codebay 0.10.1 → 0.11.1

package/src/lib/devcontainer.server.ts

@@ -1,5 +1,5 @@
-import { chmod, cp, mkdir, readFile, writeFile } from 'node:fs/promises';
-import { existsSync, statSync } from 'node:fs';
+import { chmod, cp, mkdir, readFile, unlink, writeFile } from 'node:fs/promises';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { basename, dirname, join, relative } from 'node:path';
 import { homedir } from 'node:os';
 import { INSTALL_SCRIPT as TMUX_INSTALL_SCRIPT } from '../container-injections/tmux.ts';
@@ -18,6 +18,7 @@ import {
 	dockerEnv
 } from './config.server.ts';
 import { spawnCapture } from './spawn.server.ts';
+import { isTrackedFile, restoreTrackedFile } from './git.server.ts';
 import { getOption, type InstanceMode } from './db.server.ts';
 import { claudePermissionFlags, type ClaudePermissionMode, type PortForward } from '../types.ts';
 
@@ -100,8 +101,18 @@ const CLAUDE_FEATURE_INSTALL =
 
 /** Manager-dropped files the project's own .gitignore won't cover, kept out of git status. */
 const MANAGER_GIT_EXCLUDES = [
+	'/.devcontainer/codebay.devcontainer.json',
+	'/.codebay.devcontainer.json',
 	'/.devcontainer/code-server-settings.json',
 	'/.devcontainer/devcontainer-lock.json',
+	'/.devcontainer-lock.json',
+	// The subfolder config form places the merged config, lock, and staged features one level deeper.
+	'/.devcontainer/*/codebay.devcontainer.json',
+	'/.devcontainer/*/devcontainer-lock.json',
+	'/.devcontainer/*/codebay-tmux/',
+	'/.devcontainer/*/codebay-ttyd/',
+	'/.devcontainer/*/codebay-claude/',
+	'*.codebay-backup',
 	'/.devcontainer/codebay-tmux/',
 	'/.devcontainer/codebay-ttyd/',
 	'/.devcontainer/codebay-claude/',
@@ -416,20 +427,47 @@ function stripJsonc(input: string): string {
 	return out;
 }
 
-/** Follows the CLI's precedence: `.devcontainer/devcontainer.json`, then `.devcontainer.json`. */
+/**
+ * Follows the spec's precedence: `.devcontainer/devcontainer.json`, `.devcontainer.json`, then
+ * the one-level-deep `.devcontainer/<folder>/devcontainer.json` form (first folder alphabetically).
+ */
 export function findDevcontainerConfig(dir: string): string | null {
 	const nested = join(dir, '.devcontainer', 'devcontainer.json');
 	if (existsSync(nested)) return nested;
 	const flat = join(dir, '.devcontainer.json');
 	if (existsSync(flat)) return flat;
+	const root = join(dir, '.devcontainer');
+	let entries;
+	try {
+		entries = readdirSync(root, { withFileTypes: true });
+	} catch {
+		return null;
+	}
+	for (const name of entries
+		.filter((e) => e.isDirectory())
+		.map((e) => e.name)
+		.sort()) {
+		const candidate = join(root, name, 'devcontainer.json');
+		if (existsSync(candidate)) return candidate;
+	}
 	return null;
 }
 
-function configPath(workspaceDir: string): string {
-	// Falls back to the nested path because that's where we'd create one.
-	return (
-		findDevcontainerConfig(workspaceDir) ?? join(workspaceDir, '.devcontainer', 'devcontainer.json')
-	);
+const CODEBAY_CONFIG_NESTED = 'codebay.devcontainer.json';
+const CODEBAY_CONFIG_FLAT = '.codebay.devcontainer.json';
+
+/**
+ * Sits in the same directory as the project's own config, which is what `--config` points the CLI at:
+ * relative dockerfile/compose/feature paths resolve against that directory either way.
+ */
+export function overrideConfigPath(
+	workspaceDir: string,
+	canonical: string | null = findDevcontainerConfig(workspaceDir)
+): string {
+	if (!canonical) return join(workspaceDir, '.devcontainer', CODEBAY_CONFIG_NESTED);
+	return basename(canonical) === '.devcontainer.json'
+		? join(workspaceDir, CODEBAY_CONFIG_FLAT)
+		: join(dirname(canonical), CODEBAY_CONFIG_NESTED);
 }
 
 type DevcontainerConfig = {
@@ -450,10 +488,10 @@ function containerPortOf(entry: number | string): number {
 	return Number.parseInt(last, 10);
 }
 
-/** Only meaningful on a pristine, pre-injection config; code-server's own port is excluded. */
+/** Reads the project's own config (never Codebay's merged one); reserved ports are excluded. */
 export async function readDeclaredContainerPorts(workspaceDir: string): Promise<number[]> {
-	const target = configPath(workspaceDir);
-	if (!existsSync(target)) return [];
+	const target = findDevcontainerConfig(workspaceDir);
+	if (!target) return [];
 	let config: DevcontainerConfig;
 	try {
 		config = JSON.parse(stripJsonc(await readFile(target, 'utf8'))) as DevcontainerConfig;
@@ -487,7 +525,10 @@ export async function readDeclaredContainerPorts(workspaceDir: string): Promise<
 /** Maps `host.docker.internal` to the host so the in-container attention bridge resolves. */
 const HOST_GATEWAY_ARG = '--add-host=host.docker.internal:host-gateway';
 
-/** Operates on the copy, never the user's original, so rewriting and normalizing is safe. */
+/**
+ * Merges the project's config (read-only) into a Codebay-owned sibling file that `devcontainer up
+ * --override-config` boots from, so the project's own devcontainer.json never shows as modified in git.
+ */
 export async function writeOverrideConfig(
 	workspaceDir: string,
 	hostPort: number,
@@ -496,31 +537,37 @@ export async function writeOverrideConfig(
 	mode: InstanceMode = 'ide',
 	permissionMode: ClaudePermissionMode = 'default',
 	envVars: { name: string; value: string }[] = []
-): Promise<{ imageSource: string }> {
+): Promise<{ imageSource: string; configPath: string | null; overrideConfigPath: string }> {
 	const isTerminal = mode === 'terminal';
-	const target = configPath(workspaceDir);
+	const canonical = findDevcontainerConfig(workspaceDir);
+	const target = overrideConfigPath(workspaceDir, canonical);
 	let config: DevcontainerConfig = {};
 
-	const hadConfig = existsSync(target);
+	const hadConfig = canonical !== null;
 	const imageSource = hadConfig ? 'local' : defaultImage;
 
-	if (hadConfig) {
-		const raw = await readFile(target, 'utf8');
+	if (canonical) {
+		const raw = await readFile(canonical, 'utf8');
 		try {
 			config = JSON.parse(stripJsonc(raw)) as DevcontainerConfig;
 		} catch (err) {
 			throw new Error(
-				`Could not parse existing devcontainer.json at ${target}: ${(err as Error).message}`,
+				`Could not parse existing devcontainer.json at ${canonical}: ${(err as Error).message}`,
 				{ cause: err }
 			);
 		}
+		// A config restoreCanonicalConfig couldn't clean (injection committed, or no .git to restore
+		// from) must not feed its baked-in injections back into the merge.
+		if (raw.includes(OVERRIDE_FINGERPRINT)) stripLegacyInjections(config);
 	} else {
 		config.image = defaultImage;
 	}
 
-	// A local feature is addressed relative to the config, which sits at one of two depths.
-	const featureKey = (dir: string) =>
-		`./${relative(dirname(target), join(workspaceDir, '.devcontainer', dir))}`;
+	// Local features are staged next to a subfolder-form config (the CLI only promises to resolve
+	// `./`-descendant feature paths), and under `.devcontainer/` for the two classic forms.
+	const featureRoot =
+		dirname(target) === workspaceDir ? join(workspaceDir, '.devcontainer') : dirname(target);
+	const featureKey = (dir: string) => `./${relative(dirname(target), join(featureRoot, dir))}`;
 	const tmuxFeatureKey = featureKey(TMUX_FEATURE_DIR);
 	const ttydFeatureKey = featureKey(TTYD_FEATURE_DIR);
 	const claudeFeatureKey = featureKey(CLAUDE_FEATURE_DIR);
@@ -577,7 +624,7 @@ export async function writeOverrideConfig(
 	await writeFile(target, JSON.stringify(config, null, 2) + '\n', 'utf8');
 
 	if (isTerminal) {
-		await writeTtydFeature(workspaceDir);
+		await writeTtydFeature(featureRoot);
 		await writeTerminalLaunchScript(workspaceDir, permissionMode);
 	} else {
 		// Staged next to the config; codeServerLaunch copies it into the user-data dir on first start.
@@ -590,13 +637,113 @@ export async function writeOverrideConfig(
 		await writeTerminalTask(workspaceDir, permissionMode);
 	}
 
-	await writeTmuxFeature(workspaceDir);
+	await writeTmuxFeature(featureRoot);
 
-	if (isTerminal && hadConfig) await writeClaudeFeature(workspaceDir);
+	if (isTerminal && hadConfig) await writeClaudeFeature(featureRoot);
 
 	await writeLocalGitExclude(workspaceDir);
 
-	return { imageSource };
+	return { imageSource, configPath: canonical, overrideConfigPath: target };
+}
+
+/** `codebay-tmux` has been injected into every config this manager has ever written. */
+const OVERRIDE_FINGERPRINT = TMUX_FEATURE_DIR;
+
+/** Where a destructive restore stashes the pre-restore file, in case it held user edits. */
+const LEGACY_BACKUP_SUFFIX = '.codebay-backup';
+
+/**
+ * Removes what the legacy in-place scheme baked into a config that git couldn't restore — left as
+ * merge input, the stale features would resurrect and the launcher would chain onto itself.
+ */
+function stripLegacyInjections(config: DevcontainerConfig): void {
+	if (config.features) {
+		for (const key of Object.keys(config.features)) {
+			if (
+				key === CODE_SERVER_FEATURE ||
+				key.includes(TMUX_FEATURE_DIR) ||
+				key.includes(TTYD_FEATURE_DIR) ||
+				key.includes(CLAUDE_FEATURE_DIR)
+			) {
+				delete config.features[key];
+			}
+		}
+	}
+	if (typeof config.postStartCommand === 'string') {
+		const cmd = config.postStartCommand;
+		// The legacy launcher was always appended last, as a `bash -c "…nohup code-server/ttyd…"` tail.
+		const start = cmd.lastIndexOf('bash -c "');
+		if (start !== -1 && /nohup (?:code-server|ttyd) /.test(cmd.slice(start))) {
+			const head = cmd
+				.slice(0, start)
+				.replace(/\s*&&\s*$/, '')
+				.trim();
+			if (head) config.postStartCommand = head;
+			else delete config.postStartCommand;
+		}
+	}
+}
+
+/**
+ * Undoes the legacy scheme that overwrote the project's own devcontainer.json in place: restores
+ * the tracked file (or deletes the one Codebay created) so the instance's git status comes clean.
+ * `'unknown'` means git itself failed to answer, so the caller should retry on the next rebuild.
+ */
+export async function restoreCanonicalConfig(
+	workspaceDir: string
+): Promise<'restored' | 'deleted' | 'none' | 'unknown'> {
+	const canonical = findDevcontainerConfig(workspaceDir);
+	if (!canonical) return 'none';
+
+	let content: string;
+	try {
+		content = await readFile(canonical, 'utf8');
+	} catch {
+		return 'none';
+	}
+	if (!content.includes(OVERRIDE_FINGERPRINT)) return 'none';
+
+	// Only a real .git directory can vouch for the file's provenance (same check as the excludes).
+	const gitDir = join(workspaceDir, '.git');
+	if (!existsSync(gitDir) || !statSync(gitDir).isDirectory()) return 'none';
+
+	const relPath = relative(workspaceDir, canonical);
+	const tracked = await isTrackedFile(workspaceDir, relPath);
+	if (tracked === null) return 'unknown'; // never destroy a config on a guess
+
+	// The file may hold user edits on top of the injection — stash it before anything destructive.
+	const backup = canonical + LEGACY_BACKUP_SUFFIX;
+	const dropBackup = () => unlink(backup).catch(() => {});
+	try {
+		await writeFile(backup, content, 'utf8');
+	} catch {
+		// Best-effort: a failed backup shouldn't block the migration itself.
+	}
+
+	if (tracked) {
+		if (!(await restoreTrackedFile(workspaceDir, relPath))) {
+			await dropBackup();
+			return 'unknown';
+		}
+		const after = await readFile(canonical, 'utf8').catch(() => null);
+		if (after === content) {
+			// The injection was committed inside the instance, so git has nothing cleaner to offer;
+			// stripLegacyInjections keeps it out of the merge instead.
+			await dropBackup();
+			return 'none';
+		}
+		return 'restored';
+	}
+
+	// Fingerprinted but untracked: Codebay created it for a config-less project — remove it so the
+	// next merge falls back to the default image again.
+	try {
+		await unlink(canonical);
+	} catch {
+		await dropBackup();
+		return 'unknown';
+	}
+	return 'deleted';
 }
 
 /**
@@ -669,8 +816,8 @@ async function writeLocalGitExclude(workspaceDir: string): Promise<void> {
 	await writeFile(excludePath, existing ? `${existing}\n\n${block}` : block, 'utf8');
 }
 
-async function writeTmuxFeature(workspaceDir: string): Promise<void> {
-	const dir = join(workspaceDir, '.devcontainer', TMUX_FEATURE_DIR);
+async function writeTmuxFeature(featureRoot: string): Promise<void> {
+	const dir = join(featureRoot, TMUX_FEATURE_DIR);
 	await mkdir(dir, { recursive: true }).catch(() => {});
 	await writeFile(
 		join(dir, 'devcontainer-feature.json'),
@@ -683,8 +830,8 @@ async function writeTmuxFeature(workspaceDir: string): Promise<void> {
 	await chmod(installPath, 0o755);
 }
 
-async function writeClaudeFeature(workspaceDir: string): Promise<void> {
-	const dir = join(workspaceDir, '.devcontainer', CLAUDE_FEATURE_DIR);
+async function writeClaudeFeature(featureRoot: string): Promise<void> {
+	const dir = join(featureRoot, CLAUDE_FEATURE_DIR);
 	await mkdir(dir, { recursive: true }).catch(() => {});
 	await writeFile(
 		join(dir, 'devcontainer-feature.json'),
@@ -696,8 +843,8 @@ async function writeClaudeFeature(workspaceDir: string): Promise<void> {
 	await chmod(installPath, 0o755);
 }
 
-async function writeTtydFeature(workspaceDir: string): Promise<void> {
-	const dir = join(workspaceDir, '.devcontainer', TTYD_FEATURE_DIR);
+async function writeTtydFeature(featureRoot: string): Promise<void> {
+	const dir = join(featureRoot, TTYD_FEATURE_DIR);
 	await mkdir(dir, { recursive: true }).catch(() => {});
 	await writeFile(
 		join(dir, 'devcontainer-feature.json'),
@@ -758,7 +905,10 @@ export interface UpResult {
 	description?: string;
 }
 
-export function devcontainerUpArgs(workspaceDir: string, opts: { noCache?: boolean } = {}) {
+/** `configPath` is the project's own config (`--config`), `overrideConfigPath` the Codebay-owned one. */
+type UpOptions = { noCache?: boolean; configPath?: string; overrideConfigPath?: string };
+
+export function devcontainerUpArgs(workspaceDir: string, opts: UpOptions = {}) {
 	const args = [
 		devcontainerBin(),
 		'up',
@@ -766,6 +916,10 @@ export function devcontainerUpArgs(workspaceDir: string, opts: { noCache?: boole
 		workspaceDir,
 		'--remove-existing-container'
 	];
+	// --config rejects any basename but devcontainer.json/.devcontainer.json, so the Codebay-owned
+	// file rides --override-config; --config only pins which path relative resolution is based on.
+	if (opts.configPath) args.push('--config', opts.configPath);
+	if (opts.overrideConfigPath) args.push('--override-config', opts.overrideConfigPath);
 	// Only takes effect because --remove-existing-container drops the container before the build.
 	if (opts.noCache) args.push('--build-no-cache');
 	return args;
@@ -783,7 +937,7 @@ export function devcontainerUpEnv(): Record<string, string | undefined> {
 export async function devcontainerUp(
 	workspaceDir: string,
 	onLog: (chunk: string) => void,
-	opts: { noCache?: boolean } = {}
+	opts: UpOptions = {}
 ): Promise<UpResult> {
 	const proc = Bun.spawn(devcontainerUpArgs(workspaceDir, opts), {
 		cwd: workspaceDir,

package/src/lib/docker.server.ts

@@ -106,6 +106,16 @@ export async function stopContainer(containerId: string): Promise<boolean> {
 	}
 }
 
+/** Rebuild-safe removal: volumes survive — the CLI's `--remove-existing-container` is a plain `docker rm -f`, no `-v`. */
+export async function removeContainerOnly(containerId: string): Promise<boolean> {
+	try {
+		await (await getDocker()).getContainer(containerId).remove({ force: true });
+		return true;
+	} catch (err) {
+		return statusOf(err) === 404; // already absent counts as success
+	}
+}
+
 /** Named volumes must be listed before removal and dropped by hand — the engine never reaps them. */
 export async function removeContainer(containerId: string): Promise<boolean> {
 	const docker = await getDocker();

package/src/lib/git.server.ts

@@ -16,6 +16,34 @@ export async function readGitBranch(workspacePath: string): Promise<string | nul
 	}
 }
 
+/** Exit-code probe — `spawnCapture` can't tell a silent success from a failure. */
+async function gitExitCode(workspaceDir: string, args: string[]): Promise<number | null> {
+	try {
+		const proc = Bun.spawn(['git', '-C', workspaceDir, ...args], {
+			stdout: 'ignore',
+			stderr: 'ignore'
+		});
+		return await proc.exited;
+	} catch {
+		return null; // no git on the host
+	}
+}
+
+/** `null` means git itself failed to answer (missing binary, corrupt repo) — not "untracked". */
+export async function isTrackedFile(
+	workspaceDir: string,
+	relPath: string
+): Promise<boolean | null> {
+	const code = await gitExitCode(workspaceDir, ['ls-files', '--error-unmatch', '--', relPath]);
+	if (code === 0) return true;
+	if (code === 1) return false; // ls-files --error-unmatch reserves 1 for "no such tracked file"
+	return null;
+}
+
+export async function restoreTrackedFile(workspaceDir: string, relPath: string): Promise<boolean> {
+	return (await gitExitCode(workspaceDir, ['checkout', '--', relPath])) === 0;
+}
+
 /**
  * The token goes in env-scoped git config, so it lands in neither argv nor the clone's
  * persisted `.git/config`; `GIT_TERMINAL_PROMPT=0` fails fast instead of blocking on a prompt.

package/src/lib/instances.server.ts

@@ -33,6 +33,7 @@ import {
 	hostPortsInUse,
 	isRunning,
 	removeContainer,
+	removeContainerOnly,
 	startContainer,
 	stopContainer
 } from './docker.server.ts';
@@ -43,6 +44,7 @@ import {
 	INJECTIONS_DONE_FILE,
 	launchCommandFor,
 	readDeclaredContainerPorts,
+	restoreCanonicalConfig,
 	TERMINAL_LAUNCHED_MARKER,
 	writeOverrideConfig
 } from './devcontainer.server.ts';
@@ -73,7 +75,8 @@ import {
 	normalizeMode,
 	type Instance,
 	type InstanceFilter,
-	type InstanceHealth
+	type InstanceHealth,
+	type Theme
 } from '../types.ts';
 
 /** The sprite a row shows: its persisted choice, or the id hash for rows created before avatars were stored. */
@@ -189,7 +192,9 @@ export type StreamEvent =
 	// The dashboard run-state filter, so a change in one tab propagates to every open client.
 	| { type: 'filter'; data: { value: InstanceFilter } }
 	// The global default editor surface, so the picker's toggle follows a settings change.
-	| { type: 'default-mode'; data: { mode: InstanceMode } };
+	| { type: 'default-mode'; data: { mode: InstanceMode } }
+	// The colour scheme, so a change in the settings popup repaints the window behind it.
+	| { type: 'theme'; data: { value: Theme } };
 
 interface StreamHub {
 	sockets: Set<ServerWebSocket<unknown>>;
@@ -250,6 +255,14 @@ export function broadcastDefaultMode(mode: InstanceMode): void {
 	broadcast({ type: 'default-mode', data: { mode } });
 }
 
+/**
+ * Same popup problem for the theme — but it lives in a cookie, not `options`, so there's
+ * nothing to seed a reconnecting client with: its own cookie already drives the SSR paint.
+ */
+export function broadcastTheme(value: Theme): void {
+	broadcast({ type: 'theme', data: { value } });
+}
+
 async function reconcileInstances(force = false): Promise<void> {
 	const list = await listInstances();
 	const listJson = JSON.stringify(list);
@@ -380,7 +393,7 @@ async function boot(row: InstanceRow, opts: { branch?: string } = {}): Promise<v
 	await provision(row);
 }
 
-/** Must run before config injection, while the copied `devcontainer.json` is still pristine. */
+/** Reads the project's own `devcontainer.json`, which the config injection never touches. */
 async function seedDeclaredPorts(row: InstanceRow): Promise<void> {
 	const existing = new Set(listForwards(row.id).map((f) => f.container_port));
 	for (const containerPort of await readDeclaredContainerPorts(row.workspace_path)) {
@@ -425,6 +438,22 @@ async function provision(row: InstanceRow, opts: { noCache?: boolean } = {}): Pr
 	let containerId: string | null = null;
 	inFlight.add(row.id);
 	try {
+		// Migrates instances created before the merged config moved to its own file — one-shot per
+		// instance, so a later rebuild can never claw back a config the user has since edited.
+		if (!row.config_migrated) {
+			const migrated = await restoreCanonicalConfig(row.workspace_path);
+			if (migrated === 'restored' || migrated === 'deleted') {
+				appendLog(
+					row.id,
+					'Restored the project devcontainer config (Codebay now keeps its merged config in a separate file)\n'
+				);
+			}
+			// 'unknown' means git itself failed to answer; leave the flag unset so the next rebuild retries.
+			if (migrated !== 'unknown') {
+				updateInstance(row.id, { config_migrated: 1 });
+				row.config_migrated = 1;
+			}
+		}
 		// On a rebuild `devcontainer up --remove-existing-container` discards the old container's
 		// ~/.claude, so drain it first; a first boot has no container_id and skips straight past.
 		if (row.container_id) {
@@ -438,7 +467,7 @@ async function provision(row: InstanceRow, opts: { noCache?: boolean } = {}): Pr
 		}));
 		appendLog(row.id, `Injecting ${surfaceLabel(row.mode)} (host port ${row.host_port})\n`);
 		const defaultImage = getOption('default_image') ?? DEFAULT_IMAGE;
-		const { imageSource } = await writeOverrideConfig(
+		const { imageSource, configPath, overrideConfigPath } = await writeOverrideConfig(
 			row.workspace_path,
 			row.host_port,
 			forwards,
@@ -452,10 +481,22 @@ async function provision(row: InstanceRow, opts: { noCache?: boolean } = {}): Pr
 		const noCache = opts.noCache || getOption('disable_build_cache') === '1';
 		if (noCache) appendLog(row.id, `Building without cache (--build-no-cache)\n`);
 
+		// The CLI's --remove-existing-container matches by the devcontainer.config_file label, and
+		// deliberately ignores a workspace match whose label differs — so a container left by a build
+		// that labelled itself differently would survive and keep the host port. Drop it ourselves.
+		if (row.container_id && !(await removeContainerOnly(row.container_id))) {
+			appendLog(
+				row.id,
+				`⚠ Could not remove the previous container (${row.container_id.slice(0, 12)}) — if the boot fails on a busy port, remove it manually\n`
+			);
+		}
+
 		appendLog(row.id, `Starting devcontainer…\n`);
 		const upStart = Date.now();
 		const result = await devcontainerUp(row.workspace_path, (chunk) => appendLog(row.id, chunk), {
-			noCache
+			noCache,
+			configPath: configPath ?? undefined,
+			overrideConfigPath
 		});
 		appendLog(row.id, `⏱ devcontainer up: ${elapsed(upStart)}\n`);
 
@@ -592,7 +633,9 @@ export async function createInstance(
 		// Kept synchronous through insertInstance so two concurrent creations can't claim the same free sprite.
 		avatar: pickUniqueAvatar(id, allInstances().map(effectiveAvatarName)).name,
 		mode: opts.mode ?? getDefaultMode(),
-		terminal_split: 0
+		terminal_split: 0,
+		// Born under the separate-config scheme, so there is never a legacy injection to undo.
+		config_migrated: 1
 	};
 	insertInstance(row);
 	// Strip the de-dup `#2` suffix so the recent-folders list keeps the base name.

package/src/lib/tab-nav.ts

@@ -0,0 +1,30 @@
+/** Digit jumps follow the browser convention: 1–8 are absolute, 9 is always the last tab. */
+function digitTarget(digit: number, count: number): number {
+	return digit === 9 ? count - 1 : digit - 1;
+}
+
+/**
+ * Index the tab strip should move to for a key, or `null` to leave the event alone.
+ * Pure so the arrow/Home/End/digit math is testable without a DOM.
+ */
+export function nextTabIndex(current: number, key: string, count: number): number | null {
+	if (count <= 0) return null;
+	// A `current` outside the strip (nothing focused yet) still resolves, since the
+	// arrow branches below normalise through a modulo of `count`.
+	const from = current < 0 || current >= count ? 0 : current;
+	switch (key) {
+		case 'ArrowRight':
+			return (from + 1) % count;
+		case 'ArrowLeft':
+			return (from - 1 + count) % count;
+		case 'Home':
+			return 0;
+		case 'End':
+			return count - 1;
+		default: {
+			if (!/^[1-9]$/.test(key)) return null;
+			const target = digitTarget(Number(key), count);
+			return target < count ? target : null;
+		}
+	}
+}

package/src/routes.ts

@@ -35,6 +35,7 @@ import {
 	broadcastDefaultMode,
 	broadcastFilter,
 	broadcastPet,
+	broadcastTheme,
 	createInstance,
 	getDefaultMode,
 	deleteAllInstances,
@@ -68,6 +69,7 @@ import { timingSafeEqualStr } from './lib/crypto.server.ts';
 import { proxyRoutes } from './lib/proxy.server.ts';
 import {
 	isInstanceFilter,
+	isTheme,
 	normalizeMode,
 	normalizePermissionMode,
 	normalizeEffortLevel,
@@ -514,6 +516,16 @@ export const routes: Record<string, MochiRouteValue> = {
 		return json({ value: body.value });
 	}),
 
+	// The cookie the picker just wrote is already shared browser-wide; this only tells
+	// the tabs behind the settings popup to repaint without a reload.
+	'/api/settings/theme': Mochi.api(async ({ method, request }) => {
+		if (method !== 'POST') return apiError(405, 'Method Not Allowed');
+		const body = (await request.json().catch(() => null)) as { value?: string } | null;
+		if (!body || !isTheme(body.value)) return apiError(400, 'Invalid theme');
+		broadcastTheme(body.value);
+		return json({ value: body.value });
+	}),
+
 	'/api/stream': Mochi.ws({
 		// Mochi.ws routes bypass the global basicAuth handle, so enforce origin + auth here.
 		upgrade: (req) => (wsUpgradeAllowed(req) ? {} : false),