From fde5fe7c64413ebec78de47a50c9160d6eee01ba Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 7 Jun 2026 09:02:38 +0800
Subject: [PATCH 01/18] fix: use relative symlink for latest to work inside
 Docker containers

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 73a1aee..71c0ca3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ jobs:
           cp packaging/breadbox-sync.service "${PKG_DIR}/"
           cp config.example.toml "${PKG_DIR}/"
           cp bakery.toml "${PKG_DIR}/bakery.toml"
-          ln -sfn "${PKG_DIR}" "${DL_DIR}/breadbox/latest"
+          ln -sfn "${VERSION}" "${DL_DIR}/breadbox/latest"
 
       - name: ensure bread-ecosystem
         run: |

From 423d00383b109dfbca5d6c4c040d0bd567f93397 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sun, 7 Jun 2026 14:35:06 +0800
Subject: [PATCH 02/18] feat: rank search results by match quality and launch
 frequency

Track per-app launch counts in ~/.cache/breadbox/history.json. When a
query is active, sort visible results by fuzzy match quality (exact >
prefix > contains > subsequence) then by launch count descending, so
the most relevant and most-used app rises to the top. The base list
(no query) also surfaces most-launched apps above unvisited ones.
---
 Cargo.lock                 |  7 ++--
 breadbox-shared/Cargo.toml |  3 +-
 breadbox-shared/src/lib.rs | 33 +++++++++++++++++
 breadbox-sync/Cargo.toml   |  2 +-
 breadbox/Cargo.toml        |  2 +-
 breadbox/src/main.rs       | 76 ++++++++++++++++++++++++++++++++------
 6 files changed, 106 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index cf7328f..e484fcb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,7 +39,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "bread-theme",
  "breadbox-shared",
@@ -50,15 +50,16 @@ dependencies = [
 
 [[package]]
 name = "breadbox-shared"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "serde",
+ "serde_json",
  "toml 0.8.23",
 ]
 
 [[package]]
 name = "breadbox-sync"
-version = "0.1.0"
+version = "0.2.0"
 dependencies = [
  "breadbox-shared",
  "serde_json",
diff --git a/breadbox-shared/Cargo.toml b/breadbox-shared/Cargo.toml
index 1600acd..0edc06a 100644
--- a/breadbox-shared/Cargo.toml
+++ b/breadbox-shared/Cargo.toml
@@ -1,9 +1,10 @@
 [package]
 name = "breadbox-shared"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 license = "MIT"
 
 [dependencies]
 serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 toml = "0.8"
diff --git a/breadbox-shared/src/lib.rs b/breadbox-shared/src/lib.rs
index 8ce6f7d..5286729 100644
--- a/breadbox-shared/src/lib.rs
+++ b/breadbox-shared/src/lib.rs
@@ -1,4 +1,5 @@
 use std::{
+    collections::HashMap,
     env,
     fs::{self, File},
     io::{BufRead, BufReader},
@@ -215,6 +216,38 @@ impl Default for IconCache {
     }
 }
 
+// ---- Launch history ---------------------------------------------------------
+
+pub struct LaunchHistory {
+    counts: HashMap<String, u32>,
+    path: PathBuf,
+}
+
+impl LaunchHistory {
+    pub fn load() -> Self {
+        let path = cache_dir().join("history.json");
+        let counts = fs::read_to_string(&path)
+            .ok()
+            .and_then(|s| serde_json::from_str(&s).ok())
+            .unwrap_or_default();
+        LaunchHistory { counts, path }
+    }
+
+    pub fn count(&self, name: &str) -> u32 {
+        self.counts.get(name).copied().unwrap_or(0)
+    }
+
+    pub fn increment(&mut self, name: &str) {
+        *self.counts.entry(name.to_string()).or_insert(0) += 1;
+    }
+
+    pub fn save(&self) {
+        if let Ok(json) = serde_json::to_string(&self.counts) {
+            let _ = fs::write(&self.path, json);
+        }
+    }
+}
+
 // ---- Config -----------------------------------------------------------------
 
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
diff --git a/breadbox-sync/Cargo.toml b/breadbox-sync/Cargo.toml
index 1c68856..5938acb 100644
--- a/breadbox-sync/Cargo.toml
+++ b/breadbox-sync/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-sync"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index 8dc7f3b..2f09d31 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox"
-version = "0.1.0"
+version = "0.2.0"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox/src/main.rs b/breadbox/src/main.rs
index 29338a9..0fbab50 100644
--- a/breadbox/src/main.rs
+++ b/breadbox/src/main.rs
@@ -1,5 +1,6 @@
 use bread_theme::{hex_to_rgba, load_palette, Palette};
 use std::{
+    cell::RefCell,
     collections::HashMap,
     env,
     fs,
@@ -11,7 +12,7 @@ use std::{
 };
 
 use breadbox_shared::{
-    config_dir, load_all_desktop_entries, Config, DesktopEntry, IconCache,
+    config_dir, load_all_desktop_entries, Config, DesktopEntry, IconCache, LaunchHistory,
 };
 use gtk4::{
     gdk::Display,
@@ -58,6 +59,7 @@ fn load_manifest() -> HashMap<String, PathBuf> {
 fn load_sorted_entries(
     manifest: &HashMap<String, PathBuf>,
     priority: &[String],
+    history: &LaunchHistory,
 ) -> Vec<DesktopEntry> {
     let mut entries = load_all_desktop_entries();
 
@@ -79,7 +81,11 @@ fn load_sorted_entries(
             (Some(i), Some(j)) => i.cmp(&j),
             (Some(_), None) => std::cmp::Ordering::Less,
             (None, Some(_)) => std::cmp::Ordering::Greater,
-            (None, None) => a.name.to_lowercase().cmp(&b.name.to_lowercase()),
+            (None, None) => {
+                // Most-launched first, then alphabetical
+                history.count(&b.name).cmp(&history.count(&a.name))
+                    .then(a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+            }
         }
     });
 
@@ -230,6 +236,17 @@ fn fuzzy_matches(pattern: &str, text: &str) -> bool {
     true
 }
 
+fn fuzzy_score(query: &str, entry: &DesktopEntry) -> u32 {
+    let q = query.to_lowercase();
+    let name = entry.name.to_lowercase();
+    let wm = entry.wm_class.as_deref().unwrap_or("").to_lowercase();
+    if name == q || wm == q { return 0; }
+    if name.starts_with(&q) { return 1; }
+    if name.contains(&q) { return 2; }
+    if wm.starts_with(&q) || wm.contains(&q) { return 3; }
+    4 // subsequence match
+}
+
 // ---- PID file toggle --------------------------------------------------------
 
 fn pid_file() -> PathBuf {
@@ -273,11 +290,14 @@ fn get_row_entry(row: &gtk4::ListBoxRow) -> Option<DesktopEntry> {
     }
 }
 
-fn run_ui(entries: Vec<DesktopEntry>, css: String) {
+fn run_ui(entries: Vec<DesktopEntry>, css: String, history: LaunchHistory) {
     let app = Application::builder()
         .application_id("com.breadway.breadbox")
         .build();
 
+    let history_rc = Rc::new(RefCell::new(history));
+    let query_rc: Rc<RefCell<String>> = Rc::new(RefCell::new(String::new()));
+
     app.connect_activate(move |app| {
         // Base CSS
         let provider = CssProvider::new();
@@ -290,7 +310,6 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
 
         // User CSS override
         {
-            use std::cell::RefCell;
             let user_css_path = config_dir().join("style.css");
             let user_cell: RefCell<Option<CssProvider>> = RefCell::new(None);
             bread_theme::gtk::apply_user_css(&user_css_path, &user_cell);
@@ -334,7 +353,7 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
         let list = ListBox::new();
         list.set_selection_mode(SelectionMode::Browse);
 
-        for entry in &entries {
+        for (idx, entry) in entries.iter().enumerate() {
             let row = gtk4::ListBoxRow::new();
             let hbox = GBox::new(Orientation::Horizontal, 0);
             hbox.set_margin_start(6);
@@ -360,9 +379,35 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
 
             row.set_child(Some(&hbox));
             unsafe { row.set_data("entry", entry.clone()) };
+            unsafe { row.set_data("initial_order", idx as u32) };
             list.append(&row);
         }
 
+        // Sort by match quality + launch count when a query is active;
+        // fall back to insertion order (priority + launch frequency) when empty.
+        let sort_query = Rc::clone(&query_rc);
+        let sort_history = Rc::clone(&history_rc);
+        list.set_sort_func(move |row_a, row_b| {
+            let query = sort_query.borrow();
+            if query.is_empty() {
+                let oa = unsafe { row_a.data::<u32>("initial_order").map_or(u32::MAX, |p| *p.as_ref()) };
+                let ob = unsafe { row_b.data::<u32>("initial_order").map_or(u32::MAX, |p| *p.as_ref()) };
+                return oa.cmp(&ob).into();
+            }
+            let (Some(ea), Some(eb)) = (get_row_entry(row_a), get_row_entry(row_b)) else {
+                return std::cmp::Ordering::Equal.into();
+            };
+            let sa = fuzzy_score(&query, &ea);
+            let sb = fuzzy_score(&query, &eb);
+            let history = sort_history.borrow();
+            let ca = history.count(&ea.name);
+            let cb = history.count(&eb.name);
+            sa.cmp(&sb)
+                .then(cb.cmp(&ca))
+                .then(ea.name.to_lowercase().cmp(&eb.name.to_lowercase()))
+                .into()
+        });
+
         if let Some(first) = list.row_at_index(0) {
             list.select_row(Some(&first));
         }
@@ -373,10 +418,11 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
 
         // Filter on keystroke
         let list_f = list.clone();
+        let filter_query = Rc::clone(&query_rc);
         search.connect_changed(move |entry| {
             let text = entry.text();
             let query = text.as_str();
-            let mut first_vis: Option<gtk4::ListBoxRow> = None;
+            *filter_query.borrow_mut() = query.to_string();
             let mut i = 0i32;
             while let Some(row) = list_f.row_at_index(i) {
                 let vis = get_row_entry(&row)
@@ -389,11 +435,12 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
                     })
                     .unwrap_or(false);
                 row.set_visible(vis);
-                if vis && first_vis.is_none() {
-                    first_vis = Some(row);
-                }
                 i += 1;
             }
+            list_f.invalidate_sort();
+            let first_vis = (0i32..).find_map(|j| {
+                list_f.row_at_index(j).filter(|r| r.is_visible())
+            });
             list_f.select_row(first_vis.as_ref());
         });
 
@@ -402,6 +449,7 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
         key_ctrl.set_propagation_phase(gtk4::PropagationPhase::Capture);
         let close_k = Rc::clone(&close_all);
         let list_k = list.clone();
+        let history_k = Rc::clone(&history_rc);
         key_ctrl.connect_key_pressed(move |_, key, _, _| {
             use gtk4::gdk::Key;
             match key {
@@ -412,6 +460,8 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
                 Key::Return | Key::KP_Enter => {
                     if let Some(row) = list_k.selected_row() {
                         if let Some(entry) = get_row_entry(&row) {
+                            history_k.borrow_mut().increment(&entry.name);
+                            history_k.borrow().save();
                             do_launch(&entry);
                             close_k();
                         }
@@ -458,8 +508,11 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String) {
 
         // Row click launches
         let close_a = Rc::clone(&close_all);
+        let history_a = Rc::clone(&history_rc);
         list.connect_row_activated(move |_, row| {
             if let Some(entry) = get_row_entry(row) {
+                history_a.borrow_mut().increment(&entry.name);
+                history_a.borrow().save();
                 do_launch(&entry);
                 close_a();
             }
@@ -505,11 +558,12 @@ fn main() {
         .map(|c| c.priority.clone())
         .unwrap_or_default();
 
+    let history = LaunchHistory::load();
     let manifest = load_manifest();
-    let entries = load_sorted_entries(&manifest, &priority);
+    let entries = load_sorted_entries(&manifest, &priority, &history);
 
     let palette = load_palette();
     let css = build_css(&palette);
 
-    run_ui(entries, css);
+    run_ui(entries, css, history);
 }

From c01cb67aa55eeea15953ede78bc9aa082463277c Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Thu, 11 Jun 2026 13:37:49 +0800
Subject: [PATCH 03/18] fix: add optional_system_deps (hyprland)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hyprland is used via IPC but not a linked dep — optional now.
---
 bakery.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bakery.toml b/bakery.toml
index 1f16c1f..f2abae4 100644
--- a/bakery.toml
+++ b/bakery.toml
@@ -2,6 +2,7 @@ name = "breadbox"
 description = "App launcher for Hyprland / Wayland"
 binaries = ["breadbox", "breadbox-sync"]
 system_deps = ["gtk4", "gtk4-layer-shell", "librsvg"]
+optional_system_deps = ["hyprland"]
 bread_deps = []
 
 [[service]]

From 311f0d261f7e530ebfaaf10524a1b2ce7743d676 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Thu, 11 Jun 2026 14:21:31 +0800
Subject: [PATCH 04/18] chore: bump version to 0.2.1

---
 breadbox-shared/Cargo.toml | 2 +-
 breadbox-sync/Cargo.toml   | 2 +-
 breadbox/Cargo.toml        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/breadbox-shared/Cargo.toml b/breadbox-shared/Cargo.toml
index 0edc06a..a47dc19 100644
--- a/breadbox-shared/Cargo.toml
+++ b/breadbox-shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-shared"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox-sync/Cargo.toml b/breadbox-sync/Cargo.toml
index 5938acb..93b7392 100644
--- a/breadbox-sync/Cargo.toml
+++ b/breadbox-sync/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-sync"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index 2f09d31..1de3b4e 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox"
-version = "0.2.0"
+version = "0.2.1"
 edition = "2021"
 license = "MIT"
 

From d2ef12551df4cb49c96d5573443bf06db54d2bdb Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Thu, 11 Jun 2026 14:28:01 +0800
Subject: [PATCH 05/18] chore: update Cargo.lock for v0.2.1

---
 Cargo.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index e484fcb..77c0113 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,7 +39,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "bread-theme",
  "breadbox-shared",
@@ -50,7 +50,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-shared"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "serde",
  "serde_json",
@@ -59,7 +59,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-sync"
-version = "0.2.0"
+version = "0.2.1"
 dependencies = [
  "breadbox-shared",
  "serde_json",

From f93596adf299712eb3199af364667bcfcb84e1c3 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 12:12:42 +0800
Subject: [PATCH 06/18] Add packaging/arch PKGBUILD and Forgejo Actions
 workflows

- packaging/arch/PKGBUILD: builds and publishes breadbox to [breadway] repo
- .forgejo/workflows/mirror.yml: mirrors every push/tag to GitHub
- .forgejo/workflows/package.yml: builds on tag, publishes to Forgejo registry

Requires FORGEJO_TOKEN and GITHUB_MIRROR_TOKEN secrets in Forgejo.
---
 .forgejo/workflows/mirror.yml  | 20 +++++++++++++++
 .forgejo/workflows/package.yml | 46 ++++++++++++++++++++++++++++++++++
 packaging/arch/PKGBUILD        | 35 ++++++++++++++++++++++++++
 3 files changed, 101 insertions(+)
 create mode 100644 .forgejo/workflows/mirror.yml
 create mode 100644 .forgejo/workflows/package.yml
 create mode 100644 packaging/arch/PKGBUILD

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
new file mode 100644
index 0000000..ab5700f
--- /dev/null
+++ b/.forgejo/workflows/mirror.yml
@@ -0,0 +1,20 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches: ['**']
+    tags: ['**']
+
+jobs:
+  mirror:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Push to GitHub
+        run: |
+          git remote add github \
+            "https://x-access-token:${{ secrets.GITHUB_MIRROR_TOKEN }}@github.com/Breadway/breadbox.git"
+          git push github --mirror
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
new file mode 100644
index 0000000..246126b
--- /dev/null
+++ b/.forgejo/workflows/package.yml
@@ -0,0 +1,46 @@
+name: Build and publish package
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  package:
+    runs-on: [self-hosted, hestia]
+    container:
+      image: archlinux:latest
+      options: --privileged
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set version
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
+
+      - name: Install build dependencies
+        run: pacman -Syu --noconfirm base-devel git rust cargo gtk4 gtk4-layer-shell librsvg
+
+      - name: Create builder user
+        run: useradd -m builder
+
+      - name: Prepare source
+        run: |
+          git archive --format=tar.gz \
+            --prefix=breadbox-${VERSION}/ \
+            HEAD > packaging/arch/breadbox-${VERSION}.tar.gz
+          SHA=$(sha256sum packaging/arch/breadbox-${VERSION}.tar.gz | awk '{print $1}')
+          sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
+          sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
+          cp -r . /home/builder/src
+          chown -R builder:builder /home/builder/src
+
+      - name: Build package
+        run: su builder -c "cd /home/builder/src/packaging/arch && makepkg -sf --noconfirm"
+
+      - name: Publish to Forgejo registry
+        run: |
+          PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
+          curl -fsS -X PUT \
+            -H "Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
+            --upload-file "${PKG}" \
+            "https://git.breadway.dev/api/packages/breadway/arch/push?distrib=breadway"
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
new file mode 100644
index 0000000..b0f0b1d
--- /dev/null
+++ b/packaging/arch/PKGBUILD
@@ -0,0 +1,35 @@
+# Maintainer: Breadway <rileyhorsham@gmail.com>
+
+pkgname=breadbox
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="App launcher for Hyprland / Wayland"
+arch=('x86_64')
+url="https://github.com/Breadway/breadbox"
+license=('MIT')
+depends=('gtk4' 'gtk4-layer-shell' 'librsvg')
+optdepends=(
+  'hyprland: window and workspace integration'
+)
+makedepends=('rust' 'cargo')
+source=("${pkgname}-${pkgver}.tar.gz")
+sha256sums=('SKIP')
+
+build() {
+  cd "${srcdir}/${pkgname}-${pkgver}"
+  cargo build --release --locked
+}
+
+check() {
+  cd "${srcdir}/${pkgname}-${pkgver}"
+  cargo test --release --locked --workspace
+}
+
+package() {
+  cd "${srcdir}/${pkgname}-${pkgver}"
+  install -Dm755 target/release/breadbox      "${pkgdir}/usr/bin/breadbox"
+  install -Dm755 target/release/breadbox-sync "${pkgdir}/usr/bin/breadbox-sync"
+  install -Dm644 packaging/breadbox-sync.service \
+    "${pkgdir}/usr/lib/systemd/user/breadbox-sync.service"
+  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+}

From 43df888aa1ddbae60b1dce20f2a81069370ed395 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 16:02:16 +0800
Subject: [PATCH 07/18] Fix Forgejo workflows for the actual server
 capabilities

- package.yml: correct Arch registry upload (octet-stream + binary body),
  drop --privileged, manual shell clone (archlinux image has no Node),
  built-in Actions token, --nocheck
- mirror.yml: clone --mirror + explicit refs push with --prune
---
 .forgejo/workflows/mirror.yml  | 17 ++++++------
 .forgejo/workflows/package.yml | 48 +++++++++++++++-------------------
 2 files changed, 30 insertions(+), 35 deletions(-)

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
index ab5700f..807e3ab 100644
--- a/.forgejo/workflows/mirror.yml
+++ b/.forgejo/workflows/mirror.yml
@@ -9,12 +9,13 @@ jobs:
   mirror:
     runs-on: [self-hosted, hestia]
     steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Push to GitHub
+      - name: Mirror to GitHub
         run: |
-          git remote add github \
-            "https://x-access-token:${{ secrets.GITHUB_MIRROR_TOKEN }}@github.com/Breadway/breadbox.git"
-          git push github --mirror
+          set -euo pipefail
+          git clone --mirror "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" repo.git
+          cd repo.git
+          # Mirror only branches and tags (not refs/pull/*, which GitHub rejects);
+          # --prune deletes GitHub refs that no longer exist on Forgejo.
+          git push --prune \
+            "https://x-access-token:${{ secrets.GITHUB_MIRROR_TOKEN }}@github.com/Breadway/breadbox.git" \
+            '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
index 246126b..f88284d 100644
--- a/.forgejo/workflows/package.yml
+++ b/.forgejo/workflows/package.yml
@@ -9,38 +9,32 @@ jobs:
     runs-on: [self-hosted, hestia]
     container:
       image: archlinux:latest
-      options: --privileged
-
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Set version
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_ENV
-
-      - name: Install build dependencies
-        run: pacman -Syu --noconfirm base-devel git rust cargo gtk4 gtk4-layer-shell librsvg
-
-      - name: Create builder user
-        run: useradd -m builder
-
-      - name: Prepare source
+      # Note: no actions/checkout — the archlinux image has no Node, which JS
+      # actions require. Everything runs as shell steps and clones manually.
+      - name: Build and publish
+        env:
+          PUBLISH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git archive --format=tar.gz \
-            --prefix=breadbox-${VERSION}/ \
-            HEAD > packaging/arch/breadbox-${VERSION}.tar.gz
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          pacman -Syu --noconfirm base-devel git rust cargo gtk4 gtk4-layer-shell librsvg
+          useradd -m builder
+          git config --global --add safe.directory '*'
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" /home/builder/src
+          cd /home/builder/src
+          git archive --format=tar.gz --prefix="breadbox-${VERSION}/" HEAD \
+            > packaging/arch/breadbox-${VERSION}.tar.gz
           SHA=$(sha256sum packaging/arch/breadbox-${VERSION}.tar.gz | awk '{print $1}')
           sed -i "s/^pkgver=.*/pkgver=${VERSION}/" packaging/arch/PKGBUILD
           sed -i "s/^sha256sums=.*/sha256sums=('${SHA}')/" packaging/arch/PKGBUILD
-          cp -r . /home/builder/src
           chown -R builder:builder /home/builder/src
-
-      - name: Build package
-        run: su builder -c "cd /home/builder/src/packaging/arch && makepkg -sf --noconfirm"
-
-      - name: Publish to Forgejo registry
-        run: |
+          # --nocheck: packaging builds the artifact; tests belong in a CI job.
+          su builder -c "cd /home/builder/src/packaging/arch && makepkg -f --noconfirm --nocheck"
           PKG=$(find /home/builder/src/packaging/arch -name '*.pkg.tar.zst' | head -1)
           curl -fsS -X PUT \
-            -H "Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
-            --upload-file "${PKG}" \
-            "https://git.breadway.dev/api/packages/breadway/arch/push?distrib=breadway"
+            -H "Authorization: token ${PUBLISH_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@${PKG}" \
+            "https://git.breadway.dev/api/packages/Breadway/arch/os"

From cbb1cf03d65d2824a6425102289442842661618c Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 16:10:50 +0800
Subject: [PATCH 08/18] Rename mirror secret to MIRROR_TOKEN (GITHUB_ prefix is
 reserved)

Forgejo/gitea rejects user secret names starting with GITHUB_.
---
 .forgejo/workflows/mirror.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
index 807e3ab..640d656 100644
--- a/.forgejo/workflows/mirror.yml
+++ b/.forgejo/workflows/mirror.yml
@@ -17,5 +17,5 @@ jobs:
           # Mirror only branches and tags (not refs/pull/*, which GitHub rejects);
           # --prune deletes GitHub refs that no longer exist on Forgejo.
           git push --prune \
-            "https://x-access-token:${{ secrets.GITHUB_MIRROR_TOKEN }}@github.com/Breadway/breadbox.git" \
+            "https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/breadbox.git" \
             '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

From 8bc185f40c1018c285aae241c0cb267081787e24 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 16:14:14 +0800
Subject: [PATCH 09/18] Clone from public URL, not GITHUB_SERVER_URL (resolves
 to localhost in runner)

The Forgejo runner injects GITHUB_SERVER_URL as http://localhost:3002, which
is unreachable from inside the job container. Use the public URL instead.
---
 .forgejo/workflows/mirror.yml  | 2 +-
 .forgejo/workflows/package.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
index 640d656..6f40c04 100644
--- a/.forgejo/workflows/mirror.yml
+++ b/.forgejo/workflows/mirror.yml
@@ -12,7 +12,7 @@ jobs:
       - name: Mirror to GitHub
         run: |
           set -euo pipefail
-          git clone --mirror "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" repo.git
+          git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
           cd repo.git
           # Mirror only branches and tags (not refs/pull/*, which GitHub rejects);
           # --prune deletes GitHub refs that no longer exist on Forgejo.
diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
index f88284d..7502e73 100644
--- a/.forgejo/workflows/package.yml
+++ b/.forgejo/workflows/package.yml
@@ -22,7 +22,7 @@ jobs:
           useradd -m builder
           git config --global --add safe.directory '*'
           git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
-            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" /home/builder/src
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
           cd /home/builder/src
           git archive --format=tar.gz --prefix="breadbox-${VERSION}/" HEAD \
             > packaging/arch/breadbox-${VERSION}.tar.gz

From b80e06b253b9937f7755b0ba2d252d2281a21adf Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 17:06:55 +0800
Subject: [PATCH 10/18] Disable LTO in PKGBUILD (vendored ring/mlua static libs
 vs makepkg -flto)

---
 packaging/arch/PKGBUILD | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
index b0f0b1d..bca6391 100644
--- a/packaging/arch/PKGBUILD
+++ b/packaging/arch/PKGBUILD
@@ -7,6 +7,10 @@ pkgdesc="App launcher for Hyprland / Wayland"
 arch=('x86_64')
 url="https://github.com/Breadway/breadbox"
 license=('MIT')
+# Some Rust deps (ring/mlua) build vendored C/asm into static archives; makepkg's
+# default -flto=auto emits GCC LTO bitcode the Rust (lld) link cannot read,
+# causing undefined-symbol errors. Disable LTO.
+options=(!lto)
 depends=('gtk4' 'gtk4-layer-shell' 'librsvg')
 optdepends=(
   'hyprland: window and workspace integration'

From 21392645cd2eda30a5b0a5d07150abcf48b5c71c Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 22:55:41 +0800
Subject: [PATCH 11/18] Use REGISTRY_TOKEN (scoped write:package) for registry
 publish

---
 .forgejo/workflows/package.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.forgejo/workflows/package.yml b/.forgejo/workflows/package.yml
index 7502e73..fecfe9d 100644
--- a/.forgejo/workflows/package.yml
+++ b/.forgejo/workflows/package.yml
@@ -14,7 +14,7 @@ jobs:
       # actions require. Everything runs as shell steps and clones manually.
       - name: Build and publish
         env:
-          PUBLISH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"

From a6007e9a6a7cc5b7521efe611059f330990acfa9 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Sat, 13 Jun 2026 23:00:50 +0800
Subject: [PATCH 12/18] Disable debug package so the main package publishes
 correctly

makepkg's debug split produced a -debug pkg; the upload's head -1 could
grab it instead of the main package. !debug yields a single package.
---
 packaging/arch/PKGBUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
index bca6391..1df5ba5 100644
--- a/packaging/arch/PKGBUILD
+++ b/packaging/arch/PKGBUILD
@@ -10,7 +10,7 @@ license=('MIT')
 # Some Rust deps (ring/mlua) build vendored C/asm into static archives; makepkg's
 # default -flto=auto emits GCC LTO bitcode the Rust (lld) link cannot read,
 # causing undefined-symbol errors. Disable LTO.
-options=(!lto)
+options=(!lto !debug)
 depends=('gtk4' 'gtk4-layer-shell' 'librsvg')
 optdepends=(
   'hyprland: window and workspace integration'

From d464689a184a9fb846aa77b27ab727a742113bf0 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Tue, 16 Jun 2026 16:57:12 +0800
Subject: [PATCH 13/18] theme: load the shared bread-theme stylesheet

Apply bread_theme::gtk::apply_shared() before breadbox's own CSS so fonts,
palette, and generic widgets come from the shared ecosystem stylesheet. Keep
only launcher-specific rules (launcher-bg, searchentry, rows). Bump bread-theme
dep to v0.2.6.
---
 breadbox/Cargo.toml  |  2 +-
 breadbox/src/main.rs | 10 +++++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index 1de3b4e..f3965f5 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -9,7 +9,7 @@ name = "breadbox"
 path = "src/main.rs"
 
 [dependencies]
-bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.1.0", features = ["gtk"] }
+bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.6", features = ["gtk"] }
 breadbox-shared = { path = "../breadbox-shared" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
diff --git a/breadbox/src/main.rs b/breadbox/src/main.rs
index 0fbab50..68627d7 100644
--- a/breadbox/src/main.rs
+++ b/breadbox/src/main.rs
@@ -133,9 +133,10 @@ fn matches_term(field: &str, term: &str) -> bool {
 
 fn build_css(p: &Palette) -> String {
     let bg_panel = hex_to_rgba(&p.background, 0.60);
+    // breadbox-specific rules only — fonts, palette, and generic widgets come
+    // from the shared ecosystem stylesheet (applied first in connect_activate).
     format!(
-        "* {{ font-family: 'Varela Round', sans-serif; font-size: 14px; }}\
-         window {{ background-color: transparent; }}\
+        "window {{ background-color: transparent; }}\
          .launcher-bg {{ background-color: {bg_panel}; border-radius: 8px;\
              box-shadow: 0 8px 32px rgba(0,0,0,0.6); }}\
          searchentry {{ background-color: {surface}; color: {fg}; caret-color: {accent};\
@@ -299,7 +300,10 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String, history: LaunchHistory) {
     let query_rc: Rc<RefCell<String>> = Rc::new(RefCell::new(String::new()));
 
     app.connect_activate(move |app| {
-        // Base CSS
+        // Shared ecosystem base (fonts, palette, generic widgets) first, then
+        // breadbox-specific CSS layered on top at APPLICATION priority.
+        bread_theme::gtk::apply_shared();
+
         let provider = CssProvider::new();
         provider.load_from_string(&css);
         gtk4::style_context_add_provider_for_display(

From 732c3126ae50941d7b4ccc1442a8d8d4fe0930cb Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Tue, 16 Jun 2026 18:32:12 +0800
Subject: [PATCH 14/18] Release 0.2.2: shared bread-theme stylesheet

Pin bread-theme v0.2.6 and load the shared ecosystem stylesheet.
---
 Cargo.lock                 | 10 +++++-----
 breadbox-shared/Cargo.toml |  2 +-
 breadbox-sync/Cargo.toml   |  2 +-
 breadbox/Cargo.toml        |  2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 77c0113..88fcfd0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -28,8 +28,8 @@ checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "bread-theme"
-version = "0.1.0"
-source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.1.0#6b5f4f475f66a645b08cb865e6dda8228d23679b"
+version = "0.2.3"
+source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.6#0c8c5c00e435fedff4f81e36d603424c153519a9"
 dependencies = [
  "dirs",
  "gtk4",
@@ -39,7 +39,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "bread-theme",
  "breadbox-shared",
@@ -50,7 +50,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-shared"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "serde",
  "serde_json",
@@ -59,7 +59,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-sync"
-version = "0.2.1"
+version = "0.2.2"
 dependencies = [
  "breadbox-shared",
  "serde_json",
diff --git a/breadbox-shared/Cargo.toml b/breadbox-shared/Cargo.toml
index a47dc19..9a3de5c 100644
--- a/breadbox-shared/Cargo.toml
+++ b/breadbox-shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-shared"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox-sync/Cargo.toml b/breadbox-sync/Cargo.toml
index 93b7392..d60c2fa 100644
--- a/breadbox-sync/Cargo.toml
+++ b/breadbox-sync/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-sync"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index f3965f5..f5784c8 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2021"
 license = "MIT"
 

From 8c64ec1bf2b6b60fc953fb4169e7a5de9afa0a33 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Tue, 16 Jun 2026 18:32:48 +0800
Subject: [PATCH 15/18] Release 0.2.4: shared bread-theme stylesheet

---
 Cargo.lock                 | 6 +++---
 breadbox-shared/Cargo.toml | 2 +-
 breadbox-sync/Cargo.toml   | 2 +-
 breadbox/Cargo.toml        | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 88fcfd0..18d6e7c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -39,7 +39,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox"
-version = "0.2.2"
+version = "0.2.4"
 dependencies = [
  "bread-theme",
  "breadbox-shared",
@@ -50,7 +50,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-shared"
-version = "0.2.2"
+version = "0.2.4"
 dependencies = [
  "serde",
  "serde_json",
@@ -59,7 +59,7 @@ dependencies = [
 
 [[package]]
 name = "breadbox-sync"
-version = "0.2.2"
+version = "0.2.4"
 dependencies = [
  "breadbox-shared",
  "serde_json",
diff --git a/breadbox-shared/Cargo.toml b/breadbox-shared/Cargo.toml
index 9a3de5c..ec62ed1 100644
--- a/breadbox-shared/Cargo.toml
+++ b/breadbox-shared/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-shared"
-version = "0.2.2"
+version = "0.2.4"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox-sync/Cargo.toml b/breadbox-sync/Cargo.toml
index d60c2fa..bdcab16 100644
--- a/breadbox-sync/Cargo.toml
+++ b/breadbox-sync/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox-sync"
-version = "0.2.2"
+version = "0.2.4"
 edition = "2021"
 license = "MIT"
 
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index f5784c8..6f23930 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "breadbox"
-version = "0.2.2"
+version = "0.2.4"
 edition = "2021"
 license = "MIT"
 

From 83b9fd908ea6bab8d089b2fee24b8bd149e8e48b Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 17 Jun 2026 12:41:30 +0800
Subject: [PATCH 16/18] Fix illegible text on light pywal palettes + hot-reload

Use bread-theme 0.2.7's luminance-picked ink (@on-*): a selected/hovered row set
its background to `surface` but kept the pywal foreground, so the highlighted
item went unreadable when `surface` came out light. Colour is now set per surface
(panel, search box, row states) and labels inherit it.

Switch to bread_theme::gtk::apply_app_css so breadbox picks up `bread-theme
reload` (and rebuilds from the fresh palette on each launch).
---
 Cargo.lock           |  2 +-
 breadbox/Cargo.toml  |  2 +-
 breadbox/src/main.rs | 47 ++++++++++++++++++++------------------------
 3 files changed, 23 insertions(+), 28 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 18d6e7c..ca7661c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -29,7 +29,7 @@ checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 [[package]]
 name = "bread-theme"
 version = "0.2.3"
-source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.6#0c8c5c00e435fedff4f81e36d603424c153519a9"
+source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.7#ea87083c0615fc9141b0ae4c99f833748a0189d1"
 dependencies = [
  "dirs",
  "gtk4",
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index 6f23930..6b71c50 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -9,7 +9,7 @@ name = "breadbox"
 path = "src/main.rs"
 
 [dependencies]
-bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.6", features = ["gtk"] }
+bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.7", features = ["gtk"] }
 breadbox-shared = { path = "../breadbox-shared" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"
diff --git a/breadbox/src/main.rs b/breadbox/src/main.rs
index 68627d7..17f72ac 100644
--- a/breadbox/src/main.rs
+++ b/breadbox/src/main.rs
@@ -1,4 +1,4 @@
-use bread_theme::{hex_to_rgba, load_palette, Palette};
+use bread_theme::{hex_to_rgba, ink_on, load_palette, Palette};
 use std::{
     cell::RefCell,
     collections::HashMap,
@@ -15,7 +15,6 @@ use breadbox_shared::{
     config_dir, load_all_desktop_entries, Config, DesktopEntry, IconCache, LaunchHistory,
 };
 use gtk4::{
-    gdk::Display,
     glib,
     pango::EllipsizeMode,
     prelude::*,
@@ -135,25 +134,30 @@ fn build_css(p: &Palette) -> String {
     let bg_panel = hex_to_rgba(&p.background, 0.60);
     // breadbox-specific rules only — fonts, palette, and generic widgets come
     // from the shared ecosystem stylesheet (applied first in connect_activate).
+    // Colour is set on each surface (panel, search box, hovered/selected row) so
+    // child labels inherit the legible ink for that background. `on_*` are
+    // luminance-picked black/white — the pywal hues are untouched. Without this a
+    // light `surface` slot makes the selected row's text vanish.
     format!(
         "window {{ background-color: transparent; }}\
-         .launcher-bg {{ background-color: {bg_panel}; border-radius: 8px;\
+         .launcher-bg {{ background-color: {bg_panel}; color: {on_bg}; border-radius: 8px;\
              box-shadow: 0 8px 32px rgba(0,0,0,0.6); }}\
-         searchentry {{ background-color: {surface}; color: {fg}; caret-color: {accent};\
+         searchentry {{ background-color: {surface}; color: {on_surface}; caret-color: {accent};\
              border: none; outline: none; box-shadow: none;\
              padding: 12px 16px; border-radius: 6px 6px 0 0; }}\
          listbox {{ background-color: transparent; padding: 4px; }}\
-         row {{ padding: 8px 12px; color: {fg}; background-color: transparent;\
+         row {{ padding: 8px 12px; color: {on_bg}; background-color: transparent;\
              border-radius: 6px; }}\
-         row:hover {{ background-color: {surface}; }}\
-         row:selected {{ background-color: {surface}; }}\
+         row:hover {{ background-color: {surface}; color: {on_surface}; }}\
+         row:selected {{ background-color: {surface}; color: {on_surface}; }}\
          .app-name {{ font-size: 14px; }}\
-         .app-muted {{ color: {fg}; opacity: 0.6; font-size: 12px; }}\
+         .app-muted {{ opacity: 0.6; font-size: 12px; }}\
          image {{ margin-right: 8px; }}",
-        bg_panel = bg_panel,
-        surface  = p.color0,
-        fg       = p.foreground,
-        accent   = p.color4,
+        bg_panel   = bg_panel,
+        surface    = p.color0,
+        accent     = p.color4,
+        on_bg      = ink_on(&p.background),
+        on_surface = ink_on(&p.color0),
     )
 }
 
@@ -291,7 +295,7 @@ fn get_row_entry(row: &gtk4::ListBoxRow) -> Option<DesktopEntry> {
     }
 }
 
-fn run_ui(entries: Vec<DesktopEntry>, css: String, history: LaunchHistory) {
+fn run_ui(entries: Vec<DesktopEntry>, history: LaunchHistory) {
     let app = Application::builder()
         .application_id("com.breadway.breadbox")
         .build();
@@ -301,16 +305,10 @@ fn run_ui(entries: Vec<DesktopEntry>, css: String, history: LaunchHistory) {
 
     app.connect_activate(move |app| {
         // Shared ecosystem base (fonts, palette, generic widgets) first, then
-        // breadbox-specific CSS layered on top at APPLICATION priority.
+        // breadbox-specific CSS layered on top — both hot-reload on
+        // `bread-theme reload` (the closure re-reads the pywal palette).
         bread_theme::gtk::apply_shared();
-
-        let provider = CssProvider::new();
-        provider.load_from_string(&css);
-        gtk4::style_context_add_provider_for_display(
-            &Display::default().expect("no display"),
-            &provider,
-            gtk4::STYLE_PROVIDER_PRIORITY_APPLICATION,
-        );
+        bread_theme::gtk::apply_app_css(|| build_css(&load_palette()));
 
         // User CSS override
         {
@@ -566,8 +564,5 @@ fn main() {
     let manifest = load_manifest();
     let entries = load_sorted_entries(&manifest, &priority, &history);
 
-    let palette = load_palette();
-    let css = build_css(&palette);
-
-    run_ui(entries, css, history);
+    run_ui(entries, history);
 }

From a33e979e5ee53cb051b80f7e03e95a19400be750 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Wed, 17 Jun 2026 12:55:52 +0800
Subject: [PATCH 17/18] Bump bread-theme to v0.2.8 (live-reload fix)

---
 Cargo.lock          | 2 +-
 breadbox/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ca7661c..4f3f9c2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -29,7 +29,7 @@ checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 [[package]]
 name = "bread-theme"
 version = "0.2.3"
-source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.7#ea87083c0615fc9141b0ae4c99f833748a0189d1"
+source = "git+https://github.com/Breadway/bread-ecosystem?tag=v0.2.8#77417d552130281ff787e07d52541eb25e9d533b"
 dependencies = [
  "dirs",
  "gtk4",
diff --git a/breadbox/Cargo.toml b/breadbox/Cargo.toml
index 6b71c50..9189abf 100644
--- a/breadbox/Cargo.toml
+++ b/breadbox/Cargo.toml
@@ -9,7 +9,7 @@ name = "breadbox"
 path = "src/main.rs"
 
 [dependencies]
-bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.7", features = ["gtk"] }
+bread-theme = { git = "https://github.com/Breadway/bread-ecosystem", tag = "v0.2.8", features = ["gtk"] }
 breadbox-shared = { path = "../breadbox-shared" }
 gtk4 = { version = "0.11", features = ["v4_12"] }
 gtk4-layer-shell = "0.8"

From 7ece4fd7626d7c7b880ea2172dd7a3bea27a6c73 Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Fri, 19 Jun 2026 08:38:38 +0800
Subject: [PATCH 18/18] CI: use /tmp for ecosystem clone, avoid permissions
 conflict

---
 .github/workflows/release.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 71c0ca3..12f8fac 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ permissions:
 
 env:
   DL_DIR: /srv/breadway-dl
-  ECOSYSTEM_DIR: /home/breadway/Projects/bread-ecosystem
+  ECOSYSTEM_DIR: /tmp/bread-ecosystem-ci
 
 jobs:
   build:
@@ -41,12 +41,8 @@ jobs:
 
       - name: ensure bread-ecosystem
         run: |
-          if [[ -d "${ECOSYSTEM_DIR}/.git" ]]; then
-            git -C "${ECOSYSTEM_DIR}" pull --ff-only
-          else
-            mkdir -p "$(dirname "${ECOSYSTEM_DIR}")"
-            git clone https://github.com/Breadway/bread-ecosystem.git "${ECOSYSTEM_DIR}"
-          fi
+          rm -rf "${ECOSYSTEM_DIR}"
+          git clone https://github.com/Breadway/bread-ecosystem.git "${ECOSYSTEM_DIR}"
 
       - name: regenerate index.json
         run: bash "${ECOSYSTEM_DIR}/scripts/gen-index.sh"