rosstaco · Oct 14, 2026 · Oct 14, 2026
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -19,6 +19,7 @@ jobs:
           - copilot-persistence
           - gitlab-ci-local
           - atlassian-jira-confluence-cli
+          - atlassian-teamwork-graph-cli
           - package-source-overrides
         baseImage:
           - debian:latest
@@ -45,6 +46,7 @@ jobs:
           - copilot-persistence
           - gitlab-ci-local
           - atlassian-jira-confluence-cli
+          - atlassian-teamwork-graph-cli
           - package-source-overrides
     steps:
       - uses: actions/checkout@v4

diff --git a/README.md b/README.md
@@ -10,6 +10,7 @@ Custom [dev container Features](https://containers.dev/implementors/features/) f
 | [Microsoft Security DevOps CLI](src/microsoft-security-devops-cli) | `guardian` CLI for running security analysis tools without .NET |
 | [Copilot CLI Persistence](src/copilot-persistence) | Persist GitHub Copilot CLI settings & chat history across rebuilds |
 | [Atlassian CLI for Jira & Confluence](src/atlassian-jira-confluence-cli) | `acli` for working with Jira and Confluence Cloud |
+| [Atlassian Teamwork Graph CLI](src/atlassian-teamwork-graph-cli) | `twg` for Jira, Confluence, Bitbucket, JSM and the Teamwork Graph, built for AI agents |
 | [Package Source Overrides](src/package-source-overrides) | Point npm, pnpm, Yarn, Corepack, pip, uv, and NuGet at internal override feeds |
 | [GitLab CI Local](src/gitlab-ci-local) | Run GitLab CI/CD pipelines locally with `gitlab-ci-local` |
 | [Prompty Dumpty](src/prompty-dumpty) | `dumpty` CLI for managing prompty files |
@@ -156,6 +157,39 @@ acli jira project list
 
 `acli auth login` opens an OAuth page via `xdg-open`, which doesn't honor `$BROWSER` inside a dev container. With `configureBrowser` enabled (the default), the feature installs a small `xdg-open` shim at `/usr/local/bin/xdg-open` that prefers `$BROWSER` (such as the VS Code browser helper) so the login page opens on your host machine. Set `configureBrowser` to `false` to skip it.
 
+### Atlassian Teamwork Graph CLI
+
+Installs the [Atlassian Teamwork Graph CLI](https://developer.atlassian.com/platform/teamwork-graph/twg-cli/) (`twg`) for working with Jira, Confluence, JSM, Bitbucket, Loom, Trello and the Teamwork Graph, from the terminal or from AI coding agents. It complements `acli`, and the two Features can be used together.
+
+**Usage:**
+
+```json
+{
+  "features": {
+    "ghcr.io/rosstaco/devcontainer-features/atlassian-teamwork-graph-cli:1": {}
+  },
+  "remoteEnv": {
+    "TWG_TOKEN": "${localEnv:TWG_TOKEN}",
+    "TWG_USER": "${localEnv:TWG_USER}",
+    "TWG_SITE": "${localEnv:TWG_SITE}"
+  }
+}
+```
+
+The `remoteEnv` block is optional. Use it to pass credentials from your host instead of running `twg login`.
+
+**Options:**
+- `version` - Version of twg to install (default: "latest"). Use "latest" or a specific version like "1.3.5"
+- `installSkills` - Install the TWG agent skills into `~/.agents/skills` and `~/.claude/skills` (default: `false`)
+- `enableTelemetry` - Allow twg telemetry. When `false`, `DO_NOT_TRACK=1` and `TWG_DISABLE_3P_DATA_TELEMETRY=1` are exported (default: `false`)
+- `persistAuth` - Keep `~/.config/twg` on a named volume so `twg login` survives rebuilds (default: `true`)
+- `configureBrowser` - Install an `xdg-open` shim that prefers `$BROWSER` so `twg login` opens on your host (default: `true`)
+
+**How It Works:**
+- Downloads the official binary from Atlassian and checks its SHA-256 checksum. It skips the interactive installer, which asks for consent and login during the build.
+- Installs to `~/.local/bin/twg` for the remote user, with a `/usr/local/bin/twg` symlink
+- Run `twg login` and then `twg doctor` once the container starts
+
 ### Package Source Overrides
 
 Points npm, pnpm, Yarn, Corepack, pip, uv, and NuGet at internal **override package sources** (a pull-through proxy such as Artifactory, Nexus, or Azure Artifacts) instead of public feeds. It writes system- and user-scoped configuration so that Features installed after it, and your projects, resolve packages through the proxy.

diff --git a/justfile b/justfile
@@ -25,6 +25,10 @@ build-gitlab-ci-local:
 build-atlassian-jira-confluence-cli:
     just build-feature atlassian-jira-confluence-cli
 
+# Build Atlassian Teamwork Graph CLI (twg) feature
+build-atlassian-teamwork-graph-cli:
+    just build-feature atlassian-teamwork-graph-cli
+
 # Build Package Source Overrides feature
 build-package-source-overrides:
     just build-feature package-source-overrides
@@ -35,6 +39,7 @@ build-all:
     just build-microsoft-security-devops-cli
     just build-gitlab-ci-local
     just build-atlassian-jira-confluence-cli
+    just build-atlassian-teamwork-graph-cli
     just build-package-source-overrides
 
 # Generate feature README.md files from devcontainer-feature.json and NOTES.md
@@ -46,6 +51,7 @@ clean:
     rm -rf .devcontainer/ohmyposh
     rm -rf .devcontainer/gitlab-ci-local
     rm -rf .devcontainer/atlassian-jira-confluence-cli
+    rm -rf .devcontainer/atlassian-teamwork-graph-cli
     rm -rf .devcontainer/package-source-overrides
     rm -f .devcontainer/*.tgz
     echo "✓ Cleaned local features"
diff --git a/src/atlassian-teamwork-graph-cli/NOTES.md b/src/atlassian-teamwork-graph-cli/NOTES.md
@@ -0,0 +1,79 @@
+## About
+
+The [Atlassian Teamwork Graph CLI](https://developer.atlassian.com/platform/teamwork-graph/twg-cli/) (`twg`) is Atlassian's CLI for the Teamwork Graph and Atlassian Cloud: Jira, Confluence, Jira Service Management, Bitbucket, Loom, Trello, Goals, Assets and more. It is designed to be driven by AI coding agents as well as people, and complements the [Atlassian CLI (`acli`)](https://github.com/rosstaco/devcontainer-features/tree/main/src/atlassian-jira-confluence-cli). Both Features can be used together.
+
+## How It Works
+
+Atlassian's official installer (`curl … /cli/install | bash`) also runs `twg setup`, which asks you to accept the Atlassian agreements, installs agent skills and starts an interactive OAuth login on the controlling terminal. None of that can happen while an image is being built, so this Feature:
+
+1. **Downloads the official binary** from `teamwork-graph.atlassian.com/cli` (`latest` is resolved from the stable `manifest.json`) and **verifies its SHA-256** against the published `SHA256SUMS`
+2. **Installs it for the remote user** at `~/.local/bin/twg` (twg's default location, user-owned so `twg upgrade` works without sudo) and symlinks `/usr/local/bin/twg` to it so it is on every `PATH`
+3. **Disables telemetry** unless `enableTelemetry` is `true` (see below)
+4. **Persists `~/.config/twg`** on a per-dev-container named volume when `persistAuth` is `true`, so you only log in once
+5. **Optionally installs TWG agent skills** (`installSkills`)
+6. **Installs an `xdg-open` shim** (when `configureBrowser` is `true`) so the OAuth login opens in your host browser
+
+Supported architectures: `x86_64` and `arm64` (Linux, glibc).
+
+## Getting Started
+
+Authenticate once, then check the setup:
+
+```bash
+twg login     # OAuth device authorization: open the printed URL (or let $BROWSER open it) and approve
+twg doctor
+```
+
+Then, for example:
+
+```bash
+twg jira --help
+twg confluence --help
+twg --output json jira ...
+```
+
+## Authenticating with Environment Variables
+
+Instead of `twg login`, every `twg` command reads `TWG_TOKEN`, `TWG_USER` and `TWG_SITE` directly. A Feature can't safely set these (its `containerEnv` is baked into the image), so pass them from your host in your own `devcontainer.json` with `remoteEnv`:
+
+```json
+{
+  "features": {
+    "ghcr.io/rosstaco/devcontainer-features/atlassian-teamwork-graph-cli:1": {}
+  },
+  "remoteEnv": {
+    "TWG_TOKEN": "${localEnv:TWG_TOKEN}",
+    "TWG_USER": "${localEnv:TWG_USER}",
+    "TWG_SITE": "${localEnv:TWG_SITE}"
+  }
+}
+```
+
+`remoteEnv` values are applied to the processes VS Code (or the dev container CLI) starts and are not written to the image. Never commit a token to `devcontainer.json`.
+
+## Telemetry
+
+With `enableTelemetry` set to `false` (the default), the Feature writes `/etc/atlassian-teamwork-graph-cli/env.sh`:
+
+```bash
+export DO_NOT_TRACK=1
+export TWG_DISABLE_3P_DATA_TELEMETRY=1
+```
+
+It is sourced by login shells via `/etc/profile.d/atlassian-teamwork-graph-cli.sh` and by non-interactive bash via `BASH_ENV` (`/etc/atlassian-teamwork-graph-cli/bash_env`, which chains to any `BASH_ENV` set before this Feature). `DO_NOT_TRACK` is the [Console Do Not Track](https://consoledonottrack.com/) convention, so other tools that honour it will also stop sending telemetry. Set `enableTelemetry` to `true` to skip this.
+
+## Persisted Login
+
+`twg` keeps its credentials and settings in `~/.config/twg`. The Feature always mounts a named volume at `/twg-config` (dev container mounts can't depend on options). With `persistAuth` set to `true` (the default), `~/.config/twg` is a symlink to that volume, so `twg login` survives rebuilds. Set `persistAuth` to `false` to keep the config in the container instead. To log out, run `twg logout`, or remove the `<devcontainerId>-twg-config` volume.
+
+## Agent Skills
+
+With `installSkills` set to `true`, the Feature runs `twg skills install --yes` as the remote user, installing the TWG skills into `~/.agents/skills` (used by Copilot, Codex, Cursor, Gemini and other `.agents/skills`-compatible agents) and `~/.claude/skills`. They are reinstalled on every rebuild. You can also run `twg skills install` yourself.
+
+## Browser Login in a Dev Container
+
+`twg login` tries to open the OAuth page with `xdg-open`, which doesn't honour `$BROWSER` inside a dev container. With `configureBrowser` enabled, this Feature installs a small `xdg-open` shim at `/usr/local/bin/xdg-open` that prefers `$BROWSER` (for example the VS Code browser helper) and falls back to the real `xdg-open` otherwise. `twg login` also prints the URL, so you can open it yourself. The shim is the same one the `atlassian-jira-confluence-cli` Feature installs.
+
+## Versions and Upgrades
+
+`latest` installs the current stable release at build time. Atlassian publishes a minimum supported version and blocks older builds, so a pinned `version` may stop working over time. `twg upgrade` works inside the container, but the image installs the configured version again on the next rebuild.
diff --git a/src/atlassian-teamwork-graph-cli/README.md b/src/atlassian-teamwork-graph-cli/README.md
@@ -0,0 +1,107 @@
+
+# Atlassian Teamwork Graph CLI (twg) (atlassian-teamwork-graph-cli)
+
+Installs the Atlassian Teamwork Graph CLI (twg) for working with Jira, Confluence, Bitbucket, JSM, Loom, Trello and the Teamwork Graph from the command line and from AI coding agents
+
+## Example Usage
+
+```json
+"features": {
+    "ghcr.io/rosstaco/devcontainer-features/atlassian-teamwork-graph-cli:1": {}
+}
+```
+
+## Options
+
+| Options Id | Description | Type | Default Value |
+|-----|-----|-----|-----|
+| version | Version of twg to install. Use 'latest' (current stable release) or a specific version like '1.3.5'. Atlassian blocks versions below a published minimum, so old pins may stop working | string | latest |
+| installSkills | Run 'twg skills install --yes' for the remote user, installing TWG agent skills into ~/.agents/skills and ~/.claude/skills | boolean | false |
+| enableTelemetry | Allow twg runtime telemetry. When false (the default), DO_NOT_TRACK=1 and TWG_DISABLE_3P_DATA_TELEMETRY=1 are exported for login shells (/etc/profile.d) and non-interactive bash (BASH_ENV) | boolean | false |
+| persistAuth | Symlink ~/.config/twg (credentials, site, settings) to a per-dev-container named volume so 'twg login' survives container rebuilds | boolean | true |
+| configureBrowser | Install an xdg-open shim in /usr/local/bin that prefers $BROWSER (e.g. the VS Code browser helper) so 'twg login' opens the OAuth page on your host instead of failing inside the container | boolean | true |
+
+## About
+
+The [Atlassian Teamwork Graph CLI](https://developer.atlassian.com/platform/teamwork-graph/twg-cli/) (`twg`) is Atlassian's CLI for the Teamwork Graph and Atlassian Cloud: Jira, Confluence, Jira Service Management, Bitbucket, Loom, Trello, Goals, Assets and more. It is designed to be driven by AI coding agents as well as people, and complements the [Atlassian CLI (`acli`)](https://github.com/rosstaco/devcontainer-features/tree/main/src/atlassian-jira-confluence-cli). Both Features can be used together.
+
+## How It Works
+
+Atlassian's official installer (`curl … /cli/install | bash`) also runs `twg setup`, which asks you to accept the Atlassian agreements, installs agent skills and starts an interactive OAuth login on the controlling terminal. None of that can happen while an image is being built, so this Feature:
+
+1. **Downloads the official binary** from `teamwork-graph.atlassian.com/cli` (`latest` is resolved from the stable `manifest.json`) and **verifies its SHA-256** against the published `SHA256SUMS`
+2. **Installs it for the remote user** at `~/.local/bin/twg` (twg's default location, user-owned so `twg upgrade` works without sudo) and symlinks `/usr/local/bin/twg` to it so it is on every `PATH`
+3. **Disables telemetry** unless `enableTelemetry` is `true` (see below)
+4. **Persists `~/.config/twg`** on a per-dev-container named volume when `persistAuth` is `true`, so you only log in once
+5. **Optionally installs TWG agent skills** (`installSkills`)
+6. **Installs an `xdg-open` shim** (when `configureBrowser` is `true`) so the OAuth login opens in your host browser
+
+Supported architectures: `x86_64` and `arm64` (Linux, glibc).
+
+## Getting Started
+
+Authenticate once, then check the setup:
+
+```bash
+twg login     # OAuth device authorization: open the printed URL (or let $BROWSER open it) and approve
+twg doctor
+```
+
+Then, for example:
+
+```bash
+twg jira --help
+twg confluence --help
+twg --output json jira ...
+```
+
+## Authenticating with Environment Variables
+
+Instead of `twg login`, every `twg` command reads `TWG_TOKEN`, `TWG_USER` and `TWG_SITE` directly. A Feature can't safely set these (its `containerEnv` is baked into the image), so pass them from your host in your own `devcontainer.json` with `remoteEnv`:
+
+```json
+{
+  "features": {
+    "ghcr.io/rosstaco/devcontainer-features/atlassian-teamwork-graph-cli:1": {}
+  },
+  "remoteEnv": {
+    "TWG_TOKEN": "${localEnv:TWG_TOKEN}",
+    "TWG_USER": "${localEnv:TWG_USER}",
+    "TWG_SITE": "${localEnv:TWG_SITE}"
+  }
+}
+```
+
+`remoteEnv` values are applied to the processes VS Code (or the dev container CLI) starts and are not written to the image. Never commit a token to `devcontainer.json`.
+
+## Telemetry
+
+With `enableTelemetry` set to `false` (the default), the Feature writes `/etc/atlassian-teamwork-graph-cli/env.sh`:
+
+```bash
+export DO_NOT_TRACK=1
+export TWG_DISABLE_3P_DATA_TELEMETRY=1
+```
+
+It is sourced by login shells via `/etc/profile.d/atlassian-teamwork-graph-cli.sh` and by non-interactive bash via `BASH_ENV` (`/etc/atlassian-teamwork-graph-cli/bash_env`, which chains to any `BASH_ENV` set before this Feature). `DO_NOT_TRACK` is the [Console Do Not Track](https://consoledonottrack.com/) convention, so other tools that honour it will also stop sending telemetry. Set `enableTelemetry` to `true` to skip this.
+
+## Persisted Login
+
+`twg` keeps its credentials and settings in `~/.config/twg`. The Feature always mounts a named volume at `/twg-config` (dev container mounts can't depend on options). With `persistAuth` set to `true` (the default), `~/.config/twg` is a symlink to that volume, so `twg login` survives rebuilds. Set `persistAuth` to `false` to keep the config in the container instead. To log out, run `twg logout`, or remove the `<devcontainerId>-twg-config` volume.
+
+## Agent Skills
+
+With `installSkills` set to `true`, the Feature runs `twg skills install --yes` as the remote user, installing the TWG skills into `~/.agents/skills` (used by Copilot, Codex, Cursor, Gemini and other `.agents/skills`-compatible agents) and `~/.claude/skills`. They are reinstalled on every rebuild. You can also run `twg skills install` yourself.
+
+## Browser Login in a Dev Container
+
+`twg login` tries to open the OAuth page with `xdg-open`, which doesn't honour `$BROWSER` inside a dev container. With `configureBrowser` enabled, this Feature installs a small `xdg-open` shim at `/usr/local/bin/xdg-open` that prefers `$BROWSER` (for example the VS Code browser helper) and falls back to the real `xdg-open` otherwise. `twg login` also prints the URL, so you can open it yourself. The shim is the same one the `atlassian-jira-confluence-cli` Feature installs.
+
+## Versions and Upgrades
+
+`latest` installs the current stable release at build time. Atlassian publishes a minimum supported version and blocks older builds, so a pinned `version` may stop working over time. `twg upgrade` works inside the container, but the image installs the configured version again on the next rebuild.
+
+
+---
+
+_Note: This file was auto-generated from the [devcontainer-feature.json](https://github.com/rosstaco/devcontainer-features/blob/main/src/atlassian-teamwork-graph-cli/devcontainer-feature.json).  Add additional notes to a `NOTES.md`._
diff --git a/src/atlassian-teamwork-graph-cli/devcontainer-feature.json b/src/atlassian-teamwork-graph-cli/devcontainer-feature.json
@@ -0,0 +1,62 @@
+{
+  "id": "atlassian-teamwork-graph-cli",
+  "version": "1.0.0",
+  "name": "Atlassian Teamwork Graph CLI (twg)",
+  "description": "Installs the Atlassian Teamwork Graph CLI (twg) for working with Jira, Confluence, Bitbucket, JSM, Loom, Trello and the Teamwork Graph from the command line and from AI coding agents",
+  "documentationURL": "https://github.com/rosstaco/devcontainer-features/tree/main/src/atlassian-teamwork-graph-cli",
+  "options": {
+    "version": {
+      "type": "string",
+      "proposals": [
+        "latest"
+      ],
+      "default": "latest",
+      "description": "Version of twg to install. Use 'latest' (current stable release) or a specific version like '1.3.5'. Atlassian blocks versions below a published minimum, so old pins may stop working"
+    },
+    "installSkills": {
+      "type": "boolean",
+      "default": false,
+      "description": "Run 'twg skills install --yes' for the remote user, installing TWG agent skills into ~/.agents/skills and ~/.claude/skills"
+    },
+    "enableTelemetry": {
+      "type": "boolean",
+      "default": false,
+      "description": "Allow twg runtime telemetry. When false (the default), DO_NOT_TRACK=1 and TWG_DISABLE_3P_DATA_TELEMETRY=1 are exported for login shells (/etc/profile.d) and non-interactive bash (BASH_ENV)"
+    },
+    "persistAuth": {
+      "type": "boolean",
+      "default": true,
+      "description": "Symlink ~/.config/twg (credentials, site, settings) to a per-dev-container named volume so 'twg login' survives container rebuilds"
+    },
+    "configureBrowser": {
+      "type": "boolean",
+      "default": true,
+      "description": "Install an xdg-open shim in /usr/local/bin that prefers $BROWSER (e.g. the VS Code browser helper) so 'twg login' opens the OAuth page on your host instead of failing inside the container"
+    }
+  },
+  "mounts": [
+    {
+      "source": "${devcontainerId}-twg-config",
+      "target": "/twg-config",
+      "type": "volume"
+    }
+  ],
+  "containerEnv": {
+    "ATLASSIAN_TEAMWORK_GRAPH_CLI_PREV_BASH_ENV": "${BASH_ENV}",
+    "BASH_ENV": "/etc/atlassian-teamwork-graph-cli/bash_env"
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {
+        "github.copilot.chat.codeGeneration.instructions": [
+          {
+            "text": "This dev container includes `twg`, the Atlassian Teamwork Graph CLI, pre-installed and available on the `PATH`. Use it to work with Jira, Confluence, Bitbucket, JSM and other Atlassian Cloud products from the command line (run `twg --help` to discover commands, and prefer `--output json` for machine-readable output). Authenticate with `twg login` (interactive) or the `TWG_TOKEN`/`TWG_USER`/`TWG_SITE` environment variables; never ask for, echo or log a token."
+          }
+        ]
+      }
+    }
+  },
+  "installsAfter": [
+    "ghcr.io/devcontainers/features/common-utils"
+  ]
+}