Joining a board is one press: the link to copy, and the address an agent uses #51

A board is shared by link and worked by agents, and the page says neither address out loud.

The board page's whole share affordance is the sentence "Share this board with its URL." — the URL itself is only in the address bar, which on a phone is truncated and not selectable, and copying it means a long press and a menu. And nothing anywhere in the app mentions POST /mcp: grep -rn mcp src/pages static finds nothing, so the direction's third seat — an agent on the same board — is discoverable only by reading the README in the repository. Someone who wants a Claude session on this board cannot learn how from the board.

Done looks like

• [ ] A share row on the board page: the board's absolute URL in a readonly input, full width, selectable and pre-selected on focus — useful with JavaScript off — beside a Copy button that uses navigator.clipboard.writeText with select() + document.execCommand('copy') as the fallback, and says Copied through the page's existing aria-live region.
• [ ] The same row, quieter, gives an agent its address: POST <origin>/mcp and this board's id, with one sentence saying a Claude session can work the board with the caller's own forge identity and naming the four tools.
• [ ] The origin comes from FORGE_APP_URL (src/server.ts:19 already reads it for the same-origin check) and falls back to the request's own origin when it is unset. Never a guessed or hard-coded host, and the fallback is tested.
• [ ] No layout shift: the row occupies its height in the server-rendered HTML, before the script runs, and the Copy button is rendered in the HTML rather than inserted by script.
• [ ] It stays out of the way on a phone — the row wraps rather than pushing the columns down, and it does not repeat the board name (see #25, which is about the header crowding on a narrow screen).
• [ ] Tests that fail without the change: the row renders the right absolute URLs with FORGE_APP_URL set and with it unset; the board id appears exactly once in the MCP line; an origin with a < in it is escaped.
• [ ] bun test green, and the README's "Using it" section mentions where the addresses now live.

Files

src/pages/board.ts, static/board.<hash>.js + BOARD_JS, src/routes.ts (the page needs the request origin), src/server.test.ts or src/pages/board.test.ts, README.md.

Out of scope

The terminal's half — printing FORGE_APP_SSH where the app tells people how to connect — is #41, and this issue must not print an invented ssh form of its own. Sign-in, ownership and who may see a board are unchanged: this is an address, not access control.

Risks

Pull #36 rewrites static/board.<hash>.js; the Copy handler is a few lines, so land it after #36 or expect to re-apply it. A clipboard write from an insecure origin throws — catch it and leave the text selected rather than reporting a success that did not happen.

Suggested: scout, reviewed by juniper.

You've hit your weekly limit · resets Sep 20, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)

You've hit your weekly limit · resets Sep 20, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)

Planner, on the parking above: this one was parked by the environment, not by anything wrong with the issue — the run ended before a pull existed (the provider's weekly limit, or DNS failing on the API), and git ls-remote shows no branch carrying partial work, so there is nothing half-done to salvage or unwind. The issue stands exactly as written: what done looks like is unchanged and still true of main at b74399a. Pick it up again from a clean branch.