codebay 0.5.0 → 0.7.0

package/src/container-injections/claude-statusline.ts

@@ -2,8 +2,12 @@ import { existsSync, statSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
+import { writeContainerFile } from '../lib/container-files.server.ts';
+import {
+	claudeConfigFile,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** Left unexpanded — Claude Code invokes this long after the injection has finished. */
@@ -65,23 +69,20 @@ export async function readStatusLineConfig(): Promise<StatusLineConfig | null> {
 	return { statusLine: { ...statusLine, command }, script };
 }
 
-/** Two execs rather than one, because `execInContainer` carries a single `stdin` payload per call. */
+/** A referenced script is staged first, then the statusLine block is merged into settings.json. */
 async function injectStatusLine(
 	target: ContainerTarget,
 	config: StatusLineConfig
 ): Promise<{ ok: boolean; error?: string }> {
 	if (config.script) {
-		const writeScript =
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-			'printf \'%s\' "$CODEBAY_STDIN" > "$d/statusline.sh"; chmod 755 "$d/statusline.sh"';
-		const res = await execInContainer(target, { script: writeScript, stdin: config.script });
-		if (!res.ok) return { ok: false, error: res.error };
+		const wrote = await writeContainerFile(
+			target,
+			claudeConfigFile('statusline.sh', '755'),
+			config.script
+		);
+		if (!wrote.ok) return wrote;
 	}
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify({ statusLine: config.statusLine })
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	return mergeClaudeSettings(target, { statusLine: config.statusLine });
 }
 
 export const claudeStatusline: Injection = {
@@ -115,10 +116,7 @@ export const claudeStatusline: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q statusLine "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return !!settings?.statusLine;
 	}
 };

package/src/container-injections/claude-trust.ts

@@ -0,0 +1,73 @@
+import { deepMerge, editJsonFile, readJsonFile } from '../lib/container-files.server.ts';
+import {
+	CLAUDE_JSON_FILE,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
+
+/**
+ * Pre-accepts the three prompts `claude` shows on first launch, so a throwaway instance
+ * opens straight into a session: the folder-trust dialog and the MCP-server approval
+ * (both per-project, keyed by the path `claude` runs in), and the one-time Bypass
+ * Permissions acknowledgement (`--dangerously-skip-permissions` still trips it without this).
+ * Key names verified against the shipped `claude` binary.
+ */
+export function claudeTrustConfig(workspacePath: string | null): Record<string, unknown> {
+	const cfg: Record<string, unknown> = {
+		// Idempotent with the credentials injection; keeps this self-sufficient when auth is skipped.
+		hasCompletedOnboarding: true,
+		bypassPermissionsModeAccepted: true
+	};
+	if (workspacePath) {
+		cfg.projects = {
+			[workspacePath]: {
+				hasTrustDialogAccepted: true,
+				hasCompletedProjectOnboarding: true,
+				enableAllProjectMcpServers: true
+			}
+		};
+	}
+	return cfg;
+}
+
+/** claude ≥2.1.220 keeps the bypass acknowledgement here; the `.claude.json` key stays for older versions. */
+export const CLAUDE_TRUST_SETTINGS: Record<string, unknown> = {
+	skipDangerousModePermissionPrompt: true
+};
+
+/** Safe here only because instances are throwaway, single-tenant sandboxes. */
+export const claudeTrust: Injection = {
+	id: 'claude-trust',
+	label: 'Claude trust & MCP auto-accept',
+
+	async apply(target, log) {
+		log('Pre-accepting Claude trust, MCP, and bypass-permissions prompts…\n');
+		// deepMerge recurses into `projects`, so the per-project keys layer onto any existing entries.
+		const res = await editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+			deepMerge(cur, claudeTrustConfig(target.instance.remote_workspace_folder))
+		);
+		if (!res.ok) {
+			log(`⚠ Claude trust injection failed: ${res.error}\n`);
+			return;
+		}
+		const settings = await mergeClaudeSettings(target, CLAUDE_TRUST_SETTINGS);
+		log(
+			settings.ok
+				? '✓ Claude startup prompts pre-accepted\n'
+				: `⚠ Claude trust injection failed: ${settings.error}\n`
+		);
+	},
+
+	// Not keyed on `.claude.json`'s `bypassPermissionsModeAccepted`: claude ≥2.1.220 drops
+	// that key (and `enableAllProjectMcpServers`) when it rewrites the file after startup.
+	async check(target) {
+		const settings = await readClaudeSettings(target);
+		if (settings?.skipDangerousModePermissionPrompt !== true) return false;
+		const workspace = target.instance.remote_workspace_folder;
+		if (!workspace) return true;
+		const cfg = await readJsonFile(target, CLAUDE_JSON_FILE);
+		const projects = cfg?.projects as Record<string, Record<string, unknown>> | undefined;
+		return projects?.[workspace]?.hasTrustDialogAccepted === true;
+	}
+};

package/src/container-injections/host-env-vars.ts

@@ -1,8 +1,13 @@
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	containerFileExists,
+	shellEnvFile,
+	installShellEnvFile,
+	shellSingleQuote
+} from '../lib/container-files.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
-const ENV_FILE = '~/.codebay-host-env';
+const ENV_FILE_NAME = '.codebay-host-env';
 
 interface ResolvedVar {
 	name: string;
@@ -47,31 +52,15 @@ export function hostEnvVarsConfig(): {
 }
 
 /** Values ride `stdin` as one payload, so they reach neither argv nor `docker inspect`. */
-async function injectHostEnvVars(
+function injectHostEnvVars(
 	target: ContainerTarget,
 	resolved: ResolvedVar[]
 ): Promise<{ ok: boolean; error?: string }> {
 	// Every interactive shell sources this file, so values must be single-quoted to stay literal.
-	const payload = resolved
-		.map(({ name, value }) => `export ${name}='${value.replaceAll("'", "'\\''")}'`)
-		.join('\n');
-	const script =
-		'set -e; f=$(eval echo "' +
-		ENV_FILE +
-		'"); ' +
-		'printf \'%s\\n\' "$CODEBAY_STDIN" > "$f"; chmod 600 "$f"; ' +
-		// The grep guard keeps a re-apply from stacking duplicate source lines.
-		'h=$(eval echo ~$(id -un)); src="[ -f \\"$f\\" ] && . \\"$f\\""; ' +
-		'for rc in "$h/.bashrc" "$h/.zshrc"; do ' +
-		'grep -qF "$src" "$rc" 2>/dev/null || printf \'%s\\n\' "$src" >> "$rc"; ' +
-		'done';
-
-	const res = await execInContainer(target, {
-		script,
-		stdin: payload,
-		args: ['host-env-vars']
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const content =
+		resolved.map(({ name, value }) => `export ${name}=${shellSingleQuote(value)}`).join('\n') +
+		'\n';
+	return installShellEnvFile(target, ENV_FILE_NAME, content);
 }
 
 /**
@@ -103,6 +92,6 @@ export const hostEnvVars: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(target, `f=$(eval echo "${ENV_FILE}"); [ -s "$f" ] && echo 1 || echo 0`);
+		return containerFileExists(target, shellEnvFile(ENV_FILE_NAME));
 	}
 };

package/src/container-injections/tmux.ts

@@ -1,4 +1,5 @@
 import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import { appendLinesIfAbsent } from '../lib/container-files.server.ts';
 import type { Injection } from '../lib/injections.server.ts';
 
 /** apt-get is the real path (the default image is Debian); the rest cover project images. */
@@ -26,13 +27,6 @@ export const TMUX_CONF_LINES = [
 	'bind m set -g mouse \\; display-message "mouse: #{?mouse,on,off}"'
 ];
 
-/** Lines arrive as `$@` so no conf text is interpolated into the loop body. */
-const CONF_SCRIPT =
-	'h=$(eval echo ~$(id -un)); f="$h/.tmux.conf"; ' +
-	'for line in "$@"; do ' +
-	'grep -qF "$line" "$f" 2>/dev/null || printf \'%s\\n\' "$line" >> "$f"; ' +
-	'done';
-
 const CHECK_SCRIPT = 'command -v tmux >/dev/null 2>&1 && echo 1 || echo 0';
 
 /**
@@ -54,10 +48,7 @@ export const tmux: Injection = {
 			log(`⚠ tmux install failed: ${install.error} — terminal falls back to non-persistent mode\n`);
 			return;
 		}
-		const conf = await execInContainer(target, {
-			script: CONF_SCRIPT,
-			args: ['tmux-conf', ...TMUX_CONF_LINES]
-		});
+		const conf = await appendLinesIfAbsent(target, [{ name: '.tmux.conf' }], TMUX_CONF_LINES);
 		log(conf.ok ? '✓ tmux installed\n' : `⚠ tmux conf setup failed: ${conf.error}\n`);
 	},
 

package/src/index.ts

@@ -27,6 +27,8 @@ ensureMochiKey();
 await Mochi.serve({
 	port: PORT,
 	hostname: HOST,
+	// Bun defaults to 10s and aborts slower form POSTs mid-flight; passed through to Bun.serve.
+	idleTimeout: 120,
 	development: process.env.MODE === 'development',
 	htmlShell: './src/shell.html',
 	handle: sequence(basicAuth, themeHandle),

package/src/lib/claude-settings.server.ts

@@ -0,0 +1,35 @@
+import type { ExecTarget } from './exec.server.ts';
+import {
+	deepMerge,
+	editJsonFile,
+	readJsonFile,
+	type ContainerFile
+} from './container-files.server.ts';
+
+/** A file in `~/.claude` (or wherever `CLAUDE_CONFIG_DIR` points), e.g. settings.json or .bridge-header. */
+export const claudeConfigFile = (name: string, mode?: string): ContainerFile => ({
+	dir: '${CLAUDE_CONFIG_DIR:-$h/.claude}',
+	name,
+	mode
+});
+
+/** `~/.claude/settings.json`, honoring a `CLAUDE_CONFIG_DIR` override. */
+export const CLAUDE_SETTINGS_FILE: ContainerFile = claudeConfigFile('settings.json');
+
+/** `~/.claude.json` sits beside the config dir, not inside it — hence a different dir expr. */
+export const CLAUDE_JSON_FILE: ContainerFile = {
+	dir: '${CLAUDE_CONFIG_DIR:-$h}',
+	name: '.claude.json'
+};
+
+/** Deep-merges a patch into settings.json, letting the settings.json injections compose in any order. */
+export function mergeClaudeSettings(
+	target: ExecTarget,
+	patch: Record<string, unknown>
+): Promise<{ ok: boolean; error?: string }> {
+	return editJsonFile(target, CLAUDE_SETTINGS_FILE, (current) => deepMerge(current, patch));
+}
+
+export function readClaudeSettings(target: ExecTarget): Promise<Record<string, unknown> | null> {
+	return readJsonFile<Record<string, unknown>>(target, CLAUDE_SETTINGS_FILE);
+}

package/src/lib/container-files.server.ts

@@ -0,0 +1,219 @@
+import { checkPresence, execInContainer, type ExecTarget } from './exec.server.ts';
+
+/**
+ * A file inside a container, addressed by a shell expr for its dir (`$h` = the exec user's home) + name.
+ * Every field is interpolated into a bash script, so callers must pass literal, trusted values only.
+ */
+export interface ContainerFile {
+	/** Shell expr for the containing dir; `$h` is bound to the resolved home. Defaults to `$h`. */
+	dir?: string;
+	name: string;
+	/** chmod mode applied on write. */
+	mode?: string;
+}
+
+/** Resolves the exec user's home the same way every injection historically has. */
+const HOME_PRELUDE = 'h=$(eval echo ~$(id -un)); ';
+
+const filePath = (file: ContainerFile): string => `${file.dir ?? '$h'}/${file.name}`;
+
+/** The two rc files either shell may open, so an interactive-shell tweak must reach both. */
+export const SHELL_RC_FILES: ContainerFile[] = [{ name: '.bashrc' }, { name: '.zshrc' }];
+
+/** `bash -lc` runs profile scripts whose stdout precedes ours, so reads mark where real output starts. */
+const READ_MARKER = '__CODEBAY_READ__';
+
+export function readFileScript(file: ContainerFile): string {
+	// A status char follows the marker: A(bsent), O(k)+content, E (exists but unreadable).
+	return (
+		`${HOME_PRELUDE}f="${filePath(file)}"; ` +
+		`if [ ! -e "$f" ]; then printf '%sA' '${READ_MARKER}'; ` +
+		`elif c=$(cat "$f" 2>/dev/null); then printf '%sO%s' '${READ_MARKER}' "$c"; ` +
+		`else printf '%sE' '${READ_MARKER}'; fi`
+	);
+}
+
+type ContainerRead = { ok: true; content: string | null } | { ok: false; error: string };
+
+/** Slices `readFileScript` output at the marker, so profile noise can't masquerade as file content. */
+export function parseReadScriptOutput(stdout: string, name: string): ContainerRead {
+	const at = stdout.indexOf(READ_MARKER);
+	if (at === -1) return { ok: false, error: `read of ${name} produced no marker` };
+	const payload = stdout.slice(at + READ_MARKER.length);
+	if (payload[0] === 'A') return { ok: true, content: null };
+	if (payload[0] === 'O') return { ok: true, content: payload.slice(1) };
+	return { ok: false, error: `${name} exists but is unreadable` };
+}
+
+export function writeFileScript(file: ContainerFile): string {
+	const mode = file.mode ?? '644';
+	// `set -e` so a partial write can't exit 0 and get reported as a success.
+	return (
+		`set -e; ${HOME_PRELUDE}f="${filePath(file)}"; mkdir -p "$(dirname "$f")"; ` +
+		`printf '%s' "$CODEBAY_STDIN" > "$f"; chmod ${mode} "$f"`
+	);
+}
+
+/** Single-quotes a value for a sourced shell file so whatever it contains stays literal. */
+export const shellSingleQuote = (value: string): string => `'${value.replaceAll("'", "'\\''")}'`;
+
+/** Lines arrive as `$@` so none is interpolated into the loop body; each file gets a `grep -qF` guard. */
+export function appendLinesScript(files: ContainerFile[]): string {
+	const paths = files.map((f) => `"${filePath(f)}"`).join(' ');
+	// `set -e` so a failed append (readonly fs, perms) can't exit 0 and get reported as a success.
+	return (
+		`set -e; ${HOME_PRELUDE}for line in "$@"; do ` +
+		`for f in ${paths}; do ` +
+		`mkdir -p "$(dirname "$f")"; ` +
+		`grep -qF "$line" "$f" 2>/dev/null || printf '%s\\n' "$line" >> "$f"; ` +
+		`done; done`
+	);
+}
+
+/** Read that distinguishes "absent" (`content: null`) from "couldn't read" (`ok: false`). */
+export async function readContainerFileResult(
+	target: ExecTarget,
+	file: ContainerFile
+): Promise<ContainerRead> {
+	const res = await execInContainer(target, { script: readFileScript(file), capture: true });
+	if (!res.ok) return { ok: false, error: res.error ?? `read of ${file.name} failed` };
+	return parseReadScriptOutput(res.stdout, file.name);
+}
+
+/** Returns the file's contents, or null when it's absent, empty, or unreadable. Note: output capture trims trailing whitespace (incl. trailing newlines), so a whitespace-only file reads as null — fine for JSON callers, but don't use this where exact bytes matter. */
+export async function readContainerFile(
+	target: ExecTarget,
+	file: ContainerFile
+): Promise<string | null> {
+	const res = await readContainerFileResult(target, file);
+	return res.ok && res.content ? res.content : null;
+}
+
+export async function writeContainerFile(
+	target: ExecTarget,
+	file: ContainerFile,
+	content: string
+): Promise<{ ok: boolean; error?: string }> {
+	const res = await execInContainer(target, { script: writeFileScript(file), stdin: content });
+	return res.ok ? { ok: true } : { ok: false, error: res.error };
+}
+
+/** Appends each line to every file it's missing from — the shared idempotent rc/conf write. */
+export async function appendLinesIfAbsent(
+	target: ExecTarget,
+	files: ContainerFile[],
+	lines: string[]
+): Promise<{ ok: boolean; error?: string }> {
+	if (!lines.length) return { ok: true };
+	const res = await execInContainer(target, {
+		script: appendLinesScript(files),
+		args: ['append-lines', ...lines]
+	});
+	return res.ok ? { ok: true } : { ok: false, error: res.error };
+}
+
+/** A line counts as present when any listed file carries it — the either-rc-file check the injections have always used. */
+export function linesPresentScript(files: ContainerFile[]): string {
+	const greps = files.map((f) => `grep -qF "$line" "${filePath(f)}" 2>/dev/null`).join(' || ');
+	return `${HOME_PRELUDE}for line in "$@"; do ${greps} || { echo 0; exit 0; }; done; echo 1`;
+}
+
+/** The `check()` counterpart of `appendLinesIfAbsent`. */
+export function linesPresent(
+	target: ExecTarget,
+	files: ContainerFile[],
+	lines: string[]
+): Promise<boolean> {
+	return checkPresence(target, linesPresentScript(files), ['lines-present', ...lines]);
+}
+
+/** True when the file exists and is non-empty — a content-free probe for `check()`. */
+export function containerFileExists(target: ExecTarget, file: ContainerFile): Promise<boolean> {
+	return checkPresence(
+		target,
+		`${HOME_PRELUDE}f="${filePath(file)}"; [ -s "$f" ] && echo 1 || echo 0`
+	);
+}
+
+/** `$HOME`-addressed so the write, the `check()` probe, and the sourced rc line all resolve one path. */
+export const shellEnvFile = (name: string): ContainerFile => ({ dir: '$HOME', name, mode: '600' });
+
+/** Writes a mode-600 env file in the home dir and guards a source line into both rc files. */
+export async function installShellEnvFile(
+	target: ExecTarget,
+	name: string,
+	content: string
+): Promise<{ ok: boolean; error?: string }> {
+	const wrote = await writeContainerFile(target, shellEnvFile(name), content);
+	if (!wrote.ok) return wrote;
+	const path = `$HOME/${name}`;
+	return appendLinesIfAbsent(target, SHELL_RC_FILES, [`[ -f "${path}" ] && . "${path}"`]);
+}
+
+function isPlainObject(v: unknown): v is Record<string, unknown> {
+	return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+/** Mirrors jq's `.[0] * .[1]`: recurse into plain objects, replace arrays and scalars with the patch. */
+export function deepMerge<T extends Record<string, unknown> = Record<string, unknown>>(
+	base: Record<string, unknown>,
+	patch: Record<string, unknown>
+): T {
+	const out: Record<string, unknown> = { ...base };
+	for (const [key, value] of Object.entries(patch)) {
+		// A `__proto__` key in parsed JSON would pollute Object.prototype via plain assignment.
+		if (key === '__proto__') continue;
+		const current = out[key];
+		out[key] = isPlainObject(value) && isPlainObject(current) ? deepMerge(current, value) : value;
+	}
+	return out as T;
+}
+
+type JsonRead = { ok: true; data: Record<string, unknown> | null } | { ok: false; error: string };
+
+/** Absent/empty means "start fresh"; anything else must parse to an object, so callers can refuse destructive fallbacks. */
+export function parseJsonRead(raw: string | null, name: string): JsonRead {
+	if (raw === null || raw === '') return { ok: true, data: null };
+	try {
+		const data: unknown = JSON.parse(raw);
+		if (!isPlainObject(data)) return { ok: false, error: `${name} is not a JSON object` };
+		return { ok: true, data };
+	} catch {
+		return { ok: false, error: `${name} exists but is not valid JSON` };
+	}
+}
+
+/** Parses the container file, treating an absent or invalid file as "no JSON" (null). */
+export async function readJsonFile<T = Record<string, unknown>>(
+	target: ExecTarget,
+	file: ContainerFile
+): Promise<T | null> {
+	const parsed = parseJsonRead(await readContainerFile(target, file), file.name);
+	return parsed.ok ? (parsed.data as T | null) : null;
+}
+
+export async function writeJsonFile(
+	target: ExecTarget,
+	file: ContainerFile,
+	data: unknown
+): Promise<{ ok: boolean; error?: string }> {
+	return writeContainerFile(target, file, JSON.stringify(data, null, 2));
+}
+
+/**
+ * Read-modify-write: an absent/empty file starts from `{}`, but a failed read or unparseable
+ * existing content aborts the edit — overwriting what we couldn't read would silently destroy it.
+ */
+export async function editJsonFile(
+	target: ExecTarget,
+	file: ContainerFile,
+	edit: (current: Record<string, unknown>) => Record<string, unknown> | void
+): Promise<{ ok: boolean; error?: string }> {
+	const read = await readContainerFileResult(target, file);
+	if (!read.ok) return { ok: false, error: `read before edit failed: ${read.error}` };
+	const parsed = parseJsonRead(read.content, file.name);
+	if (!parsed.ok) return { ok: false, error: parsed.error };
+	const current = parsed.data ?? {};
+	const next = edit(current) ?? current;
+	return writeJsonFile(target, file, next);
+}

package/src/lib/devcontainer.server.ts

@@ -3,6 +3,7 @@ import { existsSync, statSync } from 'node:fs';
 import { basename, dirname, join, relative } from 'node:path';
 import { homedir } from 'node:os';
 import { INSTALL_SCRIPT as TMUX_INSTALL_SCRIPT } from '../container-injections/tmux.ts';
+import { EXTENSION_ID as CLAUDE_CODE_EXTENSION_ID } from '../container-injections/claude-code-ide-extension.ts';
 import {
 	CODE_SERVER_PORT,
 	DEFAULT_IMAGE,
@@ -62,6 +63,13 @@ const EXCLUDE_MARKER_END = '# <<< codebay <<<';
 
 const CODE_SERVER_SETTINGS = {
 	'workbench.colorTheme': 'Default Dark Modern',
+	// Stop VS Code re-resolving the theme from the OS/browser color scheme at runtime —
+	// that re-resolution (fired on focus/tab-switch) is what randomly flips the editor to
+	// light. Pinning both preferred themes to dark keeps either branch dark even if it does.
+	'window.autoDetectColorScheme': false,
+	'window.autoDetectHighContrast': false,
+	'workbench.preferredDarkColorTheme': 'Default Dark Modern',
+	'workbench.preferredLightColorTheme': 'Default Dark Modern',
 	'workbench.secondarySideBar.defaultVisibility': 'hidden',
 	'chat.commandCenter.enabled': false,
 	// Instances are throwaway sandboxes — never nag to install recommended extensions.
@@ -78,6 +86,26 @@ const CODE_SERVER_SETTINGS = {
 
 const TMUX_SESSION = 'codebay';
 
+/** Written to `$HOME` when the post-up injection sequence finishes; the terminal launcher waits on it. */
+export const INJECTIONS_DONE_FILE = '.codebay-injections-done';
+
+/**
+ * An auto-launched `claude` that starts mid-injection reads `~/.claude.json` before the trust
+ * keys land and clobbers them on its next rewrite, so hold it until the sentinel appears.
+ * Bounded so a failed boot (sentinel never written) still yields a usable terminal.
+ */
+const WAIT_FOR_INJECTIONS =
+	`[ -e "$HOME/${INJECTIONS_DONE_FILE}" ] || echo "Waiting for codebay setup to finish…"; ` +
+	`i=0; until [ -e "$HOME/${INJECTIONS_DONE_FILE}" ] || [ "$i" -ge 60 ]; do sleep 1; i=$((i + 1)); done; `;
+
+/**
+ * claude scans `~/.claude/ide/*.lock` once at startup and never retries, so it must not race
+ * the code-server extension host writing that lock — hold it briefly until the bridge appears.
+ * Bounded so an offline/uninstalled instance (lock never written) still yields a usable terminal.
+ * No single quotes: this is spliced into the single-quoted tmux command string below.
+ */
+const WAIT_FOR_IDE_BRIDGE = `i=0; until ls "$HOME/.claude/ide/"*.lock >/dev/null 2>&1 || [ "$i" -ge 30 ]; do sleep 1; i=$((i + 1)); done; `;
+
 /**
  * Runs under tmux so Claude survives the browser closing — code-server reaps the
  * detached PTY, which only kills the tmux client. `-A` doubles as the run-once gate.
@@ -87,9 +115,11 @@ const TERMINAL_TASK = {
 	type: 'shell',
 	command:
 		// `"$SHELL"` must reach tmux unexpanded; VS Code would substitute a `${…}` form first.
-		`if command -v tmux >/dev/null 2>&1; then exec tmux new-session -A -s ${TMUX_SESSION} 'claude --dangerously-skip-permissions; exec "$SHELL" -l'; fi; ` +
+		`if command -v tmux >/dev/null 2>&1; then exec tmux new-session -A -s ${TMUX_SESSION} '${WAIT_FOR_INJECTIONS}${WAIT_FOR_IDE_BRIDGE}claude --dangerously-skip-permissions; exec "$SHELL" -l'; fi; ` +
 		// Without tmux there's no run-once gate, and folderOpen re-fires on every workspace load.
 		'MARK="$HOME/.codebay-terminal-launched"; [ -e "$MARK" ] && exit 0; touch "$MARK"; ' +
+		WAIT_FOR_INJECTIONS +
+		WAIT_FOR_IDE_BRIDGE +
 		'claude --dangerously-skip-permissions; exec ${env:SHELL} -l',
 	presentation: { reveal: 'always', panel: 'shared', focus: true },
 	runOptions: { runOn: 'folderOpen' },
@@ -101,8 +131,15 @@ const CODE_SERVER_APPLY_SETTINGS =
 	`cp -f \\"$PWD/.devcontainer/${CODE_SERVER_SETTINGS_FILE}\\" ` +
 	`~/.local/share/code-server/User/settings.json 2>/dev/null;`;
 
+// Runs before code-server first launches so the extension host activates it on the first window
+// (the /ide bridge, in-container over localhost); best-effort, offline-tolerant, skipped if present.
+const CODE_SERVER_INSTALL_EXT =
+	`ls -d ~/.local/share/code-server/extensions/${CLAUDE_CODE_EXTENSION_ID}-* >/dev/null 2>&1 || ` +
+	`code-server --install-extension ${CLAUDE_CODE_EXTENSION_ID} >/tmp/code-server-ext.log 2>&1 || true; `;
+
 const CODE_SERVER_LAUNCH =
 	`bash -c "${CODE_SERVER_APPLY_SETTINGS} ` +
+	`${CODE_SERVER_INSTALL_EXT} ` +
 	// The bare default image may not export SHELL, which the Terminal task needs.
 	`export SHELL=\\"\${SHELL:-/bin/bash}\\"; ` +
 	`pgrep -f 'code-server.*${CODE_SERVER_PORT}' >/dev/null 2>&1 || ` +

package/src/lib/exec.server.ts

@@ -82,11 +82,6 @@ export async function checkPresence(
 	args?: string[]
 ): Promise<boolean> {
 	const res = await execInContainer(target, { script, args, capture: true });
-	return res.ok && res.stdout === '1';
-}
-
-/** Only for secret-only files; injections mixing secret and non-secret content roll their own. */
-export function writeSecretFileScript(dirExpr: string, filename: string, mode = '600'): string {
-	const path = `${dirExpr}/${filename}`;
-	return `mkdir -p "${dirExpr}"; printf '%s' "$CODEBAY_STDIN" > "${path}"; chmod ${mode} "${path}";`;
+	// The login shell's profile noise precedes the probe's echo, so only the last line counts.
+	return res.ok && res.stdout.split('\n').at(-1)?.trim() === '1';
 }

package/src/lib/injections.server.ts

@@ -6,12 +6,14 @@ import { tmux } from '../container-injections/tmux.ts';
 import { gitIdentity } from '../container-injections/git-identity.ts';
 import { claudeCodeCredentials } from '../container-injections/claude-code-credentials.ts';
 import { claudeCodeCustom } from '../container-injections/claude-code-custom.ts';
+import { claudeCodeIdeExtension } from '../container-injections/claude-code-ide-extension.ts';
 import { claudeCodeModels } from '../container-injections/claude-code-models.ts';
 import { githubCredentials } from '../container-injections/github-credentials.ts';
 import { attentionHooks } from '../container-injections/attention-hooks.ts';
 import { claudeStatusline } from '../container-injections/claude-statusline.ts';
 import { claudeModel } from '../container-injections/claude-model.ts';
 import { claudeSkipPermissions } from '../container-injections/claude-skip-permissions.ts';
+import { claudeTrust } from '../container-injections/claude-trust.ts';
 import { claudeAliases } from '../container-injections/claude-aliases.ts';
 import { claudeNoCoauthor } from '../container-injections/claude-no-coauthor.ts';
 import { hostEnvVars } from '../container-injections/host-env-vars.ts';
@@ -52,11 +54,13 @@ const BASE_INJECTIONS_HEAD: Injection[] = [
 const BASE_INJECTIONS_TAIL: Injection[] = [
 	// Self-skips unless manual override is on and LiteLLM off, so it's safe in the always-run tail.
 	claudeCodeModels,
+	claudeCodeIdeExtension,
 	githubCredentials,
 	attentionHooks,
 	claudeStatusline,
 	claudeModel,
 	claudeSkipPermissions,
+	claudeTrust,
 	claudeAliases,
 	claudeNoCoauthor,
 	hostEnvVars

package/src/lib/instances.server.ts

@@ -38,9 +38,11 @@ import {
 	copyWorkspace,
 	devcontainerCliAvailable,
 	devcontainerUp,
+	INJECTIONS_DONE_FILE,
 	readDeclaredContainerPorts,
 	writeOverrideConfig
 } from './devcontainer.server.ts';
+import { writeContainerFile } from './container-files.server.ts';
 import { clearAttention, getAttention } from './bridge.server.ts';
 import { proxyPathFor } from './proxy.server.ts';
 import { resolveInjections } from './injections.server.ts';
@@ -321,6 +323,13 @@ async function provision(row: InstanceRow, opts: { noCache?: boolean } = {}): Pr
 			error: null
 		});
 
+		// updateInstance writes the DB, not `row`; mirror the fields so `target.instance`
+		// (e.g. remote_workspace_folder, which claude-trust keys on) isn't the stale pre-boot row.
+		row.container_id = result.containerId;
+		row.remote_workspace_folder = result.remoteWorkspaceFolder ?? null;
+		row.remote_user = result.remoteUser ?? null;
+		row.status = 'running';
+
 		const target = {
 			containerId: result.containerId,
 			remoteUser: result.remoteUser,
@@ -335,6 +344,11 @@ async function provision(row: InstanceRow, opts: { noCache?: boolean } = {}): Pr
 			}
 		}
 
+		// Unblocks the terminal launcher's wait; written even after ⚠s — its timeout is the fallback.
+		await writeContainerFile(target, { dir: '$HOME', name: INJECTIONS_DONE_FILE }, 'done\n').catch(
+			() => undefined
+		);
+
 		appendLog(row.id, `\n✓ Instance running — open it via the proxy at ${proxyPathFor(row.id)}\n`);
 		triggerReconcile();
 	} catch (err) {