Self-service operation from the WebUI, for a dev instance first.
- Settings > Console > Restart Console. A foreground `mosaic console
start` now supervises the webui: the child exits 75 after answering a
restart and the supervisor relaunches it with the same argv. Org buses
keep running. /api/config carries a per-process boot id, so the open
page polls until a new process answers and then reloads. A detached
Console has no supervisor and answers 409.
- Restart bus on every "Restart needed" receipt and on the bus-down
banner: POST /api/orgs/<id>/restart/bus restarts a running bus or
starts a stopped one, then shows a done receipt with the time.
- Settings > Routing: after a save, the page lists how the change
reaches each agent (next start, session end, thread idle) and offers
"Restart <agent> now" for a running one. A session is terminated with
the reason "route change" and launched again; a thread is terminated.
- Organization settings: the signed-in owner's settings, routing,
agent, plug-in and Model proxy writes now reach the selected org's
bus instead of answering 403. Org mode exists only under
--dev-local-owner. Proxy setup stays a terminal step; a dev-only note
names the two commands.
Every control needs the signed-in owner session, the page's exact
Origin and Sec-Fetch-Site: same-origin. The tester listener, granted
users, API tokens, agents and bus roles are refused before any work.
Each use is written to <dataRoot>/console/actions.jsonl (0600, no
symlinks) with who, when, what and the outcome. The Console and bus
restart trails fail closed. No change to credential handling, the
broker, the bus tenant boundary or v2 schemas.
Add a reviewed `theme` plugin kind (interfaceVersion 1, export `theme`, switch
"list"). A module returns data only: a displayName and a flat map of colour
custom properties for light, dim and dark. checkTheme validates names and
#rrggbb colours strictly and checks each text/background pair for contrast; a
bad module is refused and logged, never served.
The ten shipped palettes become the first ten modules under
packages/plugins/theme/<name>/. Modules are found by directory scan
(loader.discoverModules, loader.loadInstalled), not by a list in the Console.
loadModule and createLoader are unchanged.
The organization file takes `appearance: { theme, mode }`, validated in
packages/business/src/appearance.mjs; a missing appearance is valid.
GET /api/themes (themes-http.mjs) serves the installed, valid themes.
Browser: the Settings picker lists /api/themes. Precedence is a per-organization
browser override, then the organization's saved theme, then the built-in default
(Harbor, dark). Clearing the override restores the organization's choice. An
uninstalled or invalid saved theme renders the default with a visible warning
and keeps the saved value. A legacy global browser preference is not copied to
every organization. The organization is named in text, so colour is never the
only cue. A plain load writes no appearance record. The default look is
unchanged: computed styles match the base commit element for element.
jason.woltje