brane 0.3.0 → 0.3.1

package/dist/daemon/server.js

@@ -24,8 +24,8 @@ import { signalEventFields, signalStanding } from "./signal-source.js";
 import { AGENT_LOOPBACK_REFUSAL, AGENT_REVIVE_REFUSAL, agentRefusal, agentReviveRefusal } from "./agent-scope.js";
 import { DbTokenStore, bootstrapTokens, legacyTokenWarning, parseTokenHashes, liveAgentTokenId, mintAgentToken, recordLauncher, settleAgentLaunch, verifyAgentToken } from "../db/tokens.js";
 import { closeSocketsOf, listTokensRoute, socketOwners, retireTokens } from "./token-routes.js";
-import { getConfig } from "../commands/config.js";
-import { doSpawn, buildGooseExtensionArg, reestablishMcpConfigArgs, braneTmuxEnv, resolveAgentCommand, LIVE_LOOP_PROMPT } from "../commands/spawn.js";
+import { getConfig, resolveAppHost } from "../commands/config.js";
+import { doSpawn, buildGooseExtensionArg, reestablishMcpConfigArgs, braneTmuxEnv, ensureHookConfig, resolveAgentCommand, LIVE_LOOP_PROMPT } from "../commands/spawn.js";
 import { ensureSessionAffinityConfig } from "../session-affinity.js";
 import { revivedContent, restartedContent } from "../shared/narrative-format.js";
 import { parseRecolorSalt } from "../shared/speaker-color.js";
@@ -47,7 +47,7 @@ import { getTailscaleIps, getTailscaleIpsAsync } from "../tailscale.js";
 import { addressesToBind, nextProbeDelay, TAILSCALE_PROBE_MAX_MS } from "./tailscale-rebind.js";
 import { CertManager } from "./cert-manager.js";
 import { KeepAwake } from "./keep-awake.js";
-import { resolveTmux, ensureTmux, newTmuxSession } from "../tmux.js";
+import { resolveTmux, ensureTmux, newTmuxSession, parseTerminalSize } from "../tmux.js";
 import { INHERITED_AGENT_ENV, unsetAgentEnvPrefix } from "../agent-env.js";
 import { highlight } from "../highlight.js";
 import { browseFold, openFoldSource, parseOffsetParam } from "../files/browse.js";
@@ -191,6 +191,13 @@ export function reviveNarrative(db, nid, opts = {}) {
         return { status: "continued", nid: result.narrativeId, agent: effectiveAgent };
     }
     // Same agent — use resume args
+    // Point the fold's tool-call hooks at this daemon before anything else can
+    // fail. The config names a port, and a daemon that came back on another
+    // one (its old port was taken, or a Fly boot cleared the hint) leaves it
+    // naming a dead one: every tool call then fails its hook, and the chat
+    // stops showing tool rows. doSpawn does this for fresh sessions; a revive
+    // builds its launch here, so it has to as well (claude-nkrks0of:23).
+    ensureHookConfig(db, effectiveAgent, absoluteFoldPath, nid);
     const agentCommand = resolveAgentCommand(effectiveAgent);
     // The revived session's agent token. Minted with the previous one left
     // live until the launch succeeds (settleAgentLaunch, below): a revive that
@@ -306,74 +313,47 @@ export function reviveNarrative(db, nid, opts = {}) {
     }
     return { status: "revived", nid, agent: effectiveAgent };
 }
-function isLocalhostOrigin(origin) {
-    try {
-        const url = new URL(origin);
-        return url.hostname === "localhost" || url.hostname === "127.0.0.1";
-    }
-    catch {
-        return false;
-    }
-}
-function isAppDomainOrigin(origin, appDomain) {
-    try {
-        const url = new URL(origin);
-        // Match exact domain or any subdomain
-        return url.hostname === appDomain || url.hostname.endsWith(`.${appDomain}`);
-    }
-    catch {
-        return false;
-    }
-}
-function isSameOrigin(origin, ...serverPorts) {
-    try {
-        const url = new URL(origin);
-        const originPort = parseInt(url.port, 10);
-        return serverPorts.some((p) => originPort === p);
-    }
-    catch {
-        return false;
-    }
-}
-function isTailscaleOrigin(origin) {
-    try {
-        const url = new URL(origin);
-        return url.hostname.endsWith(".ts.net");
-    }
-    catch {
-        return false;
-    }
-}
-function isAllowedOrigin(origin, appDomain, ...serverPorts) {
-    if (isLocalhostOrigin(origin))
-        return true;
-    if (isSameOrigin(origin, ...serverPorts))
-        return true;
-    if (isAppDomainOrigin(origin, appDomain))
-        return true;
-    if (isTailscaleOrigin(origin))
-        return true;
-    return false;
+/** What `GET /api/status` reports as `app_domain`: the config, reduced to a
+ *  host exactly as `brane meld` reduces it (`resolveAppHost`), so an operator
+ *  who stored it as a URL (`brane config app_domain https://staging.example/`)
+ *  gets a working Isolate link from a daemon's bundle rather than
+ *  `https://https://…`, and a blank value means the default on both sides.
+ *  The app reads a missing field, from a daemon older than this, as "no way
+ *  out". */
+export function statusAppDomain(db) {
+    return resolveAppHost(getConfig("app_domain", db));
 }
-export function setCorsHeaders(req, res, appDomain, ...serverPorts) {
-    const origin = req.headers.origin;
-    if (origin && isAllowedOrigin(origin, appDomain, ...serverPorts)) {
-        res.setHeader("Access-Control-Allow-Origin", origin);
-        res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
-        res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-        res.setHeader("Access-Control-Allow-Credentials", "true");
-        // How long the browser may reuse this preflight's answer. Without it
-        // Chrome caches for 5 seconds, which on a fast link is indistinguishable
-        // from caching forever and on a slow one is indistinguishable from not
-        // caching at all: nearly every request pays its own extra round trip.
-        // Measured at 741ms RTT that was fatal rather than merely slow — see the
-        // note on `apiUrl` in expo/lib/api.ts. The bodiless requests avoid the
-        // preflight entirely now; this is for the ones that carry JSON and can't.
-        // A day is the practical ceiling (Chrome caps at 2h, Firefox 24h), and
-        // the answer being cached is safe: it does not authenticate anything,
-        // it only says which methods and headers this origin may use.
-        res.setHeader("Access-Control-Max-Age", "86400");
-    }
+/** CORS for a browser on any origin. The token is the only credential, so
+ *  the origin is not a trust decision: a page holding no token gets a 401
+ *  whatever its origin, and a page holding one can act with it from any
+ *  origin regardless of what is answered here — `?token=` is taken on any
+ *  method and bodies are parsed as JSON whatever their `Content-Type`, so a
+ *  `text/plain` POST needs no preflight. An origin allowlist would only
+ *  hide responses and refuse WebSockets. So the answer is `*`, never a
+ *  reflected origin, and never `Allow-Credentials`: brane sets no cookies,
+ *  and credentials with a reflected origin is the one CORS combination that
+ *  could ever be dangerous. This is what lets one daemon be fronted
+ *  by `brane.organelle.dev`, a staging hostname, a fork's own deployment, or
+ *  its own bundle, with nothing to configure. Which origin a device actually
+ *  runs is recorded on its token and shown in the Devices list, not gated
+ *  here (SECURITY.md, "Authentication"). */
+export function setCorsHeaders(req, res) {
+    if (req.headers.origin === undefined)
+        return;
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    // How long the browser may reuse this preflight's answer. Without it
+    // Chrome caches for 5 seconds, which on a fast link is indistinguishable
+    // from caching forever and on a slow one is indistinguishable from not
+    // caching at all: nearly every request pays its own extra round trip.
+    // Measured at 741ms RTT that was fatal rather than merely slow — see the
+    // note on `apiUrl` in expo/lib/api.ts. The bodiless requests avoid the
+    // preflight entirely now; this is for the ones that carry JSON and can't.
+    // A day is the practical ceiling (Chrome caps at 2h, Firefox 24h), and
+    // the answer being cached is safe: it does not authenticate anything,
+    // it only says which methods and headers a page may use.
+    res.setHeader("Access-Control-Max-Age", "86400");
 }
 /** Below this, compressing costs more than it saves — a gzip header is 20-odd
  *  bytes and the CPU is not free. Above it, JSON of brane's shape compresses
@@ -616,9 +596,11 @@ export function isLoopbackRequest(req) {
  *  list can tell rows apart. */
 export function authenticateRequest(ring, presented, req, braneDir, onTrust, now = Date.now()) {
     const userAgent = req.headers["user-agent"];
+    const origin = req.headers.origin;
     const seen = {
         userAgent: typeof userAgent === "string" ? userAgent : null,
         remoteAddr: connectionLabel(req.socket),
+        origin: typeof origin === "string" ? origin : null,
     };
     if (!presented && isUnixConnection(req.socket)) {
         const refusal = tokenlessRefusal(req, braneDir);
@@ -794,7 +776,6 @@ export async function startServer(config) {
         return refusal;
     };
     const braneId = getBraneId(db);
-    const appDomain = getConfig("app_domain", db) ?? "brane.organelle.dev";
     let actualPort = port; // updated after bind when port is 0
     let actualHttpPort = 0; // HTTP fallback port (set when httpServer binds)
     // TLS cert lifecycle. CertManager owns provisioning, renewal, fs.watch,
@@ -1175,7 +1156,7 @@ export async function startServer(config) {
         // response — including the early auth and error exits — can see whether
         // the client accepts gzip.
         trackRequest(res, req);
-        setCorsHeaders(req, res, appDomain, actualPort, actualHttpPort);
+        setCorsHeaders(req, res);
         // Handle CORS preflight
         if (req.method === "OPTIONS") {
             res.writeHead(204);
@@ -1300,6 +1281,12 @@ export async function startServer(config) {
                 // Listening on the address over HTTPS, but the HTTP fallback (the
                 // local/LAN path) is not up there yet.
                 fallback_missing: [...needFallback],
+                // The hostname that serves the shared app: where `brane meld` points
+                // a QR, and where a daemon's own bundle offers to hop *out* to
+                // (Isolate's way back). The app reads it from here rather than
+                // carrying a host of its own, so a fork's daemon names the fork's
+                // shell (src/shared/view-url.ts).
+                app_domain: statusAppDomain(db),
             });
             return;
         }
@@ -2016,7 +2003,7 @@ export async function startServer(config) {
         // Route: POST /api/spawn
         if (path === "/api/spawn" && req.method === "POST") {
             parseBody(req).then(async (body) => {
-                const { agent, role, model, re, fold_path, extra_args } = JSON.parse(body);
+                const { agent, role, model, re, fold_path, extra_args, terminal_size } = JSON.parse(body);
                 if (!agent) {
                     sendJson(res, 400, { error: "agent is required" });
                     return;
@@ -2035,7 +2022,11 @@ export async function startServer(config) {
                         extraArgs = extra_args;
                 }
                 await ensureTmux();
-                const result = doSpawn({ db, agent, role, model, re, foldPath: fold_path, extraArgs, terminalSize: lastTerminalSize ?? undefined });
+                // Start at the requesting viewer's grid when it sent one: a session
+                // resized right after launch redraws at each width, and the stale
+                // frames land in the scrollback the mirror shows.
+                const terminalSize = parseTerminalSize(terminal_size) ?? lastTerminalSize ?? undefined;
+                const result = doSpawn({ db, agent, role, model, re, foldPath: fold_path, extraArgs, terminalSize });
                 recordLauncher(db, result.narrativeId, auth.record.id);
                 const connectedNids = mcpConnectedNids(mcpClients);
                 sendJson(res, 200, {
@@ -2060,7 +2051,7 @@ export async function startServer(config) {
         // Route: POST /api/run
         if (path === "/api/run" && req.method === "POST") {
             parseBody(req).then(async (body) => {
-                const { command, fold_path } = JSON.parse(body);
+                const { command, fold_path, terminal_size } = JSON.parse(body);
                 if (!command || !Array.isArray(command) || command.length === 0) {
                     sendJson(res, 400, { error: "command is required (array of strings)" });
                     return;
@@ -2070,7 +2061,8 @@ export async function startServer(config) {
                     return;
                 }
                 await ensureTmux();
-                const result = doRun({ db, command, foldPath: fold_path, terminalSize: lastTerminalSize ?? undefined });
+                const terminalSize = parseTerminalSize(terminal_size) ?? lastTerminalSize ?? undefined;
+                const result = doRun({ db, command, foldPath: fold_path, terminalSize });
                 recordLauncher(db, result.narrativeId, auth.record.id);
                 sendJson(res, 200, {
                     narrative: {
@@ -2612,13 +2604,10 @@ export async function startServer(config) {
         }
         if (auth.retired)
             finishRotation({ retired: auth.retired });
-        // Origin check
-        const origin = req.headers.origin;
-        if (origin && !isAllowedOrigin(origin, appDomain, actualPort, actualHttpPort)) {
-            socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
-            socket.destroy();
-            return;
-        }
+        // No Origin check: the token above is the credential, and the origin it
+        // was presented from is now on its row for the Devices list to show
+        // (`authenticateRequest`). Every browser sends one on an upgrade, so
+        // this is the request that names which copy of the app a device runs.
         // WS: /ws/control — single real-time channel
         if (path === "/ws/control") {
             controlWss.handleUpgrade(req, socket, head, (ws) => {
@@ -2796,7 +2785,6 @@ export async function startServer(config) {
             console.warn("[socket] not listening: this machine's shell (the brane CLI outside an agent session) and new external MCP clients " +
                 "cannot reach this daemon; agents and signed-in devices still can");
         }
-        console.log(`app domain: ${appDomain}`);
         console.log(`pid: ${process.pid}`);
         // Eagerly load the embedding model so first search is fast
         preloadEmbeddingModel();
@@ -6146,6 +6134,9 @@ function handleTerminalSocket(ws, nid) {
                 case "mouse":
                     sendMouseToTmux(nid, msg);
                     break;
+                case "clear_history":
+                    clearTerminalHistory(nid);
+                    break;
                 case "refresh": {
                     // Client requests a clean full frame. The client has just wiped its
                     // <pre> DOM, so if we wait for `forceCapture()` alone the capture
@@ -6224,6 +6215,19 @@ function fitWindowToViewers(nid) {
     cap.appliedSize = { cols, rows };
     resizeTerminal(nid, cols, rows);
 }
+// The operator's "Clear scrollback": drop the pane's tmux history and leave
+// the live screen alone. Scrollback is where a TUI's stale redraws pile up —
+// Claude's trust dialog drawn at three widths before the session settled, its
+// full-width rules now wider than the pane — and the mirror shows all of it
+// (`capture-pane -S -`). Only ever on an explicit request, since it throws
+// that history away. The forced capture sends the shorter frame at once; the
+// client trims to `totalLines`, so the stale lines go with it.
+function clearTerminalHistory(nid) {
+    execFile(resolveTmux(), ["clear-history", "-t", nid], { timeout: 2000 }, (err) => {
+        if (!err)
+            terminalCaptures.get(nid)?.forceCapture();
+    });
+}
 function resizeTerminal(nid, cols, rows) {
     if (!cols || !rows || cols < 1 || rows < 1)
         return;

package/dist/db/schema.js

@@ -439,6 +439,16 @@ export function applyMigrations(db) {
     if (!tokenCols.has("owner_nid")) {
         db.exec("ALTER TABLE tokens ADD COLUMN owner_nid TEXT");
     }
+    // The `Origin` a token was first presented from, and the latest: which
+    // copy of the app a device runs (a hosted one, or a daemon's own). The
+    // origin is reported, never gated — the token is the credential — so this
+    // is what lets the Devices list say "via main.brane.organelle.dev".
+    if (!tokenCols.has("app_origin")) {
+        db.exec("ALTER TABLE tokens ADD COLUMN app_origin TEXT");
+    }
+    if (!tokenCols.has("last_app_origin")) {
+        db.exec("ALTER TABLE tokens ADD COLUMN last_app_origin TEXT");
+    }
     // Which token's request last launched a narrative's process (spawn, run or
     // revive), so revoking a device can say which agents it started. Recorded
     // from now on; there is nothing to backfill it from.

package/dist/db/tokens.js

@@ -10,6 +10,18 @@ import { hashToken, LEGACY_TOKEN_LABEL, UNUSED_TOKEN_LAPSE_MS, } from "../daemon
 /** A user agent is shown in a devices list and nowhere else; past this it is
  *  noise, and an unbounded header is not something to keep forever. */
 const MAX_USER_AGENT_LENGTH = 512;
+/** An `Origin` is `scheme://host[:port]`; anything longer than this is not
+ *  one a browser sent. */
+const MAX_ORIGIN_LENGTH = 256;
+/** An `Origin` header as it may be stored. The literal `null` is what a
+ *  browser sends for an opaque origin (a sandboxed iframe, a `file://` page,
+ *  some cross-origin redirects): it names nothing, and stored it would read
+ *  "via null" for good, since the first origin is never overwritten. So it
+ *  counts as no origin at all. */
+function cleanOrigin(value) {
+    const clean = cleanSighting(value, MAX_ORIGIN_LENGTH);
+    return clean === "null" ? null : clean;
+}
 /** A header or address as it may be stored and shown: control characters
  *  become spaces (a newline in a list is a forged row), capped, or null. */
 function cleanSighting(value, max) {
@@ -130,7 +142,7 @@ export function adoptBindTokens(db, now = Date.now(), only) {
 const TOUCH_INTERVAL_MS = 60_000;
 export { LEGACY_TOKEN_LABEL };
 const ROW_COLUMNS = "id, kind, label, origin, created_at, last_used_at, user_agent, remote_addr, " +
-    "last_user_agent, last_remote_addr, elsewhere_at, minted_by, owner_nid";
+    "last_user_agent, last_remote_addr, app_origin, last_app_origin, elsewhere_at, minted_by, owner_nid";
 /** `ROW_COLUMNS` qualified as `t.`, plus what the minting token is, for the list. */
 const LISTING_COLUMNS = ROW_COLUMNS.split(", ").map((c) => `t.${c}`).join(", ") +
     ", m.kind AS minted_by_kind, m.user_agent AS minted_by_user_agent";
@@ -188,6 +200,18 @@ export class DbTokenStore {
                 }
                 catch { }
         }
+        // The origin is sighted on its own, not with the user agent and address:
+        // the first request to present a token is often a same-origin GET, which
+        // carries no Origin, so it is the first request that *has* one — in
+        // practice the control socket's upgrade — that names the app. Written
+        // once, like the sighting, and best-effort, like everything here.
+        const origin = seen ? cleanOrigin(seen.origin) : null;
+        if (origin !== null && row.app_origin === null) {
+            try {
+                this.recordOrigin(row.id, origin);
+            }
+            catch { }
+        }
         // The first sighting names the row; the latest, and whether it came from
         // somewhere else, is what shows a copied token. An address is the one
         // thing about a request its sender cannot choose, so it is what's compared.
@@ -204,9 +228,10 @@ export class DbTokenStore {
                     .prepare(`UPDATE tokens SET last_used_at = ?,
                last_user_agent = COALESCE(?, last_user_agent),
                last_remote_addr = COALESCE(?, last_remote_addr),
+               last_app_origin = COALESCE(?, last_app_origin),
                elsewhere_at = CASE WHEN ? THEN ? ELSE elsewhere_at END
              WHERE id = ?`)
-                    .run(now, userAgent, remoteAddr, elsewhere ? 1 : 0, now, row.id);
+                    .run(now, userAgent, remoteAddr, origin, elsewhere ? 1 : 0, now, row.id);
                 this.touched.set(row.id, now);
                 if (elsewhere)
                     this.elsewhereStamped.set(row.id, now);
@@ -237,8 +262,24 @@ export class DbTokenStore {
                     this.sighted.add(record.id);
             }
             catch { }
+        if (opts.seen) {
+            const origin = cleanOrigin(opts.seen.origin);
+            if (origin !== null)
+                try {
+                    this.recordOrigin(record.id, origin);
+                }
+                catch { }
+        }
         return record;
     }
+    /** Write a row's first origin, if it has none; the latest rides with
+     *  `last_used_at`. Never overwrites one, for the same reason as the
+     *  sighting: the row keeps naming the app that claimed it. */
+    recordOrigin(id, origin) {
+        this.db
+            .prepare("UPDATE tokens SET app_origin = ?, last_app_origin = COALESCE(last_app_origin, ?) WHERE id = ? AND app_origin IS NULL")
+            .run(origin, origin, id);
+    }
     /** Write a row's first sighting, if it has none. Never overwrites one: the
      *  row should keep naming the device that first presented it, not whoever
      *  presents it next. Returns whether anything was written. */

package/dist/shared/app-origin.js

@@ -0,0 +1,26 @@
+/** An `Origin` header as a Devices list shows it: the host, port included
+ *  when it has one, without the scheme. `https://main.brane.organelle.dev`
+ *  reads "via main.brane.organelle.dev"; a daemon's own bundle reads "via
+ *  mac.tail1234.ts.net:47443". Anything that is not a URL is shown as it
+ *  came (already stripped of control characters by the store). */
+export function originHost(origin) {
+    try {
+        return new URL(origin).host || origin;
+    }
+    catch {
+        return origin;
+    }
+}
+/** A host as `app_domain` or `--app` may give it: a bare host, or a URL whose
+ *  host is taken (`https://main.brane.organelle.dev/` reads as the host), with
+ *  a port kept if there is one, lower-cased. Every reader of `app_domain`
+ *  goes through this — `brane meld`, `GET /api/status`, the app — so a value
+ *  stored in URL form by `brane config` builds the same link everywhere,
+ *  rather than a QR that works beside an Isolate link that reads
+ *  `https://https://…`. Empty in, empty out. */
+export function cleanAppHost(value) {
+    const trimmed = value.trim();
+    const m = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i.exec(trimmed);
+    return (m ? m[1] : trimmed.replace(/[/?#].*$/, "")).toLowerCase();
+}
+//# sourceMappingURL=app-origin.js.map

package/dist/shared/narrative-menu.js

@@ -20,7 +20,7 @@
 export function revivesAsTwin(role) {
     return role === "external" || role === "absorbed";
 }
-export function narrativeMenuItems({ role, status, mcpConnected, archived = false, isIsolated = false, selectedCount = 0, onMeld, onIsolate, onExport, onRecolor, onTwin, onRevive, onEnd, onArchiveToggle, }) {
+export function narrativeMenuItems({ role, status, mcpConnected, archived = false, isIsolated = false, canIsolate = true, selectedCount = 0, onMeld, onIsolate, onExport, onRecolor, onTwin, onRevive, onEnd, onArchiveToggle, }) {
     const isEnded = status === "ended" && !mcpConnected;
     // External narratives have no tmux process — no in-place End/Revive applies;
     // their only lifecycle action is Twin (continue into a brane-managed agent).
@@ -30,11 +30,13 @@ export function narrativeMenuItems({ role, status, mcpConnected, archived = fals
     const isExternal = role === "external";
     return [
         { icon: "🖖", label: "Meld", onPress: onMeld },
-        {
-            icon: isIsolated ? "🏘️" : "🏠",
-            label: isIsolated ? "Unisolate" : "Isolate",
-            onPress: onIsolate,
-        },
+        ...(canIsolate
+            ? [{
+                    icon: isIsolated ? "🏘️" : "🏠",
+                    label: isIsolated ? "Unisolate" : "Isolate",
+                    onPress: onIsolate,
+                }]
+            : []),
         // With a selection, Export becomes two items — the picks, or everything but
         // the picks — because a selection is as often "these are the interesting
         // ones" as "these are the ones nobody else should read". Both items name

package/dist/shared/view-url.js

@@ -4,8 +4,8 @@
  *  This lives in `shared/` rather than in the screen that uses it because the
  *  URL is the only carrier of view state between two *origins*. Tab layout and
  *  last-visited file are also kept in `sessionStorage`, which is origin-scoped,
- *  and the Isolate menu item hops between `brane.organelle.dev` and a daemon's
- *  own host —
+ *  and the Isolate menu item hops between the shared app's origin and a
+ *  daemon's own host —
  *  so whatever isn't in the query string does not survive the jump. Keeping
  *  the serialization and the link builder in one pure module means the URL you
  *  get from tapping around and the URL Isolate hands the other origin are the
@@ -15,14 +15,17 @@
  *  matter what order they were toggled in, so a URL is stable. */
 export const CANONICAL_TABS = ["chat", "terminal", "files"];
 const VALID_TABS = new Set(CANONICAL_TABS);
-/** The multi-daemon SPA, which can be melded to any number of daemons. Every
- *  other host is a single daemon serving its own bundle. */
-export const SHARED_SPA_HOST = "brane.organelle.dev";
-/** True when this page is a single daemon's own bundle rather than the shared
- *  SPA — i.e. when "isolated" is the *current* state and the menu offers the
- *  way back out. */
-export function isIsolatedHost(hostname) {
-    return hostname !== SHARED_SPA_HOST;
+/** True when this page is served by the daemon it is connected to — a
+ *  daemon's own bundle — so "isolated" is the *current* state and the menu
+ *  offers the way back out. Everything else is a shared app: the hosted
+ *  shell, a staging hostname, a fork's deployment, a dev server. The app
+ *  carries no host of its own, so this is a comparison with no constant in
+ *  it: `window.location.host` against the connection's host, which a
+ *  daemon's bundle fills from the same `location.host` (expo/lib/api.ts).
+ *  Hosts are case-insensitive; the port is part of the answer, since a
+ *  daemon's bundle is reached on its port. */
+export function isIsolated(pageHost, daemonHost) {
+    return pageHost.toLowerCase() === daemonHost.toLowerCase();
 }
 export function parseActiveTab(tab) {
     return VALID_TABS.has(tab) ? tab : "chat";
@@ -128,7 +131,7 @@ export function withoutConnectionHash(hash) {
 /** Where a link puts the daemon's address and token: the URL **fragment**.
  *
  *  A query string is part of the HTTP request, so `?host=…&token=…` on a
- *  `brane.organelle.dev` link reached Cloudflare's edge with the daemon's
+ *  shared-app link reached its host's edge with the daemon's
  *  bearer token in it, landed in the daemon's own request log on an Isolate
  *  hop, and was fetched by every chat app's link unfurler when a meld URL was
  *  pasted. A fragment is never sent to any server: the browser keeps it, the
@@ -173,25 +176,41 @@ export function buildViewUrl(target, opts) {
     const query = params.toString();
     const rest = (query ? `?${query}` : "") + connectionFragment(conn, target === "shared");
     if (target === "shared") {
-        // The shared SPA serves every daemon, so it has to be told which one.
-        return `https://${SHARED_SPA_HOST}${path}${rest}`;
+        // A shared app serves every daemon, so it has to be told which one.
+        const origin = sharedOrigin(opts);
+        return origin === null ? null : `${origin}${path}${rest}`;
     }
     // A daemon's own bundle already knows which daemon it is; only the token is
     // needed. The scheme follows the page building the link, so a plain-http LAN
     // session doesn't hand out https links that won't load.
-    const scheme = protocol === "https:" ? "https" : "http";
-    return `${scheme}://${conn.host}${path}${rest}`;
+    return `${pageScheme(protocol)}://${conn.host}${path}${rest}`;
+}
+function pageScheme(protocol) {
+    return protocol === "https:" ? "https" : "http";
+}
+/** The shared app's origin, from where this page stands. On a shared app it
+ *  is this page's own origin, scheme included (a dev server is plain http).
+ *  On a daemon's own bundle it is whatever the daemon reports as its
+ *  `app_domain`, over https, since that is a hosted shell; with none
+ *  reported there is no shared origin to name, and the answer is null. */
+function sharedOrigin(opts) {
+    if (!isIsolated(opts.host, opts.conn.host))
+        return `${pageScheme(opts.protocol)}://${opts.host}`;
+    return opts.appHost ? `https://${opts.appHost}` : null;
 }
 /** Isolate / Unisolate: the same view, on the *other* kind of origin. Which
- *  way it goes is just where you are now. */
+ *  way it goes is just where you are now. Null only from a daemon's own
+ *  bundle that was told no `appHost`: there is nowhere to hop out to, and
+ *  the menu should say so rather than offer a link. */
 export function buildIsolateUrl(opts) {
-    return buildViewUrl(isIsolatedHost(opts.hostname) ? "shared" : "daemon", opts);
+    return buildViewUrl(isIsolated(opts.host, opts.conn.host) ? "shared" : "daemon", opts);
 }
 /** Meld: the same view, on another *device*. The origin kind is the one thing
  *  that must not change — someone reaching the daemon directly can't be handed
- *  a shared-SPA link, and someone on the shared app expects to stay there — so
- *  where Isolate flips, this stays put. */
+ *  a shared-app link, and someone on a shared app expects to stay on *that*
+ *  one — so where Isolate flips, this stays put. It never needs `appHost`:
+ *  the shared origin it names is the page's own, so it is never null. */
 export function buildMeldUrl(opts) {
-    return buildViewUrl(isIsolatedHost(opts.hostname) ? "daemon" : "shared", opts);
+    return buildViewUrl(isIsolated(opts.host, opts.conn.host) ? "daemon" : "shared", opts);
 }
 //# sourceMappingURL=view-url.js.map

package/dist/test/app-host-literal.test.js

@@ -0,0 +1,53 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+// The app carries no host of its own. "Isolated" is `location.host` against
+// the connection's host; where a daemon's bundle hops out to is what the
+// daemon reports (`app_domain` in GET /api/status); `brane meld` reads the
+// same config. So any brane host spelled out in the app or in `src/shared/`
+// is a dependency creeping back in, and this is what keeps it out. A literal
+// in a comment is an example, not a dependency, so comments are stripped
+// before the scan. The one legitimate literal is the absolute `og:image`
+// URL in the HTML template, which docs/link-previews.md explains.
+//
+// This reads *source*, which the npm tarball does not carry, so it skips when
+// the source is absent rather than failing `brane doctor` on every install.
+const root = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const SCAN = ["src/shared", "expo/app", "expo/lib", "expo/components"];
+const ALLOWED = new Set(["expo/app/+html.tsx"]);
+const HOST = /\borganelle\.dev\b/;
+function* files(dir) {
+    for (const name of readdirSync(dir)) {
+        const p = join(dir, name);
+        if (statSync(p).isDirectory())
+            yield* files(p);
+        else if (/\.(ts|tsx)$/.test(name))
+            yield p;
+    }
+}
+function withoutComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+}
+describe("the app names no brane host", () => {
+    it("has no organelle.dev literal in src/shared or the app, outside comments and the og:image tag", (t) => {
+        if (!SCAN.every((d) => existsSync(join(root, d))))
+            return t.skip("source is not present (an installed package)");
+        const offenders = [];
+        for (const dir of SCAN) {
+            for (const file of files(join(root, dir))) {
+                const rel = relative(root, file);
+                if (ALLOWED.has(rel))
+                    continue;
+                const code = withoutComments(readFileSync(file, "utf-8"));
+                code.split("\n").forEach((line, i) => {
+                    if (HOST.test(line))
+                        offenders.push(`${rel}:${i + 1}: ${line.trim()}`);
+                });
+            }
+        }
+        assert.deepEqual(offenders, [], "a host literal outside a comment:\n" + offenders.join("\n"));
+    });
+});
+//# sourceMappingURL=app-host-literal.test.js.map