refactor: extract version management to scripts and add --trace/--dry-run flags

- Move Makefile versions-up logic to scripts/version-upgrade.sh
- Add release-utils.sh with unified tool registry and version fetching
- Support --trace flag in claude agent for request tracing via claude-trace
- Add --dry-run flag to show docker command without execution
- Fix duplicate --dangerously-skip-permissions injection
- Fix autolink checks to handle existing symlinks correctly
- Switch atlas-cli to release-based versioning
- Add clickhouse-client to rust image

Author: lroolle

Dockerfile

@@ -181,7 +181,7 @@ LABEL org.opencontainers.image.claude_code_version=${CLAUDE_CODE_VERSION}
 LABEL org.opencontainers.image.codex_version=${CODEX_VERSION}
 LABEL org.opencontainers.image.gemini_cli_version=${GEMINI_CLI_VERSION}
 
-# Use BuildKit cache for npm to speed up repeated builds
+# Install CLI tools via npm
 RUN --mount=type=cache,target=/home/deva/.npm,uid=${DEVA_UID},gid=${DEVA_GID},sharing=locked \
     npm config set prefix "$DEVA_HOME/.npm-global" && \
     npm install -g --no-audit --no-fund \
@@ -197,9 +197,12 @@ ARG ATLAS_CLI_VERSION=main
 
 LABEL org.opencontainers.image.atlas_cli_version=${ATLAS_CLI_VERSION}
 
-# Install Go tools for Atlassian integration (Confluence/Jira/Bitbucket)
-RUN go install github.com/lroolle/atlas-cli/cmd/atl@${ATLAS_CLI_VERSION} && \
-    sudo mv $HOME/go/bin/atl /usr/local/bin/
+# Install atlas-cli binary + skill via upstream install.sh
+# - Uses prebuilt release tarball (faster than go install)
+# - Falls back to go install if no prebuilt for platform
+# - Installs skill with proper structure (SKILL.md + references/)
+RUN curl -fsSL "https://raw.githubusercontent.com/lroolle/atlas-cli/${ATLAS_CLI_VERSION}/install.sh" \
+    | bash -s -- --skill-dir $DEVA_HOME/.skills
 
 USER root
 

Dockerfile.rust

@@ -29,7 +29,12 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
         libpng-dev libjpeg-dev \
         libudev-dev \
         libproc2-dev \
-        libzmq3-dev libzmq5 libczmq-dev
+        libzmq3-dev libzmq5 libczmq-dev && \
+    curl -fsSL 'https://packages.clickhouse.com/rpm/lts/repodata/repomd.xml.key' | gpg --dearmor -o /usr/share/keyrings/clickhouse-keyring.gpg && \
+    ARCH=$(dpkg --print-architecture) && \
+    echo "deb [signed-by=/usr/share/keyrings/clickhouse-keyring.gpg arch=${ARCH}] https://packages.clickhouse.com/deb stable main" > /etc/apt/sources.list.d/clickhouse.list && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends clickhouse-client
 
 RUN --mount=type=cache,target=/tmp/rust-cache,sharing=locked \
     set -euxo pipefail && \

Makefile

@@ -21,7 +21,7 @@ DETECTED_IMAGE := $(shell \
 CLAUDE_CODE_VERSION := $(shell npm view @anthropic-ai/claude-code version 2>/dev/null || echo "2.0.1")
 CODEX_VERSION := $(shell npm view @openai/codex version 2>/dev/null || echo "0.42.0")
 GEMINI_CLI_VERSION := $(shell npm view @google/gemini-cli version 2>/dev/null || echo "latest")
-ATLAS_CLI_VERSION := $(shell gh api repos/lroolle/atlas-cli/commits/main --jq '.sha' 2>/dev/null || echo "789eefa650d66e97dd8fddceabf9e09f2a5d04a4")
+ATLAS_CLI_VERSION := $(shell gh api repos/lroolle/atlas-cli/releases/latest --jq '.tag_name' 2>/dev/null || echo "v0.1.1")
 COPILOT_API_VERSION := $(shell gh api repos/ericc-ch/copilot-api/branches/master --jq '.commit.sha' 2>/dev/null || echo "83cdfde17d7d3be36bd2493cc7592ff13be4928d")
 
 export DOCKER_BUILDKIT := 1
@@ -132,70 +132,17 @@ buildx-multi-local:
 
 .PHONY: versions-up
 versions-up:
-	@echo "\033[1;36m╔════════════════════════════════════════════════════╗\033[0m"
-	@echo "\033[1;36m║  Upgrading to Latest Versions                     ║\033[0m"
-	@echo "\033[1;36m╚════════════════════════════════════════════════════╝\033[0m"
-	@echo "\033[0;90m⏰ Time: $$(date '+%Y-%m-%d %H:%M:%S')\033[0m"
-	@echo ""
-	@echo "\033[0;90mFetching release dates...\033[0m"
-	@echo "\033[0;90mChecking image: $(DETECTED_IMAGE)\033[0m"
-	@# Get current image versions for comparison
-	@prev_claude=$$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.claude_code_version" }}' $(DETECTED_IMAGE) 2>/dev/null || echo "-"); \
-	 prev_codex=$$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.codex_version" }}' $(DETECTED_IMAGE) 2>/dev/null || echo "-"); \
-	 prev_gemini=$$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.gemini_cli_version" }}' $(DETECTED_IMAGE) 2>/dev/null || echo "-"); \
-	 prev_atlas=$$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.atlas_cli_version" }}' $(DETECTED_IMAGE) 2>/dev/null || echo "-"); \
-	 prev_copilot=$$(docker inspect --format='{{ index .Config.Labels "org.opencontainers.image.copilot_api_version" }}' $(DETECTED_IMAGE) 2>/dev/null || echo "-"); \
-	 fmt() { v="$$1"; if [ -z "$$v" ] || [ "$$v" = "<no value>" ]; then echo "-"; else case "$$v" in v*) echo "$$v";; *) echo "v$$v";; esac; fi; }; \
-	 fmt_date() { d="$$1"; if [ -z "$$d" ]; then echo ""; else date -d "$$d" '+%b %d, %Y %H:%M' 2>/dev/null || date -jf '%Y-%m-%dT%H:%M:%SZ' "$$d" '+%b %d, %Y %H:%M' 2>/dev/null || echo "$$d"; fi; }; \
-	 curC=$$(fmt "$$prev_claude"); curX=$$(fmt "$$prev_codex"); curG=$$(fmt "$$prev_gemini"); curA="$${prev_atlas:0:7}"; curP="$${prev_copilot:0:7}"; \
-	 tgtC=$$(fmt "$(CLAUDE_CODE_VERSION)"); tgtX=$$(fmt "$(CODEX_VERSION)"); tgtG=$$(fmt "$(GEMINI_CLI_VERSION)"); \
-	 tgtA="$(ATLAS_CLI_VERSION)"; tgtA="$${tgtA:0:7}"; tgtP="$(COPILOT_API_VERSION)"; tgtP="$${tgtP:0:7}"; \
-	 dateC=$$(npm view "@anthropic-ai/claude-code@$(CLAUDE_CODE_VERSION)" time --json 2>/dev/null | jq -r '.["$(CLAUDE_CODE_VERSION)"] // .' 2>/dev/null | head -1); \
-	 dateX=$$(npm view "@openai/codex@$(CODEX_VERSION)" time --json 2>/dev/null | jq -r '.["$(CODEX_VERSION)"] // .' 2>/dev/null | head -1); \
-	 dateG=$$(npm view "@google/gemini-cli@$(GEMINI_CLI_VERSION)" time --json 2>/dev/null | jq -r '.["$(GEMINI_CLI_VERSION)"] // .' 2>/dev/null | head -1); \
-	 dateA=$$(gh api "repos/lroolle/atlas-cli/commits/$(ATLAS_CLI_VERSION)" --jq '.commit.committer.date' 2>/dev/null || echo ""); \
-	 dateP=$$(gh api "repos/ericc-ch/copilot-api/commits/$(COPILOT_API_VERSION)" --jq '.commit.committer.date' 2>/dev/null || echo ""); \
-	 fmtC=$$(fmt_date "$$dateC"); fmtX=$$(fmt_date "$$dateX"); fmtG=$$(fmt_date "$$dateG"); fmtA=$$(fmt_date "$$dateA"); fmtP=$$(fmt_date "$$dateP"); \
-	 echo ""; \
-	 echo "\033[1;33m📦 Version Changes:\033[0m"; \
-	 if [ "$$curC" = "$$tgtC" ]; then \
-	   echo "  \033[0;90mClaude Code: $$tgtC ($$fmtC) https://www.npmjs.com/package/@anthropic-ai/claude-code\033[0m \033[0;32m(no change)\033[0m"; \
-	 else \
-	   echo "  \033[1;37mClaude Code:\033[0m \033[0;31m$$curC\033[0m → \033[0;32m$$tgtC\033[0m \033[0;90m($$fmtC) https://www.npmjs.com/package/@anthropic-ai/claude-code\033[0m"; \
-	 fi; \
-	 if [ "$$curX" = "$$tgtX" ]; then \
-	   echo "  \033[0;90mCodex:       $$tgtX ($$fmtX) https://www.npmjs.com/package/@openai/codex\033[0m \033[0;32m(no change)\033[0m"; \
-	 else \
-	   echo "  \033[1;37mCodex:      \033[0m \033[0;31m$$curX\033[0m → \033[0;32m$$tgtX\033[0m \033[0;90m($$fmtX) https://www.npmjs.com/package/@openai/codex\033[0m"; \
-	 fi; \
-	 if [ "$$curG" = "$$tgtG" ]; then \
-	   echo "  \033[0;90mGemini CLI:  $$tgtG ($$fmtG) https://www.npmjs.com/package/@google/gemini-cli\033[0m \033[0;32m(no change)\033[0m"; \
-	 else \
-	   echo "  \033[1;37mGemini CLI: \033[0m \033[0;31m$$curG\033[0m → \033[0;32m$$tgtG\033[0m \033[0;90m($$fmtG) https://www.npmjs.com/package/@google/gemini-cli\033[0m"; \
-	 fi; \
-	 if [ "$$curA" = "$$tgtA" ]; then \
-	   echo "  \033[0;90mAtlas CLI:   $$tgtA ($$fmtA) https://github.com/lroolle/atlas-cli\033[0m \033[0;32m(no change)\033[0m"; \
-	 else \
-	   echo "  \033[1;37mAtlas CLI:  \033[0m \033[0;31m$$curA\033[0m → \033[0;32m$$tgtA\033[0m \033[0;90m($$fmtA) https://github.com/lroolle/atlas-cli\033[0m"; \
-	 fi; \
-	 if [ "$$curP" = "$$tgtP" ]; then \
-	   echo "  \033[0;90mCopilot API: $$tgtP ($$fmtP) https://github.com/ericc-ch/copilot-api\033[0m \033[0;32m(no change)\033[0m"; \
-	 else \
-	   echo "  \033[1;37mCopilot API:\033[0m \033[0;31m$$curP\033[0m → \033[0;32m$$tgtP\033[0m \033[0;90m($$fmtP) https://github.com/ericc-ch/copilot-api\033[0m"; \
-	 fi
-	@echo ""
-	@echo "\033[1;33m⚠  Starting build in 5 seconds... Press Ctrl+C to cancel\033[0m"
-	@echo "\033[0;90mHint: Override via CLAUDE_CODE_VERSION=... CODEX_VERSION=... GEMINI_CLI_VERSION=... ATLAS_CLI_VERSION=... COPILOT_API_VERSION=...\033[0m"
-	@bash -c 'for i in 5 4 3 2 1; do echo -ne "\r\033[1;36m⏳ $$i...\033[0m "; sleep 1; done; echo -ne "\r\033[K"'
-	@echo "\033[1;32m✓ Proceeding with build...\033[0m"
-	@echo ""
-	@$(MAKE) build-main CLAUDE_CODE_VERSION=$(CLAUDE_CODE_VERSION) CODEX_VERSION=$(CODEX_VERSION) GEMINI_CLI_VERSION=$(GEMINI_CLI_VERSION) ATLAS_CLI_VERSION=$(ATLAS_CLI_VERSION) COPILOT_API_VERSION=$(COPILOT_API_VERSION)
-	@echo ""
-	@echo "\033[1;36m🔨 Rebuilding Rust image...\033[0m"
-	@docker build -f $(RUST_DOCKERFILE) --build-arg BASE_IMAGE=$(MAIN_IMAGE) -t $(RUST_IMAGE) .
-	@echo ""
-	@echo "\033[1;32m✅ All images upgraded to latest versions\033[0m"
-	@echo "\033[0;90m⏰ Completed: $$(date '+%Y-%m-%d %H:%M:%S')\033[0m"
+	@MAIN_IMAGE=$(DETECTED_IMAGE) \
+	 BUILD_IMAGE=$(MAIN_IMAGE) \
+	 RUST_IMAGE=$(RUST_IMAGE) \
+	 DOCKERFILE=$(DOCKERFILE) \
+	 RUST_DOCKERFILE=$(RUST_DOCKERFILE) \
+	 CLAUDE_CODE_VERSION=$(CLAUDE_CODE_VERSION) \
+	 CODEX_VERSION=$(CODEX_VERSION) \
+	 GEMINI_CLI_VERSION=$(GEMINI_CLI_VERSION) \
+	 ATLAS_CLI_VERSION=$(ATLAS_CLI_VERSION) \
+	 COPILOT_API_VERSION=$(COPILOT_API_VERSION) \
+	 ./scripts/version-upgrade.sh
 
 .PHONY: versions
 versions:

agents/claude.sh

@@ -10,26 +10,60 @@ agent_prepare() {
     else
         args=()
     fi
-    AGENT_COMMAND=("claude")
 
     parse_auth_args "claude" "${args[@]+"${args[@]}"}"
     AUTH_METHOD="$PARSED_AUTH_METHOD"
     local -a remaining_args=("${PARSED_REMAINING_ARGS[@]+"${PARSED_REMAINING_ARGS[@]}"}")
 
-    local has_dangerously=false
+    # Detect --trace flag and extract trace options
+    local use_trace=false
+    local -a trace_args=()
+    local -a claude_args=()
+
     if [ ${#remaining_args[@]} -gt 0 ]; then
-        for arg in "${remaining_args[@]}"; do
-            if [ "$arg" = "--dangerously-skip-permissions" ]; then
-                has_dangerously=true
-                break
-            fi
+        local i=0
+        while [ $i -lt ${#remaining_args[@]} ]; do
+            local arg="${remaining_args[$i]}"
+            case "$arg" in
+                --trace)
+                    use_trace=true
+                    # Default trace options - include all requests for visibility
+                    trace_args+=("--include-all-requests")
+                    ;;
+                *)
+                    claude_args+=("$arg")
+                    ;;
+            esac
+            i=$((i + 1))
         done
     fi
-    if [ "$has_dangerously" = false ]; then
-        AGENT_COMMAND+=("--dangerously-skip-permissions")
-    fi
 
-    AGENT_COMMAND+=("${remaining_args[@]+"${remaining_args[@]}"}")
+    # Check if --dangerously-skip-permissions already in claude_args
+    local has_dangerously=false
+    for arg in "${claude_args[@]+"${claude_args[@]}"}"; do
+        if [ "$arg" = "--dangerously-skip-permissions" ]; then
+            has_dangerously=true
+            break
+        fi
+    done
+
+    if [ "$use_trace" = true ]; then
+        # Use claude-trace wrapper
+        AGENT_COMMAND=("claude-trace")
+        AGENT_COMMAND+=("${trace_args[@]}")
+        AGENT_COMMAND+=("--run-with")
+        if [ "$has_dangerously" = false ]; then
+            AGENT_COMMAND+=("--dangerously-skip-permissions")
+        fi
+        AGENT_COMMAND+=("${claude_args[@]+"${claude_args[@]}"}")
+    else
+        # Direct claude invocation
+        AGENT_COMMAND=("claude")
+        if [ "$has_dangerously" = false ]; then
+            AGENT_COMMAND+=("--dangerously-skip-permissions")
+        fi
+        AGENT_COMMAND+=("${claude_args[@]+"${claude_args[@]}"}")
+    fi
 
     setup_claude_auth "$AUTH_METHOD"
 }

deva.sh

@@ -41,6 +41,7 @@ AGENT_EXPLICIT=false
 EPHEMERAL_MODE=false
 GLOBAL_MODE=false
 DEBUG_MODE=false
+DRY_RUN=false
 
 usage() {
     cat <<'USAGE'
@@ -73,6 +74,7 @@ Deva flags:
                           Select profile: base (default), rust. Pulls tag, falls back to Dockerfile.<profile>
   --host-net              Use host networking for the agent container
   --no-docker             Disable auto-mount of Docker socket (default: auto-mount if present)
+  --dry-run               Show docker command without executing (implies --debug)
   --verbose, --debug      Print full docker command before execution
   --                      Everything after this sentinel is passed to the agent unchanged
 
@@ -114,9 +116,9 @@ Examples:
 
 Advanced:
   deva.sh codex -v ~/.ssh:/home/deva/.ssh:ro -- -m gpt-5-codex
-  deva.sh -c ~/work-claude-home -- --trace
-  deva.sh --show-config               # Debug configuration
-  deva.sh --no-docker claude          # Disable Docker-in-Docker auto-mount
+  deva.sh claude -- --trace --continue   # Use claude-trace wrapper for request tracing
+  deva.sh --show-config                  # Debug configuration
+  deva.sh --no-docker claude             # Disable Docker-in-Docker auto-mount
 USAGE
 }
 
@@ -1426,6 +1428,12 @@ parse_wrapper_args() {
             i=$((i + 1))
             continue
             ;;
+        --dry-run)
+            DRY_RUN=true
+            DEBUG_MODE=true
+            i=$((i + 1))
+            continue
+            ;;
         *)
             remaining+=("$arg")
             i=$((i + 1))
@@ -1879,9 +1887,9 @@ if [ "$CONFIG_HOME_FROM_CLI" = true ] && [ -n "$CONFIG_HOME" ]; then
 fi
 
 autolink_legacy_into_deva_root() {
-    [ "$AUTOLINK" = true ] || return
-    [ "$CONFIG_HOME_FROM_CLI" = false ] || return
-    [ -n "${CONFIG_ROOT:-}" ] || return
+    [ "$AUTOLINK" = true ] || return 0
+    [ "$CONFIG_HOME_FROM_CLI" = false ] || return 0
+    [ -n "${CONFIG_ROOT:-}" ] || return 0
     [ -d "$CONFIG_ROOT" ] || mkdir -p "$CONFIG_ROOT"
 
     if [ -d "$HOME/.claude" ] || [ -f "$HOME/.claude.json" ]; then
@@ -1908,7 +1916,7 @@ autolink_legacy_into_deva_root() {
         fi
     fi
     if [ -d "$CONFIG_ROOT" ]; then
-        [ -d "$CONFIG_ROOT/codex/.codex" ] || mkdir -p "$CONFIG_ROOT/codex/.codex"
+        [ -d "$CONFIG_ROOT/codex/.codex" ] || [ -L "$CONFIG_ROOT/codex/.codex" ] || mkdir -p "$CONFIG_ROOT/codex/.codex"
     fi
 
     if [ -d "$HOME/.gemini" ]; then
@@ -1919,7 +1927,7 @@ autolink_legacy_into_deva_root() {
         fi
     fi
     if [ -d "$CONFIG_ROOT" ]; then
-        [ -d "$CONFIG_ROOT/gemini/.gemini" ] || mkdir -p "$CONFIG_ROOT/gemini/.gemini"
+        [ -d "$CONFIG_ROOT/gemini/.gemini" ] || [ -L "$CONFIG_ROOT/gemini/.gemini" ] || mkdir -p "$CONFIG_ROOT/gemini/.gemini"
     fi
 }
 
@@ -2036,7 +2044,10 @@ DOCKER_ARGS+=(-e "DEVA_WORKSPACE=$(pwd)")
 DOCKER_ARGS+=(-e "DEVA_EPHEMERAL=${EPHEMERAL_MODE}")
 
 # Centralized mounting logic based on auth method
-if [ -n "${AUTH_METHOD:-}" ]; then
+# If --config-home is set, use it exclusively and skip auth-based mounting
+if [ -n "$CONFIG_HOME" ]; then
+    mount_config_home
+elif [ -n "${AUTH_METHOD:-}" ]; then
     is_default_auth=false
     if [ "$ACTIVE_AGENT" = "claude" ] && [ "$AUTH_METHOD" = "claude" ]; then
         is_default_auth=true
@@ -2206,6 +2217,10 @@ if [ "$DEBUG_MODE" = true ]; then
     echo "" >&2
 fi
 
+if [ "$DRY_RUN" = true ]; then
+    exit 0
+fi
+
 if [ "$EPHEMERAL_MODE" = false ]; then
     # Check if container is running
     container_action="attach"

docker-entrypoint.sh

@@ -203,7 +203,8 @@ setup_nonroot_user() {
     if [ "$DEVA_UID" != "$current_uid" ]; then
         [ "$VERBOSE" = "true" ] && echo "[entrypoint] updating $DEVA_USER UID: $current_uid -> $DEVA_UID"
         usermod -u "$DEVA_UID" -g "$DEVA_GID" "$DEVA_USER"
-        chown -R "$DEVA_UID:$DEVA_GID" "$DEVA_HOME" 2>/dev/null || true
+        # Only chown files owned by container, skip mounted volumes
+        find "$DEVA_HOME" -maxdepth 1 ! -type l -user root -exec chown "$DEVA_UID:$DEVA_GID" {} \; 2>/dev/null || true
     fi
 
     chmod 755 /root 2>/dev/null || true
@@ -291,18 +292,44 @@ main() {
 
     if [ "$DEVA_AGENT" = "claude" ]; then
         if [ "$cmd" = "claude" ] || [ "$cmd" = "$(command -v claude 2>/dev/null)" ]; then
-            build_gosu_env_cmd "$DEVA_USER" "$cmd" "$@" --dangerously-skip-permissions
+            # Add --dangerously-skip-permissions if not already present
+            local has_dsp=false
+            for arg in "$@"; do
+                if [ "$arg" = "--dangerously-skip-permissions" ]; then
+                    has_dsp=true
+                    break
+                fi
+            done
+            if [ "$has_dsp" = true ]; then
+                build_gosu_env_cmd "$DEVA_USER" "$cmd" "$@"
+            else
+                build_gosu_env_cmd "$DEVA_USER" "$cmd" "$@" --dangerously-skip-permissions
+            fi
         elif [ "$cmd" = "claude-trace" ]; then
-            args=("$@")
-            new_args=()
-            for arg in "${args[@]}"; do
-                if [ "$arg" = "--run-with" ]; then
-                    new_args+=("--run-with" "--dangerously-skip-permissions")
-                else
-                    new_args+=("$arg")
+            # claude-trace: ensure --dangerously-skip-permissions follows --run-with
+            local has_dsp=false
+            for arg in "$@"; do
+                if [ "$arg" = "--dangerously-skip-permissions" ]; then
+                    has_dsp=true
+                    break
                 fi
             done
-            build_gosu_env_cmd "$DEVA_USER" "$cmd" "${new_args[@]}"
+            if [ "$has_dsp" = true ]; then
+                # Already has --dangerously-skip-permissions, pass through
+                build_gosu_env_cmd "$DEVA_USER" "$cmd" "$@"
+            else
+                # Insert --dangerously-skip-permissions after --run-with
+                args=("$@")
+                new_args=()
+                for arg in "${args[@]}"; do
+                    if [ "$arg" = "--run-with" ]; then
+                        new_args+=("--run-with" "--dangerously-skip-permissions")
+                    else
+                        new_args+=("$arg")
+                    fi
+                done
+                build_gosu_env_cmd "$DEVA_USER" "$cmd" "${new_args[@]}"
+            fi
         else
             build_gosu_env_cmd "$DEVA_USER" "$cmd" "$@"
         fi