diff --git a/.devcontainer/init-plugins.sh b/.devcontainer/init-plugins.sh
index 2aad0d9..7b27424 100755
--- a/.devcontainer/init-plugins.sh
+++ b/.devcontainer/init-plugins.sh
@@ -46,13 +46,11 @@ done
 
 # Initialize rtk global hook for Claude Code (auto-rewrite mode).
 # --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
-# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
-# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
-# would otherwise block on stdin here. rtk's own TTY check is not enough — a
-# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
-# interactive. timeout stays as a backstop against a future init-time hang.
+# Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
+# closed stdin defeats the pseudo-TTY postCreateCommand hands us, and timeout
+# backstops any other init-time hang.
 echo "Initializing rtk (token optimizer)..."
-RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch || {
+RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch < /dev/null || {
     echo "Note: rtk init may have already been configured or rtk not available"
 }
 
diff --git a/claude-code/.devcontainer/init-plugins.sh b/claude-code/.devcontainer/init-plugins.sh
index 6f64ac7..c9fe42e 100644
--- a/claude-code/.devcontainer/init-plugins.sh
+++ b/claude-code/.devcontainer/init-plugins.sh
@@ -76,13 +76,11 @@ done
 # ── rtk init (token-optimized CLI proxy) ────────────────────────────────────
 # Global hook-first mode: installs only the PreToolUse rewrite hook to ~/.claude/,
 # no workspace artifacts (CLAUDE.md, .rtk/). Safe to run multiple times.
-# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
-# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
-# would otherwise block on stdin here. rtk's own TTY check is not enough — a
-# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
-# interactive. timeout stays as a backstop against a future init-time hang.
+# Telemetry consent prompt: RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477),
+# closed stdin defeats the pseudo-TTY postCreateCommand hands us, and timeout
+# backstops any other init-time hang.
 if command -v rtk &>/dev/null; then
-    RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
+    RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch < /dev/null 2>/dev/null || true
 fi
 
 # ── agent-browser skill ─────────────────────────────────────────────────────
diff --git a/ralphex-fe/init-docker.sh b/ralphex-fe/init-docker.sh
index 7b2cbc4..dcab520 100755
--- a/ralphex-fe/init-docker.sh
+++ b/ralphex-fe/init-docker.sh
@@ -3,11 +3,17 @@
 # The entrypoint (/init.sh) runs /srv/init.sh if it exists before the main command.
 #
 # Source: https://github.com/umputun/ralphex/blob/master/scripts/internal/init-docker.sh
-# Copied as-is from umputun/ralphex. Check upstream for updates.
+# Copied from umputun/ralphex; local additions are marked "Local:" or cite
+# an issue. Check upstream for updates.
+
+# ── Local: ~/.claude must exist without the host mount (#128) ───────────────
+# rtk init -g below writes into it (as app) and fails if it is missing. Not
+# recursive: only the copies below are chowned, never anything bind-mounted in.
+mkdir -p /home/app/.claude
+chown app:app /home/app/.claude
 
 # copy only essential claude files (not the entire 2GB directory)
 if [ -d /mnt/claude ]; then
-    mkdir -p /home/app/.claude
     # copy config files only (not cache, history, debug, todos, etc.)
     for f in .credentials.json settings.json settings.local.json CLAUDE.md format.sh; do
         [ -e "/mnt/claude/$f" ] && cp -L "/mnt/claude/$f" "/home/app/.claude/$f" 2>/dev/null || true
@@ -27,19 +33,14 @@ if [ -d /mnt/claude ]; then
     fi
 
     chown -R app:app /home/app/.claude
+fi
 
-    # ── RTK: ensure rewrite hook is configured ─────────────────────────────
-    # The host mount usually brings the hook; re-init idempotently in case the
-    # mounted ~/.claude carries none. --hook-only avoids workspace artifacts.
-    # Scope: this sits inside the /mnt/claude guard, so a container started
-    # without the host mount gets no rtk hook and rtk stays inert.
-    # RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround:
-    # since rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent
-    # prompt that would otherwise block on stdin here. timeout stays as a
-    # backstop against a future init-time hang.
-    if command -v rtk >/dev/null 2>&1; then
-        RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
-    fi
+# ── Local: RTK rewrite hook, with or without the host mount (#128) ──────────
+# Idempotent; --hook-only avoids workspace artifacts. Telemetry prompt:
+# RTK_TELEMETRY_DISABLED=1 opts out (rtk-ai/rtk#2477), closed stdin stops it
+# blocking, and timeout backstops any other hang.
+if command -v rtk >/dev/null 2>&1; then
+    RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch < /dev/null 2>/dev/null || true
 fi
 
 # copy credentials extracted from macOS keychain (mounted separately)