Fix unsupported Feature mount metadata blocking release

README.md

@@ -91,8 +91,8 @@ other sensitive data. Since they are stored directly in your host home directory
 | `playwright` | AI agent tool: Playwright Agent CLI and browser runtime only | none |
 | `gitlab-cli` | Coding tool: `glab` CLI from GitLab releases | `~/.config/glab-cli` |
 | `agents` | Shared feature for agent skills/state only | `~/.agents` |
-| `tmux` | `tmux` via apt (Debian/Ubuntu) | read-only `~/.tmux.conf` |
-| `vim` | `vim` via apt (Debian/Ubuntu) | read-only `~/.vimrc`, read-write `~/.vim` |
+| `tmux` | `tmux` via apt (Debian/Ubuntu) | read-write `~/.tmux.conf` |
+| `vim` | `vim` via apt (Debian/Ubuntu) | read-write `~/.vimrc`, `~/.vim` |
 
 ## Publishing
 
@@ -109,17 +109,18 @@ Roo Code, Cline, OpenCode, or GitLab.
 ## Terminal Features
 
 The `tmux` Feature installs tmux and shares the host's `~/.tmux.conf`
-file read-only. The `vim` Feature installs Vim and shares `~/.vimrc`
-read-only and `~/.vim/` read-write. This supports standard dotfile layouts,
+file. The `vim` Feature installs Vim and shares `~/.vimrc` and `~/.vim/`.
+These mounts are read-write because Feature metadata does not support
+read-only bind mount properties. This supports standard dotfile layouts,
 including Vim configurations that install plugins or write undo data under
 `~/.vim/`.
 
 Before starting a Dev Container, ensure the corresponding host paths exist.
 A missing bind-mount source may prevent the container from starting.
 These Features do not mount the entire host HOME directory.
 
-The writable `~/.vim/` mount allows processes in the container to modify
-host Vim configuration, plugins and state. Review this security tradeoff
+All shared configuration paths are writable by container processes, including
+`~/.tmux.conf`, `~/.vimrc`, and `~/.vim/`. Review this security tradeoff
 before using these Features with untrusted code.
 
 See [`src/tmux/README.md`](src/tmux/README.md) and

src/tmux/README.md

@@ -1,7 +1,7 @@
 # tmux Feature
 
 Installs tmux on Debian/Ubuntu and exposes the **host** `~/.tmux.conf`
-file in the container, read-only. A symlink at the container user's
+file in the container (read-write bind mount). A symlink at the container user's
 `~/.tmux.conf` points to the mounted file.
 
 ## Host configuration
@@ -23,6 +23,9 @@ file bind mount cannot be skipped dynamically; the container may fail to start.
 }
 ```
 
+Dev Container Feature metadata cannot declare read-only bind mounts, so
+container processes can also **modify the host's** `~/.tmux.conf`.
+
 Only the configuration file is shared; tmux server/socket/session state
 belongs to the temporary container. The container startup script refuses
 to overwrite an existing `~/.tmux.conf` file or unrelated symlink.

src/tmux/devcontainer-feature.json

@@ -2,13 +2,12 @@
   "id": "tmux",
   "version": "0.1.0",
   "name": "tmux",
-  "description": "Installs tmux and shares the host ~/.tmux.conf read-only.",
+  "description": "Installs tmux and shares the host ~/.tmux.conf configuration file.",
   "mounts": [
     {
       "type": "bind",
       "source": "${localEnv:HOME}/.tmux.conf",
-      "target": "/mnt/devcontainer-features/tmux/tmux.conf",
-      "readonly": true
+      "target": "/mnt/devcontainer-features/tmux/tmux.conf"
     }
   ],
   "postCreateCommand": "/usr/local/share/devcontainer-features/tmux/setup-persistence.sh"

src/vim/README.md

@@ -1,7 +1,7 @@
 # Vim Feature
 
 Installs the full `vim` package on Debian/Ubuntu. Exposes the **host**
-`~/.vimrc` **read-only** and `~/.vim/` **read-write** and links both
+`~/.vimrc` and `~/.vim/` via **read-write** bind mounts and links both
 paths into the container user's HOME.
 
 ## Host configuration
@@ -20,6 +20,10 @@ inside the container can modify host Vim configuration, plugins and state.
 Review this exception to workspace isolation before using the Feature
 with untrusted code.
 
+The `~/.vimrc` file is also writable from inside the container because
+Dev Container Feature metadata does not provide a read-only mount property.
+This is an explicit exception to workspace-only isolation.
+
 The optional `~/.vimrc.local` is not mounted, so Vim skips it unless
 another mount provides it.
 

src/vim/devcontainer-feature.json

@@ -2,19 +2,17 @@
   "id": "vim",
   "version": "0.1.0",
   "name": "Vim",
-  "description": "Installs Vim and shares host ~/.vimrc (read-only) and ~/.vim (read-write).",
+  "description": "Installs Vim and shares host ~/.vimrc and ~/.vim configuration.",
   "mounts": [
     {
       "type": "bind",
       "source": "${localEnv:HOME}/.vimrc",
-      "target": "/mnt/devcontainer-features/vim/vimrc",
-      "readonly": true
+      "target": "/mnt/devcontainer-features/vim/vimrc"
     },
     {
       "type": "bind",
       "source": "${localEnv:HOME}/.vim",
-      "target": "/mnt/devcontainer-features/vim/vim",
-      "readonly": false
+      "target": "/mnt/devcontainer-features/vim/vim"
     }
   ],
   "postCreateCommand": "/usr/local/share/devcontainer-features/vim/setup-persistence.sh"