Merge remote-tracking branch 'github/master' into feat/gh-stack

# Conflicts:
#	.github/workflows/build-claude-code.yml
#	.github/workflows/ci.yml

Author: gatezh

.claude/CLAUDE.md

@@ -54,6 +54,8 @@ Never duplicate: wiki pages link to READMEs, READMEs link back. Every wiki page
 - Use comments in devcontainer.json (JSONC format)
 - Dockerfile instruction order: ARG → FROM → packages → user/permissions → tools → LABEL
 - For images with multiple binary downloads, use multi-stage parallel builds (see `ralphex-fe/Dockerfile`)
+- Commit every `.sh` file as `100755` (they all have a shebang); check with `git ls-files -s '*.sh'`
+- README headings are plain text, no emoji. Per-image READMEs use these shared section names, in this order, wherever the section exists: `Features` → `Multi-platform Support` → `Image Tags` → `Usage` → image-specific sections → `Build Args` → `Building the Image` → `Resources` → `License` → `Contributing`. Shared boilerplate (platform list, buildx block) is worded identically; only each image's tag scheme and paths differ.
 
 ## Validation
 

.devcontainer/claude-sandbox/devcontainer.json

@@ -23,6 +23,7 @@
         // **General**
         "redhat.vscode-yaml",
         "bierner.markdown-preview-github-styles",
+        "bierner.markdown-mermaid",
         "ms-azuretools.vscode-docker"
       ],
       "settings": {

.devcontainer/devcontainer.json

@@ -23,6 +23,8 @@
         "redhat.vscode-yaml",
         // Markdown Preview Github Styles - Markdown preview
         "bierner.markdown-preview-github-styles",
+        // Markdown Preview Mermaid Support - Mermaid diagrams
+        "bierner.markdown-mermaid",
         // Docker - Dockerfile support
         "ms-azuretools.vscode-docker"
       ],

.devcontainer/init-plugins.sh

@@ -46,13 +46,11 @@ done
 
 # Initialize rtk global hook for Claude Code (auto-rewrite mode).
 # --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
-# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
-# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
-# would otherwise block on stdin here. rtk's own TTY check is not enough — a
-# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
-# interactive. timeout stays as a backstop against a future init-time hang.
+# Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
+# closed stdin defeats the pseudo-TTY postCreateCommand hands us, and timeout
+# backstops any other init-time hang.
 echo "Initializing rtk (token optimizer)..."
-RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch || {
+RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch < /dev/null || {
     echo "Note: rtk init may have already been configured or rtk not available"
 }
 

.github/workflows/build-claude-code.yml

@@ -75,19 +75,19 @@ jobs:
       matrix:
         include:
           - image-suffix: claude-code
-            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node"
+            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node"
             runner: ubuntu-24.04
             arch: amd64
           - image-suffix: claude-code
-            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node"
+            verify-command: "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node"
             runner: ubuntu-24.04-arm
             arch: arm64
           - image-suffix: claude-code-sandbox
-            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node"
+            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node"
             runner: ubuntu-24.04
             arch: amd64
           - image-suffix: claude-code-sandbox
-            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node"
+            verify-command: "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node"
             runner: ubuntu-24.04-arm
             arch: arm64
     runs-on: ${{ matrix.runner }}

.github/workflows/ci.yml

@@ -117,12 +117,12 @@ jobs:
             add_image "claude-code" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node" \
+              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "default"
             add_image "claude-code-sandbox" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node" \
+              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "sandbox"
           fi
 

README.md

@@ -4,7 +4,7 @@ This repository contains Dockerfiles for custom Docker images hosted on GitHub C
 
 **New here?** The [wiki](https://github.com/gatezh/devcontainers/wiki) has a [guide to picking an image](https://github.com/gatezh/devcontainers/wiki/Choosing-an-Image) and explains [what `latest` means and when it moves](https://github.com/gatezh/devcontainers/wiki/Image-Tags-and-Rebuild-Policy).
 
-## 📚 Image Documentation
+## Image Documentation
 
 ### Devcontainer Images
 
@@ -18,7 +18,7 @@ This repository contains Dockerfiles for custom Docker images hosted on GitHub C
 
 - **[ralphex-fe](./ralphex-fe/README.md)** - Bun + Hugo Extended on ralphex base (standalone image)
 
-## 📖 Guides (wiki)
+## Guides (wiki)
 
 Cross-image guides and host-level procedures live in the [wiki](https://github.com/gatezh/devcontainers/wiki), because they go stale when Docker or GitHub changes rather than when this repo does.
 

bun/README.md

@@ -9,44 +9,16 @@ A multiplatform development container image with Bun runtime, optimized for mode
 - **Zsh** - Modern shell with better VS Code integration
 - **Alpine Linux** - Lightweight base image
 
-## Multiplatform Support
+## Multi-platform Support
 
 This image is built for multiple architectures:
 - `linux/amd64` (x86_64)
 - `linux/arm64` (ARM64/Apple Silicon)
 
-## Building the Image
-
-To build this multiplatform image, use Docker Buildx:
-
-```bash
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/<USERNAME>/devcontainers/bun:bun<BUN_VERSION>-alpine \
-  -t ghcr.io/<USERNAME>/devcontainers/bun:latest \
-  --push \
-  .devcontainer
-```
-
-### Example with specific versions:
-
-```bash
-docker buildx build \
-  --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/myusername/devcontainers/bun:bun1.3.5-alpine \
-  -t ghcr.io/myusername/devcontainers/bun:latest \
-  --push \
-  .devcontainer
-```
-
-**Replace:**
-- `<USERNAME>` with your GitHub username or organization
-- `<BUN_VERSION>` with the Bun version (e.g., `1.3.5`)
+## Image Tags
 
-**Note:** The `--push` flag requires you to be logged in to GitHub Container Registry:
-```bash
-echo $GITHUB_TOKEN | docker login ghcr.io -u <USERNAME> --password-stdin
-```
+- `latest` — most recent build
+- `bun<BUN_VERSION>-alpine` — version-specific tag (e.g., `bun1.3.5-alpine`)
 
 ## Usage
 
@@ -96,7 +68,31 @@ The development container comes pre-configured with the following extensions:
 - **Tailwind CSS IntelliSense** (`bradlc.vscode-tailwindcss`) - Autocomplete and syntax highlighting
 - **Tailwind Fold** (`stivo.tailwind-fold`) - Fold long Tailwind class strings
 
-## Version Information
+## Development Workflow
+
+### Starting the Dev Container
+
+1. Open your project in VS Code
+2. Press `F1` and select "Dev Containers: Reopen in Container"
+3. VS Code will pull the image and start the container
+
+### Using Bun
+
+```bash
+# Install dependencies
+bun install
+
+# Run scripts
+bun run build
+
+# Execute files
+bun run index.ts
+
+# Start development server
+bun run dev
+```
+
+## Build Args
 
 The image uses a specific version of Bun defined as a build argument:
 
@@ -116,28 +112,37 @@ docker buildx build \
   .devcontainer
 ```
 
-## Development Workflow
+## Building the Image
 
-### Starting the Dev Container
+To build this multiplatform image, use Docker Buildx:
 
-1. Open your project in VS Code
-2. Press `F1` and select "Dev Containers: Reopen in Container"
-3. VS Code will pull the image and start the container
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t ghcr.io/<USERNAME>/devcontainers/bun:bun<BUN_VERSION>-alpine \
+  -t ghcr.io/<USERNAME>/devcontainers/bun:latest \
+  --push \
+  .devcontainer
+```
 
-### Using Bun
+### Example with Specific Versions
 
 ```bash
-# Install dependencies
-bun install
-
-# Run scripts
-bun run build
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t ghcr.io/myusername/devcontainers/bun:bun1.3.5-alpine \
+  -t ghcr.io/myusername/devcontainers/bun:latest \
+  --push \
+  .devcontainer
+```
 
-# Execute files
-bun run index.ts
+**Replace:**
+- `<USERNAME>` with your GitHub username or organization
+- `<BUN_VERSION>` with the Bun version (e.g., `1.3.5`)
 
-# Start development server
-bun run dev
+**Note:** The `--push` flag requires you to be logged in to GitHub Container Registry:
+```bash
+echo $GITHUB_TOKEN | docker login ghcr.io -u <USERNAME> --password-stdin
 ```
 
 ## License

claude-bun/.devcontainer/init-firewall.sh

@@ -12,7 +12,18 @@ Claude Code development container based on the [official Anthropic devcontainer
 - **Session persistence** for command history and Claude configuration between restarts
 - **Multi-platform support** (linux/amd64, linux/arm64)
 
-## Quick Start
+## Multi-platform Support
+
+This image is built for multiple architectures:
+- `linux/amd64` (x86_64)
+- `linux/arm64` (ARM64/Apple Silicon)
+
+## Image Tags
+
+- `latest` — most recent build
+- `bun<BUN_VERSION>-slim` — version-specific tag (e.g., `bun1.3.5-slim`)
+
+## Usage
 
 ### Using the pre-built image
 
@@ -72,11 +83,6 @@ When executed with `--dangerously-skip-permissions`, devcontainers do **not prev
 | `devcontainer.json` | VS Code devcontainer settings |
 | `init-firewall.sh` | Firewall initialization script |
 
-## Image Tags
-
-- `ghcr.io/gatezh/devcontainers/claude-bun:latest` - Latest build
-- `ghcr.io/gatezh/devcontainers/claude-bun:bun1.3.5-slim` - Bun version specific tag
-
 ## Customization
 
 ### Adding VS Code extensions