codebay 0.7.0 → 0.8.0

package/.mochi/manifest.json

@@ -32,18 +32,18 @@
     "src/components/AppBar.svelte": "/_mochi/css/AppBar-3bxinv4pabv8l.css",
     "src/components/Avatar.svelte": "/_mochi/css/Avatar-3pi30db6ozvf0.css",
     "src/components/Button.svelte": "/_mochi/css/Button-2vtbrzb5kgu25.css",
-    "src/components/ThemePicker.svelte": "/_mochi/css/ThemePicker-1ir8jyocm8mvi.css",
     "src/components/CoinButton.svelte": "/_mochi/css/CoinButton-1rej3sh3tkjud.css",
-    "src/components/FolderBrowser.svelte": "/_mochi/css/FolderBrowser-1x428zb3f2kti.css",
+    "src/components/ThemePicker.svelte": "/_mochi/css/ThemePicker-1ir8jyocm8mvi.css",
     "src/components/InstanceCard.svelte": "/_mochi/css/InstanceCard-3vnltxnbxkvay.css",
-    "src/components/TopBar.svelte": "/_mochi/css/TopBar-2q87li6yt8ids.css",
+    "src/components/FolderBrowser.svelte": "/_mochi/css/FolderBrowser-1x428zb3f2kti.css",
     "node_modules/svelte-french-toast/dist/components/ToastWrapper.svelte": "/_mochi/css/ToastWrapper-1fbnym10rm2nv.css",
     "node_modules/svelte-french-toast/dist/components/ToastMessage.svelte": "/_mochi/css/ToastMessage-2jfwb2og2lfa8.css",
-    "src/components/PortsBox.svelte": "/_mochi/css/PortsBox-1t25b5yg7jva3.css",
+    "src/components/TopBar.svelte": "/_mochi/css/TopBar-2q87li6yt8ids.css",
     "src/components/BranchBox.svelte": "/_mochi/css/BranchBox-1yqu1q2mgnjwz.css",
-    "src/components/Brand.svelte": "/_mochi/css/Brand-1bh2b800g5vrn.css",
-    "src/components/InstanceFilter.svelte": "/_mochi/css/InstanceFilter-3q6x0jt0hcgpz.css",
+    "src/components/PortsBox.svelte": "/_mochi/css/PortsBox-1t25b5yg7jva3.css",
     "src/components/CredMenu.svelte": "/_mochi/css/CredMenu-9hwgeptp7crb.css",
+    "src/components/InstanceFilter.svelte": "/_mochi/css/InstanceFilter-3q6x0jt0hcgpz.css",
+    "src/components/Brand.svelte": "/_mochi/css/Brand-1bh2b800g5vrn.css",
     "src/components/SettingsCog.svelte": "/_mochi/css/SettingsCog-jftyadvo64qo.css"
   },
   "clientFiles": {
@@ -70,18 +70,18 @@
     "/_mochi/css/AppBar-3bxinv4pabv8l.css": "svelte-css/AppBar-3bxinv4pabv8l.css",
     "/_mochi/css/Avatar-3pi30db6ozvf0.css": "svelte-css/Avatar-3pi30db6ozvf0.css",
     "/_mochi/css/Button-2vtbrzb5kgu25.css": "svelte-css/Button-2vtbrzb5kgu25.css",
-    "/_mochi/css/ThemePicker-1ir8jyocm8mvi.css": "svelte-css/ThemePicker-1ir8jyocm8mvi.css",
     "/_mochi/css/CoinButton-1rej3sh3tkjud.css": "svelte-css/CoinButton-1rej3sh3tkjud.css",
-    "/_mochi/css/FolderBrowser-1x428zb3f2kti.css": "svelte-css/FolderBrowser-1x428zb3f2kti.css",
+    "/_mochi/css/ThemePicker-1ir8jyocm8mvi.css": "svelte-css/ThemePicker-1ir8jyocm8mvi.css",
     "/_mochi/css/InstanceCard-3vnltxnbxkvay.css": "svelte-css/InstanceCard-3vnltxnbxkvay.css",
-    "/_mochi/css/TopBar-2q87li6yt8ids.css": "svelte-css/TopBar-2q87li6yt8ids.css",
+    "/_mochi/css/FolderBrowser-1x428zb3f2kti.css": "svelte-css/FolderBrowser-1x428zb3f2kti.css",
     "/_mochi/css/ToastWrapper-1fbnym10rm2nv.css": "svelte-css/ToastWrapper-1fbnym10rm2nv.css",
     "/_mochi/css/ToastMessage-2jfwb2og2lfa8.css": "svelte-css/ToastMessage-2jfwb2og2lfa8.css",
-    "/_mochi/css/PortsBox-1t25b5yg7jva3.css": "svelte-css/PortsBox-1t25b5yg7jva3.css",
+    "/_mochi/css/TopBar-2q87li6yt8ids.css": "svelte-css/TopBar-2q87li6yt8ids.css",
     "/_mochi/css/BranchBox-1yqu1q2mgnjwz.css": "svelte-css/BranchBox-1yqu1q2mgnjwz.css",
-    "/_mochi/css/Brand-1bh2b800g5vrn.css": "svelte-css/Brand-1bh2b800g5vrn.css",
-    "/_mochi/css/InstanceFilter-3q6x0jt0hcgpz.css": "svelte-css/InstanceFilter-3q6x0jt0hcgpz.css",
+    "/_mochi/css/PortsBox-1t25b5yg7jva3.css": "svelte-css/PortsBox-1t25b5yg7jva3.css",
     "/_mochi/css/CredMenu-9hwgeptp7crb.css": "svelte-css/CredMenu-9hwgeptp7crb.css",
+    "/_mochi/css/InstanceFilter-3q6x0jt0hcgpz.css": "svelte-css/InstanceFilter-3q6x0jt0hcgpz.css",
+    "/_mochi/css/Brand-1bh2b800g5vrn.css": "svelte-css/Brand-1bh2b800g5vrn.css",
     "/_mochi/css/SettingsCog-jftyadvo64qo.css": "svelte-css/SettingsCog-jftyadvo64qo.css",
     "/_mochi/import-css/index-0nwv3654.css": "import-css/index-0nwv3654.css",
     "/_mochi/import-css/index-xndx4980.css": "import-css/index-xndx4980.css",

package/README.md

@@ -18,6 +18,8 @@ The UI opens at `http://localhost:6969`. State (SQLite DB + per-instance workspa
 - `DATA_DIR` — where state lives (default `~/.codebay`)
 - `DOCKER_HOST` — Docker socket/URL (defaults to your active Docker context)
 - `HOST` — bind address (default `127.0.0.1`). Set `0.0.0.0` to reach codebay from other machines; your instances' forwarded app ports are then published on all interfaces too. Each container's code-server port stays loopback-only regardless — it runs without a password of its own and is reached through the Basic-Auth-gated `/p/:id/` proxy instead. Existing instances need a **Restart** to pick up the new binding.
+- `PUBLIC_ORIGIN` — the origin you actually load codebay from (default `http://localhost:<PORT>`). Every form POST — creating an instance, restarting one, saving settings — is checked against it, so reaching the UI at any other address (a LAN IP, a hostname, or a reverse proxy / tunnel that terminates TLS) makes those actions fail with a `403 Cross-site POST form submissions are forbidden` until you set this. Give the exact scheme + host + port your browser shows, with no trailing slash — `PUBLIC_ORIGIN=http://192.168.1.50:6969` or `PUBLIC_ORIGIN=https://codebay.example.com`. Behind a TLS-terminating proxy this is the public `https://` URL, not the loopback address the proxy forwards to.
+- `TRUSTED_ORIGINS` — comma-separated extra origins accepted alongside `PUBLIC_ORIGIN`, for when the UI is legitimately reachable at more than one address (e.g. `http://localhost:6969,http://192.168.1.50:6969`)
 - `BASIC_AUTH_PASSWORD` — enables HTTP Basic Auth over the whole UI (disabled when unset); required if you bind beyond loopback with `HOST=0.0.0.0`
 - `CODEBAY_CLAUDE_CODE_TOKEN` — Claude Code token to inject into every container (e.g. from `claude setup-token`) instead of discovering the host's credentials
 - `CODEBAY_GITHUB_TOKEN` — GitHub token to inject instead of reading `gh auth token` from the host
@@ -25,6 +27,7 @@ The UI opens at `http://localhost:6969`. State (SQLite DB + per-instance workspa
 
 ## Troubleshooting
 
+- `403 Cross-site POST form submissions are forbidden` when clicking anything that saves — codebay is being reached at an origin other than `http://localhost:<PORT>`. Set `PUBLIC_ORIGIN` to the URL in your browser's address bar and restart (see Configuration).
 - `warn: incorrect peer dependency "svelte@5.56.8"` on startup — harmless. It comes from `svelte-french-toast`, whose published peer range predates Svelte 5; the library works correctly on Svelte 5. Nothing to fix.
 
 ## Development

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "codebay",
-	"version": "0.7.0",
+	"version": "0.8.0",
 	"description": "Web UI for spinning up isolated devcontainer instances from any local folder, each with a browser-based VS Code (code-server) — built for parallel Claude Code workflows.",
 	"type": "module",
 	"license": "MIT",

package/src/container-injections/claude-code-update.ts

@@ -0,0 +1,43 @@
+import { execInContainer } from '../lib/exec.server.ts';
+import type { Injection } from '../lib/injections.server.ts';
+
+/**
+ * The claude-code devcontainer feature installs `npm install -g @anthropic-ai/claude-code`
+ * (always latest) at *build* time, so a cached feature layer keeps serving whatever version
+ * was current when the layer was first baked. This re-checks at boot and only reinstalls when
+ * behind — no-op if Claude Code isn't installed (project-owned images own their tooling) or
+ * npm/registry is unreachable, and it echoes `updated <old> -> <new>` so `apply()` can log it.
+ */
+export const UPDATE_SCRIPT =
+	'command -v claude >/dev/null 2>&1 || exit 0; ' +
+	'command -v npm >/dev/null 2>&1 || exit 0; ' +
+	"installed=$(claude --version 2>/dev/null | grep -oE '[0-9]+\\.[0-9]+\\.[0-9]+' | head -n1); " +
+	'latest=$(npm view @anthropic-ai/claude-code version 2>/dev/null); ' +
+	'if [ -z "$latest" ]; then exit 0; fi; ' +
+	'if [ "$installed" = "$latest" ]; then echo "current $latest"; exit 0; fi; ' +
+	'npm install -g @anthropic-ai/claude-code@latest >/dev/null 2>&1 || exit 1; ' +
+	'echo "updated $installed -> $latest"';
+
+/** Best-effort, non-fatal — a failed update leaves the cached version in place. */
+export const claudeCodeUpdate: Injection = {
+	id: 'claude-code-update',
+	label: 'Claude Code up to date',
+
+	async apply(target, log) {
+		log('Checking Claude Code is up to date…\n');
+		// Omitting remoteUser runs as root, which the global npm reinstall needs.
+		const res = await execInContainer(
+			{ containerId: target.containerId },
+			{ script: UPDATE_SCRIPT, capture: true }
+		);
+		if (!res.ok) {
+			log(`⚠ Claude Code update check failed: ${res.error} — keeping the installed version\n`);
+			return;
+		}
+		const status = res.stdout.split('\n').at(-1)?.trim() ?? '';
+		if (status.startsWith('updated ')) log(`✓ Claude Code ${status.slice('updated '.length)}\n`);
+		else if (status.startsWith('current '))
+			log(`✓ Claude Code already latest (${status.slice('current '.length)})\n`);
+		else log('✓ Claude Code version check done\n');
+	}
+};

package/src/index.ts

@@ -4,6 +4,7 @@ import { basicAuth } from './lib/auth.server.ts';
 import { themeHandle } from './lib/theme.server.ts';
 import { PROXY_PREFIX } from './lib/proxy.server.ts';
 import {
+	APP_VERSION,
 	BASIC_AUTH_PASSWORD,
 	HOST,
 	PORT,
@@ -66,7 +67,7 @@ await Mochi.serve({
 });
 
 const url = 'http://localhost:' + PORT;
-console.log(`Server running at ${url} (bound to ${HOST})`);
+console.log(`codebay v${APP_VERSION} — server running at ${url} (bound to ${HOST})`);
 
 if (process.env.DISABLE_OPEN_BROWSER !== '1') {
 	const openCmd =

package/src/lib/devcontainer.server.ts

@@ -102,9 +102,11 @@ const WAIT_FOR_INJECTIONS =
  * claude scans `~/.claude/ide/*.lock` once at startup and never retries, so it must not race
  * the code-server extension host writing that lock — hold it briefly until the bridge appears.
  * Bounded so an offline/uninstalled instance (lock never written) still yields a usable terminal.
- * No single quotes: this is spliced into the single-quoted tmux command string below.
+ * No single quotes: this is spliced into the single-quoted tmux command string below. The probe
+ * pipes ls through grep instead of globbing — tmux runs this under the user's default shell, and
+ * zsh prints "no matches found" to the terminal on every unmatched-glob iteration.
  */
-const WAIT_FOR_IDE_BRIDGE = `i=0; until ls "$HOME/.claude/ide/"*.lock >/dev/null 2>&1 || [ "$i" -ge 30 ]; do sleep 1; i=$((i + 1)); done; `;
+const WAIT_FOR_IDE_BRIDGE = `i=0; until ls "$HOME/.claude/ide/" 2>/dev/null | grep -q "\\.lock$" || [ "$i" -ge 30 ]; do sleep 1; i=$((i + 1)); done; `;
 
 /**
  * Runs under tmux so Claude survives the browser closing — code-server reaps the

package/src/lib/injections.server.ts

@@ -7,6 +7,7 @@ import { gitIdentity } from '../container-injections/git-identity.ts';
 import { claudeCodeCredentials } from '../container-injections/claude-code-credentials.ts';
 import { claudeCodeCustom } from '../container-injections/claude-code-custom.ts';
 import { claudeCodeIdeExtension } from '../container-injections/claude-code-ide-extension.ts';
+import { claudeCodeUpdate } from '../container-injections/claude-code-update.ts';
 import { claudeCodeModels } from '../container-injections/claude-code-models.ts';
 import { githubCredentials } from '../container-injections/github-credentials.ts';
 import { attentionHooks } from '../container-injections/attention-hooks.ts';
@@ -52,6 +53,8 @@ const BASE_INJECTIONS_HEAD: Injection[] = [
 ];
 
 const BASE_INJECTIONS_TAIL: Injection[] = [
+	// Refresh the binary to latest before the other claude-config steps run against it.
+	claudeCodeUpdate,
 	// Self-skips unless manual override is on and LiteLLM off, so it's safe in the always-run tail.
 	claudeCodeModels,
 	claudeCodeIdeExtension,