGISTRATION_WINDOW_MS / 1000) });
+    }
     const redirectUris = parseRedirects(body.redirect_uris);
     const app = api.registerApp({ name: body.client_name, website: body.website,
       redirectUris, scopes: body.scopes });
@@ -427,7 +493,7 @@ export async function handle(api, ctx) {
     // The way back from the pod's login: no client named, only the pod's
     // code. The page finishes the sign-in and returns to the client's request.
     if (req.method === 'GET' && !params.get('client_id') && params.get('code') && params.get('state') && ownerWebId) {
-      return sendPodSigninPage(res, null, ownerWebId, api.mount || '');
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || '', ownAddress(api));
     }
     const app = api.findApp(params.get('client_id') || '');
     // A client that published its own metadata document needs no
@@ -471,9 +537,15 @@ export async function handle(api, ctx) {
     //    about a web page. Anything pointing elsewhere has to be approved by
     //    somebody who knows the password.
     const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+    // A proof method named and not known is refused rather than read as the
+    // weakest one, whose proof is the challenge itself.
+    const challengeMethod = params.get('code_challenge_method');
+    if (params.get('code_challenge') && challengeMethod && challengeMethod !== 'S256' && challengeMethod !== 'plain') {
+      return send(400, { error: 'code_challenge_method must be S256 or plain' });
+    }
     if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
       // With a pod to sign in at, the owner approves the client there.
-      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: 'this client asks to be sent somewhere other than this agent, and no password is '
@@ -519,7 +591,7 @@ export async function handle(api, ctx) {
       return sendLoginForm(res, params, '', client);
     } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
       // With a pod to sign in at, the owner does that instead of a password.
-      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
       // No password set, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
@@ -543,6 +615,7 @@ export async function handle(api, ctx) {
         challenge: params.get('code_challenge') || null,
         challengeMethod: params.get('code_challenge_method') || null })
       : api.mintToken(client.scope);
+    if (app) touchApp(api, app.clientId);
     if (!redirect || redirect === 'urn:ietf:wg:oauth:2.0:oob') return send(200, { code });
     const target = new URL(redirect);
     target.searchParams.set('code', code);
@@ -563,7 +636,7 @@ export async function handle(api, ctx) {
     // challenge is the whole of its proof. The code carries the document's
     // URL as the client it was bound to.
     if (!app && body.code_verifier && /^https:\/\//iu.test(String(body.client_id || ''))) {
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== body.client_id
         || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for that client document');
@@ -573,6 +646,7 @@ export async function handle(api, ctx) {
         api.log('token refused: the verifier does not answer the challenge this code was made with');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
@@ -582,7 +656,7 @@ export async function handle(api, ctx) {
     // challenge it presented at authorize (RFC 7636). Sending a verifier is
     // what says which of the two flows this is.
     if (app && body.code_verifier) {
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for this client');
         return send(400, { error: 'invalid_grant' });
@@ -593,6 +667,7 @@ export async function handle(api, ctx) {
         api.log('token refused: the verifier does not answer the challenge this code was made with');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
@@ -602,7 +677,7 @@ export async function handle(api, ctx) {
       const known = Buffer.from(app.clientSecret);
       const okSecret = given.length === known.length && crypto.timingSafeEqual(given, known);
       if (!okSecret) { api.log('token refused: client secret mismatch'); return send(401, { error: 'invalid_client' }); }
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for this client');
         return send(400, { error: 'invalid_grant' });
@@ -613,6 +688,7 @@ export async function handle(api, ctx) {
         api.log('token refused: this code was made with a challenge and the verifier does not answer it');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         // Which actor the token acts for. A Mastodon client ignores it; an
@@ -647,6 +723,8 @@ export async function handle(api, ctx) {
     if (gone) {
       const kept = api.tokenRecords().filter(r => r.token !== gone);
       api.store.write('masto-tokens.json', kept);
+      // Its notifications stop with it.
+      if (api.push.get(gone)) api.push.drop(gone);
       api.log('client token revoked');
     }
     return send(200, {});

package/lib/client/oidc-auth.mjs

@@ -8,6 +8,9 @@
 // The verifier is injected so offline tests stub it, and wrapped so the
 // library (CJS, older jose) can be replaced without touching any caller.
 
+import { scopeAllows } from './masto/oauth.mjs';
+import { claimedWebId } from '../gateway/token-claims.mjs';
+
 export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
   let verify = verifier;
   const loadVerifier = async () => {
@@ -19,7 +22,14 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
   };
 
   return async function authenticate(req, pathname) {
-    if (masto?.authed(req)) {
+    const bearer = masto?.tokenOf(req);
+    if (bearer) {
+      // The same permission the Mastodon routes ask of this token: a client
+      // allowed only to read does not post here either.
+      const need = req.method === 'GET' || req.method === 'HEAD' ? 'read' : 'write';
+      if (!scopeAllows(bearer.scope, need)) {
+        return { ok: false, status: 403, error: `this app was not allowed to ${need === 'read' ? 'read' : 'post'} for the account` };
+      }
       return { ok: true, webid: agent.remote?.webId || null, via: 'bearer' };
     }
     if (!req.headers.authorization) {
@@ -32,6 +42,12 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
         headers: { 'www-authenticate': 'DPoP' } };
     }
+    // A token naming anyone but the owner is refused before it is checked:
+    // checking fetches the documents it names, and a stranger names them.
+    const claimed = claimedWebId({ headers: { get: (n) => req.headers[n] ?? null } });
+    if (claimed && claimed !== agent.remote?.webId) {
+      return { ok: false, status: 403, error: 'this account belongs to its owner alone' };
+    }
     let webid;
     try {
       const v = await loadVerifier();
@@ -48,8 +64,10 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
         { header: req.headers.dpop, method: req.method, url: htu },
       ));
     } catch (e) {
+      // The reason stays here: it can carry what was read from an address
+      // the token named.
       log(`c2s auth: token rejected — ${e.message}`);
-      return { ok: false, status: 401, error: `token rejected: ${e.message}` };
+      return { ok: false, status: 401, error: 'token rejected' };
     }
     const owner = agent.remote?.webId;
     if (!owner || webid !== owner) {

package/lib/client/webpush.mjs

@@ -7,10 +7,13 @@ import crypto from 'node:crypto';
 import webpush from 'web-push';
 
 export class Push {
-  constructor({ store, subject, log = () => {} }) {
+  constructor({ store, subject, log = () => {}, liveKeys = null }) {
     this.store = store;
     this.subject = subject;             // () => the actor URL, VAPID's contact
     this.log = log;
+    // () => the keys of the sign-ins still in force, where they are kept beside
+    // the subscriptions; without it no subscription is forgotten for its sign-in.
+    this.liveKeys = liveKeys;
   }
 
   state() { return this.store.read('webpush.json', { subs: {} }); }
@@ -68,14 +71,21 @@ export class Push {
 
   // Push one notification to every subscription whose alerts allow the type.
   // A push service answering 404/410 means the browser dropped the
-  // subscription — it is removed rather than retried forever.
+  // subscription — it is removed rather than retried forever. With
+  // `liveKeys`, every subscription whose sign-in is no longer in force is
+  // forgotten first: an app signed out, expired or pushed off the list hears
+  // nothing more.
   async notify(n, payload) {
     const st = this.state();
+    let dropped = false;
+    const live = this.liveKeys?.() || null;
+    if (live) {
+      for (const key of Object.keys(st.subs)) if (!live.has(key)) { delete st.subs[key]; dropped = true; }
+    }
     const entries = Object.entries(st.subs);
-    if (!entries.length) return;
+    if (!entries.length) { if (dropped) this.save(st); return; }
     const { publicKey, privateKey } = this.vapid();
     const details = { subject: this.subject(), publicKey, privateKey };
-    let dropped = false;
     for (const [key, sub] of entries) {
       if (sub.alerts && sub.alerts[n.type] === false) continue;
       try {

package/lib/connections/tagfeed.mjs

@@ -29,6 +29,20 @@ const DEFAULTS = {
   intervalMin: 15,
 };
 const PER_TAG = 20;              // statuses requested per tag per sweep
+// One copy of each tag's timeline per process, for every account sweeping it:
+// a server running many accounts asks the instance once per tag in this
+// window, not once per account. Just under the shortest default interval.
+const SHARED_TTL_MS = 12 * 60_000;
+const sharedTimelines = new Map();   // `${instance}|${tag}` → { at, answer }
+export function timelineOnce(key, load) {
+  const now = Date.now();
+  const held = sharedTimelines.get(key);
+  if (held && now - held.at < SHARED_TTL_MS) return held.answer;
+  const answer = load().catch((e) => { sharedTimelines.delete(key); throw e; });
+  sharedTimelines.set(key, { at: now, answer });
+  if (sharedTimelines.size > 500) sharedTimelines.delete(sharedTimelines.keys().next().value);
+  return answer;
+}
 const MAX_NEW_PER_SWEEP = 8;     // dereference budget per sweep — stay light
 // …and no one tag may take more than this much of it. Without a per-tag share
 // the budget was spent in list order: the first two or three busy tags used it
@@ -141,21 +155,27 @@ export class TagFeed {
       try {
         const { safeFetch, retryAfterMs, readCapped } = await import('../shared/safefetch.mjs');
         const url = `${instance}/api/v1/timelines/tag/${encodeURIComponent(tag)}?limit=${PER_TAG}`;
-        const res = this.fetcher === globalThis.fetch
-          ? await safeFetch(url, { headers: { accept: 'application/json' } })
-          : await this.fetcher(url, { headers: { accept: 'application/json' } });
-        if (res.status >= 400) {
+        const load = async () => {
+          const res = this.fetcher === globalThis.fetch
+            ? await safeFetch(url, { headers: { accept: 'application/json' } })
+            : await this.fetcher(url, { headers: { accept: 'application/json' } });
+          if (res.status >= 400) return { status: res.status, retryAfter: retryAfterMs(res), list: null };
+          // Somebody else's server, polled on our schedule: bounded, because
+          // res.json() would buffer a timeline of whatever size it sent.
+          return { status: res.status, list: JSON.parse(await readCapped(res, MAX_TIMELINE_BYTES)) };
+        };
+        // Shared only with the real network: a fetcher handed in is a test's own.
+        const got = this.fetcher === globalThis.fetch ? await timelineOnce(`${instance}|${tag}`, load) : await load();
+        if (got.status >= 400) {
           // This is somebody else's server, polled on OUR schedule, and it had
           // no way to ask us to stop: a 429 or a 503 logged a line and the next
           // sweep arrived on the same cadence regardless. One refusal now ends
           // the sweep — the remaining tags are on the same instance, so there
           // is nothing to be gained by asking them too.
-          this._backOff(res.status, retryAfterMs(res));
+          this._backOff(got.status, got.retryAfter);
           return;
         }
-        // Somebody else's server, polled on our schedule: bounded, because
-        // res.json() would buffer a timeline of whatever size it sent.
-        list = JSON.parse(await readCapped(res, MAX_TIMELINE_BYTES));
+        list = got.list;
       } catch (e) {
         // A network failure is the same signal, minus the courtesy.
         this.log(`tagfeed #${tag}: ${e.message}`);

package/lib/core/agent.mjs

@@ -25,7 +25,7 @@ import { AcctFeed } from '../connections/acctfeed.mjs';
 import { BskyFeed } from '../connections/bskyfeed.mjs';
 import { BskyGroup } from '../connections/bskygroup.mjs';
 import { Lease } from './lease.mjs';
-import { publishDue } from './scheduled.mjs';
+import { publishDue, nextToPublish } from './scheduled.mjs';
 import { apUrls, assertionKeyId, publicHandle } from './wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './social.mjs';
 import * as podInbox from '../pod/inbox.mjs';
@@ -306,6 +306,9 @@ export class Agent {
       proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
       onGone: () => this.publisher.publishCollections({ followers: true }),
+      // Inside a pod server, a long-lived process: several followers' servers
+      // at once rather than one after another.
+      parallel: this.embedded ? 6 : 1,
     });
     this.publisher = new Publisher({
       config, remote: this.remote, store: this.store,
@@ -317,6 +320,9 @@ export class Agent {
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
       clientOrigin: this.embedded ? this.urls.base : null,
+      // There, a post is answered once it is on the pod and delivery carries
+      // on behind; a process that may be stopped any moment waits for it.
+      background: this.embedded,
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
@@ -553,11 +559,17 @@ export class Agent {
     this.tagfeed.start();
     this.startBsky();
     this.startAccts();
-    // Scheduled posts and polls whose time is up: a 30s sweep does what has
-    // come due (lib/core/scheduled.mjs).
+    // Scheduled posts and polls whose time is up: every 30s the clock is
+    // compared with the next one due, and only then is anything done
+    // (lib/core/scheduled.mjs).
     clearInterval(this.schedTimer);
+    let publishing = false;
     this.schedTimer = setInterval(() => {
-      publishDue(this.store, this.publisher, this.log).catch(err => this.log(`scheduled: ${err.message}`));
+      const due = nextToPublish(this.store);
+      if (publishing || due == null || due > Date.now()) return;
+      publishing = true;
+      publishDue(this.store, this.publisher, this.log).catch(err => this.log(`scheduled: ${err.message}`))
+        .finally(() => { publishing = false; });
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.

package/lib/core/deliver.mjs

@@ -66,7 +66,7 @@ export class Deliverer {
   // placing a post as it lands — which records what to send and leaves the
   // sending to the run it starts.
   constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false, defer = false, onGone = null }) {
+    log = console.log, passive = false, defer = false, onGone = null, parallel = 1 }) {
     this.store = store;
     this.defer = defer;
     // Called after followers at a gone inbox are dropped: the agent republishes
@@ -81,7 +81,9 @@ export class Deliverer {
     // How many fresh deliveries one attempt may carry. The Node deliverer
     // opens a socket per recipient; the browser's relay deliverer sends a
     // list, and sets this to what the relay accepts.
-    this.batchSize = 1;
+    this.batchSize = parallel;
+    // Sent side by side, up to that many at once, rather than one after another.
+    this.parallel = parallel;
     if (!passive) this.startQueue();
   }
 
@@ -184,6 +186,10 @@ export class Deliverer {
   // with the error deliverNow would have thrown. Here one at a time; the
   // relay deliverer sends the whole list in one call.
   async deliverManyNow(targets) {
+    if (this.parallel > 1) {
+      return Promise.all(targets.map((t) => this.deliverNow(t.inbox, t.activity)
+        .then(() => ({ ok: true }), (error) => ({ error }))));
+    }
     const out = [];
     for (const t of targets) {
       try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }

package/lib/core/intake/index.mjs

@@ -40,6 +40,9 @@ const POLL_MS = 2 * 60_000;      // fallback cadence when there is no push
 // With a live socket the poll is pure redundancy: it exists for the case where
 // push is down, so it slows right down while push is up.
 const POLL_PUSH_OK_MS = 10 * 60_000;
+// Inside the pod server the store's own events wake the drain, and they are
+// not lost the way a socket's are: the poll is only a backstop.
+const POLL_IN_PROCESS_MS = 60 * 60_000;
 // A container that times out will time out again in two minutes, and each
 // attempt holds one of the pod's workers for the full timeout. Sweeping stops
 // for a while instead, doubling up to half an hour.
@@ -113,7 +116,8 @@ export class Intake {
   // what makes the fallback poll a slow one.
   _pollMs() {
     if (this.pollSeconds) return this.pollSeconds * 1000;
-    return this.wsState === 'open' || this.wsState === 'in-process' ? POLL_PUSH_OK_MS : POLL_MS;
+    if (this.wsState === 'in-process') return POLL_IN_PROCESS_MS;
+    return this.wsState === 'open' ? POLL_PUSH_OK_MS : POLL_MS;
   }
 
   // `drainNow: false` and `subscribe: false` are for a browser worker the
@@ -121,6 +125,10 @@ export class Intake {
   async start({ drainNow = true, subscribe = true } = {}) {
     this.stopped = false;                     // restartable across demote/takeover cycles
     if (drainNow) await this.drain().catch(e => this.log(`drain: ${e.message}`));
+    // Embedded in the pod server, a notification socket back to that same
+    // server buys nothing — the store's own change events wake the drain.
+    // Settled before the first poll is timed, which reads it.
+    if (!this.push) this.wsState = 'in-process';
     const tick = () => {
       this.pollTimer = setTimeout(() => {
         this.drain().catch(e => this.log(`drain: ${e.message}`)).finally(() => { if (!this.stopped) tick(); });
@@ -128,10 +136,7 @@ export class Intake {
       this.pollTimer.unref?.();
     };
     tick();
-    // Embedded in the pod server, a notification socket back to that same
-    // server buys nothing — the store's own change events wake the drain.
-    if (!this.push) this.wsState = 'in-process';
-    else if (subscribe) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
+    if (this.push && subscribe) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
   }
 
   stop() { this.stopped = true; clearTimeout(this.pollTimer); clearTimeout(this.resubTimer); this.ws?.close(); }

package/lib/core/publisher/index.mjs

@@ -35,6 +35,7 @@ import { recordPlace, forgetPlace } from '../place.mjs';
 export class Publisher {
   constructor({ config, remote, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
     probeFetch = null, resolveMention = null, resolveActor = null, clientOrigin = null,
+    background = false,
   }) {
     this.config = config;
     this.remote = remote;
@@ -48,6 +49,8 @@ export class Publisher {
     // stranger can reach. Null on a laptop, where the surface is on loopback
     // and advertising it to the world would name somewhere nobody can go.
     this.clientOrigin = clientOrigin;
+    // Whether a new post's delivery may carry on after it is answered.
+    this.background = background;
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor

package/lib/core/publisher/notes.mjs

@@ -321,7 +321,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     reply?.inbox,
     ...addressedInboxes,
   ].filter(Boolean))];
-  await publisher.deliverer.deliverToAll(inboxes, create);
+  // The post is on the pod; where the process lives on, the app is answered
+  // now and delivery carries on behind.
+  const fanout = publisher.deliverer.deliverToAll(inboxes, create);
+  if (publisher.background) fanout.catch((e) => publisher.log(`delivering ${note.id}: ${e.message}`));
+  else await fanout;
   publisher.log(`note published: ${note.id} → ${inboxes.length} inbox(es)`);
   // The quoted author is asked after the note is out: their Accept names the
   // note, so it has to exist where they will look for it.

package/lib/core/scheduled.mjs

@@ -24,6 +24,18 @@ export async function publishDue(store, publisher, log = () => {}, now = Date.no
   return due.length;
 }
 
+/**
+ * When the next scheduled post or poll end falls due, in milliseconds, or null.
+ * Cheap enough to ask every 30 seconds: the timeline is read, not copied.
+ */
+export function nextToPublish(store) {
+  const at = [
+    ...store.getScheduled().map((e) => Date.parse(e.scheduledAt)),
+    ...(store.openPollEnds?.() || []),
+  ].filter(Number.isFinite);
+  return at.length ? Math.min(...at) : null;
+}
+
 /**
  * When the next thing falls due, or null when nothing is waiting: a scheduled
  * post, a poll's end, or another try at a delivery that failed.