brane 0.3.0 → 0.3.1

package/AGENTS.md

@@ -22,7 +22,7 @@ Brane is a TypeScript reimagining of the [organelle](https://github.com/benjamn/
 - **Terminal mirroring** of tmux sessions with keyboard input
 - The **LIVE loop** protocol for cursor-based agent communication
 - A **semantic memory** system with embeddings and full-text search
-- **Multi-agent support** with session resumption across 6 agent types
+- **Multi-agent support** across 8 agent types, with session resumption where the agent offers it
 
 ## Golden Rule
 
@@ -66,7 +66,7 @@ brane/
 │   ├── components/            # MacroMenu, TerminalPane, TerminalKeyboard
 │   ├── lib/                   # api.ts, terminal.ts, connection.ts, registry.ts
 │   └── dist/                  # Built web bundle (served by daemon)
-├── worker/                    # Cloudflare Workers deployment (serves expo/dist as SPA)
+├── worker/                    # Cloudflare Workers deployment (serves the latest release's expo/dist as SPA)
 ├── protocols/
 │   ├── LIVE_loop.md           # Core agent communication protocol
 │   ├── digest.md              # /digest protocol for activity summaries
@@ -113,8 +113,11 @@ non-executable files) while `node dist/cli.js` keeps working.
 
 Publishing to npm is done by `.github/workflows/release.yml`, triggered by a
 published GitHub release, and only by it. **Agents never run `npm publish`.**
-The version bump, tag rule, dist-tag choice and why there is no provenance
-attestation are in [docs/releasing.md](docs/releasing.md).
+The shared web app ships with it: a release deploys its tarball's
+`expo/dist`, and a merge to `main` deploys nothing (staging is Isolate on a
+daemon running `main`). The version bump, tag rule, dist-tag choice, app
+deploy and rollback, and why 0.3.0 has no provenance attestation are in
+[docs/releasing.md](docs/releasing.md).
 
 ## CLI Commands
 
@@ -125,7 +128,7 @@ attestation are in [docs/releasing.md](docs/releasing.md).
 | `attach` | Attach to a tmux session |
 | `list` | List narratives grouped by brane (`--brane`, `--archived`, `--limit`) — reads `GET /api/narratives` + `GET /api/branes` |
 | `fold` | Register directories as spawn points (`--brane` to associate with a brane) — delegates to `POST /api/folds` |
-| `meld` | Generate QR code for mobile access (defaults to `brane.organelle.dev`, `--local` for direct); waits for Touch ID at this machine — see [Presence Check](docs/presence.md#the-gate). `--remote --send … --ask …` melds a daemon on another machine (a Fly machine: /fly) with a token minted here, and refuses in an agent's session |
+| `meld` | Generate QR code for mobile access (points at the `app_domain` config, `brane.organelle.dev` unless set; `--app <host>` for one QR, `--local` for a direct daemon URL); waits for Touch ID at this machine — see [Presence Check](docs/presence.md#the-gate). `--remote --send … --ask …` melds a daemon on another machine (a Fly machine: /fly) with a token minted here, and refuses in an agent's session |
 | `mcp` | MCP stdio server (used internally by agent sessions) |
 | `revive` | Restart dead agent sessions (`--prompt`, `--no-prompt`, `--agent`) — delegates to `POST /api/revive/:nid` |
 | `config` | Get/set brane configuration (git-config style: `--list`, `--unset`) |
@@ -170,6 +173,8 @@ Brane supports multiple agent types with session resumption. Each agent has an a
 | `codex` | `resume <session_id>` | Subcommand-based resumption |
 | `amp` | (none) | Uses thread references `@T-<id>` in prompt |
 | `copilot` | `--session-id <session_id>` | Daemon-pinned UUID resumes the exact local session |
+| `cline` | (none) | Each revive starts a fresh session; brane captures its id for cost |
+| `crush` | (none) | Each revive starts a fresh session; brane captures its id for cost |
 
 Spawning a session generates agent-specific MCP config. This happens in `doSpawn()`, which always runs in the daemon — `brane spawn` gets it by delegating to `POST /api/spawn`, not by writing these files itself:
 - **Claude**: `.mcp.json` in fold directory
@@ -187,7 +192,7 @@ See `SECURITY.md` for full details. Key features:
 - **Atomic daemon startup** — `BEGIN EXCLUSIVE` SQLite transaction prevents race conditions
 - **Version checking** — daemon stores version for CLI compatibility detection
 - **Payload security** — path traversal protection, 50MB size limits, immutable cached URLs
-- **Origin checking** — WebSocket upgrade validates Origin header
+- **The token is the only credential** — no origin allowlist: CORS answers `*` without credentials, the WebSocket upgrade checks the token and nothing else, and the `Origin` a device runs the app from is recorded on its token for the Devices list (`SECURITY.md`, Authentication)
 
 ## Rules for Every Change
 
@@ -345,7 +350,7 @@ read at runtime).
 - **The mirror sends text; everything else is explicit**: the pane's cursor is the only thing about a terminal that isn't in its text, so it rides the same tmux round trip as the capture — and gets its own message when it moves and the text doesn't
 - **The chat never scrolls itself**: after landing, only the operator moves the chat. It is a `column-reverse` scroller (`CHAT_SCROLLER_STYLE`, `expo/app/[nid].tsx`), not a virtualized `FlatList`, so scroll position is measured from the bottom: it opens on the latest message without a scroll, an arrival is followed only when the view is already exactly at the bottom, a page of older history lands at the far end and moves nothing, and no row is ever swapped for an estimated spacer mid-scroll. The one scroll the code writes is landing on `?scrollToSeq=` / `?scrollTo=`, plus the ↑/↓ tab button the operator taps. Sending doesn't scroll, and vertical scroll is never disabled, not even under a horizontal pane swipe. Measured in Chromium and WebKit against a sandbox daemon: the message under the viewport moves 0 px on arrival, on send and on each page loaded
 - **A tap should cost what it changed**: the chat's selection lives in a store with per-seq subscriptions, so selecting a message wakes that bubble, the header's count and the composer — not the screen, not `renderItem`, not the other two hundred rows; the same store is what makes two taps in one frame both land
-- **The URL carries the view**: anything that must survive an origin hop (Isolate) or a device hop (Meld) goes in the query string, built through `src/shared/view-url.ts` — `sessionStorage` is origin-scoped and does not travel
+- **The URL carries the view**: anything that must survive an origin hop (Isolate) or a device hop (Meld) goes in the query string, built through `src/shared/view-url.ts` — `sessionStorage` is origin-scoped and does not travel. The app names no host: "isolated" is `location.host` equal to the connection's host, and the way out is the daemon's `app_domain` from `/api/status`; `src/test/app-host-literal.test.ts` keeps it that way
 - **Back undoes a jump, never a view change**: a different narrative or any `nid:seq` link (even into the narrative you're reading) is a `router.push`; a tab, pin, file or selection change is `router.setParams`, which replaces. Screens behind the top stay mounted, so Back restores them whole, and narrative subscriptions are refcounted because two of them can watch the same narrative — see [View URLs](docs/view-urls.md)
 - **`shared/` is the publication unit**: a fold's `wiki/shared/` is what other folds — and the npm tarball — can see; everything directly under `wiki/` is fold-local, and the install directory is just another fold
 - **One renderer, two targets**: markdown features that must survive export (code highlighting, math) render server-side or through shared code, never through a script the exported file carries

package/CHANGELOG.md

@@ -6,14 +6,47 @@ page, which is also what triggers its publish (see
 [docs/releasing.md](docs/releasing.md)). This file is the summary that
 travels in the npm tarball.
 
+## 0.3.1 - 2026-10-12
+
+- The shared web app ships with the release. It serves the `latest`
+  release's own `expo/dist`, and a merge to `main` deploys nothing; a
+  daemon running `main` serves its own newer bundle, through Isolate
+  ([#600](https://github.com/benjamn/brane/pull/600)).
+- The app knows no host. `brane meld` and `brane spawn --meld` point
+  their QR at the `app_domain` config (`--app` / `--meld-app` for one
+  QR), `GET /api/status` reports it, and Isolate and the in-app Meld
+  work from whichever host serves the app
+  ([#598](https://github.com/benjamn/brane/pull/598),
+  [#599](https://github.com/benjamn/brane/pull/599)).
+- The token is the only credential. The daemon no longer checks an
+  origin allowlist: CORS answers `*` without credentials. The origin
+  each device runs the app from is recorded and shown in the Devices
+  list and `brane token list`
+  ([#593](https://github.com/benjamn/brane/pull/593),
+  [#595](https://github.com/benjamn/brane/pull/595)).
+- The spawn dialog's "Other…" agent runs any command on the daemon's
+  `PATH`, as `brane spawn <agent>` does, and spawn errors show in the
+  dialog ([#596](https://github.com/benjamn/brane/pull/596)).
+- New terminals start at the viewer's size, so launch redraws no longer
+  pile up in scrollback, and the 🦾 menu gains "Clear 🧽" to clear a
+  pane's scrollback ([#574](https://github.com/benjamn/brane/pull/574)).
+- On a Fly machine the daemon keeps its ports across boots, and a revive
+  repoints the fold's hook config at the running daemon
+  ([#594](https://github.com/benjamn/brane/pull/594)).
+- Vulnerabilities are reported through GitHub's private vulnerability
+  reporting (see `SECURITY.md`). This is the first release published
+  from the public repository, so it carries npm provenance; 0.3.0 has
+  none ([#597](https://github.com/benjamn/brane/pull/597)).
+
 ## 0.3.0 - 2026-10-11
 
 The first release of this codebase. What ships:
 
 - The `brane` CLI and userspace daemon: register directories as folds,
-  spawn agents in them (Claude Code, Codex, Gemini, Goose, Crush, Copilot,
-  or any command) under tmux, and keep every session's narrative in one
-  SQLite database, every message with a stable `nid:seq` address.
+  spawn agents in them (Claude Code, Codex, Gemini, Goose, Amp, Copilot,
+  Cline, Crush, or any command) under tmux, and keep every session's
+  narrative in one SQLite database, every message with a stable `nid:seq`
+  address.
 - The LIVE loop: an MCP server injected into each agent session
   (`narrate`, `listen`, `whoami`, wiki and memory search), and the
   protocols agents read at runtime, in `protocols/`.
@@ -29,5 +62,5 @@ The first release of this codebase. What ships:
 
 ## 0.1.1
 
-An unrelated earlier package that held the name on npm (2022). Not an
+An unrelated earlier package that held the name on npm (2020). Not an
 ancestor of this code.

package/CONTRIBUTING.md

@@ -6,6 +6,14 @@ and every one of them was reviewed, authored, committed, and merged by a
 human. This document says what that means for anyone touching the
 repository, human or agent.
 
+## Issues and pull requests
+
+Brane is not a product, and its maintainer makes no support promise.
+Issues are open: bug reports and ideas are welcome there, and may or may
+not get an answer. Pull requests are limited to the maintainer; if you
+have a fix, describe it in an issue. Vulnerabilities go through private
+reporting instead, as `SECURITY.md` describes.
+
 ## How changes land
 
 - `main` takes pull requests only. The `protect-main-branch` ruleset
@@ -58,7 +66,8 @@ Responsibility for a change belongs to a person. Concretely:
   the work under the project's license. A model cannot hold copyright,
   enter an agreement, or take responsibility, so it cannot certify
   anything, and an agent must not write a sign-off on a human's behalf.
-- **Outside contributors sign off.** Add
+- **Outside contributors sign off**, should outside pull requests open
+  (for now they are maintainer-only; see above). Add
   `Signed-off-by: Your Name <you@example.com>` to each commit
   (`git commit -s`), certifying the
   [Developer Certificate of Origin 1.1](https://developercertificate.org/).
@@ -82,7 +91,8 @@ that way, including code whose origin you cannot account for.
 
 ## Security
 
-Do not open a public issue for a vulnerability. See `SECURITY.md`.
+Report a vulnerability privately, as `SECURITY.md` describes, not in an
+issue.
 
 ## For agents
 

package/DESIGN.md

@@ -282,10 +282,13 @@ a manual escape hatch for forcing an immediate re-provision.
 
 ### CORS
 
-The daemon allows cross-origin requests from:
-- `http://localhost:*` — any port, for local dev
-- `https://*.organelle.dev` — production domains
-- Configurable `app_domain` via config
+The daemon answers any origin with `Access-Control-Allow-Origin: *` and no
+credentials. There is no allowlist: every API request and WebSocket upgrade
+must present a token, so a page holding none gets a 401 whatever its origin,
+and the hostname the app is served from (`brane.organelle.dev`, a staging
+host, a fork's deployment, the daemon's own bundle, `localhost` in dev) is
+not a trust decision. The origin each device runs the app from is recorded
+on its token for the Devices list instead (`SECURITY.md`, Authentication).
 
 ## Web App (Expo)
 

package/README.md

@@ -164,7 +164,7 @@ CLI whenever that calculus changes for you.
 
 ## Contributing
 
-Brane is developed by one maintainer working with coding agents. Commits an agent writes carry a disclosure trailer; responsibility for every change stays with a human, who reviews, signs off, and merges it. Sign-off is human-only: an agent never certifies a contribution. See [CONTRIBUTING.md](CONTRIBUTING.md) for the rules, including the DCO sign-off asked of outside contributors, and for working from a clone.
+Brane is developed by one maintainer working with coding agents. Commits an agent writes carry a disclosure trailer; responsibility for every change stays with a human, who reviews, signs off, and merges it. Sign-off is human-only: an agent never certifies a contribution. Issues are open; pull requests are maintainer-only. See [CONTRIBUTING.md](CONTRIBUTING.md) for the rules, including the DCO sign-off, and for working from a clone.
 
 ## License
 
@@ -172,4 +172,4 @@ GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). See [LICENS
 
 Brane is designed to be run as a standalone daemon by individual operators, not embedded into other products. The AGPL's network-use clause ensures that anyone who modifies brane and offers it as a hosted service must share their modifications back.
 
-> Note: the `brane` package was previously published on npm under MIT in 2020. This codebase is a complete rewrite that supersedes that release; any future npm publication would ship as a new major version under AGPL-3.0-or-later.
+> Note: the `brane` name on npm previously carried unrelated MIT-licensed packages (0.0.x in 2015, 0.1.1 in 2020). This codebase is a complete rewrite under AGPL-3.0-or-later, first published as 0.3.0.

package/SECURITY.md

@@ -2,6 +2,12 @@
 
 Brane is a local-first system. Your data never leaves your machine unless you explicitly connect a device.
 
+## Reporting a vulnerability
+
+Report it privately, through GitHub's [private vulnerability reporting](https://github.com/benjamn/brane/security/advisories/new) (the repository's **Security** tab, then **Report a vulnerability**). Only the maintainer sees the report. Don't open an issue for it: issues are public.
+
+Brane has one maintainer and no support commitment, so there is no promised response time. The report that gets fixed fastest says which version (`brane --version`), what the attacker needs to start with (a tailnet peer, a process on the machine, a melded device, an agent session), and what they end up with.
+
 ## Network isolation by default
 
 The daemon binds **only to loopback and Tailscale addresses**. The listen sockets themselves are the first line of defense: by default, the daemon is attached only to `127.0.0.1`, `::1`, and whatever IPs `tailscale status --json` reports (typically one IPv4 and one IPv6 in the 100.x / fd7a::/8 range). **The machine's LAN IP is not bound.** Same-subnet port scans see nothing on the daemon's port — the kernel rejects those SYNs with RST before any userspace code runs.
@@ -44,6 +50,8 @@ To opt in to LAN reach on a trusted home network, pass `brane meld --host <lan-i
 
 Every API and WebSocket request over TCP requires a 128-bit UUID bearer token, passed via `Authorization: Bearer` header or query parameter. Brute-forcing 128 bits of entropy is not feasible. The one exception is a request over the daemon's Unix socket, which needs no token and acts as this machine's account (below).
 
+**The token is the only credential; the origin is reported, never gated.** The daemon does not care which hostname serves the app: `brane.organelle.dev`, a staging hostname, a fork's own deployment, a daemon's own bundle, or a page on a laptop's `localhost`. A page holding no token gets a 401 whatever its origin. A page holding one can *act* with it from any origin: the token is accepted in `?token=` on any method, and request bodies are parsed as JSON whatever their `Content-Type`, so a `text/plain` POST, which needs no preflight, signals or spawns from any origin regardless. An origin allowlist would only hide responses and refuse WebSockets, never block a write, and the browser is the bridge across the IP filter that `curl` off the tailnet does not have. So the only honest boundary is the token. CORS therefore answers `*` with no credentials (brane sets no cookies, and `Allow-Credentials` with a reflected origin is the one CORS combination that could ever be dangerous), and the WebSocket upgrade checks the token and nothing else. What the origin *is* for is the Devices list: the first `Origin` a token is presented from, and the latest, are recorded on its row (`app_origin`, `last_app_origin`) and shown as "via main.brane.organelle.dev", so you can see which copy of the app each device runs. The one request that still looks at `Origin` is a tokenless one on the Unix socket, below, where its presence is what marks a browser behind a relay.
+
 **Tokens are stored as hashes only.** The `tokens` table holds the SHA-256 of each token, never the token, so the daemon's own record of who may connect authenticates nothing by itself, and the daemon cannot print a token back. Each melded device gets its own token, minted when its QR is made, whether by `brane meld` or by the app's Meld item; that QR is the only copy. The device showing an in-app Meld QR never hands over its own token, and opening the sheet mints a fresh one each time. A minted token nobody uses within 10 minutes lapses, so an unscanned or photographed QR stops working. This machine's CLI and MCP bridges hold no token: they reach the daemon over its Unix socket, `~/.brane/daemon.sock`, and present nothing. `~/.brane` is `0700` and the database is `0600`, so other accounts on the machine can read none of it, and cannot connect to the socket either: reaching it takes search permission on that directory. That is why a request over the socket needs no token: only this account can have sent it, and it acts as this machine's `local` row, which no token opens. This machine's standing therefore exists only on the socket and cannot be copied off the machine. Older branes kept a local token in `~/.brane/.daemon_token` instead, which worked from any address the IP filter admits; the daemon revokes it at its first start and empties the file, and `brane doctor` reports the empty leftover, which is yours to remove. Where the daemon cannot listen on the socket (a `~/.brane` path too long for one, a filesystem that cannot hold one), the shell CLI cannot reach it and says why; agents and devices, which hold tokens, still can. The daemon checks the directory is still owned by it and closed to group and other before every such request, and refuses them if it is not. It also refuses a tokenless request that carries an `Origin` header or a `Host` other than `localhost`, which is what a browser's request looks like when something relays a port to the socket (`ssh -L`, socat, a devcontainer forward). Even so, a relay to `daemon.sock` extends "this account" to whoever can reach the relay: don't run one.
 
 **What hashing does not cover.** Two things.

package/dist/commands/config.js

@@ -1,10 +1,27 @@
 import { defineCommand } from "citty";
 import { openDatabase } from "../db/schema.js";
+import { cleanAppHost } from "../shared/app-origin.js";
 // Well-known config keys and their defaults
 export const CONFIG_DEFAULTS = {
+    // The hostname that serves the shared app: where `brane meld` points a QR
+    // unless `--app` says otherwise, and what `GET /api/status` reports so a
+    // daemon's own bundle knows where Isolate hops out to. Never a trust
+    // decision: the daemon accepts any origin (SECURITY.md, Authentication).
+    // A fork changes this one line, and its daemons point at its own shell.
     app_domain: "brane.organelle.dev",
     "session-affinity.enabled": "true",
 };
+/** The shared app's host from a configured or given `app_domain` value,
+ *  reduced to a host (`cleanAppHost`); a blank one means the default, so
+ *  `brane config app_domain ""` or `brane meld --app ""` can never make a QR
+ *  for `https:///`. Every reader applies this one rule — `brane meld`
+ *  (`buildMeldUrl`) and `GET /api/status` (`statusAppDomain`) — so a daemon's
+ *  bundle and the QR always agree on where the shared app is. Lives here,
+ *  beside the default it falls back to, so the daemon need not import the
+ *  meld command to read it. */
+export function resolveAppHost(value) {
+    return cleanAppHost(value ?? "") || cleanAppHost(CONFIG_DEFAULTS.app_domain);
+}
 /** Reads a config key. Pass the caller's `db` whenever it has one: the daemon
  *  and every test do. Without it this opens `~/.brane/brane.db` itself — right
  *  for a CLI command, and exactly wrong anywhere else. That fallback is how a

package/dist/commands/meld.js

@@ -4,6 +4,8 @@ import qrcode from "qrcode-terminal";
 import { getDaemonAddress, openDatabase } from "../db/schema.js";
 import { getTailscaleHost } from "../tailscale.js";
 import { connectionFragment } from "../shared/view-url.js";
+import { CONFIG_DEFAULTS, getConfig, resolveAppHost } from "./config.js";
+import { cleanAppHost } from "../shared/app-origin.js";
 import { UNUSED_TOKEN_LAPSE_MS } from "../daemon/token-ring.js";
 import { daemonRequest, resolveDaemonEndpoint, warnIfVersionMismatch, } from "../daemon/client.js";
 /** What the CLI prints before a request the daemon holds for the presence
@@ -64,8 +66,14 @@ export function buildMeldUrl(opts) {
     let path = opts.path ?? "/";
     if (!path.startsWith("/"))
         path = "/" + path;
-    const url = meldLink({ daemonHost, scheme, useLocal }, token, path);
-    return { url, daemonHost, scheme, useLocal, isLoopbackFallback, tlsDegraded };
+    // Where the shared app lives is config, never a literal: a fork sets its
+    // own default (CONFIG_DEFAULTS), an operator sets `app_domain`, and a
+    // one-off `--app` wins over both. The daemon trusts none of them — the
+    // token is the credential — so this only decides which copy of the app
+    // the phone loads.
+    const appHost = resolveAppHost(opts.app ?? getConfig("app_domain", db));
+    const url = meldLink({ daemonHost, scheme, useLocal, appHost }, token, path);
+    return { url, daemonHost, scheme, useLocal, appHost, isLoopbackFallback, tlsDegraded };
 }
 /** A meld URL for `token`, at the daemon `parts` describes. */
 export function meldLink(parts, token, path = "/") {
@@ -75,9 +83,12 @@ export function meldLink(parts, token, path = "/") {
     // the daemon's own request log does not record it. The app reads it from
     // `location.hash` and strips it once it has been used.
     const conn = { host: parts.daemonHost, token };
+    // A remote brane from before `appHost` was part of the connection reply
+    // (readMeldReply) names no shell; this install's default stands in.
+    const appHost = parts.appHost ?? CONFIG_DEFAULTS.app_domain;
     return parts.useLocal
         ? `${parts.scheme}://${parts.daemonHost}${path}${connectionFragment(conn, false)}`
-        : `https://brane.organelle.dev${path}${connectionFragment(conn, true)}`;
+        : `https://${appHost}${path}${connectionFragment(conn, true)}`;
 }
 /** Ask this machine's daemon for a device token for a daemon on another
  *  machine, and its hash. The daemon stores neither, and first asks the
@@ -117,8 +128,16 @@ export function readMeldReply(output) {
             continue;
         if (r.isLoopbackFallback)
             return { kind: "wait", reason: "the remote machine has no Tailscale name yet" };
-        const { ready: _ready, ...connection } = r;
-        return { kind: "address", connection: connection };
+        const { ready: _ready, appHost, ...connection } = r;
+        // A remote that names its shell does so as a string; anything else is
+        // treated as unnamed, and meldLink falls back to this install's default.
+        return {
+            kind: "address",
+            connection: {
+                ...connection,
+                ...(typeof appHost === "string" && appHost ? { appHost: cleanAppHost(appHost) } : {}),
+            },
+        };
     }
     return { kind: "old" };
 }
@@ -216,13 +235,17 @@ async function meldRemote(args) {
         console.error("Run this again once it's up; the token sent this time was never shown, so nothing is lost.");
         process.exit(1);
     }
-    const url = meldLink(connection, token);
+    // The remote daemon's `app_domain` names the shell, unless --app does.
+    const link = args.app ? { ...connection, appHost: cleanAppHost(args.app) } : connection;
+    const url = meldLink(link, token);
     console.log(`\nScan this QR code to meld:\n`);
     qrcode.generate(url, { small: args.small ?? true }, (code) => {
         console.log(code);
     });
     console.log(`\n${url}\n`);
     console.log(`Daemon: ${connection.daemonHost} (${connection.scheme})`);
+    if (!connection.useLocal)
+        console.log(`App: ${link.appHost ?? CONFIG_DEFAULTS.app_domain}`);
     // The clock started with the remote daemon's restart, not now.
     console.log(`This QR is valid for ${UNUSED_TOKEN_LAPSE_MS / 60_000} minutes from the remote daemon's start; once scanned, the device stays signed in until revoked.`);
     if (connection.tlsDegraded) {
@@ -245,7 +268,11 @@ export const meldCommand = defineCommand({
         },
         local: {
             type: "boolean",
-            description: "Generate direct daemon URL instead of brane.organelle.dev",
+            description: "Generate a direct daemon URL instead of the shared app's (see --app)",
+        },
+        app: {
+            type: "string",
+            description: "The shared app's host to point the QR at (default: the `app_domain` config, brane.organelle.dev unless set)",
         },
         connection: {
             type: "boolean",
@@ -278,7 +305,7 @@ export const meldCommand = defineCommand({
             try {
                 const address = getDaemonAddress(db);
                 const reply = address
-                    ? (({ url: _url, ...connection }) => ({ ready: true, ...connection }))(buildMeldUrl({ db, daemon: { port: address.port, token: "" }, host: args.host, local: args.local }))
+                    ? (({ url: _url, ...connection }) => ({ ready: true, ...connection }))(buildMeldUrl({ db, daemon: { port: address.port, token: "" }, host: args.host, local: args.local, app: args.app }))
                     : { ready: false, reason: "no daemon is running yet" };
                 console.log(JSON.stringify(reply));
             }
@@ -300,11 +327,12 @@ export const meldCommand = defineCommand({
         }
         const daemon = { port: endpoint.port, token };
         const db = openDatabase();
-        const { url, daemonHost, scheme, useLocal, isLoopbackFallback, tlsDegraded } = buildMeldUrl({
+        const { url, daemonHost, scheme, useLocal, appHost, isLoopbackFallback, tlsDegraded } = buildMeldUrl({
             db,
             daemon,
             host: args.host,
             local: args.local,
+            app: args.app,
         });
         db.close();
         console.log(`\nScan this QR code to meld:\n`);
@@ -314,7 +342,7 @@ export const meldCommand = defineCommand({
         console.log(`\n${url}\n`);
         console.log(`Daemon: ${daemonHost} (${scheme})`);
         if (!useLocal) {
-            console.log(`App: brane.organelle.dev`);
+            console.log(`App: ${appHost}`);
         }
         console.log(meldLapseNote());
         if (isLoopbackFallback) {

package/dist/commands/spawn.js

@@ -929,7 +929,9 @@ export function doSpawn(opts) {
     return { narrativeId, foldPath, agentType: agent, role };
 }
 /** Set up MCP config and build launch command for an agent in a fold.
- *  Used by revive when switching agent types. */
+ *  Nothing calls this: switching agents on revive goes through
+ *  `doSpawn({ re })`, and a same-agent revive builds its own launch in
+ *  `reviveNarrative`, which has to refresh hook and affinity config itself. */
 export function prepareAgentLaunch(db, agent, narrativeId, foldPath) {
     const agentCommand = resolveAgentCommand(agent);
     const absoluteFoldPath = fromPortablePath(foldPath);
@@ -1017,7 +1019,11 @@ export const spawnCommand = defineCommand({
         },
         "meld-local": {
             type: "boolean",
-            description: "Use a direct daemon URL in the meld output instead of brane.organelle.dev",
+            description: "Use a direct daemon URL in the meld output instead of the shared app's",
+        },
+        "meld-app": {
+            type: "string",
+            description: "The shared app's host for the meld output (default: the `app_domain` config)",
         },
     },
     async run({ args }) {
@@ -1053,12 +1059,13 @@ export const spawnCommand = defineCommand({
                 console.log(`  re: ${args.re}`);
             if (deviceToken) {
                 const meldDb = openDatabase();
-                const { url, daemonHost, scheme, useLocal, isLoopbackFallback, tlsDegraded } = buildMeldUrl({
+                const { url, daemonHost, scheme, useLocal, appHost, isLoopbackFallback, tlsDegraded } = buildMeldUrl({
                     db: meldDb,
                     daemon: { port: endpoint.port, token: deviceToken },
                     path: `/${narrative.id}`,
                     host: args["meld-host"],
                     local: args["meld-local"],
+                    app: args["meld-app"],
                 });
                 meldDb.close();
                 console.log(`\nScan this QR code to open ${narrative.id}:\n`);
@@ -1068,7 +1075,7 @@ export const spawnCommand = defineCommand({
                 console.log(`\n${url}\n`);
                 console.log(`Daemon: ${daemonHost} (${scheme})`);
                 if (!useLocal)
-                    console.log(`App: brane.organelle.dev`);
+                    console.log(`App: ${appHost}`);
                 console.log(meldLapseNote());
                 if (isLoopbackFallback) {
                     console.log("\nNo Tailscale detected — this URL only works from this machine.");

package/dist/commands/token.js

@@ -1,6 +1,7 @@
 import { defineCommand } from "citty";
 import { resolveDaemonEndpoint, daemonRequest, warnIfVersionMismatch, } from "../daemon/client.js";
 import { announcePresenceWait } from "./meld.js";
+import { originHost } from "../shared/app-origin.js";
 /** Sign out every device. One request: this shell holds no token, so there
  *  is none to swap and nothing to confirm — once the operator passes the
  *  presence prompt the daemon revokes every device token before it answers
@@ -67,7 +68,7 @@ export function formatTokenList(tokens) {
                 : "never used";
         const lines = [
             `${t.id}  ${name}${marks.length ? ` [${marks.join("; ")}]` : ""}`,
-            `    "${t.label}", created ${formatTime(t.created_at)}${t.minted_by_device ? ` by ${t.minted_by_device}` : ""}, ${seen}${t.remote_addr ? `, from ${t.remote_addr}` : ""}`,
+            `    "${t.label}", created ${formatTime(t.created_at)}${t.minted_by_device ? ` by ${t.minted_by_device}` : ""}, ${seen}${t.remote_addr ? `, from ${t.remote_addr}` : ""}${t.app_origin ? `, via ${originHost(t.app_origin)}` : ""}`,
         ];
         if (t.descendants?.length)
             lines.push(`    added ${t.descendants.length} device(s): ${t.descendants.join(", ")} (revoke --cascade takes them too)`);