fedipod 1.50.0 → 1.55.2

package/lib/gateway/check-letter.mjs

@@ -0,0 +1,123 @@
+// check-letter.mjs — the gateway's test letter. Every six hours it writes to
+// its admin's own account through the account's door, as any server would,
+// and FediPod answers once it has taken the letter in (POST /api/check), or
+// the gateway's own reader does when it reads held mail (account-agent.mjs).
+// A letter still unanswered after FediPod has been open an hour means mail is
+// not getting through, and the owner's phones are told. The letter itself is
+// shown nowhere (lib/core/intake: checkLetters).
+import crypto from 'node:crypto';
+import { PRESENT_MS } from './held-mail.mjs';
+
+export const LETTER_EVERY_MS = 6 * 3600_000;
+export const ANSWER_WITHIN_MS = 3600_000;
+const LETTER_ID = /^https?:\/\/[^/]+\/check\/letters\/[0-9a-f]{24}$/u;
+
+const base = (origin) => String(origin || '').replace(/\/$/u, '');
+export const checkActor = (origin) => `${base(origin)}/check/actor`;
+const stateKey = (handle) => `check/${handle}`;
+const read = async (kv, handle) => { try { return JSON.parse((await kv.get(stateKey(handle)))?.text || 'null') || {}; } catch { return {}; } };
+const save = (kv, handle, st) => kv.set(stateKey(handle), JSON.stringify(st));
+
+// Who gets letters: the admin's own browser accounts, still at this gateway.
+const checked = (ctx, rec) => !!(ctx.adminWebId && rec?.openedAt && rec.actorUrl && rec.webId === ctx.adminWebId && !rec.movedTo);
+
+/** The letter, as the door takes it: a direct note to the account. */
+export function letterFor(origin, letter, to) {
+  const actor = checkActor(origin);
+  return {
+    '@context': 'https://www.w3.org/ns/activitystreams',
+    id: letter, type: 'Create', actor, to: [to],
+    object: { id: `${letter}#note`, type: 'Note', attributedTo: actor, to: [to], content: '<p>A test letter from this gateway.</p>' },
+  };
+}
+
+/**
+ * The round's part: for each account checked, a letter unanswered after an
+ * hour of FediPod open is alerted once, and a new one goes when none is
+ * waiting and six hours have passed since the last. `send(handle, rec, doc)`
+ * delivers a letter; `alert(handle, text)` tells the owner's phones.
+ */
+export async function roundChecks(ctx, { kv = ctx.mastoKv, now = Date.now(), send, alert, log = console.log } = {}) {
+  if (!kv || !ctx.adminWebId || !ctx.listDirectory || !ctx.frontOrigin) return;
+  const rows = await ctx.listDirectory();
+  for (const [handle, rec] of Object.entries(rows || {})) {
+    if (!checked(ctx, rec)) continue;
+    const st = await read(kv, handle);
+    const presentAt = Number(await ctx.presentAt?.(handle).catch(() => 0)) || 0;
+    const open = !!presentAt && now - presentAt < PRESENT_MS;
+    const waiting = st.letter && !st.answeredAt && !st.alertedAt;
+    if (waiting) {
+      // Open since this round, or since an earlier one; closed starts it again.
+      st.openSince = open ? (st.openSince ?? now) : null;
+      if (open && now - st.openSince >= ANSWER_WITHIN_MS) {
+        st.alertedAt = now;
+        await alert(handle, 'Its test letter has not reached your FediPod after an hour with FediPod open. Mail may not be getting through.')
+          .catch((e) => log(`check @${handle}: alert not sent: ${e?.message || e}`));
+        log(`check @${handle}: letter not answered after an hour open — owner told`);
+      }
+      await save(kv, handle, st);
+      continue;
+    }
+    if (typeof st.sentAt === 'number' && now - st.sentAt < LETTER_EVERY_MS) continue;
+    const letter = `${base(ctx.frontOrigin)}/check/letters/${crypto.randomBytes(12).toString('hex')}`;
+    const status = await send(handle, rec, letterFor(ctx.frontOrigin, letter, rec.actorUrl)).catch((e) => { log(`check @${handle}: letter not sent: ${e?.message || e}`); return 0; });
+    if (status !== 202) { log(`check @${handle}: the door answered ${status} to the letter`); continue; }
+    await save(kv, handle, { letter, sentAt: now });
+    log(`check @${handle}: letter sent`);
+  }
+}
+
+/** The letter taken in: true when it is the one waiting. */
+export async function answerLetter(kv, handle, letter, { now = Date.now() } = {}) {
+  if (!kv || !LETTER_ID.test(String(letter || ''))) return false;
+  const st = await read(kv, handle);
+  if (st.letter !== letter) return false;
+  if (!st.answeredAt) await save(kv, handle, { ...st, answeredAt: now });
+  return true;
+}
+
+/** When the letter waiting was alerted and is still unanswered, its time; else null. */
+export async function missingLetter(kv, handle) {
+  if (!kv) return null;
+  const st = await read(kv, handle);
+  return st.alertedAt && !st.answeredAt ? new Date(st.alertedAt).toISOString() : null;
+}
+
+/** What the gateway's reader needs to take a letter in at the gateway itself. */
+export const checkLettersFor = (ctx, handle) => (ctx?.frontOrigin && ctx.mastoKv
+  ? { actor: checkActor(ctx.frontOrigin), taken: async (letter) => { await answerLetter(ctx.mastoKv, handle, letter); } }
+  : null);
+
+// The letter's sender, for anything that looks it up: an application, whose
+// inbox takes and keeps nothing. Returns a response, or null for other paths.
+export function routeCheckActor(request, pathname, ctx, { j }) {
+  if (pathname === '/check/actor' && (request.method === 'GET' || request.method === 'HEAD')) {
+    const id = checkActor(ctx.frontOrigin || new URL(request.url).origin);
+    return j(200, {
+      '@context': 'https://www.w3.org/ns/activitystreams',
+      id, type: 'Application', preferredUsername: 'check', name: `${ctx.host || new URL(id).host} test letters`,
+      inbox: `${base(new URL(id).origin)}/check/inbox`,
+    }, 'application/activity+json');
+  }
+  if (pathname === '/check/inbox' && request.method === 'POST') return { status: 202, headers: {}, body: null };
+  return null;
+}
+
+// The owner's FediPod, saying it took the letter in, proved like /api/here;
+// and the letter's sender, for anything that looks it up.
+export async function routeCheckApi(request, pathname, ctx, deps) {
+  if (pathname.startsWith('/check/')) return routeCheckActor(request, pathname, ctx, deps);
+  if (pathname !== '/api/check') return null;
+  const { j } = deps;
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const handle = String(body.handle || '').toLowerCase();
+  const rec = await ctx.lookup(handle);
+  if (!rec) return j(404, { error: 'no such account' });
+  const who = await deps.provedOwner(request, pathname, ctx, rec, deps);
+  if (who.error) return who.error;
+  const answered = await answerLetter(ctx.mastoKv, handle, String(body.letter || ''));
+  return j(200, { ok: true, handle, answered });
+}

package/lib/gateway/connected-feeds.mjs

@@ -0,0 +1,116 @@
+// connected-feeds.mjs — the owner's other accounts read into theirs at the
+// gateway, for an app such as Elk while FediPod is closed in the browser.
+//
+// FediPod in the browser reads the owner's connected Mastodon-API accounts and
+// Bluesky account every five minutes while it is open (acctfeed.mjs,
+// bskyfeed.mjs). Here the same reads are made, at most every five minutes,
+// when an app asks for the home timeline or the notifications and nobody else
+// holds the account. The logins are read from the pod for the one read and are
+// never kept at the gateway (lib/core/pod-only.mjs); a login the far server
+// renews goes back to the pod.
+import { FediAccounts } from '../connections/fediacct.mjs';
+import { AcctFeed } from '../connections/acctfeed.mjs';
+import { Atproto } from '../connections/atproto.mjs';
+import { BskyFeed } from '../connections/bskyfeed.mjs';
+import { safeFetch } from '../shared/safefetch.mjs';
+import { apUrls } from '../core/wire.mjs';
+import { lockCopy, heldByBrowser } from './copy.mjs';
+import { reachAccount, settle, stateAndLease } from './account-agent.mjs';
+
+export const FEEDS_EVERY_MS = 5 * 60_000;
+// An account with nothing connected is looked at again only this often.
+export const NONE_EVERY_MS = 60 * 60_000;
+// Each request to another server is cut short, and Bluesky is not started
+// once this much of the read has gone, so an app's write waiting on the
+// account does not wait long.
+const ASK_MS = 6_000;
+const READ_MS = 15_000;
+const CONNECTED = ['fediaccts.json', 'atproto.json'];
+
+// The logins as FediPod in the browser keeps them: one document for the
+// Mastodon-API accounts, by id, and one for Bluesky.
+function accountsVault(store) {
+  const all = () => store.read('fediaccts.json', {}) || {};
+  return {
+    names: () => Object.keys(all()),
+    read: (id) => all()[id] || null,
+    write: (id, rec) => store.write('fediaccts.json', { ...all(), [id]: { ...rec, storage: 'pod' } }),
+    remove: async () => false,
+  };
+}
+const NO_APPS = { names: () => [], read: () => null, write: () => {}, remove: async () => false };
+function blueskyVault(store) {
+  return {
+    names: () => (store.read('atproto.json', null) ? ['bluesky'] : []),
+    read: () => store.read('atproto.json', null),
+    write: (_, rec) => store.write('atproto.json', { ...rec, storage: 'pod' }),
+    remove: async () => false,
+  };
+}
+
+const dueKey = (handle) => `${handle}/feeds-due`;
+
+/** For an app checking in: when due, and never over FediPod open in a browser. */
+export async function readConnectedForApp(ctx, handle, rec, { log = console.log, fetcher = null, session = null } = {}) {
+  if (!ctx.copyKv) return 0;
+  const due = async () => Date.now() >= Number((await ctx.copyKv.get(dueKey(handle)))?.text || 0);
+  // FediPod open in a browser reads them itself; the pod is not asked.
+  if (!await due() || await heldByBrowser(ctx.copyKv, handle)) return 0;
+  const unlock = await lockCopy(ctx.copyKv, handle, { waitMs: 1000 });
+  if (!unlock) return 0;
+  try {
+    // Another request may have read them while this one waited.
+    if (!await due()) return 0;
+    await ctx.copyKv.set(dueKey(handle), String(Date.now() + FEEDS_EVERY_MS));
+    const out = await readConnected(ctx, handle, rec, { log, fetcher, session });
+    if (out.none) await ctx.copyKv.set(dueKey(handle), String(Date.now() + NONE_EVERY_MS));
+    return out.added || 0;
+  } finally { await unlock(); }
+}
+
+/**
+ * One read of every connected account into the account, by a caller holding
+ * lockCopy. Returns { added } or { none } when nothing is connected.
+ */
+export async function readConnected(ctx, handle, rec, { log = console.log, fetcher = null, session = null } = {}) {
+  const at = await reachAccount(ctx, handle, rec, { log, session });
+  if (at.skipped) return { added: 0 };
+  if (!(await settle(ctx, handle, rec, at, { log })).ok) return { added: 0 };
+  // The key is not needed to read: only the logins come from the pod.
+  const { store, lease } = stateAndLease(ctx, handle, at, { log, podNames: [] });
+  try { await store.refresh(CONNECTED); } catch (e) { log(`@${handle}: connected accounts: ${e.message}`); return { added: 0 }; }
+  const out = fetcher || ctx.fetchImpl || null;
+  const ask = (url, init = {}) => {
+    const cut = { ...init, signal: AbortSignal.timeout(ASK_MS) };
+    return out ? out(url, cut) : safeFetch(url, cut);
+  };
+  const said = (m) => log(`@${handle}: ${m}`);
+  const masto = new FediAccounts({ vault: accountsVault(store), apps: NO_APPS, log: said, fetcher: ask });
+  const bsky = new Atproto({ vault: blueskyVault(store), log: said, fetcher: ask });
+  const bskyOn = () => bsky.connected() && !bsky.read()?.feedPaused;
+  if (!masto.connected() && !bskyOn()) return { none: true };
+  if (!await lease.acquire()) return { added: 0 };
+  try {
+    await store.load();
+    const config = store.getConfig();
+    if (!config || config.quiescedAt) return { added: 0 };
+    // Stamped as FediPod in the browser stamps them, so a login made for
+    // another actor is left alone here too.
+    const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/u, '') : null;
+    masto.actorId = bsky.actorId = apUrls(at.pod, config.root || at.root, { publicBase }).actor;
+    const started = Date.now();
+    let added = 0;
+    if (masto.connected()) {
+      const feed = new AcctFeed({ store, accounts: masto, log: said });
+      await feed.sweep();
+      added += feed.lastAdded;
+    }
+    if (bskyOn() && Date.now() - started < READ_MS) {
+      const feed = new BskyFeed({ store, atproto: bsky, log: said });
+      await feed.sweep();
+      added += feed.lastAdded;
+    }
+    if (!await store.commit()) said('connected accounts read, but not written to the copy');
+    return { added };
+  } finally { await lease.release().catch(() => {}); }
+}

package/lib/gateway/copy.mjs

@@ -375,6 +375,25 @@ export async function flushCopy(kv, h, { pod, log = () => {} }) {
   let changed = false;
   for (const b of docs) {
     const name = b.key.slice(`${h}/d/`.length);
+    // A pod-only document in the copy was put there before it was pod-only.
+    // It goes to the pod unless the pod's is newer (changed since the copy
+    // last wrote it, or made since the copy was), then out of the copy and
+    // its record.
+    if (podOnly(name)) {
+      const got = await kv.get(b.key);
+      const there = typeof pod.read === 'function' ? await pod.read(name).catch(() => null) : null;
+      const podMoved = !!there?.ok && (!flushed[name] || hashOf(there.body) !== flushed[name].hash);
+      if (got && !podMoved && flushed[name]?.hash !== hashOf(got.text)) {
+        const w = await pod.write(name, got.text, 'application/json');
+        if (!w.ok) { log(`copy @${h}: ${name} not written to the pod (${w.why})`); continue; }
+        n++;
+      }
+      await kv.delete(b.key);
+      delete flushed[name];
+      changed = true;
+      log(`copy @${h}: ${name} is kept on the pod only now, and left the copy`);
+      continue;
+    }
     if (flushed[name]?.etag === b.etag) continue;
     const got = await kv.get(b.key);
     if (!got) continue;

package/lib/gateway/front-core.mjs

@@ -23,7 +23,8 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
+import { routeCheckApi, missingLetter } from './check-letter.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
 import { claimedWebId, verifyPodToken } from './token-claims.mjs';
@@ -574,8 +575,9 @@ async function route(request, ctx) {
   const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
   if (quiet) return withApiCors(quiet);
   // The owner's app saying it is open, taking what was held, and naming what to push (held-mail.mjs).
-  const owned = { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner };
-  const here = await routeHereApi(request, pathname, ctx, owned) || await routeKeeperApi(request, pathname, ctx, owned) || await routePushApi(request, pathname, ctx, owned);
+  const owned = { j, verifyPodToken, webidUnderPod, apiPreflight, provedOwner, missingLetter: (h) => missingLetter(ctx.mastoKv, h) };
+  const here = await routeHereApi(request, pathname, ctx, owned) || await routeKeeperApi(request, pathname, ctx, owned) || await routePushApi(request, pathname, ctx, owned)
+    || await routeAlertApi(request, pathname, ctx, owned) || await routeCheckApi(request, pathname, ctx, owned);
   if (here) return withApiCors(here);
 
   // The relay: the front sends requests a browser has already signed. A page

package/lib/gateway/held-mail.mjs

@@ -211,7 +211,31 @@ export async function routeHereApi(request, pathname, ctx, deps) {
   const flushed = await flushHeld(ctx, handle, rec)
     .catch((e) => { console.log(`here @${handle}: held mail not delivered: ${e?.message || e}`); return 0; });
   // `hold`: with it off, a browser working from a copy goes back to the pod.
-  return j(200, { ok: true, handle, flushed, hold: holdOn(ctx) });
+  // `missingLetter`: the gateway's test letter has not arrived (check-letter.mjs).
+  const missing = await deps.missingLetter?.(handle).catch(() => null);
+  return j(200, { ok: true, handle, flushed, hold: holdOn(ctx), ...(missing ? { missingLetter: missing } : {}) });
+}
+
+// FediPod could not read some of its owner's mail: they are told on the phones
+// and browsers they signed up for notifications, in FediPod's own words.
+// Proved like /api/here. Returns a response, or null for other paths.
+export async function routeAlertApi(request, pathname, ctx, deps) {
+  if (pathname !== '/api/alert') return null;
+  const { j } = deps;
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const handle = String(body.handle || '').toLowerCase();
+  const text = typeof body.text === 'string' ? body.text.trim().slice(0, 200) : '';
+  if (!text) return j(400, { error: 'text required' });
+  const rec = await ctx.lookup(handle);
+  if (!rec) return j(404, { error: 'no such account' });
+  const who = await deps.provedOwner(request, pathname, ctx, rec, deps);
+  if (who.error) return who.error;
+  if (!ctx.startPush || !await ctx.pushWanted?.(handle).catch(() => false)) return j(200, { ok: true, handle, pushing: 0 });
+  await ctx.startPush(handle, { alert: text }).catch((e) => console.log(`alert @${handle}: not started: ${e?.message || e}`));
+  return j(200, { ok: true, handle, pushing: 1 });
 }
 
 // FediPod open in a browser reads its own mail, so nothing is held for the

package/lib/gateway/keeper.mjs

@@ -19,6 +19,7 @@ import { flushHeld, heldEntries } from './held-mail.mjs';
 import { publishDue, nextDue } from '../core/scheduled.mjs';
 import { lockCopy } from './copy.mjs';
 import { reachAccount, settle, stateAndLease, actingAgent } from './account-agent.mjs';
+import { checkLettersFor } from './check-letter.mjs';
 
 export { keeperSession };
 
@@ -53,7 +54,7 @@ export async function keepOnce(ctx, handle, rec, { log = console.log, session =
     if (!await lease.acquire()) return { skipped: 'another device is acting on this account', flushed, retry: 'soon' };
     try {
       await store.load();
-      const agent = await actingAgent(at, store, lease, { log });
+      const agent = await actingAgent(at, store, lease, { log, checkLetters: checkLettersFor(ctx, handle) });
       if (agent.skipped) return { skipped: agent.skipped, flushed };
       let taken = 0;
       if (at.inCopy && ctx.listHeld) {

package/lib/gateway/masto-gateway.mjs

@@ -48,6 +48,9 @@ import { CopyStorage, lockCopy, keptNow, keptBefore, holdOn, waitOutClosing, GAT
 import { HttpStorage } from '../core/storage.mjs';
 import * as podInbox from '../pod/inbox.mjs';
 import { heldEntries } from './held-mail.mjs';
+import { checkLettersFor } from './check-letter.mjs';
+import { readConnectedForApp } from './connected-feeds.mjs';
+import { TagFeed } from '../connections/tagfeed.mjs';
 import { noteOpened } from './quiet.mjs';
 import { Push } from '../client/webpush.mjs';
 import webpush from 'web-push';
@@ -282,6 +285,8 @@ function readingAgent(at, store, acting, log) {
   const publisher = new Publisher({ config, remote: at.remote, store, deliverer: null, publicKeyPem: null, log });
   return {
     store, publisher, remote: at.remote, config, viewer: false, copy: null,
+    // The hashtags followed, for the app to show; FediPod in the browser reads them.
+    tagfeed: new TagFeed({ store, intake: null, log }),
     configured: () => !!store.getConfig(), requestTakeover: async () => true, onScheduled: () => {},
     intake: { fetchAP: async (u) => (await acting()).intake.fetchAP(u) },
   };
@@ -334,7 +339,7 @@ async function readHeld(ctx, handle, rec, { log = console.log, takeover = false,
     const { store, lease } = stateAndLease(ctx, handle, at, { log });
     if (!await lease.acquire() && !(takeover && await lease.takeover())) return 0;
     await store.load();
-    const agent = await actingAgent(at, store, lease, { log });
+    const agent = await actingAgent(at, store, lease, { log, checkLetters: checkLettersFor(ctx, handle) });
     if (agent.skipped) return 0;
     const pushes = [];
     if (await pushWanted(ctx, handle)) {
@@ -433,17 +438,50 @@ export async function pushMade(ctx, handle, rec, ids, { log = console.log, now =
   return fresh.length;
 }
 
+/**
+ * For FediPod, when it could not read some of its owner's mail: one
+ * notification, in its own words, to every phone and browser signed up for
+ * them. Read from the account as it is now, without acting.
+ */
+export async function pushAlert(ctx, handle, rec, text, { log = console.log } = {}) {
+  if (!text || !await pushWanted(ctx, handle)) return 0;
+  await waitOutClosing(ctx.copyKv, handle);
+  const at = await reachAccount(ctx, handle, rec, { log });
+  if (at.skipped) return 0;
+  const store = await readingStore(ctx, handle, at, log);
+  const agent = readingAgent(at, store, async () => { throw new Error('only reading'); }, log);
+  if (!agent) return 0;
+  if (!at.inCopy) await store.refresh(['webpush.json'], { ifChanged: true });
+  const api = facade(agent, null, log, await vapidKeys(ctx.mastoKv), pushContact(ctx), { keep: false });
+  const id = crypto.randomBytes(8).toString('hex');
+  await api.push.notify({ id, type: 'mention' }, {
+    notification_id: id, notification_type: 'mention', preferred_locale: 'en',
+    title: 'FediPod', body: String(text).slice(0, 200), icon: '',
+  });
+  log(`@${handle}: alert pushed`);
+  return 1;
+}
+
 // A request from an app, answered by the account's facade over its copy, or
 // with the hold off, over the pod.
 async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
   const handle = tok.handle;
   forgetOld();
   const repeatKey = request.method === 'GET' && REPEATABLE.test(url.pathname) ? `${handle}\n${tokenHash}\n${url.pathname}${url.search}` : null;
+  // An app checking in: new mail, and the owner's connected accounts when due,
+  // read in beside this answer for the app's next check.
+  const checksIn = request.method === 'GET' && /^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname);
+  const readConnected = () => readConnectedForApp(ctx, handle, rec, { log })
+    .then((n) => { if (n) forget(handle); })
+    .catch((e) => log(`app @${handle}: connected accounts: ${e.message}`));
   // The copy's listing as it was: the same answer, without opening the copy.
   // A copy written to the pod and deleted since lists differently.
   if (repeatKey && holdOn(ctx)) {
     const again = await repeatAnswer(ctx, handle, repeatKey, { inCopy: true });
-    if (again) return again;
+    if (again) {
+      if (checksIn) ctx.waitUntil?.(readConnected());
+      return again;
+    }
   }
   // A copy the round is writing to the pod and deleting is waited out; it is
   // made again below.
@@ -457,9 +495,11 @@ async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
     if (!made.ok) return json(made.status === 409 ? 503 : made.status, { error: made.why });
     at.inCopy = true;
   }
-  // New mail read in beside this answer, for the app's next check.
-  if (!writes && /^\/api\/v[12]\/(timelines\/home|notifications)$/u.test(url.pathname)) {
-    ctx.waitUntil?.(readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`)));
+  if (checksIn) {
+    ctx.waitUntil?.((async () => {
+      await readHeldForApp(ctx, handle, rec, { log }).catch((e) => log(`app @${handle}: held mail: ${e.message}`));
+      await readConnected();
+    })());
   }
   // With the hold off, the pod's listing, after the inbox has been looked at.
   if (repeatKey && !holdOn(ctx)) {
@@ -475,7 +515,7 @@ async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
     const acting = () => (actingP ||= (async () => {
       const s = stateAndLease(ctx, handle, at, { log });
       await s.store.load();
-      const a = await actingAgent(at, s.store, s.lease, { log });
+      const a = await actingAgent(at, s.store, s.lease, { log, checkLetters: checkLettersFor(ctx, handle) });
       if (a.skipped) throw new Error(a.skipped);
       return a;
     })());
@@ -505,7 +545,7 @@ async function answerForAccount(request, url, ctx, tok, rec, log, tokenHash) {
     lease = s.lease;
     const store = s.store;
     await store.load();
-    const agent = await actingAgent(at, store, lease, { log });
+    const agent = await actingAgent(at, store, lease, { log, checkLetters: checkLettersFor(ctx, handle) });
     if (agent.skipped) return json(503, { error: agent.skipped });
     const api = facade(agent, token, log, await vapidKeys(ctx.mastoKv), pushContact(ctx));
     const handled = await api.handle(b.req, b.res, url.pathname, url);

package/lib/surface/routes/owner.mjs

@@ -13,7 +13,7 @@ import { AGENT_VERSION } from '../static.mjs';
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
 // Config the actor document carries, so a change is not real until it is
 // republished.
-const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'approveJoins', 'moderators'];
+const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'approveJoins', 'moderators', 'autoAcceptFollows'];
 
 export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
   const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
@@ -70,6 +70,7 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
       approveJoins: !!cfg.approveJoins, review: !!cfg.review,
       aliases: cfg.aliases || [],
       autoAcceptFollows: cfg.autoAcceptFollows !== false,
+      tagsInHome: cfg.tagsInHome !== false,
       quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
       // Per-machine, so it comes from the credential file, not pod config —
       // and it is a fact here, not a setting: moving it means moving data,
@@ -189,10 +190,12 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       if ('approveJoins' in body) cfg.approveJoins = !!body.approveJoins;
       if ('review' in body) cfg.review = !!body.review;
       // A person's queue gate: on, and an inbound Follow is accepted on
-      // arrival instead of waiting in the requests queue. Local behavior,
-      // not on the wire — but intake reads the LIVE config, so it is
-      // patched below whether or not anything republishes.
+      // arrival instead of waiting in the requests queue. The actor says
+      // which (manuallyApprovesFollowers), and intake reads the LIVE config,
+      // so it is patched below as well as republished.
       if ('autoAcceptFollows' in body) cfg.autoAcceptFollows = !!body.autoAcceptFollows;
+      // Whether hashtag posts appear in Home; read as each timeline is answered.
+      if ('tagsInHome' in body) cfg.tagsInHome = !!body.tagsInHome;
       // The moderator roster (FEP-1b12): actor IRIs whose federated
       // moderation asks are queued, published as attributedTo.
       let rosterDiff = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.50.0",
+  "version": "1.55.2",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",
@@ -98,6 +98,6 @@
   },
   "devDependencies": {
     "esbuild": "^0.28.2",
-    "fedipod-bb": "^0.4.1"
+    "fedipod-bb": "^0.4.4"
   }
 }

package/scripts/stage-site.mjs

@@ -152,8 +152,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
         .replace('</head>', '<script src="/admin/client-pick.js"></script>\n</head>')
   .replace('</body>', `${clientNews()}</body>`);
       // Hide controls the browser build does not carry: the manual drain (it
-      // drains automatically over notifications), the local logfile viewer
-      // (there is no local log in a browser), and the "create a handle at the
+      // drains automatically over notifications), and the "create a handle at the
       // gateway" choice — a fronted @you@front identity is not the browser
       // model, and admin-facade.mjs refuses one outright. Leaving the radio
       // visible meant the page checked the name's availability as you typed,
@@ -162,7 +161,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
       // And rename "Recover posts" to the plainer "Refresh Feed" for this
       // audience.
       text = text
-        .replace('<style>#actor-pick', '<style>#gw-shape-front,#do-drain,#do-log,#actor-pick')
+        .replace('<style>#actor-pick', '<style>#gw-shape-front,#do-drain,#actor-pick')
         .replace('>Recover posts<', '>Refresh Feed<')
         // The move-to-another-gateway hint: only the browser build can move
         // in (signup.mjs moveIn), so only here does gateway.js get to show it.