fedipod 1.7.0 → 1.10.0

package/lib/core/publisher/notes.mjs

@@ -83,6 +83,45 @@ export async function mentionsFor(publisher, content, inReplyTo) {
   return mentions;
 }
 
+// Who a reply is answering. Their server gets the post whether or not the
+// text names them — that is how the thread stays whole where they are — but
+// no Mention tag is added, so a handle the author trimmed out still means no
+// notification. Nothing for a direct post: it goes to whom it names. The
+// parent is read from the timeline row; a parent the agent never held (a
+// client-to-server reply to any address) is fetched to find its author.
+export async function replyTarget(publisher, inReplyTo, mentions = [], visibility = 'public') {
+  if (!inReplyTo || visibility === 'direct' || !publisher.resolveActor) return null;
+  const parent = publisher.store.getStatuses().find(s => s.noteId === inReplyTo);
+  let actor = parent?.actor || null;
+  if (!parent) {
+    const doc = await publisher.resolveActor(inReplyTo).catch(() => null);
+    const by = doc?.attributedTo;
+    actor = typeof by === 'string' ? by : (Array.isArray(by) ? by[0] : by)?.id || null;
+    if (typeof actor === 'object') actor = actor?.id || null;
+  }
+  if (!actor || actor === publisher.urls.actor) return null;
+  if (mentions.some(m => m.actor === actor)) return null;
+  if (publisher.store.isBlocked?.(actor)) return null;
+  const doc = await publisher.resolveActor(actor).catch(() => null);
+  const inbox = doc?.endpoints?.sharedInbox || doc?.inbox || null;
+  if (!inbox) publisher.log(`reply: no inbox found for ${actor} — they get it only through followers`);
+  return { actor, inbox };
+}
+
+// Inboxes for actors a client addressed by id — the people in a post's
+// to/cc and the ones in bto/bcc, who are delivered to and never listed.
+export async function inboxesFor(publisher, actorIds = []) {
+  const out = [];
+  for (const id of [...new Set(actorIds.filter(a => typeof a === 'string' && a && a !== publisher.urls.actor))]) {
+    if (!publisher.resolveActor) break;
+    const doc = await publisher.resolveActor(id).catch(() => null);
+    const inbox = doc?.endpoints?.sharedInbox || doc?.inbox;
+    if (inbox) out.push(inbox);
+    else publisher.log(`addressed actor ${id} has no inbox the agent can find — not delivered to`);
+  }
+  return out;
+}
+
 // A direct post goes only to the people it names, so one that names nobody
 // the agent can find would be kept in the private container and delivered
 // to no one, with nothing said. Refused instead, before anything is written,
@@ -99,7 +138,28 @@ export function assertDirectAddressed(content, mentions) {
   throw e;
 }
 
-export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
+// A client may name the document it is creating (the Slug of a client-to-server
+// POST). Only a plain name is taken, and only when nothing is there already;
+// otherwise the agent mints one as it always has.
+const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
+export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
+async function slugFor(publisher, container, wanted, published) {
+  const name = safeSlug(wanted);
+  if (name && !(await podNotes.read(publisher.remote, container + name).catch(() => null))) return name;
+  return published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+}
+
+// What the author's own timeline shows for an object: its content, else its
+// text under one of the names other vocabularies use, else a link to it.
+export function rowContent(obj) {
+  if (typeof obj?.content === 'string' && obj.content.trim()) return wire.sanitizeHtml(obj.content);
+  const plain = [obj?.bodyValue, obj?.name, obj?.summary].find((v) => typeof v === 'string' && v.trim());
+  if (plain) return wire.contentHtml(plain);
+  const esc = (v) => String(v).replace(/[&<>"]/gu, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  return `<p><a href="${esc(obj?.id || '')}">${esc(obj?.type || 'object')}</a></p>`;
+}
+
+export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null, sensitive = false, slug: wanted = null, also = [], deliverTo = [] } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -107,11 +167,14 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     if (ready !== true) throw new Error(ready);
   }
   const published = new Date().toISOString();
-  const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+  const slug = await slugFor(publisher, priv ? urls.privateNotes : urls.notes, wanted, published);
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
-    visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
+    visibility, summary: spoilerText, sensitive, container: priv ? urls.privateNotes : urls.notes,
+    also: [...also, ...(reply ? [reply.actor] : [])] });
+  const addressedInboxes = await inboxesFor(publisher, [...also, ...deliverTo]);
 
   await podNotes.write(publisher.remote, note.id, note);
   // Empty, but present: a dangling `replies` that 404s is worse than none.
@@ -124,9 +187,15 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     noteId: note.id, actor: urls.actor, content: note.content, published, inReplyTo,
     kind: 'post', slug, text: content, visibility,
     ...(spoilerText ? { spoiler: spoilerText } : {}),
+    ...(note.sensitive ? { sensitive: true } : {}),
     ...(attachments?.length ? { attachments } : {}),
-    ...(note.tag?.length ? { mentions: note.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    ...rowTags(note),
   });
+  // The row is what the author's own timeline reads. Land it before answering
+  // — the same PUT the debounce would send in 300 ms — so a worker killed or a
+  // write refused after the answer cannot leave a post that stands on the pod
+  // and reached followers but never shows to its author.
+  if (await publisher.store.commit?.() === false) publisher.log(`post published but its timeline row was refused: ${note.id}`);
 
   const create = wire.createActivity(note, urls);
   // Published as its own document: a group that carries this post wraps the
@@ -138,6 +207,8 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const inboxes = [...new Set([
     ...(visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
+    reply?.inbox,
+    ...addressedInboxes,
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, create);
   publisher.log(`note published: ${note.id} → ${inboxes.length} inbox(es)`);
@@ -164,7 +235,78 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
 // edit's own stamp. The pod documents are overwritten in place — the Create
 // too, so a group's Announce resolves to the edited text — and an Update
 // goes everywhere the Create went.
-export async function updateNote(publisher, s, { content, spoilerText = null, attachments = null } = {}) {
+// Any object as a post: what a client-to-server Create carries when it is not
+// a Note or a Question — a Web Annotation, say. Stored as sent, with its own
+// context, under this actor; the Create around it is what followers receive.
+// Servers that know the type show it; the rest ignore it, which is the
+// expected outcome.
+//
+// An object already living on this pod (an id under it) is not copied: the
+// Create names it where it is. Anything else is written into the notes
+// container under the client's slug when it is free, else a minted one.
+export async function publishObject(publisher, object, { visibility = 'public', slug: wanted = null, also = [], deliverTo = [] } = {}) {
+  const { urls } = publisher;
+  const priv = visibility === 'private' || visibility === 'direct';
+  if (priv) {
+    const ready = await publisher.privateReady();
+    if (ready !== true) throw new Error(ready);
+  }
+  const published = new Date().toISOString();
+  const container = priv ? urls.privateNotes : urls.notes;
+  const pod = publisher.config?.remotePod || urls.base;
+  const ownId = typeof object.id === 'string' && /^https?:\/\//u.test(object.id) && object.id.startsWith(pod)
+    ? object.id : null;
+  const name = await slugFor(publisher, container, wanted, published);
+  const addressed = wire.addressing(urls, visibility, visibility === 'direct' ? also : []);
+  if (visibility !== 'direct') addressed.cc = [...new Set([...addressed.cc, ...also])];
+  let doc = null;
+  const id = ownId || container + name;
+  if (!ownId) {
+    // bto and bcc are for delivery alone: they never appear in what is
+    // stored, served or sent (ActivityPub §6).
+    const { bto, bcc, ...sent } = object;   // eslint-disable-line no-unused-vars
+    doc = { ...sent, id, attributedTo: urls.actor, published: object.published || published, to: addressed.to, cc: addressed.cc };
+    if (!doc['@context']) doc['@context'] = wire.AS_CTX;
+    if (typeof doc.content === 'string') doc.content = wire.sanitizeHtml(doc.content);
+    await podNotes.write(publisher.remote, id, doc);
+  }
+  if (!priv) await publisher.recordOutbox(id);
+  const row = doc || object;
+  publisher.store.addStatus({
+    noteId: id, actor: urls.actor, content: rowContent(row), published: row.published || published,
+    kind: 'post', slug: name, visibility,
+  });
+  if (await publisher.store.commit?.() === false) publisher.log(`object published but its timeline row was refused: ${id}`);
+
+  // The Create sits beside the object; for an object living elsewhere on the
+  // pod it sits in the notes container, whose ACL is public Read.
+  const createId = doc ? wire.createActivityId(id) : wire.createActivityId(container + name);
+  const create = {
+    '@context': wire.AS_CTX, id: createId, type: 'Create', actor: urls.actor,
+    published: row.published || published, to: addressed.to, cc: addressed.cc,
+    object: doc || id,
+  };
+  await podNotes.writeCreate(publisher.remote, create.id, create);
+  const contacts = publisher.store.getContacts();
+  const inboxes = [...new Set([
+    ...(visibility === 'direct' ? [] : contacts.followers.map((f) => f.sharedInbox || f.inbox)),
+    ...(await inboxesFor(publisher, [...also, ...deliverTo])),
+  ].filter(Boolean))];
+  await publisher.deliverer.deliverToAll(inboxes, create);
+  publisher.log(`${row.type || 'object'} published: ${id} → ${inboxes.length} inbox(es)`);
+  return { id, createId, copied: !ownId };
+}
+
+// What the author's timeline row keeps of a note's tags: the people it
+// mentions and the hashtags it carries, each as the client-facing shape.
+export function rowTags(note) {
+  const tags = [].concat(note.tag || []);
+  const mentions = tags.filter(t => t.type === 'Mention').map(t => ({ href: t.href, name: t.name }));
+  const hashtags = tags.filter(t => t.type === 'Hashtag').map(t => ({ name: String(t.name).replace(/^#/, ''), url: t.href }));
+  return { ...(mentions.length ? { mentions } : {}), ...(hashtags.length ? { tags: hashtags } : {}) };
+}
+
+export async function updateNote(publisher, s, { content, spoilerText = null, sensitive = null, attachments = null } = {}) {
   const { urls } = publisher;
   const updated = new Date().toISOString();
   const inText = new Set(wire.mentionsIn(content));
@@ -180,24 +322,29 @@ export async function updateNote(publisher, s, { content, spoilerText = null, at
   // post may carry no slug, but the note id already contains it.
   const container = String(s.noteId).startsWith(urls.privateNotes) ? urls.privateNotes : urls.notes;
   const slug = s.slug || String(s.noteId).slice(container.length);
+  const reply = await replyTarget(publisher, s.inReplyTo, mentions, s.visibility || 'public');
   const note = wire.noteDoc({
     urls, slug, content, published: s.published, inReplyTo: s.inReplyTo,
     attachments: atts, mentions, visibility: s.visibility || 'public',
-    summary: spoilerText, updated, container,
+    summary: spoilerText, sensitive: sensitive ?? !!s.sensitive, updated, container,
+    also: reply ? [reply.actor] : [],
   });
   await podNotes.write(publisher.remote, note.id, note);
   await podNotes.writeCreate(publisher.remote, wire.createActivityId(note.id), wire.createActivity(note, urls));
   const patched = publisher.store.updateStatus(s.noteId, {
     content: note.content, text: content, editedAt: updated,
     spoiler: spoilerText || undefined,
+    sensitive: note.sensitive || undefined,
     attachments: atts.length ? atts : undefined,
-    mentions: note.tag?.length ? note.tag.map(t => ({ href: t.href, name: t.name })) : undefined,
+    mentions: rowTags(note).mentions,
+    tags: rowTags(note).tags,
   });
   const update = wire.updateActivity(note, urls);
   const contacts = publisher.store.getContacts();
   const inboxes = [...new Set([
     ...(s.visibility === 'direct' ? [] : contacts.followers.map(f => f.sharedInbox || f.inbox)),
     ...mentions.map(m => m.inbox),
+    reply?.inbox,
   ].filter(Boolean))];
   await publisher.deliverer.deliverToAll(inboxes, update);
   publisher.log(`note edited: ${note.id} → ${inboxes.length} inbox(es)`);

package/lib/core/publisher/questions.mjs

@@ -9,7 +9,7 @@ import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
 import * as polls from '../polls.mjs';
 import * as podNotes from '../../pod/notes.mjs';
-import { assertDirectAddressed } from './notes.mjs';
+import { assertDirectAddressed, replyTarget, rowTags } from './notes.mjs';
 
 // How long a poll gathers votes before its Question is rewritten. Every vote
 // changes a number other servers re-read, and rewriting per vote would make a
@@ -22,7 +22,7 @@ const POLL_REWRITE_MS = 10_000;
  * voter pick more than one, and `expiresAt` is when voting stops.
  */
 export async function publishQuestion(publisher, content, { options = [], multiple = false, expiresAt = null,
-  inReplyTo = undefined, visibility = 'public', spoilerText = null } = {}) {
+  inReplyTo = undefined, visibility = 'public', spoilerText = null, sensitive = false } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
   if (priv) {
@@ -54,6 +54,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
   const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
   const mentions = await publisher._mentionsFor(content, inReplyTo);
   if (visibility === 'direct') assertDirectAddressed(content, mentions);
+  const reply = await replyTarget(publisher, inReplyTo, mentions, visibility);
   const poll = {
     multiple: !!multiple,
     expiresAt: expiresAt || null,
@@ -62,11 +63,11 @@ export async function publishQuestion(publisher, content, { options = [], multip
     votersCount: 0,
     // Resolved once, here: a tally rewrite must not cost a webfinger lookup
     // per vote for people the poll named.
-    mentionInboxes: [...new Set(mentions.map(m => m.inbox).filter(Boolean))],
+    mentionInboxes: [...new Set([...mentions.map(m => m.inbox), reply?.inbox].filter(Boolean))],
   };
   const question = wire.questionDoc({
     urls, slug, content, published, inReplyTo, attachments: [], mentions,
-    visibility, summary: spoilerText,
+    visibility, summary: spoilerText, sensitive, also: reply ? [reply.actor] : [],
     container: priv ? urls.privateNotes : urls.notes,
     options: poll.options, multiple: poll.multiple, endTime: poll.expiresAt, votersCount: 0,
   });
@@ -79,9 +80,12 @@ export async function publishQuestion(publisher, content, { options = [], multip
   publisher.store.addStatus({
     noteId: question.id, actor: urls.actor, content: question.content, published,
     kind: 'post', slug, text: content, visibility, poll, inReplyTo,
+    ...(reply ? { replyActor: reply.actor } : {}),
     ...(spoilerText ? { spoiler: spoilerText } : {}),
-    ...(question.tag?.length ? { mentions: question.tag.map(t => ({ href: t.href, name: t.name })) } : {}),
+    ...(question.sensitive ? { sensitive: true } : {}),
+    ...rowTags(question),
   });
+  if (await publisher.store.commit?.() === false) publisher.log(`poll published but its timeline row was refused: ${question.id}`);
 
   const create = publisher._pollActivity('Create', question, wire.createActivityId(question.id));
   await podNotes.writeCreate(publisher.remote, create.id, create);
@@ -163,8 +167,8 @@ export async function republishPoll(publisher, questionId, { closing = null } =
   }));
   const question = wire.questionDoc({
     urls, slug, content: s.text ?? '', published: s.published, inReplyTo: s.inReplyTo,
-    attachments: [], mentions,
-    visibility: s.visibility || 'public', summary: s.spoiler || null, container,
+    attachments: [], mentions, also: s.replyActor ? [s.replyActor] : [],
+    visibility: s.visibility || 'public', summary: s.spoiler || null, sensitive: !!s.sensitive, container,
     options: poll.options, multiple: !!poll.multiple, endTime: poll.expiresAt,
     closed: poll.closed, votersCount: poll.votersCount || 0,
   });

package/lib/core/publisher/restore.mjs

@@ -5,6 +5,7 @@
 import * as wire from '../wire.mjs';
 import * as podNotes from '../../pod/notes.mjs';
 import { readLenient } from '../as2.mjs';
+import { rowContent } from './notes.mjs';
 
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 const REBUILD_MAX_PER_RUN = 200;
@@ -151,13 +152,14 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     if (have.has(id) || removed.has(id)) continue;
     budget--;
     const note = await podNotes.read(publisher.remote, id).catch(() => null);
-    if (note?.type !== 'Note' || note.id !== id || note.attributedTo !== urls.actor) continue;
+    // Any object of ours: a Note, a poll, or whatever a client posted.
+    if (!note?.type || note.id !== id || note.attributedTo !== urls.actor) continue;
     const attachments = wire.attachmentsOf(note);
     const mentions = (Array.isArray(note.tag) ? note.tag : [])
       .filter(t => t?.type === 'Mention' && t.href)
       .map(t => ({ href: t.href, name: t.name }));
     recovered.push({
-      noteId: note.id, actor: urls.actor, content: note.content || '',
+      noteId: note.id, actor: urls.actor, content: rowContent(note),
       published: note.published || null,
       ...(note.inReplyTo ? { inReplyTo: note.inReplyTo } : {}),
       kind: 'post', slug: note.id.slice(urls.notes.length),
@@ -197,3 +199,26 @@ export async function rebuildStatuses(publisher, { fromNotes = false } = {}) {
     dropped: Math.max(0, merged.length - kept.length),
   };
 }
+
+// Own posts the outbox records and the statuses index does not.
+//
+// The index row is the last thing a post writes, and it goes by a debounced
+// PUT: a worker killed or a write refused after the post was answered leaves a
+// post that stands on the pod and reached followers but never shows on its
+// author's own timeline. Run when an agent becomes active. Cheap when nothing
+// is wrong — two cached documents compared, no request — and the capped,
+// merge-only rebuild when something is.
+export async function healStatuses(publisher) {
+  const { urls, store } = publisher;
+  const own = store.read('outbox.json', [])
+    .map(i => (typeof i === 'string' ? i : null))
+    .filter(id => id && id.startsWith(urls.notes));
+  if (!own.length) return { missing: 0, recovered: 0 };
+  const have = new Set(store.getStatuses().map(s => s.noteId));
+  const removed = new Set(store.read('outbox-removed.json', []).map(r => r.id));
+  const missing = own.filter(id => !have.has(id) && !removed.has(id));
+  if (!missing.length) return { missing: 0, recovered: 0 };
+  const r = await rebuildStatuses(publisher);
+  publisher.log(`timeline index healed: ${missing.length} own post(s) were missing, ${r.recovered} recovered`);
+  return { missing: missing.length, recovered: r.recovered };
+}

package/lib/core/social.mjs

@@ -204,6 +204,7 @@ export async function reblog(agent, s) {
   // missing entry, a failed status write would let a retry announce twice.
   const updated = agent.store.updateStatus(s.noteId, { reblogged: true, announceActivity: act });
   await agent.publisher.recordOutbox(act);
+  if (await agent.store.commit?.() === false) agent.log(`boost sent but its timeline row was refused: ${s.noteId}`);
   return updated;
 }
 

package/lib/core/store.mjs

@@ -74,6 +74,7 @@ export function dropFollower(contacts, actor, why) {
 
 export class PodStore {
   constructor({ storage = null, log = console.log } = {}) {
+    this.lastSkipped = [];        // what the last load could not read, as `name (HTTP n)`
     this.storage = storage;
     this.log = log;
     this.cache = new Map();        // name → parsed value
@@ -146,6 +147,9 @@ export class PodStore {
       try { this.cache.set(name, JSON.parse(r.body)); }
       catch (e) { this.log(`state load ${name}: unparsable (${e.message})`); }
     }
+    // Kept for /status: a document skipped here is a timeline or a contact
+    // list quietly missing, and the owner should be able to see that.
+    this.lastSkipped = skipped;
     if (skipped.length) this.log(`state load skipped ${skipped.length}: ${skipped.join(', ')}`);
     this.log(`state loaded: ${this.cache.size} doc(s) from ${this.base} (${fetched} re-fetched)`);
   }
@@ -410,6 +414,15 @@ export class PodStore {
   // — not from the pod, not from the RDF. Unverified entries are dropped first
   // now, so a flood can only ever evict itself, and a stranger's genuine
   // favourite still shows up, which is what recording them at all is for.
+  // What an Undo unsays: the favourite or boost it names, matched by a
+  // predicate on what was recorded. Returns how many went.
+  removeNotifications(pred) {
+    const all = this.getNotifications();
+    const kept = all.filter(n => !pred(n));
+    if (kept.length !== all.length) this.write('notifications.json', kept);
+    return all.length - kept.length;
+  }
+
   addNotification(n) {
     const all = this.getNotifications();
     const id = crypto.createHash('sha256').update(JSON.stringify(n)).digest('hex').slice(0, 16);

package/lib/core/wire.mjs

@@ -52,11 +52,14 @@ export function hostMeta(base) {
   return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
 }
 
-export function jrd({ handle, host, actor, aliases = [] }) {
+export function jrd({ handle, host, actor, aliases = [], page = null }) {
   return {
     subject: `acct:${handle}@${host}`,
     ...(aliases.length ? { aliases } : {}),
-    links: [{ rel: 'self', type: 'application/activity+json', href: actor }],
+    links: [
+      { rel: 'self', type: 'application/activity+json', href: actor },
+      ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+    ],
   };
 }
 
@@ -372,7 +375,7 @@ export function outboxPage(outboxId, n, items) {
     id: outboxPageId(outboxId, n),
     type: 'OrderedCollectionPage',
     partOf: outboxId,
-    orderedItems: items,
+    orderedItems: items.map(outboxWireItem),
     ...(n > 1 ? { next: outboxPageId(outboxId, n - 1) } : {}),
   };
 }
@@ -394,6 +397,13 @@ export function outboxPages(outbox) {
 
 export const outboxItemId = (i) => (typeof i === 'string' ? i : i?.id || null);
 
+// The outbox lists activities. A post is recorded by its object id, which is
+// what every local reader keys on, and published as the Create beside it — a
+// document of its own. An Announce is recorded and published whole.
+export const outboxWireItem = (i) => (typeof i === 'string' ? createActivityId(i) : i);
+export const outboxLocalItem = (i) =>
+  (typeof i === 'string' && i.endsWith('-create') ? i.slice(0, -'-create'.length) : i);
+
 // Assign entries to pages, and KEEP the assignment.
 //
 // Deriving the pages from position — which is what outboxPages does — makes an
@@ -589,10 +599,37 @@ export function mentionsIn(text) {
   return [...new Set(String(text).match(MENTION_RE) || [])].map(m => m.slice(1));
 }
 
+// #word in the text: letters, digits and underscores with at least one
+// letter, not glued to a word or a path (so a URL's fragment is not a tag).
+export const HASHTAG_RE = /(^|[^\/\w)])#([\p{L}\p{N}_]*[\p{L}_][\p{L}\p{N}_]*)/gu;
+
+export function hashtagsIn(text) {
+  const seen = new Map();
+  for (const m of String(text).matchAll(HASHTAG_RE)) {
+    const key = m[2].toLowerCase();
+    if (!seen.has(key)) seen.set(key, m[2]);
+  }
+  return [...seen.values()];
+}
+
+// Where a tag's link points: this actor's own page, asked for the tag. A
+// Hashtag's href must be a URL; the name is what servers file it under.
+export function tagHref(urls, name) {
+  return urls.profileHtml + '?tag=' + encodeURIComponent(String(name).toLowerCase());
+}
+
 // Escape first, then linkify: escaping cannot introduce an @handle, and the
 // anchors must survive it. A mention nobody could resolve stays plain text.
-export function contentHtml(text, mentions = []) {
+export function contentHtml(text, mentions = [], hashtags = []) {
   let html = String(text).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
+  if (hashtags.length) {
+    const byName = new Map(hashtags.filter(h => h?.name && h?.href).map(h => [h.name.toLowerCase(), h.href]));
+    html = html.replace(HASHTAG_RE, (all, lead, name) => {
+      const href = byName.get(name.toLowerCase());
+      if (!href) return all;
+      return `${lead}<a href="${String(href).replace(/[&<>"]/g, c => (HTML_ESCAPES[c] || '&quot;'))}" class="mention hashtag" rel="tag">#<span>${name}</span></a>`;
+    });
+  }
   for (const m of mentions) {
     if (!m?.handle || !m?.actor) continue;
     // The anchor is for PEOPLE — the mentioned actor's advertised page when it
@@ -605,36 +642,50 @@ export function contentHtml(text, mentions = []) {
   return '<p>' + html.replace(/\n+/g, '</p><p>') + '</p>';
 }
 
-export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, updated = null, container = null }) {
-  const id = (container || urls.notes) + slug;
-  const who = mentions.map(m => m.actor);
-  // Mastodon's four shapes. Public and unlisted are world-readable; private
-  // (followers-only) and direct carry no Public address at all and belong in
-  // the owner-only container. Mastodon addresses mentions in cc (to, for a
-  // direct post) and will not notify anyone it does not find there or in the
-  // tags.
-  const addressing = {
+// Mastodon's four shapes. Public and unlisted are world-readable; private
+// (followers-only) and direct carry no Public address at all and belong in
+// the owner-only container. Mastodon addresses mentions in cc (to, for a
+// direct post) and will not notify anyone it does not find there or in the
+// tags.
+export function addressing(urls, visibility, who = []) {
+  return {
     public: { to: [PUBLIC], cc: [urls.followers, ...who] },
     unlisted: { to: [urls.followers], cc: [PUBLIC, ...who] },
     private: { to: [urls.followers], cc: who },
     direct: { to: who, cc: [] },
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
+}
+
+// `also`: actors addressed without being mentioned — the parent's author on
+// a reply. In cc but not in tag, so their server receives the post and does
+// not notify them. A direct post names its audience in the text alone.
+export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
+  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [] }) {
+  const id = (container || urls.notes) + slug;
+  const who = mentions.map(m => m.actor);
+  const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
+  const addressed = addressing(urls, visibility, [...who, ...extra]);
+  const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
   const note = {
     '@context': AS_CTX,
     id, type: 'Note',
     attributedTo: urls.actor,
-    content: contentHtml(content, mentions),
+    content: contentHtml(content, mentions, hashtags),
     published,
-    to: addressing.to,
-    cc: addressing.cc,
+    to: addressed.to,
+    cc: addressed.cc,
     replies: repliesId(id),
   };
   if (summary) note.summary = summary;      // the content warning
+  // A content warning is what a receiver hides behind; media marked
+  // sensitive without one is hidden the same way.
+  if (summary || sensitive) note.sensitive = true;
   if (updated) note.updated = updated;      // an edit's own stamp
-  if (mentions.length) {
-    note.tag = mentions.map(m => ({ type: 'Mention', href: m.actor, name: '@' + m.handle }));
-  }
+  const tag = [
+    ...mentions.map(m => ({ type: 'Mention', href: m.actor, name: '@' + m.handle })),
+    ...hashtags.map(h => ({ type: 'Hashtag', href: h.href, name: '#' + h.name })),
+  ];
+  if (tag.length) note.tag = tag;
   if (inReplyTo) note.inReplyTo = inReplyTo;
   if (attachments?.length) {
     note.attachment = attachments.map(a => ({

package/lib/device/admin/static.mjs

@@ -130,8 +130,8 @@ export function securityHeaders(auth, isHtml) {
   return h;
 }
 
-export function sendJson(res, status, obj, auth) {
-  res.writeHead(status, { 'content-type': 'application/json', ...securityHeaders(auth, false) });
+export function sendJson(res, status, obj, auth, contentType = 'application/json') {
+  res.writeHead(status, { 'content-type': contentType, ...securityHeaders(auth, false) });
   res.end(JSON.stringify(obj) + '\n');
 }
 

package/lib/device/admin/surface.mjs

@@ -181,6 +181,14 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
         return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}${mount}`));
       }
+      // The short address a person types: /@handle opens the profile page.
+      const at = /^\/@([^/]+)$/u.exec(p);
+      const ownHandle = handle || agent.store?.getConfig?.()?.handle || '';
+      if (at && ownHandle && agent.publisher?.urls?.profileHtml
+        && decodeURIComponent(at[1]).toLowerCase() === String(ownHandle).toLowerCase()) {
+        res.writeHead(302, { location: agent.publisher.urls.profileHtml, 'cache-control': 'no-store' });
+        res.end(); return;
+      }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
         res.writeHead(200, { 'content-type': 'text/plain' }); res.end('OK'); return;
@@ -191,10 +199,11 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           `${req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http'}://${req.headers.host}${mount}/nodeinfo/2.0`));
       }
       if (p === '/nodeinfo/2.0') {
-        return json(res, 200, nodeinfoDoc({
+        // The schema's own media type, as the NodeInfo spec names it.
+        return sendJson(res, 200, nodeinfoDoc({
           version: AGENT_VERSION,
           localPosts: agent.store.countStatuses('post'),
-        }));
+        }), allowed, 'application/json; profile="http://nodeinfo.diaspora.software/ns/schema/2.0#"');
       }
       // A group serves the client too, as of 2026-08-01. It was withheld on the
       // reasoning that a group has no timeline a human reads — which was wrong