fix(claude-code): patch playwright MCP on every session start (#98)

[gatezh]

What

Wires patch-playwright-mcp as a Claude Code SessionStart hook via an image-baked /etc/claude-code/managed-settings.json, so the patch runs before any MCP launches in every new or resumed session — not just at container start.

Why

Closes #98. The playwright plugin can auto-update mid-container-run, extracting a fresh cache dir whose .mcp.json defaults to --browser chrome and points at /opt/google/chrome/chrome (not shipped in this image). Existing postCreateCommand/postStartCommand wiring only patches cache dirs that exist at the moment they run — anything created later stays broken until the next container restart, producing:

Error: Chromium distribution 'chrome' is not found at /opt/google/chrome/chrome

SessionStart is the canonical Claude Code hook for "run before the first prompt of every session" and is documented to run synchronously before the model receives input, so by the time MCP launches the patched .mcp.json is already on disk.

The settings file lives at the Linux managed-settings path (/etc/claude-code/managed-settings.json) so it has highest precedence, sits outside the /home/node/.claude named volume, and survives volume re-creation across container rebuilds.

Changes

• Add claude-code/.devcontainer/managed-settings.json — SessionStart hook entry invoking /usr/local/bin/patch-playwright-mcp on all session sources (startup, resume, clear, compact). Matcher omitted; the patch is idempotent and ~20 ms.
• claude-code/.devcontainer/Dockerfile — COPY the new file to /etc/claude-code/managed-settings.json for both default and sandbox targets (shared base stage).
• .github/workflows/build-claude-code.yml — extend the build trigger paths: filter to pick up managed-settings.json; add a jq -e assertion to the verify matrix on all four target × arch combinations confirming the hook is actually present in the published image.
• claude-code/.devcontainer/devcontainer.json + claude-sandbox/devcontainer.json + init-plugins.sh — update comments to describe postCreateCommand/postStartCommand as defense in depth alongside the new hook, and add issue [BUG] patch-playwright-mcp misses mid-session plugin cache updates #98 cross-references.

Notes

• No script changes. patch-playwright-mcp was already idempotent and looped over every cache dir; this PR only adds a third invocation cadence.
• Existing devcontainers won't get the hook until they rebuild from a refreshed image. The Dockerfile change forces a latest rebuild; downstream projects pick it up on next image pull.
• Verified canonical against upstream docs (2026-05-12):
  • SessionStart hook schema and stdin payload per code.claude.com/docs/en/hooks.
  • Linux managed-settings path per code.claude.com/docs/en/settings.
  • --browser chromium, --executable-path, --no-sandbox, --headless flags valid in @playwright/mcp v0.0.75 (README + upstream Dockerfile ENTRYPOINT).

Test plan

• jq parse of managed-settings.json succeeds and verify-command predicate evaluates true locally.
• hadolint clean on modified Dockerfile (against .hadolint.yaml).
• actionlint clean on modified workflow.
• CI build succeeds and the new jq -e verify assertion passes on all four target × arch combinations.
• In a refreshed devcontainer, observe .mcp.json mtimes update at every session start (not just container start), and confirm mcp__plugin_playwright_playwright__* tools work after a mid-session plugin auto-update.

Closes #98.