fix: trace state through docker exec, Makefile pin, CA warnings

Review findings on #422:
- persistent containers: docker exec now passes DEVA_TRACE=0/1
  explicitly every attach — exec env overrides creation-time env, so
  --trace works on an existing container and a non-traced attach
  un-trusts a previously installed CA
- Makefile CCTRACE_VERSION ?= pin bumped to 0.11.0 (it overrides the
  Dockerfile default on the make build path)
- setup_trace_ca: warn instead of silently swallowing
  update-ca-certificates failures; chmod 644 the installed cert;
  success log only on actual success

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

Makefile

@@ -31,7 +31,7 @@ DELTA_VERSION ?= 0.19.2
 TMUX_VERSION ?= 3.6a
 TMUX_SHA256 ?= b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759
 CLAUDE_CODE_VERSION ?= 2.1.143
-CCTRACE_VERSION ?= 0.4.0
+CCTRACE_VERSION ?= 0.11.0
 CODEX_VERSION ?= 0.131.0
 GEMINI_CLI_VERSION ?= 0.42.0
 GROK_CLI_VERSION ?= 0.2.93

agents/claude.sh

@@ -50,6 +50,7 @@ agent_prepare() {
         # DEVA_TRACE=1 tells the entrypoint to install the cctrace MITM CA
         # into the container system trust store (#414)
         DOCKER_ARGS+=("-e" "DEVA_TRACE=1")
+        DEVA_TRACE_ACTIVE=true
         AGENT_COMMAND=("cctrace" "--no-open" "--")
         if [ "$has_dangerously" = false ]; then
             AGENT_COMMAND+=("--dangerously-skip-permissions")

agents/codex.sh

@@ -93,6 +93,7 @@ agent_prepare() {
         # cctrace codex profile: codex args go after "--"; always mitm.
         # DEVA_TRACE=1 installs the MITM CA into the container store (#414).
         DOCKER_ARGS+=("-e" "DEVA_TRACE=1")
+        DEVA_TRACE_ACTIVE=true
         AGENT_COMMAND=("cctrace" "codex" "--no-open" "--" "${AGENT_COMMAND[@]:1}")
     fi
 

agents/grok.sh

@@ -41,6 +41,7 @@ agent_prepare() {
         # cctrace grok profile: grok args go after "--"; always mitm.
         # DEVA_TRACE=1 installs the MITM CA into the container store (#414).
         DOCKER_ARGS+=("-e" "DEVA_TRACE=1")
+        DEVA_TRACE_ACTIVE=true
         AGENT_COMMAND=("cctrace" "grok" "--no-open" "--" "${AGENT_COMMAND[@]:1}")
     fi
 

deva.sh

@@ -3684,11 +3684,17 @@ if [ "$EPHEMERAL_MODE" = false ]; then
         update_session_file
     fi
 
+    # docker exec env overrides the container's creation-time env: pass the
+    # trace state explicitly so --trace works on an existing container and a
+    # non-traced attach un-trusts the CA installed by an earlier traced run.
+    _trace_env="DEVA_TRACE=0"
+    [ "${DEVA_TRACE_ACTIVE:-false}" = true ] && _trace_env="DEVA_TRACE=1"
+
     if [ "$AUTH_PROVISION_MODE" = true ]; then
-        docker exec "${DOCKER_TERMINAL_ARGS[@]}" "$CONTAINER_NAME" /usr/local/bin/docker-entrypoint.sh "${AGENT_COMMAND[@]}" || true
+        docker exec -e "$_trace_env" "${DOCKER_TERMINAL_ARGS[@]}" "$CONTAINER_NAME" /usr/local/bin/docker-entrypoint.sh "${AGENT_COMMAND[@]}" || true
         finish_auth_provision
     else
-        exec docker exec "${DOCKER_TERMINAL_ARGS[@]}" "$CONTAINER_NAME" /usr/local/bin/docker-entrypoint.sh "${AGENT_COMMAND[@]}"
+        exec docker exec -e "$_trace_env" "${DOCKER_TERMINAL_ARGS[@]}" "$CONTAINER_NAME" /usr/local/bin/docker-entrypoint.sh "${AGENT_COMMAND[@]}"
     fi
 else
     echo "Launching ${ACTIVE_AGENT} (ephemeral mode) via $(docker_image_ref)"

docker-entrypoint.sh

@@ -343,7 +343,9 @@ setup_trace_ca() {
     if [ "${DEVA_TRACE:-}" != "1" ]; then
         if [ -f "$crt" ]; then
             rm -f "$crt"
-            update-ca-certificates >/dev/null 2>&1 || true
+            if ! update-ca-certificates >/dev/null 2>&1; then
+                echo "[entrypoint] warning: trust-store update failed; cctrace MITM CA may still be trusted" >&2
+            fi
         fi
         return 0
     fi
@@ -363,8 +365,12 @@ setup_trace_ca() {
     fi
 
     cp "$ca_path" "$crt"
-    update-ca-certificates >/dev/null 2>&1 || true
-    [ "$VERBOSE" = "true" ] && echo "[entrypoint] cctrace MITM CA trusted container-wide: $crt"
+    chmod 644 "$crt"
+    if update-ca-certificates >/dev/null 2>&1; then
+        [ "$VERBOSE" = "true" ] && echo "[entrypoint] cctrace MITM CA trusted container-wide: $crt"
+    else
+        echo "[entrypoint] warning: trust-store update failed; container-wide CA trust incomplete (cctrace env-scoped trust still applies)" >&2
+    fi
     return 0
 }