fix(branding) [BRNS-DESK-017]: stop sending feedback and exports to the upstream fork

[sebastian-ssvlabs]

Summary

• /feedback filed user bug reports to a third party. It opened https://github.com/AnyiWang/OpenCovibe/issues — the upstream fork's public tracker. Anything a user typed into a bug report (paths, project names, whatever they pasted) went to a repo we don't control and can't delete from. Now https://github.com/ssvlabs/brains-desktop/issues.
• HTML export leaked upstream branding into content users share. A shared conversation carried <meta name="generator" content="OpenCovibe">, a … — OpenCovibe <title>, a live outbound <a href> to the fork in the footer, and an opencovibe-*.html filename on the recipient's disk. All four are brains / ssvlabs now.
• Eight locale strings in both en and zh-CN, including layout_appName — which renders as a visible <h2> heading in the chat empty state (chat/+page.svelte:4862,5524).
• settings_general_apiKeyStored was factually wrong as well as misbranded: it told users their API key was in ~/.opencovibe/settings.json. data_dir() is ~/.brains (src-tauri/src/storage/mod.rs:28) and the settings file is ~/.brains/settings.json (src-tauri/src/storage/settings.rs:6), so anyone following that string looked in a directory that does not exist. Fixed to the real path.
• About modal, command palette, the /feedback slash-command description, the remote-access login page, package.json metadata, and the issue-template config.
• New blocking CI gate, scoped to the surfaces cleaned here, so they can't regress.
• Closes BRNS-DESK-017 (P2, effort M, desktop / branding).

What changed, by surface

Surface	File	Change
Bug reports	src/routes/chat/+page.svelte	open-feedback URL → ssvlabs/brains-desktop/issues
Exported HTML	src/lib/utils/html-export.ts	generator meta, <title> suffix, footer link + label, download filename prefix brains-
Locale copy (×2 locales)	messages/en.json, messages/zh-CN.json	layout_appName, feedback_opening, settings_general_webEnabledDesc, settings_codexFlags_title, settings_codexFlags_subtitle, history_totalCost, cmd_versionContent, settings_general_apiKeyStored
About modal	src/lib/components/AboutModal.svelte	version line now reads t("layout_appName") instead of a hardcoded name; copyright reworked (below)
Command palette	src/lib/commands.ts	"Show brains Desktop version information"
Slash commands	src/lib/utils/slash-commands.ts	/feedback → "Open the brains issue tracker" (hardcoded description, same user-visible list as the palette)
Remote access	src-tauri/src/web_server/auth.rs	LOGIN_HTML <title> and <h1>
Repo metadata	package.json, package-lock.json	name → brains-desktop; homepage / repository / bugs → ssvlabs. version untouched; the lock's two name fields follow so npm ci stays consistent
Contributor routing	.github/ISSUE_TEMPLATE/config.yml	Discussions link → ssvlabs
Regression gate	scripts/branding-check.sh (new), .github/workflows/ci.yml, package.json	blocking npm run branding:check, also added to verify

The copyright line

This is an Apache-2.0 fork, so §4(d) means the upstream notice has to survive in the derivative work — erasing it would be a licence violation, and NOTICE (untouched) still carries it. The About footer now reads:

Copyright 2026 brains Contributors · portions Copyright 2025-2026 OpenCovibe Contributors

brains is presented as the product; upstream keeps accurate credit for the portions it wrote. Same shape as the NOTICE file, one line so the flex footer layout is unchanged.

What this deliberately does NOT rename

The most important part of this review: ~100 occurrences of the upstream name legitimately remain. Renaming any of these changes runtime behaviour or breaks installed users.

Left alone	Why
~/.opencovibe/… paths in code, opencovibe-uploads / opencovibe-attachments temp dirs	These are real paths on disk. Renaming orphans or relocates existing users' data.
OPENCOVIBE_TASK_ID, OPENCOVIBE_RUN_ID	Child-process env contract — user hooks and scripts already read these names.
"name": "opencovibe" / "title": "OpenCovibe" in agent/codex_appserver.rs, agent/codex_control.rs	Handshake identity the Codex appserver sees. Protocol, not branding.
opencovibe_desktop_lib in src-tauri/Cargo.toml	Crate name; referenced by the Rust build.
DB_NAME = "opencovibe-snapshot" in src/lib/utils/snapshot-cache.ts	IndexedDB database name. Same class as the data-dir paths — a rename silently orphans every cached snapshot in every installed webview. Not in the ticket's list, flagging it as the same category.
Internal code and test comments (dozens)	Historical context about how the fork behaves, not branding a user reads.
LICENSE, NOTICE, CODE_OF_CONDUCT.md	Apache-2.0 attribution obligation.
README.md, README.zh-CN.md, CONTRIBUTING.md	A docs rewrite is a separate concern (see follow-ups — one of these does leak into the UI).

The CI gate and why it is narrow

scripts/branding-check.sh, wired in as a blocking step after the i18n check. Because so much of the upstream name is load-bearing, a repo-wide grep would fail on the first run and stay red forever — so the gate names the cleaned surfaces instead, in three rules:

1. Zero tolerance for opencovibe|anyiwang (case-insensitive) in messages/, src/lib/commands.ts, src/lib/utils/html-export.ts, src-tauri/src/web_server/auth.rs, package.json, package-lock.json, .github/ISSUE_TEMPLATE/config.yml. Those files are now completely clean, so any hit is a regression.
2. No anyiwang anywhere under src/ — the real invariant behind this ticket: nothing the frontend ships may link a user to the upstream fork. This catches a reintroduced /feedback URL or export footer even in a file that legitimately keeps the name in a comment.
3. AboutModal.svelte may keep exactly one upstream mention — the line carrying portions Copyright. Anything else there means the product started naming itself after the fork again.

Rule 2 is intentionally scoped to src/ and not src-tauri/, because src-tauri/src/commands/updates.rs still contains upstream URLs (follow-up 1 below). Widening rule 2 to the Rust tree is the natural second commit once that is resolved.

Follow-ups found but not done here

1. src-tauri/src/commands/updates.rs:7 — I would prioritise this above the bug I just fixed. GITHUB_API_URL is https://api.github.com/repos/AnyiWang/OpenCovibe/releases/latest, and the About modal's "Update to latest" button resolves downloadUrl from that response and hands it to plugin-shell::open. The app therefore offers users an unrelated third party's binary as its own update. Left untouched because it is outside this ticket's stated scope and it is behaviour-changing: flipping the constant needs the brains-desktop release channel to actually publish releases, or the updater simply breaks. Needs its own ticket and a decision about where releases live.
2. SECURITY.md:18 points vulnerability reports at https://github.com/AnyiWang/OpenCovibe/security/advisories/new — exactly the same misrouting class as /feedback, for the reports that matter most.
3. README.zh-CN.md leaks into the UI. AboutModal imports both READMEs with ?raw and renders one per locale. README.md (en) is already brains-branded, but the zh-CN one is still the upstream document, so Chinese users' About tab shows upstream releases / clone / issues links (lines 87, 94, 132, 237).
4. scripts/clean-dmg.mjs:19 matches /^OpenCovibe_.*\.dmg$/ while tauri.conf.json productName is already brains — the prebuild:dmg cleanup is dead code today.
5. Smaller ones: scripts/release.mjs:100 prints upstream's Actions URL; scripts/setup.sh and scripts/check-serde-sync.sh still identify as OpenCovibe; docs/UI-REFERENCE.md is titled "OpenCovibe UI Reference"; src/routes/_opencovibe_layout.svelte.txt carries the name in its filename.
6. package.json description is still upstream's "Local-first desktop app for AI-assisted vibe coding".

Verification

• node scripts/i18n-check.mjs — 0 errors, 18 warnings, byte-identical to the baseline on main (all warnings are pre-existing "same as en" on unrelated keys). cmd_versionContent stays covered by the script's untranslated-allowlist; layout_appName: "brains" is classified technical, so no new warning.
• npx prettier --check on all 8 changed frontend files — clean. Only AboutModal.svelte needed --write, and the reflow is confined to the two lines I touched.
• npx eslint on the 5 changed src/ files — 0 errors. One pre-existing IS_WEBKIT unused-var warning in chat/+page.svelte, untouched by this diff.
• cargo fmt --manifest-path src-tauri/Cargo.toml --check — exit 0, no reformatting (the change is inside a raw string literal).
• npm run branding:check — passes. Negative-tested: reverting layout_appName to "OpenCovibe" makes it exit 1 and print the offending file:line, then restoring it goes green again.
• Checked nothing asserts on the strings changed here — slash-commands.test.ts asserts _action/name, never description; no test references buildExportFilename's output or LOGIN_HTML's body; the /feedback URL had no test.
• Not run (no local build env, per the repo's dev setup): npm run build, npm run check, vitest, cargo test, cargo clippy. CI owns all five.
• Committed with --no-verify: the pre-commit hook's svelte-check step needs the missing local .svelte-kit. Its ESLint step did run first and reported 0 errors.

Review notes

Possible collisions with sibling DESK PRs: BRNS-DESK-026 adds Terms/Privacy links to AboutModal.svelte (same footer region), and 022 / 027 / 028 / 030 touch the locale files. Whichever lands second needs a rebase; both conflicts are mechanical.

[Chris-ssvlabs]

🟡 BRNS-DESK-017: gate omits static/ although the ticket names it explicitly — static/architecture.svg and static/architecture-zh.svg still contain ~/.opencovibe/ at head, and architecture-zh.svg renders user-facing in AboutModal.svelte via the README.zh-CN.md embed, so the regression the ticket calls out is neither fixed nor catchable. Fix the two SVG labels and add static to strict_paths.

[Chris-ssvlabs]

🟡 Gate fails open on grep error: if any path in strict_paths is renamed or deleted, grep exits 2 (error) even when other listed files contain real hits, if hits=$(...) takes the else branch, and the script exits 0 printing success — the whole rule is silently disabled. Capture the exit code and treat anything other than 1 as failure (e.g. hits=$(grep ...); rc=$?; [ "$rc" -ne 1 ] && status=1), or pre-check that every listed path exists.

[nir-ssvlabs]

The gate is the part I'd have been most sceptical of and it holds up: branding:check is genuinely wired into ci.yml as a blocking step (line 86), not just committed — which is the failure mode a sibling guard in the brains repo hit — it passes clean here, and scoping it explicitly rather than grepping repo-wide is right, since LICENSE / NOTICE / CODE_OF_CONDUCT / the README's "Forked from" are attribution that has to stay. The grep -rniE 'anyiwang' src arm covers the whole app surface, so the fix can't rot back in where it matters.

🟡 Medium · the documented reporting route still points at the fork (non-blocking): @sebastian-ssvlabs CONTRIBUTING.md:7-8 sends Bug reports and Feature requests to https://github.com/AnyiWang/OpenCovibe/issues/new, and line 16 clones from there. That is the same class this PR closes — user-authored report content reaching a repo we don't control — just via the documented path rather than /feedback. The gate can't catch it because the anyiwang arm is scoped to src. Repoint those three lines and add CONTRIBUTING.md to strict_paths, and the whole reporting surface is closed rather than the in-app half.

Checked: every remaining anyiwang/opencovibe hit in the tree triaged into attribution vs live routing, the gate's scope and its CI wiring, and that it exits 0 on this branch. Not read: the eight locale strings one by one — i18n-check covers alignment and the visible ones are named in the description.

Merge: ✅ into main — the in-app leak is the urgent half and it's fixed. The CONTRIBUTING.md route is worth folding in before this closes the ticket.