Address remaining CodeRabbit review findings (3, 4, 5, 8, 9, 10)

- Fix hardcoded /home/vscode/.claude in changelog, use portable ~/.claude
- Remove implementation detail "(leading dot)" from changelog entry
- Set AUTH_CONFIGURED=true when credentials already exist (fixes false
  "No tokens provided" summary)
- Update docs site settings.json deployment path to ~/.claude
- Harden $HOME fallback across all scripts: resolve target user's home
  via SUDO_USER/USER/vscode chain instead of relying on $HOME (guards
  against root context in feature installs and hooks)
- Add CLAUDE_CONFIG_DIR documentation to ccstatusline and mcp-qdrant
  feature READMEs
- Fix stale .claude/settings.json references in ccstatusline README

Author: AnExiledDev

.devcontainer/CHANGELOG.md

@@ -7,15 +7,15 @@
 #### Configuration
 - Moved `.claude` directory from `/workspaces/.claude` to `~/.claude` (home directory)
 - Added Docker named volume for persistence across rebuilds (per-instance isolation via `${devcontainerId}`)
-- `CLAUDE_CONFIG_DIR` now defaults to `/home/vscode/.claude`
+- `CLAUDE_CONFIG_DIR` now defaults to `~/.claude`
 
 #### Authentication
 - Added `CLAUDE_AUTH_TOKEN` support in `.secrets` for long-lived tokens from `claude setup-token`
 - Auto-creates `.credentials.json` from token on container start (skips if already exists)
 - Added `CLAUDE_AUTH_TOKEN` to devcontainer.json secrets declaration
 
 #### Security
-- Protected-files-guard now covers `.credentials.json` (leading dot)
+- Protected-files-guard now blocks modifications to `.credentials.json`
 
 #### Scripts
 - Replaced `setup-symlink-claude.sh` with `setup-migrate-claude.sh` (one-time migration)

.devcontainer/features/ccstatusline/README.md

@@ -45,7 +45,7 @@ All widgets connected with powerline arrows (monokai theme).
 
 - **ccstatusline npm package**: Installed on-demand via `npx` (not globally)
 - **Configuration file**: `~/.config/ccstatusline/settings.json` with powerline theme
-- **Claude Code integration**: Automatically updates `.claude/settings.json`
+- **Claude Code integration**: Automatically updates `~/.claude/settings.json`
 - **Disk Usage**: Minimal (~2MB when cached by npx)
 
 ## Requirements
@@ -75,17 +75,18 @@ The feature will validate these are present and exit with an error if missing.
 - ✅ **Session Resume**: Copyable `cc --resume {sessionId}` command via custom-command widget
 - ✅ **Burn Rate Tracking**: Live ccburn compact output showing pace indicators (🧊/🔥/🚨)
 - ✅ **ANSI Colors**: High-contrast colors optimized for dark terminals
-- ✅ **Automatic Integration**: Auto-configures `.claude/settings.json`
+- ✅ **Automatic Integration**: Auto-configures `~/.claude/settings.json`
 - ✅ **Idempotent**: Safe to run multiple times
 - ✅ **Multi-user**: Automatically detects container user
+- ✅ **Config-aware**: Respects `CLAUDE_CONFIG_DIR` environment variable (defaults to `~/.claude`)
 
 ## Post-Installation Steps
 
 ### ✅ Configuration is Automatic
 
 This feature automatically:
 1. Creates `~/.config/ccstatusline/settings.json` with powerline configuration
-2. Configures `.claude/settings.json` to use ccstatusline
+2. Configures `~/.claude/settings.json` to use ccstatusline
 
 **No manual steps required!**
 
@@ -258,7 +259,7 @@ configure-ccstatusline-auto
 npm install -g ccstatusline@latest
 ```
 
-Then update `.claude/settings.json`:
+Then update `~/.claude/settings.json`:
 ```json
 {
   "statusLine": {

.devcontainer/features/ccstatusline/install.sh

@@ -190,9 +190,10 @@ if ! command -v jq &>/dev/null; then
     exit 1
 fi
 
-SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"
 # Use SUDO_USER since _REMOTE_USER isn't set in post-start hooks
 USERNAME="${SUDO_USER:-vscode}"
+_USER_HOME=$(eval echo "~${USERNAME}")
+SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}/settings.json"
 
 # Ensure directory exists
 mkdir -p "$(dirname "${SETTINGS_FILE}")"

.devcontainer/features/mcp-qdrant/README.md

@@ -154,6 +154,7 @@ The feature will validate these are present and exit with an error if missing.
 - ✅ **Cloud or Local**: Supports both Qdrant Cloud and local instances
 - ✅ **Idempotent**: Safe to run multiple times
 - ✅ **Multi-user**: Automatically detects container user
+- ✅ **Config-aware**: Respects `CLAUDE_CONFIG_DIR` environment variable (defaults to `~/.claude`)
 - ✅ **Native mcpServers**: Uses VS Code's native devcontainer mcpServers support (declarative configuration)
 - ✅ **Dynamic Configuration**: Environment variables loaded from `/workspaces/.qdrant-mcp.env` file
 - ✅ **Secure**: API keys protected with 600 permissions on env file

.devcontainer/features/mcp-qdrant/install.sh

@@ -188,8 +188,12 @@ else
     QDRANT_LOCAL_PATH="${QDRANT_LOCAL_PATH:-/workspaces/.qdrant/storage}"
 fi
 
+# Resolve target user's home (guards against $HOME=/root during feature install)
+_USERNAME="${SUDO_USER:-${USER:-vscode}}"
+_USER_HOME=$(eval echo "~${_USERNAME}")
+
 # Ensure settings.json exists
-SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"
+SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}/settings.json"
 if [ ! -f "$SETTINGS_FILE" ]; then
     echo "[mcp-qdrant] ERROR: $SETTINGS_FILE not found"
     exit 1

.devcontainer/features/mcp-qdrant/poststart-hook.sh

@@ -56,8 +56,12 @@ else
     QDRANT_LOCAL_PATH="${QDRANT_LOCAL_PATH:-/workspaces/.qdrant/storage}"
 fi
 
+# Resolve target user's home (guards against $HOME=/root when hook runs as root)
+_USERNAME="${SUDO_USER:-${USER:-vscode}}"
+_USER_HOME=$(eval echo "~${_USERNAME}")
+
 # Ensure settings.json exists
-SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"
+SETTINGS_FILE="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}/settings.json"
 if [ ! -f "$SETTINGS_FILE" ]; then
     echo "[mcp-qdrant] ERROR: $SETTINGS_FILE not found"
     exit 1

.devcontainer/scripts/setup-auth.sh

@@ -69,7 +69,9 @@ fi
 # Long-lived tokens only — generated via: claude setup-token
 # Note: After unset, the token remains visible in /proc/<pid>/environ for the
 # lifetime of this process. This is a platform limitation of environment variables.
-CLAUDE_CRED_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+_USERNAME="${SUDO_USER:-${USER:-vscode}}"
+_USER_HOME=$(eval echo "~${_USERNAME}")
+CLAUDE_CRED_DIR="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}"
 CLAUDE_CRED_FILE="$CLAUDE_CRED_DIR/.credentials.json"
 if [ -n "$CLAUDE_AUTH_TOKEN" ]; then
     # Validate token format (claude setup-token produces sk-ant-* tokens)
@@ -83,6 +85,7 @@ if [ -n "$CLAUDE_AUTH_TOKEN" ]; then
             echo "[setup-auth] WARNING: .credentials.json has permissions $perms (expected 600), fixing"
             chmod 600 "$CLAUDE_CRED_FILE"
         fi
+        AUTH_CONFIGURED=true
     else
         echo "[setup-auth] Creating .credentials.json from CLAUDE_AUTH_TOKEN..."
         mkdir -p "$CLAUDE_CRED_DIR"

.devcontainer/scripts/setup-migrate-claude.sh

@@ -7,7 +7,9 @@
 # prevent overwriting files already in the destination.
 
 OLD_DIR="/workspaces/.claude"
-NEW_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+_USERNAME="${SUDO_USER:-${USER:-vscode}}"
+_USER_HOME=$(eval echo "~${_USERNAME}")
+NEW_DIR="${CLAUDE_CONFIG_DIR:-${_USER_HOME}/.claude}"
 
 # Nothing to migrate if old directory doesn't exist
 if [ ! -d "$OLD_DIR" ]; then

docs/src/content/docs/customization/configuration.md

@@ -9,7 +9,7 @@ CodeForge configuration is spread across three files that each control a differe
 
 ## settings.json
 
-The primary configuration file lives at `.devcontainer/config/defaults/settings.json`. It is deployed to `.claude/settings.json` on every container start and controls Claude Code's runtime behavior.
+The primary configuration file lives at `.devcontainer/config/defaults/settings.json`. It is deployed to `~/.claude/settings.json` on every container start and controls Claude Code's runtime behavior.
 
 ### Core Settings