meta-sovereign 0.49.15 → 0.49.17

package/js/src/server/background-jobs.js

@@ -78,14 +78,17 @@ export const backgroundJobs = ({ ctx, store, log, later, backups }) => {
   });
   const purge = cachePurgeFor({ store, log, later });
   return {
+    // Returns a promise settled once a backup and the pulls in flight
+    // have finished.
     stopJobs: () => {
-      backup.stopBackups();
+      const backupDone = backup.stopBackups();
       audience.stopAudienceSync();
       purge.stopCachePurge();
       // The other timers and pollers the server started with the port.
       ctx.autoImport?.close();
       ctx.whatsappSignIn?.stop().catch(() => {});
-      ctx.stopPulls?.();
+      const pullsDone = ctx.stopPulls?.();
+      return Promise.all([backupDone, pullsDone]).then(() => {});
     },
   };
 };

package/js/src/server/backup-job.js

@@ -87,5 +87,6 @@ export const backupJobFor = ({ ctx, store, log, later, backups }) => {
       });
     });
   }
+  // Resolves once a backup in flight has finished (and pruned).
   return { stopBackups: () => scheduler?.stop() };
 };

package/js/src/server/index.js

@@ -40,6 +40,7 @@
  *   POST /api/email/send           -> local-server email send proxy
  *   GET  /api/email/attachment     -> a mail attachment from the media folder (routes-email.js)
  *   GET  /api/media/<network>/<sha256>[.ext] -> imported archive media (routes-media.js, R-Z15)
+ *   POST /api/archive/upload?source=&name= -> import an export file (routes-archive-upload.js)
  *   GET  /api/backups              -> list archives (gated on archiveDir)
  *   POST /api/backups              -> { passphrase?, keep? } -> { file }
  *   POST /api/backups/restore      -> { file, passphrase? } -> { restored }
@@ -97,6 +98,10 @@ import { handleTelegramRoutes } from './routes-telegram.js';
 import { handleMessageRoutes } from './routes-messages.js';
 import { handleEmailGets } from './routes-email.js';
 import { handleMediaGets } from './routes-media.js';
+import {
+  handleArchiveUpload,
+  UPLOAD_TIMEOUT_MS,
+} from './routes-archive-upload.js';
 import { createAttachmentStore } from './email-attachments.js';
 import {
   VK_CAPTCHA_HOSTS,
@@ -586,6 +591,7 @@ const routeOn = async (store, req, res, ctx, url, p) => {
     () => ctx.clientLog?.(req, res, p, ctx) ?? false,
     () => handleAutoImportRoutes(store, req, res, p, ctx),
     () => handleWhatsAppRoutes(store, req, res, p, ctx),
+    () => handleArchiveUpload(store, req, res, p, ctx),
     () => handlePullRoutes(store, req, res, p, ctx),
     () => handleTelegramRoutes(req, res, p, ctx),
     () => handleMessageRoutes(store, req, res, p, url, ctx),
@@ -659,7 +665,9 @@ const initStore = async ({
 // The HTTP server: each request is logged, and routed (./account-scope.js
 // picks the Telegram account it is for).
 const createHttpServer = (store, ctx, log) =>
-  http.createServer((req, res) => {
+  // A big export uploaded over Wi-Fi takes longer than Node's default 5
+  // minutes to arrive (R-Z23); headers still time out at Node's 60 s.
+  http.createServer({ requestTimeout: UPLOAD_TIMEOUT_MS }, (req, res) => {
     const start = Date.now();
     res.on('finish', () => {
       log?.({
@@ -916,13 +924,13 @@ export const startServer = async ({
         bus?.close();
         ctx.replies.close().catch(() => {});
         ctx.closeAutomations().catch(() => {});
-        ctx.stopJobs();
+        const jobsDone = ctx.stopJobs();
         ctx.chatIndex.close();
         stopAll(telegramAccount, ctx.telegramAccounts, ctx.telegramExtras);
         wsHandle?.close();
         signaling?.close();
         closeFront();
-        server.close(() => resolve());
+        server.close(() => Promise.resolve(jobsDone).then(resolve, resolve));
         for (const socket of sockets) {
           socket.destroy();
         }

package/js/src/server/routes-archive-upload.js

@@ -0,0 +1,220 @@
+/**
+ * Archive uploads (R-Z23):
+ *   POST /api/archive/upload?source=<network>&name=<file name>
+ *        (application/octet-stream body: the file's bytes)
+ *     -> { ok, imported, files: [{ name, imported, error? }], media?, chat? }
+ *
+ * The page's import box sends an export it was given (a Facebook, X,
+ * LinkedIn or WhatsApp .zip, a Telegram result.json, ...) here. The bytes
+ * are streamed to a private temp folder in the store (never held in
+ * memory, never base64, no fixed size cap) and read by the same importer
+ * as auto-import (../sources/auto-import/files.js: a zip is opened in
+ * place, media copied to `<store>/media/<network>/`); a WhatsApp export
+ * keeps its own importer (../sources/whatsapp-file.js), which copies the
+ * attachments its chat names. The temp file is removed afterwards, and
+ * leftovers of a crash are swept on the next upload.
+ *
+ * Not JSON, so not isTrustedMutation's check: its own, as for the Telegram
+ * upload — the bytes' type is not one a form on another site can send
+ * without asking first (CORS), and another site's page is refused. A disk
+ * without room for the file twice over (the file and what it becomes)
+ * is refused before anything is written (507).
+ */
+
+import { createWriteStream, promises as fs } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import path from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { json } from './util.js';
+import { classifyOrigin } from './cors.js';
+import { safeMessage } from './redact.js';
+import { enoughSpace } from '../storage/disk-space.js';
+import { ensurePrivateDir } from '../storage/durable.js';
+import { autoImportRecipes } from '../sources/auto-import/recipes.js';
+import { importDownloadedFile } from '../sources/auto-import/files.js';
+import { importWhatsAppPath } from '../sources/whatsapp-file.js';
+import { isFatalWrite } from '../sources/archive/context.js';
+
+export const ARCHIVE_UPLOAD_ROUTE = '/api/archive/upload';
+const UPLOADS = 'uploads';
+// A temp folder this old is a crashed upload's: no request lives that long.
+const STALE_MS = 6 * 60 * 60_000;
+/** How long a request may take to arrive (the server's `requestTimeout`). */
+export const UPLOAD_TIMEOUT_MS = 3 * 60 * 60_000;
+
+const reply = (res, status, body) =>
+  json(res, status, { ok: status < 400, ...body }) ?? true;
+
+// Refused before the body was read: drain it so the socket stays usable.
+const refuse = (req, res, status, code, error) => {
+  req.resume();
+  return reply(res, status, { error, code });
+};
+
+/** A plain file name: no folders or control characters, at most 200 long. */
+export const uploadName = (raw) => {
+  const base = path.posix.basename(String(raw ?? '').replace(/\\/g, '/'));
+  const clean = [...base]
+    .filter((ch) => ch.charCodeAt(0) >= 0x20 && ch.charCodeAt(0) !== 0x7f)
+    .join('')
+    .slice(-200);
+  return clean && clean !== '.' && clean !== '..' ? clean : 'archive';
+};
+
+const sweepStale = async (root, now = Date.now()) => {
+  for (const name of await fs.readdir(root).catch(() => [])) {
+    const dir = path.join(root, name);
+    const stat = await fs.stat(dir).catch(() => null);
+    if (stat?.isDirectory() && now - stat.mtimeMs > STALE_MS) {
+      await fs.rm(dir, { recursive: true, force: true }).catch(() => {});
+    }
+  }
+};
+
+const importUploaded = async (store, { source, name, file, mediaDir }) => {
+  if (source === 'whatsapp') {
+    const out = await importWhatsAppPath(store, name, file, { mediaDir });
+    return { ...out, files: [{ name, imported: out.imported }] };
+  }
+  const files = await importDownloadedFile({
+    store,
+    provider: source,
+    filePath: file,
+    mediaDir,
+  });
+  return {
+    imported: files.reduce((sum, row) => sum + (row.imported ?? 0), 0),
+    files,
+  };
+};
+
+// The answer's status: a full disk, a file with nothing to import, or done.
+const statusOf = (out) => {
+  if (out.files.some((row) => row.aborted)) {
+    return 507;
+  }
+  return out.imported === 0 && out.files.every((row) => row.error) ? 400 : 200;
+};
+
+const failed = (out) => {
+  const status = statusOf(out);
+  if (status === 200) {
+    return {};
+  }
+  const row = out.files.find((r) => r.error);
+  return {
+    error: row?.error ?? 'nothing to import',
+    code: status === 507 ? 'store-write-failed' : 'bad-archive',
+  };
+};
+
+const NOT_WHOLE = Object.freeze([
+  400,
+  { error: 'the file did not arrive whole; try again', code: 'upload-failed' },
+]);
+
+// The bytes to `file`, then the import: `[status, body]`.
+const importInto = async (req, ctx, file, { source, name, size }) => {
+  try {
+    await pipeline(req, createWriteStream(file, { flags: 'wx', mode: 0o600 }));
+  } catch {
+    return NOT_WHOLE;
+  }
+  if ((await fs.stat(file)).size !== size) {
+    return NOT_WHOLE;
+  }
+  try {
+    const out = await importUploaded(ctx.store, {
+      source,
+      name,
+      file,
+      mediaDir: path.join(ctx.storeDir, 'media'),
+    });
+    return [statusOf(out), { ...out, ...failed(out) }];
+  } catch (error) {
+    // A full or unwritable disk is not a bad file (R-Z14).
+    return isFatalWrite(error)
+      ? [507, { error: safeMessage(error), code: 'store-write-failed' }]
+      : [400, { error: safeMessage(error), code: 'bad-archive' }];
+  }
+};
+
+// The temp folder is gone before the answer is sent.
+const receive = async (req, res, ctx, wanted) => {
+  const root = path.join(ctx.storeDir, UPLOADS);
+  await ensurePrivateDir(root);
+  await sweepStale(root);
+  const dir = path.join(root, randomBytes(8).toString('hex'));
+  await ensurePrivateDir(dir);
+  let answer;
+  try {
+    answer = await importInto(req, ctx, path.join(dir, wanted.name), wanted);
+  } finally {
+    await fs.rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+  return reply(res, ...answer);
+};
+
+/** POST /api/archive/upload (see the header). */
+export const handleArchiveUpload = async (store, req, res, p, ctx) => {
+  if (p !== ARCHIVE_UPLOAD_ROUTE || req.method !== 'POST') {
+    return false;
+  }
+  const type = String(req.headers['content-type'] ?? '').toLowerCase();
+  if (
+    !type.startsWith('application/octet-stream') ||
+    classifyOrigin(req, ctx?.allowOrigins ?? []) === 'denied'
+  ) {
+    return refuse(
+      req,
+      res,
+      403,
+      'forbidden',
+      'archives are sent from the app only'
+    );
+  }
+  const query = new URL(req.url, 'http://local').searchParams;
+  const source = query.get('source') ?? '';
+  if (!Object.hasOwn(autoImportRecipes, source)) {
+    return refuse(
+      req,
+      res,
+      400,
+      'bad-source',
+      `no archive import for "${source}"`
+    );
+  }
+  if (!ctx?.storeDir) {
+    return refuse(
+      req,
+      res,
+      501,
+      'no-store',
+      'archive uploads need a store folder'
+    );
+  }
+  const size = Number(req.headers['content-length']);
+  if (!Number.isSafeInteger(size) || size <= 0) {
+    return refuse(req, res, 411, 'length-required', 'the file size is needed');
+  }
+  const space = await enoughSpace(ctx.storeDir, size * 2, ctx.diskFree);
+  if (!space.ok) {
+    return refuse(
+      req,
+      res,
+      507,
+      'low-disk',
+      `not enough free disk space for this file: about ${Math.ceil(space.needed / 1048576)} MB needed`
+    );
+  }
+  return receive(
+    req,
+    res,
+    { ...ctx, store },
+    {
+      source,
+      name: uploadName(query.get('name')),
+      size,
+    }
+  );
+};

package/js/src/server/routes-automations.js

@@ -199,6 +199,20 @@ const sendOnce = (ctx, draft, send) => {
   return promise;
 };
 
+// The network has it: a store that cannot take the copy (a full disk,
+// R-Z14) does not make it unsent — answering "failed" would invite a
+// second send. The sync brings the message once the store takes writes.
+const keepSent = async (store, links) => {
+  try {
+    for (const link of links) {
+      await store.put(link);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 const handleSend = async (store, res, body, ctx) => {
   if (!validChat(body) || !String(body.text ?? '').trim()) {
     return fail(res, 400, 'bad-message', 'source, chat and text are needed');
@@ -232,14 +246,13 @@ const handleSend = async (store, res, body, ctx) => {
     const sent = await sendOnce(ctx, draft, async () => {
       const result = await ctx.send(draft);
       const links = sentLinks(draft, result);
-      for (const link of links) {
-        await store.put(link);
-      }
+      const stored = await keepSent(store, links);
       return {
         status: 'sent',
         via: result?.via,
         link: links.at(-1) ?? null,
         links,
+        ...(stored ? {} : { stored: false }),
         ...(result?.scheduled ? { scheduled: true } : {}),
       };
     });

package/js/src/server/routes-pull.js

@@ -105,10 +105,8 @@ export const createPullServices = (store, log, options = {}, github = null) => {
       pullRunner.start();
       vkInbox.start();
     },
-    stop: () => {
-      pullRunner.stop();
-      vkInbox.stop();
-    },
+    // Resolves once the pulls in flight have stored what they fetched.
+    stop: () => Promise.all([vkInbox.stop(), pullRunner.stop()]).then(() => {}),
   };
 };
 

package/js/src/server/routes-telegram-contact-extras.js

@@ -0,0 +1,102 @@
+// Contact notes, share-my-contact links, phone links, photos for contacts,
+// suggested birthdays, synced contacts and blocking from Replies (R-Y217):
+// the routes of the POSTS table in routes-telegram.js, each validated
+// strictly before the account is asked.
+//
+// Its routes:
+//   POST /api/telegram/contact-note {chat, note} -> { ok, note } the private
+//                       note on a contact (at most 128 characters, "" clears)
+//   POST /api/telegram/contact-token {} -> { ok, url, expires } the link
+//                       t.me/contact/<token> to share the user's contact
+//   POST /api/telegram/contact-token-open {token} -> { ok, chat, name } the
+//                       person that link names
+//   POST /api/telegram/phone-resolve {phone} -> { ok, found, chat?, name? }
+//                       the person with that number (t.me/+<digits>)
+//   POST /api/telegram/contact-photo {chat, mode, token?} -> { ok, mode }
+//                       mode save (only the user sees it), suggest, or reset
+//                       (the personal photo removed; no token)
+//   POST /api/telegram/birthday-suggest {chat, day, month, year?} -> { ok }
+//   POST /api/telegram/saved-contacts {} -> { ok, count } the imported
+//                       contacts Telegram keeps
+//   POST /api/telegram/saved-contacts-reset {} -> { ok } those deleted
+//   POST /api/telegram/block-from-replies {msgId, deleteMessage?,
+//                       deleteHistory?, reportSpam?} -> { ok } the sender
+//                       of a message of the Replies chat blocked
+
+import { route } from './routes-telegram-admin-extras.js';
+import {
+  MODES,
+  NOTE_MAX,
+  PHONE_DIGITS,
+  TOKEN,
+  USER,
+  validMsgId,
+} from '../sources/telegram-contact-extras.js';
+
+const UPLOAD = /^[a-f0-9]{32}$/;
+const user = (b) => USER.test(String(b.chat ?? ''));
+const flag = (v) => v === undefined || typeof v === 'boolean';
+const always = () => true;
+
+export const CONTACT_EXTRAS_POSTS = {
+  'contact-note': route(
+    'contactNote',
+    'chat and note required',
+    (b) => user(b) && typeof b.note === 'string' && b.note.length <= NOTE_MAX,
+    (b) => ({ chat: String(b.chat), note: b.note })
+  ),
+  'contact-token': route('contactToken', 'unsupported', always, () => ({})),
+  'contact-token-open': route(
+    'contactTokenOpen',
+    'token required',
+    (b) => typeof b.token === 'string' && TOKEN.test(b.token),
+    (b) => ({ token: b.token })
+  ),
+  'phone-resolve': route(
+    'phoneResolve',
+    'phone required',
+    (b) =>
+      typeof b.phone === 'string' &&
+      PHONE_DIGITS.test(b.phone.replace(/^\+/, '')),
+    (b) => ({ phone: b.phone })
+  ),
+  'contact-photo': route(
+    'contactPhoto',
+    'chat, mode and token required',
+    (b) =>
+      user(b) &&
+      MODES.includes(b.mode) &&
+      (b.mode === 'reset'
+        ? b.token === undefined
+        : typeof b.token === 'string' && UPLOAD.test(b.token)),
+    (b) => ({ chat: String(b.chat), mode: b.mode, token: b.token })
+  ),
+  'birthday-suggest': route(
+    'birthdaySuggest',
+    'chat, day and month required',
+    (b) => user(b) && Number.isInteger(b.day) && Number.isInteger(b.month),
+    ({ chat, day, month, year }) => ({ chat: String(chat), day, month, year })
+  ),
+  'saved-contacts': route('savedContacts', 'unsupported', always, () => ({})),
+  'saved-contacts-reset': route(
+    'savedContactsReset',
+    'unsupported',
+    always,
+    () => ({})
+  ),
+  'block-from-replies': route(
+    'blockFromReplies',
+    'msgId required',
+    (b) =>
+      validMsgId(b.msgId) &&
+      flag(b.deleteMessage) &&
+      flag(b.deleteHistory) &&
+      flag(b.reportSpam),
+    ({ msgId, deleteMessage, deleteHistory, reportSpam }) => ({
+      msgId,
+      deleteMessage,
+      deleteHistory,
+      reportSpam,
+    })
+  ),
+};

package/js/src/server/routes-telegram-security-extras.js

@@ -0,0 +1,64 @@
+// More of Privacy and Security (R-Y218): the routes of the POSTS table in
+// routes-telegram.js, each validated strictly before the account is asked.
+// A code in a body is passed on and never kept.
+//
+// Its routes:
+//   POST /api/telegram/login-email-send {email} -> { ok, pattern, length }
+//   POST /api/telegram/login-email-verify {code} -> { ok, email }
+//   POST /api/telegram/recovery-request -> { ok, pattern } a code mailed to
+//                       the recovery email
+//   POST /api/telegram/recovery-confirm {code} -> { ok } the password gone
+//   POST /api/telegram/password-reset -> { ok, result: 'ok' | 'wait' |
+//                       'failed-wait', until }
+//   POST /api/telegram/password-reset-cancel -> { ok }
+//   POST /api/telegram/passkeys -> { ok, passkeys: [{ id, name, created,
+//                       lastUsed }] }
+//   POST /api/telegram/passkey-options -> { ok, options } WebAuthn JSON
+//   POST /api/telegram/passkey-register {id, rawId, clientData,
+//                       attestation} -> { ok, passkey } (base64url strings)
+//   POST /api/telegram/passkey-delete {id} -> { ok }
+//   POST /api/telegram/sign-in-codes -> { ok, codes } fresh codes from 777000
+//   POST /api/telegram/invalidate-codes {codes: ['12345']} -> { ok }
+
+import { route } from './routes-telegram-admin-extras.js';
+
+const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,255}$/;
+const CODE = /^[0-9A-Za-z]{1,16}$/;
+const str = (v, max) =>
+  typeof v === 'string' && v.length > 0 && v.length <= max;
+const nothing = () => true;
+const code = (b) => CODE.test(String(b.code ?? ''));
+
+export const SECURITY_EXTRAS_POSTS = {
+  'login-email-send': route('loginEmailSend', 'a valid email required', (b) =>
+    EMAIL.test(String(b.email ?? ''))
+  ),
+  'login-email-verify': route('loginEmailVerify', 'the code required', code),
+  'recovery-request': route('recoveryRequest', 'no body', nothing),
+  'recovery-confirm': route('recoveryConfirm', 'the code required', code),
+  'password-reset': route('passwordReset', 'no body', nothing),
+  'password-reset-cancel': route('passwordResetCancel', 'no body', nothing),
+  passkeys: route('passkeys', 'no body', nothing),
+  'passkey-options': route('passkeyOptions', 'no body', nothing),
+  'passkey-register': route(
+    'passkeyRegister',
+    'id, rawId, clientData and attestation required',
+    (b) =>
+      ['id', 'rawId', 'clientData', 'attestation'].every((k) =>
+        str(b[k], 100_000)
+      )
+  ),
+  'passkey-delete': route('passkeyDelete', 'the passkey id required', (b) =>
+    str(b.id, 1024)
+  ),
+  'sign-in-codes': route('signInCodes', 'no body', nothing),
+  'invalidate-codes': route(
+    'invalidateCodes',
+    'one to ten codes required',
+    (b) =>
+      Array.isArray(b.codes) &&
+      b.codes.length > 0 &&
+      b.codes.length <= 10 &&
+      b.codes.every((v) => /^\d{5,6}$/.test(String(v)))
+  ),
+};

package/js/src/server/routes-telegram.js

@@ -243,6 +243,7 @@ import { FOLDER_EDIT_POSTS } from './routes-telegram-folder-edit.js';
 import { CHATLIST_POSTS } from './routes-telegram-chatlists.js';
 import { STICKER_SETTINGS_POSTS } from './routes-telegram-sticker-settings.js';
 import { CHAT_THEME_POSTS } from './routes-telegram-chat-themes.js';
+import { CONTACT_EXTRAS_POSTS } from './routes-telegram-contact-extras.js';
 import { CLOUD_THEME_POSTS } from './routes-telegram-cloud-themes.js';
 import { COMMON_CHATS_POSTS } from './routes-telegram-common-chats.js';
 import { STATS_POSTS } from './routes-telegram-stats.js';
@@ -267,6 +268,7 @@ import { EMOJI_STATUS_POSTS } from './routes-telegram-emoji-status.js';
 import { ROUND_POSTS } from './routes-telegram-round.js';
 import { PRIVACY_POSTS } from './routes-telegram-privacy.js';
 import { SECURITY_POSTS } from './routes-telegram-security.js';
+import { SECURITY_EXTRAS_POSTS } from './routes-telegram-security-extras.js';
 import { SHARE_POSTS } from './routes-telegram-share.js';
 import { INLINE_POSTS } from './routes-telegram-inline.js';
 import { MESSAGE_LINK_POSTS } from './routes-telegram-message-links.js';
@@ -1022,6 +1024,7 @@ const POSTS = {
   ...ADMIN_POSTS,
   ...EPHEMERAL_POSTS,
   ...YEXTRAS_POSTS,
+  ...CONTACT_EXTRAS_POSTS,
   ...GROUP_EXTRAS_POSTS,
   ...INSTANT_VIEW_POSTS,
   ...STICKER_EXTRAS_POSTS,
@@ -1071,6 +1074,7 @@ const POSTS = {
   ...ROUND_POSTS,
   ...PRIVACY_POSTS,
   ...SECURITY_POSTS,
+  ...SECURITY_EXTRAS_POSTS,
   ...SHARE_POSTS,
   ...INLINE_POSTS,
   ...TTL_POSTS,

package/js/src/sources/browser-sender.js

@@ -39,6 +39,7 @@ import { createAdapterSender } from '../crm/reengage.js';
 import { WEB_UIS } from './web-uis.js';
 import { createBrowserActions } from './browser-actions.js';
 import { createMessageActions } from './message-actions.js';
+import { markSendOutcome } from './http.js';
 
 const isNumericId = (value) => /^-?\d+$/.test(String(value));
 
@@ -227,16 +228,29 @@ const typeLines = async (commander, text, delayMs) => {
   }
 };
 
+// A failure while pressing Send may come after the press took effect: the
+// message may be out, so it is never retried or sent another way (R-Z4).
+const sentInDoubt = (error) =>
+  Object.assign(markSendOutcome(error, { ambiguous: true }), {
+    code: 'send-unknown',
+    outcome: 'unknown',
+    fallback: false,
+  });
+
 /** Click the send button when it is there, otherwise press the key. */
 const pressSend = async (ui, commander) => {
   const button = ui.send?.selector
     ? await firstMatch(commander, ui.send.selector)
     : null;
-  if (button) {
-    await commander.clickButton({ selector: button, scrollIntoView: true });
-    return;
+  try {
+    if (button) {
+      await commander.clickButton({ selector: button, scrollIntoView: true });
+      return;
+    }
+    await commander.pressKey({ key: ui.send?.key ?? 'Enter' });
+  } catch (error) {
+    throw sentInDoubt(error);
   }
-  await commander.pressKey({ key: ui.send?.key ?? 'Enter' });
 };
 
 /**
@@ -534,6 +548,22 @@ const markUnknown = (error) => {
   return error;
 };
 
+// What a failed web-UI send raises after the API failed with `apiError`.
+const browserFailure = (error, apiError, draft, action) => {
+  // "Not allowed to automate this" is the answer, not a pair of failures.
+  if (error?.code === 'unsupported') {
+    return error;
+  }
+  // Maybe delivered by the web UI: told as such, never "failed" (R-Z4).
+  if (!apiError || error?.ambiguous === true) {
+    return markUnknown(error);
+  }
+  return new SendFallbackError(
+    [apiError, error],
+    `${draft?.source}: ${action === 'send' ? 'sending' : action} failed through the API (${apiError.message}) and the web UI (${error.message})`
+  );
+};
+
 /**
  * API first, browser second.
  *
@@ -584,17 +614,7 @@ export const createFallbackSender =
         apiError ? { apiError: apiError.message } : {}
       );
     } catch (error) {
-      // "Not allowed to automate this" is the answer, not a pair of failures.
-      if (error?.code === 'unsupported') {
-        throw error;
-      }
-      if (!apiError) {
-        throw error;
-      }
-      throw new SendFallbackError(
-        [apiError, error],
-        `${draft?.source}: ${action === 'send' ? 'sending' : action} failed through the API (${apiError.message}) and the web UI (${error.message})`
-      );
+      throw browserFailure(error, apiError, draft, action);
     }
   };
 

package/js/src/sources/pull-runner.js

@@ -86,9 +86,12 @@ export const createPullRunner = ({
   const lastStart = new Map();
   const running = new Set();
   const timers = new Map();
+  // Runs in flight, so that `stop()` can be waited for: a server that
+  // closed mid-run would otherwise store the pull after its last flush.
+  const flights = new Set();
   let stopped = true;
 
-  const execute = async (source) => {
+  const runOnce = async (source) => {
     const job = jobs[source];
     running.add(source);
     lastStart.set(source, now());
@@ -115,6 +118,13 @@ export const createPullRunner = ({
     }
   };
 
+  const execute = (source) => {
+    const flight = runOnce(source);
+    flights.add(flight);
+    flight.finally(() => flights.delete(flight)).catch(() => {});
+    return flight;
+  };
+
   const fetchNow = async (source) => {
     const job = jobs[source];
     if (!job) {
@@ -181,12 +191,14 @@ export const createPullRunner = ({
         }
       }
     },
+    /** Stop the schedules; resolves once the runs in flight are done. */
     stop() {
       stopped = true;
       for (const timer of timers.values()) {
         clearTimer(timer);
       }
       timers.clear();
+      return Promise.allSettled([...flights]).then(() => {});
     },
     sources: () => Object.keys(jobs),
     connected: (source) => jobs[source].ready(),