brane 0.3.0 → 0.3.2

package/dist/test/app-host-literal.test.js

@@ -0,0 +1,53 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+// The app carries no host of its own. "Isolated" is `location.host` against
+// the connection's host; where a daemon's bundle hops out to is what the
+// daemon reports (`app_domain` in GET /api/status); `brane meld` reads the
+// same config. So any brane host spelled out in the app or in `src/shared/`
+// is a dependency creeping back in, and this is what keeps it out. A literal
+// in a comment is an example, not a dependency, so comments are stripped
+// before the scan. The one legitimate literal is the absolute `og:image`
+// URL in the HTML template, which docs/link-previews.md explains.
+//
+// This reads *source*, which the npm tarball does not carry, so it skips when
+// the source is absent rather than failing `brane doctor` on every install.
+const root = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const SCAN = ["src/shared", "expo/app", "expo/lib", "expo/components"];
+const ALLOWED = new Set(["expo/app/+html.tsx"]);
+const HOST = /\borganelle\.dev\b/;
+function* files(dir) {
+    for (const name of readdirSync(dir)) {
+        const p = join(dir, name);
+        if (statSync(p).isDirectory())
+            yield* files(p);
+        else if (/\.(ts|tsx)$/.test(name))
+            yield p;
+    }
+}
+function withoutComments(source) {
+    return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:"'`])\/\/.*$/gm, "$1");
+}
+describe("the app names no brane host", () => {
+    it("has no organelle.dev literal in src/shared or the app, outside comments and the og:image tag", (t) => {
+        if (!SCAN.every((d) => existsSync(join(root, d))))
+            return t.skip("source is not present (an installed package)");
+        const offenders = [];
+        for (const dir of SCAN) {
+            for (const file of files(join(root, dir))) {
+                const rel = relative(root, file);
+                if (ALLOWED.has(rel))
+                    continue;
+                const code = withoutComments(readFileSync(file, "utf-8"));
+                code.split("\n").forEach((line, i) => {
+                    if (HOST.test(line))
+                        offenders.push(`${rel}:${i + 1}: ${line.trim()}`);
+                });
+            }
+        }
+        assert.deepEqual(offenders, [], "a host literal outside a comment:\n" + offenders.join("\n"));
+    });
+});
+//# sourceMappingURL=app-host-literal.test.js.map

package/dist/test/archive-gate.test.js

@@ -0,0 +1,22 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { archiveRefusal } from "../daemon/archive-gate.js";
+const ended = { status: "ended", mcpConnected: false, tmuxLive: false };
+describe("archiveRefusal", () => {
+    it("allows an ended narrative with nothing running", () => {
+        assert.equal(archiveRefusal(ended), null);
+    });
+    it("refuses a narrative whose status is not ended", () => {
+        assert.ok(archiveRefusal({ ...ended, status: "active" }));
+        assert.ok(archiveRefusal({ ...ended, status: null }));
+    });
+    it("refuses an ended row with an agent still on the bridge", () => {
+        // The stale row the menu also treats as running: hiding it would hide a
+        // live agent.
+        assert.match(archiveRefusal({ ...ended, mcpConnected: true }) ?? "", /connected/);
+    });
+    it("refuses an ended row whose tmux session is still up", () => {
+        assert.match(archiveRefusal({ ...ended, tmuxLive: true }) ?? "", /running/);
+    });
+});
+//# sourceMappingURL=archive-gate.test.js.map

package/dist/test/cors-preflight.test.js

@@ -12,37 +12,44 @@ function exchange(origin) {
     };
     return { req, res, headers };
 }
-const APP_DOMAIN = "brane.organelle.dev";
-describe("CORS preflight caching", () => {
-    test("an allowed origin is told how long it may reuse the answer", () => {
+describe("CORS: the token is the credential, not the origin", () => {
+    test("any origin is answered the same way, and no origin is reflected", () => {
+        // The daemon does not care which hostname serves the app: the hosted
+        // shell, a staging hostname, a fork's deployment, its own bundle. A page
+        // with no token gets a 401 whatever its origin, and a page with one has
+        // the standing of curl with that token. So the answer is `*` for all of
+        // them — never the request's own origin echoed back, which with
+        // credentials would be the one dangerous combination.
+        for (const origin of ["https://brane.organelle.dev", "https://main.brane.organelle.dev", "https://fork.example", "http://localhost:8081"]) {
+            const { req, res, headers } = exchange(origin);
+            setCorsHeaders(req, res);
+            assert.equal(headers.get("access-control-allow-origin"), "*", origin);
+            assert.match(headers.get("access-control-allow-methods") ?? "", /GET/);
+            assert.match(headers.get("access-control-allow-headers") ?? "", /Authorization/);
+        }
+    });
+    test("credentials are never allowed", () => {
+        // Brane sets no cookies, so the header would grant nothing — except that
+        // a browser refuses `*` for a credentialed request, which is the guard
+        // worth keeping. Sending `Allow-Credentials: true` would turn it off.
+        const { req, res, headers } = exchange("https://brane.organelle.dev");
+        setCorsHeaders(req, res);
+        assert.equal(headers.get("access-control-allow-credentials"), undefined);
+    });
+    test("a preflight answer may be reused for at least an hour", () => {
         // Without this header Chrome caches a preflight for 5 seconds, which on a
         // fast link is indistinguishable from caching forever and on a slow one is
         // indistinguishable from not caching at all — every request pays its own
         // extra round trip. At 741ms RTT that was fatal rather than merely slow.
-        const { req, res, headers } = exchange(`https://${APP_DOMAIN}`);
-        setCorsHeaders(req, res, APP_DOMAIN, 8080);
+        const { req, res, headers } = exchange("https://brane.organelle.dev");
+        setCorsHeaders(req, res);
         const maxAge = headers.get("access-control-max-age");
         assert.ok(maxAge, "preflight answers must be cacheable");
         assert.ok(Number(maxAge) >= 3600, `max-age ${maxAge} is too short to spare a slow link repeated preflights`);
     });
-    test("the rest of the CORS contract is unchanged", () => {
-        const { req, res, headers } = exchange(`https://${APP_DOMAIN}`);
-        setCorsHeaders(req, res, APP_DOMAIN, 8080);
-        assert.equal(headers.get("access-control-allow-origin"), `https://${APP_DOMAIN}`);
-        assert.match(headers.get("access-control-allow-methods") ?? "", /GET/);
-        assert.match(headers.get("access-control-allow-headers") ?? "", /Authorization/);
-        assert.equal(headers.get("access-control-allow-credentials"), "true");
-    });
-    test("a disallowed origin is told nothing at all", () => {
-        // Caching must not become a way to hand headers to an origin that would
-        // otherwise have been refused.
-        const { req, res, headers } = exchange("https://evil.example.com");
-        setCorsHeaders(req, res, APP_DOMAIN, 8080);
-        assert.equal(headers.size, 0);
-    });
     test("a request with no Origin gets no CORS headers", () => {
         const { req, res, headers } = exchange();
-        setCorsHeaders(req, res, APP_DOMAIN, 8080);
+        setCorsHeaders(req, res);
         assert.equal(headers.size, 0);
     });
 });

package/dist/test/hook-config.test.js

@@ -2,9 +2,10 @@ import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { mkdtempSync, readFileSync, existsSync, writeFileSync, mkdirSync, statSync, chmodSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createTestDb } from "./helpers.js";
 import { ensureClaudeHookConfig, ensureGooseHookConfig, ensureClineHookConfig, ensureHookConfig, } from "../commands/spawn.js";
+import { reviveNarrative } from "../daemon/server.js";
 const HOOK_PATH = "/api/hooks/tool-use";
 function seedDaemon(db, port, httpPort) {
     const rows = [
@@ -259,4 +260,40 @@ describe("ensureHookConfig", () => {
         assert.doesNotThrow(() => ensureHookConfig(db, "goose", "/dev/null/nope", "claude-nid00006"));
     });
 });
+describe("reviveNarrative", () => {
+    // A daemon that comes back on another port leaves every fold's hook config
+    // naming the dead one. Fresh spawns rewrote it; a same-agent revive didn't,
+    // so on Fly, where every boot moved the port, revived sessions failed every
+    // tool call's hook (claude-nkrks0of:23).
+    it("repoints a stale hook config before it launches anything", (t) => {
+        // With no `claude` reachable the revive fails at resolving the agent,
+        // after the hook config and before any token or tmux session exists.
+        // resolveAgentCommand's fallback is node_modules/.bin two levels above
+        // the entry script; if one is there, this would launch a real agent.
+        const fallback = resolve(process.argv[1], "../..", "node_modules", ".bin", "claude");
+        if (existsSync(fallback))
+            return t.skip(`${fallback} exists`);
+        const db = createTestDb();
+        seedDaemon(db, "4321", "46347");
+        const fold = mkdtempSync(join(tmpdir(), "brane-hook-"));
+        const stale = `http://127.0.0.1:39287${HOOK_PATH}`;
+        mkdirSync(join(fold, ".claude"));
+        writeFileSync(join(fold, ".claude", "settings.local.json"), JSON.stringify({
+            hooks: { PostToolUse: [{ matcher: ".*", hooks: [{ type: "http", url: stale }] }] },
+        }));
+        db.prepare("INSERT INTO narratives (id, brane_id, agent_type, role, status, fold_path, created_at) VALUES ('claude-rev00001', 'brane-test', 'claude', 'worker', 'ended', ?, ?)").run(fold, Date.now());
+        const path = process.env.PATH;
+        process.env.PATH = mkdtempSync(join(tmpdir(), "brane-empty-path-"));
+        try {
+            assert.throws(() => reviveNarrative(db, "claude-rev00001"), /Agent command not found: claude/);
+        }
+        finally {
+            process.env.PATH = path;
+        }
+        const settings = readSettings(fold);
+        for (const event of ["PreToolUse", "PostToolUse"]) {
+            assert.equal(settings.hooks[event][0].hooks[0].url, `http://127.0.0.1:46347${HOOK_PATH}`, event);
+        }
+    });
+});
 //# sourceMappingURL=hook-config.test.js.map

package/dist/test/meld.test.js

@@ -1,7 +1,9 @@
 import { describe, it, before, after } from "node:test";
 import assert from "node:assert/strict";
 import { createTestDb } from "./helpers.js";
-import { buildMeldUrl } from "../commands/meld.js";
+import { buildMeldUrl, meldLink } from "../commands/meld.js";
+import { cleanAppHost } from "../shared/app-origin.js";
+import { statusAppDomain } from "../daemon/server.js";
 function setTls(db, value) {
     db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('daemon_tls', ?)").run(value ? "true" : "false");
 }
@@ -73,6 +75,33 @@ describe("buildMeldUrl", () => {
         assert.equal(r.tlsDegraded, false);
         assert.ok(r.daemonHost.startsWith("127.0.0.1"));
     });
+    it("points at the app_domain config, which --app overrides, and a literal never decides", () => {
+        setTls(db, true);
+        // Default: the shipped default, brane's own shell.
+        db.prepare("DELETE FROM meta WHERE key = 'config.app_domain'").run();
+        assert.equal(buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST }).appHost, "brane.organelle.dev");
+        // `brane config set app_domain …`: a staging hostname, or a fork's shell.
+        db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('config.app_domain', 'main.brane.organelle.dev')").run();
+        const configured = buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST });
+        assert.equal(configured.appHost, "main.brane.organelle.dev");
+        assert.equal(new URL(configured.url).host, "main.brane.organelle.dev");
+        assert.equal(new URLSearchParams(new URL(configured.url).hash.slice(1)).get("host"), `${TS_HOST}:${daemon.port}`);
+        // --app, for one QR.
+        const once = buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST, app: "https://fork.example/" });
+        assert.equal(once.appHost, "fork.example");
+        assert.equal(new URL(once.url).origin, "https://fork.example");
+        // --local ignores it: the QR is the daemon's own.
+        const local = buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST, local: true, app: "fork.example" });
+        assert.equal(new URL(local.url).host, `${TS_HOST}:${daemon.port}`);
+        db.prepare("DELETE FROM meta WHERE key = 'config.app_domain'").run();
+    });
+    it("meldLink falls back to the shipped default for a reply that names no app host", () => {
+        // A remote brane from before appHost was part of `--connection`'s reply.
+        const url = meldLink({ daemonHost: "h.ts.net:8443", scheme: "https", useLocal: false }, "tok");
+        assert.equal(new URL(url).host, "brane.organelle.dev");
+        const named = meldLink({ daemonHost: "h.ts.net:8443", scheme: "https", useLocal: false, appHost: "fork.example" }, "tok");
+        assert.equal(new URL(named).host, "fork.example");
+    });
     it("does not flag tlsDegraded when advertising a custom --host", () => {
         // A custom host that isn't the Tailscale hostname isn't a degraded TLS
         // case — the operator chose to advertise something else.
@@ -82,4 +111,33 @@ describe("buildMeldUrl", () => {
         assert.equal(r.isLoopbackFallback, false);
     });
 });
+describe("cleanAppHost", () => {
+    it("takes a bare host, or the host of a URL, lower-cased, port kept", () => {
+        assert.equal(cleanAppHost("brane.organelle.dev"), "brane.organelle.dev");
+        assert.equal(cleanAppHost(" Main.Brane.Organelle.dev "), "main.brane.organelle.dev");
+        assert.equal(cleanAppHost("https://fork.example/"), "fork.example");
+        assert.equal(cleanAppHost("http://localhost:8081/claude-abc?x=1#y"), "localhost:8081");
+        assert.equal(cleanAppHost("fork.example/path"), "fork.example");
+    });
+});
+describe("statusAppDomain", () => {
+    it("reports the config reduced to a host, as meld reads it, so Isolate and the QR agree", () => {
+        const db = createTestDb();
+        // With a cert, so the QR is the shared app's and names the host.
+        setTls(db, true);
+        assert.equal(statusAppDomain(db), "brane.organelle.dev");
+        // Stored as a URL by `brane config`: the app must not build https://https://…
+        db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('config.app_domain', 'https://staging.example/')").run();
+        assert.equal(statusAppDomain(db), "staging.example");
+        assert.equal(statusAppDomain(db), buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST }).appHost);
+        // Blanked: means the default, on both sides, never a QR for https:///.
+        db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES ('config.app_domain', '  ')").run();
+        assert.equal(statusAppDomain(db), "brane.organelle.dev");
+        const blank = buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST });
+        assert.equal(blank.appHost, "brane.organelle.dev");
+        assert.equal(new URL(blank.url).host, "brane.organelle.dev");
+        assert.equal(buildMeldUrl({ db, daemon, tailscaleHost: TS_HOST, app: "" }).appHost, "brane.organelle.dev");
+        db.close();
+    });
+});
 //# sourceMappingURL=meld.test.js.map

package/dist/test/narrative-menu.test.js

@@ -69,7 +69,6 @@ describe("narrativeMenuItems", () => {
             "Recolor",
             "Twin",
             "End",
-            "Archive",
         ]);
     });
     it("swaps End for Revive once the session is over", () => {
@@ -93,8 +92,23 @@ describe("narrativeMenuItems", () => {
         assert.ok(labels({ role: "absorbed", status: "ended" }).includes("Revive"));
     });
     it("flips the archive item both ways", () => {
-        assert.ok(labels({ archived: false }).includes("Archive"));
-        assert.ok(labels({ archived: true }).includes("Unarchive"));
+        assert.ok(labels({ status: "ended", archived: false }).includes("Archive"));
+        assert.ok(labels({ status: "ended", archived: true }).includes("Unarchive"));
+    });
+    it("offers Archive only once the session has ended", () => {
+        const running = labels({ status: "active", mcpConnected: true });
+        assert.ok(!running.includes("Archive") && !running.includes("Unarchive"));
+        // The same stale-row test as Revive: an ended row with an agent still on
+        // the bridge is running, and isn't archivable yet.
+        assert.ok(!labels({ status: "ended", mcpConnected: true }).includes("Archive"));
+        assert.ok(labels({ status: "ended" }).includes("Archive"));
+    });
+    it("always offers Unarchive on an archived narrative", () => {
+        for (const status of ["active", "ended", null]) {
+            for (const mcpConnected of [true, false]) {
+                assert.ok(labels({ archived: true, status, mcpConnected }).includes("Unarchive"), `status: ${status}, mcpConnected: ${mcpConnected}`);
+            }
+        }
     });
     it("flips isolate by where the app is served from", () => {
         assert.ok(labels({ isIsolated: false }).includes("Isolate"));
@@ -134,4 +148,17 @@ describe("revivesAsTwin", () => {
         }
     });
 });
+describe("narrativeMenuItems — Isolate", () => {
+    it("reads Isolate on a shared app and Unisolate on a daemon's own bundle", () => {
+        assert.ok(labels().includes("Isolate"));
+        assert.ok(labels({ isIsolated: true }).includes("Unisolate"));
+    });
+    it("is left out when there is nowhere to go, and nothing else moves", () => {
+        // A daemon's own bundle whose daemon reported no app host: offering the
+        // item would mean a link to a host the app made up.
+        const without = labels({ isIsolated: true, canIsolate: false });
+        assert.ok(!without.includes("Isolate") && !without.includes("Unisolate"));
+        assert.deepEqual(without, labels({ isIsolated: true }).filter((l) => l !== "Unisolate"));
+    });
+});
 //# sourceMappingURL=narrative-menu.test.js.map

package/dist/test/remote-meld.test.js

@@ -90,6 +90,19 @@ describe("the remote daemon's address", () => {
         const loopback = readMeldReply(JSON.stringify({ ready: true, ...c, daemonHost: "127.0.0.1:8443", isLoopbackFallback: true }));
         assert.deepEqual(loopback, { kind: "wait", reason: "the remote machine has no Tailscale name yet" });
     });
+    it("follows the remote daemon's app host, end to end, and ignores one that is not a string", () => {
+        // What `brane meld --connection` prints on a remote whose app_domain
+        // names a fork's shell, read back by `--remote` and turned into the QR.
+        const reply = readMeldReply(JSON.stringify({ ready: true, ...c, appHost: "https://Fork.example/" }));
+        assert.equal(reply.kind, "address");
+        if (reply.kind !== "address")
+            return;
+        assert.equal(reply.connection.appHost, "fork.example");
+        assert.equal(new URL(meldLink(reply.connection, "tok")).host, "fork.example");
+        // A remote that sends something other than a string names no shell.
+        const odd = readMeldReply(JSON.stringify({ ready: true, ...c, appHost: 42 }));
+        assert.equal(odd.kind === "address" && odd.connection.appHost, undefined);
+    });
     it("calls an answer with no JSON line an older brane, which ran a plain meld", () => {
         assert.deepEqual(readMeldReply("\nScan this QR code to meld:\n█▀▀▀▀▀█\n"), { kind: "old" });
         assert.deepEqual(readMeldReply('{"daemonHost": 1}'), { kind: "old" });

package/dist/test/terminal-size.test.js

@@ -0,0 +1,36 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { parseTerminalSize, newSessionLine } from "../tmux.js";
+// The grid a spawn or run request carries: the size the requesting viewer's
+// pane last measured, so the session starts at the width it will be watched at
+// and a TUI's launch screen isn't redrawn — and left in scrollback — at each
+// width it is resized through.
+test("parseTerminalSize accepts a positive integer grid", () => {
+    assert.deepEqual(parseTerminalSize({ cols: 80, rows: 24 }), { cols: 80, rows: 24 });
+});
+test("parseTerminalSize drops extra fields", () => {
+    assert.deepEqual(parseTerminalSize({ cols: 120, rows: 40, dpr: 2 }), { cols: 120, rows: 40 });
+});
+test("parseTerminalSize rejects anything that isn't a usable grid", () => {
+    for (const bad of [
+        undefined,
+        null,
+        "80x24",
+        [80, 24],
+        {},
+        { cols: 80 },
+        { cols: 0, rows: 24 },
+        { cols: 80, rows: -1 },
+        { cols: 80.5, rows: 24 },
+        { cols: "80", rows: "24" },
+        { cols: 80, rows: 100000 },
+    ]) {
+        assert.equal(parseTerminalSize(bad), null, JSON.stringify(bad));
+    }
+});
+test("a parsed size reaches new-session as -x/-y", () => {
+    const size = parseTerminalSize({ cols: 93, rows: 41 });
+    const line = newSessionLine({ name: "claude-abc", cwd: "/tmp", size, command: "claude" });
+    assert.match(line, / -x 93 -y 41 /);
+});
+//# sourceMappingURL=terminal-size.test.js.map

package/dist/test/token-devices.test.js

@@ -182,6 +182,65 @@ describe("describeUserAgent", () => {
         });
     }
 });
+describe("which app a device runs", () => {
+    const MAIN = "https://main.brane.organelle.dev";
+    const APEX = "https://brane.organelle.dev";
+    const origins = (db, id) => db.prepare("SELECT app_origin, last_app_origin FROM tokens WHERE id = ?").get(id);
+    it("is recorded from the first request that carries an Origin, and the first is never overwritten", () => {
+        const { ring, phone, db } = setup();
+        // A same-origin GET carries no Origin: the device is named, the app not yet.
+        ring.authenticate("phone", T0 + 1, { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2" });
+        assert.deepEqual(origins(db, phone.id), { app_origin: null, last_app_origin: null });
+        // The control socket's upgrade carries one. Inside the once-a-minute
+        // throttle of the last-seen stamp, so the first write must carry both.
+        ring.authenticate("phone", T0 + 2, { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2", origin: MAIN });
+        assert.deepEqual(origins(db, phone.id), { app_origin: MAIN, last_app_origin: MAIN });
+        // The same token from another copy of the app: the first stands, the latest moves.
+        ring.authenticate("phone", T0 + 2 + 60_000, { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2", origin: APEX });
+        assert.deepEqual(origins(db, phone.id), { app_origin: MAIN, last_app_origin: APEX });
+        // A request with no Origin after that leaves the latest alone.
+        ring.authenticate("phone", T0 + 2 + 120_000, { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2" });
+        assert.deepEqual(origins(db, phone.id), { app_origin: MAIN, last_app_origin: APEX });
+    });
+    it("is listed, and shown as a host", () => {
+        const { ring, store, local, phone, db } = setup();
+        ring.authenticate("phone", T0 + 1, { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2", origin: MAIN });
+        const listed = listTokensRoute(store, local, T0 + 2).body.tokens.find((t) => t.id === phone.id);
+        assert.equal(listed.app_origin, MAIN);
+        assert.match(formatTokenList([listed]), /via main\.brane\.organelle\.dev/);
+        // A daemon's own bundle is an origin like any other, port included.
+        ring.authenticate("laptop", T0 + 1, { userAgent: MAC_CHROME, remoteAddr: "100.101.1.3", origin: "https://mac.tail1234.ts.net:47443" });
+        assert.match(formatTokenList(listTokensRoute(store, local, T0 + 2).body.tokens), /via mac\.tail1234\.ts\.net:47443/);
+        assert.equal(origins(db, local.id).app_origin, null);
+    });
+    it("is stored as text a list can show: control characters become spaces, and it is capped", () => {
+        const { ring, phone, db } = setup();
+        ring.authenticate("phone", T0 + 1, { userAgent: IPHONE_SAFARI, origin: "https://evil.example\r\nX-Forged: row" + "a".repeat(300) });
+        const { app_origin } = origins(db, phone.id);
+        assert.ok(app_origin && !/[\r\n]/.test(app_origin));
+        assert.ok(app_origin.length <= 256);
+    });
+    it("treats the opaque origin `null` as no origin, so it never names a device", () => {
+        // A sandboxed iframe or a file:// page sends the literal `Origin: null`.
+        // Stored, it would read "via null" for good, since the first origin is
+        // never overwritten; so it must not take the slot a real one would fill.
+        const { ring, phone, db } = setup();
+        ring.authenticate("phone", T0 + 1, { userAgent: IPHONE_SAFARI, origin: "null" });
+        assert.deepEqual(origins(db, phone.id), { app_origin: null, last_app_origin: null });
+        ring.authenticate("phone", T0 + 2, { userAgent: IPHONE_SAFARI, origin: MAIN });
+        assert.deepEqual(origins(db, phone.id), { app_origin: MAIN, last_app_origin: MAIN });
+        ring.authenticate("phone", T0 + 2 + 60_000, { userAgent: IPHONE_SAFARI, origin: "null" });
+        assert.deepEqual(origins(db, phone.id), { app_origin: MAIN, last_app_origin: MAIN });
+    });
+    it("a rotation's replacement takes the origin of the request that confirms it", () => {
+        const { store } = setup();
+        const replacement = store.insert(hashToken("fresh"), "device", "phone", T0 + 3, {
+            used: true,
+            seen: { userAgent: IPHONE_SAFARI, remoteAddr: "100.101.1.2", origin: MAIN },
+        });
+        assert.equal(store.list(T0 + 4).find((t) => t.id === replacement.id)?.app_origin, MAIN);
+    });
+});
 describe("formatTokenList", () => {
     it("puts the id first, and marks this machine, the requester and an unscanned QR", () => {
         const text = formatTokenList([