fedipod 1.56.0 → 1.57.2

package/README.md

@@ -31,7 +31,7 @@ This README is about the `FediPod` as used with a Gateway. There are also a numb
 You can access your account by pointing any Mastodon API or C2S client at fedipod.net and signing in.  There are also two built-inclients, both served by fedipod.net: [Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant), which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)(MIT, by Chee Aun). The links at the top right of every page switch between
 them, at any time; whichever you opened last is the one that opens next time.
 
-You can follow and unfollow, post, reply, favourite, boost, attach media, edit and delete. Content warnings, polls with up to four options and one or several answers, all four visibility levels, a conversations view for direct messages, bookmarks, lists, keyword filters, pinned posts that other servers can see, blocking and muting, and the custom emojis other servers send.
+You can follow and unfollow, post, reply, favourite, boost, attach media, edit and delete. Content warnings, polls with up to four options and one or several answers, all four visibility levels, a conversations view for direct messages, bookmarks, lists (a list can keep its people out of your home timeline), keyword filters, pinned posts that other servers can see, blocking and muting, and the custom emojis other servers send.
 
 A post can quote another post. Quote is offered on posts whose author allows
 it; the quoted author's server is asked, and the quote shows as pending until

package/gateway.md

@@ -171,11 +171,10 @@ A browser account runs only while FediPod is open somewhere. While it is
 closed, fedipod.net does two things for it.
 
 **Your mail waits at the gateway.** Deliveries are kept there, not written to
-your pod one by one, and reach your pod in batches of up to a hundred: when you
-open FediPod, or every fifteen minutes otherwise. While FediPod is open, mail
-goes straight to your pod as before. A DeviceAgent's mail always goes straight
-to its pod. On a gateway whose admin has turned the hold off (below), mail
-always goes straight to your pod.
+your pod one by one, and reach your pod in batches of up to a hundred: all of
+them when you open FediPod, or one batch every fifteen minutes otherwise. While
+FediPod is open, mail goes straight to your pod as before. On a gateway whose
+admin has turned the hold off (below), mail always goes straight to your pod.
 
 **The gateway keeps your account running.** It accepts your follows, tries
 again what failed to go out, and publishes the posts you scheduled, all while FediPod is closed. Other mail waits on your
@@ -278,10 +277,10 @@ door answer 410 Gone, other servers drop the account the next time they look,
 and nobody can take the name. Nothing on your pod is touched. An address that
 had already moved to another gateway keeps answering as moved.
 
-Only accounts opened from a browser are counted. A DeviceAgent behind the
-gateway drains its own inbox as it runs, and is never paused or closed by
-time. Accounts from before this was built are counted from their next
-sign-in. A gateway operator sets the cap and the window with
+Every person's account is counted: from the last time its owner signed in or
+posted, or from the day it was set up if they never have. An account with no
+day on record is counted from 23 September 2026. A forum, its categories and a
+group are not counted. A gateway operator sets the cap and the window with
 `FEDIPOD_PAUSE_ITEMS` and `FEDIPOD_CLOSE_DAYS`.
 
 ## Notices

package/gui.md

@@ -104,6 +104,16 @@ that one of your connected accounts also brought in is from someone you follow
 there, and stays. An app already showing them keeps them on screen until it
 reloads.
 
+## Lists in your home timeline
+
+The **lists** row counts your lists, and under it each list has a switch:
+*shown in home* or *hidden from home*. Hidden, the posts and boosts of the
+people on that list leave your home timeline and show on the list's own
+timeline and on the public timeline. Lists are made and filled in the app;
+an app can set the same switch (in Phanpy, **Hide posts on this list from
+Home/Following**). An app already showing the posts keeps them on screen
+until it reloads.
+
 ## Handling follow requests
 
 New followers are accepted automatically. Set **new followers** to *wait for

package/lib/client/masto/accounts.mjs

@@ -250,7 +250,7 @@ export async function handle(api, ctx) {
     const actorUrl = api.store.urlFor(mAccLists[1]);
     if (!actorUrl) return send(404, { error: 'Record not found' });
     return send(200, api.store.getLists().filter(l => (l.members || []).includes(actorUrl))
-      .map(l => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false })));
+      .map(l => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: !!l.exclusive })));
   }
 
   // The people muted and blocked, as accounts; the domains blocked, as names.

package/lib/client/masto/timelines.mjs

@@ -22,6 +22,10 @@ export async function handle(api, ctx) {
     // stay on the public timeline, their hashtags' pages and trends. One a
     // connected account also brought in is from someone followed there.
     const hideTags = pathname === '/api/v1/timelines/home' && api.store.getConfig?.()?.tagsInHome === false;
+    // A list set to hide its people from Home (`exclusive`): their posts and
+    // boosts show on the list and on the public timeline only.
+    const hiddenBy = new Set(pathname === '/api/v1/timelines/home'
+      ? (api.store.getLists?.() || []).filter(l => l.exclusive).flatMap(l => l.members || []) : []);
     // The UNFILTERED list, both as the source and as the reply-count corpus:
     // a reply can be a mention, and mentions are filtered out of timelines
     // below — counting against the filtered set would undercount them.
@@ -36,6 +40,7 @@ export async function handle(api, ctx) {
       .filter(s => !s.direct && s.visibility !== 'direct')
       .filter(s => !muted.has(s.actor) && !muted.has(s.via))
       .filter(s => !hideTags || s.kind !== 'tag' || s.sourceAccts?.length)
+      .filter(s => !hiddenBy.size || !(hiddenBy.has(s.actor) || hiddenBy.has(s.via)))
       .filter(s => !localOnly || (s.kind === 'post' && s.visibility !== 'private'))
       .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
     const { items: page, headers } = api.page(items, url);
@@ -122,7 +127,9 @@ export async function handle(api, ctx) {
 
   // Lists, filters and scheduled posts are the client's own arrangements —
   // kept in local state, nothing federates.
-  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false });
+  // `exclusive`: the list hides its people from Home. A form sends it as a word.
+  const flag = (v) => v === true || v === 'true' || v === 'on' || v === '1';
+  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: !!l.exclusive });
   if (pathname === '/api/v1/lists' && req.method === 'GET') {
     return send(200, api.store.getLists().map(listJson));
   }
@@ -131,7 +138,8 @@ export async function handle(api, ctx) {
     const title = String(body.title || '').trim();
     if (!title) return send(422, { error: 'a title is required' });
     const lists = api.store.getLists();
-    const l = { id: crypto.randomBytes(8).toString('hex'), title, repliesPolicy: body.replies_policy || 'list', members: [] };
+    const l = { id: crypto.randomBytes(8).toString('hex'), title, repliesPolicy: body.replies_policy || 'list',
+      exclusive: flag(body.exclusive), members: [] };
     lists.push(l);
     api.store.setLists(lists);
     return send(200, listJson(l));
@@ -149,6 +157,7 @@ export async function handle(api, ctx) {
       const body = await readBody(req);
       if (body.title) l.title = String(body.title);
       if (body.replies_policy) l.repliesPolicy = body.replies_policy;
+      if ('exclusive' in body) l.exclusive = flag(body.exclusive);
       api.store.setLists(lists);
     }
     return send(200, listJson(l));

package/lib/gateway/front-core.mjs

@@ -23,7 +23,7 @@ import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
 import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer, provedOwner } from './quiet.mjs';
-import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
+import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, waitsForRound, routeHereApi, routeKeeperApi, routePushApi, routeAlertApi } from './held-mail.mjs';
 import { routeCheckApi, missingLetter } from './check-letter.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { routeForumPage } from './forum-pages.mjs';
@@ -827,7 +827,7 @@ async function route(request, ctx) {
     const standing = await accountState(ctx, up.handle, rec);
     // A browser account's mail waits here while its app is closed (held-mail.mjs), unless the hold is off.
     const away = mayBeAway(ctx, rec) && !(await isPresent(ctx, up.handle)); const held = away && holdsMail(ctx, rec);
-    const { status, reason, content, bytes, type, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
+    const { status, reason, content, bytes, type, accountDeleted, notifies, name, raw, receipt } = await handleDelivery(request, identFor(rec, policy),
       { podPut: held ? holdingPut(ctx, up.handle, rec) : (u, b, ct) => ctx.podPut(up.handle, u, b, ct),
         fetchImpl: ctx.fetchImpl, paused: standing.paused, origin: ctx.frontOrigin || null });
     // One line per delivery, so "did it arrive at the door" has an answer.
@@ -836,8 +836,8 @@ async function route(request, ctx) {
     if (away && status === 202) await afterHeld(ctx, up.handle, rec, { type, notifies });
     // A forum fedipod.net keeps: the delivery is placed now, in this request,
     // and the run that carries it is started. Whatever could not be placed
-    // here is still in the inbox for that run.
-    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper) {
+    // here is still in the inbox for that run. A notice that an account was deleted waits for the round's run (held-mail.mjs).
+    if (status === 202 && name && ctx.forum?.isForumRow(rec) && rec.keeper && !await waitsForRound(ctx, up.handle, rec, { accountDeleted })) {
       const placed = await ctx.forum.placeAtDoor(ctx, up.handle, rec, { name, raw, receipt })
         .catch((e) => ({ placed: false, why: e.message }));
       console.log(`door @${up.handle}: ${placed.placed ? 'placed' : `not placed (${placed.why})`}`);

package/lib/gateway/gateway-core.mjs

@@ -168,14 +168,23 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     ? signReceipt(makeReceipt(v, { gateway: ident.gatewayWebId }), ident.hmacSecret)
     : null;
   const hash = sha256hex(raw);
-  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  // The item and its receipt together: on a slow pod, one write after the
+  // other outlasted the sender's wait, and the sender sent the item again. A
+  // receipt whose item did not land vouches for nothing, and the reader lets
+  // it go.
+  const [okA] = await Promise.all([
+    inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw),
+    receipt ? inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt) : null,
+  ]);
   // A pod-write failure returns 5xx so the ORIGIN retries over its own ladder —
   // that is what preserves the pod's buffer property without the gateway
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  // `accountDeleted`: the sender says its own account is gone. Mastodon sends
+  // one of these to every inbox it knows, for every account it deletes.
   return { status: 202, reason: v.verified ? 'verified' : failed ? `buffered-unverified: ${failed}` : 'buffered-unverified',
-    content, bytes: bytes.byteLength, type: activity.type, notifies: notifies(activity, ident), name: hash, raw, receipt };
+    content, bytes: bytes.byteLength, type: activity.type, accountDeleted: activity.type === 'Delete' && idOf(activity.object) === actor,
+    notifies: notifies(activity, ident), name: hash, raw, receipt };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/held-mail.mjs

@@ -69,40 +69,55 @@ export const holdingPut = (ctx, handle, rec) => async (url, body, ct) => {
  * [{ name, body, receipt, held: [the held names it came from] }]. A receipt
  * whose delivery is not here has nothing to vouch for, and is let go.
  */
-export async function heldEntries(ctx, handle) {
-  const names = await ctx.listHeld(handle);
+// `max`: at most that many deliveries, the first by name, and no more of the
+// pile is listed or read than holds them. Without it, everything.
+export async function heldEntries(ctx, handle, { max = Infinity } = {}) {
+  // A receipt may sit beside each delivery: twice as many names hold them whole.
+  const names = (await ctx.listHeld(handle, Number.isFinite(max) ? { limit: max * 2 } : {})).sort();
   if (!names.length) return [];
   const items = new Map();            // item name -> { body, receipt, held: [names] }
   for (const name of names) {
-    const got = await ctx.readHeld(handle, name);
     const item = name.endsWith(RECEIPT) ? name.slice(0, -RECEIPT.length) : name;
+    if (!items.has(item) && items.size >= max) break;
     const e = items.get(item) || { held: [] };
     e.held.push(name);
-    if (got != null) {
-      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
-    }
     items.set(item, e);
   }
-  for (const [item, e] of items) {
+  await inTurns([...items], async ([item, e]) => {
+    for (const name of e.held) {
+      const got = await ctx.readHeld(handle, name);
+      if (got == null) continue;
+      if (name.endsWith(RECEIPT)) { try { e.receipt = JSON.parse(got); } catch { e.receipt = null; } } else e.body = got;
+    }
     if (typeof e.body !== 'string') { for (const n of e.held) await ctx.dropHeld(handle, n); items.delete(item); }
-  }
+  });
   return [...items].map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null, held: e.held }));
 }
 
-// Everything held for one account, written to its pod inbox in batches and
-// then let go. Returns how many deliveries reached the pod. A batch the pod
-// refuses stays held for the next try.
-export async function flushHeld(ctx, handle, rec, { now = Date.now() } = {}) {
-  const all = (await heldEntries(ctx, handle)).map((e) => [e.name, e]);
-  if (!all.length) return 0;
+// A few at a time: a pile is read and let go quickly without asking the store
+// for all of it at once.
+const TOGETHER = 6;
+async function inTurns(list, fn) {
+  for (let i = 0; i < list.length; i += TOGETHER) await Promise.all(list.slice(i, i + TOGETHER).map(fn));
+}
+
+// What is held for one account, written to its pod inbox in batches and then
+// let go: every batch, or `batches` of them. Returns how many deliveries
+// reached the pod. A batch the pod refuses, or does not take within `podMs`
+// where one is given, stays held for the next try.
+export async function flushHeld(ctx, handle, rec, { now = Date.now(), batches = Infinity, podMs = null } = {}) {
   let delivered = 0;
-  for (let i = 0; i < all.length; i += BATCH_MAX) {
-    const chunk = all.slice(i, i + BATCH_MAX);
-    const batch = chunk.map(([name, e]) => ({ name, body: e.body, receipt: e.receipt || null }));
-    const doc = `batch-${now}-${i / BATCH_MAX}-${Math.random().toString(36).slice(2, 8)}.json`;
-    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json');
+  const sent = new Set();
+  for (let i = 0; i < batches; i++) {
+    // A delivery written once is not written again, should letting it go fail.
+    const chunk = (await heldEntries(ctx, handle, { max: BATCH_MAX })).filter((e) => !sent.has(e.name));
+    if (!chunk.length) break;
+    const batch = chunk.map((e) => ({ name: e.name, body: e.body, receipt: e.receipt || null }));
+    const doc = `batch-${now}-${i}-${Math.random().toString(36).slice(2, 8)}.json`;
+    const ok = await ctx.podPut(handle, inboxOf(rec) + doc, JSON.stringify({ batch }), 'application/json', podMs ? { timeoutMs: podMs } : undefined);
     if (!ok) break;
-    for (const [, e] of chunk) for (const n of e.held) await ctx.dropHeld(handle, n);
+    for (const e of chunk) sent.add(e.name);
+    await inTurns(chunk.flatMap((e) => e.held), (n) => ctx.dropHeld(handle, n));
     delivered += chunk.length;
   }
   return delivered;
@@ -118,6 +133,18 @@ export async function wakesKeeper(ctx, handle, rec, type) {
   return true;
 }
 
+// A notice that an account was deleted, arriving for a forum this gateway
+// keeps, starts no run of its own: the forum is marked as having work, and the
+// round's run reads the notice from the inbox. False where that cannot be
+// noted, so the caller starts the run as for any delivery.
+export async function waitsForRound(ctx, handle, rec, { accountDeleted = false } = {}) {
+  const forum = rec.kind === 'application' ? handle : rec.forum;
+  if (!accountDeleted || !forum || !ctx.noteNext) return false;
+  const noted = await ctx.noteNext(forum, new Date().toISOString(), { earliest: true }).then(() => true, () => false);
+  if (noted) console.log(`door @${handle}: an account's deletion, left for the round's run of @${forum}`);
+  return noted;
+}
+
 // After a delivery is held: a follow wakes the keeper, and anything that
 // becomes a notification is read in and pushed at once to the phones and
 // browsers the owner signed up for notifications (masto-gateway.mjs: pushHeld).
@@ -132,17 +159,33 @@ export async function afterHeld(ctx, handle, rec, { type, notifies = false } = {
 // is gone, closed or moved has nowhere to deliver to, so its mail is let go.
 // `keep(handle, rec)` answers true when the account's keeper will take its mail
 // itself (lib/gateway/keeper.mjs), which delivers it and then reads it.
+//
+// The round has to end. So an account gets one batch a round, a pod has
+// ROUND_POD_MS to take it, a few accounts are worked on at a time, and each
+// round begins after the account the last one finished with (ctx.roundMark,
+// ctx.setRoundMark): a round cut short leaves out different accounts each time.
+export const ROUND_POD_MS = 10_000;
+const ROUND_TOGETHER = 4;
 export async function flushAll(ctx, { log = console.log, isGone = async () => false, keep = async () => false } = {}) {
-  for (const handle of await ctx.heldAccounts()) {
+  const all = [...await ctx.heldAccounts()].sort();
+  const mark = await ctx.roundMark?.().catch(() => null);
+  const from = mark ? all.findIndex((h) => h > mark) : 0;
+  const order = from > 0 ? [...all.slice(from), ...all.slice(0, from)] : all;
+  const one = async (handle) => {
     const rec = await ctx.lookup(handle);
     if (!rec || rec.movedTo || await isGone(handle, rec)) {
-      for (const n of await ctx.listHeld(handle)) await ctx.dropHeld(handle, n);
+      await inTurns(await ctx.listHeld(handle, { limit: BATCH_MAX * 2 }), (n) => ctx.dropHeld(handle, n));
       log(`held mail @${handle}: let go (no account to deliver to)`);
-      continue;
+      return;
     }
-    if (await keep(handle, rec).catch(() => false)) continue;
-    const n = await flushHeld(ctx, handle, rec).catch((e) => { log(`held mail @${handle}: ${e?.message || e}`); return 0; });
+    if (await keep(handle, rec).catch(() => false)) return;
+    const n = await flushHeld(ctx, handle, rec, { batches: 1, podMs: ROUND_POD_MS });
     if (n) log(`held mail @${handle}: ${n} delivered to the pod`);
+  };
+  for (let i = 0; i < order.length; i += ROUND_TOGETHER) {
+    const turn = order.slice(i, i + ROUND_TOGETHER);
+    await Promise.all(turn.map((h) => one(h).catch((e) => log(`held mail @${h}: ${e?.message || e}`))));
+    await ctx.setRoundMark?.(turn.at(-1)).catch(() => {});
   }
 }
 

package/lib/gateway/quiet.mjs

@@ -4,7 +4,17 @@
 // public read, stamps noteOpened from the relay, counts noteReceived after
 // a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
 
-import { keptNow, holdOn } from './copy.mjs';
+import { keptNow, holdOn, isPersonal } from './copy.mjs';
+
+// A gateway whose people all run FediPod in a browser gives every person's
+// account a day its owner was last here, so none is left out of what follows:
+// the day it was attached, or the day these dates began for a row that has
+// neither. A forum, a group and a forum's category are nobody's to open.
+export const FIRST_OPENED = '2026-09-23T00:00:00.000Z';
+export function withOpened(rec) {
+  if (!rec || rec.openedAt || !isPersonal(rec)) return rec;
+  return { ...rec, openedAt: rec.attachedAt || FIRST_OPENED };
+}
 
 // ---- accounts that go quiet -------------------------------------------------
 //

package/lib/pod/inbox.mjs

@@ -20,12 +20,15 @@ const RECEIPT_CT = 'application/json';
  * public Append the pod may well allow. This is the one place that gets to
  * decide that, because it lived in two adapters and had to be right in both.
  *
+ * `timeoutMs`, when given, is how long the pod has to answer; a pod that takes
+ * longer counts as one that did not answer.
+ *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null, timeoutMs = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
-  const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  const r = await fetchImpl(url, { method: 'PUT', headers, body, ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}) }).catch(() => null);
   // The pod's answer, for a caller that keeps a log: a refused write is
   // otherwise a bare "failed" with the status thrown away.
   report?.(r ? r.status : 0);

package/lib/surface/routes/owner.mjs

@@ -14,6 +14,9 @@ const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
 // Config the actor document carries, so a change is not real until it is
 // republished.
 const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'approveJoins', 'moderators', 'autoAcceptFollows'];
+// A list as the page shows it: its name and whether its people are kept out
+// of Home. Lists are made and filled in the client; the page only switches.
+const listRow = (l) => ({ id: l.id, title: l.title, exclusive: !!l.exclusive });
 
 export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
   const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
@@ -71,6 +74,7 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
       aliases: cfg.aliases || [],
       autoAcceptFollows: cfg.autoAcceptFollows !== false,
       tagsInHome: cfg.tagsInHome !== false,
+      lists: agent.store.getLists().map(listRow),
       quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
       // Per-machine, so it comes from the credential file, not pod config —
       // and it is a fact here, not a setting: moving it means moving data,
@@ -254,6 +258,18 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         },
       });
     }
+    // One list's Home switch, the same `exclusive` a Mastodon app sets.
+    case '/lists': {
+      if (typeof body.exclusive !== 'boolean') return json(res, 400, { error: 'exclusive (true or false) is the one thing to set here' });
+      await agent.requestTakeover?.();
+      const lists = agent.store.getLists();
+      const l = lists.find(x => x.id === String(body.id || ''));
+      if (!l) return json(res, 404, { error: 'no such list' });
+      l.exclusive = body.exclusive;
+      agent.store.setLists(lists);
+      await agent.store.flush();
+      return json(res, 200, { ok: true, lists: lists.map(listRow) });
+    }
     default: return false;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.56.0",
+  "version": "1.57.2",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node claude/smoke-tests/admin-facade-smoke.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs claude/smoke-tests/unread-docs.test.mjs claude/smoke-tests/post-text-once.test.mjs claude/smoke-tests/connected-pod-only.test.mjs claude/smoke-tests/check-letter.test.mjs claude/smoke-tests/gone-through-relay.test.mjs claude/smoke-tests/connected-feeds.test.mjs claude/smoke-tests/forum-pages.test.mjs claude/smoke-tests/round.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/web/admin/record.js

@@ -108,6 +108,37 @@ document.getElementById('win').addEventListener('win:closed', () => {
 });
 
 
+// One row per list, indented under the lists row: its name, and one dropdown
+// whose two options are its states — the list's people shown in Home, or kept
+// to the list. Changing the word is the whole action.
+function listRows() {
+  const out = [];
+  for (const l of config.lists || []) {
+    const dt = document.createElement('dt');
+    dt.className = 'under';
+    dt.textContent = l.title;
+    const sel = document.createElement('select');
+    sel.setAttribute('aria-label', `Posts from ${l.title} in your home timeline`);
+    sel.title = '   Whether the posts and boosts of the people on this list appear in your home timeline; hidden, they show only on the list and on the public timeline';
+    for (const [v, t] of [['show', 'shown in home'], ['hide', 'hidden from home']]) {
+      const o = document.createElement('option');
+      o.value = v; o.textContent = t; o.selected = (v === 'hide') === !!l.exclusive;
+      sel.appendChild(o);
+    }
+    sel.addEventListener('change', async () => {
+      const hide = sel.value === 'hide';
+      sel.disabled = true;
+      const r = await write('/lists', { id: l.id, exclusive: hide },
+        hide ? `${l.title} is hidden from your home timeline` : `${l.title} is shown in your home timeline`);
+      if (r) await load(); else { sel.value = l.exclusive ? 'hide' : 'show'; sel.disabled = false; }
+    });
+    const dd = document.createElement('dd');
+    dd.append(sel);
+    out.push([dt, dd]);
+  }
+  return out;
+}
+
 // One row per identity connected elsewhere, indented under the row that adds
 // them. Each carries its own way out: disconnecting one has nothing to do with
 // the others.
@@ -254,7 +285,7 @@ function render() {
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
   // kind row, so the row would be a second switch for the same thing.
-  if (config.kind !== 'group') rows.splice(2, 0, ['new followers', 'ctl'], ['hashtag posts in home', 'ctl']);
+  if (config.kind !== 'group') rows.splice(2, 0, ['new followers', 'ctl'], ['hashtag posts in home', 'ctl'], ['lists', 'ctl']);
   // Rows that belong under the one being written, appended after it.
   let kids = null;
   for (const [k, v, link] of rows) {
@@ -301,6 +332,13 @@ function render() {
       HOME_TAGS_CTL.hidden = false;
       HOME_TAGS_PICK.value = config.tagsInHome !== false ? 'show' : 'hide';
     }
+    // How many lists; each one is a row of its own underneath with its Home
+    // switch. Lists are made and filled in the client, so this row only counts.
+    if (k === 'lists') {
+      const n = (config.lists || []).length;
+      dd.textContent = n ? `${n} ${n === 1 ? 'list' : 'lists'}` : 'none — make one in Phanpy';
+      kids = listRows();
+    }
     if (k === 'gateway') {
       dd.textContent = '';
       dd.append(GATEWAY_CTL);

package/web/app/admin-facade.mjs

@@ -23,12 +23,15 @@ import { followActor, followHandle } from '../../lib/core/social.mjs';
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
 // Carried in the actor document, so a change is not live until republished.
 const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'aliases', 'autoAcceptFollows'];
+// A list as the page shows it: its name and whether its people are kept out
+// of Home. Lists are made and filled in the client; the page only switches.
+const listRow = (l) => ({ id: l.id, title: l.title, exclusive: !!l.exclusive });
 
 // The data endpoints this agent answers at the origin root (the page computes
 // its base as the origin, so it asks for /status, not /admin/status). Anything
 // not here falls through to the network as a static file or the gateway.
 export const ADMIN_PATHS = new Set([
-  '/status', '/config', '/gateway', '/alias', '/rotate-key', '/import',
+  '/status', '/config', '/gateway', '/alias', '/rotate-key', '/import', '/lists',
   '/deadletter', '/trouble', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
@@ -121,6 +124,7 @@ export class AdminFacade {
             aliases: cfg.aliases || [],
             autoAcceptFollows: cfg.autoAcceptFollows !== false,
             tagsInHome: cfg.tagsInHome !== false,
+            lists: a.store.getLists().map(listRow),
             quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
             mode: a.status().mode,
             // Live from the credential's actual backend on THIS browser (a
@@ -242,6 +246,19 @@ export class AdminFacade {
         });
       }
 
+      // One list's Home switch, the same `exclusive` a Mastodon app sets.
+      case '/lists': {
+        if (typeof body.exclusive !== 'boolean') return json(400, { error: 'exclusive (true or false) is the one thing to set here' });
+        await a.requestTakeover?.();
+        const lists = a.store.getLists();
+        const l = lists.find(x => x.id === String(body.id || ''));
+        if (!l) return json(404, { error: 'no such list' });
+        l.exclusive = body.exclusive;
+        a.store.setLists(lists);
+        await a.store.flush();
+        return json(200, { ok: true, lists: lists.map(listRow) });
+      }
+
       case '/describe': {
         const cfg = { ...a.store.getConfig() };
         if ('summary' in body) cfg.summary = body.summary || undefined;

package/web/app/dist/sw.js

@@ -69313,7 +69313,7 @@ async function handle3(api, ctx) {
   if (mAccLists && req.method === "GET") {
     const actorUrl = api.store.urlFor(mAccLists[1]);
     if (!actorUrl) return send(404, { error: "Record not found" });
-    return send(200, api.store.getLists().filter((l) => (l.members || []).includes(actorUrl)).map((l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || "list", exclusive: false })));
+    return send(200, api.store.getLists().filter((l) => (l.members || []).includes(actorUrl)).map((l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || "list", exclusive: !!l.exclusive })));
   }
   if (pathname === "/api/v1/mutes" && req.method === "GET") {
     return send(200, (api.store.getMuted().actors || []).map((a) => api.account(a)));
@@ -69382,9 +69382,10 @@ async function handle4(api, ctx) {
   if (pathname === "/api/v1/timelines/home" || pathname === "/api/v1/timelines/public" || pathname === "/api/v1/trends/statuses") {
     const localOnly = pathname === "/api/v1/timelines/public" && url.searchParams.get("local") === "true";
     const hideTags = pathname === "/api/v1/timelines/home" && api.store.getConfig?.()?.tagsInHome === false;
+    const hiddenBy = new Set(pathname === "/api/v1/timelines/home" ? (api.store.getLists?.() || []).filter((l) => l.exclusive).flatMap((l) => l.members || []) : []);
     const all = api.store.getStatuses();
     const muted = new Set(api.store.getMuted().actors);
-    let items = all.filter((s) => s.kind !== "remote" && s.kind !== "mention").filter((s) => !s.direct && s.visibility !== "direct").filter((s) => !muted.has(s.actor) && !muted.has(s.via)).filter((s) => !hideTags || s.kind !== "tag" || s.sourceAccts?.length).filter((s) => !localOnly || s.kind === "post" && s.visibility !== "private").sort((a, b) => String(b.published || "").localeCompare(String(a.published || "")));
+    let items = all.filter((s) => s.kind !== "remote" && s.kind !== "mention").filter((s) => !s.direct && s.visibility !== "direct").filter((s) => !muted.has(s.actor) && !muted.has(s.via)).filter((s) => !hideTags || s.kind !== "tag" || s.sourceAccts?.length).filter((s) => !hiddenBy.size || !(hiddenBy.has(s.actor) || hiddenBy.has(s.via))).filter((s) => !localOnly || s.kind === "post" && s.visibility !== "private").sort((a, b) => String(b.published || "").localeCompare(String(a.published || "")));
     const { items: page2, headers } = api.page(items, url);
     return send(200, page2.map((s) => api.statusOrBoost(s, { all })), headers);
   }
@@ -69452,7 +69453,8 @@ async function handle4(api, ctx) {
     const { items: page2, headers } = api.page(items, url);
     return send(200, page2.map((s) => api.statusOrBoost(s, { all })), headers);
   }
-  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || "list", exclusive: false });
+  const flag = (v) => v === true || v === "true" || v === "on" || v === "1";
+  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || "list", exclusive: !!l.exclusive });
   if (pathname === "/api/v1/lists" && req.method === "GET") {
     return send(200, api.store.getLists().map(listJson));
   }
@@ -69461,7 +69463,13 @@ async function handle4(api, ctx) {
     const title = String(body.title || "").trim();
     if (!title) return send(422, { error: "a title is required" });
     const lists = api.store.getLists();
-    const l = { id: node_crypto_default.randomBytes(8).toString("hex"), title, repliesPolicy: body.replies_policy || "list", members: [] };
+    const l = {
+      id: node_crypto_default.randomBytes(8).toString("hex"),
+      title,
+      repliesPolicy: body.replies_policy || "list",
+      exclusive: flag(body.exclusive),
+      members: []
+    };
     lists.push(l);
     api.store.setLists(lists);
     return send(200, listJson(l));
@@ -69479,6 +69487,7 @@ async function handle4(api, ctx) {
       const body = await readBody2(req);
       if (body.title) l.title = String(body.title);
       if (body.replies_policy) l.repliesPolicy = body.replies_policy;
+      if ("exclusive" in body) l.exclusive = flag(body.exclusive);
       api.store.setLists(lists);
     }
     return send(200, listJson(l));
@@ -71622,6 +71631,7 @@ var ImportWorker = class {
 // web/app/admin-facade.mjs
 var PERMANENT_CONFIG = ["handle", "remotePod", "issuer", "root", "kind"];
 var WIRE_CONFIG = ["name", "summary", "icon", "image", "fields", "aliases", "autoAcceptFollows"];
+var listRow = (l) => ({ id: l.id, title: l.title, exclusive: !!l.exclusive });
 var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/status",
   "/config",
@@ -71629,6 +71639,7 @@ var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/alias",
   "/rotate-key",
   "/import",
+  "/lists",
   "/deadletter",
   "/trouble",
   "/blocks",
@@ -71733,6 +71744,7 @@ var AdminFacade = class {
             aliases: cfg.aliases || [],
             autoAcceptFollows: cfg.autoAcceptFollows !== false,
             tagsInHome: cfg.tagsInHome !== false,
+            lists: a.store.getLists().map(listRow),
             quiescedAt: cfg.quiescedAt || null,
             movedTo: cfg.movedTo || null,
             mode: a.status().mode,
@@ -71876,6 +71888,18 @@ var AdminFacade = class {
           ...pub?.unreachable?.length ? { unreachable: pub.unreachable } : {}
         });
       }
+      // One list's Home switch, the same `exclusive` a Mastodon app sets.
+      case "/lists": {
+        if (typeof body.exclusive !== "boolean") return json2(400, { error: "exclusive (true or false) is the one thing to set here" });
+        await a.requestTakeover?.();
+        const lists = a.store.getLists();
+        const l = lists.find((x) => x.id === String(body.id || ""));
+        if (!l) return json2(404, { error: "no such list" });
+        l.exclusive = body.exclusive;
+        a.store.setLists(lists);
+        await a.store.flush();
+        return json2(200, { ok: true, lists: lists.map(listRow) });
+      }
       case "/describe": {
         const cfg = { ...a.store.getConfig() };
         if ("summary" in body) cfg.summary = body.summary || void 0;