Innim · greymag · Sep 9, 2026 · Sep 8, 2026
diff --git a/unpub/CHANGELOG.md b/unpub/CHANGELOG.md
@@ -3,6 +3,9 @@
 ### Added
 - `--legacy-hosted-url-rewrite`, which serves versions published under an earlier address of this repository as though their dependencies named its current one. Authentication needs https — `dart pub token add` refuses a plain-http url — but pub treats a package's repository url as part of its identity, so a version published against `http://pub.example.org` asks for a *different* package than an application asking for it on `https://pub.example.org`, and the solver reports the two as an unsatisfiable conflict. That left only republishing every old version, overriding them in every consumer, or serving the old metadata under the new address; this is the third. Only the repository API answer changes: archives keep the `pubspec.yaml` they were published with, their content hashes stay valid, no version number moves, and switching the flag off restores the previous answers exactly. It covers `dependencies`, `dev_dependencies` and `dependency_overrides`, both the `hosted: <url>` and the `hosted: {name, url}` forms, and leaves `git`, `path`, `sdk` and every other repository alone. The address rewritten *to* is the one the server is answering on, so the only url it can produce is one the client has just reached — an https caller can never be sent to an http endpoint. Matching is on the parsed address rather than the text, so `http://pub.example.org.attacker.test` is a different host, as is the same host on another port or path prefix. Off by default: it makes the repository answer with something other than what was published and reports each rewrite at `FINE`, where the default log level shows nothing, so on-by-default a mistaken rewrite would be silent while a missing one is a `pub get` that fails loudly. Behind a TLS-terminating proxy it needs `--proxy-origin`, the same setting the archive urls already depend on. `--legacy-hosted-url` adds addresses that were retired outright; the same address over plain http is derived and need not be listed.
 
+### Changed
+- The browser tab is titled with the page it is showing, rather than a fixed `in_pub` on every one of them: a package's name and, on a version page, its version; what was searched for; `Packages`, `Account`, `Administration`; and the repository's name alone on the home page. Written pub.dev's way round, the specific part first, because the first few characters are all a tab strip has room for. The name is declared once, in `unpub_api/page_title.dart`, and stamped into the served shell through the build-time template mechanism, so what a tab says before the bundle has loaded is what it goes on saying.
+
 ## 3.5.1
 
 ### Added

diff --git a/unpub/lib/src/app.dart b/unpub/lib/src/app.dart
@@ -15,6 +15,7 @@ import 'package:archive/archive.dart';
 import 'package:in_pub/src/address.dart';
 import 'package:in_pub/src/models.dart';
 import 'package:in_pub/unpub_api/lib/models.dart';
+import 'package:in_pub/unpub_api/lib/page_title.dart';
 import 'package:in_pub/unpub_api/lib/spa_routes.dart';
 import 'package:in_pub/src/meta_store.dart';
 import 'package:in_pub/src/package_store.dart';
@@ -1359,6 +1360,10 @@ class App {
   /// reverting to the unversioned url this exists to avoid — the moment
   /// webdev changed a quote or reordered an attribute.
   String get _indexHtml => _indexHtmlBody ??= index_html.content({
+        // What the tab says until the application has loaded and named the
+        // page it is showing. The same constant the web UI composes its own
+        // titles from, so the two cannot disagree over the repository's name.
+        'APP_TITLE': appTitle,
         'APP_VERSION': version,
         'BUNDLE_VERSION': _mainDartJsTag.replaceAll('"', ''),
       });

diff --git a/unpub/lib/src/static/index.html.dart b/unpub/lib/src/static/index.html.dart
@@ -1,7 +1,7 @@
 String content(Map<String, String> vars) => """<!DOCTYPE html>
 <html>
   <head>
-    <title>in_pub</title>
+    <title>${vars['APP_TITLE'] ?? ''}</title>
     <meta charset="utf-8" />
     <base href="/" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />