fix(native-installer): POSIX compat, bash installer, onboarding hook

- Replace &>/dev/null with >/dev/null 2>&1 (POSIX)
- Require curl only (not wget) — matches official installer dependency
- Use bash instead of sh for piping installer (it requires bash)
- Quote ${TARGET} in su -c to prevent word splitting
- Pre-create ~/.local/state and ~/.claude directories
- Add 99-claude-onboarding.sh post-start hook to ensure
  hasCompletedOnboarding is set when token auth is configured

Author: AnExiledDev

.devcontainer/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+### Added
+
+#### Claude Code Installation
+- **Post-start onboarding hook** (`99-claude-onboarding.sh`) — ensures `hasCompletedOnboarding: true` in `.claude.json` when token auth is configured; catches overwrites from Claude Code CLI/extension that race with `postStartCommand`
+
 ### Changed
 
 #### Claude Code Installation
@@ -14,6 +19,10 @@
 - **Update script no longer silently discards errors** — background update output now captured to log file instead of being discarded via `&>/dev/null`
 - **Update script simplified to native-binary-only** — removed npm fallback and `claude install` bootstrap code; added 60s timeout and transitional npm cleanup
 - **Alias resolution simplified** — `_CLAUDE_BIN` now resolves directly to native binary path (removed npm and `/usr/local/bin` fallbacks)
+- **POSIX redirect** — replaced `&>/dev/null` with `>/dev/null 2>&1` in dependency check for portability
+- **Installer shell** — changed `sh -s` to `bash -s` when piping the official installer (it requires bash)
+- **Unquoted `${TARGET}`** — quoted variable in `su -c` command to prevent word splitting
+- **Directory prep** — added `~/.local/state` and `~/.claude` pre-creation; consolidated `chown` to cover entire `~/.local` tree
 
 ## [v1.14.2] - 2026-02-24
 

.devcontainer/features/claude-code-native/install.sh

@@ -15,7 +15,7 @@ echo "[claude-code-native] Version: ${VERSION}"
 
 # === VALIDATE DEPENDENCIES ===
 # The official installer (claude.ai/install.sh) requires curl internally
-if ! command -v curl &>/dev/null; then
+if ! command -v curl >/dev/null 2>&1; then
 	echo "[claude-code-native] ERROR: curl is required"
 	echo "  Ensure common-utils feature is installed first"
 	exit 1
@@ -47,7 +47,9 @@ echo "[claude-code-native] Installing for user: ${USERNAME} (home: ${USER_HOME})
 # === PREPARE DIRECTORIES ===
 mkdir -p "${USER_HOME}/.local/bin"
 mkdir -p "${USER_HOME}/.local/share/claude"
-chown -R "${USERNAME}:" "${USER_HOME}/.local/bin" "${USER_HOME}/.local/share/claude"
+mkdir -p "${USER_HOME}/.local/state"
+mkdir -p "${USER_HOME}/.claude"
+chown -R "${USERNAME}:" "${USER_HOME}/.local" "${USER_HOME}/.claude"
 
 # === DETERMINE TARGET ===
 # The official installer accepts: stable, latest, or a specific semver
@@ -68,9 +70,9 @@ fi
 echo "[claude-code-native] Downloading official installer..."
 
 if [ "${USERNAME}" = "root" ]; then
-	curl -fsSL https://claude.ai/install.sh | sh -s -- "${TARGET}"
+	curl -fsSL https://claude.ai/install.sh | bash -s -- "${TARGET}"
 else
-	su - "${USERNAME}" -c "curl -fsSL https://claude.ai/install.sh | sh -s -- \"${TARGET}\""
+	su - "${USERNAME}" -c "curl -fsSL https://claude.ai/install.sh | bash -s -- \"${TARGET}\""
 fi
 
 # === VERIFICATION ===
@@ -87,4 +89,41 @@ else
 	exit 1
 fi
 
+# === POST-START HOOK ===
+# Ensures hasCompletedOnboarding is set when token auth is configured.
+# Runs as the LAST post-start hook (99- prefix) to catch overwrites from
+# Claude Code CLI/extension that may race with postStartCommand.
+HOOK_DIR="/usr/local/devcontainer-poststart.d"
+mkdir -p "$HOOK_DIR"
+cat > "$HOOK_DIR/99-claude-onboarding.sh" << 'HOOK_EOF'
+#!/bin/bash
+# Ensure hasCompletedOnboarding: true in .claude.json when token auth exists.
+# Runs after all setup scripts to catch any overwrites by Claude Code CLI/extension.
+_USERNAME="${SUDO_USER:-${USER:-vscode}}"
+_USER_HOME=$(getent passwd "$_USERNAME" 2>/dev/null | cut -d: -f6)
+_USER_HOME="${_USER_HOME:-/home/$_USERNAME}"
+CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}"
+CLAUDE_JSON="$CLAUDE_DIR/.claude.json"
+CRED_FILE="$CLAUDE_DIR/.credentials.json"
+
+# Only act when token auth is configured
+[ -f "$CRED_FILE" ] || exit 0
+
+if [ -f "$CLAUDE_JSON" ]; then
+    if ! grep -q '"hasCompletedOnboarding"' "$CLAUDE_JSON" 2>/dev/null; then
+        if command -v jq >/dev/null 2>&1; then
+            jq '. + {"hasCompletedOnboarding": true}' "$CLAUDE_JSON" > "${CLAUDE_JSON}.tmp" && \
+                mv "${CLAUDE_JSON}.tmp" "$CLAUDE_JSON"
+        else
+            sed -i '$ s/}$/,\n  "hasCompletedOnboarding": true\n}/' "$CLAUDE_JSON"
+        fi
+        echo "[claude-onboarding] Injected hasCompletedOnboarding into .claude.json"
+    fi
+else
+    printf '{\n  "hasCompletedOnboarding": true\n}\n' > "$CLAUDE_JSON"
+    echo "[claude-onboarding] Created .claude.json with hasCompletedOnboarding"
+fi
+HOOK_EOF
+chmod +x "$HOOK_DIR/99-claude-onboarding.sh"
+
 echo "[claude-code-native] Installation complete"