brane 0.3.4 → 0.3.5

package/AGENTS.md

@@ -148,6 +148,7 @@ Single SQLite database at `~/.brane/brane.db` (WAL mode). Key tables:
 | `meta` | Instance ID, daemon port/pid/version/tls/http_port/socket, config |
 | `tokens` | Daemon bearer tokens as SHA-256 hashes only (`local`: one row for this machine's CLI, which no token opens; `device` per meld, `agent` per narrative session, handed to it as `BRANE_NARRATIVE_SECRET`), revoked never deleted — see [Token Rotation](docs/token-rotation.md) |
 | `folds` | Registered spawn directories (path, brane_id, created_at) |
+| `branes` | Archived branes (brane_id, archived, archived_at), written lazily, never deleted — see [Multi-Brane](docs/multi-brane.md#archived-branes) |
 | `narratives` | Agent sessions (id, brane_id, agent_type, role, status, fold_path, title, summary, archived, agent_session_id) |
 | `events` | Append-only event log: (narrative_id, seq, time, type, content, content_type, source, re, payloads, meta) |
 | `memory_chunks` | Event chunks for embeddings |

package/CHANGELOG.md

@@ -6,6 +6,31 @@ page, which is also what triggers its publish (see
 [docs/releasing.md](docs/releasing.md)). This file is the summary that
 travels in the npm tarball.
 
+## 0.3.5 - 2026-10-14
+
+- A browser holds daemons from one tailnet only. A meld link or "+ Add
+  Daemon" entry for a host on another tailnet is refused before anything
+  is sent to it, so a stranger's daemon (behind Tailscale Funnel, say)
+  can't be melded into a browser that holds yours. To use another
+  tailnet, use another browser, or remove this one's daemons first
+  ([#613](https://github.com/benjamn/brane/pull/613)).
+- A browser's first meld gets a warning card: continue only if you
+  installed brane and ran `brane meld` yourself, and cancel a link
+  someone sent you. A loopback daemon is accepted beside a tailnet and
+  never decides one
+  ([#615](https://github.com/benjamn/brane/pull/615)).
+- Every row of the brane switcher has a ⋯. A daemon can be archived on
+  this device, keeping its token so it is one tap from Reconnect, or
+  deleted, which first signs this device out of it
+  (`POST /api/token/forget`). A brane can be archived on the daemon, for
+  every device: its ended narratives leave All branes, and its running
+  ones never do. The home brane and the last brane showing can't be
+  archived. The long-press that silently removed a daemon is gone
+  ([#614](https://github.com/benjamn/brane/pull/614)).
+
+Published while the repository is private, so like 0.3.0–0.3.4 it
+carries no npm provenance attestation.
+
 ## 0.3.4 - 2026-10-14
 
 - "All narratives" in the narrative switcher pushes the list in this tab

package/SECURITY.md

@@ -46,6 +46,17 @@ A stranger who photographs your QR from across the coffee shop gets a token they
 
 To opt in to LAN reach on a trusted home network, pass `brane meld --host <lan-ip>` paired with a matching `--bind`. That is an explicit choice — the over-the-shoulder threat reappears for the duration of that session, but only because the operator asked for it.
 
+## One tailnet per browser
+
+The QR's safety is about the link *you* show. The reverse case is a link someone sends *you*: a meld link to a daemon they run. Anyone can stand one up behind Tailscale Funnel, which gives it a public `*.ts.net` name and a valid certificate, and the meld card's **Daemon** and **Brane** rows are whatever that daemon says about itself, so it can claim to be `you@your-mac`. A browser keeps every melded daemon's token in one origin's `localStorage`. Any script that runs in that origin, through a renderer bug fed by the hostile daemon, can read every one of them. Your browser is on your tailnet, so the script can then use those tokens against your own daemons directly. Tapping **Meld** on such a link must cost nothing, whatever bugs the renderer has.
+
+So a browser origin holds daemons from **one trust domain** only (`src/shared/tailnet.ts`). The domain is read from the host the browser connects to, never from anything the daemon reports. For a MagicDNS name, which is what `brane meld` writes, it is the tailnet: `tail1234.ts.net` for `mac.tail1234.ts.net`. Only Tailscale issues names and certificates under a tailnet's domain. Any other host is a domain of just itself. Loopback is no domain at all: only this machine can serve a loopback daemon, so one is accepted beside any tailnet and never decides one. A browser holding only loopback daemons still has its domain to pick. The first meld of anything else sets it. After that, a meld link or an **+ Add Daemon** entry for a host in another domain is refused **before anything is sent to it**, not even the status probe that would tell its owner the link was opened. The card names both domains. To use another tailnet, open the link in another browser or profile, or remove this browser's daemons first.
+
+What this does not cover:
+- **A hostile member of your own tailnet** passes. On a tailnet shared with other people, that person is inside the trust boundary, as they are for every other tailnet service.
+- **A browser with no domain yet** (no daemons, or only loopback ones) takes whatever it is sent first, which is why that meld gets its own card. It says to continue only if you installed brane and ran `brane meld` yourself, and to cancel if someone sent you the link. It also names the tailnet the browser will be held to. Connecting to a stranger's daemon is already the loss: it sees everything you do in the app. So the defense is at that tap, not after it. Your own daemon is refused afterwards, which is how you would find out.
+- **A browser melded before this rule may already hold two domains.** It can add daemons to either, but not to a third.
+
 ## Authentication
 
 Every API and WebSocket request over TCP requires a 128-bit UUID bearer token, passed via `Authorization: Bearer` header or query parameter. Brute-forcing 128 bits of entropy is not feasible. The one exception is a request over the daemon's Unix socket, which needs no token and acts as this machine's account (below).
@@ -193,6 +204,7 @@ Surfacing mentions on the recipient's own timeline — so a transcript reader ca
 - An attacker with root on your machine (nothing can)
 - A process running as your Unix account, agents included: it can reach `daemon.sock` and act as this machine, or use tmux directly (see [Who the operator is](#who-the-operator-is)). An agent token's narrower scope stops an agent that follows the rules, not one that goes around it
 - A compromised Tailscale account (same as any tailnet service)
+- A hostile member of your own tailnet: a browser accepts daemons from its tailnet, and only from its tailnet (see [One tailnet per browser](#one-tailnet-per-browser))
 - A compromised brane.organelle.dev deployment (use `--local` to eliminate this)
 - Independent auditing of the upstream `tmux` build (the pinned SHA-256 guarantees you receive exactly the bytes brane vetted, not that those bytes were audited beyond trust-on-first-use)
 

package/dist/daemon/server.js

@@ -24,7 +24,7 @@ import { signalEventFields, signalStanding } from "./signal-source.js";
 import { AGENT_LOOPBACK_REFUSAL, AGENT_REVIVE_REFUSAL, agentRefusal, agentReviveRefusal } from "./agent-scope.js";
 import { archiveRefusal } from "./archive-gate.js";
 import { DbTokenStore, bootstrapTokens, legacyTokenWarning, parseTokenHashes, liveAgentTokenId, mintAgentToken, recordLauncher, settleAgentLaunch, verifyAgentToken } from "../db/tokens.js";
-import { closeSocketsOf, listTokensRoute, socketOwners, retireTokens } from "./token-routes.js";
+import { closeSocketsOf, forgetSelfRoute, listTokensRoute, socketOwners, retireTokens } from "./token-routes.js";
 import { getConfig, resolveAppHost } from "../commands/config.js";
 import { doSpawn, buildGooseExtensionArg, reestablishMcpConfigArgs, braneTmuxEnv, ensureHookConfig, resolveAgentCommand, LIVE_LOOP_PROMPT } from "../commands/spawn.js";
 import { ensureSessionAffinityConfig } from "../session-affinity.js";
@@ -46,6 +46,7 @@ import { parseDuration, timeSince } from "../commands/memory.js";
 import { getTlsCertPath, getTlsKeyPath } from "../commands/certify.js";
 import { getTailscaleIps, getTailscaleIpsAsync } from "../tailscale.js";
 import { addressesToBind, nextProbeDelay, TAILSCALE_PROBE_MAX_MS } from "./tailscale-rebind.js";
+import { archivedBraneIds, braneArchiveRefusal, setBraneArchived, visibleUnscopedClause } from "../db/branes.js";
 import { CertManager } from "./cert-manager.js";
 import { KeepAwake } from "./keep-awake.js";
 import { resolveTmux, ensureTmux, newTmuxSession, parseTerminalSize } from "../tmux.js";
@@ -1308,6 +1309,13 @@ export async function startServer(config) {
                 where.push(`brane_id IN (${braneIds.map(() => "?").join(",")})`);
                 params.push(...braneIds);
             }
+            else {
+                // All branes: an archived brane's ended narratives stay out of it
+                // (src/db/branes.ts). Naming the brane still lists them.
+                const visible = visibleUnscopedClause(connectedNids);
+                where.push(visible.sql);
+                params.push(...visible.params);
+            }
             // last_activity = time of the most recent event, so the UI can show a
             // recency timestamp on each card (more meaningful than created_at for
             // long-running narratives). Events are append-ordered, so the newest
@@ -1849,8 +1857,12 @@ export async function startServer(config) {
             }).catch((err) => sendJson(res, 500, { error: String(err) }));
             return;
         }
-        // Route: GET /api/branes
+        // Route: GET /api/branes?archived=1
+        // Archived branes (src/db/branes.ts) are left out unless archived=1, which
+        // the switcher's "Show N archived" asks for; each row says which it is.
         if (path === "/api/branes" && req.method === "GET") {
+            const includeArchived = url.searchParams.get("archived") === "1";
+            const hidden = archivedBraneIds(db);
             const rows = db.prepare(`SELECT brane_id,
                 COUNT(*) as narrative_count,
                 SUM(CASE WHEN status = 'active' THEN 1 ELSE 0 END) as active_count,
@@ -1875,14 +1887,51 @@ export async function startServer(config) {
                 list.push({ unit: c.unit, amount: Math.round(c.amount * 100) / 100, metered: c.metered });
                 costByBrane.set(c.brane_id, list);
             }
-            const branes = rows.map((r) => ({
+            const branes = rows
+                .filter((r) => includeArchived || !hidden.has(r.brane_id))
+                .map((r) => ({
                 ...r,
                 is_home: r.brane_id === braneId,
+                archived: hidden.has(r.brane_id),
                 cost: costByBrane.get(r.brane_id) ?? [],
             }));
             sendJson(res, 200, { branes });
             return;
         }
+        // Route: PATCH /api/branes/archive  { brane_id, archived }
+        // Hide a brane, or bring it back. Refused for the home brane and for the
+        // last brane not already archived (src/db/branes.ts). The operator's act:
+        // not in AGENT_ROUTES.
+        if (path === "/api/branes/archive" && req.method === "PATCH") {
+            parseBody(req).then((body) => {
+                let target, archived;
+                try {
+                    ({ brane_id: target, archived } = JSON.parse(body));
+                }
+                catch {
+                    sendJson(res, 400, { error: "invalid JSON body" });
+                    return;
+                }
+                if (typeof target !== "string" || target.trim() === "") {
+                    sendJson(res, 400, { error: "brane_id is required" });
+                    return;
+                }
+                if (typeof archived !== "boolean") {
+                    sendJson(res, 400, { error: "archived must be true or false" });
+                    return;
+                }
+                const refusal = braneArchiveRefusal(db, target, archived, braneId);
+                if (refusal) {
+                    sendJson(res, refusal.status, { error: refusal.error });
+                    return;
+                }
+                setBraneArchived(db, target, archived);
+                sendJson(res, 200, { brane_id: target, archived });
+            }).catch((err) => {
+                sendJson(res, 400, { error: String(err) });
+            });
+            return;
+        }
         // Route: GET /api/folds?archived=1
         // Archived folds are hidden from the spawn dropdown by default; pass
         // archived=1 to include them (for the "show hidden" affordance).
@@ -2203,6 +2252,20 @@ export async function startServer(config) {
             });
             return;
         }
+        // Route: POST /api/token/forget — this device signs itself out, for the
+        // app's "Delete permanently" (src/daemon/token-routes.ts). Bodiless. Its
+        // sockets close after the answer is on its way.
+        if (path === "/api/token/forget" && req.method === "POST") {
+            const answer = forgetSelfRoute(tokenStore, tokenRing, auth.record);
+            sendJson(res, answer.status, answer.body);
+            if (answer.status === 200) {
+                const closed = closeSocketsOf(viewerSockets, answer.body.ids);
+                console.log(`[token] device "${answer.body.label}" signed itself out from ${connectionLabel(req.socket) ?? "?"}; ` +
+                    `closed ${closed} viewer socket(s)` +
+                    (answer.body.abandonedRotation ? "; abandoned the rotation it had begun" : ""));
+            }
+            return;
+        }
         // Route: POST /api/token/rotate — "sign out other devices". For a device
         // it mints a pending token and returns it; nothing else changes until a
         // request presents that token, which is when the requester's old token
@@ -5582,6 +5645,13 @@ function handleNarrativeInfo(db, args, connectedNids, braneIds) {
         sql += ` AND n.brane_id IN (${braneIds.map(() => "?").join(", ")})`;
         params.push(...braneIds);
     }
+    else {
+        // Every brane, as `brane memory log` asks: archived branes' ended
+        // narratives stay out, as they do from All branes (src/db/branes.ts).
+        const visible = visibleUnscopedClause(connectedNids, "n");
+        sql += ` AND ${visible.sql}`;
+        params.push(...visible.params);
+    }
     if (!args.archived) {
         sql += ` AND COALESCE(n.archived, 0) = 0`;
     }
@@ -5681,6 +5751,10 @@ function handleListBranes(db, selfNarrativeId) {
      FROM narratives
      GROUP BY brane_id
      ORDER BY last_activity DESC`).all();
+    // Archived branes are listed too, flagged, so an agent can still reach one
+    // on purpose (src/db/branes.ts).
+    const hidden = archivedBraneIds(db);
+    const flag = (id) => (hidden.has(id) ? { archived: true } : {});
     // Insert caller's home brane entry first so iteration order surfaces it,
     // then everything else in last_activity DESC order.
     const result = {};
@@ -5689,14 +5763,14 @@ function handleListBranes(db, selfNarrativeId) {
         const homeRow = rows.find((r) => r.brane_id === homeBraneId);
         if (homeRow) {
             const { brane_id, ...rest } = homeRow;
-            result[brane_id] = rest;
+            result[brane_id] = { ...rest, ...flag(brane_id) };
         }
     }
     for (const r of rows) {
         if (r.brane_id === homeBraneId)
             continue;
         const { brane_id, ...rest } = r;
-        result[brane_id] = rest;
+        result[brane_id] = { ...rest, ...flag(brane_id) };
     }
     return result;
 }

package/dist/daemon/token-routes.js

@@ -187,4 +187,23 @@ also = []) {
         abandonedRotation = ring.abandonRotationBy(x) || abandonedRotation;
     return { status: 200, body: { revoked: row.id, kind: row.kind, label: row.label, also: extra, ids, abandonedRotation } };
 }
+/** `POST /api/token/forget`: a device signs itself out — the app's "Delete
+ *  permanently" on a daemon it no longer wants, so no live token is left
+ *  behind on the daemon that nobody holds. Bodiless, like the revoke. The
+ *  per-device revoke refuses the requester's own token because "Sign out
+ *  other devices" is usually what was meant; here stranding itself is the
+ *  point. Only a device token can ask: this machine's account holds no token,
+ *  and an agent's is not offered the route. The externals it dialed in go
+ *  with it, as they do with any revoke; devices it added stay. */
+export function forgetSelfRoute(store, ring, requester, now = Date.now()) {
+    if (requester.kind !== "device") {
+        return { status: 400, body: { error: `Only a device's token can sign itself out; this is a ${requester.kind} token` } };
+    }
+    const ids = [requester.id, ...store.externalsOf([requester.id]).filter((x) => x !== requester.id)];
+    store.revoke(ids, now);
+    let abandonedRotation = false;
+    for (const x of ids)
+        abandonedRotation = ring.abandonRotationBy(x) || abandonedRotation;
+    return { status: 200, body: { revoked: requester.id, label: requester.label, ids, abandonedRotation } };
+}
 //# sourceMappingURL=token-routes.js.map

package/dist/db/branes.js

@@ -0,0 +1,44 @@
+/** The ids of every archived brane. */
+export function archivedBraneIds(db) {
+    const rows = db.prepare("SELECT brane_id FROM branes WHERE archived = 1").all();
+    return new Set(rows.map((r) => r.brane_id));
+}
+/** A WHERE clause over `narratives` (unaliased columns) that drops ended
+ *  narratives of archived branes, for a listing that names no brane. A
+ *  narrative counts as running if its status is not `ended` or its agent is
+ *  on the bridge (`connected`, bound as parameters). `alias` qualifies the
+ *  columns when the query joins another table. */
+export function visibleUnscopedClause(connected, alias = "") {
+    const ids = [...connected];
+    const a = alias ? `${alias}.` : "";
+    const live = ids.length ? ` OR ${a}id IN (${ids.map(() => "?").join(",")})` : "";
+    return {
+        sql: `(${a}brane_id NOT IN (SELECT brane_id FROM branes WHERE archived = 1) OR ${a}status IS NOT 'ended'${live})`,
+        params: ids,
+    };
+}
+/** Why `braneId` cannot be archived, as a status and message, or null when
+ *  it can. Unarchiving is refused only for a brane that does not exist. */
+export function braneArchiveRefusal(db, braneId, archived, homeBraneId) {
+    const exists = db.prepare("SELECT 1 FROM narratives WHERE brane_id = ? LIMIT 1").get(braneId);
+    if (!exists)
+        return { status: 404, error: `No brane ${braneId}` };
+    if (!archived)
+        return null;
+    if (braneId === homeBraneId) {
+        return { status: 400, error: `${braneId} is this daemon's home brane, where every spawn without a brane lands; it can't be archived` };
+    }
+    const hidden = archivedBraneIds(db);
+    const remaining = db.prepare("SELECT DISTINCT brane_id FROM narratives").all()
+        .filter((r) => r.brane_id !== braneId && !hidden.has(r.brane_id));
+    if (remaining.length === 0) {
+        return { status: 400, error: `${braneId} is the last brane not archived; archiving it would leave nothing to show` };
+    }
+    return null;
+}
+/** Archive or unarchive `braneId`, writing its row on first use. */
+export function setBraneArchived(db, braneId, archived, now = Date.now()) {
+    db.prepare(`INSERT INTO branes (brane_id, archived, archived_at) VALUES (?, ?, ?)
+     ON CONFLICT(brane_id) DO UPDATE SET archived = excluded.archived, archived_at = excluded.archived_at`).run(braneId, archived ? 1 : 0, archived ? now : null);
+}
+//# sourceMappingURL=branes.js.map

package/dist/db/schema.js

@@ -456,6 +456,17 @@ export function applyMigrations(db) {
     if (!launchCols.has("launched_by")) {
         db.exec("ALTER TABLE narratives ADD COLUMN launched_by TEXT");
     }
+    // Which branes the operator has hidden (src/db/branes.ts). A brane has no
+    // row of its own anywhere else — it is the brane_id its narratives share —
+    // so a row here is written lazily by the first archive and never deleted;
+    // unarchiving clears the flag.
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS branes (
+      brane_id    TEXT PRIMARY KEY,
+      archived    INTEGER NOT NULL DEFAULT 0,
+      archived_at INTEGER
+    )
+  `);
 }
 /** Carry provider-only `absorb_messages` / `absorb_files` rows (the shape
  *  #456 shipped) into the brane-scoped tables. Detected by the old table

package/dist/shared/tailnet.js

@@ -0,0 +1,117 @@
+/** One tailnet per browser origin.
+ *
+ *  Every daemon a browser has melded keeps its token in that origin's
+ *  `localStorage`, so anything that runs script in the origin — a renderer bug
+ *  fed by a hostile daemon — can read all of them, and a page on your tailnet
+ *  can use them against your daemons directly. A meld link is the cheap way to
+ *  get a hostile daemon in: a stranger stands one up behind Tailscale Funnel,
+ *  which gives it a real `*.ts.net` name and certificate, and sends the link.
+ *
+ *  The rule that makes that harmless: an origin holds daemons from one trust
+ *  domain only, and the domain is read off the host the browser itself
+ *  connects to, never off anything the daemon says about itself. For a
+ *  MagicDNS name (`mac.tail1234.ts.net`, what `brane meld` always writes) the
+ *  domain is the tailnet (`tail1234.ts.net`): only Tailscale issues names and
+ *  certificates under it, so a daemon cannot claim to be in a tailnet it is
+ *  not in. Any other host (a LAN IP, a raw Tailscale IP, a public name) is a
+ *  domain of exactly itself. Loopback is the exception that is no domain at
+ *  all: only this machine can serve it, so it is accepted beside any tailnet,
+ *  and it never decides one. So a browser that melded `tail1234.ts.net`
+ *  refuses a link to `evil.tail5678.ts.net` before it contacts it, and using
+ *  another tailnet takes another browser (or profile), or forgetting this
+ *  one's daemons first. See SECURITY.md, "One tailnet per browser".
+ *
+ *  Pure, so the test suite drives it without a DOM. */
+/** The hostname of a `host[:port]` as the app stores it, lower-cased, without
+ *  brackets or a trailing dot; `null` when it is not a host at all. */
+export function hostnameOf(host) {
+    const trimmed = host.trim();
+    if (!trimmed || /[/?#@\s]/.test(trimmed))
+        return null;
+    try {
+        const name = new URL(`http://${trimmed}`).hostname.toLowerCase();
+        return name.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "") || null;
+    }
+    catch {
+        return null;
+    }
+}
+function isLoopback(hostname) {
+    return (hostname === "localhost" ||
+        hostname.endsWith(".localhost") ||
+        hostname === "::1" ||
+        /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(hostname));
+}
+/** The tailnet a MagicDNS name belongs to — `tail1234.ts.net` for
+ *  `mac.tail1234.ts.net` — or `null` for any other host. */
+export function tailnetOf(host) {
+    const name = hostnameOf(host);
+    if (!name)
+        return null;
+    const labels = name.split(".");
+    if (labels.length < 4 || labels.at(-1) !== "net" || labels.at(-2) !== "ts")
+        return null;
+    if (labels.some((l) => l === ""))
+        return null;
+    return labels.slice(-3).join(".");
+}
+/** The domain every loopback spelling shares. */
+export const LOOPBACK = "localhost";
+/** The trust domain a daemon at `host` belongs to: its tailnet, `localhost`
+ *  for every loopback spelling, or else the hostname itself. `null` for
+ *  something that is not a host. */
+export function trustDomainOf(host) {
+    const name = hostnameOf(host);
+    if (!name)
+        return null;
+    if (isLoopback(name))
+        return LOOPBACK;
+    return tailnetOf(name) ?? name;
+}
+/** May a browser that already holds daemons at `existingHosts` add one at
+ *  `candidate`? A loopback daemon, always: only this machine can serve one,
+ *  and its token beside a tailnet's is exposed to nobody that tailnet's
+ *  aren't. Anything else, when the browser holds no domain yet (the meld
+ *  picks it, and `setsHome` says so), or when the domain is one it already
+ *  holds — a browser melded before this rule may hold two, and adding to
+ *  either exposes nothing new. Loopback never counts as holding a domain: a
+ *  browser with only loopback daemons still has its domain to pick, and that
+ *  pick is screened like a first meld, since a stranger's daemon there could
+ *  reach the loopback one from this very browser. Hosts that do not parse
+ *  are ignored on the existing side and refused on the candidate side. */
+export function checkMeldHost(candidate, existingHosts) {
+    const home = [
+        ...new Set(existingHosts.map(trustDomainOf).filter((d) => d !== null && d !== LOOPBACK)),
+    ].sort();
+    const domain = trustDomainOf(candidate);
+    if (domain === null)
+        return { ok: false, domain, home };
+    if (domain === LOOPBACK)
+        return { ok: true, domain, setsHome: false };
+    if (home.length === 0)
+        return { ok: true, domain, setsHome: true };
+    if (home.includes(domain))
+        return { ok: true, domain, setsHome: false };
+    return { ok: false, domain, home };
+}
+/** Whether a meld link the rule allowed gets the first-meld warning: the
+ *  browser holds no daemon at all, or this meld picks its domain. Never on
+ *  the daemon's own origin (`candidate` is the page's host): that is where
+ *  Isolate lands, from the operator's own app, and if the daemon were
+ *  hostile the card would be drawn by its own bundle, warning about nothing.
+ *  Only a page some other origin serves — the shared app — can warn honestly. */
+export function isFirstMeld(existingHosts, verdict, candidate, pageHost) {
+    if (candidate.toLowerCase() === pageHost.toLowerCase())
+        return false;
+    return existingHosts.length === 0 || verdict.setsHome;
+}
+/** The refusal in words, for the meld card and the add-daemon form. */
+export function meldRefusalMessage(candidate, verdict) {
+    if (verdict.domain === null)
+        return `"${candidate}" is not a daemon address.`;
+    const home = verdict.home.join(" and ");
+    return (`${hostnameOf(candidate) ?? candidate} is on ${verdict.domain}, but this browser's daemons are on ${home}. ` +
+        `A browser holds daemons from one tailnet only, so that no daemon can reach another tailnet's tokens. ` +
+        `To use it, open the link in another browser or profile, or remove this browser's daemons first.`);
+}
+//# sourceMappingURL=tailnet.js.map

package/dist/test/agent-scope.test.js

@@ -142,6 +142,7 @@ const serverSource = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "
 const CLOSED_TO_AGENTS = new Set([
     "GET /api/absorb/survey",
     "POST /api/absorb",
+    "PATCH /api/branes/archive",
     "POST /api/cost/backfill",
     "POST /api/cost/reprice",
     "POST /api/folds",
@@ -150,6 +151,7 @@ const CLOSED_TO_AGENTS = new Set([
     "POST /api/narratives/:/signal",
     "POST /api/presence/cancel",
     "POST /api/run",
+    "POST /api/token/forget",
     "POST /api/token/rotate",
     "GET /api/tokens",
     "POST /api/tokens",

package/dist/test/brane-archive.test.js

@@ -0,0 +1,107 @@
+/**
+ * Archived branes (src/db/branes.ts) and a device signing itself out
+ * (`forgetSelfRoute`), the two daemon halves of the switcher's archive menus.
+ */
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createTestDb } from "./helpers.js";
+import { archivedBraneIds, braneArchiveRefusal, setBraneArchived, visibleUnscopedClause } from "../db/branes.js";
+import { DbTokenStore } from "../db/tokens.js";
+import { TokenRing, hashToken } from "../daemon/token-ring.js";
+import { forgetSelfRoute } from "../daemon/token-routes.js";
+const HOME = "brane-home";
+function addNarrative(db, id, braneId, status) {
+    db.prepare("INSERT INTO narratives (id, brane_id, created_at, status) VALUES (?, ?, ?, ?)").run(id, braneId, 1, status);
+}
+function setup() {
+    const db = createTestDb();
+    addNarrative(db, "claude-h1", HOME, "ended");
+    addNarrative(db, "claude-a1", "brane-absorbed", "ended");
+    addNarrative(db, "claude-a2", "brane-absorbed", "active");
+    addNarrative(db, "claude-a3", "brane-absorbed", "ended");
+    addNarrative(db, "claude-o1", "brane-other", "ended");
+    return db;
+}
+function unscoped(db, connected = []) {
+    const v = visibleUnscopedClause(connected);
+    return db.prepare(`SELECT id FROM narratives WHERE ${v.sql} ORDER BY id`).all(...v.params).map((r) => r.id);
+}
+describe("archiving a brane", () => {
+    it("is refused for the home brane", () => {
+        const db = setup();
+        assert.equal(braneArchiveRefusal(db, HOME, true, HOME)?.status, 400);
+        assert.match(braneArchiveRefusal(db, HOME, true, HOME).error, /home brane/);
+    });
+    it("is refused for the last brane not already archived, even when that is not the home brane", () => {
+        const db = createTestDb();
+        addNarrative(db, "claude-x", "brane-only", "ended");
+        const refusal = braneArchiveRefusal(db, "brane-only", true, HOME);
+        assert.equal(refusal?.status, 400);
+        assert.match(refusal.error, /last brane/);
+        const db2 = setup();
+        // Home can't be archived, so "last" is reached by archiving the others.
+        assert.equal(braneArchiveRefusal(db2, "brane-absorbed", true, HOME), null);
+        setBraneArchived(db2, "brane-absorbed", true);
+        setBraneArchived(db2, "brane-other", true);
+        assert.equal(braneArchiveRefusal(db2, HOME, true, "brane-elsewhere")?.status, 400);
+        assert.match(braneArchiveRefusal(db2, HOME, true, "brane-elsewhere").error, /last brane/);
+    });
+    it("is 404 for a brane with no narratives, either way", () => {
+        const db = setup();
+        assert.equal(braneArchiveRefusal(db, "brane-nope", true, HOME)?.status, 404);
+        assert.equal(braneArchiveRefusal(db, "brane-nope", false, HOME)?.status, 404);
+    });
+    it("is undone by unarchiving, which is never refused for a brane that exists", () => {
+        const db = setup();
+        setBraneArchived(db, "brane-other", true, 5);
+        assert.deepEqual([...archivedBraneIds(db)], ["brane-other"]);
+        assert.equal(braneArchiveRefusal(db, "brane-other", false, HOME), null);
+        setBraneArchived(db, "brane-other", false, 6);
+        assert.deepEqual([...archivedBraneIds(db)], []);
+        // The row is kept, flag cleared: never deleted.
+        assert.deepEqual(db.prepare("SELECT * FROM branes").all(), [{ brane_id: "brane-other", archived: 0, archived_at: null }]);
+    });
+});
+describe("listings that name no brane", () => {
+    it("leave out an archived brane's ended narratives and keep its running ones", () => {
+        const db = setup();
+        assert.deepEqual(unscoped(db), ["claude-a1", "claude-a2", "claude-a3", "claude-h1", "claude-o1"]);
+        setBraneArchived(db, "brane-absorbed", true);
+        assert.deepEqual(unscoped(db), ["claude-a2", "claude-h1", "claude-o1"]);
+    });
+    it("keep a narrative whose agent is on the bridge, whatever its row says", () => {
+        const db = setup();
+        setBraneArchived(db, "brane-absorbed", true);
+        assert.deepEqual(unscoped(db, ["claude-a3"]), ["claude-a2", "claude-a3", "claude-h1", "claude-o1"]);
+    });
+    it("qualify their columns when given an alias", () => {
+        const v = visibleUnscopedClause(["claude-a3"], "n");
+        assert.match(v.sql, /^\(n\.brane_id NOT IN .* OR n\.status IS NOT 'ended' OR n\.id IN \(\?\)\)$/);
+    });
+});
+describe("a device signing itself out", () => {
+    function tokens() {
+        const db = createTestDb();
+        const store = new DbTokenStore(db);
+        const ring = new TokenRing(store, () => "unexpected-mint");
+        const local = store.insert(hashToken("local"), "local", "this machine", 1);
+        const phone = store.insert(hashToken("phone"), "device", "phone", 2);
+        const laptop = store.insert(hashToken("laptop"), "device", "laptop", 3);
+        return { store, ring, local, phone, laptop };
+    }
+    it("revokes its own token and leaves the others", () => {
+        const { store, ring, phone, laptop } = tokens();
+        const answer = forgetSelfRoute(store, ring, phone, 10);
+        assert.equal(answer.status, 200);
+        assert.deepEqual(answer.status === 200 && answer.body.ids, [phone.id]);
+        assert.equal(store.get(phone.id), null);
+        assert.ok(store.get(laptop.id));
+    });
+    it("is refused for this machine's account, which holds no token", () => {
+        const { store, ring, local } = tokens();
+        const answer = forgetSelfRoute(store, ring, local, 10);
+        assert.equal(answer.status, 400);
+        assert.ok(store.get(local.id));
+    });
+});
+//# sourceMappingURL=brane-archive.test.js.map