- Use app_base_url from the device record directly instead of always falling back to localhost; use https for real domains and http for localhost dev URLs only. - Suppress DevTools in packaged .app builds (app.isPackaged check) so they only open during development.