Update sandcat config

Author: adamw

.devcontainer/Dockerfile.app

@@ -42,10 +42,9 @@ RUN if MISE_JAVA=$(mise where java 2>/dev/null); then \
     } >> "$HOME/.bashrc"; \
     fi
 
-# Pre-create the Claude config directory and seed onboarding flag so Claude
-# Code can use an API key from the environment without interactive setup.
-RUN mkdir -p /home/vscode/.claude \
-    && echo '{"hasCompletedOnboarding":true}' > /home/vscode/.claude.json
+# Pre-create ~/.claude so Docker bind-mounts (CLAUDE.md, agents/, commands/)
+# don't cause it to be created as root-owned.
+RUN mkdir -p /home/vscode/.claude
 
 RUN echo 'alias claude-yolo="claude --dangerously-skip-permissions"' >> /home/vscode/.bashrc
 

.devcontainer/sandcat/scripts/app-user-init.sh

@@ -73,5 +73,11 @@ EOFJSON
     fi
 fi
 
+# Seed the onboarding flag so Claude Code uses the API key without interactive
+# setup. Only written when the user configured an ANTHROPIC_API_KEY secret.
+if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+    echo '{"hasCompletedOnboarding":true}' > "$HOME/.claude.json"
+fi
+
 # Best-effort: may fail if network isn't routed yet or CLI was just installed.
 claude update || true