feat(webui): adopt the ui-common theme system and add a glass theme

.github/workflows/ci.yml

@@ -432,6 +432,11 @@ jobs:
         run: pnpm --dir webui run typecheck
       - name: Lint WebUI
         run: pnpm --dir webui run lint
+      # Issue #1903: data-theme is always <family>-<scheme>, so a selector keyed
+      # on a bare mode (or on the host OS scheme) silently stops applying. The
+      # gate evaluates every theme selector against the ids theme.ts ships.
+      - name: Check WebUI theme selectors
+        run: pnpm --dir webui run check:theme-selectors
       - name: Test WebUI scaffold
         run: pnpm --dir webui run unit
       - name: Install browser runtime

Makefile

@@ -806,10 +806,11 @@ verify-webui-bundle: ## Rebuild the bundled WebUI twice and compare it with chec
 	@$(WEBUI_BUNDLE_PY) scripts/webui/build_bundle.py --verify
 
 .PHONY: verify-webui-frontend
-verify-webui-frontend: ## Run WebUI lint, typecheck, unit tests, Chromium layout/accessibility gate, and multi-engine browser smoke (issue #1848)
+verify-webui-frontend: ## Run WebUI lint, typecheck, theme-selector gate, unit tests, Chromium layout/accessibility gate, and multi-engine browser smoke (issue #1848)
 	@echo "$(CYAN)[verify] WebUI frontend lint/type/unit/browser matrix...$(RESET)"
 	@pnpm --dir webui run typecheck
 	@pnpm --dir webui run lint
+	@pnpm --dir webui run check:theme-selectors
 	@pnpm --dir webui run unit
 	@pnpm --dir webui run browser
 	@pnpm --dir webui run browser:all

NOTICE

@@ -136,6 +136,22 @@ The bundled WebUI assets under src/webui/assets/ include production runtime code
     SOFTWARE.
 
 
+backend.ai-go (WebUI glass theme)
+---------------------------------
+
+Portions of the WebUI glass theme in
+webui/src/design-system/themes/glass.css (its system-color palette, the
+filled-button highlight gradients, and the translucent surface, fill and
+chrome-highlight values) are derived from the glass theme tokens of
+backend.ai-go (https://github.com/lablup/backend.ai-go), Copyright 2025-2026
+Lablup Inc., licensed under the Apache License, Version 2.0. Colors were
+adjusted where needed to meet WCAG 2.2 AA against mlxcel's own surfaces. The
+theme is compiled into the bundled WebUI assets under src/webui/assets/.
+backend.ai-go ships no NOTICE file, so there is no upstream notice text to
+carry forward under Section 4(d); the Apache License, Version 2.0 text is in
+this repository's LICENSE.
+
+
 mlx ROCm backend (NripeshN/mlx, rocm-support branch)
 ----------------------------------------------------
 

README.md

@@ -332,6 +332,7 @@ Apache License 2.0 unless otherwise noted. See [LICENSE](LICENSE). Third-party a
 - [mlx-lm](https://github.com/ml-explore/mlx-lm), [mlx-vlm](https://github.com/Blaizzy/mlx-vlm), and [mlx-audio](https://github.com/Blaizzy/mlx-audio), whose model coverage and behavior mlxcel ports and mirrors. See [NOTICE](NOTICE).
 - [MLX Community](https://huggingface.co/mlx-community), pre-converted MLX checkpoints.
 - [turboquant_plus](https://github.com/TheTom/turboquant_plus), whose TurboQuant KV-cache algorithms are ported under Apache-2.0. See [NOTICE](NOTICE).
+- [backend.ai-go](https://github.com/lablup/backend.ai-go), whose glass theme tokens the bundled WebUI's glass theme is derived from under Apache-2.0. See [NOTICE](NOTICE).
 - [moonshotai/Kimi-K3](https://huggingface.co/moonshotai/Kimi-K3), whose tiktoken pre-tokenization pattern and XTML chat grammar are reimplemented in Rust under the Kimi K3 License. See [NOTICE](NOTICE).
 - [FlashInfer](https://github.com/flashinfer-ai/flashinfer), whose paged-attention, split-KV, cascade state-merge, and sampling designs inform mlxcel's serving kernels.
 - [IREE](https://github.com/iree-org/iree) and [StableHLO](https://github.com/openxla/stablehlo), the runtime and graph format behind the alpha OpenXLA backend: mlxcel emits StableHLO, `iree-compile` lowers it, and the IREE runtime executes it under the opt-in `xla-iree` build. See [NOTICE](NOTICE).

docs/webui/bundling.ko.md

@@ -50,7 +50,7 @@ cargo build --release --features cuda
 
 `mlxcel::server::webui::router::<S>()`의 라우트에는 이미 `/webui`가 포함됩니다. 루트에 병합하거나 **검증된 서버 API 접두사** 아래 한 번 중첩하세요. `/webui` 아래 다시 중첩하지 마세요. 부모 라우터의 루트 상태 확인·추론 경로는 유지됩니다. `/webui`는 `/webui/`로 리디렉션되고, `#models` 형태의 탐색은 클라이언트 안에서 처리됩니다. 없는 정적 경로는 API 라우팅 오류를 감출 수 있는 HTML 대체 응답 대신 404를 반환합니다.
 
-정적 응답은 GET/HEAD와 조건부 ETag를 지원하고, 다른 메서드는 `Allow: GET, HEAD`와 함께 405를 반환합니다. HTML·매니페스트는 재검증하며 콘텐츠 해시 자산에는 immutable 캐시를 허용합니다. 라우터는 인코딩·경로 탐색 표현을 거부하며 일반·오류·리디렉션·304 응답에 동일 출처 CSP, `nosniff`, no-referrer 헤더를 설정합니다. 이 정적 정책이 후속 관리 API의 Host/Origin/인증 검사를 대신하지는 않습니다.
+정적 응답은 GET/HEAD와 조건부 ETag를 지원하고, 다른 메서드는 `Allow: GET, HEAD`와 함께 405를 반환합니다. HTML·매니페스트·`theme-bootstrap.js`(`webui/public/`에서 복사되는 마운트 전 테마 스크립트로, 콘텐츠 해시가 없는 유일한 스크립트)는 재검증하며 콘텐츠 해시 자산에는 immutable 캐시를 허용합니다. 라우터는 인코딩·경로 탐색 표현을 거부하며 일반·오류·리디렉션·304 응답에 동일 출처 CSP, `nosniff`, no-referrer 헤더를 설정합니다. 이 정적 정책이 후속 관리 API의 Host/Origin/인증 검사를 대신하지는 않습니다.
 
 ## 정적 자산과 운영 시작 경로의 분리 검증
 

docs/webui/bundling.md

@@ -50,7 +50,7 @@ cargo build --release --features cuda
 
 `mlxcel::server::webui::router::<S>()` returns a router whose routes already include `/webui`. Merge it at the root, or nest it once under the **validated server API prefix**, not under a second `/webui`. The parent router retains its root health and inference routes. `/webui` redirects to `/webui/`; the shell's `#models`-style navigation stays client-side. A missing static path returns 404 rather than an HTML fallback that could hide an API-routing error.
 
-Static responses support GET/HEAD and conditional ETags; other methods return 405 with `Allow: GET, HEAD`. HTML and the manifest revalidate; content-hashed assets may be cached immutably. The router rejects encoded/traversal path spellings and sets same-origin CSP, `nosniff`, and no-referrer headers on ordinary, error, redirect, and 304 responses. This static policy does not replace the later Host/Origin/authentication checks on administrative APIs.
+Static responses support GET/HEAD and conditional ETags; other methods return 405 with `Allow: GET, HEAD`. HTML, the manifest and `theme-bootstrap.js` (the pre-mount theme script copied from `webui/public/`, the one script without a content hash) revalidate; content-hashed assets may be cached immutably. The router rejects encoded/traversal path spellings and sets same-origin CSP, `nosniff`, and no-referrer headers on ordinary, error, redirect, and 304 responses. This static policy does not replace the later Host/Origin/authentication checks on administrative APIs.
 
 ## Testing static assets and production startup separately