Fix/zsh shell detection

src/aws-cli/NOTES.md

@@ -89,6 +89,15 @@ Quick create your profile:
 duploctl jit update_aws_config myprofile
 ```
 
+## Shell Compatibility
+
+The on-create script sources the AWS CLI helpers into **every installed shell's** interactive rc
+file — `~/.bashrc` when `bash` is present and `~/.zshrc` when `zsh` is present (appends are
+idempotent). It deliberately does not key off the login shell (`/etc/passwd` / `$SHELL`), because
+images often install zsh as the terminal's default without changing the user's login shell, which
+would leave the actually-used shell unconfigured. This way the helpers load on zsh-based images as
+well as bash.
+
 ## References
 
 - [Duploctl JIT Documentation](https://cli.duplocloud.com/Jit/#duplo_resource.jit.DuploJit.update_aws_config)

src/aws-cli/devcontainer-feature.json

@@ -1,7 +1,7 @@
 {
     "name": "AWS CLI with Custom Aliases",
     "id": "aws-cli",
-    "version": "1.0.11",
+    "version": "1.0.13",
     "description": "Installs AWS CLI with custom aliases and AWS Toolkit extension",
     "documentationURL": "https://github.com/duplocloud-internal/customer-workspace/tree/main/features/aws-cli",
     "options": {

src/aws-cli/on-create.sh

@@ -17,12 +17,25 @@ if [[ "$JIT" == "true" ]]; then
   bash /usr/local/share/aws-cli-configure-jit.sh
 fi
 
-# Source helpers in .bashrc
-cat <<EOF >> "${USER_HOME}/.bashrc"
+# Source helpers in every installed shell's interactive rc file. We can't rely on the login shell
+# ($SHELL / getent passwd): images often install zsh as the terminal default without changing the
+# user's login shell, so targeting a single shell leaves the actually-used shell unconfigured.
+configure_shell() {
+  local kind="$1" rc="$2"
+  command -v "$kind" >/dev/null 2>&1 || return 0
+  touch "$rc"
+  # Idempotent: skip if this feature's block is already present.
+  grep -qF 'Duplocloud AWS CLI Feature' "$rc" 2>/dev/null && return 0
+  cat <<EOF >> "$rc"
 
 ## Sourced from Duplocloud AWS CLI Feature
 if [ -f '/usr/local/share/aws-cli-helpers.sh' ]; then . '/usr/local/share/aws-cli-helpers.sh'; fi
 
 EOF
+  echo "AWS CLI helpers added to ${rc}"
+}
+
+configure_shell bash "${USER_HOME}/.bashrc"
+configure_shell zsh  "${USER_HOME}/.zshrc"
 
 echo "AWS CLI configured successfully!"

src/direnv/NOTES.md

@@ -0,0 +1,10 @@
+## Shell Compatibility
+
+The on-create script installs the direnv configuration into **every installed shell's** interactive
+rc file — `~/.bashrc` with `eval "$(direnv hook bash)"` when `bash` is present, and `~/.zshrc` with
+`eval "$(direnv hook zsh)"` when `zsh` is present (appends are idempotent). It deliberately does not
+key off the login shell (`/etc/passwd` / `$SHELL`): images frequently install zsh and make it the
+terminal's default shell without changing the user's login shell, so detecting a single shell leaves
+the shell the terminal actually launches without the hook. Writing to each installed shell's rc makes
+direnv activate regardless of which shell opens — including zsh-based images such as the Anthropic
+secure-AI reference image.

src/direnv/devcontainer-feature.json

@@ -1,7 +1,7 @@
 {
   "name": "Direnv",
   "id": "direnv",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "Installs direnv and places a DuploCloud direnvrc at $HOME/direnv/direnvrc",
   "documentationURL": "https://github.com/duplocloud/devcontainers/tree/main/src/direnv",
   "options": {},

src/direnv/on-create.sh

@@ -6,13 +6,27 @@ echo "Configuring direnv..."
 # Use devcontainer environment variables with fallbacks
 USER_HOME="${_REMOTE_USER_HOME:-$HOME}"
 
-# Add direnv config and bash hook to .bashrc
-cat <<EOF >> "${USER_HOME}/.bashrc"
+# Install the direnv hook into every installed shell's interactive rc file.
+# We can't rely on the login shell ($SHELL / getent passwd): images often install zsh and set it as
+# the terminal's default without changing the user's login shell, so detecting a single shell leaves
+# the actually-used shell without the hook. Writing to each installed shell's rc is robust to that.
+configure_shell() {
+  local kind="$1" rc="$2"
+  command -v "$kind" >/dev/null 2>&1 || return 0
+  touch "$rc"
+  # Idempotent: skip if this feature's hook is already present.
+  grep -qF "direnv hook ${kind}" "$rc" 2>/dev/null && return 0
+  cat <<EOF >> "$rc"
 
 ## Sourced from Duplocloud Direnv Feature
 export DIRENV_CONFIG="${USER_HOME}/direnv"
-eval "\$(direnv hook bash)"
+eval "\$(direnv hook ${kind})"
 
 EOF
+  echo "direnv hook added to ${rc}"
+}
+
+configure_shell bash "${USER_HOME}/.bashrc"
+configure_shell zsh  "${USER_HOME}/.zshrc"
 
 echo "direnv configured successfully!"

src/gcloud-cli/NOTES.md

@@ -0,0 +1,10 @@
+## Shell Compatibility
+
+The on-create script configures **every installed shell's** interactive rc file — `~/.bashrc` when
+`bash` is present and `~/.zshrc` when `zsh` is present (appends are idempotent). Each rc sources the
+shell-appropriate gcloud SDK include files (`path.bash.inc` / `completion.bash.inc` for bash, the
+`.zsh.inc` variants for zsh) plus the gcloud helper functions. It deliberately does not key off the
+login shell (`/etc/passwd` / `$SHELL`), because images often install zsh as the terminal's default
+without changing the user's login shell, which would leave the actually-used shell unconfigured. This
+makes the gcloud CLI path and completion load correctly on zsh-based images (such as the Anthropic
+secure-AI reference image) as well as bash.

src/gcloud-cli/devcontainer-feature.json

@@ -1,7 +1,7 @@
 {
     "name": "Google Cloud CLI",
     "id": "gcloud-cli",
-    "version": "1.0.5",
+    "version": "1.0.7",
     "description": "Installs Google Cloud CLI with multi-architecture support",
     "documentationURL": "https://github.com/duplocloud-internal/customer-workspace/tree/main/features/gcloud-cli",
     "options": {},

src/gcloud-cli/on-create.sh

@@ -6,19 +6,34 @@ echo "Configuring Google Cloud CLI..."
 # Use devcontainer environment variables with fallbacks
 USER_HOME="${_REMOTE_USER_HOME:-$HOME}"
 
-# Add gcloud CLI setup to .bashrc with some extra roomy spacing
-cat <<EOF >> "${USER_HOME}/.bashrc"
+# Add gcloud CLI setup to every installed shell's interactive rc file. The gcloud SDK ships
+# shell-specific include files (path.bash.inc / path.zsh.inc, etc.), so each shell gets its own.
+# We can't rely on the login shell ($SHELL / getent passwd): images often install zsh as the
+# terminal default without changing the user's login shell, so targeting a single shell leaves the
+# actually-used shell unconfigured.
+configure_shell() {
+  local kind="$1" rc="$2"
+  command -v "$kind" >/dev/null 2>&1 || return 0
+  touch "$rc"
+  # Idempotent: skip if this feature's block is already present.
+  grep -qF 'Duplocloud GCloud CLI Feature' "$rc" 2>/dev/null && return 0
+  cat <<EOF >> "$rc"
 
 ## Sourced from Duplocloud GCloud CLI Feature
 # Google Cloud CLI - path setup
-if [ -f '${USER_HOME}/google-cloud-sdk/path.bash.inc' ]; then . '${USER_HOME}/google-cloud-sdk/path.bash.inc'; fi
+if [ -f '${USER_HOME}/google-cloud-sdk/path.${kind}.inc' ]; then . '${USER_HOME}/google-cloud-sdk/path.${kind}.inc'; fi
 
 # Google Cloud CLI - shell command completion
-if [ -f '${USER_HOME}/google-cloud-sdk/completion.bash.inc' ]; then . '${USER_HOME}/google-cloud-sdk/completion.bash.inc'; fi
+if [ -f '${USER_HOME}/google-cloud-sdk/completion.${kind}.inc' ]; then . '${USER_HOME}/google-cloud-sdk/completion.${kind}.inc'; fi
 
 # Google Cloud CLI - helper functions
 if [ -f '/usr/local/share/gcloud-cli-helpers.sh' ]; then . '/usr/local/share/gcloud-cli-helpers.sh'; fi
 
 EOF
+  echo "Google Cloud CLI setup added to ${rc}"
+}
+
+configure_shell bash "${USER_HOME}/.bashrc"
+configure_shell zsh  "${USER_HOME}/.zshrc"
 
 echo "Google Cloud CLI configured successfully!"

src/onepassword-cli/NOTES.md

@@ -125,7 +125,7 @@ This authentication method allows biometric authentication within the devcontain
 - Extracted during the sign-in process using `op signin --raw`
 - Mapped to the correct account UUID from `op account list`
 - Exported to the current script environment for immediate use
-- Appended to `.bashrc` for persistence across terminal sessions
+- Appended to every installed shell's rc file for persistence across terminal sessions (see [Shell Compatibility](#shell-compatibility))
 
 **Note**: The account URL may be specified with or without the `https://` prefix. The feature handles both formats when looking up the account UUID.
 
@@ -392,6 +392,15 @@ The install script automatically disables problematic repositories (like yarn) b
 
 This issue is specific to Debian Trixie which uses sequoia (`sqv`) for GPG verification instead of the traditional apt-key approach.
 
+## Shell Compatibility
+
+The on-create script writes its persisted variables and the session-token sourcing line into **every
+installed shell's** interactive rc file — `~/.bashrc` when `bash` is present and `~/.zshrc` when `zsh`
+is present (appends are idempotent). It deliberately does not key off the login shell (`/etc/passwd`
+/ `$SHELL`), because images often install zsh as the terminal's default without changing the user's
+login shell, which would leave the actually-used shell unconfigured. This makes the feature work on
+zsh-based images (such as the Anthropic secure-AI reference image) as well as bash.
+
 ## References 
 
 - [1Password CLI Documentation](https://developer.1password.com/docs/cli) - Official CLI reference and setup guides

src/onepassword-cli/devcontainer-feature.json

@@ -1,7 +1,7 @@
 {
   "name": "1Password CLI",
   "id": "onepassword-cli",
-  "version": "1.1.0",
+  "version": "1.1.3",
   "description": "Installs 1Password CLI with optional auto SSH key configuration",
   "documentationURL": "https://github.com/duplocloud/devcontainers/tree/main/src/onepassword-cli",
   "options": {