rogerthat 1.24.5 → 1.25.0

package/dist/app.js

@@ -5,24 +5,18 @@ import { fileURLToPath } from "node:url";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { ChannelError, isPriority, setSessionTtlLookup, startPeriodicGc, validateSuggestedReplies, validateAttachments, } from "./channel.js";
-import { attachEmail, confirmEmailRecovery, createAccount, createIdentity, deleteIdentity, getAccount, getAccountIdsByIdentityCallsign, listIdentities, recoverAccount, removeEmail, requestEmailRecovery, verifyEmailCode, verifyIdentity, verifySession, } from "./accounts.js";
-import { createChannelWebhook, createWebhook, deleteChannelWebhook, deleteWebhook, deliver, getActiveWebhooksForAccount, getActiveWebhooksForChannel, listChannelWebhooks, listWebhooks, } from "./webhooks.js";
-import { buildRecoveryEmail, buildVerifyEmail, emailEnabled, sendEmail } from "./email.js";
-import { accountHtml } from "./account-ui.js";
 import { adminHtml } from "./admin.js";
 import { getOrCreateChannel, listActiveChannels } from "./channel.js";
 // startPeriodicGc imported above with ChannelError
 import { buildConnectInfo } from "./connect.js";
 import { agentCard } from "./agentcard.js";
 import { llmsText, mcpDescriptor, serviceInfo } from "./discovery.js";
-import { landingHtml, phoneLandingHtml } from "./landing.js";
+import { landingHtml } from "./landing.js";
 import { handleMcpRequest } from "./mcp.js";
-import { remoteHtml } from "./remote-ui.js";
-import { createRemoteControl, retrofitRemoteLink } from "./remote-control.js";
 import { policyHtml, policyText } from "./policy.js";
 import { applyPresetDefaults, getPreset, resolveMode, } from "./presets.js";
 import { recordJoin as statsRecordJoin, recordMessage as statsRecordMessage, getStats, } from "./stats.js";
-import { channelExists, createChannel, deleteChannelByCreator, setSessionTtlByCreator, ensureBands, getChannelIsBand, getChannelRequireIdentity, getChannelRetention, getChannelSessionTtlMs, getChannelTrustMode, hasOwnerPassword, listBands, listChannelsByCreator, verifyChannel, verifyOwnerPassword, } from "./store.js";
+import { channelExists, createChannel, ensureBands, getChannelIsBand, getChannelRetention, getChannelSessionTtlMs, getChannelTrustMode, hasOwnerPassword, listBands, verifyChannel, verifyOwnerPassword, } from "./store.js";
 import { isRetention, readTranscript, recordJoin as transcriptRecordJoin, recordLeave as transcriptRecordLeave, recordMessage as transcriptRecordMessage, } from "./transcripts.js";
 export function createApp(opts) {
     ensureBands();
@@ -46,13 +40,7 @@ export function createApp(opts) {
         c.header("Referrer-Policy", "strict-origin-when-cross-origin");
         c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
         c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=(), interest-cohort=()");
-        c.header("Content-Security-Policy", 
-        // img-src https: needed so /remote can render inline base64 attachments
-        // (data:) AND auto-preview image URLs that users paste from external
-        // hosts (imgur, Drive shareable links, etc.). Tradeoff: a tracking-pixel
-        // URL pasted in chat would load. We accept that for the human-in-the-loop
-        // UX win — channels are private and the operator picks who they trust.
-        "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https: https://prowl.world; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'");
+        c.header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data: https: https://prowl.world; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'");
     });
     function handleChannelError(c, e) {
         if (e instanceof ChannelError) {
@@ -72,9 +60,6 @@ export function createApp(opts) {
         if (accept.includes("application/json") && !accept.includes("text/html")) {
             return c.json(serviceInfo(opts.publicOrigin));
         }
-        const mode = c.get("mode") ?? "default";
-        if (mode === "phone")
-            return c.html(phoneLandingHtml());
         return c.html(landingHtml());
     });
     app.get("/healthz", (c) => c.text("ok"));
@@ -115,213 +100,8 @@ export function createApp(opts) {
     // Fix the broken /docs/* links from the nav — redirect to llms.txt (the canonical agent doc).
     app.get("/docs/quickstart", (c) => c.redirect("/llms.txt", 302));
     app.get("/docs/*", (c) => c.redirect("/llms.txt", 302));
-    app.get("/account", (c) => c.html(accountHtml()));
     app.get("/policy", (c) => c.html(policyHtml(opts.publicOrigin)));
-    // Mobile-first remote-control chat. Drives an agent that's already joined
-    // the same channel and looping on `wait`. Credentials are passed via the
-    // URL fragment (#t=…&k=…&cs=…) — fragment never reaches the server, so the
-    // bearer/identity_key don't end up in nginx logs or referrers.
-    app.get("/remote/:channelId", (c) => {
-        const id = c.req.param("channelId");
-        if (!channelExists(id)) {
-            return c.html(`<!doctype html><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/>` +
-                `<title>not found</title><body style="font-family:ui-monospace,Menlo,monospace;background:#f4ede0;padding:24px;color:#1a1a1a">` +
-                `<h1 style="font-size:18px">Channel not found</h1>` +
-                `<p style="color:#7a6f5f;font-size:14px">No channel <code>${id.replace(/[<>&]/g, "")}</code> on this server. The pair link may be stale or wrong.</p>` +
-                `<p><a href="/account" style="color:#d6541f">→ go to /account</a></p></body>`, 404);
-        }
-        return c.html(remoteHtml(id));
-    });
     app.get("/policy.txt", (c) => c.text(policyText(opts.publicOrigin)));
-    // ─── Accounts (passwordless, recovery-token based) ───
-    function requireSession(c) {
-        const auth = c.req.header("authorization") ?? c.req.header("Authorization") ?? "";
-        const token = auth.startsWith("Bearer ") ? auth.slice(7).trim() : "";
-        if (!token)
-            return c.json({ error: "Authorization: Bearer <session_token> required" }, 401);
-        const accountId = verifySession(token);
-        if (!accountId)
-            return c.json({ error: "invalid or expired session" }, 401);
-        return { accountId };
-    }
-    app.post("/api/account", (c) => {
-        const result = createAccount();
-        return c.json({
-            ...result,
-            notice: "Save recovery_token in a password manager. It is shown only once and is the only way to recover this account. session_token is short-lived; re-issue via /api/account/recover.",
-        });
-    });
-    app.post("/api/account/recover", async (c) => {
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty body */
-        }
-        const recoveryToken = String(body.recovery_token ?? "");
-        if (!recoveryToken)
-            return c.json({ error: "recovery_token required in body" }, 400);
-        const result = recoverAccount(recoveryToken);
-        if (!result)
-            return c.json({ error: "invalid recovery_token" }, 401);
-        return c.json(result);
-    });
-    app.get("/api/account", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const account = getAccount(r.accountId);
-        if (!account)
-            return c.json({ error: "account not found" }, 404);
-        return c.json({ ...account, identities: listIdentities(r.accountId) });
-    });
-    app.post("/api/account/identities", async (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty */
-        }
-        const callsign = String(body.callsign ?? "");
-        if (!callsign)
-            return c.json({ error: "callsign required in body" }, 400);
-        const result = createIdentity(r.accountId, callsign);
-        if ("error" in result)
-            return c.json(result, 400);
-        return c.json({
-            ...result,
-            notice: "Save identity_key. It is shown only once. Use it as Bearer auth when joining channels that require an identity.",
-        });
-    });
-    app.get("/api/account/identities", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        return c.json({ identities: listIdentities(r.accountId) });
-    });
-    app.delete("/api/account/identities/:callsign", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const cs = c.req.param("callsign");
-        const ok = deleteIdentity(r.accountId, cs);
-        if (!ok)
-            return c.json({ error: "identity not found" }, 404);
-        return c.json({ ok: true });
-    });
-    // ─── Email recovery (optional channel for "I lost my recovery_token") ───
-    const recoveryHits = new Map();
-    const RECOVERY_WINDOW_MS = 10 * 60 * 1000;
-    const RECOVERY_MAX_PER_WINDOW = 3;
-    function rateLimitRecover(c) {
-        const ip = c.req.header("cf-connecting-ip") ??
-            c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ??
-            c.req.header("x-real-ip") ??
-            "unknown";
-        const now = Date.now();
-        const bucket = recoveryHits.get(ip);
-        if (!bucket || now - bucket.windowStart > RECOVERY_WINDOW_MS) {
-            recoveryHits.set(ip, { count: 1, windowStart: now });
-            return true;
-        }
-        if (bucket.count >= RECOVERY_MAX_PER_WINDOW)
-            return false;
-        bucket.count++;
-        return true;
-    }
-    app.post("/api/account/email", async (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        if (!emailEnabled())
-            return c.json({ error: "email is not configured on this instance" }, 503);
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty */
-        }
-        const email = String(body.email ?? "");
-        if (!email)
-            return c.json({ error: "email required" }, 400);
-        const result = attachEmail(r.accountId, email);
-        if ("error" in result)
-            return c.json(result, 400);
-        try {
-            const msg = buildVerifyEmail(opts.publicOrigin, result.code, r.accountId);
-            await sendEmail(result.email, msg.subject, msg.text, msg.html);
-        }
-        catch (e) {
-            return c.json({ error: "failed to send verification email: " + e.message }, 502);
-        }
-        return c.json({ ok: true, email: result.email, verification_sent: true });
-    });
-    app.delete("/api/account/email", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        removeEmail(r.accountId);
-        return c.json({ ok: true });
-    });
-    app.get("/api/account/email-verify", (c) => {
-        const code = c.req.query("code") ?? "";
-        if (!code)
-            return c.html(verifyResultPage("Missing code parameter.", false));
-        const result = verifyEmailCode(code);
-        if ("error" in result)
-            return c.html(verifyResultPage(result.error, false));
-        return c.html(verifyResultPage(`Verified ${result.email} for account ${result.accountId}.`, true));
-    });
-    app.post("/api/account/email-recover", async (c) => {
-        if (!emailEnabled())
-            return c.json({ error: "email is not configured on this instance" }, 503);
-        if (!rateLimitRecover(c))
-            return c.json({ error: "too many requests, try again later" }, 429);
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty */
-        }
-        const email = String(body.email ?? "");
-        if (email) {
-            const result = requestEmailRecovery(email);
-            if (result) {
-                try {
-                    const msg = buildRecoveryEmail(opts.publicOrigin, result.code);
-                    await sendEmail(email, msg.subject, msg.text, msg.html);
-                }
-                catch (e) {
-                    console.error("[recover] failed to send email:", e);
-                }
-            }
-        }
-        return c.json({ ok: true, message: "If this email is registered and verified, a recovery link was sent." });
-    });
-    app.get("/api/account/email-recover-confirm", (c) => {
-        const code = c.req.query("code") ?? "";
-        if (!code)
-            return c.html(verifyResultPage("Missing code parameter.", false));
-        const result = confirmEmailRecovery(code);
-        if (!result)
-            return c.html(verifyResultPage("Invalid or expired recovery link.", false));
-        return c.html(recoveryAutoLoginPage(result.session_token));
-    });
     app.post("/api/channels", async (c) => {
         let body = {};
         try {
@@ -336,7 +116,6 @@ export function createApp(opts) {
         if (retentionInput !== undefined && !isRetention(retentionInput)) {
             return c.json({ error: "invalid retention; must be one of none|metadata|prompts|full" }, 400);
         }
-        const requireIdentityInput = body.require_identity;
         const trustModeInput = body.trust_mode;
         if (trustModeInput !== undefined && trustModeInput !== "untrusted" && trustModeInput !== "trusted") {
             return c.json({ error: "invalid trust_mode; must be 'untrusted' or 'trusted'" }, 400);
@@ -363,227 +142,36 @@ export function createApp(opts) {
         const mode = c.get("mode") ?? "default";
         const presetMerged = applyPresetDefaults(mode, {
             retention: retentionInput,
-            require_identity: requireIdentityInput === true ? true : requireIdentityInput === false ? false : undefined,
             trust_mode: trustModeInput,
             session_ttl_seconds: sessionTtlSecondsInput,
         });
         const retention = presetMerged.retention;
-        const requireIdentity = presetMerged.require_identity;
         const trustMode = presetMerged.trust_mode;
         const sessionTtlSeconds = presetMerged.session_ttl_seconds;
         // Auto-mint owner_password for presets that opt in (e.g. `go.`): gives
-        // "trusted-authorized" trust posture without an identity dance.
+        // "trusted-authorized" trust posture without extra setup.
         const preset = getPreset(mode);
         if (!ownerPassword && preset?.autoMintOwnerPassword) {
             ownerPassword = randomUUID().replace(/-/g, "").slice(0, 16);
         }
-        let creatorAccountId;
-        const auth = c.req.header("authorization") ?? c.req.header("Authorization") ?? "";
-        if (auth.startsWith("Bearer ")) {
-            const sessionTok = auth.slice(7).trim();
-            if (sessionTok) {
-                const acc = verifySession(sessionTok);
-                if (!acc)
-                    return c.json({ error: "invalid session token (omit Authorization for anonymous channel)" }, 401);
-                creatorAccountId = acc;
-            }
-        }
         const result = createChannel({
             retention,
-            require_identity: requireIdentity,
             trust_mode: trustMode,
             session_ttl_seconds: sessionTtlSeconds,
-            creator_account_id: creatorAccountId,
             owner_password: ownerPassword,
         });
         if ("error" in result)
             return c.json(result, 400);
-        const { id, token, retention: createdRetention, require_identity: createdRequireIdentity, trust_mode: createdTrustMode, session_ttl_seconds: createdTtl, creator_account_id, has_owner_password, } = result;
+        const { id, token, retention: createdRetention, trust_mode: createdTrustMode, session_ttl_seconds: createdTtl, has_owner_password, } = result;
         return c.json({
             ...buildConnectInfo(id, token, opts.publicOrigin, { ownerPassword, trustMode, mode }),
             retention: createdRetention,
-            require_identity: createdRequireIdentity,
             trust_mode: createdTrustMode,
             session_ttl_seconds: createdTtl,
-            creator_account_id,
             has_owner_password,
             owner_password: ownerPassword ?? null,
         });
     });
-    app.get("/api/account/channels", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const channelList = listChannelsByCreator(r.accountId).map((ch) => ({
-            ...ch,
-            agent_count: getOrCreateChannel(ch.id).size(),
-        }));
-        return c.json({ channels: channelList });
-    });
-    // One-shot bootstrap for the "drive the agent from my phone" flow. Creates
-    // a private trusted channel + two identities (one for the agent on this
-    // machine, one for the phone) and returns a mobile_url with creds in the
-    // URL fragment. If the caller passes a session_token, the channel is bound
-    // to that account; otherwise a fresh anonymous account is minted (the
-    // recovery_token comes back so the caller can keep it if they want).
-    app.post("/api/remote-control", async (c) => {
-        let body = {};
-        try {
-            const raw = c.req.header("content-type")?.startsWith("application/json") ? await c.req.json() : {};
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* body optional */
-        }
-        const sessionToken = typeof body.session_token === "string" ? body.session_token : undefined;
-        const result = await createRemoteControl({ publicOrigin: opts.publicOrigin, sessionToken });
-        if ("error" in result) {
-            const status = result.code === "unauthorized" ? 401 : 500;
-            return c.json({ error: result.error }, status);
-        }
-        return c.json({
-            ...result,
-            notice: "Two-step phone flow: (1) open mobile_url on the phone; (2) type owner_password on the /remote setup screen to mark the phone session as human-authorized. The password is NOT embedded in mobile_url on purpose — relay it through a separate channel so a leaked URL alone can't impersonate the human. On the agent side (this machine), join with agent.identity_key + owner_password and then loop on `wait`.",
-        });
-    });
-    // Retrofit a phone-control link onto an EXISTING channel. Use when the
-    // operator originally created a plain channel and the human shows up later
-    // wanting to drive from a phone — instead of forcing a new channel +
-    // migrating all the agents, this mints a phone identity + (if not already
-    // set) an owner_password, and returns a mobile_url/QR for the same channel.
-    app.post("/api/channels/:id/remote-link", async (c) => {
-        const channelId = c.req.param("id") ?? "";
-        if (!channelId)
-            return c.json({ error: "channel_id required" }, 400);
-        let body = {};
-        try {
-            const raw = c.req.header("content-type")?.startsWith("application/json")
-                ? await c.req.json()
-                : {};
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* body optional */
-        }
-        const channelToken = typeof body.channel_token === "string" ? body.channel_token : "";
-        const sessionToken = typeof body.session_token === "string" ? body.session_token : "";
-        if (!channelToken)
-            return c.json({ error: "channel_token required" }, 400);
-        if (!sessionToken)
-            return c.json({ error: "session_token required (account must own a phone identity)" }, 400);
-        const result = await retrofitRemoteLink({
-            publicOrigin: opts.publicOrigin,
-            channelId,
-            channelToken,
-            sessionToken,
-        });
-        if ("error" in result) {
-            const status = result.code === "unauthorized" ? 401 :
-                result.code === "not_found" ? 404 :
-                    result.code === "bad_token" ? 403 :
-                        500;
-            return c.json({ error: result.error }, status);
-        }
-        return c.json({
-            ...result,
-            notice: result.owner_password_existing
-                ? "This channel already had an owner_password set — we did NOT rotate it (would invalidate every peer that already joined with it). Use the password you already have OOB; the mobile_url above + that password = phone joins as human-authorized."
-                : "Two-step phone flow: (1) open mobile_url on the phone; (2) type owner_password on the /remote setup screen. The password is NOT embedded in mobile_url on purpose — relay it through a separate channel so a leaked URL alone can't impersonate the human.",
-        });
-    });
-    app.delete("/api/account/channels/:id", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const channelId = c.req.param("id");
-        const ok = deleteChannelByCreator(r.accountId, channelId);
-        if (!ok)
-            return c.json({ error: "channel not found or not yours" }, 404);
-        return c.json({ ok: true });
-    });
-    // Mutate the idle session TTL on an existing channel. Owner-only — same gate
-    // as DELETE. Use case: an agent started a 30-min channel for a quick task,
-    // the conversation turned into a 4-hour debugging session, and the operator
-    // wants to push TTL out to 24h instead of dealing with re-joins. Companion
-    // to /api/channels/:id/remote-link — same "retrofit instead of recreate"
-    // pattern.
-    app.patch("/api/account/channels/:id/session-ttl", async (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const channelId = c.req.param("id") ?? "";
-        if (!channelId)
-            return c.json({ error: "channel_id required" }, 400);
-        let body = {};
-        try {
-            const raw = c.req.header("content-type")?.startsWith("application/json")
-                ? await c.req.json()
-                : {};
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* body optional */
-        }
-        const ttl = typeof body.session_ttl_seconds === "number" ? body.session_ttl_seconds : NaN;
-        const result = setSessionTtlByCreator(r.accountId, channelId, ttl);
-        if ("error" in result) {
-            const status = result.code === "not_found" ? 404 :
-                result.code === "forbidden" ? 403 :
-                    400;
-            return c.json({ error: result.error }, status);
-        }
-        return c.json({
-            ok: true,
-            channel_id: channelId,
-            session_ttl_seconds: result.session_ttl_seconds,
-            notice: "New TTL applies to the next GC tick (within 60s). Sessions already past the previous TTL but not yet evicted are rescued by a bump; idle sessions inside the previous TTL but outside the new one will be evicted sooner if you shrank it.",
-        });
-    });
-    // ─── Webhooks ───
-    app.post("/api/account/webhooks", async (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty */
-        }
-        const url = String(body.url ?? "");
-        const events = Array.isArray(body.events) ? body.events.map(String) : ["message.received"];
-        const result = createWebhook(r.accountId, url, events);
-        if ("error" in result)
-            return c.json(result, 400);
-        return c.json({
-            ...result,
-            url,
-            events,
-            notice: "Save the secret. It's shown only once. Use it to verify the X-RogerThat-Signature header (HMAC-SHA256) on incoming events.",
-        });
-    });
-    app.get("/api/account/webhooks", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        return c.json({ webhooks: listWebhooks(r.accountId) });
-    });
-    app.delete("/api/account/webhooks/:id", (c) => {
-        const r = requireSession(c);
-        if (r instanceof Response)
-            return r;
-        const id = c.req.param("id");
-        const ok = deleteWebhook(r.accountId, id);
-        if (!ok)
-            return c.json({ error: "webhook not found or not yours" }, 404);
-        return c.json({ ok: true });
-    });
     app.get("/api/channels/:id", (c) => {
         const channelId = c.req.param("id");
         if (!channelExists(channelId)) {
@@ -597,7 +185,6 @@ export function createApp(opts) {
             channel_id: channelId,
             exists: true,
             retention: getChannelRetention(channelId),
-            require_identity: getChannelRequireIdentity(channelId),
             trust_mode: getChannelTrustMode(channelId),
             has_owner_password: hasOwnerPassword(channelId),
             session_ttl_seconds: Math.round(getChannelSessionTtlMs(channelId) / 1000),
@@ -613,7 +200,6 @@ export function createApp(opts) {
                 keepalive: `POST ${base}/keepalive`,
                 stats: `GET ${base}/stats`,
                 transcript: `GET ${base}/transcript`,
-                webhooks: `POST ${base}/webhooks`,
                 mcp: `${opts.publicOrigin}/mcp/${channelId}`,
             },
             auth: "All endpoints (except this one) require Authorization: Bearer <channel_token>. /send and /listen also require X-Session-Id from /join.",
@@ -674,26 +260,6 @@ export function createApp(opts) {
         if (info.retryAfter !== undefined)
             c.header("Retry-After", String(info.retryAfter));
     }
-    // ─── Webhook fan-out helper ───
-    function fanoutWebhooks(channelId, msg) {
-        const payload = {
-            channel_id: channelId,
-            message: { id: msg.id, from: msg.from, to: msg.to, text: msg.text, at: msg.at },
-        };
-        // Account-scoped webhooks — only for DMs to identities owned by an account.
-        if (msg.to !== "all") {
-            const accountIds = getAccountIdsByIdentityCallsign(msg.to);
-            for (const accountId of accountIds) {
-                for (const hook of getActiveWebhooksForAccount(accountId, "message.received")) {
-                    deliver(hook, "message.received", payload);
-                }
-            }
-        }
-        // Channel-scoped webhooks — fire for EVERY message on this channel (DMs + broadcasts).
-        for (const hook of getActiveWebhooksForChannel(channelId, "message.received")) {
-            deliver(hook, "message.received", payload);
-        }
-    }
     // ─── REST API (MCP-free; for any CLI with shell access — Codex, Aider, scripts) ───
     function requireChannelBearer(c, channelId) {
         if (!channelExists(channelId))
@@ -736,23 +302,10 @@ export function createApp(opts) {
         catch {
             /* empty body ok */
         }
-        const callsignArg = String(body.callsign ?? "");
-        const identityKey = typeof body.identity_key === "string" ? body.identity_key : undefined;
+        const resolvedCallsign = String(body.callsign ?? "");
         const ownerPassword = typeof body.owner_password === "string" ? body.owner_password : "";
-        let resolvedCallsign = callsignArg;
-        let identitySource = null;
-        if (identityKey) {
-            const idRec = verifyIdentity(identityKey);
-            if (!idRec)
-                return c.json({ error: "invalid identity_key", code: "unauthorized" }, 401);
-            resolvedCallsign = idRec.callsign;
-            identitySource = idRec.account_id;
-        }
-        else if (getChannelRequireIdentity(channelId)) {
-            return c.json({ error: "this channel requires identity_key (require_identity=true)", code: "unauthorized" }, 403);
-        }
         if (!resolvedCallsign)
-            return c.json({ error: "callsign or identity_key required", code: "invalid" }, 400);
+            return c.json({ error: "callsign required", code: "invalid" }, 400);
         const humanAuthorized = ownerPassword ? verifyOwnerPassword(channelId, ownerPassword) : false;
         if (ownerPassword && !humanAuthorized && hasOwnerPassword(channelId)) {
             return c.json({
@@ -784,7 +337,6 @@ export function createApp(opts) {
             return c.json({
                 session_id: result.sessionId,
                 callsign: resolvedCallsign,
-                identity_account: identitySource,
                 human_authorized: humanAuthorized,
                 trust_mode: trustMode,
                 trust_posture: trustPosture,
@@ -878,10 +430,9 @@ export function createApp(opts) {
             }
             const msg = channel.send(sessionId, to, message, priorityInput, suggestedReplies, attachments, kind);
             statsRecordMessage();
-            // Status pings are ephemeral — keep them out of transcripts and webhooks.
+            // Status pings are ephemeral — keep them out of transcripts.
             if (msg.kind !== "status") {
                 transcriptRecordMessage(channelId, getChannelRetention(channelId), msg);
-                fanoutWebhooks(channelId, msg);
             }
             const queued = msg.kind !== "status" && msg.to !== "all" && !channel.isCallsignOnline(msg.to);
             return c.json({
@@ -1064,7 +615,6 @@ export function createApp(opts) {
         return c.json({
             channel_id: channelId,
             retention: getChannelRetention(channelId),
-            require_identity: getChannelRequireIdentity(channelId),
             trust_mode: getChannelTrustMode(channelId),
             has_owner_password: hasOwnerPassword(channelId),
             session_ttl_seconds: Math.floor(getChannelSessionTtlMs(channelId) / 1000),
@@ -1076,54 +626,6 @@ export function createApp(opts) {
             last_activity_at: ch.lastActivityAt,
         });
     });
-    // ─── Channel-scoped webhooks (no account required, auth via channel token) ───
-    app.post("/api/channels/:id/webhooks", async (c) => {
-        const channelId = c.req.param("id");
-        const denied = requireChannelBearer(c, channelId);
-        if (denied)
-            return denied;
-        if (getChannelIsBand(channelId)) {
-            return c.json({ error: "webhooks cannot be subscribed on public bands (anyone could fire them)", code: "invalid" }, 400);
-        }
-        let body = {};
-        try {
-            const raw = await c.req.json();
-            if (raw && typeof raw === "object")
-                body = raw;
-        }
-        catch {
-            /* empty */
-        }
-        const url = String(body.url ?? "");
-        const events = Array.isArray(body.events) ? body.events.map(String) : ["message.received"];
-        const result = createChannelWebhook(channelId, url, events);
-        if ("error" in result)
-            return c.json(result, 400);
-        return c.json({
-            ...result,
-            url,
-            events,
-            channel_id: channelId,
-            notice: "Save the secret. It's shown only once. Use it to verify the X-RogerThat-Signature header (HMAC-SHA256) on incoming events.",
-        });
-    });
-    app.get("/api/channels/:id/webhooks", (c) => {
-        const channelId = c.req.param("id");
-        const denied = requireChannelBearer(c, channelId);
-        if (denied)
-            return denied;
-        return c.json({ webhooks: listChannelWebhooks(channelId) });
-    });
-    app.delete("/api/channels/:id/webhooks/:whId", (c) => {
-        const channelId = c.req.param("id");
-        const denied = requireChannelBearer(c, channelId);
-        if (denied)
-            return denied;
-        const ok = deleteChannelWebhook(channelId, c.req.param("whId"));
-        if (!ok)
-            return c.json({ error: "webhook not found on this channel" }, 404);
-        return c.json({ ok: true });
-    });
     app.get("/api/channels/:id/roster", (c) => {
         const channelId = c.req.param("id");
         const denied = requireChannelBearer(c, channelId);
@@ -1173,7 +675,7 @@ export function createApp(opts) {
         const denied = requireAdmin(c);
         if (denied)
             return denied;
-        return c.json({ channels: listActiveChannels(getChannelRetention, getChannelRequireIdentity, getChannelTrustMode) });
+        return c.json({ channels: listActiveChannels(getChannelRetention, getChannelTrustMode) });
     });
     async function mcpHandler(c, channelId) {
         if (channelId !== null) {
@@ -1280,26 +782,6 @@ export function createApp(opts) {
         ].join("\n");
         return c.text(body, 200, { "Content-Type": "text/plain; charset=utf-8" });
     });
-    function verifyResultPage(message, success) {
-        const color = success ? "#2d8a3e" : "#d6541f";
-        const icon = success ? "✓" : "✗";
-        return `<!doctype html><html><head><meta charset="utf-8" /><title>rogerthat</title>
-<style>body{font-family:ui-monospace,Menlo,monospace;background:#f4ede0;color:#1a1a1a;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;padding:24px;line-height:1.5}
-.box{background:#fffaef;border:2px solid ${color};padding:32px;max-width:480px;text-align:center}
-.icon{font-size:48px;color:${color};margin-bottom:12px}
-a{color:#d6541f}</style></head><body>
-<div class="box"><div class="icon">${icon}</div><p>${message}</p>
-<p style="font-size:13px;color:#7a6f5f"><a href="/account">→ go to /account</a></p></div></body></html>`;
-    }
-    function recoveryAutoLoginPage(sessionToken) {
-        return `<!doctype html><html><head><meta charset="utf-8" /><title>rogerthat — recovered</title>
-<style>body{font-family:ui-monospace,Menlo,monospace;background:#f4ede0;color:#1a1a1a;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;padding:24px;line-height:1.5}
-.box{background:#fffaef;border:2px solid #2d8a3e;padding:32px;max-width:480px;text-align:center}
-.icon{font-size:48px;color:#2d8a3e;margin-bottom:12px}</style></head><body>
-<div class="box"><div class="icon">✓</div><p>Recovered. Signing you in…</p></div>
-<script>sessionStorage.setItem('rogerthat_account_session', ${JSON.stringify(sessionToken)});setTimeout(function(){location.href='/account';}, 800);</script>
-</body></html>`;
-    }
     app.notFound((c) => c.text("not found", 404));
     app.onError((errInstance, c) => {
         console.error("[rogerthat] unhandled", errInstance);