fedipod 1.49.2 → 1.50.2

package/bin/fedipod.mjs

@@ -70,9 +70,6 @@
 //                         into profiles/<its handle>/. Installs made before the
 //                         2026-07-30 rename keep ~/.activitypod until they run
 //                         `--to`; new ones get ~/.fedipod.
-//   fedipod passwd    set/change the UI password (REQUIRED before any
-//                         non-loopback exposure — it turns the instant
-//                         OAuth redirect into a real login form)
 //   fedipod tokens    list client tokens; --revoke <prefix> / --revoke-all
 //   fedipod revoke-credential --email you@example.org
 //                         kill this machine's pod credential server-side and
@@ -93,7 +90,7 @@ const COMMANDS = new Map([
   ['up', run.up], ['start', run.start], ['run', run.start], ['stop', run.stop], ['status', run.status],
   ['https', run.https],
   ['setup', setup.setup], ['rotate-key', setup.rotateKey], ['revoke-credential', setup.revokeCredential],
-  ['tokens', setup.tokens], ['passwd', setup.passwd], ['keys', setup.keys],
+  ['tokens', setup.tokens], ['keys', setup.keys],
   ['state', state.state], ['upgrade', state.upgrade], ['profiles', state.profiles], ['home', state.home],
   ['export', state.exportCollectionsCmd],
   ['update', service.update], ['install-service', service.service], ['uninstall-service', service.service],
@@ -109,7 +106,7 @@ const command = COMMANDS.get(cmd);
 if (command) {
   await command();
 } else {
-console.log('usage: fedipod <setup|start|stop|status|state|upgrade|rebuild|home|passwd'
+console.log('usage: fedipod <setup|start|stop|status|state|upgrade|rebuild|home'
   + '|tokens|revoke-credential|install-service|archive|alias|import|keys|front> [--flags]');
 console.log('  keys: where the signing key lives; --to pod|local moves it (pod = multi-device signing)');
 console.log('  https: the local certificate agents serve TLS with; --trust mints a local CA for strict clients');

package/cli.md

@@ -77,20 +77,15 @@ nothing local is overwritten.  Agent must be running.
 ## Security
 
 ```
-fedipod passwd                           # require a password when a client logs in
 fedipod tokens                           # list client logins; --revoke <prefix> or --revoke-all
 fedipod revoke-credential --email EMAIL  # cut this machine off from the pod account
 ```
-A new password takes effect when a running agent restarts.
 
-**A client hosted somewhere else now needs one.** A client running on its own
-site (Elk, Phanpy on someone's own domain) asks the agent to send the sign-in
-result back to that site. Without a password there is nothing to approve that
-with — and the agent used to do it anyway, which meant any page you happened
-to have open could ask for the same thing and be given a key to your account.
-So: no password, no sending credentials off this machine. Clients that live on
-the agent itself (the bundled one, a dist in `ui/`, anything on
-`https://localhost:<port>`) are unaffected and need no password.
+**A client hosted somewhere else is approved at your pod.** A client running
+on its own site (Elk, Phanpy on someone's own domain) asks the agent to send
+the sign-in result back to that site; you approve it by signing in at your pod
+and pressing Allow. Clients that live on the agent itself (the bundled one, a
+dist in `ui/`, anything on `https://localhost:<port>`) need nothing.
 
 ## Bluesky
 

package/lib/client/masto/index.mjs

@@ -26,7 +26,6 @@ import * as accounts from './accounts.mjs';
 import * as timelines from './timelines.mjs';
 import * as statuses from './statuses.mjs';
 import * as media from './media.mjs';
-export { hashPassword } from './oauth.mjs';
 export { pollParams } from './body.mjs';
 export { attachmentType, extensionFor } from './media.mjs';
 
@@ -74,7 +73,6 @@ export class MastoApi {
     // loss — the client says "scheduled" and the post never appears. Refusing
     // it is worse UX and better behaviour.
     this.scheduling = scheduling;
-    this.authzAttempts = [];            // password-attempt timestamps
   }
 
   get store() { return this.agent.store; }
@@ -182,7 +180,6 @@ export class MastoApi {
   tokenOf(...a) { return oauth.tokenOf(this, ...a); }
   authed(...a) { return oauth.authed(this, ...a); }
   redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }
-  rateLimited(...a) { return oauth.rateLimited(this, ...a); }
 
   // render.mjs
   selfAccount(...a) { return render.selfAccount(this, ...a); }

package/lib/client/masto/oauth.mjs

@@ -1,6 +1,6 @@
 // oauth.mjs — how a client gets in: registered apps and client documents,
 // authorization codes and PKCE, the bearer tokens and their scopes, the
-// password gate, and the three /oauth endpoints plus app registration.
+// owner's approval at their pod, and the three /oauth endpoints plus app registration.
 
 import crypto from 'node:crypto';
 import { isCrossSiteNavigation } from '../../shared/guard.mjs';
@@ -8,8 +8,6 @@ import { safeFetch, readCapped } from '../../shared/safefetch.mjs';
 import { readBody } from './body.mjs';
 
 const TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;   // tokens age out after 90 days
-const AUTHZ_WINDOW_MS = 60_000;
-const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
 const MAX_REDIRECTS = 10;                        // return addresses one client may register
@@ -22,20 +20,6 @@ const CLIENT_DOC_WINDOW_MS = 60_000;
 const CLIENT_DOC_MAX_FETCHES = 20;               // outbound lookups per window
 const CLIENT_DOC_MAX = 64 * 1024;                // it names a client; it is not a payload
 
-// scrypt check for the optional UI password ({ saltHex, hashHex } record —
-// see hashPassword, used by the passwd CLI).
-export function hashPassword(password) {
-  const salt = crypto.randomBytes(16);
-  const hash = crypto.scryptSync(String(password), salt, 32);
-  return { saltHex: salt.toString('hex'), hashHex: hash.toString('hex') };
-}
-export function checkPassword(rec, password) {
-  try {
-    const hash = crypto.scryptSync(String(password), Buffer.from(rec.saltHex, 'hex'), 32);
-    return crypto.timingSafeEqual(hash, Buffer.from(rec.hashHex, 'hex'));
-  } catch { return false; }
-}
-
 const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
   ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 
@@ -85,48 +69,6 @@ button[hidden]{display:none}
   return true;
 }
 
-function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}, mount = '') {
-  const hidden = [...params.entries()].filter(([k]) => k !== 'password')
-    .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
-  // Name what is asking, so the owner approves a client they can see rather
-  // than an opaque one. The destination the code will be sent to is the fact
-  // that matters for a cross-site client.
-  let asking = '<p>Enter the agent password to authorize this client.</p>';
-  if (client && (client.name || client.redirect)) {
-    let where = '';
-    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
-    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
-    asking = `<p><strong>${who}</strong> is asking to access your account`
-      + `${where ? `, sending the authorization to <code>${escapeHtml(where)}</code>` : ''}.</p>`
-      + `<p>Scope: <code>${escapeHtml(client.scope || 'read')}</code>. Enter the agent password to allow it.</p>`;
-  }
-  res.writeHead(status || (error ? 401 : 200),
-    { 'content-type': 'text/html; charset=utf-8', ...headers });
-  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — authorize</title>
-<style>:root{color-scheme:light dark;font-size:125%;--heading:#1a4f8a}
-body{font:1rem system-ui,sans-serif;max-width:22rem;margin:15vh auto;padding:0 1rem}
-h1{color:var(--heading)}
-code{word-break:break-all}
-@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8}}
-input,button{font:inherit;width:100%;padding:.5rem;margin:.3rem 0;box-sizing:border-box}
-.err{color:#b00020}
-@media (prefers-color-scheme:dark){.err{color:#ff8a8a}}</style></head><body>
-<main>
-<h1>FediPod</h1>
-${asking}
-${error ? `<p class="err" id="login-err" role="alert">${escapeHtml(error)}</p>` : ''}
-<form method="POST" action="${escapeHtml(mount)}/oauth/authorize">
-${hidden}
-<label for="password">Agent password</label>
-<input type="password" id="password" name="password" autofocus autocomplete="current-password"
-  ${error ? 'aria-invalid="true" aria-describedby="login-err"' : ''}>
-<button type="submit">Authorize</button>
-</form>
-</main></body></html>`);
-  return true;
-}
-
 // What one request needs. Mastodon's four coarse scopes; a client that was
 // granted a granular `write:statuses` satisfies `write` here, which is the
 // direction that cannot let anything through that `write` would not.
@@ -439,22 +381,13 @@ export function redirectAllowed(api, redirect) {
   } catch { return false; }
 }
 
-export function rateLimited(api) {
-  const now = Date.now();
-  api.authzAttempts = api.authzAttempts.filter(t => now - t < AUTHZ_WINDOW_MS);
-  if (api.authzAttempts.length >= AUTHZ_MAX_ATTEMPTS) return true;
-  api.authzAttempts.push(now);
-  return false;
-}
-
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
   // --- oauth ---
-  // With no UI password configured this is "theater": whoever can reach the
-  // loopback surface IS the trusted user, and authorize redirects at once.
-  // With a password set (required before any non-loopback exposure), the
-  // authorize step becomes a real login form.
+  // On loopback this is "theater": whoever can reach the surface IS the
+  // trusted user, and authorize answers at once. Anywhere else the owner
+  // approves the client by signing in at their pod.
   if (pathname === '/api/v1/apps' && req.method === 'POST') {
     const body = await readBody(req);
     const problem = redirectsProblem(body.redirect_uris);
@@ -475,14 +408,12 @@ export async function handle(api, ctx) {
     });
   }
   if (pathname === '/oauth/authorize' && (req.method === 'GET' || req.method === 'POST')) {
-    const pw = api.store.getConfig()?.uiPassword;   // { saltHex, hashHex } scrypt record
     let params = url.searchParams;
     let body = null;
     if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
     const redirect = params.get('redirect_uri') || '';
     // The owner's pod sign-in, proved: a Solid-OIDC token with its DPoP proof,
-    // from the WebID this account belongs to. It stands in for the password
-    // everywhere below.
+    // from the WebID this account belongs to. It is how a client is approved.
     let proved = false;
     if (req.method === 'POST' && req.headers.authorization && req.headers.dpop && api.podAuth) {
       const proof = await api.podAuth(req, pathname);
@@ -513,7 +444,7 @@ export async function handle(api, ctx) {
     //
     // /api/v1/apps takes any redirect_uri from anyone — as it must, that is
     // how a fediverse client registers — and the instant-authorize path below
-    // mints without a password whenever the request "is this machine". A page
+    // mints at once whenever the request "is this machine". A page
     // in another tab is this machine. So: register a client whose redirect is
     // your own server, navigate the owner's browser to /oauth/authorize, and
     // the code arrives at your address. The agent's own CA is in the browser's
@@ -530,12 +461,10 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: cross-site navigation to the mint from ${req.headers.referer || 'nowhere'}`);
       return send(403, { error: 'a cross-site navigation may not authorize a client' });
     }
-    // 2. With NO password set there is nothing to authorize a third party
-    //    WITH. The password-less path is honest only for a client on an
-    //    address this agent itself answers on — where "whoever reaches the
-    //    port is the owner" is a statement about the machine rather than
-    //    about a web page. Anything pointing elsewhere has to be approved by
-    //    somebody who knows the password.
+    // 2. The unapproved path is honest only for a client on an address this
+    //    agent itself answers on — where "whoever reaches the port is the
+    //    owner" is a statement about the machine rather than about a web
+    //    page. Anything pointing elsewhere is approved by the owner at their pod.
     const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
     // A proof method named and not known is refused rather than read as the
     // weakest one, whose proof is the challenge itself.
@@ -543,13 +472,12 @@ export async function handle(api, ctx) {
     if (params.get('code_challenge') && challengeMethod && challengeMethod !== 'S256' && challengeMethod !== 'plain') {
       return send(400, { error: 'code_challenge_method must be S256 or plain' });
     }
-    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
-      // With a pod to sign in at, the owner approves the client there.
+    if (external && !proved && !api.redirectAllowed(redirect)) {
+      // The owner approves the client at their pod.
       if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
-      api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
+      api.log(`authorize refused: "${redirect}" is not an address of this agent, and nothing approved it`);
       return send(403, {
-        error: 'this client asks to be sent somewhere other than this agent, and no password is '
-          + 'set to approve that with. Run `fedipod passwd` and try again.',
+        error: 'this client asks to be sent somewhere other than this account; approve it by signing in at your pod',
       });
     }
     if (app) {
@@ -573,26 +501,10 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: 'redirect_uri must be an address of this agent' });
     }
-    if (req.method === 'POST' && !proved) {
-      if (api.rateLimited()) {
-        api.log('authorize rate limited');
-        // 429, not 401: a client that reads this as a wrong password will
-        // ask the person to type it again, which is the one thing that
-        // cannot help. Retry-After says how long the wait actually is.
-        return sendLoginForm(res, params, 'too many attempts — wait a minute', client,
-          429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) }, api.mount || '');
-      }
-      if (!pw || !checkPassword(pw, body.password || '')) {
-        return sendLoginForm(res, params, 'wrong password — try again', client, null, {}, api.mount || '');
-      }
-    } else if (pw && !proved) {
-      // The login/approve screen names what is asking before the owner types
-      // the password — a cross-site client cannot forge past that.
-      return sendLoginForm(res, params, '', client, null, {}, api.mount || '');
-    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
-      // With a pod to sign in at, the owner does that instead of a password.
+    if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      // The owner signs in at their pod and approves the client there.
       if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
-      // No password set, and this request did not come from this machine.
+      // Not proved, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
       // reach it IS the trusted user. It stops being theatre the moment an
@@ -602,11 +514,11 @@ export async function handle(api, ctx) {
       // — update_credentials included, which is precisely the authority the
       // isLocal check on /setup and /config exists to withhold. /oauth is
       // dispatched before that check ever runs, so it needs its own.
-      api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
+      api.log(`authorize refused: not approved at the pod, and "${req.headers.host}" is not this machine`);
       return send(403, {
         error: api.embedded
           ? 'Open your account\'s management page first, then sign in from there.'
-          : 'Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd',
+          : 'Signing in from another machine goes through your pod: sign in there to approve this app.',
       });
     }
     // External clients get a bound code; the local flow keeps code==token.
@@ -696,11 +608,10 @@ export async function handle(api, ctx) {
         // would mean a second round trip before it knows who it is.
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
     }
-    // Local flow: the code IS the token, minted by /oauth/authorize after the
-    // password gate. Minting one here for an unrecognised code handed a
-    // bearer to anyone who could reach the port — and a non-browser client
-    // sends no Origin, so the firewall never saw it. That defeated `passwd`
-    // on any agent deliberately exposed through AP_ALLOWED_HOSTS.
+    // Local flow: the code IS the token, minted by /oauth/authorize. Minting
+    // one here for an unrecognised code handed a bearer to anyone who could
+    // reach the port — and a non-browser client sends no Origin, so the
+    // firewall never saw it.
     if (!body.code || !api.tokens().includes(body.code)) {
       api.log('token refused: code is not a live authorization');
       return send(400, { error: 'invalid_grant' });

package/lib/client/masto/render.mjs

@@ -10,6 +10,13 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
 import { htmlToText } from './body.mjs';
 
+// Posts stored from 2026-09-13 to 2026-10-10 hold a Mastodon post's text twice,
+// joined by a comma; shown once.
+export const once = (html) => {
+  const m = (html.length - 1) / 2;
+  return Number.isInteger(m) && html[m] === ',' && html.slice(0, m) === html.slice(m + 1) ? html.slice(0, m) : html;
+};
+
 // 1x1 transparent PNG — placeholder header, and the instance thumbnail. A
 // banner nobody set should take up no room and show nothing; an avatar is a
 // different matter (below).
@@ -273,7 +280,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     created_at: s.published || new Date().toISOString(),
     in_reply_to_id: s.inReplyTo ? api.store.idFor(s.inReplyTo) : null,
     in_reply_to_account_id: null,
-    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: s.spoiler || '',
+    sensitive: !!(s.spoiler || s.sensitive), spoiler_text: once(s.spoiler || ''),
     visibility: s.visibility || 'public', language: null,
     edited_at: s.editedAt || null,
     uri: s.noteId, url: s.link || s.noteId,
@@ -284,7 +291,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
     favourited: !!s.favourited || (s.sourceAccts || []).some(v => v.favourited),
     reblogged: !!s.reblogged || (s.sourceAccts || []).some(v => v.reblogged),
     muted: false, bookmarked: !!s.bookmarked, pinned: !!s.pinned,
-    content: s.content || '',
+    content: once(s.content || ''),
     reblog: null, application: null,
     account: api.account(s.actor),
     media_attachments: (s.attachments || []).map(a => api.mediaJson(a)),
@@ -323,7 +330,7 @@ export function status(api, s, { all, depth = 0 } = {}) {
 // information it uses to decide anyway.
 export function filtersFor(api, s) {
   const now = Date.now();
-  const hay = `${s.content || ''} ${s.spoiler || ''}`
+  const hay = `${once(s.content || '')} ${once(s.spoiler || '')}`
     .replace(/<[^>]*>/gu, ' ')            // the text, not the markup around it
     .toLowerCase();
   if (!hay.trim()) return [];
@@ -403,7 +410,7 @@ export function pushNotify(api, n) {
   return api.push.notify(n, {
     notification_id: n.id, notification_type: n.type, preferred_locale: 'en',
     title: `${acct.display_name || acct.acct} ${verbs[n.type] || n.type}`,
-    body: s ? htmlToText(s.content || '').slice(0, 140) : '',
+    body: s ? htmlToText(once(s.content || '')).slice(0, 140) : '',
     icon: acct.avatar || '',
   });
 }

package/lib/core/agent.mjs

@@ -210,8 +210,8 @@ export class Agent {
       this.log(`this actor was retired on ${config.retiredAt} — run setup for a new identity`);
       return false;
     }
-    // A rename is a merge into the existing config, never a rewrite — the
-    // UI password and anything else set later must survive it.
+    // A rename is a merge into the existing config, never a rewrite —
+    // anything set later must survive it.
     if (name && name !== config.name) {
       this.store.setConfig({ ...config, name });
       config = this.store.getConfig();
@@ -235,11 +235,7 @@ export class Agent {
     // came out bare. Pod state is the authority; this is the cache of it.
     this.recordHandle(config.handle);
 
-    // Said once, where the config is finally known. Exposure without a gate
-    // token is refused before the socket opens (startAgent), so reaching here
-    // means the token is set and the whole surface is behind it. A UI password
-    // is the second, per-person half: without one, anyone who has the token
-    // gets a client bearer for the asking.
+    // Said once, where the config is finally known.
     // An install made before the shape changed goes on working, which is why
     // nothing here refuses — but it should not go on SILENTLY. The whole reason
     // this is said out loud is that bbba587 changed a default and every install
@@ -253,11 +249,6 @@ export class Agent {
     // read by nobody who lives in the GUI.
     this.pendingUpgrade = pending.map(s => s.what);
 
-    if (process.env.AP_ALLOWED_HOSTS && !config.uiPassword) {
-      this.log('WARNING: AP_ALLOWED_HOSTS is set and no UI password is — anyone holding '
-        + 'AP_GATE_TOKEN can mint a client token. Run `fedipod passwd`.');
-    }
-
     if (!act) return true;                   // reading only — see the note above
 
     // Exactly one agent may act on a pod (inbox drains are destructive

package/lib/core/graphview.mjs

@@ -227,6 +227,8 @@ function fromLiteral(term) {
   return term.value;
 }
 
+const isTagged = (term) => term.termType === 'Literal' && !!term.language;
+
 function toValue(term, ctx, depth, path) {
   if (term.termType === 'Literal') return fromLiteral(term);
   if (isListHead(term, ctx)) return readList(term.value, ctx, depth, path);
@@ -248,8 +250,14 @@ function readProperty(subject, name, ctx, depth = 0, path = new Set()) {
 
   const term = TERMS.get(name);
   if (!term) return undefined;
-  const values = preds.get(term.iri);
+  let values = preds.get(term.iri);
   if (!values || !values.length) return undefined;
+  // `content` and `contentMap` are one predicate, and Mastodon sends a post's
+  // text both ways. The plain term is the untagged copy, else the first tagged.
+  if (values.some(isTagged)) {
+    const plain = values.filter(v => !isTagged(v));
+    values = plain.length ? plain : [values.find(isTagged)];
+  }
 
   // `items` and `orderedItems` are the same predicate; the list is what tells
   // them apart, so asking for the ordered one only answers when it is ordered.

package/lib/core/publisher/restore.mjs

@@ -210,6 +210,7 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
 // merge-only rebuild when something is.
 export async function healStatuses(publisher) {
   const { urls, store } = publisher;
+  if (store.unread?.has('statuses.json')) return { missing: 0, recovered: 0 };   // nothing to compare with
   const own = store.read('outbox.json', [])
     .map(i => (typeof i === 'string' ? i : null))
     .filter(id => id && id.startsWith(urls.notes));

package/lib/core/store.mjs

@@ -90,6 +90,10 @@ export class PodStore {
     this._held = 0;
     this.chain = Promise.resolve();  // serialized writes
     this.verdicts = new Map();     // name → did its last write land? (read by commit)
+    // Documents the pod holds that could not be read, and that nothing here
+    // has a copy of. Never written to until they are read: what this store
+    // would send is not the document, and would replace it on the pod.
+    this.unread = new Set();
     // Moves on each time queued writes are dropped (discardPending): work that
     // began in an earlier generation has lost results, whatever a commit says.
     this.generation = 0;
@@ -106,7 +110,7 @@ export class PodStore {
   attach(storage) {
     // A different tree is different state: carrying the old cache and its
     // ETags across would serve one container's documents as another's.
-    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); }
+    if (this.storage && this.storage.base !== storage.base) { this.cache.clear(); this.etags.clear(); this.lastText.clear(); this.unread.clear(); }
     this.storage = storage;
   }
 
@@ -137,8 +141,8 @@ export class PodStore {
     if (listing.missing && this.storage.kind === 'pod') {
       throw new Error(`state container missing (HTTP 404) at ${this.base} — pod unreachable or state gone`);
     }
-    this.etags.set('', listing.etag);
     const names = listing.names.filter(n => n.endsWith('.json'));
+    for (const name of this.unread) if (!names.includes(name)) this.unread.delete(name);   // gone: nothing to write over
     let fetched = 0;
     const skipped = [];
     for (const name of names) {
@@ -147,17 +151,20 @@ export class PodStore {
       if (r.notModified) continue;                        // ours is current
       if (!r.ok) {
         // One unreadable document must not restart the whole sweep — skip it,
-        // keep whatever we already hold, and try again next load (no etag is
-        // recorded, so the retry is unconditional). config.json is the
+        // keep whatever we already hold, and try again next load (neither its
+        // etag nor the container's is recorded, so the next load lists and
+        // reads it again). config.json is the
         // exception: without it the caller cannot tell "never set up" from
         // "could not read", and would tell the user to run setup.
         if (name === 'config.json' && !this.cache.has(name)) {
           throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
         }
+        if (!this.lastText.has(name)) this.unread.add(name);
         skipped.push(`${name} (HTTP ${r.status})`);
         continue;
       }
       fetched++;
+      this.unread.delete(name);
       this.etags.set(name, r.etag);
       try { this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
@@ -165,7 +172,12 @@ export class PodStore {
     // Kept for /status: a document skipped here is a timeline or a contact
     // list quietly missing, and the owner should be able to see that.
     this.lastSkipped = skipped;
-    if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
+    // The container's ETag vouches for every document in it, so it is kept
+    // only when every one was read; otherwise the next load would stop at
+    // "not modified" and never retry what was skipped.
+    if (skipped.length) this.etags.delete(''); else this.etags.set('', listing.etag);
+    if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`
+      + (this.unread.size ? ` — not written until read: ${[...this.unread].join(', ')}` : ''));
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
     this.onLoaded?.();
   }
@@ -177,6 +189,7 @@ export class PodStore {
     for (const { name, text, etag } of docs) {
       try { this.cache.set(name, JSON.parse(text)); } catch { continue; }
       this.lastText.set(name, text);
+      this.unread.delete(name);
       if (etag) this.etags.set(name, etag);
     }
     if (listingEtag) this.etags.set('', listingEtag);
@@ -193,11 +206,12 @@ export class PodStore {
       const r = await this.storage.read(name, etag ? { etag } : undefined);
       if (r.notModified) continue;
       if (r.status === 404) {
-        this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name);
+        this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name); this.unread.delete(name);
       } else if (!r.ok) {
         throw new Error(`state doc ${name} unreadable (HTTP ${r.status})`);
       } else {
         this.cache.set(name, JSON.parse(r.body)); this.lastText.set(name, r.body); this.etags.set(name, r.etag);
+        this.unread.delete(name);
       }
       this.onSettled?.(name);
     }
@@ -216,6 +230,8 @@ export class PodStore {
   write(name, obj) {
     this.cache.set(name, structuredClone(obj));
     if (!this.storage) return;
+    // Not sent: the next commit says it did not land, and reads it first.
+    if (this.unread.has(name)) { this.verdicts.set(name, false); return; }
     // The same bytes the pod already holds are not sent again. A like, a
     // bookmark, a sweep that found nothing new each used to upload the whole
     // timeline index and the whole people cache, unchanged — the largest
@@ -263,6 +279,7 @@ export class PodStore {
   // the returned promise so one failure cannot poison the queue.
   _put(name) {
     const done = this.chain.then(async () => {
+      if (this.unread.has(name)) return false;
       const body = serialise(this.cache.get(name));
       await Promise.resolve(this.onWriting?.(name, body)).catch(() => {});
       for (let attempt = 1; attempt <= PUT_RETRIES; attempt++) {
@@ -313,6 +330,10 @@ export class PodStore {
   // `since`: the generation the caller's work began in. Anything dropped since
   // makes the answer false.
   async commit({ since } = {}) {
+    // A document that could not be read is read now, replacing whatever was
+    // written to it here; those writes already count as not landed, so the
+    // drain keeps its items and takes them again against the real document.
+    if (this.unread.size && this.storage) await this.refresh([...this.unread]).catch(() => {});
     const pending = [];
     // Held names too, or a sweep that suspended the debounce would delete the
     // pod's copy of an item whose result had not been written down — the one

package/lib/device/cli/commands/setup.mjs

@@ -1,5 +1,5 @@
 // setup.mjs — making an identity and its secrets: setup, rotate-key,
-// revoke-credential, tokens, passwd, keys.
+// revoke-credential, tokens, keys.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -398,29 +398,6 @@ if (has('revoke-all')) {
 }
 }
 
-export async function passwd() {
-requireIdentity();
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { hashPassword } = await import(new URL('../../../../lib/client/masto/index.mjs', import.meta.url));
-const { RemotePod } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const { apUrls } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-const cred = agent.readCredential();
-if (!cred) { console.error('no credential — run setup first'); process.exit(2); }
-const pw = await askHidden('new UI password: ');
-if (!pw) { console.error('empty password — aborted'); process.exit(2); }
-agent.remote = new RemotePod(cred);
-await agent.remote.warmup();
-agent.urls = apUrls(cred.remotePod, cred.root);
-agent.store.attach(agent.privateStorage(cred, 'state'));   // honours privateRoot
-await agent.store.load();
-const config = agent.store.getConfig();
-if (!config) { console.error('pod state empty — run setup first'); process.exit(2); }
-agent.store.setConfig({ ...config, uiPassword: hashPassword(pw) });
-await agent.store.flush();
-console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
-}
-
 export async function keys() {
 // Where the signing key lives; `--to pod` moves it into pod state — with
 // the state store on a pod every device reaches, that is what lets them

package/lib/device/setup.mjs

@@ -15,7 +15,6 @@ import * as $rdf from 'rdflib';
 
 import { createAccountWithPod as realCreateAccount } from './account.mjs';
 import { mintCredential as realMint, RemotePod } from './remote.mjs';
-import { hashPassword } from '../client/masto/index.mjs';
 import { webfingerHost, apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
@@ -233,7 +232,7 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
 
   const {
     mode, issuer, email, password, handle, name, podName,
-    kind = 'person', approveJoins = false, summary, icon, keys, uiPassword,
+    kind = 'person', approveJoins = false, summary, icon, keys,
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
     // The container that holds `fedipod/` (blank: the pod's root), and the
     // person's yes to a new public type index when their profile names none.
@@ -436,9 +435,6 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     done('connect');
 
     begin('publish');
-    if (uiPassword) {
-      agent.store.setConfig({ ...agent.store.getConfig(), uiPassword: hashPassword(uiPassword) });
-    }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
     // Where the account lives, in the owner's public type index — made first

package/lib/shared/guard.mjs

@@ -72,10 +72,10 @@ export function isLoopbackSocket(req) {
 // means something on this machine is relaying, and a stock
 // `proxy_pass http://127.0.0.1:<port>;` rewrites Host to a loopback authority
 // and connects from loopback. Every caller then looks local, which is what the
-// local-only routes and the password-less authorize path were trusting.
+// local-only routes and the unapproved authorize path were trusting.
 //
 // A secret is all that is left, and AP_GATE_TOKEN is the one every route
-// checks — a uiPassword guards the OAuth login and nothing else. Returns a
+// checks; an app's sign-in is approved at the owner's pod. Returns a
 // reason string when the agent must not start, or null.
 export function exposureProblem({ allowedHosts, gateToken } = {}) {
   const exposed = String(allowedHosts || '').split(',').map(s => s.trim()).filter(Boolean);