@covibes/zeroshot 5.3.0 → 5.4.0

package/cluster-templates/base-templates/worker-validator.json

@@ -37,8 +37,44 @@
       "role": "implementation",
       "modelLevel": "{{worker_level}}",
       "timeout": "{{timeout}}",
+      "outputFormat": "json",
+      "jsonSchema": {
+        "type": "object",
+        "properties": {
+          "summary": {
+            "type": "string",
+            "description": "Brief description of work done this iteration"
+          },
+          "completionStatus": {
+            "type": "object",
+            "description": "Self-assessment of completion state",
+            "properties": {
+              "canValidate": {
+                "type": "boolean",
+                "description": "true if work is ready for validator review, false if more work needed"
+              },
+              "percentComplete": {
+                "type": "number",
+                "description": "Estimated completion percentage (0-100)"
+              },
+              "blockers": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Issues preventing completion (empty if canValidate=true)"
+              },
+              "nextSteps": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Remaining work items (empty if canValidate=true)"
+              }
+            },
+            "required": ["canValidate", "percentComplete"]
+          }
+        },
+        "required": ["summary", "completionStatus"]
+      },
       "prompt": {
-        "system": "## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are an implementation agent for a SIMPLE {{task_type}} task.\n\n## FIRST ITERATION\n\n{{#if task_type == 'TASK'}}\nImplement the requested feature/change:\n- Well-defined scope (one feature, one fix)\n- Standard patterns apply\n- Complete the implementation fully\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nInvestigate and fix the issue:\n- Reproduce the problem\n- Find the root cause (not just symptoms)\n- Apply the fix\n- Verify it works\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nResearch and provide detailed answers:\n- Explore relevant code and documentation\n- Explain how things work\n- Provide accurate, complete information\n{{/if}}\n\n## SUBSEQUENT ITERATIONS (after rejection)\n\nYou are being called back because validators REJECTED your implementation. This is NOT a minor issue.\n\n### FIX LIKE A SENIOR ENGINEER\n\n1. **STOP AND UNDERSTAND FIRST**\n   - Read ALL VALIDATION_RESULT messages completely\n   - Understand WHY each issue exists, not just WHAT it is\n   - Trace the root cause - don't patch symptoms\n\n2. **FIX PROPERLY - NO SHORTCUTS**\n   - Fix the ACTUAL problem, not the error message\n   - If your approach was wrong, redesign it - don't add band-aids\n   - Consider architectural implications of your fix\n   - A senior dev would be embarrassed to submit a half-fix\n\n3. **VERIFY YOUR FIX**\n   - Test your changes actually work\n   - Check you didn't break anything else\n   - If unsure, investigate before committing\n\n### MINDSET\n- Validators are senior engineers reviewing your code\n- They found REAL problems - take them seriously\n- Shortcuts will be caught and rejected again"
+        "system": "## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are an implementation agent for a SIMPLE {{task_type}} task.\n\n## FIRST ITERATION\n\n{{#if task_type == 'TASK'}}\nImplement the requested feature/change:\n- Well-defined scope (one feature, one fix)\n- Standard patterns apply\n- Complete the implementation fully\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nInvestigate and fix the issue:\n- Reproduce the problem\n- Find the root cause (not just symptoms)\n- Apply the fix\n- Verify it works\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nResearch and provide detailed answers:\n- Explore relevant code and documentation\n- Explain how things work\n- Provide accurate, complete information\n{{/if}}\n\n## SUBSEQUENT ITERATIONS (after rejection)\n\nYou are being called back because validators REJECTED your implementation. This is NOT a minor issue.\n\n### FIX LIKE A SENIOR ENGINEER\n\n1. **STOP AND UNDERSTAND FIRST**\n   - Read ALL VALIDATION_RESULT messages completely\n   - Understand WHY each issue exists, not just WHAT it is\n   - Trace the root cause - don't patch symptoms\n\n2. **FIX PROPERLY - NO SHORTCUTS**\n   - Fix the ACTUAL problem, not the error message\n   - If your approach was wrong, redesign it - don't add band-aids\n   - Consider architectural implications of your fix\n   - A senior dev would be embarrassed to submit a half-fix\n\n3. **VERIFY YOUR FIX**\n   - Test your changes actually work\n   - Check you didn't break anything else\n   - If unsure, investigate before committing\n\n### MINDSET\n- Validators are senior engineers reviewing your code\n- They found REAL problems - take them seriously\n- Shortcuts will be caught and rejected again\n\n## 🔴 COMPLETION SELF-ASSESSMENT (REQUIRED)\n\nYour output MUST include a `completionStatus` object with honest self-assessment:\n\n**Set canValidate: true** when:\n- All work for this iteration is complete\n- Code compiles/runs without errors\n- You would be confident submitting for review\n\n**Set canValidate: false** when:\n- Work is partially complete\n- Blocked by an issue you're working around\n- Code doesn't compile or has obvious bugs\n\nValidators cost money. If you're not done, say so - your WORKER_PROGRESS message will let you continue."
       },
       "contextStrategy": {
         "sources": [
@@ -46,6 +82,11 @@
             "topic": "ISSUE_OPENED",
             "limit": 1
           },
+          {
+            "topic": "WORKER_PROGRESS",
+            "since": "last_task_end",
+            "limit": 3
+          },
           {
             "topic": "VALIDATION_RESULT",
             "since": "last_task_end",
@@ -60,6 +101,14 @@
           "topic": "ISSUE_OPENED",
           "action": "execute_task"
         },
+        {
+          "topic": "WORKER_PROGRESS",
+          "logic": {
+            "engine": "javascript",
+            "script": "return message.sender === 'worker';"
+          },
+          "action": "execute_task"
+        },
         {
           "topic": "VALIDATION_RESULT",
           "logic": {
@@ -75,8 +124,15 @@
           "config": {
             "topic": "IMPLEMENTATION_READY",
             "content": {
-              "text": "Implementation complete. Ready for validation."
+              "text": "{{result.summary}}",
+              "data": {
+                "completionStatus": "{{result.completionStatus}}"
+              }
             }
+          },
+          "logic": {
+            "engine": "javascript",
+            "script": "if (!result.completionStatus?.canValidate) return { topic: 'WORKER_PROGRESS' };"
           }
         }
       },
@@ -110,7 +166,7 @@
         "required": ["approved", "summary", "errors"]
       },
       "prompt": {
-        "system": "## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are a validator for a SIMPLE {{task_type}} task.\n\n## 🔴 VERIFICATION PROTOCOL (REQUIRED - PREVENTS FALSE CLAIMS)\n\nBefore making ANY claim about missing functionality or code issues:\n\n1. **SEARCH FIRST** - Use Glob to find ALL relevant files\n2. **READ THE CODE** - Use Read to inspect actual implementation\n3. **GREP FOR PATTERNS** - Use Grep to search for specific code (function names, endpoints, etc.)\n\n**NEVER claim something doesn't exist without FIRST searching for it.**\n\nThe worker may have implemented features in different files than originally planned. If you claim '/api/metrics endpoint is missing' without searching, you may miss that it exists in 'server/routes/health.ts' instead of 'server/routes/api.ts'.\n\n### Example Verification Flow:\n```\n1. Claim: 'Missing error handling for network failures'\n2. BEFORE claiming → Grep for 'catch', 'error', 'try' in relevant files\n3. BEFORE claiming → Read the actual implementation\n4. ONLY IF NOT FOUND → Add to errors array\n```\n\n## VALIDATION CRITERIA\n\n**APPROVE** if:\n- Core functionality works as requested\n- Implementation is correct and complete\n- No obvious bugs or critical issues\n\n**REJECT** if:\n- Major functionality is missing or broken (VERIFIED by searching)\n- Implementation doesn't match requirements (VERIFIED by reading code)\n- Critical bugs present (VERIFIED by inspection)\n\n## TASK TYPE: {{task_type}}\n\n{{#if task_type == 'TASK'}}\nVerify the feature/change works correctly.\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nVerify the bug is actually fixed at root cause.\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nVerify the information is accurate and complete.\n{{/if}}\n\nFor SIMPLE tasks, don't nitpick. Focus on: Does it work and meet requirements?\n\n## 🔴 DEBUGGING METHODOLOGY CHECK\n\nBefore approving, verify the worker didn't take shortcuts:\n\n### Ad Hoc Fix Detection\n- Did worker fix ONE instance? → Grep for similar patterns. If N > 1 exists, REJECT.\n- Example: Fixed null check in `auth.ts:42`? → `grep -r \"similar pattern\" .` - are there others?\n\n### Root Cause vs Symptom\n- Did worker add a workaround? → Find the ACTUAL bug. If workaround hides real issue, REJECT.\n- Example: Added `|| []` fallback? → WHY is it undefined? Fix THAT.\n\n### Lazy Debugging Red Flags (INSTANT REJECT)\n- Worker suggests \"restart the service\" → REJECT (hides the bug)\n- Worker suggests \"clear the cache\" → REJECT (hides the bug)\n- Worker says \"works on my machine\" → REJECT (not a fix)\n- Worker blames the test → REJECT unless they PROVE test is wrong with evidence"
+        "system": "## 🔴 OUTPUT FORMAT (CRITICAL - READ FIRST)\n\nYour output MUST be MINIMAL and STRUCTURED:\n- Output ONLY the required JSON schema fields\n- NO preambles (\"Here is my analysis...\", \"Let me explain...\")\n- NO verbose summaries - be CONCISE (max 100 chars per string field)\n- NO redundant information\n- NO explanations before or after the JSON\n\n## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are a validator for a SIMPLE {{task_type}} task.\n\n## 🔴 VERIFICATION PROTOCOL (REQUIRED - PREVENTS FALSE CLAIMS)\n\nBefore making ANY claim about missing functionality or code issues:\n\n1. **SEARCH FIRST** - Use Glob to find ALL relevant files\n2. **READ THE CODE** - Use Read to inspect actual implementation\n3. **GREP FOR PATTERNS** - Use Grep to search for specific code (function names, endpoints, etc.)\n\n**NEVER claim something doesn't exist without FIRST searching for it.**\n\nThe worker may have implemented features in different files than originally planned. If you claim '/api/metrics endpoint is missing' without searching, you may miss that it exists in 'server/routes/health.ts' instead of 'server/routes/api.ts'.\n\n### Example Verification Flow:\n```\n1. Claim: 'Missing error handling for network failures'\n2. BEFORE claiming → Grep for 'catch', 'error', 'try' in relevant files\n3. BEFORE claiming → Read the actual implementation\n4. ONLY IF NOT FOUND → Add to errors array\n```\n\n## VALIDATION CRITERIA\n\n**APPROVE** if:\n- Core functionality works as requested\n- Implementation is correct and complete\n- No obvious bugs or critical issues\n\n**REJECT** if:\n- Major functionality is missing or broken (VERIFIED by searching)\n- Implementation doesn't match requirements (VERIFIED by reading code)\n- Critical bugs present (VERIFIED by inspection)\n\n## TASK TYPE: {{task_type}}\n\n{{#if task_type == 'TASK'}}\nVerify the feature/change works correctly.\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nVerify the bug is actually fixed at root cause.\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nVerify the information is accurate and complete.\n{{/if}}\n\nFor SIMPLE tasks, don't nitpick. Focus on: Does it work and meet requirements?\n\n## 🔴 DEBUGGING METHODOLOGY CHECK\n\nBefore approving, verify the worker didn't take shortcuts:\n\n### Ad Hoc Fix Detection\n- Did worker fix ONE instance? → Grep for similar patterns. If N > 1 exists, REJECT.\n- Example: Fixed null check in `auth.ts:42`? → `grep -r \"similar pattern\" .` - are there others?\n\n### Root Cause vs Symptom\n- Did worker add a workaround? → Find the ACTUAL bug. If workaround hides real issue, REJECT.\n- Example: Added `|| []` fallback? → WHY is it undefined? Fix THAT.\n\n### Lazy Debugging Red Flags (INSTANT REJECT)\n- Worker suggests \"restart the service\" → REJECT (hides the bug)\n- Worker suggests \"clear the cache\" → REJECT (hides the bug)\n- Worker says \"works on my machine\" → REJECT (not a fix)\n- Worker blames the test → REJECT unless they PROVE test is wrong with evidence"
       },
       "contextStrategy": {
         "sources": [

package/cluster-templates/conductor-bootstrap.json

@@ -19,7 +19,7 @@
           "taskType": {
             "type": "string",
             "enum": ["INQUIRY", "TASK", "DEBUG"],
-            "description": "Type of work: INQUIRY (questions/exploration), TASK (implement new), DEBUG (fix broken)"
+            "description": "Type of work: INQUIRY (read-only), TASK (implement / known fix), DEBUG (investigate unknown root cause)"
           },
           "reasoning": {
             "type": "string",
@@ -29,7 +29,7 @@
         "required": ["complexity", "taskType", "reasoning"]
       },
       "prompt": {
-        "system": "You are the JUNIOR CONDUCTOR - fast task classification.\n\n## Your Job\nClassify the task on TWO dimensions.\n\n## COMPLEXITY (pick ONE)\n- TRIVIAL - One command, one file, mechanical\n- SIMPLE - One concern, straightforward\n- STANDARD - Multi-file, needs planning\n- CRITICAL - High risk (auth, payments, security, production)\n- UNCERTAIN - Escalate to senior conductor\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration, read-only\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"How does auth work?\"\n```json\n{\"complexity\": \"SIMPLE\", \"taskType\": \"INQUIRY\", \"reasoning\": \"Asking about existing code\"}\n```\n\nTask: \"Add rate limiting\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"New feature, multiple files\"}\n```\n\nTask: \"Fix null pointer bug\"\n```json\n{\"complexity\": \"SIMPLE\", \"taskType\": \"DEBUG\", \"reasoning\": \"Fixing broken code\"}\n```\n\n## Critical Rules\n1. Output ONLY valid JSON - no other text\n2. complexity must be EXACTLY one of: TRIVIAL, SIMPLE, STANDARD, CRITICAL, UNCERTAIN\n3. taskType must be EXACTLY one of: INQUIRY, TASK, DEBUG\n\nTask: {{ISSUE_OPENED.content.text}}"
+        "system": "You are the JUNIOR CONDUCTOR - fast task classification.\n\n## Your Job\nClassify the task on TWO dimensions.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives. CRITICAL is rare.\n\n## COMPLEXITY (pick ONE)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing (not just displaying it).\n- UNCERTAIN - Escalate to senior conductor.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive. Reserve it for actual risk.\n\n## NOT CRITICAL (Common False Positives)\n\nThese are STANDARD, not CRITICAL:\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types for existing structures\n- Code cleanup in infra-related files\n- Read-only queries to production data\n- Tests for auth/billing code (tests don't touch prod)\n- Extracting modules or services (code organization)\n- Factory patterns, dependency injection (architecture)\n- Config file reorganization (not production config values)\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration, read-only\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Explain current auth flow (read-only)\"\n```json\n{\"complexity\": \"SIMPLE\", \"taskType\": \"INQUIRY\", \"reasoning\": \"Read-only explanation\"}\n```\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Refactoring code organization, not modifying auth logic\"}\n```\n\nTask: \"Add TypeScript types to payment types\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Adding types, not modifying billing logic\"}\n```\n\nTask: \"Fix bug in password validation logic\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying authentication logic\"}\n```\n\nTask: \"Add new payment method integration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing/payment processing code\"}\n```\n\nTask: \"Rotate production API keys\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Modifying production secrets\"}\n```\n\nTask: \"DROP TABLE users migration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Destructive database operation\"}\n```\n\n## Critical Rules\n1. Output ONLY valid JSON - no other text\n2. complexity must be EXACTLY one of: TRIVIAL, SIMPLE, STANDARD, CRITICAL, UNCERTAIN\n3. taskType must be EXACTLY one of: INQUIRY, TASK, DEBUG\n\nTask: {{ISSUE_OPENED.content.text}}"
       },
       "contextStrategy": {
         "sources": [{ "topic": "ISSUE_OPENED", "limit": 1 }],
@@ -73,7 +73,7 @@
           "taskType": {
             "type": "string",
             "enum": ["INQUIRY", "TASK", "DEBUG"],
-            "description": "Type of work after analysis"
+            "description": "Type of work after analysis (INQUIRY/TASK/DEBUG)"
           },
           "reasoning": {
             "type": "string",
@@ -83,7 +83,7 @@
         "required": ["complexity", "taskType", "reasoning"]
       },
       "prompt": {
-        "system": "You are the SENIOR CONDUCTOR - expert task analyzer.\n\nThe junior conductor was uncertain. Make a definitive classification.\n\n## COMPLEXITY (pick ONE - no UNCERTAIN allowed)\n- TRIVIAL - One command/file, mechanical\n- SIMPLE - One concern, straightforward\n- STANDARD - Multi-file, needs planning\n- CRITICAL - High risk (auth/payments/security/production)\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration (read-only)\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Example Output\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Multiple files involved, new feature\"}\n```\n\n## Rules\n1. Output ONLY valid JSON - no other text\n2. YOU MUST DECIDE - pick exactly one value for each field\n3. When in doubt, go ONE LEVEL HIGHER for complexity\n\nJunior was uncertain. Original task follows."
+        "system": "You are the SENIOR CONDUCTOR - expert task analyzer.\n\nThe junior conductor was uncertain. Make a definitive classification.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives.\n\n## COMPLEXITY (pick ONE - no UNCERTAIN allowed)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive.\n\n## NOT CRITICAL (Common False Positives)\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types, tests, code organization\n- Read-only queries, config reorganization\n- Factory patterns, dependency injection\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration (read-only)\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Code refactor, not modifying auth logic\"}\n```\n\nTask: \"Fix bug in password validation\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying auth logic\"}\n```\n\nTask: \"Add payment method\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing code\"}\n```\n\n## Rules\n1. Output ONLY valid JSON - no other text\n2. YOU MUST DECIDE - pick exactly one value for each field\n3. When unsure between STANDARD and CRITICAL → STANDARD\n\nJunior was uncertain. Original task follows."
       },
       "contextStrategy": {
         "sources": [

package/lib/docker-config.js

@@ -21,6 +21,11 @@ const MOUNT_PRESETS = {
   claude: { host: '~/.claude', container: '$HOME/.claude', readonly: true },
   codex: { host: '~/.config/codex', container: '$HOME/.config/codex', readonly: true },
   gemini: { host: '~/.config/gemini', container: '$HOME/.config/gemini', readonly: true },
+  opencode: {
+    host: '~/.local/share/opencode',
+    container: '$HOME/.local/share/opencode',
+    readonly: true,
+  },
 };
 
 /**
@@ -31,12 +36,15 @@ const MOUNT_PRESETS = {
  * - Forced: 'VAR=value' (always set to value)
  * - Empty: 'VAR=' (always set to empty string)
  */
+const { CLAUDE_AUTH_ENV_VARS } = require('./settings/claude-auth');
+
 const ENV_PRESETS = {
   aws: ['AWS_REGION', 'AWS_DEFAULT_REGION', 'AWS_PROFILE', 'AWS_PAGER='],
   azure: ['AZURE_SUBSCRIPTION_ID', 'AZURE_TENANT_ID', 'AZURE_CLIENT_ID'],
   gcloud: ['CLOUDSDK_CORE_PROJECT', 'GOOGLE_CLOUD_PROJECT'],
   kube: ['KUBECONFIG'],
   terraform: ['TF_VAR_*'],
+  claude: CLAUDE_AUTH_ENV_VARS,
 };
 
 /**

package/lib/git-remote-utils.js

@@ -0,0 +1,165 @@
+/**
+ * Git remote URL parsing and provider detection.
+ * Automatically detects issue provider from git remote URL.
+ */
+
+const { execSync } = require('../src/lib/safe-exec');
+
+/**
+ * Parse git remote URL into structured provider context.
+ * Supports GitHub, GitLab, and Azure DevOps (cloud + self-hosted).
+ * Handles both HTTPS and SSH URL formats.
+ *
+ * @param {string} remoteUrl - Git remote URL
+ * @returns {Object|null} Provider context or null if unparseable
+ *
+ * @example
+ * parseGitRemoteUrl('https://github.com/org/repo.git')
+ * // → { provider: 'github', host: 'github.com', org: 'org', repo: 'repo', fullRepo: 'org/repo' }
+ *
+ * @example
+ * parseGitRemoteUrl('git@gitlab.com:org/repo.git')
+ * // → { provider: 'gitlab', host: 'gitlab.com', org: 'org', repo: 'repo', fullRepo: 'org/repo' }
+ *
+ * @example
+ * parseGitRemoteUrl('https://dev.azure.com/myorg/myproject/_git/myrepo')
+ * // → { provider: 'azure-devops', host: 'dev.azure.com', azureOrg: 'https://dev.azure.com/myorg', azureProject: 'myproject', repo: 'myrepo' }
+ */
+function parseGitRemoteUrl(remoteUrl) {
+  if (!remoteUrl || typeof remoteUrl !== 'string') {
+    return null;
+  }
+
+  const url = remoteUrl.trim();
+
+  // Normalize SSH URLs to HTTPS format for easier parsing
+  // git@host:path → https://host/path
+  let normalizedUrl = url;
+  const sshMatch = url.match(/^git@([^:]+):(.+)$/);
+  if (sshMatch) {
+    const [, host, path] = sshMatch;
+    normalizedUrl = `https://${host}/${path}`;
+  }
+
+  // Remove .git suffix if present
+  normalizedUrl = normalizedUrl.replace(/\.git$/, '');
+
+  // Azure DevOps: https://dev.azure.com/org/project/_git/repo
+  // Azure Legacy: https://org.visualstudio.com/project/_git/repo
+  // Azure SSH: git@ssh.dev.azure.com:v3/org/project/repo
+  const azureMatch =
+    normalizedUrl.match(/https:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)/) ||
+    normalizedUrl.match(/https:\/\/([^.]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)/) ||
+    // After normalization, `git@ssh.dev.azure.com:v3/org/project/repo` becomes
+    // `https://ssh.dev.azure.com/v3/org/project/repo`
+    normalizedUrl.match(/https:\/\/ssh\.dev\.azure\.com\/v3\/([^/]+)\/([^/]+)\/([^/]+)/);
+
+  if (azureMatch) {
+    const [, orgPart, project, repo] = azureMatch;
+    // For dev.azure.com, org is the first path segment
+    // For visualstudio.com, org is the subdomain
+    const isLegacy = normalizedUrl.includes('visualstudio.com');
+    const azureOrg = isLegacy
+      ? `https://${orgPart}.visualstudio.com`
+      : `https://dev.azure.com/${orgPart}`;
+
+    return {
+      provider: 'azure-devops',
+      host: isLegacy ? `${orgPart}.visualstudio.com` : 'dev.azure.com',
+      azureOrg,
+      azureProject: project,
+      repo,
+    };
+  }
+
+  // GitHub: https://github.com/org/repo
+  // GitLab: https://gitlab.com/org/repo (or self-hosted)
+  // Generic: https://host/org/repo
+  const httpsMatch = normalizedUrl.match(/https?:\/\/([^/]+)\/([^/]+)\/([^/]+)/);
+  if (httpsMatch) {
+    const [, host, org, repo] = httpsMatch;
+
+    let provider = null;
+    if (host === 'github.com') {
+      provider = 'github';
+    } else if (host.includes('gitlab')) {
+      // Matches gitlab.com or any gitlab.* subdomain or *gitlab* in hostname
+      provider = 'gitlab';
+    } else {
+      // Unknown provider - could be self-hosted GitLab or other
+      // Return null to fall back to settings
+      return null;
+    }
+
+    return {
+      provider,
+      host,
+      org,
+      repo,
+      fullRepo: `${org}/${repo}`,
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Detect git repository context from current working directory.
+ * Returns provider context extracted from git remote URL.
+ *
+ * @param {string} [cwd=process.cwd()] - Directory to check
+ * @returns {Object|null} Git context or null
+ *
+ * Gracefully returns null for:
+ * - Not in git repository
+ * - No remote configured
+ * - Remote URL unparseable
+ * - Git command fails
+ *
+ * @example
+ * // In a GitHub repo with remote
+ * detectGitContext()
+ * // → { provider: 'github', host: 'github.com', org: 'myorg', repo: 'myrepo', fullRepo: 'myorg/myrepo' }
+ *
+ * @example
+ * // Not in git repo or no remote
+ * detectGitContext()
+ * // → null
+ */
+function detectGitContext(cwd = process.cwd()) {
+  try {
+    // Check if we're in a git repository
+    execSync('git rev-parse --git-dir', {
+      cwd,
+      stdio: 'pipe',
+      encoding: 'utf8',
+    });
+  } catch {
+    // Not a git repository
+    return null;
+  }
+
+  try {
+    // Try to get remote URL (origin by default)
+    const remoteUrl = execSync('git remote get-url origin', {
+      cwd,
+      stdio: 'pipe',
+      encoding: 'utf8',
+    }).trim();
+
+    if (!remoteUrl) {
+      return null;
+    }
+
+    // Parse the remote URL to extract provider context
+    return parseGitRemoteUrl(remoteUrl);
+  } catch {
+    // No remote configured or command failed
+    return null;
+  }
+}
+
+module.exports = {
+  parseGitRemoteUrl,
+  detectGitContext,
+};

package/lib/id-detector.js

@@ -3,17 +3,19 @@
  *
  * Strategy:
  * 1. Check if ID exists in cluster storage
- * 2. If not, check if ID exists in task storage
+ * 2. If not, check if ID exists in task storage (SQLite)
  * 3. Return type: 'cluster', 'task', or null
  */
 
 const path = require('path');
 const fs = require('fs');
 const os = require('os');
+const Database = require('better-sqlite3');
 
 // Storage paths
 const CLUSTER_DIR = path.join(os.homedir(), '.zeroshot');
 const TASK_DIR = path.join(os.homedir(), '.claude-zeroshot');
+const TASK_DB_FILE = path.join(TASK_DIR, 'store.db');
 
 /**
  * Detect if ID is a cluster or task
@@ -34,16 +36,17 @@ function detectIdType(id) {
     }
   }
 
-  // Check tasks
-  const taskFile = path.join(TASK_DIR, 'tasks.json');
-  if (fs.existsSync(taskFile)) {
+  // Check tasks in SQLite
+  if (fs.existsSync(TASK_DB_FILE)) {
     try {
-      const tasks = JSON.parse(fs.readFileSync(taskFile, 'utf8'));
-      if (tasks[id]) {
+      const db = new Database(TASK_DB_FILE, { readonly: true, timeout: 5000 });
+      const row = db.prepare('SELECT id FROM tasks WHERE id = ?').get(id);
+      db.close();
+      if (row) {
         return 'task';
       }
     } catch {
-      // Ignore parse errors
+      // Ignore DB errors
     }
   }
 

package/lib/provider-defaults.js

@@ -0,0 +1,62 @@
+/**
+ * Provider defaults module
+ *
+ * Separated from settings.js to break circular dependency:
+ * - settings.js requires provider defaults
+ * - providers require settings.js (for loadSettings, getClaudeCommand, etc.)
+ *
+ * CRITICAL: This module should NOT import from settings.js
+ */
+
+// Cache provider defaults to avoid repeated instantiation
+let _providerDefaultsCache = null;
+
+/**
+ * Build provider default settings by instantiating each provider
+ * and calling getDefaultSettings()
+ * @returns {Object} Map of provider name to default settings
+ */
+function buildProviderDefaults() {
+  const { listProviders, getProvider } = require('../src/providers');
+
+  const defaults = {};
+  for (const providerName of listProviders()) {
+    try {
+      const provider = getProvider(providerName);
+      defaults[providerName] = provider.getDefaultSettings();
+    } catch (error) {
+      // If provider fails to instantiate, use basic defaults
+      console.warn(`Warning: Could not get defaults for ${providerName}: ${error.message}`);
+      defaults[providerName] = {
+        maxLevel: 'level3',
+        minLevel: 'level1',
+        defaultLevel: 'level2',
+        levelOverrides: {},
+      };
+    }
+  }
+  return defaults;
+}
+
+/**
+ * Get or build cached provider defaults
+ * @returns {Object} Provider defaults
+ */
+function getProviderDefaults() {
+  if (!_providerDefaultsCache) {
+    _providerDefaultsCache = buildProviderDefaults();
+  }
+  return _providerDefaultsCache;
+}
+
+/**
+ * Clear the provider defaults cache (primarily for testing)
+ */
+function clearProviderDefaultsCache() {
+  _providerDefaultsCache = null;
+}
+
+module.exports = {
+  getProviderDefaults,
+  clearProviderDefaultsCache,
+};

package/lib/provider-names.js

@@ -5,9 +5,10 @@ const PROVIDER_ALIASES = {
   claude: 'claude',
   codex: 'codex',
   gemini: 'gemini',
+  opencode: 'opencode',
 };
 
-const VALID_PROVIDERS = ['claude', 'codex', 'gemini'];
+const VALID_PROVIDERS = ['claude', 'codex', 'gemini', 'opencode'];
 
 function normalizeProviderName(name) {
   if (!name || typeof name !== 'string') return name;

package/lib/settings/claude-auth.js

@@ -0,0 +1,78 @@
+/**
+ * Claude authentication settings and helpers
+ * Extracted from settings.js for provider-specific isolation
+ */
+
+/**
+ * Anthropic API key prefix for validation
+ */
+const ANTHROPIC_KEY_PREFIX = 'sk-ant-';
+
+/**
+ * Environment variables used for Claude authentication
+ */
+const CLAUDE_AUTH_ENV_VARS = [
+  'ANTHROPIC_API_KEY',
+  'AWS_BEARER_TOKEN_BEDROCK',
+  'AWS_REGION',
+  'CLAUDE_CODE_USE_BEDROCK',
+];
+
+/**
+ * Validate an Anthropic API key format
+ * @param {string|null|undefined} key - API key to validate
+ * @returns {boolean} True if key is falsy OR starts with valid prefix
+ */
+function isValidAnthropicKey(key) {
+  return !key || key.startsWith(ANTHROPIC_KEY_PREFIX);
+}
+
+/**
+ * Check if Bedrock mode is active based on env and overrides
+ * @param {Object} [envOverrides={}] - Environment variable overrides to check
+ * @returns {boolean} True if Bedrock mode is active
+ */
+function isBedrockMode(envOverrides = {}) {
+  return (
+    envOverrides.CLAUDE_CODE_USE_BEDROCK === '1' || process.env.CLAUDE_CODE_USE_BEDROCK === '1'
+  );
+}
+
+/**
+ * Resolve Claude authentication environment variables from settings
+ * Bedrock takes priority over direct Anthropic API key AND OAuth session
+ * @param {Object} settings - Settings object from loadSettings()
+ * @returns {Object} Environment variables to set for Claude auth
+ */
+function resolveClaudeAuth(settings) {
+  const claudeSettings = settings.providerSettings?.claude || {};
+  const env = {};
+
+  // Bedrock takes priority over everything (including OAuth)
+  if (!process.env.AWS_BEARER_TOKEN_BEDROCK && claudeSettings.bedrockApiKey) {
+    env.AWS_BEARER_TOKEN_BEDROCK = claudeSettings.bedrockApiKey;
+    env.CLAUDE_CODE_USE_BEDROCK = '1';
+    if (claudeSettings.bedrockRegion && !process.env.AWS_REGION) {
+      env.AWS_REGION = claudeSettings.bedrockRegion;
+    }
+  } else if (process.env.AWS_BEARER_TOKEN_BEDROCK && !process.env.CLAUDE_CODE_USE_BEDROCK) {
+    // Auto-set CLAUDE_CODE_USE_BEDROCK if token present in env
+    env.CLAUDE_CODE_USE_BEDROCK = '1';
+  }
+
+  // Anthropic API key only if no Bedrock
+  const hasBedrock = env.AWS_BEARER_TOKEN_BEDROCK || process.env.AWS_BEARER_TOKEN_BEDROCK;
+  if (!process.env.ANTHROPIC_API_KEY && !hasBedrock && claudeSettings.anthropicApiKey) {
+    env.ANTHROPIC_API_KEY = claudeSettings.anthropicApiKey;
+  }
+
+  return env;
+}
+
+module.exports = {
+  ANTHROPIC_KEY_PREFIX,
+  CLAUDE_AUTH_ENV_VARS,
+  isValidAnthropicKey,
+  isBedrockMode,
+  resolveClaudeAuth,
+};