chore(release): 2.1.1 [skip ci]

The multi-line COMMITS variable broke sed substitution due to embedded
newlines. Switch to an expanding heredoc that interpolates variables
directly, removing the fragile sed placeholder replacement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/build-and-push.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - 'feature/serverless-*'  # Build development images for serverless features
   pull_request:
     branches:
       - main
@@ -17,10 +16,12 @@ env:
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
+    if: >-
+      github.event_name != 'push'
+      || !contains(github.event.head_commit.message, '[skip ci]')
     permissions:
       contents: read
       packages: write
-      id-token: write
 
     steps:
       - name: Checkout repository
@@ -47,8 +48,6 @@ jobs:
             type=ref,event=pr
             type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
-            # Development tags for serverless features
-            type=raw,value=2.0.0-dev,enable=${{ github.ref == 'refs/heads/feature/serverless-2.0.0' }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
@@ -57,53 +56,6 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            TOOLS_CACHEBUST=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          platforms: linux/amd64
-
-  # Build routing proxy image for serverless features
-  build-routing-proxy:
-    runs-on: ubuntu-latest
-    # Only build routing proxy for serverless feature branches
-    if: github.ref == 'refs/heads/feature/serverless-2.0.0' && github.event_name != 'pull_request'
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata for routing proxy
-        id: meta-proxy
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/cpfarhood/devcontainer-routing-proxy
-          tags: |
-            type=raw,value=latest
-            type=raw,value=2.0.0-dev
-            type=sha,prefix=sha-
-
-      - name: Build and push routing proxy image
-        uses: docker/build-push-action@v6
-        with:
-          context: ./serverless/routing-proxy
-          push: true
-          tags: ${{ steps.meta-proxy.outputs.tags }}
-          labels: ${{ steps.meta-proxy.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64

.github/workflows/quick-fix.yaml

@@ -16,7 +16,9 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main'
     permissions:
+      contents: read
       packages: write
 
     steps:

.github/workflows/release-unified.yaml

@@ -100,8 +100,6 @@ jobs:
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          build-args: |
-            TOOLS_CACHEBUST=${{ github.run_id }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64
@@ -158,34 +156,37 @@ jobs:
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          TAG: ${{ steps.version.outputs.tag }}
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
         run: |
-          # Build release notes
-          PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+          PREV_TAG=$(git describe --tags --abbrev=0 HEAD~1 2>/dev/null || echo "")
           if [ -z "$PREV_TAG" ]; then
             COMMITS=$(git log --pretty=format:"- %s (%h)" HEAD)
           else
             COMMITS=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..HEAD")
           fi
 
-          cat > release-notes.md <<EOF
-          ## Release ${{ steps.version.outputs.version }}
+          cat > release-notes.md <<NOTESEOF
+          ## Release ${VERSION}
 
           ### Changes
           ${COMMITS}
 
           ### Docker Image
           \`\`\`bash
-          docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
+          docker pull ${IMAGE}
           \`\`\`
 
           ### Helm Chart
           \`\`\`bash
           helm repo add devcontainer https://cpfarhood.github.io/devcontainer
           helm repo update
-          helm install mydev devcontainer/devcontainer --version ${{ steps.version.outputs.version }} --set name=mydev
+          helm install mydev devcontainer/devcontainer --version ${VERSION} --set name=mydev
           \`\`\`
-          EOF
+          NOTESEOF
+          sed -i 's/^          //' release-notes.md
 
-          gh release create "${{ steps.version.outputs.tag }}" \
-            --title "Release ${{ steps.version.outputs.tag }}" \
+          gh release create "${TAG}" \
+            --title "Release ${TAG}" \
             --notes-file release-notes.md

.mcp.json

@@ -19,10 +19,9 @@
       "type": "sse",
       "url": "http://localhost:8086/sse"
     },
-    "pgtuner": {
+    "helm": {
       "type": "sse",
-      "url": "http://localhost:8085/sse"
+      "url": "http://localhost:8088/sse"
     }
   }
-}
-
+}

CLAUDE.md

@@ -69,7 +69,7 @@ Container start
 
 | File | Purpose |
 |------|---------|
-| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Helm, Claude Code, Happy Coder, OpenCode, Crush; creates non-root user (UID 1000) |
+| `Dockerfile` | Image definition — installs Chrome, Node.js, VSCode, Helm, gh CLI, kubeseal, Claude Code, Happy Coder, OpenCode, Crush; creates non-root user (UID 1000) |
 | `scripts/init-repo.sh` | Configures git credentials, clones GitHub repo |
 | `scripts/startapp.sh` | Calls init-repo.sh then opens VSCode in the workspace |
 | `chart/` | Helm chart for Kubernetes deployment |
@@ -78,7 +78,7 @@ Container start
 | `chart/templates/pvc.yaml` | PersistentVolumeClaim for user home |
 | `chart/templates/service.yaml` | ClusterIP Service (VNC + optional SSH) |
 | `chart/values.yaml` | Default Helm values |
-| `.mcp.json` | MCP server connection config (GitHub Copilot, Kubernetes, Flux, Fetch, Sequential Thinking, Playwright, pgtuner) |
+| `.mcp.json` | MCP server connection config (GitHub Copilot, Kubernetes, Flux, Helm, Fetch, Sequential Thinking, Playwright, pgtuner) |
 | `Makefile` | Build/deploy automation |
 
 ### MCP Sidecars
@@ -89,6 +89,7 @@ MCP (Model Context Protocol) servers run as sidecar containers in the pod, enabl
 |---------|-------|---------|------|----------|---------|
 | `kubernetes-mcp` | `quay.io/containers/kubernetes_mcp_server` | v0.0.57 | 8080 | `http://localhost:8080/sse` | Enabled |
 | `flux-mcp` | `ghcr.io/controlplaneio-fluxcd/flux-operator-mcp` | v0.41.1 | 8081 | `http://localhost:8081/sse` | Enabled |
+| `helm-mcp` | `ghcr.io/zekker6/mcp-helm` | v1.3.1 | 8088 | `http://localhost:8088/sse` | Enabled |
 | `fetch-mcp` | `mcp/fetch` | latest | 8082 | `http://localhost:8082/sse` | Enabled |
 | `sequentialthinking-mcp` | `mcp/sequentialthinking` | latest | 8083 | `http://localhost:8083/sse` | Enabled |
 | `homeassistant-mcp` | `ghcr.io/homeassistant-ai/ha-mcp` | stable | 8087 | `http://localhost:8087/sse` | Disabled |
@@ -99,6 +100,7 @@ MCP (Model Context Protocol) servers run as sidecar containers in the pod, enabl
 - GitHub MCP is accessed via the Copilot API (`https://api.githubcopilot.com/mcp/`), not as a sidecar
 - Kubernetes and Flux sidecars require `clusterAccess` != `none` to be deployed (they need RBAC permissions)
 - Kubernetes and Flux sidecars inherit the pod's ServiceAccount RBAC permissions
+- Helm sidecar enables browsing Helm repositories and chart metadata
 - Fetch sidecar provides web content fetching capabilities and HTML to markdown conversion
 - Sequential thinking sidecar enables structured thinking and problem-solving processes
 - Home Assistant sidecar requires `HOMEASSISTANT_URL` and `HOMEASSISTANT_TOKEN` in the env secret
@@ -117,6 +119,8 @@ mcp:
       enabled: false
     flux:
       enabled: false
+    helm:
+      enabled: false
     fetch:
       enabled: false
     sequentialthinking:
@@ -135,6 +139,8 @@ mcp:
       enabled: true  # Keep Kubernetes MCP enabled
     flux:
       enabled: false # Disable Flux MCP
+    helm:
+      enabled: true  # Enable Helm MCP for chart browsing
     fetch:
       enabled: true  # Enable Fetch MCP for web content fetching
     sequentialthinking:

Dockerfile

@@ -61,19 +61,13 @@ RUN curl -fsSL https://deb.nodesource.com/setup_lts.x | bash - && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*
 
-# Install Happy Coder globally via npm
+# Install Happy Coder globally via npm (stable, rarely changes)
 RUN npm install -g happy-coder
 
-# Cache-bust: tools below fetch "latest" at build time — a changing ARG
-# forces Docker to re-run these layers instead of serving stale cache.
-ARG TOOLS_CACHEBUST=0
-
-# Install Claude Code via native installer (no Node.js dependency)
-RUN CLAUDE_VERSION=$(curl -fsSL https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/latest) && \
-    echo "Installing Claude Code ${CLAUDE_VERSION}" && \
-    curl -fsSL "https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c096819/claude-code-releases/${CLAUDE_VERSION}/linux-x64/claude" \
-      -o /usr/local/bin/claude && \
-    chmod +x /usr/local/bin/claude && \
+# Install Claude Code native binary (npm wrapper breaks remote control)
+RUN curl -fsSL https://claude.ai/install.sh | bash && \
+    cp /root/.local/bin/claude /usr/local/bin/claude && \
+    rm -rf /root/.local/bin/claude && \
     claude --version
 
 # Install OpenCode AI coding agent
@@ -96,6 +90,20 @@ RUN curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" |
     tar -xz --strip-components=1 -C /usr/local/bin linux-amd64/helm && \
     chmod +x /usr/local/bin/helm
 
+# Install GitHub CLI (gh) via official APT repo
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
+    chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" > /etc/apt/sources.list.d/github-cli.list && \
+    apt-get update && \
+    apt-get install -y gh && \
+    rm -rf /var/lib/apt/lists/*
+
+# Install kubeseal CLI for Bitnami Sealed Secrets
+RUN KUBESEAL_VERSION=$(curl -sL https://api.github.com/repos/bitnami-labs/sealed-secrets/releases/latest | jq -r '.tag_name' | sed 's/^v//') && \
+    curl -fsSL "https://github.com/bitnami-labs/sealed-secrets/releases/download/v${KUBESEAL_VERSION}/kubeseal-${KUBESEAL_VERSION}-linux-amd64.tar.gz" | \
+    tar -xz -C /usr/local/bin kubeseal && \
+    chmod +x /usr/local/bin/kubeseal
+
 # Install VSCode (using Microsoft's current recommended setup)
 RUN wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > /tmp/microsoft.gpg && \
     install -D -o root -g root -m 644 /tmp/microsoft.gpg /usr/share/keyrings/microsoft.gpg && \

chart/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: devcontainer
 description: Dev Container with AI coding agents and MCP sidecars - supports persistent and dynamic deployment modes
 type: application
-version: 2.0.3
+version: 2.1.1
 appVersion: "latest"
 keywords:
   - development

chart/templates/deployment.yaml

@@ -88,8 +88,10 @@ spec:
               value: {{ .Values.happy.serverUrl | quote }}
             - name: HAPPY_WEBAPP_URL
               value: {{ .Values.happy.webappUrl | quote }}
+            {{- if .Values.githubRepo }}
             - name: GITHUB_REPO
               value: {{ .Values.githubRepo | quote }}
+            {{- end }}
           envFrom:
             - secretRef:
                 name: {{ include "devcontainer.envSecretName" . }}
@@ -177,6 +179,29 @@ spec:
           resources:
             {{- toYaml .Values.mcp.sidecars.flux.resources | nindent 12 }}
         {{- end }}
+        {{- if .Values.mcp.sidecars.helm.enabled }}
+        - name: helm-mcp
+          image: "{{ .Values.mcp.sidecars.helm.image.repository }}:{{ .Values.mcp.sidecars.helm.image.tag }}"
+          args:
+            - -mode=sse
+            - -port={{ .Values.mcp.sidecars.helm.port }}
+          ports:
+            - containerPort: {{ .Values.mcp.sidecars.helm.port }}
+              name: helm-mcp
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.helm.port }}
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: {{ .Values.mcp.sidecars.helm.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.mcp.sidecars.helm.resources | nindent 12 }}
+        {{- end }}
         {{- if .Values.mcp.sidecars.homeassistant.enabled }}
         - name: homeassistant-mcp
           image: "{{ .Values.mcp.sidecars.homeassistant.image.repository }}:{{ .Values.mcp.sidecars.homeassistant.image.tag }}"

chart/values.schema.json

@@ -270,6 +270,9 @@
             "pgtuner": {
               "$ref": "#/$defs/mcpSidecar"
             },
+            "helm": {
+              "$ref": "#/$defs/mcpSidecar"
+            },
             "playwright": {
               "$ref": "#/$defs/mcpSidecar"
             }

chart/values.yaml

@@ -13,7 +13,7 @@ deploymentMode: persistent  # persistent | dynamic
 # Container image configuration
 image:
   repository: ghcr.io/cpfarhood/devcontainer
-  tag: 2.0.0-dev
+  tag: latest
   pullPolicy: Always
 
 # GitHub repository to clone into /workspace (ignored in dynamic mode - uses URL routing)
@@ -124,6 +124,20 @@ mcp:
           cpu: "500m"
 
 
+    # Helm chart browsing and management
+    helm:
+      enabled: true
+      image:
+        repository: ghcr.io/zekker6/mcp-helm
+        tag: v1.3.1
+      port: 8088
+      resources:
+        requests:
+          memory: "64Mi"
+          cpu: "50m"
+        limits:
+          memory: "256Mi"
+          cpu: "500m"
 
     # Home Assistant smart home control
     homeassistant:
@@ -217,7 +231,7 @@ dynamic:
     replicas: 2                    # High availability
     image:
       repository: ghcr.io/cpfarhood/devcontainer-routing-proxy
-      tag: 2.0.0-dev
+      tag: latest
       pullPolicy: Always
 
     resources: