[amiralis1365]

Closes #119.

Summary

• Claude Code starts every session at max effort. CLAUDE_CODE_EFFORT_LEVEL=max in containerEnv, since the settings file's effortLevel has no max. To use another level for one session: CLAUDE_CODE_EFFORT_LEVEL=auto claude.
• Claude Code's .claude.json survives a rebuild. CLAUDE_CONFIG_DIR=/home/vscode/.claude keeps the account, onboarding and trust state beside the sessions, in the claude-config volume. Without it the file landed in ~/ and was lost on every rebuild.
• A rebuild keeps more. Two new volumes in the DEVC-08 form, beside the gh, Claude, Codex and venv ones; post-create takes ownership of each before anything writes to it:
  • musher-${devcontainerId}-shell-history: zsh, bash, Node and Python history (NODE_REPL_HISTORY, and PYTHON_HISTORY, which the pinned Python 3.13 reads).
  • -cache: ~/.cache, where containerEnv already points uv, npm and Python's bytecode, and where mise keeps its cache.
• gh logs in by itself, and git keeps your identity (.devcontainer/scripts/lib/github-auth.sh):
  • post-create only stores a token in gh, from a GH_TOKEN your host exports (remoteEnv.MUSHER_HOST_GH_TOKEN).
  • A new post-attach.sh seeds gh from VS Code's forwarded credential when it still has none, then points git's github.com credential at the container's gh. It does this only after VS Code has copied your ~/.gitconfig: the copy happens only after post-create, and only when no ~/.gitconfig exists, so wiring git earlier would cost you your name and email.
• Codex is pinned in .config/mise/config.toml as aqua:openai/codex 0.163.0, for the codex-config volume the container already had, and locked for all seven platforms (the lockfile diff is Codex only). No gate runs it, and every CI job installs a named subset of the file, so CI downloads it (150 to 160 MB, by platform) only inside the dev container. The toolchain table in docs/repository.md now lists it.
  • Not 0.143.0, the rollout's first choice: the pinned mise, 2026.9.12, resolves an aqua Codex tag only among the 100 newest releases, alphas included, so it cannot lock 0.143.0, and mise install --locked then refuses it. The pin's comment says to bump only to a current release.
• Also: the Claude Code extension.

github-auth.sh is a verbatim copy of the canonical script in musher-dev/development-container#55; musher-dev/platform-backstage#114 was its first consumer. Type chore: repository machinery, so no release is cut and consumers see no change.

What a rebuild keeps

Volume (musher-${devcontainerId}-…)	Mounted at	Keeps
gh-config	~/.config/gh	The gh login
claude-config	~/.claude	Claude Code's login, settings and sessions (/resume), and now .claude.json
codex-config	~/.codex	Codex's login and settings
shell-history (new)	~/.shell-history	zsh, bash, Node and Python history
cache (new)	~/.cache	uv's, npm's and mise's caches, and Python's bytecode
venv	engineering-conventions/.venv	The authoring CLI's virtualenv

Not kept: the pinned CLIs under ~/.local/share/mise and Claude Code under ~/.local, which post-create installs again.

Before and after your first rebuild

• No volume is renamed, so there is nothing to copy. The two new volumes start empty, so this rebuild is the last one that loses your shell history and the download caches.
• .claude.json used to live outside the volume, so Claude Code may run its first-run steps once more after this rebuild. It keeps them from then on.
• The first attach seeds gh and wires git. If your host's credential lacks the repo and read:org scopes, as some credential managers' tokens do, run gh auth login once. The gh-config volume keeps it.
• Run codex login once; the codex-config volume keeps it.

AI usage

• This PR contains code generated by AI coding agents
• I have manually reviewed and tested all AI-generated logic

Test plan

• devcontainer read-configuration (CLI 0.89.0): parses. The merged mounts are the six volumes (gh, Claude, Codex, shell history, cache, venv), and the merged configuration carries postAttachCommand, CLAUDE_CODE_EFFORT_LEVEL=max, CLAUDE_CONFIG_DIR, the two history paths and MUSHER_HOST_GH_TOKEN.
• shellcheck -x --source-path=SCRIPTDIR over all six .devcontainer scripts: clean, with no inline suppression.
• lib/github-auth.sh is byte-identical to the canonical copy (cmp).
• The history step, run against a scratch home: the marker plus one line per rc file, a second run adds nothing, and bash chains an existing PROMPT_COMMAND.
• The base image already has /home/vscode and /home/vscode/.config, both owned by vscode, so no mount makes Docker create a root-owned parent.
• With the pinned mise 2026.9.12: 0.143.0 locks no platform entry, and mise install --locked refuses it. 0.163.0 locks all seven, and mise install --locked installs codex-cli 0.163.0. A later mise lock that cannot resolve a release leaves its entry unchanged.
• task lint: clean, as on main.
• task conventions:self: no findings, warnings included, through both the CLI and the launcher, as on main.
• task check (every gate CI runs except the dev container build): passes.
• task tools:doctor: every pin is installed, Codex included.
• The commit passed the repo's pre-commit and commit-msg hooks.
• CI green: all 12 checks, Validate / Required included. The Validate / Dev Container job covers the build and the lifecycle: it builds with --frozen-lockfile, runs devcontainer up (post-create and post-attach), then verify-toolchain.sh, which fails unless Codex installed from the lock. Its log shows the ownership step for the shell-history and cache directories, both history lines, 24 of 24 tools installed from the lock with Codex 0.163.0 among them, post-attach running, and the verification passing. It passes the job's token and CI=true, so gh takes its env-token path and the Claude Code install is skipped.
• A rebuild of an existing container: git identity kept, gh green, /resume lists earlier sessions, history survives.

Not exercised for this repository, by CI or locally: the no-credential path and its "no GitHub credential reached the container yet" line, the ownership of the new mounts at runtime, and the absence of ~/.gitconfig after create. The template's fresh-volume run in musher-dev/development-container#55 checked all three, with the same setup_config_dirs ownership step and the same github-auth.sh.

🤖 Generated with Claude Code