codeforge-dev 1.7.0 → 1.9.0

package/.devcontainer/plugins/devs-marketplace/plugins/code-directive/skills/spec-new/references/template.md

@@ -0,0 +1,110 @@
+# Specification Template
+
+Standard template for all feature specifications. Copy this structure when creating a new spec.
+
+---
+
+## Template
+
+```markdown
+# Feature: [Name]
+
+**Version:** v0.X.0
+**Status:** planned
+**Last Updated:** YYYY-MM-DD
+
+## Intent
+
+[What problem does this solve? Who has this problem? What's the cost of not solving it? 2-3 sentences.]
+
+## Acceptance Criteria
+
+[Testable criteria. Use Given/When/Then for complex flows, checklists for simple features, or tables for business rules. Every criterion must be verifiable.]
+
+- [ ] [Criterion 1]
+- [ ] [Criterion 2]
+- [ ] [Criterion 3]
+
+## Key Files
+
+[File paths most relevant to implementation — paths an implementer should read first.]
+
+**Backend:**
+- `src/path/to/file.py` — [brief description]
+
+**Frontend:**
+- `src/web/path/to/component.svelte` — [brief description]
+
+**Tests:**
+- `tests/path/to/test_file.py` — [brief description]
+
+## Schema / Data Model
+
+[Reference migration files and model files by path. Describe what changes — do NOT paste DDL, Pydantic models, or TypeScript interfaces.]
+
+- New table: `table_name` — see `src/db/migrations/NNN.sql`
+- Modified: `existing_table` — added `column_name` column
+
+## API Endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/resource` | List resources with pagination |
+| POST | `/api/resource` | Create a new resource |
+
+## Requirements
+
+### Functional Requirements
+
+- FR-1: [EARS format requirement — see specification-writing skill for templates]
+- FR-2: When [event], the system shall [action].
+- FR-3: If [unwanted condition], then the system shall [action].
+
+### Non-Functional Requirements
+
+- NFR-1: The system shall respond to [endpoint] within [N]ms at the [percentile] percentile.
+- NFR-2: [Security, accessibility, scalability requirement]
+
+## Dependencies
+
+- [External system, library, or feature this depends on]
+- [Blocked by: feature X must ship first]
+
+## Out of Scope
+
+- [Explicit non-goal 1 — prevents scope creep]
+- [Explicit non-goal 2]
+
+## Implementation Notes
+
+[Post-implementation only. Leave empty in planned specs. After building, document what actually shipped vs. what was planned.]
+
+## Discrepancies
+
+[Post-implementation only. Document gaps between spec intent and actual build. Prevents next session from re-planning decided work.]
+```
+
+---
+
+## Field Descriptions
+
+| Section | Required | When to Fill |
+|---------|----------|-------------|
+| Intent | Always | At creation |
+| Acceptance Criteria | Always | At creation |
+| Key Files | Always | At creation (update post-implementation) |
+| Schema / Data Model | If applicable | At creation |
+| API Endpoints | If applicable | At creation |
+| Requirements | Always | At creation |
+| Dependencies | If applicable | At creation |
+| Out of Scope | Always | At creation |
+| Implementation Notes | Post-implementation | After building |
+| Discrepancies | Post-implementation | After building |
+
+## Status Values
+
+| Status | Meaning |
+|--------|---------|
+| `planned` | Spec written, implementation not started |
+| `partial` | Some acceptance criteria implemented, work ongoing |
+| `implemented` | All acceptance criteria met, as-built notes complete |

package/.devcontainer/plugins/devs-marketplace/plugins/code-directive/skills/spec-update/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: spec-update
+description: >-
+  This skill should be used when the user asks to "update the spec",
+  "mark spec as implemented", "as-built update", "spec maintenance",
+  "update spec status", "finish the spec", or after implementing a
+  feature when the spec needs to reflect what was actually built.
+version: 0.1.0
+---
+
+# As-Built Spec Update
+
+## Mental Model
+
+Specs that say "planned" after code ships cause the next AI session to re-plan already-done work. The as-built update is the final step of every implementation — it closes the loop between what was planned and what was built.
+
+This is not optional. Every implementation ends with a spec update.
+
+---
+
+## The 6-Step Workflow
+
+### Step 1: Find the Spec
+
+```
+Glob: .specs/**/*.md
+```
+
+Search for the feature name in spec file names and content. If the user provides a spec path or feature name as `$ARGUMENTS`, use that directly.
+
+If no spec exists:
+- For substantial changes: create one using `/spec-new`
+- For trivial changes (bug fixes, config): note "spec not needed" and stop
+
+### Step 2: Set Status
+
+Update the `**Status:**` field:
+- `implemented` — all acceptance criteria are met
+- `partial` — some criteria met, work ongoing or deferred
+
+Never leave status as `planned` after implementation work has been done.
+
+### Step 3: Check Off Acceptance Criteria
+
+Review each acceptance criterion in the spec:
+- Mark as `[x]` if the criterion is met and verified (tests pass, behavior confirmed)
+- Leave as `[ ]` if not yet implemented
+- Add a note next to deferred criteria explaining why
+
+If criteria were met through different means than originally planned, note the deviation.
+
+### Step 4: Add Implementation Notes
+
+In the `## Implementation Notes` section, document:
+- **Deviations from the original spec** — what changed and why
+- **Key design decisions made during implementation** — choices that weren't in the spec
+- **Surprising findings** — edge cases discovered, performance characteristics, limitations
+- **Trade-offs accepted** — what was sacrificed and why
+
+Keep notes concise. Reference file paths, not code.
+
+### Step 5: Update File Paths
+
+In the `## Key Files` section:
+- Add files that were created during implementation
+- Remove files that no longer exist
+- Update paths that moved
+
+Verify paths exist before listing them. Use absolute project-relative paths.
+
+### Step 6: Update Metadata
+
+- Set `**Last Updated:**` to today's date (YYYY-MM-DD)
+- Verify `**Version:**` is correct
+
+---
+
+## Handling Edge Cases
+
+### Spec Already "Implemented"
+
+If the spec is already marked `implemented` and new changes affect the feature:
+1. Check if acceptance criteria still hold
+2. Update Implementation Notes with the new changes
+3. Add any new Discrepancies between spec and current code
+4. Update Last Updated date
+
+### No Spec Exists
+
+If there is no spec for the feature:
+1. Ask: is this a substantial feature or a minor fix?
+2. For substantial features: create one with `/spec-new`, then update it
+3. For minor fixes: no spec needed — report this and stop
+
+### Spec Has Unresolved Discrepancies
+
+If the `## Discrepancies` section has open items:
+1. Check if the current implementation resolves any of them
+2. Remove resolved discrepancies
+3. Add any new discrepancies discovered
+
+---
+
+## Validation Checklist
+
+Before finishing the update:
+- [ ] Status reflects the actual implementation state
+- [ ] All implemented acceptance criteria are checked off
+- [ ] Implementation Notes document deviations from original spec
+- [ ] File paths in Key Files are accurate and verified
+- [ ] Last Updated date is today
+- [ ] Spec is still ≤200 lines
+- [ ] No source code was pasted inline (references only)
+
+---
+
+## Ambiguity Policy
+
+- If unclear which spec to update, list all candidates and ask the user.
+- If the implementation deviated significantly from the spec, document it
+  honestly in Implementation Notes — do not retroactively change the original
+  requirements to match what was built.
+- If acceptance criteria are ambiguous about whether they're met, note the
+  ambiguity in Discrepancies rather than checking them off optimistically.

package/.devcontainer/plugins/devs-marketplace/plugins/code-directive/skills/specification-writing/SKILL.md

@@ -30,6 +30,18 @@ Write specifications with a hostile reader in mind -- someone who will interpret
 
 ---
 
+## Spec Sizing & AI Context Rules
+
+Specifications are loaded into AI context windows with limited capacity. Design for consumption.
+
+**Hard limit:** ≤200 lines per spec file. If a feature needs more, split into sub-specs (one per sub-feature) with a ≤50 line overview linking them.
+
+**Reference, don't reproduce:** Never inline source code, SQL DDL, Pydantic models, or TypeScript interfaces. Reference the file path and line range instead. The code is the source of truth — duplicated snippets go stale silently.
+
+**Structure for independent loading:** Each spec file must be useful on its own. Include: version, status, last-updated date, intent, key file paths, and acceptance criteria in every spec.
+
+---
+
 ## EARS Requirement Formats
 
 EARS (Easy Approach to Requirements Syntax) provides five templates that eliminate the most common ambiguities in natural-language requirements. Each template has a specific trigger pattern.
@@ -160,6 +172,17 @@ For requirements with multiple input/output combinations:
 
 A complete specification follows this structure. Not every section is needed for every feature -- scale the document to the complexity.
 
+Every spec file starts with metadata:
+
+```
+# Feature: [Name]
+**Version:** v0.X.0
+**Status:** implemented | partial | planned
+**Last Updated:** YYYY-MM-DD
+```
+
+Status tells you whether to trust it, version tells you where it belongs, last-updated tells you when it was last verified.
+
 ### 1. Problem Statement
 What problem does this feature solve? Who has this problem? What's the cost of not solving it? (2-3 sentences)
 
@@ -226,6 +249,15 @@ The cases nobody thinks about until they happen:
 ### 7. Out of Scope
 Explicit non-goals to prevent scope creep (can reference the Scope section or expand here).
 
+### 8. Key Files
+Source files most relevant to this feature — paths an implementer should read.
+
+### 9. Implementation Notes
+Post-implementation only. Capture deviations from the original spec — what changed and why.
+
+### 10. Discrepancies
+Gaps between spec intent and actual build. Prevents the next session from re-planning decided work.
+
 ---
 
 ## Completeness Checklist

package/.devcontainer/plugins/devs-marketplace/plugins/notify-hook/hooks/hooks.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "/usr/local/bin/claude-notify",
+            "command": "claude-notify",
             "timeout": 5
           }
         ]

package/.devcontainer/scripts/check-setup.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+# Verify CodeForge setup is working correctly
+# Run anytime with: check-setup
+
+echo "CodeForge Setup Check"
+echo "━━━━━━━━━━━━━━━━━━━━"
+
+PASS=0; FAIL=0; WARN=0
+
+check() {
+    local label="$1" cmd="$2"
+    if eval "$cmd" >/dev/null 2>&1; then
+        printf "  ✓ %s\n" "$label"
+        PASS=$((PASS + 1))
+    else
+        printf "  ✗ %s\n" "$label"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+warn_check() {
+    local label="$1" cmd="$2"
+    if eval "$cmd" >/dev/null 2>&1; then
+        printf "  ✓ %s\n" "$label"
+        PASS=$((PASS + 1))
+    else
+        printf "  ⚠ %s\n" "$label"
+        WARN=$((WARN + 1))
+    fi
+}
+
+echo ""
+echo "Core:"
+check "Claude Code installed" "command -v claude"
+check "cc alias available" "type cc"
+check "Config directory exists" "[ -d '${CLAUDE_CONFIG_DIR:-/workspaces/.claude}' ]"
+check "Settings file exists" "[ -f '${CLAUDE_CONFIG_DIR:-/workspaces/.claude}/settings.json' ]"
+
+echo ""
+echo "Authentication:"
+warn_check "GitHub CLI authenticated" "gh auth status"
+warn_check "Git user configured" "git config --global user.name"
+
+echo ""
+echo "Tools:"
+check "Node.js" "command -v node"
+check "Python" "command -v python3"
+check "uv" "command -v uv"
+warn_check "Go" "command -v go"
+warn_check "Bun" "command -v bun"
+warn_check "Docker" "command -v docker"
+
+echo ""
+echo "Development:"
+warn_check "biome" "command -v biome"
+warn_check "ruff" "command -v ruff"
+warn_check "dprint" "command -v dprint"
+warn_check "shfmt" "command -v shfmt"
+warn_check "shellcheck" "command -v shellcheck"
+warn_check "hadolint" "command -v hadolint"
+warn_check "ast-grep" "command -v ast-grep"
+warn_check "tmux" "command -v tmux"
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━"
+echo "  $PASS passed, $FAIL failed, $WARN warnings"
+
+if [ $FAIL -gt 0 ]; then
+    echo ""
+    echo "  Run 'cc-tools' for detailed version info."
+    exit 1
+fi

package/.devcontainer/scripts/setup-aliases.sh

@@ -12,6 +12,11 @@ ALIAS_CCRAW='alias ccraw="command claude"'
 
 for rc in ~/.bashrc ~/.zshrc; do
     if [ -f "$rc" ]; then
+        # --- Backup before modifying ---
+        cp "$rc" "${rc}.bak.$(date +%s)" 2>/dev/null || true
+        # Clean old backups (keep last 3)
+        ls -t "${rc}.bak."* 2>/dev/null | tail -n +4 | xargs rm -f 2>/dev/null || true
+
         # --- Cleanup old definitions ---
 
         # Remove old cc alias
@@ -46,6 +51,13 @@ for rc in ~/.bashrc ~/.zshrc; do
         if grep -q "alias specwright=" "$rc" 2>/dev/null; then
             sed -i '/alias specwright=/d' "$rc"
         fi
+        # Remove old cc-tools/check-setup functions
+        if grep -q "^cc-tools()" "$rc" 2>/dev/null; then
+            sed -i '/^cc-tools() {/,/^}/d' "$rc"
+        fi
+        if grep -q "alias check-setup=" "$rc" 2>/dev/null; then
+            sed -i '/alias check-setup=/d' "$rc"
+        fi
 
         # --- Add environment and aliases (idempotent) ---
         # Guard: skip if aliases already present from a previous run
@@ -67,11 +79,39 @@ for rc in ~/.bashrc ~/.zshrc; do
         echo "$ALIAS_CC" >> "$rc"
         echo "$ALIAS_CLAUDE" >> "$rc"
         echo "$ALIAS_CCRAW" >> "$rc"
+
+        # cc-tools: list all available CodeForge tools with version info
+        cat >> "$rc" << 'CCTOOLS_EOF'
+cc-tools() {
+  echo "CodeForge Available Tools"
+  echo "━━━━━━━━━━━━━━━━━━━━━━━━"
+  printf "  %-20s %s\n" "COMMAND" "STATUS"
+  echo "  ────────────────────────────────────"
+  for cmd in claude cc ccraw ccusage ccburn claude-monitor \
+             ruff biome dprint shfmt shellcheck hadolint \
+             ast-grep tree-sitter pyright typescript-language-server \
+             agent-browser gh docker git jq tmux bun go; do
+    if command -v "$cmd" >/dev/null 2>&1; then
+      ver=$("$cmd" --version 2>/dev/null | head -1 || echo "installed")
+      printf "  %-20s ✓ %s\n" "$cmd" "$ver"
+    else
+      printf "  %-20s ✗ not found\n" "$cmd"
+    fi
+  done
+}
+CCTOOLS_EOF
+
+        # check-setup: alias to the health check script
+        DEVCONTAINER_SCRIPTS="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+        echo "alias check-setup='bash ${DEVCONTAINER_SCRIPTS}/check-setup.sh'" >> "$rc"
+
         echo "[setup-aliases] Added aliases to $(basename $rc)"
     fi
 done
 
 echo "[setup-aliases] Aliases configured:"
-echo "  cc     -> claude with \$CLAUDE_CONFIG_DIR/system-prompt.md"
-echo "  claude -> claude with \$CLAUDE_CONFIG_DIR/system-prompt.md"
-echo "  ccraw  -> vanilla claude without any config"
+echo "  cc          -> claude with \$CLAUDE_CONFIG_DIR/system-prompt.md"
+echo "  claude      -> claude with \$CLAUDE_CONFIG_DIR/system-prompt.md"
+echo "  ccraw       -> vanilla claude without any config"
+echo "  cc-tools    -> list all available CodeForge tools"
+echo "  check-setup -> verify CodeForge setup health"

package/.devcontainer/scripts/setup-auth.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# Configure Git (GitHub CLI) and NPM authentication from .secrets file or environment variables.
+# Environment variables override .secrets values, supporting Codespaces secrets and localEnv.
+# Auth failure should not block other setup steps, so set -e is intentionally omitted.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DEVCONTAINER_DIR="$(dirname "$SCRIPT_DIR")"
+SECRETS_FILE="$DEVCONTAINER_DIR/.secrets"
+
+# Source .secrets file if it exists (env vars take precedence via :- defaults below)
+if [ -f "$SECRETS_FILE" ]; then
+    echo "[setup-auth] Loading tokens from .secrets file"
+    set -a
+    source "$SECRETS_FILE"
+    set +a
+else
+    echo "[setup-auth] No .secrets file found, using environment variables only"
+fi
+
+AUTH_CONFIGURED=false
+
+# --- GitHub CLI auth ---
+if [ -n "$GH_TOKEN" ]; then
+    echo "[setup-auth] Authenticating GitHub CLI..."
+    # Capture token value then unset env var — gh refuses --with-token when
+    # GH_TOKEN is already exported (it says "use the env var instead").
+    _gh_token="$GH_TOKEN"
+    unset GH_TOKEN
+    if gh auth login --with-token <<< "$_gh_token" 2>/dev/null; then
+        echo "[setup-auth] GitHub CLI authenticated"
+        gh auth setup-git 2>/dev/null && echo "[setup-auth] Git credential helper configured"
+        AUTH_CONFIGURED=true
+    else
+        echo "[setup-auth] WARNING: GitHub CLI authentication failed"
+    fi
+    unset _gh_token
+else
+    echo "[setup-auth] GH_TOKEN not set, skipping GitHub CLI auth"
+fi
+
+# --- Git user config ---
+if [ -n "$GH_USERNAME" ]; then
+    git config --global user.name "$GH_USERNAME"
+    echo "[setup-auth] Git user.name set to $GH_USERNAME"
+    unset GH_USERNAME
+fi
+
+if [ -n "$GH_EMAIL" ]; then
+    git config --global user.email "$GH_EMAIL"
+    echo "[setup-auth] Git user.email set to $GH_EMAIL"
+    unset GH_EMAIL
+fi
+
+# --- NPM auth ---
+if [ -n "$NPM_TOKEN" ]; then
+    echo "[setup-auth] Configuring NPM registry auth..."
+    if npm config set "//registry.npmjs.org/:_authToken=$NPM_TOKEN" 2>/dev/null; then
+        echo "[setup-auth] NPM auth token configured"
+        AUTH_CONFIGURED=true
+    else
+        echo "[setup-auth] WARNING: NPM auth configuration failed"
+    fi
+    unset NPM_TOKEN
+else
+    echo "[setup-auth] NPM_TOKEN not set, skipping NPM auth"
+fi
+
+# --- Summary ---
+if [ "$AUTH_CONFIGURED" = true ]; then
+    echo "[setup-auth] Auth configuration complete"
+else
+    echo "[setup-auth] No tokens provided — auth configuration skipped"
+    echo "[setup-auth] To configure, copy .secrets.example to .secrets and fill in your tokens"
+fi

package/.devcontainer/scripts/setup-config.sh

@@ -1,30 +1,123 @@
 #!/bin/bash
-# Copy Claude configuration files to workspace
+# Copy configuration files to workspace based on file-manifest.json
 
 CONFIG_DIR="${CONFIG_SOURCE_DIR:?CONFIG_SOURCE_DIR not set}"
-TARGET_DIR="${CLAUDE_CONFIG_DIR:?CLAUDE_CONFIG_DIR not set}"
-OVERWRITE="${OVERWRITE_CONFIG:-false}"
-
-echo "[setup-config] Copying configuration files..."
-[ "$OVERWRITE" = "true" ] && echo "[setup-config] Overwrite mode enabled"
-
-mkdir -p "$TARGET_DIR"
-
-copy_file() {
-    local file="$1"
-    if [ -f "$CONFIG_DIR/$file" ]; then
-        if [ "$OVERWRITE" = "true" ] || [ ! -f "$TARGET_DIR/$file" ]; then
-            cp "$CONFIG_DIR/$file" "$TARGET_DIR/$file"
-            chown "$(id -un):$(id -gn)" "$TARGET_DIR/$file" 2>/dev/null || true
-            echo "[setup-config] Copied $file"
-        else
-            echo "[setup-config] $file already exists, skipping"
-        fi
-    fi
+MANIFEST="$CONFIG_DIR/file-manifest.json"
+
+log() { echo "[setup-config] $*"; }
+warn() { echo "[setup-config] WARNING: $*"; }
+err() { echo "[setup-config] ERROR: $*" >&2; }
+
+# Deprecation notice if legacy OVERWRITE_CONFIG is still set
+if [ -n "${OVERWRITE_CONFIG+x}" ]; then
+	warn "OVERWRITE_CONFIG is deprecated. Use per-file 'overwrite' in config/file-manifest.json instead."
+fi
+
+# ── Legacy fallback ──────────────────────────────────────────────
+legacy_copy() {
+	local target_dir="${CLAUDE_CONFIG_DIR:?CLAUDE_CONFIG_DIR not set}"
+	warn "file-manifest.json not found, falling back to legacy copy"
+	mkdir -p "$target_dir"
+	for file in defaults/settings.json defaults/keybindings.json defaults/main-system-prompt.md; do
+		if [ -f "$CONFIG_DIR/$file" ]; then
+			local basename="${file##*/}"
+			cp "$CONFIG_DIR/$file" "$target_dir/$basename"
+			chown "$(id -un):$(id -gn)" "$target_dir/$basename" 2>/dev/null || true
+			log "Copied $basename (legacy)"
+		fi
+	done
+	log "Configuration complete (legacy)"
+}
+
+if [ ! -f "$MANIFEST" ]; then
+	legacy_copy
+	exit 0
+fi
+
+# ── Validate manifest JSON ──────────────────────────────────────
+if ! jq empty "$MANIFEST" 2>/dev/null; then
+	err "Invalid JSON in file-manifest.json"
+	exit 1
+fi
+
+# ── Variable expansion ───────────────────────────────────────────
+expand_vars() {
+	local val="$1"
+	val="${val//\$\{CLAUDE_CONFIG_DIR\}/$CLAUDE_CONFIG_DIR}"
+	val="${val//\$\{WORKSPACE_ROOT\}/$WORKSPACE_ROOT}"
+	# Warn on any remaining unresolved ${...} tokens
+	if [[ "$val" =~ \$\{[^}]+\} ]]; then
+		warn "Unresolved variable in: $val"
+	fi
+	echo "$val"
 }
 
-copy_file "settings.json"
-copy_file "keybindings.json"
-copy_file "main-system-prompt.md"
+# ── Change detection ─────────────────────────────────────────────
+should_copy() {
+	local src="$1" dest="$2"
+	[ ! -f "$dest" ] && return 0
+	local src_hash dest_hash
+	src_hash=$(sha256sum "$src" | cut -d' ' -f1)
+	dest_hash=$(sha256sum "$dest" | cut -d' ' -f1)
+	[ "$src_hash" != "$dest_hash" ]
+}
+
+# ── Process manifest ─────────────────────────────────────────────
+log "Copying configuration files..."
+
+# Single jq invocation to extract all fields (reduces N×5 subprocess calls to 1)
+# Note: empty destFilename uses "__NONE__" sentinel because bash read collapses
+# consecutive tab delimiters, which shifts fields when destFilename is empty.
+jq -r '.[] | [.src, .dest, (.destFilename // "__NONE__"), (.enabled // true | tostring), (.overwrite // "if-changed")] | @tsv' "$MANIFEST" |
+	while IFS=$'\t' read -r src dest dest_filename enabled overwrite; do
+		# Skip disabled entries
+		if [ "$enabled" = "false" ]; then
+			log "Skipping $src (disabled)"
+			continue
+		fi
+
+		# Resolve paths
+		src_path="$CONFIG_DIR/$src"
+		dest_dir=$(expand_vars "$dest")
+		[ "$dest_filename" = "__NONE__" ] && dest_filename=""
+		filename="${dest_filename:-${src##*/}}"
+		dest_path="$dest_dir/$filename"
+
+		# Validate source exists
+		if [ ! -f "$src_path" ]; then
+			warn "$src not found in config dir, skipping"
+			continue
+		fi
+
+		# Ensure destination directory exists
+		mkdir -p "$dest_dir"
+
+		# Apply overwrite strategy
+		case "$overwrite" in
+		always)
+			cp "$src_path" "$dest_path"
+			log "Copied $src → $dest_path (always)"
+			;;
+		never)
+			if [ ! -f "$dest_path" ]; then
+				cp "$src_path" "$dest_path"
+				log "Copied $src → $dest_path (new)"
+			else
+				log "Skipping $src (exists, overwrite=never)"
+			fi
+			;;
+		if-changed | *)
+			if should_copy "$src_path" "$dest_path"; then
+				cp "$src_path" "$dest_path"
+				log "Copied $src → $dest_path (changed)"
+			else
+				log "Skipping $src (unchanged)"
+			fi
+			;;
+		esac
+
+		# Fix ownership
+		chown "$(id -un):$(id -gn)" "$dest_path" 2>/dev/null || true
+	done
 
-echo "[setup-config] Configuration complete"
+log "Configuration complete"

package/.devcontainer/scripts/setup-update-claude.sh

@@ -8,10 +8,18 @@ echo "[update-claude] Checking for Claude Code updates..."
 # === TMPDIR ===
 _TMPDIR="${TMPDIR:-/tmp}"
 
+# === LOCK FILE (prevent concurrent updates) ===
+LOCK_FILE="${_TMPDIR}/claude-update.lock"
+if ! mkdir "$LOCK_FILE" 2>/dev/null; then
+    echo "[update-claude] Another update is already running, skipping"
+    exit 0
+fi
+
 # === CLEANUP TRAP ===
 cleanup() {
     rm -f "${_TMPDIR}/claude-update" 2>/dev/null || true
     rm -f "${_TMPDIR}/claude-update-manifest.json" 2>/dev/null || true
+    rm -rf "$LOCK_FILE" 2>/dev/null || true
 }
 trap cleanup EXIT