codebay 0.5.0 → 0.7.0

package/src/components/InstanceView.svelte

@@ -11,6 +11,7 @@
 	import { enhance } from 'mochi-framework';
 	import type { MochiEnhanceOptions } from 'mochi-framework';
 	import { onBackLinkClick, installPopupBackTrap } from '../lib/popup-nav.ts';
+	import { tick } from 'svelte';
 
 	let { id, injectionChecks = 0 }: { id: string; injectionChecks?: number } = $props();
 
@@ -18,11 +19,29 @@
 	let health = $state<InstanceHealth | null>(null);
 	let lastFetchedAt = $state<number | null>(null);
 	let logs = $state('');
+	let logEl = $state<HTMLDivElement | null>(null);
+	let following = $state(true);
 
-	// Runs after the DOM updates, so scrollHeight is fresh without a tick().
-	function autoscroll(node: HTMLDivElement) {
-		void logs; // the dependency this effect exists for
-		node.scrollTop = node.scrollHeight;
+	// Pin to the newest output whenever logs grow — but only while following.
+	// tick() lets the <pre> text node grow before we scroll, so we reach the true bottom.
+	$effect(() => {
+		if (!following || logs.length === 0) return; // reading logs.length tracks appended chunks
+		tick().then(() => {
+			if (following) logEl?.scrollTo(0, logEl.scrollHeight);
+		});
+	});
+
+	// A user scrolling up pauses following; programmatic scroll-to-bottom keeps the
+	// gap ~0, so it never trips this — only re-clicking "Follow log" resumes.
+	function onLogScroll() {
+		if (!logEl) return;
+		const gap = logEl.scrollHeight - logEl.clientHeight - logEl.scrollTop;
+		if (gap > 40) following = false;
+	}
+
+	function toggleFollow() {
+		following = !following;
+		if (following) logEl?.scrollTo(0, logEl.scrollHeight);
 	}
 
 	$effect(() => installPopupBackTrap());
@@ -234,11 +253,16 @@
 	<div class="logwrap panel">
 		<div class="log-bar panel-bar">
 			<span>Boot log</span>
-			<button class="copy" onclick={copyLogs} disabled={!logs}>
-				{copied ? 'Copied!' : 'Copy logs'}
-			</button>
+			<div class="log-actions">
+				<button class="copy" class:active={following} onclick={toggleFollow}>
+					{following ? 'Following' : 'Follow log'}
+				</button>
+				<button class="copy" onclick={copyLogs} disabled={!logs}>
+					{copied ? 'Copied!' : 'Copy logs'}
+				</button>
+			</div>
 		</div>
-		<div class="logs" {@attach autoscroll}>
+		<div class="logs" bind:this={logEl} onscroll={onLogScroll}>
 			<pre>{logs || 'Waiting for output…'}<span class="caret"></span></pre>
 		</div>
 		{#if instance?.status === 'error' && instance.error}
@@ -504,6 +528,11 @@
 		align-items: center;
 		justify-content: space-between;
 	}
+	.log-actions {
+		display: flex;
+		gap: 6px;
+		align-items: center;
+	}
 	.copy {
 		font-family: var(--font-mono);
 		font-weight: 600;
@@ -520,6 +549,10 @@
 		background: transparent;
 		color: var(--bg);
 	}
+	.copy.active {
+		background: transparent;
+		color: var(--bg);
+	}
 	.copy:disabled {
 		opacity: 0.5;
 		cursor: not-allowed;

package/src/components/SettingsView.svelte

@@ -878,8 +878,8 @@
 					<div class="text">
 						<div class="name">Rebuild running containers (no cache)</div>
 						<div class="desc">
-							Re-run <code>devcontainer up --build-no-cache</code> for every currently-running instance.
-							In-container edits are kept; stopped instances are left alone.
+							Rebuild every currently-running instance from scratch, without using any cached image
+							layers. In-container edits are kept; stopped instances are left alone.
 						</div>
 						{#if rebuildError}
 							<div class="msg error">{rebuildError}</div>

package/src/components/TopBar.svelte

@@ -2,9 +2,10 @@
 	import Plus from '@lucide/svelte/icons/plus';
 	import Component from '@lucide/svelte/icons/component';
 	import { isDev } from 'mochi-framework';
-	import type { AuthProvider } from '../types.ts';
+	import type { AuthProvider, InstanceFilter } from '../types.ts';
 	import type { AvatarArt } from '../avatars/index.ts';
 	import Brand from './Brand.svelte';
+	import InstanceFilterControl from './InstanceFilter.svelte';
 	import SettingsCog from './SettingsCog.svelte';
 	import CredMenu from './CredMenu.svelte';
 	import Button from './Button.svelte';
@@ -16,6 +17,8 @@
 		canDelete = false,
 		ready = true,
 		creating = false,
+		filter,
+		onFilter,
 		onNew,
 		onDeleteAll
 	}: {
@@ -24,6 +27,8 @@
 		canDelete?: boolean;
 		ready?: boolean;
 		creating?: boolean;
+		filter?: InstanceFilter;
+		onFilter?: (v: InstanceFilter) => void;
 		onNew?: () => void;
 		onDeleteAll?: () => void;
 	} = $props();
@@ -35,6 +40,9 @@
 		{#if isDev}
 			<Button variant="default" size="sm" icon={Component} href="/debug">Debug</Button>
 		{/if}
+		{#if filter && onFilter}
+			<InstanceFilterControl value={filter} onchange={onFilter} />
+		{/if}
 		<SettingsCog />
 		<CredMenu {auth} />
 		<Button variant="danger" size="sm" onclick={onDeleteAll} disabled={!canDelete}>

package/src/container-injections/attention-hooks.ts

@@ -1,5 +1,10 @@
 import { PORT } from '../lib/config.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import { writeContainerFile } from '../lib/container-files.server.ts';
+import {
+	claudeConfigFile,
+	mergeClaudeSettings,
+	readClaudeSettings
+} from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 function bridgeUrl(): string {
@@ -40,50 +45,32 @@ function hookFor(id: string, state: 'done' | 'waiting' | 'busy') {
 }
 
 /** Carries no token — that lives in the mode-600 header file `writeBridgeHeader` stages. */
-export function attentionHookSettings(id: string): string {
-	const settings = {
+export function attentionHookSettings(id: string): Record<string, unknown> {
+	return {
 		hooks: {
 			Stop: hookFor(id, 'done'),
 			Notification: hookFor(id, 'waiting'),
 			UserPromptSubmit: hookFor(id, 'busy')
 		}
 	};
-	return JSON.stringify(settings, null, 2);
 }
 
 /** Stored as a whole header line so curl can consume the file directly with `-H @`. */
-async function writeBridgeHeader(
+function writeBridgeHeader(
 	target: ContainerTarget,
 	token: string
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-		'f="$d/.bridge-header"; printf \'X-Bridge-Token: %s\\n\' "$CODEBAY_STDIN" > "$f"; chmod 600 "$f"';
-	const res = await execInContainer(target, { script, stdin: token });
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
-/** Merging rather than overwriting is what lets the settings.json injections compose in any order. */
-export function mergeClaudeSettingsScript(): string {
-	return (
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; mkdir -p "$d"; ' +
-		'f="$d/settings.json"; new="$CODEBAY_STDIN"; ' +
-		'if command -v jq >/dev/null 2>&1 && [ -s "$f" ] && ' +
-		'merged=$(printf \'%s\' "$new" | jq -s \'.[0] * .[1]\' "$f" - 2>/dev/null); then ' +
-		'printf \'%s\' "$merged" > "$f"; else printf \'%s\' "$new" > "$f"; fi; ' +
-		'chmod 644 "$f"'
+	return writeContainerFile(
+		target,
+		claudeConfigFile('.bridge-header', '600'),
+		`X-Bridge-Token: ${token}\n`
 	);
 }
 
-async function injectClaudeHooks(
-	target: ContainerTarget,
-	settingsJson: string
-): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: settingsJson
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+/** Matches the delimited `id=<id>&state=` fragment of the hook's curl URL, so no other instance id can match by substring. */
+export function hasAttentionHook(settings: Record<string, unknown> | null, id: string): boolean {
+	if (settings === null) return false;
+	return JSON.stringify(settings.hooks ?? null).includes(`id=${encodeURIComponent(id)}&state=`);
 }
 
 export const attentionHooks: Injection = {
@@ -97,8 +84,7 @@ export const attentionHooks: Injection = {
 			log(`⚠ Claude hook injection failed: ${header.error}\n`);
 			return;
 		}
-		const settings = attentionHookSettings(target.instance.id);
-		const hooks = await injectClaudeHooks(target, settings);
+		const hooks = await mergeClaudeSettings(target, attentionHookSettings(target.instance.id));
 		log(
 			hooks.ok
 				? '✓ Claude attention hooks installed\n'
@@ -107,11 +93,6 @@ export const attentionHooks: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q "$1" "$d/settings.json" && echo 1 || echo 0',
-			['attention-check', target.instance.id]
-		);
+		return hasAttentionHook(await readClaudeSettings(target), target.instance.id);
 	}
 };

package/src/container-injections/claude-aliases.ts

@@ -1,4 +1,8 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	appendLinesIfAbsent,
+	linesPresent,
+	SHELL_RC_FILES
+} from '../lib/container-files.server.ts';
 import type { Injection } from '../lib/injections.server.ts';
 
 /** Both resolve `claude`, which `claude-skip-permissions` also aliases, so the two compose. */
@@ -7,37 +11,17 @@ const ALIAS_LINES = [
 	"alias cs='claude --model sonnet'"
 ];
 
-/** Lines arrive as `$@` so no alias text is interpolated into the loop body. */
-const APPLY_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	'for line in "$@"; do ' +
-	'for f in "$h/.bashrc" "$h/.zshrc"; do ' +
-	'grep -qF "$line" "$f" 2>/dev/null || printf \'%s\\n\' "$line" >> "$f"; ' +
-	'done; ' +
-	'done';
-
-const CHECK_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	'for line in "$@"; do ' +
-	'grep -qF "$line" "$h/.bashrc" 2>/dev/null || grep -qF "$line" "$h/.zshrc" 2>/dev/null || ' +
-	'{ echo 0; exit 0; }; ' +
-	'done; ' +
-	'echo 1';
-
 export const claudeAliases: Injection = {
 	id: 'claude-aliases',
 	label: 'claude aliases',
 
 	async apply(target, log) {
 		log('Installing c200 / cs claude aliases…\n');
-		const res = await execInContainer(target, {
-			script: APPLY_SCRIPT,
-			args: ['claude-aliases', ...ALIAS_LINES]
-		});
+		const res = await appendLinesIfAbsent(target, SHELL_RC_FILES, ALIAS_LINES);
 		log(res.ok ? '✓ claude aliases installed\n' : `⚠ claude aliases setup failed: ${res.error}\n`);
 	},
 
 	async check(target) {
-		return checkPresence(target, CHECK_SCRIPT, ['claude-aliases', ...ALIAS_LINES]);
+		return linesPresent(target, SHELL_RC_FILES, ALIAS_LINES);
 	}
 };

package/src/container-injections/claude-code-credentials.ts

@@ -4,7 +4,9 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { CLAUDE_CODE_TOKEN, CLAUDE_KEYCHAIN_SERVICE } from '../lib/config.server.ts';
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer, writeSecretFileScript } from '../lib/exec.server.ts';
+import { checkPresence } from '../lib/exec.server.ts';
+import { deepMerge, editJsonFile, writeContainerFile } from '../lib/container-files.server.ts';
+import { CLAUDE_JSON_FILE, claudeConfigFile } from '../lib/claude-settings.server.ts';
 import { spawnCapture } from '../lib/spawn.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
@@ -95,13 +97,15 @@ async function injectClaudeCredentials(
 	target: ContainerTarget,
 	creds: string
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-		writeSecretFileScript('$d', '.credentials.json', '600') +
-		' cfg="${CLAUDE_CONFIG_DIR:+$CLAUDE_CONFIG_DIR/.claude.json}"; cfg="${cfg:-$h/.claude.json}"; ' +
-		'printf \'%s\' \'{"hasCompletedOnboarding":true}\' > "$cfg"; chmod 644 "$cfg"';
-	const res = await execInContainer(target, { script, stdin: creds });
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const wrote = await writeContainerFile(
+		target,
+		claudeConfigFile('.credentials.json', '600'),
+		creds
+	);
+	if (!wrote.ok) return wrote;
+	return editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+		deepMerge(cur, { hasCompletedOnboarding: true })
+	);
 }
 
 /**

package/src/container-injections/claude-code-custom.ts

@@ -1,5 +1,13 @@
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	containerFileExists,
+	shellEnvFile,
+	deepMerge,
+	editJsonFile,
+	installShellEnvFile,
+	shellSingleQuote
+} from '../lib/container-files.server.ts';
+import { CLAUDE_JSON_FILE } from '../lib/claude-settings.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** Mirrors the reference launcher script (claude-code.sh); each is overridable in Settings. */
@@ -35,57 +43,36 @@ export function customEndpointConfig(): {
 	};
 }
 
-const ENV_FILE = '~/.codebay-claude-env';
+const ENV_FILE_NAME = '.codebay-claude-env';
+
+/** The whole file (token included) rides `stdin` inside `installShellEnvFile`, so nothing hits argv. */
+function envFileContent(config: NonNullable<ReturnType<typeof customEndpointConfig>>): string {
+	return (
+		[
+			'export DISABLE_AUTOUPDATER=1',
+			'export CLAUDE_CODE_USE_BEDROCK=1',
+			'export CLAUDE_CODE_SKIP_BEDROCK_AUTH=1',
+			`export ANTHROPIC_BEDROCK_BASE_URL=${shellSingleQuote(config.baseUrl)}`,
+			`export ANTHROPIC_AUTH_TOKEN=${shellSingleQuote(config.token)}`,
+			`export ANTHROPIC_DEFAULT_OPUS_MODEL=${shellSingleQuote(config.opusModel)}`,
+			`export ANTHROPIC_DEFAULT_SONNET_MODEL=${shellSingleQuote(config.sonnetModel)}`,
+			`export ANTHROPIC_DEFAULT_HAIKU_MODEL=${shellSingleQuote(config.haikuModel)}`,
+			`export ANTHROPIC_SMALL_FAST_MODEL=${shellSingleQuote(config.smallFastModel)}`,
+			`export ANTHROPIC_MODEL=${shellSingleQuote(config.defaultModel)}`
+		].join('\n') + '\n'
+	);
+}
 
-/**
- * Non-secret values ride `args`, so nothing needs hand-quoting; only the token uses `stdin`.
- * The file mixes secret and non-secret content, hence no `writeSecretFileScript`.
- */
 async function injectCustomEndpoint(
 	target: ContainerTarget,
 	config: NonNullable<ReturnType<typeof customEndpointConfig>>
 ): Promise<{ ok: boolean; error?: string }> {
-	const script =
-		'set -e; f=$(eval echo "' +
-		ENV_FILE +
-		'"); ' +
-		'{ ' +
-		"printf '%s\\n' " +
-		"'export DISABLE_AUTOUPDATER=1' " +
-		"'export CLAUDE_CODE_USE_BEDROCK=1' " +
-		"'export CLAUDE_CODE_SKIP_BEDROCK_AUTH=1'; " +
-		'printf \'export ANTHROPIC_BEDROCK_BASE_URL=%s\\n\' "$1"; ' +
-		'printf \'export ANTHROPIC_AUTH_TOKEN=%s\\n\' "$CODEBAY_STDIN"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_OPUS_MODEL=%s\\n\' "$2"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_SONNET_MODEL=%s\\n\' "$3"; ' +
-		'printf \'export ANTHROPIC_DEFAULT_HAIKU_MODEL=%s\\n\' "$4"; ' +
-		'printf \'export ANTHROPIC_SMALL_FAST_MODEL=%s\\n\' "$5"; ' +
-		'printf \'export ANTHROPIC_MODEL=%s\\n\' "$6"; ' +
-		'} > "$f"; chmod 600 "$f"; ' +
-		// The grep guard keeps a re-apply from stacking duplicate source lines.
-		'h=$(eval echo ~$(id -un)); src="[ -f \\"$f\\" ] && . \\"$f\\""; ' +
-		'for rc in "$h/.bashrc" "$h/.zshrc"; do ' +
-		'grep -qF "$src" "$rc" 2>/dev/null || printf \'%s\\n\' "$src" >> "$rc"; ' +
-		'done; ' +
-		// `hasCompletedOnboarding` is what suppresses `claude`'s first-run wizard.
-		'h=$(eval echo ~$(id -un)); ' +
-		'cfg="${CLAUDE_CONFIG_DIR:+$CLAUDE_CONFIG_DIR/.claude.json}"; cfg="${cfg:-$h/.claude.json}"; ' +
-		'printf \'%s\' \'{"hasCompletedOnboarding":true}\' > "$cfg"; chmod 644 "$cfg"';
-
-	const res = await execInContainer(target, {
-		script,
-		stdin: config.token,
-		args: [
-			'claude-custom',
-			config.baseUrl,
-			config.opusModel,
-			config.sonnetModel,
-			config.haikuModel,
-			config.smallFastModel,
-			config.defaultModel
-		]
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const env = await installShellEnvFile(target, ENV_FILE_NAME, envFileContent(config));
+	if (!env.ok) return env;
+	// `hasCompletedOnboarding` is what suppresses `claude`'s first-run wizard.
+	return editJsonFile(target, CLAUDE_JSON_FILE, (cur) =>
+		deepMerge(cur, { hasCompletedOnboarding: true })
+	);
 }
 
 /** Replaces `claude-code-credentials` in the registry when the custom-endpoint setting is on. */
@@ -120,6 +107,6 @@ export const claudeCodeCustom: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(target, `f=$(eval echo "${ENV_FILE}"); [ -s "$f" ] && echo 1 || echo 0`);
+		return containerFileExists(target, shellEnvFile(ENV_FILE_NAME));
 	}
 };

package/src/container-injections/claude-code-ide-extension.ts

@@ -0,0 +1,39 @@
+import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
+
+/** On Open VSX (code-server's default registry); the Marketplace build `/ide` targets is unreachable. */
+export const EXTENSION_ID = 'anthropic.claude-code';
+
+const EXT_GLOB = '~/.local/share/code-server/extensions/anthropic.claude-code-*';
+
+/** Idempotent (skips if already present); best-effort — needs Open VSX egress. */
+export const INSTALL_SCRIPT =
+	`if ls -d ${EXT_GLOB} >/dev/null 2>&1; then exit 0; fi; ` +
+	`command -v code-server >/dev/null 2>&1 || { echo "code-server not found" >&2; exit 1; }; ` +
+	`code-server --install-extension ${EXTENSION_ID}`;
+
+export const CHECK_SCRIPT = `ls -d ${EXT_GLOB} >/dev/null 2>&1 && echo 1 || echo 0`;
+
+/**
+ * Runtime fallback to the build-time launch-line install in CODE_SERVER_LAUNCH; failure is
+ * non-fatal since the IDE integration is optional and everything else works without it.
+ */
+export const claudeCodeIdeExtension: Injection = {
+	id: 'claude-code-ide-extension',
+	label: 'Claude Code IDE extension',
+
+	async apply(target, log) {
+		log('Installing Claude Code IDE extension…\n');
+		// Full target (with remoteUser) so it lands in that user's code-server home, where code-server reads it.
+		const res = await execInContainer(target, { script: INSTALL_SCRIPT });
+		log(
+			res.ok
+				? '✓ Claude Code IDE extension installed\n'
+				: `⚠ Claude Code IDE extension install failed: ${res.error} — /ide integration off\n`
+		);
+	},
+
+	async check(target) {
+		return checkPresence(target, CHECK_SCRIPT);
+	}
+};

package/src/container-injections/claude-code-models.ts

@@ -1,5 +1,5 @@
 import { getOption } from '../lib/db.server.ts';
-import { execInContainer } from '../lib/exec.server.ts';
+import { installShellEnvFile, shellSingleQuote } from '../lib/container-files.server.ts';
 import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
 
 /** The option key → Claude env var mapping; order is the field order in Settings. */
@@ -26,33 +26,17 @@ export function manualModelConfig(): Record<string, string> | null {
 	return Object.keys(filled).length ? filled : null;
 }
 
-const ENV_FILE = '~/.codebay-claude-models-env';
+const ENV_FILE_NAME = '.codebay-claude-models-env';
 
-/** Model IDs are non-secret, so every value rides `args` ($1, $2, …) — no stdin. */
-async function injectModels(
+function injectModels(
 	target: ContainerTarget,
 	config: Record<string, string>
 ): Promise<{ ok: boolean; error?: string }> {
-	const entries = Object.entries(config);
-	const writes = entries.map(([env], i) => `printf 'export ${env}=%s\\n' "$${i + 1}"; `).join('');
-	const script =
-		'set -e; f=$(eval echo "' +
-		ENV_FILE +
-		'"); ' +
-		'{ ' +
-		writes +
-		'} > "$f"; chmod 600 "$f"; ' +
-		// The grep guard keeps a re-apply from stacking duplicate source lines.
-		'h=$(eval echo ~$(id -un)); src="[ -f \\"$f\\" ] && . \\"$f\\""; ' +
-		'for rc in "$h/.bashrc" "$h/.zshrc"; do ' +
-		'grep -qF "$src" "$rc" 2>/dev/null || printf \'%s\\n\' "$src" >> "$rc"; ' +
-		'done';
-
-	const res = await execInContainer(target, {
-		script,
-		args: ['claude-models', ...entries.map(([, value]) => value)]
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
+	const content =
+		Object.entries(config)
+			.map(([env, value]) => `export ${env}=${shellSingleQuote(value)}`)
+			.join('\n') + '\n';
+	return installShellEnvFile(target, ENV_FILE_NAME, content);
 }
 
 /** Sets Claude model env vars on the standard path; skipped when LiteLLM is active. */

package/src/container-injections/claude-model.ts

@@ -1,8 +1,7 @@
 import { getOption } from '../lib/db.server.ts';
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
+import { mergeClaudeSettings, readClaudeSettings } from '../lib/claude-settings.server.ts';
 import { readHostClaudeSettings } from './claude-statusline.ts';
-import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
 
 /** The app's own model config (manual override / LiteLLM) exports ANTHROPIC_MODEL, which wins over settings.json. */
 function appOwnsModel(): boolean {
@@ -20,35 +19,16 @@ export async function hostClaudeModel(): Promise<string | null> {
 	return typeof model === 'string' && model.trim() ? model.trim() : null;
 }
 
-async function injectModel(
-	target: ContainerTarget,
-	model: string
-): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify({ model })
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
 /** Mirrors the host's default `model` into the container so subscription instances match the host. */
 export const claudeModel: Injection = {
 	id: 'claude-model',
 	label: 'model default',
 
-	auth: {
-		hint: 'set `model` in ~/.claude/settings.json',
-		async status() {
-			const model = await hostClaudeModel();
-			return { available: model !== null, source: model ? '~/.claude/settings.json' : null };
-		}
-	},
-
 	async apply(target, log) {
 		const model = await hostClaudeModel();
 		if (!model) return;
 		log(`Injecting Claude model default (${model})…\n`);
-		const result = await injectModel(target, model);
+		const result = await mergeClaudeSettings(target, { model });
 		log(
 			result.ok
 				? '✓ Claude model default configured in container\n'
@@ -57,10 +37,7 @@ export const claudeModel: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q \'"model"\' "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return typeof settings?.model === 'string' && settings.model.trim() !== '';
 	}
 };

package/src/container-injections/claude-no-coauthor.ts

@@ -1,6 +1,5 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
-import { mergeClaudeSettingsScript } from './attention-hooks.ts';
-import type { ContainerTarget, Injection } from '../lib/injections.server.ts';
+import { mergeClaudeSettings, readClaudeSettings } from '../lib/claude-settings.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
 
 /**
  * Both schemas on purpose: newer `claude` reads the nested `attribution` object, older builds
@@ -12,14 +11,6 @@ export const NO_COAUTHOR_SETTINGS = {
 	attribution: { commit: '', pr: '', includeCoAuthoredBy: false }
 };
 
-async function injectNoCoauthor(target: ContainerTarget): Promise<{ ok: boolean; error?: string }> {
-	const res = await execInContainer(target, {
-		script: mergeClaudeSettingsScript(),
-		stdin: JSON.stringify(NO_COAUTHOR_SETTINGS)
-	});
-	return res.ok ? { ok: true } : { ok: false, error: res.error };
-}
-
 /** A Codebay-wide default rather than an opt-in setting, hence no `auth` block. */
 export const claudeNoCoauthor: Injection = {
 	id: 'claude-no-coauthor',
@@ -27,7 +18,7 @@ export const claudeNoCoauthor: Injection = {
 
 	async apply(target, log) {
 		log('Disabling Claude co-author commit byline…\n');
-		const result = await injectNoCoauthor(target);
+		const result = await mergeClaudeSettings(target, NO_COAUTHOR_SETTINGS);
 		log(
 			result.ok
 				? '✓ Claude co-author byline disabled\n'
@@ -36,10 +27,7 @@ export const claudeNoCoauthor: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(
-			target,
-			'h=$(eval echo ~$(id -un)); d="${CLAUDE_CONFIG_DIR:-$h/.claude}"; ' +
-				'[ -s "$d/settings.json" ] && grep -q includeCoAuthoredBy "$d/settings.json" && echo 1 || echo 0'
-		);
+		const settings = await readClaudeSettings(target);
+		return settings !== null && 'includeCoAuthoredBy' in settings;
 	}
 };

package/src/container-injections/claude-skip-permissions.ts

@@ -1,22 +1,12 @@
-import { checkPresence, execInContainer } from '../lib/exec.server.ts';
+import {
+	appendLinesIfAbsent,
+	linesPresent,
+	SHELL_RC_FILES
+} from '../lib/container-files.server.ts';
 import type { Injection } from '../lib/injections.server.ts';
 
 const ALIAS_LINE = "alias claude='claude --dangerously-skip-permissions'";
 
-/** Both rc files, since either shell may be the one code-server opens. */
-const APPLY_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	`line="${ALIAS_LINE}"; ` +
-	'for f in "$h/.bashrc" "$h/.zshrc"; do ' +
-	'grep -qF "$line" "$f" 2>/dev/null || printf \'%s\\n\' "$line" >> "$f"; ' +
-	'done';
-
-const CHECK_SCRIPT =
-	'h=$(eval echo ~$(id -un)); ' +
-	`line="${ALIAS_LINE}"; ` +
-	'if grep -qF "$line" "$h/.bashrc" 2>/dev/null || grep -qF "$line" "$h/.zshrc" 2>/dev/null; ' +
-	'then echo 1; else echo 0; fi';
-
 /** Safe here only because instances are throwaway, single-tenant sandboxes. */
 export const claudeSkipPermissions: Injection = {
 	id: 'claude-skip-permissions',
@@ -24,7 +14,7 @@ export const claudeSkipPermissions: Injection = {
 
 	async apply(target, log) {
 		log('Installing claude --dangerously-skip-permissions alias…\n');
-		const res = await execInContainer(target, { script: APPLY_SCRIPT });
+		const res = await appendLinesIfAbsent(target, SHELL_RC_FILES, [ALIAS_LINE]);
 		log(
 			res.ok
 				? '✓ claude skip-permissions alias installed\n'
@@ -33,6 +23,6 @@ export const claudeSkipPermissions: Injection = {
 	},
 
 	async check(target) {
-		return checkPresence(target, CHECK_SCRIPT);
+		return linesPresent(target, SHELL_RC_FILES, [ALIAS_LINE]);
 	}
 };