@covibes/zeroshot 5.4.0 → 5.4.1

package/cluster-templates/base-templates/worker-validator.json

@@ -1,208 +0,0 @@
-{
-  "name": "Worker + Validator",
-  "description": "Worker implements, validator checks, rejection loop. For SIMPLE tasks.",
-  "params": {
-    "worker_level": {
-      "type": "string",
-      "enum": ["level1", "level2", "level3"],
-      "default": "level2"
-    },
-    "validator_level": {
-      "type": "string",
-      "enum": ["level1", "level2", "level3"],
-      "default": "level2"
-    },
-    "max_iterations": {
-      "type": "number",
-      "default": 3
-    },
-    "max_tokens": {
-      "type": "number",
-      "default": 100000
-    },
-    "timeout": {
-      "type": "number",
-      "default": 0,
-      "description": "Task timeout in milliseconds (0 = no timeout)"
-    },
-    "task_type": {
-      "type": "string",
-      "enum": ["INQUIRY", "TASK", "DEBUG"],
-      "description": "Type of work"
-    }
-  },
-  "agents": [
-    {
-      "id": "worker",
-      "role": "implementation",
-      "modelLevel": "{{worker_level}}",
-      "timeout": "{{timeout}}",
-      "outputFormat": "json",
-      "jsonSchema": {
-        "type": "object",
-        "properties": {
-          "summary": {
-            "type": "string",
-            "description": "Brief description of work done this iteration"
-          },
-          "completionStatus": {
-            "type": "object",
-            "description": "Self-assessment of completion state",
-            "properties": {
-              "canValidate": {
-                "type": "boolean",
-                "description": "true if work is ready for validator review, false if more work needed"
-              },
-              "percentComplete": {
-                "type": "number",
-                "description": "Estimated completion percentage (0-100)"
-              },
-              "blockers": {
-                "type": "array",
-                "items": { "type": "string" },
-                "description": "Issues preventing completion (empty if canValidate=true)"
-              },
-              "nextSteps": {
-                "type": "array",
-                "items": { "type": "string" },
-                "description": "Remaining work items (empty if canValidate=true)"
-              }
-            },
-            "required": ["canValidate", "percentComplete"]
-          }
-        },
-        "required": ["summary", "completionStatus"]
-      },
-      "prompt": {
-        "system": "## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are an implementation agent for a SIMPLE {{task_type}} task.\n\n## FIRST ITERATION\n\n{{#if task_type == 'TASK'}}\nImplement the requested feature/change:\n- Well-defined scope (one feature, one fix)\n- Standard patterns apply\n- Complete the implementation fully\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nInvestigate and fix the issue:\n- Reproduce the problem\n- Find the root cause (not just symptoms)\n- Apply the fix\n- Verify it works\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nResearch and provide detailed answers:\n- Explore relevant code and documentation\n- Explain how things work\n- Provide accurate, complete information\n{{/if}}\n\n## SUBSEQUENT ITERATIONS (after rejection)\n\nYou are being called back because validators REJECTED your implementation. This is NOT a minor issue.\n\n### FIX LIKE A SENIOR ENGINEER\n\n1. **STOP AND UNDERSTAND FIRST**\n   - Read ALL VALIDATION_RESULT messages completely\n   - Understand WHY each issue exists, not just WHAT it is\n   - Trace the root cause - don't patch symptoms\n\n2. **FIX PROPERLY - NO SHORTCUTS**\n   - Fix the ACTUAL problem, not the error message\n   - If your approach was wrong, redesign it - don't add band-aids\n   - Consider architectural implications of your fix\n   - A senior dev would be embarrassed to submit a half-fix\n\n3. **VERIFY YOUR FIX**\n   - Test your changes actually work\n   - Check you didn't break anything else\n   - If unsure, investigate before committing\n\n### MINDSET\n- Validators are senior engineers reviewing your code\n- They found REAL problems - take them seriously\n- Shortcuts will be caught and rejected again\n\n## 🔴 COMPLETION SELF-ASSESSMENT (REQUIRED)\n\nYour output MUST include a `completionStatus` object with honest self-assessment:\n\n**Set canValidate: true** when:\n- All work for this iteration is complete\n- Code compiles/runs without errors\n- You would be confident submitting for review\n\n**Set canValidate: false** when:\n- Work is partially complete\n- Blocked by an issue you're working around\n- Code doesn't compile or has obvious bugs\n\nValidators cost money. If you're not done, say so - your WORKER_PROGRESS message will let you continue."
-      },
-      "contextStrategy": {
-        "sources": [
-          {
-            "topic": "ISSUE_OPENED",
-            "limit": 1
-          },
-          {
-            "topic": "WORKER_PROGRESS",
-            "since": "last_task_end",
-            "limit": 3
-          },
-          {
-            "topic": "VALIDATION_RESULT",
-            "since": "last_task_end",
-            "limit": 3
-          }
-        ],
-        "format": "chronological",
-        "maxTokens": "{{max_tokens}}"
-      },
-      "triggers": [
-        {
-          "topic": "ISSUE_OPENED",
-          "action": "execute_task"
-        },
-        {
-          "topic": "WORKER_PROGRESS",
-          "logic": {
-            "engine": "javascript",
-            "script": "return message.sender === 'worker';"
-          },
-          "action": "execute_task"
-        },
-        {
-          "topic": "VALIDATION_RESULT",
-          "logic": {
-            "engine": "javascript",
-            "script": "const lastPush = ledger.findLast({ topic: 'IMPLEMENTATION_READY' });\nif (!lastPush) return false;\nconst response = ledger.findLast({ topic: 'VALIDATION_RESULT', since: lastPush.timestamp });\nreturn response?.content?.data?.approved === false || response?.content?.data?.approved === 'false';"
-          },
-          "action": "execute_task"
-        }
-      ],
-      "hooks": {
-        "onComplete": {
-          "action": "publish_message",
-          "config": {
-            "topic": "IMPLEMENTATION_READY",
-            "content": {
-              "text": "{{result.summary}}",
-              "data": {
-                "completionStatus": "{{result.completionStatus}}"
-              }
-            }
-          },
-          "logic": {
-            "engine": "javascript",
-            "script": "if (!result.completionStatus?.canValidate) return { topic: 'WORKER_PROGRESS' };"
-          }
-        }
-      },
-      "maxIterations": "{{max_iterations}}"
-    },
-    {
-      "id": "validator",
-      "role": "validator",
-      "modelLevel": "{{validator_level}}",
-      "timeout": "{{timeout}}",
-      "outputFormat": "json",
-      "jsonSchema": {
-        "type": "object",
-        "properties": {
-          "approved": {
-            "type": "boolean",
-            "description": "true if implementation is correct"
-          },
-          "summary": {
-            "type": "string",
-            "description": "One-line validation result"
-          },
-          "errors": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "Issues found (empty if approved)"
-          }
-        },
-        "required": ["approved", "summary", "errors"]
-      },
-      "prompt": {
-        "system": "## 🔴 OUTPUT FORMAT (CRITICAL - READ FIRST)\n\nYour output MUST be MINIMAL and STRUCTURED:\n- Output ONLY the required JSON schema fields\n- NO preambles (\"Here is my analysis...\", \"Let me explain...\")\n- NO verbose summaries - be CONCISE (max 100 chars per string field)\n- NO redundant information\n- NO explanations before or after the JSON\n\n## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are a validator for a SIMPLE {{task_type}} task.\n\n## 🔴 VERIFICATION PROTOCOL (REQUIRED - PREVENTS FALSE CLAIMS)\n\nBefore making ANY claim about missing functionality or code issues:\n\n1. **SEARCH FIRST** - Use Glob to find ALL relevant files\n2. **READ THE CODE** - Use Read to inspect actual implementation\n3. **GREP FOR PATTERNS** - Use Grep to search for specific code (function names, endpoints, etc.)\n\n**NEVER claim something doesn't exist without FIRST searching for it.**\n\nThe worker may have implemented features in different files than originally planned. If you claim '/api/metrics endpoint is missing' without searching, you may miss that it exists in 'server/routes/health.ts' instead of 'server/routes/api.ts'.\n\n### Example Verification Flow:\n```\n1. Claim: 'Missing error handling for network failures'\n2. BEFORE claiming → Grep for 'catch', 'error', 'try' in relevant files\n3. BEFORE claiming → Read the actual implementation\n4. ONLY IF NOT FOUND → Add to errors array\n```\n\n## VALIDATION CRITERIA\n\n**APPROVE** if:\n- Core functionality works as requested\n- Implementation is correct and complete\n- No obvious bugs or critical issues\n\n**REJECT** if:\n- Major functionality is missing or broken (VERIFIED by searching)\n- Implementation doesn't match requirements (VERIFIED by reading code)\n- Critical bugs present (VERIFIED by inspection)\n\n## TASK TYPE: {{task_type}}\n\n{{#if task_type == 'TASK'}}\nVerify the feature/change works correctly.\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nVerify the bug is actually fixed at root cause.\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nVerify the information is accurate and complete.\n{{/if}}\n\nFor SIMPLE tasks, don't nitpick. Focus on: Does it work and meet requirements?\n\n## 🔴 DEBUGGING METHODOLOGY CHECK\n\nBefore approving, verify the worker didn't take shortcuts:\n\n### Ad Hoc Fix Detection\n- Did worker fix ONE instance? → Grep for similar patterns. If N > 1 exists, REJECT.\n- Example: Fixed null check in `auth.ts:42`? → `grep -r \"similar pattern\" .` - are there others?\n\n### Root Cause vs Symptom\n- Did worker add a workaround? → Find the ACTUAL bug. If workaround hides real issue, REJECT.\n- Example: Added `|| []` fallback? → WHY is it undefined? Fix THAT.\n\n### Lazy Debugging Red Flags (INSTANT REJECT)\n- Worker suggests \"restart the service\" → REJECT (hides the bug)\n- Worker suggests \"clear the cache\" → REJECT (hides the bug)\n- Worker says \"works on my machine\" → REJECT (not a fix)\n- Worker blames the test → REJECT unless they PROVE test is wrong with evidence"
-      },
-      "contextStrategy": {
-        "sources": [
-          {
-            "topic": "ISSUE_OPENED",
-            "limit": 1
-          },
-          {
-            "topic": "IMPLEMENTATION_READY",
-            "limit": 1
-          }
-        ],
-        "format": "chronological",
-        "maxTokens": "{{max_tokens}}"
-      },
-      "triggers": [
-        {
-          "topic": "IMPLEMENTATION_READY",
-          "action": "execute_task"
-        }
-      ],
-      "hooks": {
-        "onComplete": {
-          "action": "publish_message",
-          "config": {
-            "topic": "VALIDATION_RESULT",
-            "content": {
-              "text": "{{result.summary}}",
-              "data": {
-                "approved": "{{result.approved}}",
-                "errors": "{{result.errors}}"
-              }
-            }
-          }
-        }
-      }
-    }
-  ]
-}

package/cluster-templates/conductor-bootstrap.json

@@ -1,124 +0,0 @@
-{
-  "name": "Two-Tier Conductor (Complexity × TaskType)",
-  "description": "Cost-optimized conductor: level1 junior for 2D classification (complexity + taskType), level2 senior for UNCERTAIN tasks. Routes to appropriate cluster config via helpers.getConfig().",
-  "agents": [
-    {
-      "id": "junior-conductor",
-      "role": "conductor",
-      "modelLevel": "level1",
-      "useDirectApi": true,
-      "outputFormat": "json",
-      "jsonSchema": {
-        "type": "object",
-        "properties": {
-          "complexity": {
-            "type": "string",
-            "enum": ["TRIVIAL", "SIMPLE", "STANDARD", "CRITICAL", "UNCERTAIN"],
-            "description": "Task complexity level"
-          },
-          "taskType": {
-            "type": "string",
-            "enum": ["INQUIRY", "TASK", "DEBUG"],
-            "description": "Type of work: INQUIRY (read-only), TASK (implement / known fix), DEBUG (investigate unknown root cause)"
-          },
-          "reasoning": {
-            "type": "string",
-            "description": "Why this classification (1-2 sentences)"
-          }
-        },
-        "required": ["complexity", "taskType", "reasoning"]
-      },
-      "prompt": {
-        "system": "You are the JUNIOR CONDUCTOR - fast task classification.\n\n## Your Job\nClassify the task on TWO dimensions.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives. CRITICAL is rare.\n\n## COMPLEXITY (pick ONE)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing (not just displaying it).\n- UNCERTAIN - Escalate to senior conductor.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive. Reserve it for actual risk.\n\n## NOT CRITICAL (Common False Positives)\n\nThese are STANDARD, not CRITICAL:\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types for existing structures\n- Code cleanup in infra-related files\n- Read-only queries to production data\n- Tests for auth/billing code (tests don't touch prod)\n- Extracting modules or services (code organization)\n- Factory patterns, dependency injection (architecture)\n- Config file reorganization (not production config values)\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration, read-only\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Explain current auth flow (read-only)\"\n```json\n{\"complexity\": \"SIMPLE\", \"taskType\": \"INQUIRY\", \"reasoning\": \"Read-only explanation\"}\n```\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Refactoring code organization, not modifying auth logic\"}\n```\n\nTask: \"Add TypeScript types to payment types\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Adding types, not modifying billing logic\"}\n```\n\nTask: \"Fix bug in password validation logic\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying authentication logic\"}\n```\n\nTask: \"Add new payment method integration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing/payment processing code\"}\n```\n\nTask: \"Rotate production API keys\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Modifying production secrets\"}\n```\n\nTask: \"DROP TABLE users migration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Destructive database operation\"}\n```\n\n## Critical Rules\n1. Output ONLY valid JSON - no other text\n2. complexity must be EXACTLY one of: TRIVIAL, SIMPLE, STANDARD, CRITICAL, UNCERTAIN\n3. taskType must be EXACTLY one of: INQUIRY, TASK, DEBUG\n\nTask: {{ISSUE_OPENED.content.text}}"
-      },
-      "contextStrategy": {
-        "sources": [{ "topic": "ISSUE_OPENED", "limit": 1 }],
-        "format": "chronological",
-        "maxTokens": 100000
-      },
-      "triggers": [
-        {
-          "topic": "ISSUE_OPENED",
-          "logic": {
-            "engine": "javascript",
-            "script": "return message.sender === 'system' && !message.metadata?._republished;"
-          },
-          "action": "execute_task"
-        }
-      ],
-      "hooks": {
-        "onComplete": {
-          "action": "publish_message",
-          "transform": {
-            "engine": "javascript",
-            "script": "const { complexity, taskType, reasoning } = result;\nconst taskText = triggeringMessage.content?.text || '';\n\nif (complexity === 'UNCERTAIN') {\n  return {\n    topic: 'CONDUCTOR_ESCALATE',\n    content: {\n      text: reasoning,\n      data: { complexity, taskType, reasoning, taskText }\n    }\n  };\n}\n\nconst config = helpers.getConfig(complexity, taskType);\n\nreturn {\n  topic: 'CLUSTER_OPERATIONS',\n  content: {\n    text: `[${complexity}:${taskType}] ${reasoning}`,\n    data: {\n      complexity,\n      taskType,\n      operations: [\n        { action: 'load_config', config },\n        { action: 'publish', topic: 'ISSUE_OPENED', content: { text: taskText }, metadata: { _republished: true } }\n      ]\n    }\n  }\n};"
-          }
-        }
-      }
-    },
-    {
-      "id": "senior-conductor",
-      "role": "conductor",
-      "modelLevel": "level2",
-      "useDirectApi": true,
-      "outputFormat": "json",
-      "jsonSchema": {
-        "type": "object",
-        "properties": {
-          "complexity": {
-            "type": "string",
-            "enum": ["TRIVIAL", "SIMPLE", "STANDARD", "CRITICAL"],
-            "description": "Task complexity (no UNCERTAIN - must decide)"
-          },
-          "taskType": {
-            "type": "string",
-            "enum": ["INQUIRY", "TASK", "DEBUG"],
-            "description": "Type of work after analysis (INQUIRY/TASK/DEBUG)"
-          },
-          "reasoning": {
-            "type": "string",
-            "description": "Detailed explanation"
-          }
-        },
-        "required": ["complexity", "taskType", "reasoning"]
-      },
-      "prompt": {
-        "system": "You are the SENIOR CONDUCTOR - expert task analyzer.\n\nThe junior conductor was uncertain. Make a definitive classification.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives.\n\n## COMPLEXITY (pick ONE - no UNCERTAIN allowed)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive.\n\n## NOT CRITICAL (Common False Positives)\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types, tests, code organization\n- Read-only queries, config reorganization\n- Factory patterns, dependency injection\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration (read-only)\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Code refactor, not modifying auth logic\"}\n```\n\nTask: \"Fix bug in password validation\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying auth logic\"}\n```\n\nTask: \"Add payment method\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing code\"}\n```\n\n## Rules\n1. Output ONLY valid JSON - no other text\n2. YOU MUST DECIDE - pick exactly one value for each field\n3. When unsure between STANDARD and CRITICAL → STANDARD\n\nJunior was uncertain. Original task follows."
-      },
-      "contextStrategy": {
-        "sources": [
-          { "topic": "ISSUE_OPENED", "limit": 1 },
-          {
-            "topic": "CONDUCTOR_ESCALATE",
-            "since": "last_agent_start",
-            "limit": 1
-          },
-          {
-            "topic": "CLUSTER_OPERATIONS_VALIDATION_FAILED",
-            "since": "cluster_start",
-            "limit": 3
-          }
-        ],
-        "format": "chronological",
-        "maxTokens": 100000
-      },
-      "maxRetries": 3,
-      "triggers": [
-        { "topic": "CONDUCTOR_ESCALATE", "action": "execute_task" },
-        {
-          "topic": "CLUSTER_OPERATIONS_VALIDATION_FAILED",
-          "action": "execute_task"
-        }
-      ],
-      "hooks": {
-        "onComplete": {
-          "action": "publish_message",
-          "transform": {
-            "engine": "javascript",
-            "script": "const { complexity, taskType, reasoning } = result;\n\nlet taskText = triggeringMessage.content?.data?.taskText || '';\nif (!taskText) {\n  taskText = triggeringMessage.content?.text || '';\n}\n\nconst config = helpers.getConfig(complexity, taskType);\n\nreturn {\n  topic: 'CLUSTER_OPERATIONS',\n  content: {\n    text: `Senior: [${complexity}:${taskType}] ${reasoning}`,\n    data: {\n      complexity,\n      taskType,\n      operations: [\n        { action: 'load_config', config },\n        { action: 'publish', topic: 'ISSUE_OPENED', content: { text: taskText }, metadata: { _republished: true } }\n      ]\n    }\n  }\n};"
-          }
-        }
-      }
-    }
-  ]
-}

package/docker/zeroshot-cluster/Dockerfile

@@ -1,152 +0,0 @@
-# Base image for vibe cluster isolation mode
-# Provides: Node.js, Python, Git, Chromium, Claude CLI, Playwright deps, Infrastructure tools
-#
-# Build: docker build -t vibe-cluster-base vibe/cluster/docker/vibe-cluster/
-# Usage: zeroshot run <task> --docker
-
-FROM node:20-slim
-
-# Upgrade npm to fix Arborist isDescendantOf bug (npm 10.x crash on complex peer deps)
-# See: https://github.com/npm/cli/issues/7682
-RUN npm install -g npm@latest
-
-# Version pinning for infrastructure tools
-ARG AWS_CLI_VERSION=2.15.10
-ARG TERRAFORM_VERSION=1.6.6
-ARG KUBECTL_VERSION=1.29.0
-ARG HELM_VERSION=3.13.3
-ARG INFRACOST_VERSION=0.10.32
-ARG TFLINT_VERSION=0.50.0
-ARG TFSEC_VERSION=1.28.4
-
-# Install system dependencies for e2e testing and development
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    curl \
-    # Build tools for native modules (node-gyp needs make, gcc, g++)
-    build-essential \
-    python3-dev \
-    ca-certificates \
-    gnupg \
-    unzip \
-    # Docker for starting services
-    docker.io \
-    docker-compose \
-    # Python for general development
-    python3 \
-    python3-pip \
-    python3-venv \
-    # Chromium dependencies
-    chromium \
-    fonts-liberation \
-    libasound2 \
-    libatk-bridge2.0-0 \
-    libatk1.0-0 \
-    libcups2 \
-    libdbus-1-3 \
-    libdrm2 \
-    libgbm1 \
-    libgtk-3-0 \
-    libnspr4 \
-    libnss3 \
-    libx11-xcb1 \
-    libxcomposite1 \
-    libxdamage1 \
-    libxfixes3 \
-    libxrandr2 \
-    xdg-utils \
-    && rm -rf /var/lib/apt/lists/* \
-    # Create python symlink for compatibility
-    && ln -sf /usr/bin/python3 /usr/bin/python
-
-# Install GitHub CLI for git authentication
-RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
-    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
-    && apt-get update && apt-get install -y gh \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install infrastructure tools
-# AWS CLI v2
-RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip" -o /tmp/awscliv2.zip \
-    && unzip -q /tmp/awscliv2.zip -d /tmp \
-    && /tmp/aws/install \
-    && rm -rf /tmp/awscliv2.zip /tmp/aws
-
-# Terraform
-RUN curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" -o /tmp/terraform.zip \
-    && unzip -q /tmp/terraform.zip -d /usr/local/bin \
-    && chmod +x /usr/local/bin/terraform \
-    && rm /tmp/terraform.zip
-
-# kubectl
-RUN curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl \
-    && chmod +x /usr/local/bin/kubectl
-
-# Helm
-RUN curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" -o /tmp/helm.tar.gz \
-    && tar -xzf /tmp/helm.tar.gz -C /tmp \
-    && mv /tmp/linux-amd64/helm /usr/local/bin/helm \
-    && chmod +x /usr/local/bin/helm \
-    && rm -rf /tmp/helm.tar.gz /tmp/linux-amd64
-
-# infracost (cost estimation)
-RUN curl -fsSL "https://github.com/infracost/infracost/releases/download/v${INFRACOST_VERSION}/infracost-linux-amd64.tar.gz" -o /tmp/infracost.tar.gz \
-    && tar -xzf /tmp/infracost.tar.gz -C /tmp \
-    && mv /tmp/infracost-linux-amd64 /usr/local/bin/infracost \
-    && chmod +x /usr/local/bin/infracost \
-    && rm /tmp/infracost.tar.gz
-
-# tflint (terraform linter)
-RUN curl -fsSL "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" -o /tmp/tflint.zip \
-    && unzip -q /tmp/tflint.zip -d /usr/local/bin \
-    && chmod +x /usr/local/bin/tflint \
-    && rm /tmp/tflint.zip
-
-# tfsec (security scanner)
-RUN curl -fsSL "https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VERSION}/tfsec-linux-amd64" -o /usr/local/bin/tfsec \
-    && chmod +x /usr/local/bin/tfsec
-
-# Set AWS_PAGER to empty to disable paging in AWS CLI
-ENV AWS_PAGER=""
-
-# Set Chromium path for Playwright
-ENV CHROME_BIN=/usr/bin/chromium
-ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
-
-# Copy zeroshot source into container and install globally
-# CRITICAL: This enables isolation mode to use 'zeroshot task run' inside container
-# which provides timeout, error handling, and log streaming infrastructure
-COPY --chown=node:node . /tmp/zeroshot/
-RUN cd /tmp/zeroshot && npm install && npm link
-
-# Pre-bake common npm dependencies (Issue #20: 30-40% startup reduction)
-# These are installed once at image build time, then copied to workspaces at runtime
-# if the project's dependencies are satisfied by the pre-baked set.
-COPY docker/zeroshot-cluster/pre-baked-deps.json /pre-baked-deps/package.json
-RUN cd /pre-baked-deps && npm install --ignore-scripts \
-    && chown -R node:node /pre-baked-deps
-
-# Install Claude CLI globally
-RUN npm install -g @anthropic-ai/claude-code
-
-# Install Playwright (uses system Chromium)
-RUN npx playwright install-deps chromium 2>/dev/null || true
-
-# Add node user to docker group for Docker socket access
-RUN groupadd -f docker && usermod -aG docker node
-
-# Use existing 'node' user from base image (uid 1000)
-# Create directories with proper ownership for Claude CLI
-RUN mkdir -p /home/node/.claude /home/node/.config/gh \
-    && chown -R node:node /home/node
-
-# Create workspace directory with node ownership
-RUN mkdir -p /workspace && chown node:node /workspace
-WORKDIR /workspace
-
-# Switch to non-root user (required for --dangerously-skip-permissions)
-USER node
-
-# Default command (overridden by vibe)
-CMD ["bash"]

package/docker/zeroshot-cluster/pre-baked-deps.json

@@ -1,28 +0,0 @@
-{
-  "name": "pre-baked-deps",
-  "version": "1.0.0",
-  "description": "Pre-baked npm dependencies for zeroshot isolation containers",
-  "private": true,
-  "dependencies": {
-    "typescript": "^5.3.0",
-    "eslint": "^8.56.0",
-    "@typescript-eslint/parser": "^6.19.0",
-    "@typescript-eslint/eslint-plugin": "^6.19.0",
-    "prettier": "^3.2.0",
-    "jest": "^29.7.0",
-    "@types/jest": "^29.5.0",
-    "ts-jest": "^29.1.0",
-    "@types/node": "^20.11.0",
-    "tsx": "^4.7.0",
-    "esbuild": "^0.19.0",
-    "dotenv": "^16.4.0",
-    "glob": "^10.3.0",
-    "chalk": "^5.3.0",
-    "commander": "^12.0.0",
-    "axios": "^1.6.0",
-    "node-fetch": "^3.3.0",
-    "zod": "^3.22.0",
-    "lodash": "^4.17.0",
-    "@types/lodash": "^4.14.0"
-  }
-}