- Highlight string children with refractor (Prism) when `language` is
set, rendered as React token spans; add ini/bash/json/yaml/ts support
- Add `theme` prop (auto | light | dark); auto follows the `.dark` class.
Palettes are `--twui-code-*` CSS variables (GitHub Light/Dark, all
tokens WCAG AA) so custom themes need no component changes
- Fix layout: real padding, singleBlock copy button no longer covers
the code, clipped rounded corners, wrapperProps.style honoured,
long tokens wrap
- MDX helpers take `codeTheme` and no longer force a black background
- Highlight WireGuard config blocks as ini
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rebuild every page on a shared set of twui-based primitives with a dense
ops-console look, WireGuard red accent and light/dark/system theming.
- Add design tokens (WireGuard red accent, zinc neutrals, theme-flipping
semantic colours) and a no-flash theme cookie + toggle
- Add shared components: page header, panel, sub-nav, data table with
mobile card list, stat tile, status dot, key-value list, copy button,
inline alert, empty state, form section/actions, confirm dialog and
toast providers
- New admin shell (sidebar, sticky header, mobile drawer) and a centered
shell for auth and 404; strip the public template pages
- Unify adding clients at /admin/clients/add with a host picker; tabbed
client detail (Overview / Rules / Config & QR) with config copy/download
- Re-run client setup after rule changes on the detail page so the
firewall matches the DB
- Split Setup into status/maintenance/firewall and Settings into
profile/password subpages
- Replace window.confirm/alert and page reloads with in-app dialogs,
toasts and in-place list updates
- Fix nested rule form submitting the client form, prefilled signup
passwords, hidden submit buttons, fields not updating after "next
free" lookups, and TinyMCE white-on-white in dark mode
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Drop unused email module and media text extraction path
- Remove 12 unused dependencies
- Remove unused imports in server.ts
- Add typecheck and test scripts
- Rewrite AGENTS.md to describe this project
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Non-super-admin PUT updated the client whose id equalled the user's id;
it now updates the requested client only if the user owns it. POST no
longer lets non-super-admins overwrite existing clients by id.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Require admin auth on interface-local-ip, network-interfaces,
next-listen-port and public-ip (interface-local-ip and public-ip
allowed unauthenticated command injection as root)
- Validate interface names and call ip/curl via execFileSync
- Write host/client WireGuard configs with fs instead of shell
heredocs, validating IPs, AllowedIPs, endpoint and listen port
- Replace rm -rf/cat/mkdir/chmod/test shell calls with fs APIs
- Refuse private media requested through the public media route
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Import types from @moduletrace/bun-sqlite/types now that the package
has an exports map, and guard optional ctx.props in signup server fn.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- setup-main-host-button: live availability status, grab-next-subnet helper, error/success feedback
- setup-wireguard-host: harden generated shell scripts with set -e
- check-private-ip-address-availability: add user access check, drop manual body validation
- setup-main-host: pass host object with wg_ip_address
- install-wg-ui.sh: run service as the invoking user (root or sudo) instead of a dedicated wgui user, and skip systemd/OpenRC daemon setup when NODE_ENV=development
tbenandClaude Opus 5.5