fedipod 1.6.0 → 1.8.0

package/lib/device/admin/surface.mjs

@@ -76,14 +76,14 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
-  port = null, handle = null, embedded = false, basePath = '/',
+  port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme }) });
+  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.
@@ -104,21 +104,29 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     } catch (e) { log(`streaming broadcast: ${e.message}`); }
   };
 
-  // A path as the browser must ask for it: behind the door, prefixed with it.
-  const atPath = (p_) => (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
+  // A path as the browser must ask for it: under this identity's mount (a
+  // suffix pod's own path, or nothing) and behind the door, prefixed with it.
+  const atPath = (p_) => mount + (basePath === '/' ? p_ : basePath.slice(0, -1) + p_);
 
   // What every route may reach: the agent and the deployment's facts.
   const ctx = { agent, log, allowed, embedded, port, handle, publicOrigin, versionOnDisk, isGroup, json, setup: setup_ };
 
   const handler = async (req, res) => {
     const url = new URL(req.url, 'http://localhost');
+    // A suffix pod's surface answers under its mount (its own path on a shared
+    // host). Strip it once, here, so every route below is matched relative to
+    // the mount and a host-root/subdomain pod (empty mount) is unchanged. The
+    // full path stays on `url`/`req.url` for self-URLs that fold the mount back
+    // in themselves (the pagination base, the DPoP htu).
+    let p = url.pathname;
+    if (mount && (p === mount || p.startsWith(mount + '/'))) p = p.slice(mount.length) || '/';
     // Mastodon-style: the bearer-gated client API and the OAuth + nodeinfo
     // routes answer any origin — a browser client is served the way any
     // instance serves it. CORS headers and the preflight make that work; the
     // bearer stays the only credential, and the Host check below (which is
     // what stops DNS rebinding) still runs.
-    const apiPath = url.pathname.startsWith('/api/') || url.pathname.startsWith('/oauth/')
-      || url.pathname === '/.well-known/nodeinfo' || url.pathname === '/nodeinfo/2.0';
+    const apiPath = p.startsWith('/api/') || p.startsWith('/oauth/')
+      || p === '/.well-known/nodeinfo' || p === '/nodeinfo/2.0';
     if (apiPath) {
       res.setHeader('access-control-allow-origin', '*');
       res.setHeader('access-control-expose-headers', 'Link');
@@ -142,11 +150,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       res.end('forbidden\n');
       return;
     }
-    let p = url.pathname;
-    // Embedded, the operator's door is one path on the pod's origin. Behind it
-    // is everything that was the admin server; in front of it are the protocol
-    // routes, which have to answer strangers because that is what makes the pod
-    // an instance other software can talk to.
+    // Embedded, the operator's door is one path on the pod's origin (under the
+    // mount, when there is one). Behind it is everything that was the admin
+    // server; in front of it are the protocol routes, which have to answer
+    // strangers because that is what makes the pod an instance other software
+    // can talk to.
     let atDoor = !embedded;
     if (embedded && basePath !== '/'
       && (p === basePath.slice(0, -1) || p.startsWith(basePath))) {
@@ -171,7 +179,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // above still decides who gets this far.
       if (p === '/.well-known/oauth-authorization-server') {
         const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}${mount}`));
       }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
@@ -180,7 +188,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // NodeInfo on the agent origin — clients probe it at login.
       if (p === '/.well-known/nodeinfo') {
         return json(res, 200, nodeinfoPointer(
-          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}/nodeinfo/2.0`));
+          `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}${mount}/nodeinfo/2.0`));
       }
       if (p === '/nodeinfo/2.0') {
         return json(res, 200, nodeinfoDoc({
@@ -206,8 +214,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         // Our own pages come before the group check: a group is set up in the
         // browser like anything else, and it has a record to edit. It still
         // serves no fediverse client — see the 404 two lines down.
-        const mount = webMount(p);
-        if (mount) {
+        const wmount = webMount(p);
+        if (wmount) {
           // Without the slash a page's own relative <script src> resolves one
           // level up and 404s — and that is true at any depth, so ask the
           // filesystem rather than only special-casing the mount itself.
@@ -217,7 +225,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             res.end();
             return;
           }
-          return serveWeb(res, p, mount, allowed);
+          return serveWeb(res, p, wmount, allowed);
         }
         // The bare URL means "show me what this agent wants from me now".
         // Keyed on the credential FILE, never on configured(): a healthy

package/lib/device/cli/commands/setup.mjs

@@ -18,7 +18,7 @@ export async function setup() {
   if (process.stdin.isTTY && !has('cli') && !IDENTITY_FLAGS.some(f => args.includes('--' + f))) {
     return runBrowserSetup();
   }
-const root = flag('root');
+const root = flag('root') || 'fedipod/';   // new installs default to the fedipod/ container
 const kind = has('group') ? 'group' : 'person';
 const approveJoins = has('group') && has('approve-joins');
 const summary = flag('summary');
@@ -48,6 +48,14 @@ if (!newAccount && !pod) {
   }
 }
 if (!newAccount && !pod) { console.error('no pod given'); process.exit(2); }
+if (!newAccount) {
+  const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
+  const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
+  if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
+    console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    process.exit(2);
+  }
+}
 
 const issuer = flag('issuer') || await ask('Solid identity provider', 'https://solidcommunity.net');
 // Before the password is asked for, let alone sent. The issuer is where it

package/lib/device/setup.mjs

@@ -19,6 +19,7 @@ import { hashPassword } from '../client/masto/index.mjs';
 import { webfingerHost, apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
+import { resourceExists } from '../pod/root.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
 const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
@@ -222,6 +223,8 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
   } = answers;
   let { pod, root } = answers;
+  if (!root) root = 'fedipod/';   // new installs default to the fedipod/ container; a
+  // resuming run overwrites this with the credential's own root below.
   let accountWebId = null;   // what createAccountWithPod reported, when it ran
   // The private half always starts here, beside the credential and the keys —
   // not on the pod. Every activity you receive would otherwise cost the pod
@@ -263,6 +266,9 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       // reachable, and no silent 401 later on a pod whose profile is empty.
       const usable = await checkPod(pod);
       if (!usable.ok) throw new Error(usable.error);
+      if (await (deps.resourceExists || resourceExists)(deps.fetch || fetch, apUrls(pod, root || DEFAULT_ROOT).actor)) {
+        throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+      }
       skip('account', 'using the pod you already have');
     }
 

package/lib/gateway/front-core.mjs

@@ -16,10 +16,11 @@
 // HTTPS box is another. UN-DEPLOYED — nothing in FediPod runs it.
 
 import crypto from 'node:crypto';
-import { handleDelivery } from './gateway-core.mjs';
+import { handleDelivery, handleOwnerPost } from './gateway-core.mjs';
 import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
+import { podBaseOfWebId } from '../pod/urls.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -513,20 +514,31 @@ async function route(request, ctx) {
     if (!/^https?:\/\/\S+\/$/.test(podBase)) {
       return j(400, { error: 'podBase must be a URL ending in /' });
     }
-    // An identity needs an origin of its own, so only an origin root may opt
-    // in. Anything deeper would also let one path-pod user claim an ancestor
-    // of another's pod.
-    try {
-      if (new URL(podBase).pathname !== '/') {
-        return j(403, { error: 'podBase must be a pod origin root, like https://mei.example.org/' });
-      }
-    } catch { return j(400, { error: 'podBase is not a URL' }); }
+    let podUrl;
+    try { podUrl = new URL(podBase); } catch { return j(400, { error: 'podBase is not a URL' }); }
+    // A pod may be host-root (its own origin) or on a PATH of a shared host — a
+    // suffix pod, which the Server runs at `https://server/aisha/`. What is
+    // refused is the gateway's own origin root itself: that is where the
+    // gateway lives, not a pod, and admitting it would (with the ownership
+    // fallback below) let a co-tenant claim the whole origin.
+    if (ctx.frontOrigin) {
+      try {
+        if (podUrl.origin === new URL(ctx.frontOrigin).origin && podUrl.pathname === '/') {
+          return j(403, { error: 'that is this gateway, not a pod — name the pod that holds your data' });
+        }
+      } catch { /* no usable frontOrigin: the checks below still apply */ }
+    }
+    if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
+      return j(403, { error: 'that is not a pod address' });
+    }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    // The pod's own server names its owner when it can. Where it does, that is
-    // the proof; where it does not, the WebID must at least live under the pod.
+    // The pod's own server names its owner when it can, and where it does that
+    // is the proof. Where it does not, the WebID must live in EXACTLY this pod
+    // — its own pod base equal to podBase, not merely starting with it, which on
+    // a path server an ancestor of another's pod would.
     const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const proven = owners.length ? owners.includes(webid) : webid.startsWith(podBase);
+    const proven = owners.length ? owners.includes(webid) : podBaseOfWebId(webid) === podBase;
     if (!proven) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
@@ -607,6 +619,48 @@ async function route(request, ctx) {
     return { status, headers: {}, body: '' };
   }
 
+  // Outbox: the owner's own post, from any client that speaks ActivityPub
+  // client-to-server (dokieli, say). Cross-origin by nature — such a client is
+  // a page on another site — so this route answers a preflight and carries
+  // CORS headers; the owner's pod token is the credential, so any origin may
+  // ask. GET stays a read: the pod's document for a fronted account, sent on
+  // to the pod for a door account whose documents live at their own address.
+  if (up.rest === 'ap/outbox') {
+    const cors = {
+      'access-control-allow-origin': '*',
+      'access-control-allow-methods': 'GET, POST, OPTIONS',
+      'access-control-allow-headers': 'Authorization, DPoP, Content-Type, Slug, Link',
+      'access-control-expose-headers': 'Location, Accept-Post',
+      'access-control-max-age': '86400',
+    };
+    if (request.method === 'OPTIONS') {
+      // Accept-Post names JSON only: a client that reads it (dokieli) sends
+      // JSON-LD when HTML is not offered.
+      // body null, not '': a Response refuses any body on a 204, and the
+      // function adapter hands `body` straight to one.
+      return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
+        'accept-post': 'application/ld+json, application/activity+json' }, body: null };
+    }
+    if (request.method === 'POST') {
+      const json = (status, obj, extra = {}) => ({ status,
+        headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
+        body: JSON.stringify(obj) });
+      const webid = await verifyPodToken(request, pathname, ctx.verifier);
+      if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
+      const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+      if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+      const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
+        { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
+      console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
+      if (status !== 202) return json(status, { error: reason });
+      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+        note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
+    }
+    if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 303, headers: { ...cors, location: rec.podHome + 'ap/outbox', 'cache-control': 'no-store' }, body: '' };
+    }
+  }
+
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.

package/lib/gateway/gateway-core.mjs

@@ -110,4 +110,44 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
 }
 
+// The outbox door: the owner's own post, taken on their behalf.
+//
+// A client such as dokieli POSTs an activity — or a bare object — to the
+// outbox address the actor advertises. The door holds no key and mints nothing:
+// it checks that the token proves the account's owner (the caller has already
+// done that and hands in `owner`), writes the bytes into the pod inbox exactly
+// as verified mail is written, and stamps them with a receipt whose method is
+// `c2s` and whose actor is this account. The drain hands such an item to the
+// client-to-server dispatcher, which publishes and delivers it — so the post
+// goes out when the agent next runs, the same way inbound mail is read.
+//
+// `slug` is the name the client asked for its new document. It rides in the
+// receipt so the dispatcher can use it, and it is what lets the door answer a
+// Location before anything exists: the object will live at notesPrefix+slug
+// unless that name is taken, in which case the agent mints another.
+export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+  if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
+  let raw;
+  try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
+  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
+  let doc;
+  try { doc = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
+    return { status: 400, reason: 'a typed ActivityStreams object is required' };
+  }
+  const slug = safeSlug(request.headers.get('slug'));
+  const receipt = signReceipt({
+    v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
+    checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+  }, ident.hmacSecret);
+  const hash = sha256hex(raw);
+  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
+  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
+  await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
+  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+}
+
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/pod/actor.mjs

@@ -69,8 +69,8 @@ export async function writeProfilePage(pod, urls, html) {
  * parsed graph does not mention the WebID, and patches exactly the statements
  * involved rather than rewriting a document full of things that are not ours.
  */
-export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person' }) {
-  return pod.linkAccountInProfile({ actorUrl, accountName, kind });
+export function linkInWebIdProfile(pod, { actorUrl, accountName, kind = 'person', outbox = null }) {
+  return pod.linkAccountInProfile({ actorUrl, accountName, kind, outbox });
 }
 
 // ---- anyone at all ----

package/lib/pod/root.mjs

@@ -66,6 +66,17 @@ export async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_L
   return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? 'path' : null;
 }
 
+// Whether a document is there — one unauthenticated GET, 200 or not. The caller
+// names the URL; asked before a second setup, so a pod that already serves an
+// actor at the app's container refuses another rather than growing a duplicate.
+export async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(url,
+      { headers: { accept: 'application/activity+json' }, signal: AbortSignal.timeout(timeoutMs) });
+    return !!res && res.status === 200;
+  } catch { return false; }
+}
+
 export async function probeAnswers(podUrl, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(podUrl, { method: 'HEAD' });

package/lib/pod/transport.mjs

@@ -407,7 +407,7 @@ export class PodTransport {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = 'person' }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
     const docUrl = this.webId.split('#')[0];
     const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
@@ -424,11 +424,17 @@ export class PodTransport {
       [actor, RDF('type'), FOAF('OnlineAccount')],
       [actor, RDF('type'), kind === 'group' ? AS('Group') : AS('Person')],
       [actor, FOAF('accountName'), $rdf.literal(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
     // A handle change leaves the old accountName behind; ours is replaced.
-    const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
-      .filter(st => st.object.value !== accountName);
+    // Likewise an outbox that moved.
+    const stale = [
+      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
+      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
+    ];
     if (!missing.length && !stale.length) return false;
     // A patch touches these statements and nothing else. Rewriting the whole
     // profile re-serialises statements that are not ours — the OIDC issuer

package/lib/server/embed.mjs

@@ -47,7 +47,8 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  */
 export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  const url = apUrls(base, DEFAULT_ROOT).state + 'door-secret.json';
+  // Under the identity's own tree (fedipod/), where the gate reads it back.
+  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -136,7 +137,7 @@ function ensureCredential(home, { podBase, webId }) {
   const rec = {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
-    root: 'activitypods-js/',
+    root: 'fedipod/',
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -275,7 +276,7 @@ export async function startEmbeddedAgent({
   pollSeconds = null,
   autoAcceptFollows = true,
   gateToken = null,
-  uiPath = '/fedipod/',
+  uiPath = '/fp/',
 }) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
   const handle = handleFor(base);
@@ -323,7 +324,7 @@ export async function startEmbeddedAgent({
       throw new Error(`no pod at ${base} yet — its owner profile is not there`);
     }
     log(`no identity on ${base} yet — provisioning @${handle}`);
-    await agent.bootstrap({ handle, name: handle, kind: 'person' });
+    await agent.bootstrap({ handle, name: handle, kind: 'person', root: cred.root });
     if (autoAcceptFollows) {
       agent.store.setConfig({ ...agent.store.getConfig(), autoAcceptFollows: true });
       await agent.store.flush();
@@ -342,15 +343,31 @@ export async function startEmbeddedAgent({
   // speaks, the write API, nodeinfo, and behind the door the admin routes and
   // the web client. Same code the standalone agent serves, minus the routes
   // that only mean something to a process of one's own.
+  //
+  // A pod that lives on a PATH of its host (a suffix pod, e.g.
+  // https://server.example/aisha/) shares its origin with the front and with
+  // every other suffix pod, so its whole surface answers UNDER that path: the
+  // mount is the pod's own pathname, and it is stripped before a route is
+  // matched and folded back into every self-URL. A host-root or subdomain pod
+  // has an empty mount and everything is exactly as it was.
   const authorities = new FixedAuthorities(base);
   agent.authorities = authorities;
+  const mount = new URL(base).pathname.replace(/\/+$/u, '');
   const surface = buildAdminSurface({
     agent,
     log,
-    gate: makeGate(gateToken, { secureCookie: authorities.secure }),
+    // The door cookie is named the same for every identity; on a shared origin
+    // (suffix pods) it has to be scoped to this identity's own door path so two
+    // co-tenants do not overwrite each other's. A host-root/subdomain pod keeps
+    // the whole-origin cookie it always had.
+    gate: makeGate(gateToken, {
+      secureCookie: authorities.secure,
+      cookiePath: mount ? mount + uiPath : '/',
+    }),
     allowed: authorities,
     embedded: true,
     basePath: uiPath,
+    mount,
     publicOrigin: base,
     scheme: new URL(base).protocol,
   });
@@ -399,7 +416,7 @@ export async function startEmbeddedAgent({
   // podHome and actorUrl are the identity's own locations on the pod. They are
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
-    agent, handle, home, surface, host: authorities.host,
+    agent, handle, home, surface, host: authorities.host, mount,
     podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -27,7 +27,7 @@
     "cli.md",
     "groups.md",
     "architecture.svg",
-    "installed-agent.md",
+    "device-agent.md",
     "architecture.md",
     "gateway.md",
     "browser.svg"

package/run-agent.mjs

@@ -1,6 +1,6 @@
 // run-agent.mjs — fedipod: a standalone single-actor ActivityPub
 // agent. The remote pod is a RELAY: it serves the public wire face
-// (/activitypods-js/ap/) and buffers inbound mail in a public-append inbox
+// (/fedipod/ap/) and buffers inbound mail in a public-append inbox
 // while this process is off, and it keeps one private document, the lease,
 // because a lock only one machine can reach coordinates nothing.
 //
@@ -37,6 +37,7 @@ import { RemotePod } from './lib/device/remote.mjs';
 import { Deliverer } from './lib/core/deliver.mjs';
 import { Publisher } from './lib/core/publisher/index.mjs';
 import { Intake } from './lib/core/intake/index.mjs';
+import { C2S } from './lib/client/c2s.mjs';
 import { TagFeed } from './lib/connections/tagfeed.mjs';
 import { ImportWorker } from './lib/connections/import.mjs';
 import { Atproto } from './lib/connections/atproto.mjs';
@@ -122,6 +123,7 @@ export class Agent {
       update: this.updateInfo || null,
       inboxCooldownFor: this.intake?.drainCooldownUntil
         ? Math.max(0, Math.round((this.intake.drainCooldownUntil - Date.now()) / 1000)) : 0,
+      stateSkipped: this.store.lastSkipped || [],
     };
   }
 
@@ -336,11 +338,15 @@ export class Agent {
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
+    // The dispatcher the admin surface also builds; this one is for what the
+    // Gateway's outbox door took on the owner's behalf and the drain finds.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config, urls: this.urls, remote: this.remote, store: this.store,
       deliverer: this.deliverer, publisher: this.publisher, log: this.log, lease: this.lease,
       archive: this.privateStorage(cred, 'archive'),
       push: !this.embedded, pollSeconds: this.pollSeconds || null,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The CSV-import worker: paced, resumable, armed only while active.
     this.importer?.stop();
@@ -514,6 +520,9 @@ export class Agent {
     this.viewer = false;
     clearInterval(this.refreshTimer);
     if (promoted) await this.refreshBeforeActing();
+    // Own posts the outbox names and the timeline index lacks come back here,
+    // before anything acts on the index.
+    await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();

package/scripts/refresh-contexts.mjs

@@ -24,13 +24,18 @@ for (const m of module_.matchAll(/"([^"]+)":\s*(\w+),/gu)) {
   if (idents[m[2]]) map[m[1]] = idents[m[2]];
 }
 
+// Held beside fedify's set, not from it: fetched once by hand and kept.
+const EXTRA = { 'http://www.w3.org/ns/anno.jsonld': 'anno.json' };
+
 for (const file of Object.values(map)) fs.copyFileSync(path.join(src, file), path.join(dest, file));
+Object.assign(map, EXTRA);
 fs.writeFileSync(path.join(dest, 'map.json'), `${JSON.stringify(map, null, 2)}\n`);
 
 const names = Object.fromEntries(Object.keys(map).map((u, i) => [u, `ctx${i}`]));
 const header = fs.readFileSync(path.join(dest, 'index.mjs'), 'utf8').split('\nimport ')[0];
 let out = `${header}\n`;
 for (const [url, file] of Object.entries(map)) out += `import ${names[url]} from './${file}' with { type: 'json' };\n`;
+// (EXTRA entries ride along in `map` above, so index.mjs and map.json keep them.)
 out += '\n/** URL → the context document itself. Nothing outside this map is ever resolved. */\nexport const CONTEXTS = {\n';
 for (const url of Object.keys(map)) out += `  '${url}': ${names[url]},\n`;
 out += '};\n';

package/vendor/gate.cjs

@@ -85,7 +85,7 @@ function cookieValue(header, name) {
 // AP_ALLOWED_HOSTS has nothing but this token, so the gate has to be total.
 // `token` may be a function, resolved per request: an identity's secret can
 // rotate while the server runs, and the very next request sees the new one.
-function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false } = {}) {
+function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/' } = {}) {
   const tokenNow = () => (typeof token === 'function' ? token() : token);
   // gate(req, res) → true when the gate handled the response (caller stops).
   function gate(req, res) {
@@ -102,7 +102,10 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
       url.searchParams.delete(COOKIE);
       url.searchParams.delete('dk-bless');
       res.writeHead(302, {
-        'set-cookie': `${COOKIE}=${t}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`
+        // Path scopes the cookie to this identity's own door: on a shared
+        // origin (suffix pods) two co-tenants must not clobber each other's,
+        // and a whole-origin cookie would. Defaults to '/'.
+        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=31536000`
           + (secureCookie ? '; Secure' : ''),
         'location': url.pathname + url.search,
       });

package/web/admin/index.html

@@ -275,6 +275,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 
 <section id="pane-identity" hidden>
   <dl id="facts"></dl>
+  <!-- State documents the agent could not read on its last load, if any. -->
+  <p class="err" id="state-skipped" role="alert" hidden></p>
   <!-- Declared here, and render() puts these on the kind row — the row they
        belong to is generated, so this is the only place they can be written
        down. Each reads as the setting it would change, so what it shows IS the

package/web/admin/upkeep.js

@@ -145,8 +145,16 @@ const INBOX_PROMPT_AT = 500;
 let dismissed = false;
 
 async function renderInbox() {
-  if (dismissed) return;
   const { json: st } = await api('/status');
+  // A state document the last load could not read is a timeline or a contact
+  // list quietly missing; the page says which, under the facts.
+  const skipped = st?.stateSkipped || [];
+  const line = $('state-skipped');
+  line.hidden = !skipped.length;
+  line.textContent = skipped.length
+    ? `${skipped.length} state document${skipped.length === 1 ? '' : 's'} could not be read on the last load: ${skipped.join(', ')}.`
+    : '';
+  if (dismissed) return;
   const box = st?.inbox;
   const panel = $('pane-inbox');
   if (!box || box.count < INBOX_PROMPT_AT) { panel.hidden = true; return; }

package/web/app/README.md

@@ -7,7 +7,7 @@ See `claude/plans/browser-agent.md` for the whole design and status.
 |---|---|
 | `pod-auth.mjs` | The pod side of sign-in, browser-native: create a CSS account + pod, mint a client credential, and a DPoP-bound `fetch` that writes to the pod. The twin of `lib/device/account.mjs` + `vendor/idp-grant.cjs`. |
 | `keystore.mjs` | WebCrypto RSA/Ed25519 key generation, and wrapping the keys under the account password (PBKDF2-SHA256 + AES-GCM-256). The pod holds only the wrapped form, so the pod's host cannot sign as you. |
-| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. |
+| `keys-browser.mjs` | Importing a keys record for signing, and finding one: this browser's opened copy in IndexedDB first, else the pod's. A wrapped one the browser has not opened yet raises `KeyPasswordNeeded`, which `boot.mjs` answers with the unlock pane — once per browser. The same pane offers a new key wrapped under the password used now, for someone who no longer has the sign-up password. |
 | `signup.mjs` | The `fedipod setup` flow, in the browser, up to publish: account, pod, credential, keys locked on the pod (owner-only ACL written *before* the key). Produces the credential/keys/config shapes the agent already reads. |
 | `shims/fedify-sig.mjs` | Browser stand-in for `@fedify/fedify/sig` (which will not bundle for a browser). `sign()` returns signed headers as data for the relay; `signRequest()` wraps it Fedify-shaped. Proven byte-identical to Fedify. |
 | `shims/node-crypto.mjs` | Browser stand-in for `node:crypto` — the small synchronous slice the agent uses, via crypto-browserify, plus native WebCrypto. |