@the-open-engine/zeroshot 5.4.0

package/cluster-templates/base-templates/worker-validator.json

@@ -0,0 +1,230 @@
+{
+  "name": "Worker + Validator",
+  "description": "Worker implements, validator checks, rejection loop. For SIMPLE tasks.",
+  "params": {
+    "worker_level": {
+      "type": "string",
+      "enum": ["level1", "level2", "level3"],
+      "default": "level2"
+    },
+    "validator_level": {
+      "type": "string",
+      "enum": ["level1", "level2", "level3"],
+      "default": "level3"
+    },
+    "max_iterations": {
+      "type": "number",
+      "default": 3
+    },
+    "max_tokens": {
+      "type": "number",
+      "default": 100000
+    },
+    "timeout": {
+      "type": "number",
+      "default": 0,
+      "description": "Task timeout in milliseconds (0 = no timeout)"
+    },
+    "task_type": {
+      "type": "string",
+      "enum": ["INQUIRY", "TASK", "DEBUG"],
+      "description": "Type of work"
+    }
+  },
+  "agents": [
+    {
+      "id": "worker",
+      "role": "implementation",
+      "modelLevel": "{{worker_level}}",
+      "timeout": "{{timeout}}",
+      "outputFormat": "json",
+      "jsonSchema": {
+        "type": "object",
+        "properties": {
+          "summary": {
+            "type": "string",
+            "description": "Brief description of work done this iteration"
+          },
+          "completionStatus": {
+            "type": "object",
+            "description": "Self-assessment of completion state",
+            "properties": {
+              "canValidate": {
+                "type": "boolean",
+                "description": "true if work is ready for validator review, false if more work needed"
+              },
+              "percentComplete": {
+                "type": "number",
+                "description": "Estimated completion percentage (0-100)"
+              },
+              "blockers": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Issues preventing completion (empty if canValidate=true)"
+              },
+              "nextSteps": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Remaining work items (empty if canValidate=true)"
+              }
+            },
+            "required": ["canValidate", "percentComplete"]
+          }
+        },
+        "required": ["summary", "completionStatus"]
+      },
+      "prompt": {
+        "system": "## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are an implementation agent for a SIMPLE {{task_type}} task.\n\n## FIRST ITERATION\n\n{{#if task_type == 'TASK'}}\nImplement the requested feature/change:\n- Well-defined scope (one feature, one fix)\n- Standard patterns apply\n- Complete the implementation fully\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nInvestigate and fix the issue:\n- Reproduce the problem\n- Find the root cause (not just symptoms)\n- Apply the fix\n- Verify it works\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nResearch and provide detailed answers:\n- Explore relevant code and documentation\n- Explain how things work\n- Provide accurate, complete information\n{{/if}}\n\n## SUBSEQUENT ITERATIONS (after rejection)\n\nYou are being called back because validators REJECTED your implementation. This is NOT a minor issue.\n\n### FIX LIKE A SENIOR ENGINEER\n\n1. **STOP AND UNDERSTAND FIRST**\n   - Read ALL VALIDATION_RESULT messages completely\n   - Understand WHY each issue exists, not just WHAT it is\n   - Trace the root cause - don't patch symptoms\n\n2. **FIX PROPERLY - NO SHORTCUTS**\n   - Fix the ACTUAL problem, not the error message\n   - If your approach was wrong, redesign it - don't add band-aids\n   - Consider architectural implications of your fix\n   - A senior dev would be embarrassed to submit a half-fix\n\n3. **VERIFY YOUR FIX**\n   - Test your changes actually work\n   - Check you didn't break anything else\n   - If unsure, investigate before committing\n\n### MINDSET\n- Validators are senior engineers reviewing your code\n- They found REAL problems - take them seriously\n- Shortcuts will be caught and rejected again\n\n## 🔴 COMPLETION SELF-ASSESSMENT (REQUIRED)\n\nYour output MUST include a `completionStatus` object with honest self-assessment:\n\n**Set canValidate: true** when:\n- All work for this iteration is complete\n- Code compiles/runs without errors\n- You would be confident submitting for review\n\n**Set canValidate: false** when:\n- Work is partially complete\n- Blocked by an issue you're working around\n- Code doesn't compile or has obvious bugs\n\nValidators cost money. If you're not done, say so - your WORKER_PROGRESS message will let you continue."
+      },
+      "contextStrategy": {
+        "sources": [
+          {
+            "topic": "ISSUE_OPENED",
+            "priority": "required",
+            "strategy": "latest",
+            "amount": 1
+          },
+          {
+            "topic": "STATE_SNAPSHOT",
+            "priority": "required",
+            "strategy": "latest",
+            "amount": 1
+          },
+          {
+            "topic": "WORKER_PROGRESS",
+            "priority": "medium",
+            "since": "last_task_end",
+            "strategy": "latest",
+            "amount": 3
+          },
+          {
+            "topic": "VALIDATION_RESULT",
+            "priority": "high",
+            "since": "last_task_end",
+            "strategy": "latest",
+            "amount": 3
+          }
+        ],
+        "format": "chronological",
+        "maxTokens": "{{max_tokens}}"
+      },
+      "triggers": [
+        {
+          "topic": "ISSUE_OPENED",
+          "action": "execute_task"
+        },
+        {
+          "topic": "WORKER_PROGRESS",
+          "logic": {
+            "engine": "javascript",
+            "script": "return message.sender === 'worker';"
+          },
+          "action": "execute_task"
+        },
+        {
+          "topic": "VALIDATION_RESULT",
+          "logic": {
+            "engine": "javascript",
+            "script": "const lastPush = ledger.findLast({ topic: 'IMPLEMENTATION_READY' });\nif (!lastPush) return false;\nconst response = ledger.findLast({ topic: 'VALIDATION_RESULT', since: lastPush.timestamp });\nreturn response?.content?.data?.approved === false || response?.content?.data?.approved === 'false';"
+          },
+          "action": "execute_task"
+        }
+      ],
+      "hooks": {
+        "onComplete": {
+          "action": "publish_message",
+          "config": {
+            "topic": "IMPLEMENTATION_READY",
+            "content": {
+              "text": "{{result.summary}}",
+              "data": {
+                "completionStatus": "{{result.completionStatus}}"
+              }
+            }
+          },
+          "logic": {
+            "engine": "javascript",
+            "script": "if (!result.completionStatus?.canValidate) return { topic: 'WORKER_PROGRESS' };"
+          }
+        }
+      },
+      "maxIterations": "{{max_iterations}}"
+    },
+    {
+      "id": "validator",
+      "role": "validator",
+      "modelLevel": "{{validator_level}}",
+      "timeout": "{{timeout}}",
+      "outputFormat": "json",
+      "jsonSchema": {
+        "type": "object",
+        "properties": {
+          "approved": {
+            "type": "boolean",
+            "description": "true if implementation is correct"
+          },
+          "summary": {
+            "type": "string",
+            "description": "One-line validation result"
+          },
+          "errors": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Issues found (empty if approved)"
+          }
+        },
+        "required": ["approved", "summary", "errors"]
+      },
+      "prompt": {
+        "system": "## 🔴 OUTPUT FORMAT (CRITICAL - READ FIRST)\n\nYour output MUST be MINIMAL and STRUCTURED:\n- Output ONLY the required JSON schema fields\n- NO preambles (\"Here is my analysis...\", \"Let me explain...\")\n- NO verbose summaries - be CONCISE (max 100 chars per string field)\n- NO redundant information\n- NO explanations before or after the JSON\n\n## 🚫 YOU CANNOT ASK QUESTIONS\n\nYou are running non-interactively. There is NO USER to answer.\n- NEVER use AskUserQuestion tool\n- NEVER say \"Should I...\" or \"Would you like...\"\n- When unsure: Make the SAFER choice and proceed.\n\nYou are a validator for a SIMPLE {{task_type}} task.\n\n## 🔴 VERIFICATION PROTOCOL (REQUIRED - PREVENTS FALSE CLAIMS)\n\nBefore making ANY claim about missing functionality or code issues:\n\n1. **SEARCH FIRST** - Use Glob to find ALL relevant files\n2. **READ THE CODE** - Use Read to inspect actual implementation\n3. **GREP FOR PATTERNS** - Use Grep to search for specific code (function names, endpoints, etc.)\n\n**NEVER claim something doesn't exist without FIRST searching for it.**\n\nThe worker may have implemented features in different files than originally planned. If you claim '/api/metrics endpoint is missing' without searching, you may miss that it exists in 'server/routes/health.ts' instead of 'server/routes/api.ts'.\n\n### Example Verification Flow:\n```\n1. Claim: 'Missing error handling for network failures'\n2. BEFORE claiming → Grep for 'catch', 'error', 'try' in relevant files\n3. BEFORE claiming → Read the actual implementation\n4. ONLY IF NOT FOUND → Add to errors array\n```\n\n## 🔴 CLEAN DESIGN CHECK (CRITICAL)\nUnless the issue EXPLICITLY requests backwards compatibility, REJECT any of these:\n- Old function/class kept alongside new one (\"deprecated but still works\") → REJECT. Delete old, update ALL callers.\n- Re-exports or wrappers forwarding to new implementation → REJECT. Update imports at call sites.\n- `_unused` parameter renames to preserve old signatures → REJECT. Change the signature, update callers.\n- Fallback paths handling \"old format\" or \"legacy data\" → REJECT. Migrate the data, remove the fallback.\n- Comments like \"kept for backwards compatibility\" → REJECT. Remove the old code.\n- Feature flags toggling between old and new behavior → REJECT. Ship the new behavior. Delete the old.\n\nThe CLEAN solution: delete the old, update all callers, ship only the current implementation.\n\n## VALIDATION CRITERIA\n\n**APPROVE** if:\n- Core functionality works as requested\n- Implementation is correct and complete\n- No obvious bugs or critical issues\n- No backwards compatibility cruft (unless issue explicitly requests it)\n\n**REJECT** if:\n- Major functionality is missing or broken (VERIFIED by searching)\n- Implementation doesn't match requirements (VERIFIED by reading code)\n- Critical bugs present (VERIFIED by inspection)\n- Backwards compatibility shims, legacy wrappers, or deprecation patterns present (see CLEAN DESIGN CHECK)\n\n## TASK TYPE: {{task_type}}\n\n{{#if task_type == 'TASK'}}\nVerify the feature/change works correctly.\n{{/if}}\n\n{{#if task_type == 'DEBUG'}}\nVerify the bug is actually fixed at root cause.\n{{/if}}\n\n{{#if task_type == 'INQUIRY'}}\nVerify the information is accurate and complete.\n{{/if}}\n\nFor SIMPLE tasks, don't nitpick. Focus on: Does it work and meet requirements?\n\n## 🔴 DEBUGGING METHODOLOGY CHECK\n\nBefore approving, verify the worker didn't take shortcuts:\n\n### Ad Hoc Fix Detection\n- Did worker fix ONE instance? → Grep for similar patterns. If N > 1 exists, REJECT.\n- Example: Fixed null check in `auth.ts:42`? → `grep -r \"similar pattern\" .` - are there others?\n\n### Root Cause vs Symptom\n- Did worker add a workaround? → Find the ACTUAL bug. If workaround hides real issue, REJECT.\n- Example: Added `|| []` fallback? → WHY is it undefined? Fix THAT.\n\n### Lazy Debugging Red Flags (INSTANT REJECT)\n- Worker suggests \"restart the service\" → REJECT (hides the bug)\n- Worker suggests \"clear the cache\" → REJECT (hides the bug)\n- Worker says \"works on my machine\" → REJECT (not a fix)\n- Worker blames the test → REJECT unless they PROVE test is wrong with evidence"
+      },
+      "contextStrategy": {
+        "sources": [
+          {
+            "topic": "ISSUE_OPENED",
+            "priority": "required",
+            "strategy": "latest",
+            "amount": 1
+          },
+          {
+            "topic": "STATE_SNAPSHOT",
+            "priority": "required",
+            "strategy": "latest",
+            "amount": 1
+          },
+          {
+            "topic": "IMPLEMENTATION_READY",
+            "priority": "high",
+            "strategy": "latest",
+            "amount": 1
+          }
+        ],
+        "format": "chronological",
+        "maxTokens": "{{max_tokens}}"
+      },
+      "triggers": [
+        {
+          "topic": "IMPLEMENTATION_READY",
+          "action": "execute_task"
+        }
+      ],
+      "hooks": {
+        "onComplete": {
+          "action": "publish_message",
+          "config": {
+            "topic": "VALIDATION_RESULT",
+            "content": {
+              "text": "{{result.summary}}",
+              "data": {
+                "approved": "{{result.approved}}",
+                "errors": "{{result.errors}}"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

package/cluster-templates/conductor-bootstrap.json

@@ -0,0 +1,130 @@
+{
+  "name": "Two-Tier Conductor (Complexity × TaskType)",
+  "description": "Cost-optimized conductor: level1 junior for 2D classification (complexity + taskType), level2 senior for UNCERTAIN tasks. Routes to appropriate cluster config via helpers.getConfig().",
+  "agents": [
+    {
+      "id": "junior-conductor",
+      "role": "conductor",
+      "modelLevel": "level2",
+      "useDirectApi": true,
+      "outputFormat": "json",
+      "jsonSchema": {
+        "type": "object",
+        "properties": {
+          "complexity": {
+            "type": "string",
+            "enum": ["TRIVIAL", "SIMPLE", "STANDARD", "CRITICAL", "UNCERTAIN"],
+            "description": "Task complexity level"
+          },
+          "taskType": {
+            "type": "string",
+            "enum": ["INQUIRY", "TASK", "DEBUG"],
+            "description": "Type of work: INQUIRY (read-only), TASK (implement / known fix), DEBUG (investigate unknown root cause)"
+          },
+          "reasoning": {
+            "type": "string",
+            "description": "Why this classification (1-2 sentences)"
+          }
+        },
+        "required": ["complexity", "taskType", "reasoning"]
+      },
+      "prompt": {
+        "system": "You are the JUNIOR CONDUCTOR - fast task classification.\n\n## Your Job\nClassify the task on TWO dimensions.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives. CRITICAL is rare.\n\n## COMPLEXITY (pick ONE)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing (not just displaying it).\n- UNCERTAIN - Escalate to senior conductor.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive. Reserve it for actual risk.\n\n## NOT CRITICAL (Common False Positives)\n\nThese are STANDARD, not CRITICAL:\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types for existing structures\n- Code cleanup in infra-related files\n- Read-only queries to production data\n- Tests for auth/billing code (tests don't touch prod)\n- Extracting modules or services (code organization)\n- Factory patterns, dependency injection (architecture)\n- Config file reorganization (not production config values)\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration, read-only\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Explain current auth flow (read-only)\"\n```json\n{\"complexity\": \"SIMPLE\", \"taskType\": \"INQUIRY\", \"reasoning\": \"Read-only explanation\"}\n```\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Refactoring code organization, not modifying auth logic\"}\n```\n\nTask: \"Add TypeScript types to payment types\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Adding types, not modifying billing logic\"}\n```\n\nTask: \"Fix bug in password validation logic\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying authentication logic\"}\n```\n\nTask: \"Add new payment method integration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing/payment processing code\"}\n```\n\nTask: \"Rotate production API keys\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Modifying production secrets\"}\n```\n\nTask: \"DROP TABLE users migration\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"Destructive database operation\"}\n```\n\n## Critical Rules\n1. Output ONLY valid JSON - no other text\n2. complexity must be EXACTLY one of: TRIVIAL, SIMPLE, STANDARD, CRITICAL, UNCERTAIN\n3. taskType must be EXACTLY one of: INQUIRY, TASK, DEBUG\n\nTask: {{ISSUE_OPENED.content.text}}"
+      },
+      "contextStrategy": {
+        "sources": [
+          { "topic": "ISSUE_OPENED", "priority": "required", "strategy": "latest", "amount": 1 }
+        ],
+        "format": "chronological",
+        "maxTokens": 100000
+      },
+      "triggers": [
+        {
+          "topic": "ISSUE_OPENED",
+          "logic": {
+            "engine": "javascript",
+            "script": "return message.sender === 'system' && !message.metadata?._republished;"
+          },
+          "action": "execute_task"
+        }
+      ],
+      "hooks": {
+        "onComplete": {
+          "action": "publish_message",
+          "transform": {
+            "engine": "javascript",
+            "script": "const { complexity, taskType, reasoning } = result;\nconst taskText = triggeringMessage.content?.text || '';\n\nif (complexity === 'UNCERTAIN') {\n  return {\n    topic: 'CONDUCTOR_ESCALATE',\n    content: {\n      text: reasoning,\n      data: { complexity, taskType, reasoning, taskText }\n    }\n  };\n}\n\nconst config = helpers.getConfig(complexity, taskType);\n\nreturn {\n  topic: 'CLUSTER_OPERATIONS',\n  content: {\n    text: `[${complexity}:${taskType}] ${reasoning}`,\n    data: {\n      complexity,\n      taskType,\n      operations: [\n        { action: 'load_config', config },\n        { action: 'publish', topic: 'ISSUE_OPENED', content: { text: taskText }, metadata: { _republished: true } }\n      ]\n    }\n  }\n};"
+          }
+        }
+      }
+    },
+    {
+      "id": "senior-conductor",
+      "role": "conductor",
+      "modelLevel": "level3",
+      "useDirectApi": true,
+      "outputFormat": "json",
+      "jsonSchema": {
+        "type": "object",
+        "properties": {
+          "complexity": {
+            "type": "string",
+            "enum": ["TRIVIAL", "SIMPLE", "STANDARD", "CRITICAL"],
+            "description": "Task complexity (no UNCERTAIN - must decide)"
+          },
+          "taskType": {
+            "type": "string",
+            "enum": ["INQUIRY", "TASK", "DEBUG"],
+            "description": "Type of work after analysis (INQUIRY/TASK/DEBUG)"
+          },
+          "reasoning": {
+            "type": "string",
+            "description": "Detailed explanation"
+          }
+        },
+        "required": ["complexity", "taskType", "reasoning"]
+      },
+      "prompt": {
+        "system": "You are the SENIOR CONDUCTOR - expert task analyzer.\n\nThe junior conductor was uncertain. Make a definitive classification.\n\n## 🔴 COST REMINDER\n- CRITICAL uses Opus ($15/M tokens) + 4 validators = EXPENSIVE\n- STANDARD uses Sonnet ($3/M tokens) + 2 validators = NORMAL\n- Don't waste money on false positives.\n\n## COMPLEXITY (pick ONE - no UNCERTAIN allowed)\n- TRIVIAL - One file, mechanical change; no behavior change.\n- SIMPLE - Small change, 1-2 files, low risk.\n- STANDARD - Multi-file work or user-visible behavior. **DEFAULT CHOICE.**\n- CRITICAL - ONLY when code DIRECTLY modifies: (1) authentication/authorization LOGIC, (2) payment processing/billing calculations, (3) secrets/credentials handling, (4) destructive database operations (DROP, DELETE), (5) production deployment or live infrastructure, (6) PII processing.\n\n**🔴 BIAS: If unsure between STANDARD and CRITICAL, choose STANDARD.** CRITICAL is expensive.\n\n## NOT CRITICAL (Common False Positives)\n- Refactoring code that MENTIONS auth/billing/security (not MODIFYING the logic)\n- Adding TypeScript types, tests, code organization\n- Read-only queries, config reorganization\n- Factory patterns, dependency injection\n\n## TASK TYPE (pick ONE)\n- INQUIRY - Questions, exploration (read-only)\n- TASK - Implement something new\n- DEBUG - Fix something broken\n\n## Examples\n\nTask: \"Refactor auth service into smaller modules\"\n```json\n{\"complexity\": \"STANDARD\", \"taskType\": \"TASK\", \"reasoning\": \"Code refactor, not modifying auth logic\"}\n```\n\nTask: \"Fix bug in password validation\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"DEBUG\", \"reasoning\": \"Directly modifying auth logic\"}\n```\n\nTask: \"Add payment method\"\n```json\n{\"complexity\": \"CRITICAL\", \"taskType\": \"TASK\", \"reasoning\": \"New billing code\"}\n```\n\n## Rules\n1. Output ONLY valid JSON - no other text\n2. YOU MUST DECIDE - pick exactly one value for each field\n3. When unsure between STANDARD and CRITICAL → STANDARD\n\nJunior was uncertain. Original task follows."
+      },
+      "contextStrategy": {
+        "sources": [
+          { "topic": "ISSUE_OPENED", "priority": "required", "strategy": "latest", "amount": 1 },
+          {
+            "topic": "CONDUCTOR_ESCALATE",
+            "priority": "high",
+            "since": "last_agent_start",
+            "strategy": "latest",
+            "amount": 1
+          },
+          {
+            "topic": "CLUSTER_OPERATIONS_VALIDATION_FAILED",
+            "priority": "high",
+            "since": "cluster_start",
+            "strategy": "latest",
+            "amount": 3
+          }
+        ],
+        "format": "chronological",
+        "maxTokens": 100000
+      },
+      "maxRetries": 3,
+      "triggers": [
+        { "topic": "CONDUCTOR_ESCALATE", "action": "execute_task" },
+        {
+          "topic": "CLUSTER_OPERATIONS_VALIDATION_FAILED",
+          "action": "execute_task"
+        }
+      ],
+      "hooks": {
+        "onComplete": {
+          "action": "publish_message",
+          "transform": {
+            "engine": "javascript",
+            "script": "const { complexity, taskType, reasoning } = result;\n\nlet taskText = triggeringMessage.content?.data?.taskText || '';\nif (!taskText) {\n  taskText = triggeringMessage.content?.text || '';\n}\n\nconst config = helpers.getConfig(complexity, taskType);\n\nreturn {\n  topic: 'CLUSTER_OPERATIONS',\n  content: {\n    text: `Senior: [${complexity}:${taskType}] ${reasoning}`,\n    data: {\n      complexity,\n      taskType,\n      operations: [\n        { action: 'load_config', config },\n        { action: 'publish', topic: 'ISSUE_OPENED', content: { text: taskText }, metadata: { _republished: true } }\n      ]\n    }\n  }\n};"
+          }
+        }
+      }
+    }
+  ]
+}

package/docker/zeroshot-cluster/Dockerfile

@@ -0,0 +1,153 @@
+# Base image for vibe cluster isolation mode
+# Provides: Node.js, Python, Git, Chromium, Claude CLI, Playwright deps, Infrastructure tools
+#
+# Build: docker build -t vibe-cluster-base vibe/cluster/docker/vibe-cluster/
+# Usage: zeroshot run <task> --docker
+
+FROM node:20-slim
+
+# Upgrade npm to fix Arborist isDescendantOf bug (npm 10.x crash on complex peer deps)
+# See: https://github.com/npm/cli/issues/7682
+RUN npm install -g npm@latest
+
+# Version pinning for infrastructure tools
+ARG AWS_CLI_VERSION=2.15.10
+ARG TERRAFORM_VERSION=1.6.6
+ARG KUBECTL_VERSION=1.29.0
+ARG HELM_VERSION=3.13.3
+ARG INFRACOST_VERSION=0.10.32
+ARG TFLINT_VERSION=0.50.0
+ARG TFSEC_VERSION=1.28.4
+ARG CLAUDE_CODE_VERSION=2.1.20
+
+# Install system dependencies for e2e testing and development
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    # Build tools for native modules (node-gyp needs make, gcc, g++)
+    build-essential \
+    python3-dev \
+    ca-certificates \
+    gnupg \
+    unzip \
+    # Docker for starting services
+    docker.io \
+    docker-compose \
+    # Python for general development
+    python3 \
+    python3-pip \
+    python3-venv \
+    # Chromium dependencies
+    chromium \
+    fonts-liberation \
+    libasound2 \
+    libatk-bridge2.0-0 \
+    libatk1.0-0 \
+    libcups2 \
+    libdbus-1-3 \
+    libdrm2 \
+    libgbm1 \
+    libgtk-3-0 \
+    libnspr4 \
+    libnss3 \
+    libx11-xcb1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxfixes3 \
+    libxrandr2 \
+    xdg-utils \
+    && rm -rf /var/lib/apt/lists/* \
+    # Create python symlink for compatibility
+    && ln -sf /usr/bin/python3 /usr/bin/python
+
+# Install GitHub CLI for git authentication
+RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+    && apt-get update && apt-get install -y gh \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install infrastructure tools
+# AWS CLI v2
+RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWS_CLI_VERSION}.zip" -o /tmp/awscliv2.zip \
+    && unzip -q /tmp/awscliv2.zip -d /tmp \
+    && /tmp/aws/install \
+    && rm -rf /tmp/awscliv2.zip /tmp/aws
+
+# Terraform
+RUN curl -fsSL "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" -o /tmp/terraform.zip \
+    && unzip -q /tmp/terraform.zip -d /usr/local/bin \
+    && chmod +x /usr/local/bin/terraform \
+    && rm /tmp/terraform.zip
+
+# kubectl
+RUN curl -fsSL "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl" -o /usr/local/bin/kubectl \
+    && chmod +x /usr/local/bin/kubectl
+
+# Helm
+RUN curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" -o /tmp/helm.tar.gz \
+    && tar -xzf /tmp/helm.tar.gz -C /tmp \
+    && mv /tmp/linux-amd64/helm /usr/local/bin/helm \
+    && chmod +x /usr/local/bin/helm \
+    && rm -rf /tmp/helm.tar.gz /tmp/linux-amd64
+
+# infracost (cost estimation)
+RUN curl -fsSL "https://github.com/infracost/infracost/releases/download/v${INFRACOST_VERSION}/infracost-linux-amd64.tar.gz" -o /tmp/infracost.tar.gz \
+    && tar -xzf /tmp/infracost.tar.gz -C /tmp \
+    && mv /tmp/infracost-linux-amd64 /usr/local/bin/infracost \
+    && chmod +x /usr/local/bin/infracost \
+    && rm /tmp/infracost.tar.gz
+
+# tflint (terraform linter)
+RUN curl -fsSL "https://github.com/terraform-linters/tflint/releases/download/v${TFLINT_VERSION}/tflint_linux_amd64.zip" -o /tmp/tflint.zip \
+    && unzip -q /tmp/tflint.zip -d /usr/local/bin \
+    && chmod +x /usr/local/bin/tflint \
+    && rm /tmp/tflint.zip
+
+# tfsec (security scanner)
+RUN curl -fsSL "https://github.com/aquasecurity/tfsec/releases/download/v${TFSEC_VERSION}/tfsec-linux-amd64" -o /usr/local/bin/tfsec \
+    && chmod +x /usr/local/bin/tfsec
+
+# Set AWS_PAGER to empty to disable paging in AWS CLI
+ENV AWS_PAGER=""
+
+# Set Chromium path for Playwright
+ENV CHROME_BIN=/usr/bin/chromium
+ENV PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium
+
+# Copy zeroshot source into container and install globally
+# CRITICAL: This enables isolation mode to use 'zeroshot task run' inside container
+# which provides timeout, error handling, and log streaming infrastructure
+COPY --chown=node:node . /tmp/zeroshot/
+RUN cd /tmp/zeroshot && npm install && npm link
+
+# Pre-bake common npm dependencies (Issue #20: 30-40% startup reduction)
+# These are installed once at image build time, then copied to workspaces at runtime
+# if the project's dependencies are satisfied by the pre-baked set.
+COPY docker/zeroshot-cluster/pre-baked-deps.json /pre-baked-deps/package.json
+RUN cd /pre-baked-deps && npm install --ignore-scripts \
+    && chown -R node:node /pre-baked-deps
+
+# Install Claude CLI globally (version pinned via ARG)
+RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
+
+# Install Playwright (uses system Chromium)
+RUN npx playwright install-deps chromium 2>/dev/null || true
+
+# Add node user to docker group for Docker socket access
+RUN groupadd -f docker && usermod -aG docker node
+
+# Use existing 'node' user from base image (uid 1000)
+# Create directories with proper ownership for Claude CLI
+RUN mkdir -p /home/node/.claude /home/node/.config/gh \
+    && chown -R node:node /home/node
+
+# Create workspace directory with node ownership
+RUN mkdir -p /workspace && chown node:node /workspace
+WORKDIR /workspace
+
+# Switch to non-root user (required for --dangerously-skip-permissions)
+USER node
+
+# Default command (overridden by vibe)
+CMD ["bash"]

package/docker/zeroshot-cluster/pre-baked-deps.json

@@ -0,0 +1,28 @@
+{
+  "name": "pre-baked-deps",
+  "version": "1.0.0",
+  "description": "Pre-baked npm dependencies for zeroshot isolation containers",
+  "private": true,
+  "dependencies": {
+    "typescript": "^5.3.0",
+    "eslint": "^8.56.0",
+    "@typescript-eslint/parser": "^6.19.0",
+    "@typescript-eslint/eslint-plugin": "^6.19.0",
+    "prettier": "^3.2.0",
+    "jest": "^29.7.0",
+    "@types/jest": "^29.5.0",
+    "ts-jest": "^29.1.0",
+    "@types/node": "^20.11.0",
+    "tsx": "^4.7.0",
+    "esbuild": "^0.19.0",
+    "dotenv": "^16.4.0",
+    "glob": "^10.3.0",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "axios": "^1.6.0",
+    "node-fetch": "^3.3.0",
+    "zod": "^3.22.0",
+    "lodash": "^4.17.0",
+    "@types/lodash": "^4.14.0"
+  }
+}

package/lib/agent-cli-provider/adapters/claude-parser.d.ts

@@ -0,0 +1,3 @@
+import type { ProviderParseResult } from '../types';
+export declare function parseClaudeEvent(line: string): ProviderParseResult;
+//# sourceMappingURL=claude-parser.d.ts.map

package/lib/agent-cli-provider/adapters/claude-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-parser.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/adapters/claude-parser.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAe,mBAAmB,EAAe,MAAM,UAAU,CAAC;AAuG9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAmBlE"}