fix(analyze/secret): guard nil deref when spec omits fail: outcome (#2053) (#2054)

* fix(analyze/secret): guard nil deref when spec omits fail: outcome (#2053)

When a Preflight spec defines only warn: and/or pass: outcomes and the
target Secret is missing, analyzeSecret dereferenced a nil failOutcome and
panicked. Reproduction from replicatedhq/troubleshoot#2053:

  outcomes:
    - warn:
        when: "notFound"
        message: "secret missing (warn)"
    - pass:
        message: "secret found"

This change:
- Collects fail, warn, and warn-when-notFound outcomes up front.
- Routes a missing secret (or missing key) through a single resolver:
  prefer warn(when=notFound), fall back to fail, then any warn,
  then synthesize a benign warn result. Never panics.
- Adds table-driven tests covering the three new shapes.

Same defect shape as #263 (imagePullSecret). The sibling analyzers
configmap.go and image.go have the same pattern but are out of scope
for this PR.

Refs: replicatedhq/troubleshoot#2053

* refactor(analyze/secret): drop warn handling per analyzer contract

Per review feedback (banjoh): the secret analyzer only supports fail
(not found) and pass (found) outcomes — `warn:` and `when:` are not
part of the analyzer's contract (https://troubleshoot.sh/docs/analyze/secrets).

Drop the warn / notFoundWarn branches added in the previous commit and
collapse the nil-fail fallback onto IsFail with a default message. The
core fix — guarding the nil deref at the previous secret.go:72 — stays
in place.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(analyze/secret): mirror image_pull_secret pattern; return nil when spec has neither outcome

Per banjoh review: collect failOutcome and passOutcome with non-nil
checks; when the spec contains neither, return nil and let the framework
surface the missing-outcome error rather than fabricating a result.

Structure now mirrors pkg/analyze/image_pull_secret.go: default to
IsFail with fail-outcome message (if set), flip to IsPass with
pass-outcome message when the secret/key check succeeds, fill default
messages at the end only when none were configured. Analyze() now
forwards a nil result through cleanly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(analyze/secret): assign outcome messages inside their own branch

Cursor bugbot caught: when the spec defined only a fail outcome and the
secret was found, the result showed IsPass=true with the fail outcome's
message. Pre-assigning the fail message at the top before flipping
IsPass meant the stale message leaked through whenever no pass outcome
was configured.

Move both message assignments into their respective branches so a pass
result never carries a fail message. Default messages still fill in
when no outcome is set on the active branch. Added a regression test
covering fail-only spec + secret found.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(analyze/secret): address Greptile P1s — combined outcome + empty configured messages

Two fixes flagged by review on #2054:

1. Combined pass outcome dropped: the outcome loop used 'else if' for pass, so a
   single outcome object containing both fail and pass silently dropped the pass.
   Capture fail and pass independently.

2. Empty configured messages overwritten: the default-message fallback fired
   whenever result.Message was empty, clobbering a configured outcome that
   intentionally has an empty message (e.g. URI-only). Track whether the matched
   branch had a configured outcome and only fall back to a default when none was
   supplied, preserving the configured message and URI verbatim.

Adds tests: combined fail+pass captured on both found/not-found paths, and
URI-only pass/fail outcomes preserved without default-message overwrite.

* fix(analyze/secret): drop fabricated default messages; error on missing outcome

Per maintainer review: analyzers do not fabricate default messages — an empty
outcome message is intentional (e.g. a URI-only outcome), so remove the default
message fallback and preserve the configured outcome verbatim. When a matched
branch has no configured outcome, the message stays empty.

Also address the missing-outcome case: when a spec defines neither a pass nor a
fail outcome, analyzeSecret returned (nil, nil), which the Analyze wrapper
swallowed into an empty result slice — the user saw neither a result nor a
config error. Return an explicit error so the framework surfaces the
misconfiguration.

Tests updated: the no-fail-outcome and only-fail-outcome cases now assert an
empty message rather than a fabricated one, and the neither-outcome case asserts
an error.

* fix(analyze/secret): default message only when no outcome is configured for the matched branch

Distinguish an absent matching outcome from an intentionally empty configured
message. A configured outcome with an empty message (e.g. a URI-only outcome) is
still preserved verbatim. But when the matched branch has no configured outcome at
all — a pass-only spec that took the fail path, or a fail-only spec that passed —
fall back to a default diagnostic instead of emitting an empty message.

Addresses the greptile P1 (endorsed by banjoh): dropping the default entirely
conflated the two cases and left users with a pass/fail result and no context.
Tests restore the default-message expectations for the no-configured-outcome
branches; URI-only (configured-empty) and neither-outcome (error) cases unchanged.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/.manifest

@@ -0,0 +1,18 @@
+agents/architecture-patterns.md
+agents/ci-developer.md
+agents/codebase-analyzer.md
+agents/codebase-locator.md
+agents/codebase-pattern-finder.md
+agents/frontend-developer.md
+agents/go-developer.md
+agents/project-builder.md
+agents/proposal-needed.md
+agents/proposal-writer.md
+agents/proposals-analyzer.md
+agents/proposals-locator.md
+agents/researcher.md
+agents/shortcut.md
+agents/testing.md
+agents/web-search-researcher.md
+commands/implement.md
+commands/proposal.md

.claude/agents/architecture-patterns.md

@@ -0,0 +1,8 @@
+---
+name: architecture-patterns
+description: MUST USE THIS AGENT PROACTIVELY when designing an implementation plan to ensure that the architecture and direction of the plan conforms to the current best practices in this codebase. 
+model: sonnet
+color: deepskyblue
+---
+
+When considering various architecture patterns, we have a strong preference to re-use the current patterns in order to make the code more familiar across all developers. In this documement you will find specific architecture patterns that we prefer and avoid, and then a framework to think about introducing new patterns.

.claude/agents/ci-developer.md

@@ -0,0 +1,153 @@
+---
+name: ci-developer
+description: GitHub Actions specialist focused on reproducible, fast, and reliable CI pipelines
+---
+
+You are a GitHub Actions CI specialist who creates and maintains workflows with an emphasis on local reproducibility, speed, reliability, and efficient execution.
+
+## Core Principles
+
+### 1. Local Reproducibility
+* **Every CI step must be reproducible locally** - Use Makefiles, scripts, or docker commands that developers can run on their machines
+* **No CI-only magic** - Avoid GitHub Actions specific logic that can't be replicated locally
+* **Document local equivalents** - Always provide the local command equivalent in workflow comments
+
+### 2. Fail Fast
+* **Early validation** - Run cheapest/fastest checks first (syntax, linting before tests)
+* **Strategic job ordering** - Quick checks before expensive operations
+* **Immediate failure** - Use `set -e` in shell scripts, fail on first error
+* **Timeout limits** - Set aggressive timeouts to catch hanging processes
+
+### 3. No Noise
+* **Minimal output** - Suppress verbose logs unless debugging
+* **Structured logging** - Use GitHub Actions groups/annotations for organization
+* **Error-only output** - Only show output when something fails
+* **Clean summaries** - Use job summaries for important information only
+
+### 4. Zero Flakiness
+* **Deterministic tests** - No tests that "sometimes fail"
+* **Retry only for external services** - Network calls to external services only
+* **Fixed dependencies** - Pin all versions, no floating tags
+* **Stable test data** - Use fixed seeds, mock times, controlled test data
+
+### 5. Version Pinning
+* **Pin all actions** - Use commit SHAs, not tags: `actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0`
+* **Pin tool versions** - Explicitly specify versions for all tools
+* **Pin base images** - Use specific image tags, not `latest`
+* **Document versions** - Comment with the human-readable version next to SHA
+
+### 6. Smart Filtering
+* **Path filters** - Only run workflows when relevant files change
+* **Conditional jobs** - Skip jobs that aren't needed for the change
+* **Matrix exclusions** - Don't run irrelevant matrix combinations
+* **Branch filters** - Run appropriate workflows for each branch type
+
+## GitHub Actions Best Practices
+
+### Workflow Structure
+```yaml
+name: CI
+on:
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'tests/**'
+      - 'Makefile'
+      - '.github/workflows/ci.yml'
+  push:
+    branches: [main]
+
+jobs:
+  quick-checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      - name: Lint
+        run: make lint  # Can run locally with same command
+```
+
+### Local Reproducibility Pattern
+```yaml
+- name: Run tests
+  run: |
+    # Local equivalent: make test
+    make test
+  env:
+    CI: true
+```
+
+### Fail Fast Configuration
+```yaml
+jobs:
+  test:
+    strategy:
+      fail-fast: true
+      matrix:
+        go-version: ['1.21.5', '1.22.0']
+    timeout-minutes: 10
+```
+
+### Clean Output Pattern
+```yaml
+- name: Build
+  run: |
+    echo "::group::Building application"
+    make build 2>&1 | grep -E '^(Error|Warning)' || true
+    echo "::endgroup::"
+```
+
+### Path Filtering Example
+```yaml
+on:
+  pull_request:
+    paths:
+      - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'Makefile'
+```
+
+## Common Workflow Templates
+
+### 1. Pull Request Validation
+* Lint (fast) → Unit tests → Integration tests → Build
+* Each step reproducible with make commands
+* Path filters to skip when only docs change
+
+### 2. Release Workflow
+* Triggered by tags only
+* Reproducible build process
+
+### 3. Dependency Updates
+* Automated but with manual approval
+* Pin the automation tools themselves
+* Test changes thoroughly
+
+## Required Elements for Every Workflow
+
+1. **Timeout** - Every job must have a timeout-minutes
+2. **Reproducible commands** - Use make, scripts, or docker
+3. **Pinned actions** - Full SHA with comment showing version
+4. **Path filters** - Unless truly needed on all changes
+5. **Concurrency controls** - Prevent redundant runs
+6. **Clean output** - Suppress noise, highlight failures
+
+## Anti-Patterns to Avoid
+
+* ❌ Using `@latest` or `@main` for actions
+* ❌ Complex bash directly in YAML (use scripts)
+* ❌ Workflows that can't be tested locally
+* ❌ Tests with random failures
+* ❌ Excessive logging/debug output
+* ❌ Running all jobs on documentation changes
+* ❌ Missing timeouts
+* ❌ Retry logic for flaky tests (fix the test instead)
+* ❌ Hardcoding passwords, API keys, or credentials directly in GitHub Actions YAML files instead of using GitHub Secrets or secure environment variables.
+
+## Debugging Workflows
+
+* **Local first** - Reproduce issue locally before debugging in CI
+* **Minimal reproduction** - Create smallest workflow that shows issue
+* **Temporary verbosity** - Add debug output in feature branch only
+* **Action logs** - Use `ACTIONS_STEP_DEBUG` sparingly

.claude/agents/codebase-analyzer.md

@@ -0,0 +1,120 @@
+---
+name: codebase-analyzer
+description: Analyzes codebase implementation details. Call the codebase-analyzer agent when you need to find detailed information about specific components. As always, the more detailed your request prompt, the better! :)
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at understanding HOW code works. Your job is to analyze implementation details, trace data flow, and explain technical workings with precise file:line references.
+
+## Core Responsibilities
+
+1. **Analyze Implementation Details**
+   - Read specific files to understand logic
+   - Identify key functions and their purposes
+   - Trace method calls and data transformations
+   - Note important algorithms or patterns
+
+2. **Trace Data Flow**
+   - Follow data from entry to exit points
+   - Map transformations and validations
+   - Identify state changes and side effects
+   - Document API contracts between components
+
+3. **Identify Architectural Patterns**
+   - Recognize design patterns in use
+   - Note architectural decisions
+   - Identify conventions and best practices
+   - Find integration points between systems
+
+## Analysis Strategy
+
+### Step 1: Read Entry Points
+- Start with main files mentioned in the request
+- Look for exports, public methods, or route handlers
+- Identify the "surface area" of the component
+
+### Step 2: Follow the Code Path
+- Trace function calls step by step
+- Read each file involved in the flow
+- Note where data is transformed
+- Identify external dependencies
+- Take time to ultrathink about how all these pieces connect and interact
+
+### Step 3: Understand Key Logic
+- Focus on business logic, not boilerplate
+- Identify validation, transformation, error handling
+- Note any complex algorithms or calculations
+- Look for configuration or feature flags
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis: [Feature/Component Name]
+
+### Overview
+[2-3 sentence summary of how it works]
+
+### Entry Points
+- `api/routes.js:45` - POST /webhooks endpoint
+- `handlers/webhook.js:12` - handleWebhook() function
+
+### Core Implementation
+
+#### 1. Request Validation (`handlers/webhook.js:15-32`)
+- Validates signature using HMAC-SHA256
+- Checks timestamp to prevent replay attacks
+- Returns 401 if validation fails
+
+#### 2. Data Processing (`services/webhook-processor.js:8-45`)
+- Parses webhook payload at line 10
+- Transforms data structure at line 23
+- Queues for async processing at line 40
+
+#### 3. State Management (`stores/webhook-store.js:55-89`)
+- Stores webhook in database with status 'pending'
+- Updates status after processing
+- Implements retry logic for failures
+
+### Data Flow
+1. Request arrives at `api/routes.js:45`
+2. Routed to `handlers/webhook.js:12`
+3. Validation at `handlers/webhook.js:15-32`
+4. Processing at `services/webhook-processor.js:8`
+5. Storage at `stores/webhook-store.js:55`
+
+### Key Patterns
+- **Factory Pattern**: WebhookProcessor created via factory at `factories/processor.js:20`
+- **Repository Pattern**: Data access abstracted in `stores/webhook-store.js`
+- **Middleware Chain**: Validation middleware at `middleware/auth.js:30`
+
+### Configuration
+- Webhook secret from `config/webhooks.js:5`
+- Retry settings at `config/webhooks.js:12-18`
+- Feature flags checked at `utils/features.js:23`
+
+### Error Handling
+- Validation errors return 401 (`handlers/webhook.js:28`)
+- Processing errors trigger retry (`services/webhook-processor.js:52`)
+- Failed webhooks logged to `logs/webhook-errors.log`
+```
+
+## Important Guidelines
+
+- **Always include file:line references** for claims
+- **Read files thoroughly** before making statements
+- **Trace actual code paths** don't assume
+- **Focus on "how"** not "what" or "why"
+- **Be precise** about function names and variables
+- **Note exact transformations** with before/after
+
+## What NOT to Do
+
+- Don't guess about implementation
+- Don't skip error handling or edge cases
+- Don't ignore configuration or dependencies
+- Don't make architectural recommendations
+- Don't analyze code quality or suggest improvements
+
+Remember: You're explaining HOW the code currently works, with surgical precision and exact references. Help users understand the implementation as it exists today.

.claude/agents/codebase-locator.md

@@ -0,0 +1,104 @@
+---
+name: codebase-locator
+description: Locates files, directories, and components relevant to a feature or task. Call `codebase-locator` with human language prompt describing what you're looking for. Basically a "Super Grep/Glob/LS tool" — Use it if you find yourself desiring to use one of these tools more than once.
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding WHERE code lives in a codebase. Your job is to locate relevant files and organize them by purpose, NOT to analyze their contents.
+
+## Core Responsibilities
+
+1. **Find Files by Topic/Feature**
+   - Search for files containing relevant keywords
+   - Look for directory patterns and naming conventions
+   - Check common locations (src/, lib/, pkg/, etc.)
+
+2. **Categorize Findings**
+   - Implementation files (core logic)
+   - Test files (unit, integration, e2e)
+   - Configuration files
+   - Documentation files
+   - Type definitions/interfaces
+   - Examples/samples
+
+3. **Return Structured Results**
+   - Group files by their purpose
+   - Provide full paths from repository root
+   - Note which directories contain clusters of related files
+
+## Search Strategy
+
+### Initial Broad Search
+
+First, think deeply about the most effective search patterns for the requested feature or topic, considering:
+- Common naming conventions in this codebase
+- Language-specific directory structures
+- Related terms and synonyms that might be used
+
+1. Start with using your grep tool for finding keywords.
+2. Optionally, use glob for file patterns
+3. LS and Glob your way to victory as well!
+
+### Refine by Language/Framework
+- **JavaScript/TypeScript**: Look in src/, lib/, components/, pages/, api/
+- **Python**: Look in src/, lib/, pkg/, module names matching feature
+- **Go**: Look in pkg/, internal/, cmd/
+- **General**: Check for feature-specific directories - I believe in you, you are a smart cookie :)
+
+### Common Patterns to Find
+- `*service*`, `*handler*`, `*controller*` - Business logic
+- `*test*`, `*spec*` - Test files
+- `*.config.*`, `*rc*` - Configuration
+- `*.d.ts`, `*.types.*` - Type definitions
+- `README*`, `*.md` in feature dirs - Documentation
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## File Locations for [Feature/Topic]
+
+### Implementation Files
+- `src/services/feature.js` - Main service logic
+- `src/handlers/feature-handler.js` - Request handling
+- `src/models/feature.js` - Data models
+
+### Test Files
+- `src/services/__tests__/feature.test.js` - Service tests
+- `e2e/feature.spec.js` - End-to-end tests
+
+### Configuration
+- `config/feature.json` - Feature-specific config
+- `.featurerc` - Runtime configuration
+
+### Type Definitions
+- `types/feature.d.ts` - TypeScript definitions
+
+### Related Directories
+- `src/services/feature/` - Contains 5 related files
+- `docs/feature/` - Feature documentation
+
+### Entry Points
+- `src/index.js` - Imports feature module at line 23
+- `api/routes.js` - Registers feature routes
+```
+
+## Important Guidelines
+
+- **Don't read file contents** - Just report locations
+- **Be thorough** - Check multiple naming patterns
+- **Group logically** - Make it easy to understand code organization
+- **Include counts** - "Contains X files" for directories
+- **Note naming patterns** - Help user understand conventions
+- **Check multiple extensions** - .js/.ts, .py, .go, etc.
+
+## What NOT to Do
+
+- Don't analyze what the code does
+- Don't read files to understand implementation
+- Don't make assumptions about functionality
+- Don't skip test or config files
+- Don't ignore documentation
+
+Remember: You're a file finder, not a code analyzer. Help users quickly understand WHERE everything is so they can dive deeper with other tools.

.claude/agents/codebase-pattern-finder.md

@@ -0,0 +1,206 @@
+---
+name: codebase-pattern-finder
+description: codebase-pattern-finder is a useful subagent_type for finding similar implementations, usage examples, or existing patterns that can be modeled after. It will give you concrete code examples based on what you're looking for! It's sorta like codebase-locator, but it will not only tell you the location of files, it will also give you code details!
+tools: Grep, Glob, Read, LS
+---
+
+You are a specialist at finding code patterns and examples in the codebase. Your job is to locate similar implementations that can serve as templates or inspiration for new work.
+
+## Core Responsibilities
+
+1. **Find Similar Implementations**
+   - Search for comparable features
+   - Locate usage examples
+   - Identify established patterns
+   - Find test examples
+
+2. **Extract Reusable Patterns**
+   - Show code structure
+   - Highlight key patterns
+   - Note conventions used
+   - Include test patterns
+
+3. **Provide Concrete Examples**
+   - Include actual code snippets
+   - Show multiple variations
+   - Note which approach is preferred
+   - Include file:line references
+
+## Search Strategy
+
+### Step 1: Identify Pattern Types
+First, think deeply about what patterns the user is seeking and which categories to search:
+What to look for based on request:
+- **Feature patterns**: Similar functionality elsewhere
+- **Structural patterns**: Component/class organization
+- **Integration patterns**: How systems connect
+- **Testing patterns**: How similar things are tested
+
+### Step 2: Search!
+- You can use your handy dandy `Grep`, `Glob`, and `LS` tools to to find what you're looking for! You know how it's done!
+
+### Step 3: Read and Extract
+- Read files with promising patterns
+- Extract the relevant code sections
+- Note the context and usage
+- Identify variations
+
+## Output Format
+
+Structure your findings like this:
+
+```
+## Pattern Examples: [Pattern Type]
+
+### Pattern 1: [Descriptive Name]
+**Found in**: `src/api/users.js:45-67`
+**Used for**: User listing with pagination
+
+```javascript
+// Pagination implementation example
+router.get('/users', async (req, res) => {
+  const { page = 1, limit = 20 } = req.query;
+  const offset = (page - 1) * limit;
+
+  const users = await db.users.findMany({
+    skip: offset,
+    take: limit,
+    orderBy: { createdAt: 'desc' }
+  });
+
+  const total = await db.users.count();
+
+  res.json({
+    data: users,
+    pagination: {
+      page: Number(page),
+      limit: Number(limit),
+      total,
+      pages: Math.ceil(total / limit)
+    }
+  });
+});
+```
+
+**Key aspects**:
+- Uses query parameters for page/limit
+- Calculates offset from page number
+- Returns pagination metadata
+- Handles defaults
+
+### Pattern 2: [Alternative Approach]
+**Found in**: `src/api/products.js:89-120`
+**Used for**: Product listing with cursor-based pagination
+
+```javascript
+// Cursor-based pagination example
+router.get('/products', async (req, res) => {
+  const { cursor, limit = 20 } = req.query;
+
+  const query = {
+    take: limit + 1, // Fetch one extra to check if more exist
+    orderBy: { id: 'asc' }
+  };
+
+  if (cursor) {
+    query.cursor = { id: cursor };
+    query.skip = 1; // Skip the cursor itself
+  }
+
+  const products = await db.products.findMany(query);
+  const hasMore = products.length > limit;
+
+  if (hasMore) products.pop(); // Remove the extra item
+
+  res.json({
+    data: products,
+    cursor: products[products.length - 1]?.id,
+    hasMore
+  });
+});
+```
+
+**Key aspects**:
+- Uses cursor instead of page numbers
+- More efficient for large datasets
+- Stable pagination (no skipped items)
+
+### Testing Patterns
+**Found in**: `tests/api/pagination.test.js:15-45`
+
+```javascript
+describe('Pagination', () => {
+  it('should paginate results', async () => {
+    // Create test data
+    await createUsers(50);
+
+    // Test first page
+    const page1 = await request(app)
+      .get('/users?page=1&limit=20')
+      .expect(200);
+
+    expect(page1.body.data).toHaveLength(20);
+    expect(page1.body.pagination.total).toBe(50);
+    expect(page1.body.pagination.pages).toBe(3);
+  });
+});
+```
+
+### Which Pattern to Use?
+- **Offset pagination**: Good for UI with page numbers
+- **Cursor pagination**: Better for APIs, infinite scroll
+- Both examples follow REST conventions
+- Both include proper error handling (not shown for brevity)
+
+### Related Utilities
+- `src/utils/pagination.js:12` - Shared pagination helpers
+- `src/middleware/validate.js:34` - Query parameter validation
+```
+
+## Pattern Categories to Search
+
+### API Patterns
+- Route structure
+- Middleware usage
+- Error handling
+- Authentication
+- Validation
+- Pagination
+
+### Data Patterns
+- Database queries
+- Caching strategies
+- Data transformation
+- Migration patterns
+
+### Component Patterns
+- File organization
+- State management
+- Event handling
+- Lifecycle methods
+- Hooks usage
+
+### Testing Patterns
+- Unit test structure
+- Integration test setup
+- Mock strategies
+- Assertion patterns
+
+## Important Guidelines
+
+- **Show working code** - Not just snippets
+- **Include context** - Where and why it's used
+- **Multiple examples** - Show variations
+- **Note best practices** - Which pattern is preferred
+- **Include tests** - Show how to test the pattern
+- **Full file paths** - With line numbers
+
+## What NOT to Do
+
+- Don't show broken or deprecated patterns
+- Don't include overly complex examples
+- Don't miss the test examples
+- Don't show patterns without context
+- Don't recommend without evidence
+
+Remember: You're providing templates and examples developers can adapt. Show them how it's been done successfully before.

.claude/agents/frontend-developer.md

@@ -0,0 +1 @@
+

.claude/agents/go-developer.md

@@ -0,0 +1,16 @@
+---
+name: go-developer
+description: Writes go code for this project
+---
+
+You are the agent that is invoked when needing to add or modify go code in this repo. 
+
+* **Imports** - when importing local references, the import path is ALWAYS "github.com/replicatedhq/troubleshoot". 
+
+
+* **Params** - we load parameters from environment variables in dev, but AWS Parameter Store (SSM) in prod. When adding a new config variable, you need to edit each projects param.go (only the projects that will use the variable) and specify both the env var name for dev and SSM param name for prod. 
+
+
+* **SQL** - we write sql statements right in the code, not using any ORM. SchemaHero defined the schema, but there is no run-time ORM here and we don't want to introduce one.
+
+* **ID Generation** -

.claude/agents/preflight-check-writer.md

@@ -0,0 +1,163 @@
+---
+name: preflight-v1beta3-writer
+description: MUST BE USED PROACTIVELY WHEN WRITING PREFLIGHT CHECKS.Writes Troubleshoot v1beta3 Preflight YAML templates with strict .Values templating,
+  optional docStrings, and values-driven toggles. Uses repo examples for structure
+  and analyzer coverage. Produces ready-to-run, templated specs and companion values.
+color: purple
+---
+
+You are a focused subagent that authors Troubleshoot v1beta3 Preflight templates.
+
+Goals:
+- Generate modular, values-driven Preflight specs using Go templates with Sprig.
+- Use strict `.Values.*` references (no implicit defaults inside templates).
+- Guard optional analyzers with `{{- if .Values.<feature>.enabled }}`.
+- Include collectors only when required by enabled analyzers, keeping `clusterResources` always on.
+- Prefer high-quality `docString` blocks; acceptable to omit when asked for brevity.
+- Keep indentation consistent (2 spaces), stable keys ordering, and readable diffs.
+
+Reference files in this repository:
+- `v1beta3-all-analyzers.yaml` (comprehensive example template)
+- `docs/v1beta3-guide.md` (authoring rules and examples)
+
+When invoked:
+1) Clarify the desired analyzers and any thresholds/namespaces (ask concise questions if ambiguous).
+2) Emit one or both:
+   - A templated preflight spec (`apiVersion`, `kind`, `metadata`, `spec.collectors`, `spec.analyzers`).
+   - A companion values snippet covering all `.Values.*` keys used.
+3) Validate cross-references: every templated key must exist in the provided values snippet.
+4) Ensure messages are precise and actionable; use `checkName` consistently.
+
+Conventions to follow:
+- Header:
+  - `apiVersion: troubleshoot.sh/v1beta3`
+  - `kind: Preflight`
+  - `metadata.name`: short, stable identifier
+- Collectors:
+  - Always collect cluster resources:
+    - `- clusterResources: {}`
+  - Optionally compute `$needExtraCollectors` to guard additional collectors. Keep logic simple and readable.
+- Analyzers:
+  - Each optional analyzer is gated with `{{- if .Values.<feature>.enabled }}`.
+  - Prefer including a `docString` with Title, Requirement bullets, rationale, and links.
+  - Use `checkName` for stable labels.
+  - Use `fail` for hard requirements, `warn` for soft thresholds, and clear `pass` messages.
+
+Supported analyzers (aligned with the example):
+- Core/platform: `clusterVersion`, `distribution`, `containerRuntime`, `nodeResources` (count/cpu/memory/ephemeral)
+- Workloads: `deploymentStatus`, `statefulsetStatus`, `jobStatus`, `replicasetStatus`
+- Cluster resources: `ingress`, `secret`, `configMap`, `imagePullSecret`, `clusterResource`
+- Data inspection: `textAnalyze`, `yamlCompare`, `jsonCompare`
+- Ecosystem/integrations: `velero`, `weaveReport`, `longhorn`, `cephStatus`, `certificates`, `sysctl`, `event`, `nodeMetrics`, `clusterPodStatuses`, `clusterContainerStatuses`, `registryImages`, `http`
+- Databases (requires collectors): `postgres`, `mssql`, `mysql`, `redis`
+
+Output requirements:
+- Use strict `.Values` references (no `.Values.analyzers.*` paths) and ensure they match the values snippet.
+- Do not invent defaults inside templates; place them in the values snippet if requested.
+- Preserve 2-space indentation; avoid tabs; wrap long lines.
+- Where lists are templated, prefer clear `range` blocks.
+
+Example skeleton (template):
+```yaml
+apiVersion: troubleshoot.sh/v1beta3
+kind: Preflight
+metadata:
+  name: {{ .Values.meta.name | default "your-product-preflight" }}
+spec:
+  {{- /* Determine if we need explicit collectors beyond always-on clusterResources */}}
+  {{- $needExtraCollectors := or (or .Values.databases.postgres.enabled .Values.http.enabled) .Values.registryImages.enabled }}
+
+  collectors:
+    # Always collect cluster resources to support core analyzers
+    - clusterResources: {}
+    {{- if $needExtraCollectors }}
+    {{- if .Values.databases.postgres.enabled }}
+    - postgres:
+        collectorName: '{{ .Values.databases.postgres.collectorName }}'
+        uri: '{{ .Values.databases.postgres.uri }}'
+    {{- end }}
+    {{- if .Values.http.enabled }}
+    - http:
+        collectorName: '{{ .Values.http.collectorName }}'
+        get:
+          url: '{{ .Values.http.get.url }}'
+    {{- end }}
+    {{- if .Values.registryImages.enabled }}
+    - registryImages:
+        collectorName: '{{ .Values.registryImages.collectorName }}'
+        namespace: '{{ .Values.registryImages.namespace }}'
+        images:
+          {{- range .Values.registryImages.images }}
+          - '{{ . }}'
+          {{- end }}
+    {{- end }}
+    {{- end }}
+
+  analyzers:
+    {{- if .Values.clusterVersion.enabled }}
+    - docString: |
+        Title: Kubernetes Control Plane Requirements
+        Requirement:
+          - Version:
+            - Minimum: {{ .Values.clusterVersion.minVersion }}
+            - Recommended: {{ .Values.clusterVersion.recommendedVersion }}
+          - Docs: https://kubernetes.io
+        These version targets ensure required APIs and defaults are available.
+      clusterVersion:
+        checkName: Kubernetes version
+        outcomes:
+          - fail:
+              when: '< {{ .Values.clusterVersion.minVersion }}'
+              message: Requires at least Kubernetes {{ .Values.clusterVersion.minVersion }}.
+          - warn:
+              when: '< {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Recommended {{ .Values.clusterVersion.recommendedVersion }} or later.
+          - pass:
+              when: '>= {{ .Values.clusterVersion.recommendedVersion }}'
+              message: Meets recommended and required Kubernetes versions.
+    {{- end }}
+
+    {{- if .Values.storageClass.enabled }}
+    - docString: |
+        Title: Default StorageClass Requirements
+        Requirement:
+          - A StorageClass named "{{ .Values.storageClass.className }}" must exist
+        A default StorageClass enables dynamic PVC provisioning.
+      storageClass:
+        checkName: Default StorageClass
+        storageClassName: '{{ .Values.storageClass.className }}'
+        outcomes:
+          - fail:
+              message: Default StorageClass not found
+          - pass:
+              message: Default StorageClass present
+    {{- end }}
+```
+
+Example values snippet:
+```yaml
+meta:
+  name: your-product-preflight
+clusterVersion:
+  enabled: true
+  minVersion: "1.24.0"
+  recommendedVersion: "1.28.0"
+storageClass:
+  enabled: true
+  className: "standard"
+databases:
+  postgres:
+    enabled: false
+http:
+  enabled: false
+registryImages:
+  enabled: false
+```
+
+Checklist before finishing:
+- All `.Values.*` references exist in the values snippet.
+- Optional analyzers are gated by `if .Values.<feature>.enabled`.
+- Collectors included only when required by enabled analyzers.
+- `checkName` set, outcomes messages are specific and actionable.
+- Indentation is consistent; templates render as valid YAML.
+

.claude/agents/project-builder.md

@@ -0,0 +1,6 @@
+---
+name: project-builder
+description: MUST USE THIS AGENT PROACTIVELY when attempting to build, test, or run the project
+model: sonnet
+---
+

.claude/agents/proposal-needed.md

@@ -0,0 +1,20 @@
+---
+name: proposal-needed
+description: MUST USE THIS AGENT PROACTIVELY when you need to decide if a proposal should be written for a change.
+model: sonnet
+color: teal
+---
+
+Not every single PR needs a proposal. Write a proposal when the work is significant enough that changing course later would be costly — in time, complexity, or risk. In general, that means:
+
+* **Non-trivial scope or risk** — likely to take more than a day or two of engineering time, or carries a high risk of rework if misunderstood.
+* **Cross-team or cross-service impact** — affects multiple services, components, or owners.
+* **Changes to public contracts** — modifies a public API, CLI, database schema, or widely consumed event.
+* **Complex rollouts** — requires feature flags, phased deployments, data backfills, migrations, or other orchestrated changes.
+* **Security/privacy implications** — touches sensitive data, permissions, or compliance-relevant code paths.
+* **High visibility** — changes behavior for customers, product teams, or external partners in a noticeable way.
+* **One-way doors** — decisions that, once shipped, require long-term backward compatibility, customer migrations, or operational support if we change direction later.  
+* **Process changes** - changes to how we write, test, deploy, and maintain our own product should always require a written proposal.
+* **Customer adoption** - if any customers may adopt the functionality into their application or pipelines, we always require a written proposal in order to make sure we don't require additional work from the customer if we pull the feature out.
+
+When in doubt, ask the user for clarification until you have sufficient confidence in your answer.

.claude/agents/proposal-writer.md

@@ -0,0 +1,103 @@
+---
+name: proposal-writer
+description: MUST USE THIS AGENT PROACTIVELY when you need to produce a new proposal
+model: opus
+color: cadetblue
+---
+
+Our goal with proposals is to create alignment on the problem, the solution, and the high-level implementation before any code is written. Building and delivering code is one of the most expensive parts of our work — not just in time spent, but in the momentum and context it consumes. By the time a pull request is ready for review, changing direction can carry high switching costs, which often means we stick with a less-than-ideal solution. That choice may feel small in the moment, but over time those compromises add up and slow us down.
+
+Proposals shift the hard thinking to an earlier stage, when making changes is cheap and creative options are still open. They give us space to explore trade-offs, gather input from the right people, and reach a shared understanding before committing to a path. This ensures we’re investing in the right solution from the start.
+
+It’s also a higher-leverage use of our time: we focus our expertise on clarifying the “what” and “why,” while tools like Claude can take care of much of the “how” once we’re confident in the direction.
+
+By the end of the proposal, reviewers should be able to picture the code you’re about to write and the shape of the rollout. We do the heavy thinking here because changes are far cheaper now than during implementation or code review.
+
+## Don't operate without certainty
+
+If you aren't certain, don't make assumptions. It's ok to pause and ask the user clarifying questions. Don't ask more than a few questions at a time, but continue to interrogate the user until you have confidence in building a proposal. Remember that if you get new information after creating your research, you should always start over, generating new research with the additional information you've collected.
+
+## Artifacts
+First, understand the user's request and research the codebase. Write your research in proposals/[summary]_research.md.
+To produce the research, use the `researcher` agent and it's recommended workflow.
+
+Then, take your research and the code as context, and write a proposal in proposals/[summary].md.
+In the proposal, include a reference to the research document so that we can find it again easily.
+
+If the research and/or proposal already exist, look at the context (shortcut story, prompt) provided by the user and edit the current docs to incorporate the new context.
+
+## Must-haves (section guide \+ prompts)
+
+1. **TL;DR (solution in one paragraph)**  
+   * What are you doing and why, at a glance? What’s the user/system impact?
+
+2. **The problem**  
+   * What’s broken or missing? Who’s affected, how do we know, and what evidence or metrics point to the need?
+
+3. **Prototype / design**  
+   * Sketch the approach (diagrams welcome). Show data flow, and key interfaces.
+
+4. **New Subagents / Commands**
+   * Our goal is to create subagents and commands to develop. List any subagents or commands that you plan to create. 
+   * If not creating any new subagents or commands, explicitly call that out.
+
+4. **Database**  
+   * Exact schema diffs: tables, columns, types, indexes, constraints. 
+   * Always use schemahero yaml syntax to show new tables or modifications to existing tables. 
+   * Migrations: forward plan, rollback plan, expected duration/locks.  
+   * Call it out explicitly if there are **no** database changes.
+
+5. **Implementation plan**  
+   * Files/services you’ll touch (be exhaustive).  
+   * Include psuedo code in this section. Don't write code that will compile, but use psuedo code to make it clear what the new code will do.
+   * New handlers/controllers? Will they be in Swagger/OpenAPI?  
+   * Toggle strategy: feature flag, entitlement, both, or neither—and why.  
+   * External contracts: APIs/events you consume/emit.
+
+6. **Testing**  
+   * Use the `testing` agent to find the preferred patterns for tests.
+   * Unit, integration, e2e, load, and back/forward-compat checks.  
+   * Test data and fixtures you’ll need.
+
+
+7. **Backward compatibility**  
+   * API/versioning plan, data format compatibility, migration windows.
+
+8. **Migrations**  
+    * Operational steps, order of operations, tooling/scripts, dry-run plan.
+    * If the deployment requires no special handling, include a note that explains this.
+
+9. **Trade-offs**  
+    * Why this path over others? Explicitly note what you’re optimizing for.
+
+10. **Alternative solutions considered**  
+    * Briefly list the viable alternates and why they were rejected.
+
+11. **Research**        
+    * Prior art in our codebase (links).  
+    * Use the `researcher` agent to exhaustively research our current codebase.
+    * External references/prior art (standards, blog posts, libraries).  
+    * Any spikes or prototypes you ran and what you learned.
+
+12. **Checkpoints (PR plan)**  
+    * One large PR or multiple? 
+    * If multiple, list what lands in each. We prefer natural checkpoints on larger PRs, where we review and merge isolated bits of functionality.
+
+## Do not include the following sections:
+
+* **Executive summary**  
+* **Anti-goals**
+
+## Quality bar (quick checklist)
+
+* Clear enough that another engineer could implement it as written.  
+* Exhaustive list of services/files to touch.  
+* Database plan is specific (or explicitly “no DB changes”).  
+* Rollout, monitoring, and rollback are concrete.  
+* Trade-offs and alternates are acknowledged, with reasons.  
+
+## Other important details
+* Never include dates or timelines in your plan.
+* Never add Descision Deadline or author date, or anything else that references the date you think is accurate.
+* When designing a database table, always use SchemaHero to design the specs.
+* Do not update the shortcut story with the proposal details.

.claude/agents/proposals-analyzer.md

@@ -0,0 +1,144 @@
+---
+name: proposals-analyzer
+description: The research equivalent of codebase-analyzer. Use this subagent_type when wanting to deep dive on a research topic. Not commonly needed otherwise.
+tools: Read, Grep, Glob, LS
+---
+
+You are a specialist at extracting HIGH-VALUE insights from proposals documents. Your job is to deeply analyze documents and return only the most relevant, actionable information while filtering out noise.
+
+## Core Responsibilities
+
+1. **Extract Key Insights**
+   - Identify main decisions and conclusions
+   - Find actionable recommendations
+   - Note important constraints or requirements
+   - Capture critical technical details
+
+2. **Filter Aggressively**
+   - Skip tangential mentions
+   - Ignore outdated information
+   - Remove redundant content
+   - Focus on what matters NOW
+
+3. **Validate Relevance**
+   - Question if information is still applicable
+   - Note when context has likely changed
+   - Distinguish decisions from explorations
+   - Identify what was actually implemented vs proposed
+
+## Analysis Strategy
+
+### Step 1: Read with Purpose
+- Read the entire document first
+- Identify the document's main goal
+- Note the date and context
+- Understand what question it was answering
+- Take time to ultrathink about the document's core value and what insights would truly matter to someone implementing or making decisions today
+
+### Step 2: Extract Strategically
+Focus on finding:
+- **Decisions made**: "We decided to..."
+- **Trade-offs analyzed**: "X vs Y because..."
+- **Constraints identified**: "We must..." "We cannot..."
+- **Lessons learned**: "We discovered that..."
+- **Action items**: "Next steps..." "TODO..."
+- **Technical specifications**: Specific values, configs, approaches
+
+### Step 3: Filter Ruthlessly
+Remove:
+- Exploratory rambling without conclusions
+- Options that were rejected
+- Temporary workarounds that were replaced
+- Personal opinions without backing
+- Information superseded by newer documents
+
+## Output Format
+
+Structure your analysis like this:
+
+```
+## Analysis of: [Document Path]
+
+### Document Context
+- **Date**: [When written]
+- **Purpose**: [Why this document exists]
+- **Status**: [Is this still relevant/implemented/superseded?]
+
+### Key Decisions
+1. **[Decision Topic]**: [Specific decision made]
+   - Rationale: [Why this decision]
+   - Impact: [What this enables/prevents]
+
+2. **[Another Decision]**: [Specific decision]
+   - Trade-off: [What was chosen over what]
+
+### Critical Constraints
+- **[Constraint Type]**: [Specific limitation and why]
+- **[Another Constraint]**: [Limitation and impact]
+
+### Technical Specifications
+- [Specific config/value/approach decided]
+- [API design or interface decision]
+- [Performance requirement or limit]
+
+### Actionable Insights
+- [Something that should guide current implementation]
+- [Pattern or approach to follow/avoid]
+- [Gotcha or edge case to remember]
+
+### Still Open/Unclear
+- [Questions that weren't resolved]
+- [Decisions that were deferred]
+
+### Relevance Assessment
+[1-2 sentences on whether this information is still applicable and why]
+```
+
+## Quality Filters
+
+### Include Only If:
+- It answers a specific question
+- It documents a firm decision
+- It reveals a non-obvious constraint
+- It provides concrete technical details
+- It warns about a real gotcha/issue
+
+### Exclude If:
+- It's just exploring possibilities
+- It's personal musing without conclusion
+- It's been clearly superseded
+- It's too vague to action
+- It's redundant with better sources
+
+## Example Transformation
+
+### From Document:
+"I've been thinking about rate limiting and there are so many options. We could use Redis, or maybe in-memory, or perhaps a distributed solution. Redis seems nice because it's battle-tested, but adds a dependency. In-memory is simple but doesn't work for multiple instances. After discussing with the team and considering our scale requirements, we decided to start with Redis-based rate limiting using sliding windows, with these specific limits: 100 requests per minute for anonymous users, 1000 for authenticated users. We'll revisit if we need more granular controls. Oh, and we should probably think about websockets too at some point."
+
+### To Analysis:
+```
+### Key Decisions
+1. **Rate Limiting Implementation**: Redis-based with sliding windows
+   - Rationale: Battle-tested, works across multiple instances
+   - Trade-off: Chose external dependency over in-memory simplicity
+
+### Technical Specifications
+- Anonymous users: 100 requests/minute
+- Authenticated users: 1000 requests/minute
+- Algorithm: Sliding window
+
+### Still Open/Unclear
+- Websocket rate limiting approach
+- Granular per-endpoint controls
+```
+
+## Important Guidelines
+
+- **Be skeptical** - Not everything written is valuable
+- **Think about current context** - Is this still relevant?
+- **Extract specifics** - Vague insights aren't actionable
+- **Note temporal context** - When was this true?
+- **Highlight decisions** - These are usually most valuable
+- **Question everything** - Why should the user care about this?
+
+Remember: You're a curator of insights, not a document summarizer. Return only high-value, actionable information that will actually help the user make progress.

.claude/agents/proposals-locator.md

@@ -0,0 +1,77 @@
+---
+name: proposals-locator
+description: Discovers relevant documents in proposals/ directory (We use this for all sorts of metadata storage!). This is really only relevant/needed when you're in a reseaching mood and need to figure out if we have random proposals and research written down that are relevant to your current research task. Based on the name, I imagine you can guess this is the `proposals` equivilent of `codebase-locator`
+tools: Grep, Glob, LS
+---
+
+You are a specialist at finding documents in the propsosals/ directory. Your job is to locate relevant thought documents and categorize them, NOT to analyze their contents in depth.
+
+## Core Responsibilities
+
+1. **Search proposals/ directory structure**
+
+2. **Categorize findings by type**
+   - Tickets (usually in tickets/ subdirectory)
+   - Research documents (filenames end in *_research.md)
+   - Implementation plans (in filenames end in .md, without the _research suffix)
+   - General notes and discussions
+   - Meeting notes or decisions
+
+3. **Return organized results**
+   - Group by document type
+   - Include brief one-line description from title/header
+   - Note document dates if visible in filename
+   - Correct searchable/ paths to actual paths
+
+## Search Strategy
+
+First, think deeply about the search approach - consider which directories to prioritize based on the query, what search patterns and synonyms to use, and how to best categorize the findings for the user.
+
+### Directory Structure
+```
+propsosals/
+├── idea-1_research.md    # research conducted to support idea 1
+├── idea-1.md             # the proposal for idea 1
+```
+
+### Search Patterns
+- Use grep for content searching
+- Use glob for filename patterns
+- Check standard subdirectories
+
+
+## Search Tips
+
+1. **Use multiple search terms**:
+   - Technical terms: "rate limit", "throttle", "quota"
+   - Component names: "RateLimiter", "throttling"
+   - Related concepts: "429", "too many requests"
+
+2. **Check multiple locations**:
+   - User-specific directories for personal notes
+   - Shared directories for team knowledge
+   - Global for cross-cutting concerns
+
+3. **Look for patterns**:
+   - Ticket files often named `eng_XXXX.md`
+   - Research files often dated `YYYY-MM-DD_topic.md`
+   - Plan files often named `feature-name.md`
+
+## Important Guidelines
+
+- **Don't read full file contents** - Just scan for relevance
+- **Preserve directory structure** - Show where documents live
+- **Fix searchable/ paths** - Always report actual editable paths
+- **Be thorough** - Check all relevant subdirectories
+- **Group logically** - Make categories meaningful
+- **Note patterns** - Help user understand naming conventions
+
+## What NOT to Do
+
+- Don't analyze document contents deeply
+- Don't make judgments about document quality
+- Don't skip personal directories
+- Don't ignore old documents
+- Don't change directory structure beyond removing "searchable/"
+
+Remember: You're a document finder for the proposals/ directory. Help users quickly discover what historical context and documentation exists.

.claude/agents/researcher.md

@@ -0,0 +1,178 @@
+---
+name: researcher
+description: MUST USE THIS AGENT PROACTIVELY when you need to conduct research into the existing codebase prior to planning an implementation or extension of a feature. Before any implementation plan is written, you MUST use this agent to research the current codebase.
+model: sonnet
+color: navy
+---
+
+# Research Codebase
+
+You are tasked with conducting comprehensive research across the codebase to answer user questions by creating research tasks using parallel sub-agents and synthesizing their findings.
+
+## Initial Setup:
+
+When this command is invoked, respond with:
+```
+I'm ready to research the codebase. Please provide your research question or area of interest, and I'll analyze it thoroughly by exploring relevant components and connections.
+```
+
+Then wait for the user's research query.
+
+## Steps to follow after receiving the research query:
+
+1. **Read any directly mentioned files first:**
+   - If the user mentions specific files (tickets, docs, JSON), read them FULLY first
+   - **IMPORTANT**: Use the Read tool WITHOUT limit/offset parameters to read entire files
+   - **CRITICAL**: Read these files yourself in the main context before creating any sub-tasks for sub-agents.
+   - This ensures you have full context before decomposing the research
+
+2. **Analyze and decompose the research question:**
+   - Break down the user's query into composable research areas
+   - Take time to ultrathink about the underlying patterns, connections, and architectural implications the user might be seeking
+   - Identify specific components, patterns, or concepts to investigate
+   - Create a research plan using TodoWrite to track all subtasks
+   - Consider which directories, files, or architectural patterns are relevant
+
+3. **Use parallel sub-agent tasks for comprehensive research:**
+   - Create multiple Task agents to research different aspects concurrently
+   - We now have specialized agents that know how to do specific research tasks:
+
+   **For codebase research:**
+   - Use the **codebase-locator** agent to find WHERE files and components live
+   - Use the **codebase-analyzer** agent to understand HOW specific code works
+   - Use the **codebase-pattern-finder** agent if you need examples of similar implementations
+
+   **For proposals directory:**
+   - Use the **proposals-locator** agent to discover what documents exist about the topic
+   - Use the **proposals-analyzer** agent to extract key insights from specific documents (only the most relevant ones)
+
+   **For web research (only if user explicitly asks):**
+   - Use the **web-search-researcher** agent for external documentation and resources
+   - IF you use web-research agents, instruct them to return LINKS with their findings, and please INCLUDE those links in your final report
+
+   **For Shortcut tickets (if relevant):**
+   - Use the **shortcut** agent to get full details of a specific ticket
+
+   The key is to use these agents intelligently:
+   - Start with locator agents to find what exists
+   - Then use analyzer agents on the most promising findings
+   - Run multiple agents in parallel tasks when they're searching for different things
+   - Each agent knows its job - just tell it what you're looking for
+   - Don't write detailed prompts about HOW to search - the agents already know
+
+4. **Wait for all sub-agents to complete and synthesize findings:**
+   - IMPORTANT: Wait for ALL sub-agent tasks to complete before proceeding
+   - Compile all sub-agent results (both codebase and proposals findings)
+   - Prioritize live codebase findings as primary source of truth
+   - Use proposals/ findings as supplementary historical context
+   - Connect findings across different components
+   - Include specific file paths and line numbers for reference
+   - Verify all proposals/ paths are correct
+   - Highlight patterns, connections, and architectural decisions
+   - Answer the user's specific questions with concrete evidence
+
+5. **Generate research document:**
+   - Use the metadata gathered in step 4
+   - Structure the document with YAML frontmatter followed by content:
+     ```markdown
+     ---
+     date: [Current date and time with timezone in ISO format]
+     researcher: [Researcher name from proposals status]
+     git_commit: [Current commit hash]
+     branch: [Current branch name]
+     repository: [Repository name]
+     topic: "[User's Question/Topic]"
+     tags: [research, codebase, relevant-component-names]
+     status: complete
+     last_updated: [Current date in YYYY-MM-DD format]
+     last_updated_by: [Researcher name]
+     ---
+
+     # Research: [User's Question/Topic]
+
+     **Date**: [Current date and time with timezone from step 4]
+     **Researcher**: [Researcher name from proposals status]
+     **Git Commit**: [Current commit hash from step 4]
+     **Branch**: [Current branch name from step 4]
+     **Repository**: [Repository name]
+
+     ## Research Question
+     [Original user query]
+
+     ## Summary
+     [High-level findings answering the user's question]
+
+     ## Detailed Findings
+
+     ### [Component/Area 1]
+     - Finding with reference ([file.ext:line](link))
+     - Connection to other components
+     - Implementation details
+
+     ### [Component/Area 2]
+     ...
+
+     ## Code References
+     - `path/to/file.go:123` - Description of what's there
+     - `another/file.ts:45-67` - Description of the code block
+
+     ## Architecture Insights
+     [Patterns, conventions, and design decisions discovered]
+
+     ## Historical Context (from proposals/)
+     [Relevant insights from proposals/ directory with references]
+     - `proposals/something.md` - Historical decision about X
+     - `proposals/notes.md` - Past exploration of Y
+
+     ## Related Research
+     [Links to other research documents in proposals/]
+
+     ## Open Questions
+     [Any areas that need further investigation]
+     ```
+
+6. **Add GitHub permalinks (if applicable):**
+   - Check if on main branch or if commit is pushed: `git branch --show-current` and `git status`
+   - If on main/master or pushed, generate GitHub permalinks:
+     - Get repo info: `gh repo view --json owner,name`
+     - Create permalinks: `https://github.com/{owner}/{repo}/blob/{commit}/{file}#L{line}`
+   - Replace local file references with permalinks in the document
+
+7. **Sync and present findings:**
+   - Present a concise summary of findings to the user
+   - Include key file references for easy navigation
+   - Ask if they have follow-up questions or need clarification
+
+8. **Handle follow-up questions:**
+   - If the user has follow-up questions, append to the same research document
+   - Update the frontmatter fields `last_updated` and `last_updated_by` to reflect the update
+   - Add `last_updated_note: "Added follow-up research for [brief description]"` to frontmatter
+   - Add a new section: `## Follow-up Research [timestamp]`
+   - Use new sub-agents as needed for additional investigation, do not create bespoke sub-agents.
+   - Continue updating the document and syncing
+
+## Important notes:
+- Always use parallel Task agents to maximize efficiency and minimize context usage
+- Always run fresh codebase research - never rely solely on existing research documents
+- The proposals/ directory provides historical context to supplement live findings
+- Focus on finding concrete file paths and line numbers for developer reference
+- Research documents should be self-contained with all necessary context
+- Each sub-agent prompt should be specific and focused on read-only operations
+- Consider cross-component connections and architectural patterns
+- Include temporal context (when the research was conducted)
+- Link to GitHub when possible for permanent references
+- Keep the main agent focused on synthesis, not deep file reading
+- Encourage sub-agents to find examples and usage patterns, not just definitions
+- Explore all of proposals/ directory, not just research subdirectory
+- **File reading**: Always read mentioned files FULLY (no limit/offset) before working on sub-tasks
+- **Critical ordering**: Follow the numbered steps exactly
+  - ALWAYS read mentioned files first before working on sub-tasks (step 1)
+  - ALWAYS wait for all sub-agents to complete before synthesizing (step 4)
+  - ALWAYS gather metadata before writing the document (step 5 before step 6)
+  - NEVER write the research document with placeholder values
+- **Frontmatter consistency**:
+  - Always include frontmatter at the beginning of research documents
+  - Keep frontmatter fields consistent across all research documents
+  - Update frontmatter when adding follow-up research
+  - Use snake_case for multi-word field names (e.g., `last_updated`, `git_commit`)
+  - Tags should be relevant to the research topic and components studied

.claude/agents/shortcut.md

@@ -0,0 +1,9 @@
+---
+name: shortcut-story-manager
+description: MUST USE THIS AGENT PROACTIVELY when you need to query, create, or edit Shortcut "stories" (or tickets, issues, etc). Shortcut is where we track work for this project. Any issue that this project works on will be on the "Troubleshoot Team" team and project in Shortcut.
+model: sonnet
+color: cyan
+---
+
+You are a product manager for the Troubleshoot Team team and responsible for managing shortcut stories that plan, prioritize, and track the work. You want to maintain a thorough record of the work done, including why, in each Shortcut story.
+

.claude/agents/testing.md

@@ -0,0 +1,16 @@
+---
+name: testing
+description: MUST USE THIS AGENT PROACTIVELY when designing a plan to write tests.
+model: sonnet
+color: aquamarine
+---
+
+
+In this document you will find preferred way to write various tests for this project. 
+
+
+* **Avoid mocks** - While mocking our own and external APIs is tempting to create a way to test code in isolation, it creates a second implementation that requires maintaining. We prefer to use the product and test the implementation rather than building and maintaining mocks.
+
+* **Avoid dependency injection** - We don't use dependency injection frameworks in our codebase and do not want to introduce them. Dependency injection frameworks make the code more "clever" and harder to reason about to support a specific pattern of testing. We prefer to solve testing without introducing dependency injection.
+
+* **Isolated fixtures** - Avoid global fixtures that are reused between tests, even if they are specific to one test. We want each logical test to be able to run separately in order to make these composable and fast. We run all tests in parallel in the CI pipeline. 

.claude/agents/web-search-researcher.md

@@ -0,0 +1,108 @@
+---
+name: web-search-researcher
+description: Do you find yourself desiring information that you don't quite feel well-trained (confident) on? Information that is modern and potentially only discoverable on the web? Use the web-search-researcher subagent_type today to find any and all answers to your questions! It will research deeply to figure out and attempt to answer your questions! If you aren't immediately satisfied you can get your money back! (Not really - but you can re-run web-search-researcher with an altered prompt in the event you're not satisfied the first time)
+tools: WebSearch, WebFetch, TodoWrite, Read, Grep, Glob, LS
+color: yellow
+---
+
+You are an expert web research specialist focused on finding accurate, relevant information from web sources. Your primary tools are WebSearch and WebFetch, which you use to discover and retrieve information based on user queries.
+
+## Core Responsibilities
+
+When you receive a research query, you will:
+
+1. **Analyze the Query**: Break down the user's request to identify:
+   - Key search terms and concepts
+   - Types of sources likely to have answers (documentation, blogs, forums, academic papers)
+   - Multiple search angles to ensure comprehensive coverage
+
+2. **Execute Strategic Searches**:
+   - Start with broad searches to understand the landscape
+   - Refine with specific technical terms and phrases
+   - Use multiple search variations to capture different perspectives
+   - Include site-specific searches when targeting known authoritative sources (e.g., "site:docs.stripe.com webhook signature")
+
+3. **Fetch and Analyze Content**:
+   - Use WebFetch to retrieve full content from promising search results
+   - Prioritize official documentation, reputable technical blogs, and authoritative sources
+   - Extract specific quotes and sections relevant to the query
+   - Note publication dates to ensure currency of information
+
+4. **Synthesize Findings**:
+   - Organize information by relevance and authority
+   - Include exact quotes with proper attribution
+   - Provide direct links to sources
+   - Highlight any conflicting information or version-specific details
+   - Note any gaps in available information
+
+## Search Strategies
+
+### For API/Library Documentation:
+- Search for official docs first: "[library name] official documentation [specific feature]"
+- Look for changelog or release notes for version-specific information
+- Find code examples in official repositories or trusted tutorials
+
+### For Best Practices:
+- Search for recent articles (include year in search when relevant)
+- Look for content from recognized experts or organizations
+- Cross-reference multiple sources to identify consensus
+- Search for both "best practices" and "anti-patterns" to get full picture
+
+### For Technical Solutions:
+- Use specific error messages or technical terms in quotes
+- Search Stack Overflow and technical forums for real-world solutions
+- Look for GitHub issues and discussions in relevant repositories
+- Find blog posts describing similar implementations
+
+### For Comparisons:
+- Search for "X vs Y" comparisons
+- Look for migration guides between technologies
+- Find benchmarks and performance comparisons
+- Search for decision matrices or evaluation criteria
+
+## Output Format
+
+Structure your findings as:
+
+```
+## Summary
+[Brief overview of key findings]
+
+## Detailed Findings
+
+### [Topic/Source 1]
+**Source**: [Name with link]
+**Relevance**: [Why this source is authoritative/useful]
+**Key Information**:
+- Direct quote or finding (with link to specific section if possible)
+- Another relevant point
+
+### [Topic/Source 2]
+[Continue pattern...]
+
+## Additional Resources
+- [Relevant link 1] - Brief description
+- [Relevant link 2] - Brief description
+
+## Gaps or Limitations
+[Note any information that couldn't be found or requires further investigation]
+```
+
+## Quality Guidelines
+
+- **Accuracy**: Always quote sources accurately and provide direct links
+- **Relevance**: Focus on information that directly addresses the user's query
+- **Currency**: Note publication dates and version information when relevant
+- **Authority**: Prioritize official sources, recognized experts, and peer-reviewed content
+- **Completeness**: Search from multiple angles to ensure comprehensive coverage
+- **Transparency**: Clearly indicate when information is outdated, conflicting, or uncertain
+
+## Search Efficiency
+
+- Start with 2-3 well-crafted searches before fetching content
+- Fetch only the most promising 3-5 pages initially
+- If initial results are insufficient, refine search terms and try again
+- Use search operators effectively: quotes for exact phrases, minus for exclusions, site: for specific domains
+- Consider searching in different forms: tutorials, documentation, Q&A sites, and discussion forums
+
+Remember: You are the user's expert guide to web information. Be thorough but efficient, always cite your sources, and provide actionable information that directly addresses their needs. Think deeply as you work.

.claude/commands/implement.md

@@ -0,0 +1,34 @@
+# Proposal Implementation
+
+You are tasked with implementing a detailed and approved technical proposal in this code. This command allows you to understand the proposal and proceed with the implementation.
+
+## Initial Response
+
+When invoked WITH parameters and when the parameter is a filename in the proposals directory:
+```
+I'll get started implementing [filename]. Let's first check if there an any questions before I start.
+```
+
+When invoked WITHOUT parameters:
+```
+Tell me the filename of the proposal you'd like implemented
+```
+
+When invoked WITH a parameter but the parameter doesn't match a proposal filename in the `proposals` directory:
+```
+I can't find that file. Tell me the filename of the proposal you'd like me to implement.
+```
+
+## Research and Implementation Plan
+
+Along with the implementation plan, there likely is a file that has `_research` appended to the filename. This is where all thoughts and research for various options have been documented. While you should primarily base your implementation on the provided proposal/implementation doc, the _research is available if you need to scan and understand some of the background.
+
+## Separate PRs
+
+If the implementation plan contains a section that shows separate PRs being made, limit your work to the next PR only. When completed, update the proposal to indicate the PR has been implemented so that next run, you will know to start on the next phase.
+
+## Subagents
+
+When writing code, use the following subagents, in addition to normal agents:
+
+- go-developer: this subagent is used to follow patterns we want for Go code.

.claude/commands/proposal.md

@@ -0,0 +1,40 @@
+# Proposal Author
+
+You are tasked with writing a proposal for new or edited functionality in this code. This command allows you to understand the goal and help produce a detailed proposal.
+
+## Initial Response
+
+When invoked WITH parameters:
+```
+I'll help you write a proposal for [summary]. Let's first check if this idea requires a proposal.
+```
+
+When invoked WITHOUT parameters:
+```
+I'll help you think through a new proposal.
+
+Please describe what your goals are:
+- What is the desired change?
+- Do you have any initial thoughts on how you'd like to implement?
+```
+
+## Follow up response
+
+
+
+## Subagent use
+
+You SHOULD use the following subagents (and any subagents they recommend) to help the user with their request:
+
+- proposal-needed
+- proposal-writer
+
+## Shortcut (tickets and stories)
+
+If the user's request references a ticket or shortcut story, use the shortcut agent to find the story. 
+Never update the shortcut story with anything. At this time, you should treat Shortcut as a readonly API.
+
+
+## Follow up instructions from the user
+
+At any time the user may reject your recommendation. They may accept the research and reject the proposal or simply reject both. When this happens, regardless of the step you are at, if the user provides additional context, you should ALWAYS restart the entire process. Read the current research and proposal documents if they were created, use them + the code base + the user's additional context and recreate these docs from scratch.

.cursor/BUGBOT.md

@@ -0,0 +1,22 @@
+# Code Review Guidelines
+
+## Basic Review
+
+- **Breaking API changes** — Check for removed/renamed fields in `pkg/apis/`, changed function signatures in public packages, or modified CLI flags and output formats.
+- **Pattern violations** — New code should follow existing patterns in the codebase (e.g., collector/analyzer structure, error handling conventions, interface usage).
+- **Security** — Watch for command injection in exec-based collectors, path traversal in file operations, unsanitized user input in specs, and leaked credentials in collected data.
+- **Go standards** — Issues that linters like `go vet`, `staticcheck`, and `modernize` would catch: deprecated API usage, unnecessary allocations, error shadowing, unchecked errors.
+- **Test coverage** — New functionality should have tests. Changes to existing code should not reduce coverage compared to the last test run on `main`.
+- **Error handling** — Errors should wrap context (`fmt.Errorf("... : %w", err)`), not be silently swallowed, and provide actionable messages for operator-facing output.
+- **Concurrency safety** — Collectors run concurrently. Shared state must be protected. `CollectorResult` map writes from goroutines need synchronization.
+- **Bundle storage** — Collectors must save data using `CollectorResult.SaveResult` and related methods (`SaveResults`, `SymLinkResult`). Never write files directly — `CollectorResult` handles dual-mode storage (in-memory for preflights, on-disk for support bundles). See `pkg/collect/result.go`.
+
+## Advanced Review
+
+- **Cross-feature impact** — Consider whether a change to one collector/analyzer could affect the broader collection pipeline, redaction, or output archive structure.
+- **CLI vs SDK consumers** — This project is consumed both as CLI tools and as Go packages (SDK). Changes targeting a CLI use case must not break SDK consumers who import `pkg/collect`, `pkg/analyze`, or API types directly.
+- **Documentation** — Does the change add, modify, or remove user-facing behavior? Check whether https://troubleshoot.sh needs updates. Use https://troubleshoot.sh/llms.txt or https://troubleshoot.sh/llms-full.txt to review current docs.
+- **Dedicated documentation needs** — For large or complex changes, consider whether CLI users or SDK consumers need standalone documentation (migration guides, new feature walkthroughs, updated examples).
+- **Backwards compatibility** — Spec changes must consider existing specs in the wild. New fields should have sensible zero-value defaults. Removed fields should not cause parse failures.
+- **Downstream impact on sbctl** — Changes to public Go packages (`pkg/collect`, `pkg/analyze`, API types, etc.) may require follow-up changes in [replicatedhq/sbctl](https://github.com/replicatedhq/sbctl), which imports this project as a dependency. Flag any breaking or behavioral changes that could affect sbctl.
+- **Repository docs** — If your changes affect build commands, architecture, project conventions, or review guidelines, update `CLAUDE.md`, `README.md`, and this file accordingly.

.devcontainer/Dockerfile

@@ -1,115 +0,0 @@
-#-------------------------------------------------------------------------------------------------------------
-# Modified from Codespaces default container image: https://github.com/microsoft/vscode-dev-containers/blob/main/containers/codespaces-linux/history/1.6.3.md
-# - Remove PHP, Ruby, Dotnet, Java, powershell, rust dependencies
-# - Remove fish shell
-# - Remove Oryx
-# - Remove git-lfs
-# - Change shell to zsh
-#
-# TODO (dans): find a better way to pull in library script dynamically from vscode repo
-# TODO (dans): AWS CLI - make a common script in the dev-containers repo
-# TODO (dans): Gcloud CLI - make a common script in the dev-containers repo
-# TODO (dans): add gcommands alias
-# TODO (dans): terraform 
-#-------------------------------------------------------------------------------------------------------------
-FROM mcr.microsoft.com/oryx/build:vso-focal-20210902.1 as replicated
-
-ARG USERNAME=codespace
-ARG USER_UID=1000
-ARG USER_GID=$USER_UID
-ARG HOMEDIR=/home/$USERNAME
-
-ARG GO_VERSION="latest"
-
-# Default to bash shell (other shells available at /usr/bin/fish and /usr/bin/zsh)
-ENV SHELL=/bin/bash \
-    ORYX_ENV_TYPE=vsonline-present \
-    NODE_ROOT="${HOMEDIR}/.nodejs" \
-    PYTHON_ROOT="${HOMEDIR}/.python" \
-    HUGO_ROOT="${HOMEDIR}/.hugo" \
-    NVM_SYMLINK_CURRENT=true \
-    NVM_DIR="/home/${USERNAME}/.nvm" \
-    NVS_HOME="/home/${USERNAME}/.nvs" \
-    NPM_GLOBAL="/home/${USERNAME}/.npm-global" \
-    KREW_HOME="/home/${USERNAME}/.krew/bin" \
-    PIPX_HOME="/usr/local/py-utils" \
-    PIPX_BIN_DIR="/usr/local/py-utils/bin" \
-    GOROOT="/usr/local/go" \
-    GOPATH="/go" 
-
-ENV PATH="${PATH}:${KREW_HOME}:${NVM_DIR}/current/bin:${NPM_GLOBAL}/bin:${ORIGINAL_PATH}:${GOROOT}/bin:${GOPATH}/bin:${PIPX_BIN_DIR}:/opt/conda/condabin:${NODE_ROOT}/current/bin:${PYTHON_ROOT}/current/bin:${HUGO_ROOT}/current/bin:${ORYX_PATHS}"
-
-COPY library-scripts/* first-run-notice.txt /tmp/scripts/
-COPY ./config/* /etc/replicated/
-COPY ./lifecycle-scripts/* /var/lib/replicated/scripts/
-
-# Install needed utilities and setup non-root user. Use a separate RUN statement to add your own dependencies.
-RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
-    # Restore man command
-    && yes | unminimize 2>&1 \ 
-    # Run common script and setup user
-    && bash /tmp/scripts/common-debian.sh "true" "${USERNAME}" "${USER_UID}" "${USER_GID}" "true" "true" "true" \
-    && bash /tmp/scripts/setup-user.sh "${USERNAME}" "${PATH}" \
-    # Change owner of opt contents since Oryx can dynamically install and will run as "codespace"
-    && chown ${USERNAME} /opt/* \
-    && chsh -s /bin/bash ${USERNAME} \
-    # Verify expected build and debug tools are present
-    && apt-get -y install build-essential cmake python3-dev \
-    # Install tools and shells not in common script
-    && apt-get install -yq vim vim-doc xtail software-properties-common libsecret-1-dev \
-    # Install additional tools (useful for 'puppeteer' project)
-    && apt-get install -y --no-install-recommends libnss3 libnspr4 libatk-bridge2.0-0 libatk1.0-0 libx11-6 libpangocairo-1.0-0 \
-                                                  libx11-xcb1 libcups2 libxcomposite1 libxdamage1 libxfixes3 libpango-1.0-0 libgbm1 libgtk-3-0 \
-    && bash /tmp/scripts/sshd-debian.sh \
-    && bash /tmp/scripts/github-debian.sh \
-    && bash /tmp/scripts/azcli-debian.sh \
-    # Install Moby CLI and Engine
-    && /bin/bash /tmp/scripts/docker-debian.sh "true" "/var/run/docker-host.sock" "/var/run/docker.sock" "${USERNAME}" "true" \
-    # && bash /tmp/scripts/docker-in-docker-debian.sh "true" "${USERNAME}" "true" \
-    && bash /tmp/scripts/kubectl-helm-debian.sh \
-    # Build latest git from source
-    && bash /tmp/scripts/git-from-src-debian.sh "latest" \
-    # Clean up
-    && apt-get autoremove -y && apt-get clean -y \
-    # Move first run notice to right spot
-    && mkdir -p /usr/local/etc/vscode-dev-containers/ \
-    && mv -f /tmp/scripts/first-run-notice.txt /usr/local/etc/vscode-dev-containers/
-
-# Install Python
-RUN bash /tmp/scripts/python-debian.sh "none" "/opt/python/latest" "${PIPX_HOME}" "${USERNAME}" "true" \
-    && apt-get clean -y
-
-# Setup Node.js, install NVM and NVS
-RUN bash /tmp/scripts/node-debian.sh "${NVM_DIR}" "none" "${USERNAME}" \
-    && (cd ${NVM_DIR} && git remote get-url origin && echo $(git log -n 1 --pretty=format:%H -- .)) > ${NVM_DIR}/.git-remote-and-commit \
-    # Install nvs (alternate cross-platform Node.js version-management tool)
-    && sudo -u ${USERNAME} git clone -c advice.detachedHead=false --depth 1 https://github.com/jasongin/nvs ${NVS_HOME} 2>&1 \
-    && (cd ${NVS_HOME} && git remote get-url origin && echo $(git log -n 1 --pretty=format:%H -- .)) > ${NVS_HOME}/.git-remote-and-commit \
-    && sudo -u ${USERNAME} bash ${NVS_HOME}/nvs.sh install \
-    && rm ${NVS_HOME}/cache/* \
-    # Set npm global location
-    && sudo -u ${USERNAME} npm config set prefix ${NPM_GLOBAL} \
-    && npm config -g set prefix ${NPM_GLOBAL} \
-    # Clean up
-    && rm -rf ${NVM_DIR}/.git ${NVS_HOME}/.git
-
-# Install Go
-RUN bash /tmp/scripts/go-debian.sh "${GO_VERSION}" "${GOROOT}" "${GOPATH}" "${USERNAME}" 
-
-# Install Replicated Tools
-RUN bash /tmp/scripts/replicated-debian.sh \
-    && rm -rf /tmp/scripts \
-    && apt-get clean -y 
-
-# Userspace
-ENV SHELL=/bin/zsh
-USER ${USERNAME}
-COPY --chown=${USERNAME}:root library-scripts/replicated-userspace.sh /tmp/scripts/
-RUN bash /usr/local/share/docker-init.sh \
-    && bash /tmp/scripts/replicated-userspace.sh \
-    && rm -rf /tmp/scripts/scripts
-
-# Fire Docker/Moby script if needed along with Oryx's benv
-ENTRYPOINT [ "/usr/local/share/docker-init.sh", "/usr/local/share/ssh-init.sh", "benv" ]
-CMD [ "sleep", "infinity" ]
-

.devcontainer/README.md

@@ -1,7 +0,0 @@
-# Replicated KOTS Codespace Container
-
-Most of the code here is borrowed from this [Microsoft repo of base images](https://github.com/microsoft/vscode-dev-containers), except for replicated specific things.
-
-## Notes
-* k3d *DOES NOT* work with DinD. You have to use the docker with docker install instead.
-* Might be faster to install kubectl plugins on the `$PATH` in the `Dockerfile` instead of downloading them `onCreate.sh`.

.devcontainer/config/k3d-cluster.yaml

@@ -1,10 +0,0 @@
-apiVersion: k3d.io/v1alpha3 
-kind: Simple 
-name: replicated
-servers: 1
-image: rancher/k3s:v1.21.4-k3s1 # v1.21.3-k3s1 default is broken
-registries:
-  create: 
-    name: k3d-replicated-registry.localhost
-    host: "0.0.0.0"
-    hostPort: "5000"

.devcontainer/devcontainer.json

@@ -1,63 +0,0 @@
-// For format details, see https://aka.ms/devcontainer.json. For config options, see the README at:
-// https://github.com/microsoft/vscode-dev-containers/tree/v0.162.0/containers/javascript-node
-{
-	"name": "Replicated Codeserver",
-	"build": {
-		"dockerfile": "Dockerfile",
-		"args": { 
-            "GO_VERSION": "1.17",
-        }
-	},
-
-	// Set *default* container specific settings.json values on container create.
-	"settings": { 
-        "terminal.integrated.shell.linux": "/usr/bin/zsh",
-        "go.toolsManagement.checkForUpdates": "local",
-        "go.useLanguageServer": true,
-        "go.gopath": "/go",
-        "go.goroot": "/usr/local/go",
-        "python.pythonPath": "/opt/python/latest/bin/python",
-        "python.linting.enabled": true,
-        "python.linting.pylintEnabled": true,
-        "python.formatting.autopep8Path": "/usr/local/py-utils/bin/autopep8",
-        "python.formatting.blackPath": "/usr/local/py-utils/bin/black",
-        "python.formatting.yapfPath": "/usr/local/py-utils/bin/yapf",
-        "python.linting.banditPath": "/usr/local/py-utils/bin/bandit",
-        "python.linting.flake8Path": "/usr/local/py-utils/bin/flake8",
-        "python.linting.mypyPath": "/usr/local/py-utils/bin/mypy",
-        "python.linting.pycodestylePath": "/usr/local/py-utils/bin/pycodestyle",
-        "python.linting.pydocstylePath": "/usr/local/py-utils/bin/pydocstyle",
-        "python.linting.pylintPath": "/usr/local/py-utils/bin/pylint",
-        "lldb.executable": "/usr/bin/lldb",
-        "files.watcherExclude": {
-            "**/target/**": true
-        }
-	},
-    "remoteUser": "codespace",
-	"overrideCommand": false,
-    "runArgs": [
-		"--privileged",
-		"--init"
-	],
-    "mounts": [
-		"source=/var/run/docker.sock,target=/var/run/docker-host.sock,type=bind",
-	],
-	// Add the IDs of extensions you want installed when the container is created.
-	"extensions": [
-		"dbaeumer.vscode-eslint",
-        "GitHub.vscode-pull-request-github",
-        "golang.go",
-        "github.copilot",
-        "lizebang.bash-extension-pack",
-        "streetsidesoftware.code-spell-checker",
-	],
-
-	// Use 'postCreateCommand' to run commands after the container is created.
-	"postCreateCommand": "bash /var/lib/replicated/scripts/onCreate.sh",
-
-    // Use 'postStartCommand' to run commands after the container is created like starting minikube.
-	"postStartCommand": "bash /var/lib/replicated/scripts/onStart.sh",
-
-	// Comment out connect as root instead. More info: https://aka.ms/vscode-remote/containers/non-root.
-	// "remoteUser": "node"
-}

.devcontainer/first-run-notice.txt

@@ -1,9 +0,0 @@
-👋 Welcome to your Replicated Codespace!
-
-There's a local Kubernetes cluster set up for you.
-
-Drivers Manual:
-* `k` alias is available for `kubectl` with auto-completion for your pleasure
-* This is a `zsh` terminal with Oh My Zsh installed. Just thought you should know.
-
-

.devcontainer/library-scripts/azcli-debian.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/azcli.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./azcli-debian.sh
-
-set -e
-
-MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-export DEBIAN_FRONTEND=noninteractive
-
-# Install dependencies
-check_packages apt-transport-https curl ca-certificates lsb-release gnupg2
-
-# Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
-. /etc/os-release
-get_common_setting MICROSOFT_GPG_KEYS_URI
-curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
-echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/azure-cli/ ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/azure-cli.list
-apt-get update
-apt-get install -y azure-cli
-echo "Done!"

.devcontainer/library-scripts/common-debian.sh

@@ -1,478 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/common.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./common-debian.sh [install zsh flag] [username] [user UID] [user GID] [upgrade packages flag] [install Oh My Zsh! flag] [Add non-free packages]
-
-set -e
-
-INSTALL_ZSH=${1:-"true"}
-USERNAME=${2:-"automatic"}
-USER_UID=${3:-"automatic"}
-USER_GID=${4:-"automatic"}
-UPGRADE_PACKAGES=${5:-"true"}
-INSTALL_OH_MYS=${6:-"true"}
-ADD_NON_FREE_PACKAGES=${7:-"false"}
-SCRIPT_DIR="$(cd $(dirname "${BASH_SOURCE[0]}") && pwd)"
-MARKER_FILE="/usr/local/etc/vscode-dev-containers/common"
-
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Ensure that login shells get the correct path if the user updated the PATH using ENV.
-rm -f /etc/profile.d/00-restore-env.sh
-echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
-chmod +x /etc/profile.d/00-restore-env.sh
-
-# If in automatic mode, determine if a user already exists, if not use vscode
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=vscode
-    fi
-elif [ "${USERNAME}" = "none" ]; then
-    USERNAME=root
-    USER_UID=0
-    USER_GID=0
-fi
-
-# Load markers to see which steps have already run
-if [ -f "${MARKER_FILE}" ]; then
-    echo "Marker file found:"
-    cat "${MARKER_FILE}"
-    source "${MARKER_FILE}"
-fi
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Function to call apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Run install apt-utils to avoid debconf warning then verify presence of other common developer tools and dependencies
-if [ "${PACKAGES_ALREADY_INSTALLED}" != "true" ]; then
-
-    package_list="apt-utils \
-        openssh-client \
-        gnupg2 \
-        iproute2 \
-        procps \
-        lsof \
-        htop \
-        net-tools \
-        psmisc \
-        curl \
-        wget \
-        rsync \
-        ca-certificates \
-        unzip \
-        zip \
-        nano \
-        vim-tiny \
-        less \
-        jq \
-        lsb-release \
-        apt-transport-https \
-        dialog \
-        libc6 \
-        libgcc1 \
-        libkrb5-3 \
-        libgssapi-krb5-2 \
-        libicu[0-9][0-9] \
-        liblttng-ust0 \
-        libstdc++6 \
-        zlib1g \
-        locales \
-        sudo \
-        ncdu \
-        man-db \
-        strace \
-        manpages \
-        manpages-dev \
-        init-system-helpers"
-        
-    # Needed for adding manpages-posix and manpages-posix-dev which are non-free packages in Debian
-    if [ "${ADD_NON_FREE_PACKAGES}" = "true" ]; then
-        # Bring in variables from /etc/os-release like VERSION_CODENAME
-        . /etc/os-release
-        sed -i -E "s/deb http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME} main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME} main contrib non-free/" /etc/apt/sources.list
-        sed -i -E "s/deb-src http:\/\/(deb|httredir)\.debian\.org\/debian ${VERSION_CODENAME} main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME} main contrib non-free/" /etc/apt/sources.list
-        sed -i -E "s/deb http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME}-updates main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME}-updates main contrib non-free/" /etc/apt/sources.list
-        sed -i -E "s/deb-src http:\/\/(deb|httpredir)\.debian\.org\/debian ${VERSION_CODENAME}-updates main/deb http:\/\/\1\.debian\.org\/debian ${VERSION_CODENAME}-updates main contrib non-free/" /etc/apt/sources.list
-        sed -i "s/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main contrib non-free/" /etc/apt/sources.list
-        sed -i "s/deb-src http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main/deb http:\/\/security\.debian\.org\/debian-security ${VERSION_CODENAME}\/updates main contrib non-free/" /etc/apt/sources.list
-        sed -i "s/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main contrib non-free/" /etc/apt/sources.list 
-        sed -i "s/deb-src http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main/deb http:\/\/deb\.debian\.org\/debian ${VERSION_CODENAME}-backports main contrib non-free/" /etc/apt/sources.list
-        echo "Running apt-get update..."
-        apt-get update
-        package_list="${package_list} manpages-posix manpages-posix-dev"
-    else
-        apt_get_update_if_needed
-    fi
-
-    # Install libssl1.1 if available
-    if [[ ! -z $(apt-cache --names-only search ^libssl1.1$) ]]; then
-        package_list="${package_list}       libssl1.1"
-    fi
-    
-    # Install appropriate version of libssl1.0.x if available
-    libssl_package=$(dpkg-query -f '${db:Status-Abbrev}\t${binary:Package}\n' -W 'libssl1\.0\.?' 2>&1 || echo '')
-    if [ "$(echo "$LIlibssl_packageBSSL" | grep -o 'libssl1\.0\.[0-9]:' | uniq | sort | wc -l)" -eq 0 ]; then
-        if [[ ! -z $(apt-cache --names-only search ^libssl1.0.2$) ]]; then
-            # Debian 9
-            package_list="${package_list}       libssl1.0.2"
-        elif [[ ! -z $(apt-cache --names-only search ^libssl1.0.0$) ]]; then
-            # Ubuntu 18.04, 16.04, earlier
-            package_list="${package_list}       libssl1.0.0"
-        fi
-    fi
-
-    echo "Packages to verify are installed: ${package_list}"
-    apt-get -y install --no-install-recommends ${package_list} 2> >( grep -v 'debconf: delaying package configuration, since apt-utils is not installed' >&2 )
-        
-    # Install git if not already installed (may be more recent than distro version)
-    if ! type git > /dev/null 2>&1; then
-        apt-get -y install --no-install-recommends git
-    fi
-
-    PACKAGES_ALREADY_INSTALLED="true"
-fi
-
-# Get to latest versions of all packages
-if [ "${UPGRADE_PACKAGES}" = "true" ]; then
-    apt_get_update_if_needed
-    apt-get -y upgrade --no-install-recommends
-    apt-get autoremove -y
-fi
-
-# Ensure at least the en_US.UTF-8 UTF-8 locale is available.
-# Common need for both applications and things like the agnoster ZSH theme.
-if [ "${LOCALE_ALREADY_SET}" != "true" ] && ! grep -o -E '^\s*en_US.UTF-8\s+UTF-8' /etc/locale.gen > /dev/null; then
-    echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen 
-    locale-gen
-    LOCALE_ALREADY_SET="true"
-fi
-
-# Create or update a non-root user to match UID/GID.
-if id -u ${USERNAME} > /dev/null 2>&1; then
-    # User exists, update if needed
-    if [ "${USER_GID}" != "automatic" ] && [ "$USER_GID" != "$(id -G $USERNAME)" ]; then 
-        groupmod --gid $USER_GID $USERNAME 
-        usermod --gid $USER_GID $USERNAME
-    fi
-    if [ "${USER_UID}" != "automatic" ] && [ "$USER_UID" != "$(id -u $USERNAME)" ]; then 
-        usermod --uid $USER_UID $USERNAME
-    fi
-else
-    # Create user
-    if [ "${USER_GID}" = "automatic" ]; then
-        groupadd $USERNAME
-    else
-        groupadd --gid $USER_GID $USERNAME
-    fi
-    if [ "${USER_UID}" = "automatic" ]; then 
-        useradd -s /bin/bash --gid $USERNAME -m $USERNAME
-    else
-        useradd -s /bin/bash --uid $USER_UID --gid $USERNAME -m $USERNAME
-    fi
-fi
-
-# Add add sudo support for non-root user
-if [ "${USERNAME}" != "root" ] && [ "${EXISTING_NON_ROOT_USER}" != "${USERNAME}" ]; then
-    echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME
-    chmod 0440 /etc/sudoers.d/$USERNAME
-    EXISTING_NON_ROOT_USER="${USERNAME}"
-fi
-
-# ** Shell customization section **
-if [ "${USERNAME}" = "root" ]; then 
-    user_rc_path="/root"
-else
-    user_rc_path="/home/${USERNAME}"
-fi
-
-# Restore user .bashrc defaults from skeleton file if it doesn't exist or is empty
-if [ ! -f "${user_rc_path}/.bashrc" ] || [ ! -s "${user_rc_path}/.bashrc" ] ; then
-    cp  /etc/skel/.bashrc "${user_rc_path}/.bashrc"
-fi
-
-# Restore user .profile defaults from skeleton file if it doesn't exist or is empty
-if  [ ! -f "${user_rc_path}/.profile" ] || [ ! -s "${user_rc_path}/.profile" ] ; then
-    cp  /etc/skel/.profile "${user_rc_path}/.profile"
-fi
-
-# .bashrc/.zshrc snippet
-rc_snippet="$(cat << 'EOF'
-
-if [ -z "${USER}" ]; then export USER=$(whoami); fi
-if [[ "${PATH}" != *"$HOME/.local/bin"* ]]; then export PATH="${PATH}:$HOME/.local/bin"; fi
-
-# Display optional first run image specific notice if configured and terminal is interactive
-if [ -t 1 ] && [[ "${TERM_PROGRAM}" = "vscode" || "${TERM_PROGRAM}" = "codespaces" ]] && [ ! -f "$HOME/.config/vscode-dev-containers/first-run-notice-already-displayed" ]; then
-    if [ -f "/usr/local/etc/vscode-dev-containers/first-run-notice.txt" ]; then
-        cat "/usr/local/etc/vscode-dev-containers/first-run-notice.txt"
-    elif [ -f "/workspaces/.codespaces/shared/first-run-notice.txt" ]; then
-        cat "/workspaces/.codespaces/shared/first-run-notice.txt"
-    fi
-    mkdir -p "$HOME/.config/vscode-dev-containers"
-    # Mark first run notice as displayed after 10s to avoid problems with fast terminal refreshes hiding it
-    ((sleep 10s; touch "$HOME/.config/vscode-dev-containers/first-run-notice-already-displayed") &)
-fi
-
-# Set the default git editor if not already set
-if [ -z "$(git config --get core.editor)" ] && [ -z "${GIT_EDITOR}" ]; then
-    if  [ "${TERM_PROGRAM}" = "vscode" ]; then
-        if [[ -n $(command -v code-insiders) &&  -z $(command -v code) ]]; then 
-            export GIT_EDITOR="code-insiders --wait"
-        else 
-            export GIT_EDITOR="code --wait"
-        fi
-    fi
-fi
-
-EOF
-)"
-
-# code shim, it fallbacks to code-insiders if code is not available
-cat << 'EOF' > /usr/local/bin/code
-#!/bin/sh
-
-get_in_path_except_current() {
-    which -a "$1" | grep -A1 "$0" | grep -v "$0"
-}
-
-code="$(get_in_path_except_current code)"
-
-if [ -n "$code" ]; then
-    exec "$code" "$@"
-elif [ "$(command -v code-insiders)" ]; then
-    exec code-insiders "$@"
-else
-    echo "code or code-insiders is not installed" >&2
-    exit 127
-fi
-EOF
-chmod +x /usr/local/bin/code
-
-# systemctl shim - tells people to use 'service' if systemd is not running
-cat << 'EOF' > /usr/local/bin/systemctl
-#!/bin/sh
-set -e
-if [ -d "/run/systemd/system" ]; then
-    exec /bin/systemctl/systemctl "$@"
-else
-    echo '\n"systemd" is not running in this container due to its overhead.\nUse the "service" command to start services intead. e.g.: \n\nservice --status-all'
-fi
-EOF
-chmod +x /usr/local/bin/systemctl
-
-# Codespaces bash and OMZ themes - partly inspired by https://github.com/ohmyzsh/ohmyzsh/blob/master/themes/robbyrussell.zsh-theme
-codespaces_bash="$(cat \
-<<'EOF'
-
-# Codespaces bash prompt theme
-__bash_prompt() {
-    local userpart='`export XIT=$? \
-        && [ ! -z "${GITHUB_USER}" ] && echo -n "\[\033[0;32m\]@${GITHUB_USER} " || echo -n "\[\033[0;32m\]\u " \
-        && [ "$XIT" -ne "0" ] && echo -n "\[\033[1;31m\]➜" || echo -n "\[\033[0m\]➜"`'
-    local gitbranch='`\
-        export BRANCH=$(git symbolic-ref --short HEAD 2>/dev/null || git rev-parse --short HEAD 2>/dev/null); \
-        if [ "${BRANCH}" != "" ]; then \
-            echo -n "\[\033[0;36m\](\[\033[1;31m\]${BRANCH}" \
-            && if git ls-files --error-unmatch -m --directory --no-empty-directory -o --exclude-standard ":/*" > /dev/null 2>&1; then \
-                    echo -n " \[\033[1;33m\]✗"; \
-               fi \
-            && echo -n "\[\033[0;36m\]) "; \
-        fi`'
-    local lightblue='\[\033[1;34m\]'
-    local removecolor='\[\033[0m\]'
-    PS1="${userpart} ${lightblue}\w ${gitbranch}${removecolor}\$ "
-    unset -f __bash_prompt
-}
-__bash_prompt
-
-EOF
-)"
-
-codespaces_zsh="$(cat \
-<<'EOF'
-# Codespaces zsh prompt theme
-__zsh_prompt() {
-    local prompt_username
-    if [ ! -z "${GITHUB_USER}" ]; then 
-        prompt_username="@${GITHUB_USER}"
-    else
-        prompt_username="%n"
-    fi
-    PROMPT="%{$fg[green]%}${prompt_username} %(?:%{$reset_color%}➜ :%{$fg_bold[red]%}➜ )" # User/exit code arrow
-    PROMPT+='%{$fg_bold[blue]%}%(5~|%-1~/…/%3~|%4~)%{$reset_color%} ' # cwd
-    PROMPT+='$(git_prompt_info)%{$fg[white]%}$ %{$reset_color%}' # Git status
-    unset -f __zsh_prompt
-}
-ZSH_THEME_GIT_PROMPT_PREFIX="%{$fg_bold[cyan]%}(%{$fg_bold[red]%}"
-ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%} "
-ZSH_THEME_GIT_PROMPT_DIRTY=" %{$fg_bold[yellow]%}✗%{$fg_bold[cyan]%})"
-ZSH_THEME_GIT_PROMPT_CLEAN="%{$fg_bold[cyan]%})"
-__zsh_prompt
-
-EOF
-)"
-
-# Add notice that Oh My Bash! has been removed from images and how to provide information on how to install manually
-omb_readme="$(cat \
-<<'EOF'
-"Oh My Bash!" has been removed from this image in favor of a simple shell prompt. If you 
-still wish to use it, remove "~/.oh-my-bash" and install it from: https://github.com/ohmybash/oh-my-bash
-You may also want to consider "Bash-it" as an alternative: https://github.com/bash-it/bash-it
-See here for infomation on adding it to your image or dotfiles: https://aka.ms/codespaces/omb-remove
-EOF
-)"
-omb_stub="$(cat \
-<<'EOF'
-#!/usr/bin/env bash
-if [ -t 1 ]; then
-    cat $HOME/.oh-my-bash/README.md
-fi
-EOF
-)"
-
-# Add RC snippet and custom bash prompt
-if [ "${RC_SNIPPET_ALREADY_ADDED}" != "true" ]; then
-    echo "${rc_snippet}" >> /etc/bash.bashrc
-    echo "${codespaces_bash}" >> "${user_rc_path}/.bashrc"
-    echo 'export PROMPT_DIRTRIM=4' >> "${user_rc_path}/.bashrc"
-    if [ "${USERNAME}" != "root" ]; then
-        echo "${codespaces_bash}" >> "/root/.bashrc"
-        echo 'export PROMPT_DIRTRIM=4' >> "/root/.bashrc"
-    fi
-    chown ${USERNAME}:${USERNAME} "${user_rc_path}/.bashrc"
-    RC_SNIPPET_ALREADY_ADDED="true"
-fi
-
-# Add stub for Oh My Bash!
-if [ ! -d "${user_rc_path}/.oh-my-bash}" ] && [ "${INSTALL_OH_MYS}" = "true" ]; then
-    mkdir -p "${user_rc_path}/.oh-my-bash" "/root/.oh-my-bash"
-    echo "${omb_readme}" >> "${user_rc_path}/.oh-my-bash/README.md"
-    echo "${omb_stub}" >> "${user_rc_path}/.oh-my-bash/oh-my-bash.sh"
-    chmod +x "${user_rc_path}/.oh-my-bash/oh-my-bash.sh"
-    if [ "${USERNAME}" != "root" ]; then
-        echo "${omb_readme}" >> "/root/.oh-my-bash/README.md"
-        echo "${omb_stub}" >> "/root/.oh-my-bash/oh-my-bash.sh"
-        chmod +x "/root/.oh-my-bash/oh-my-bash.sh"
-    fi
-    chown -R "${USERNAME}:${USERNAME}" "${user_rc_path}/.oh-my-bash"
-fi
-
-# Optionally install and configure zsh and Oh My Zsh!
-if [ "${INSTALL_ZSH}" = "true" ]; then
-    if ! type zsh > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get install -y zsh
-    fi
-    if [ "${ZSH_ALREADY_INSTALLED}" != "true" ]; then
-        echo "${rc_snippet}" >> /etc/zsh/zshrc
-        ZSH_ALREADY_INSTALLED="true"
-    fi
-
-    # Adapted, simplified inline Oh My Zsh! install steps that adds, defaults to a codespaces theme.
-    # See https://github.com/ohmyzsh/ohmyzsh/blob/master/tools/install.sh for official script.
-    oh_my_install_dir="${user_rc_path}/.oh-my-zsh"
-    if [ ! -d "${oh_my_install_dir}" ] && [ "${INSTALL_OH_MYS}" = "true" ]; then
-        template_path="${oh_my_install_dir}/templates/zshrc.zsh-template"
-        user_rc_file="${user_rc_path}/.zshrc"
-        umask g-w,o-w
-        mkdir -p ${oh_my_install_dir}
-        git clone --depth=1 \
-            -c core.eol=lf \
-            -c core.autocrlf=false \
-            -c fsck.zeroPaddedFilemode=ignore \
-            -c fetch.fsck.zeroPaddedFilemode=ignore \
-            -c receive.fsck.zeroPaddedFilemode=ignore \
-            "https://github.com/ohmyzsh/ohmyzsh" "${oh_my_install_dir}" 2>&1
-        echo -e "$(cat "${template_path}")\nDISABLE_AUTO_UPDATE=true\nDISABLE_UPDATE_PROMPT=true" > ${user_rc_file}
-        sed -i -e 's/ZSH_THEME=.*/ZSH_THEME="codespaces"/g' ${user_rc_file}
-
-        mkdir -p ${oh_my_install_dir}/custom/themes
-        echo "${codespaces_zsh}" > "${oh_my_install_dir}/custom/themes/codespaces.zsh-theme"
-        # Shrink git while still enabling updates
-        cd "${oh_my_install_dir}"
-        git repack -a -d -f --depth=1 --window=1
-        # Copy to non-root user if one is specified
-        if [ "${USERNAME}" != "root" ]; then
-            cp -rf "${user_rc_file}" "${oh_my_install_dir}" /root
-            chown -R ${USERNAME}:${USERNAME} "${user_rc_path}"
-        fi
-    fi
-fi
-
-# Persist image metadata info, script if meta.env found in same directory
-meta_info_script="$(cat << 'EOF'
-#!/bin/sh
-. /usr/local/etc/vscode-dev-containers/meta.env
-
-# Minimal output
-if [ "$1" = "version" ] || [ "$1" = "image-version" ]; then
-    echo "${VERSION}"
-    exit 0
-elif [ "$1" = "release" ]; then
-    echo "${GIT_REPOSITORY_RELEASE}"
-    exit 0
-elif [ "$1" = "content" ] || [ "$1" = "content-url" ] || [ "$1" = "contents" ] || [ "$1" = "contents-url" ]; then
-    echo "${CONTENTS_URL}"
-    exit 0
-fi
-
-#Full output
-echo
-echo "Development container image information"
-echo
-if [ ! -z "${VERSION}" ]; then echo "- Image version: ${VERSION}"; fi
-if [ ! -z "${DEFINITION_ID}" ]; then echo "- Definition ID: ${DEFINITION_ID}"; fi
-if [ ! -z "${VARIANT}" ]; then echo "- Variant: ${VARIANT}"; fi
-if [ ! -z "${GIT_REPOSITORY}" ]; then echo "- Source code repository: ${GIT_REPOSITORY}"; fi
-if [ ! -z "${GIT_REPOSITORY_RELEASE}" ]; then echo "- Source code release/branch: ${GIT_REPOSITORY_RELEASE}"; fi
-if [ ! -z "${BUILD_TIMESTAMP}" ]; then echo "- Timestamp: ${BUILD_TIMESTAMP}"; fi
-if [ ! -z "${CONTENTS_URL}" ]; then echo && echo "More info: ${CONTENTS_URL}"; fi
-echo
-EOF
-)"
-if [ -f "${SCRIPT_DIR}/meta.env" ]; then
-    mkdir -p /usr/local/etc/vscode-dev-containers/
-    cp -f "${SCRIPT_DIR}/meta.env" /usr/local/etc/vscode-dev-containers/meta.env
-    echo "${meta_info_script}" > /usr/local/bin/devcontainer-info
-    chmod +x /usr/local/bin/devcontainer-info
-fi
-
-# Write marker file
-mkdir -p "$(dirname "${MARKER_FILE}")"
-echo -e "\
-    PACKAGES_ALREADY_INSTALLED=${PACKAGES_ALREADY_INSTALLED}\n\
-    LOCALE_ALREADY_SET=${LOCALE_ALREADY_SET}\n\
-    EXISTING_NON_ROOT_USER=${EXISTING_NON_ROOT_USER}\n\
-    RC_SNIPPET_ALREADY_ADDED=${RC_SNIPPET_ALREADY_ADDED}\n\
-    ZSH_ALREADY_INSTALLED=${ZSH_ALREADY_INSTALLED}" > "${MARKER_FILE}"
-
-echo "Done!"

.devcontainer/library-scripts/docker-debian.sh

@@ -1,224 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./docker-debian.sh [enable non-root docker socket access flag] [source socket] [target socket] [non-root user] [use moby]
-
-ENABLE_NONROOT_DOCKER=${1:-"true"}
-SOURCE_SOCKET=${2:-"/var/run/docker-host.sock"}
-TARGET_SOCKET=${3:-"/var/run/docker.sock"}
-USERNAME=${4:-"automatic"}
-USE_MOBY=${5:-"true"}
-MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install dependencies
-check_packages apt-transport-https curl ca-certificates gnupg2
-
-# Install Docker / Moby CLI if not already installed
-if type docker > /dev/null 2>&1; then
-    echo "Docker / Moby CLI already installed."
-else
-    # Source /etc/os-release to get OS info
-    . /etc/os-release
-    if [ "${USE_MOBY}" = "true" ]; then
-        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
-        get_common_setting MICROSOFT_GPG_KEYS_URI
-        curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
-        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
-        apt-get update
-        apt-get -y install --no-install-recommends moby-cli moby-buildx moby-compose
-    else
-        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
-        curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg
-        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
-        apt-get update
-        apt-get -y install --no-install-recommends docker-ce-cli
-    fi
-fi
-
-# Install Docker Compose if not already installed  and is on a supported architecture
-if type docker-compose > /dev/null 2>&1; then
-    echo "Docker Compose already installed."
-else
-    TARGET_COMPOSE_ARCH="$(uname -m)"
-    if [ "${TARGET_COMPOSE_ARCH}" = "amd64" ]; then
-        TARGET_COMPOSE_ARCH="x86_64"
-    fi
-    if [ "${TARGET_COMPOSE_ARCH}" != "x86_64" ]; then
-        # Use pip to get a version that runns on this architecture
-        if ! dpkg -s python3-minimal python3-pip libffi-dev python3-venv pipx > /dev/null 2>&1; then
-            apt_get_update_if_needed
-            apt-get -y install python3-minimal python3-pip libffi-dev python3-venv pipx
-        fi
-        export PIPX_HOME=/usr/local/pipx
-        mkdir -p ${PIPX_HOME}
-        export PIPX_BIN_DIR=/usr/local/bin
-        export PIP_CACHE_DIR=/tmp/pip-tmp/cache
-        pipx install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' docker-compose
-        rm -rf /tmp/pip-tmp
-    else 
-        LATEST_COMPOSE_VERSION=$(basename "$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/compose/releases/latest)")
-        curl -fsSL "https://github.com/docker/compose/releases/download/${LATEST_COMPOSE_VERSION}/docker-compose-$(uname -s)-${TARGET_COMPOSE_ARCH}" -o /usr/local/bin/docker-compose
-        chmod +x /usr/local/bin/docker-compose
-    fi
-fi
-
-# If init file already exists, exit
-if [ -f "/usr/local/share/docker-init.sh" ]; then
-    exit 0
-fi
-
-# By default, make the source and target sockets the same
-if [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ]; then
-    touch "${SOURCE_SOCKET}"
-    ln -s "${SOURCE_SOCKET}" "${TARGET_SOCKET}"
-fi
-
-# Add a stub if not adding non-root user access, user is root
-if [ "${ENABLE_NONROOT_DOCKER}" = "false" ] || [ "${USERNAME}" = "root" ]; then
-    echo '/usr/bin/env bash -c "\$@"' > /usr/local/share/docker-init.sh
-    chmod +x /usr/local/share/docker-init.sh
-    exit 0
-fi
-
-# If enabling non-root access and specified user is found, setup socat and add script
-chown -h "${USERNAME}":root "${TARGET_SOCKET}"        
-if ! dpkg -s socat > /dev/null 2>&1; then
-    apt_get_update_if_needed
-    apt-get -y install socat
-fi
-tee /usr/local/share/docker-init.sh > /dev/null \
-<< EOF 
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-
-set -e
-
-SOCAT_PATH_BASE=/tmp/vscr-docker-from-docker
-SOCAT_LOG=\${SOCAT_PATH_BASE}.log
-SOCAT_PID=\${SOCAT_PATH_BASE}.pid
-
-# Wrapper function to only use sudo if not already root
-sudoIf()
-{
-    if [ "\$(id -u)" -ne 0 ]; then
-        sudo "\$@"
-    else
-        "\$@"
-    fi
-}
-
-# Log messages
-log()
-{
-    echo -e "[\$(date)] \$@" | sudoIf tee -a \${SOCAT_LOG} > /dev/null
-}
-
-echo -e "\n** \$(date) **" | sudoIf tee -a \${SOCAT_LOG} > /dev/null
-log "Ensuring ${USERNAME} has access to ${SOURCE_SOCKET} via ${TARGET_SOCKET}"
-
-# If enabled, try to add a docker group with the right GID. If the group is root, 
-# fall back on using socat to forward the docker socket to another unix socket so 
-# that we can set permissions on it without affecting the host.
-if [ "${ENABLE_NONROOT_DOCKER}" = "true" ] && [ "${SOURCE_SOCKET}" != "${TARGET_SOCKET}" ] && [ "${USERNAME}" != "root" ] && [ "${USERNAME}" != "0" ]; then
-    SOCKET_GID=\$(stat -c '%g' ${SOURCE_SOCKET})
-    if [ "\${SOCKET_GID}" != "0" ]; then
-        log "Adding user to group with GID \${SOCKET_GID}."
-        if [ "\$(cat /etc/group | grep :\${SOCKET_GID}:)" = "" ]; then
-            sudoIf groupadd --gid \${SOCKET_GID} docker-host
-        fi
-        # Add user to group if not already in it
-        if [ "\$(id ${USERNAME} | grep -E "groups.*(=|,)\${SOCKET_GID}\(")" = "" ]; then
-            sudoIf usermod -aG \${SOCKET_GID} ${USERNAME}
-        fi
-    else
-        # Enable proxy if not already running
-        if [ ! -f "\${SOCAT_PID}" ] || ! ps -p \$(cat \${SOCAT_PID}) > /dev/null; then
-            log "Enabling socket proxy."
-            log "Proxying ${SOURCE_SOCKET} to ${TARGET_SOCKET} for vscode"
-            sudoIf rm -rf ${TARGET_SOCKET}
-            (sudoIf socat UNIX-LISTEN:${TARGET_SOCKET},fork,mode=660,user=${USERNAME} UNIX-CONNECT:${SOURCE_SOCKET} 2>&1 | sudoIf tee -a \${SOCAT_LOG} > /dev/null & echo "\$!" | sudoIf tee \${SOCAT_PID} > /dev/null)
-        else
-            log "Socket proxy already running."
-        fi
-    fi
-    log "Success"
-fi
-
-# Execute whatever commands were passed in (if any). This allows us 
-# to set this script to ENTRYPOINT while still executing the default CMD.
-set +e
-exec "\$@"
-EOF
-chmod +x /usr/local/share/docker-init.sh
-chown ${USERNAME}:root /usr/local/share/docker-init.sh
-echo "Done!"

.devcontainer/library-scripts/docker-in-docker-debian.sh

@@ -1,237 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker-in-docker.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./docker-in-docker-debian.sh [enable non-root docker access flag] [non-root user] [use moby]
-
-ENABLE_NONROOT_DOCKER=${1:-"true"}
-USERNAME=${2:-"automatic"}
-USE_MOBY=${3:-"true"}
-MICROSOFT_GPG_KEYS_URI="https://packages.microsoft.com/keys/microsoft.asc"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install dependencies
-check_packages apt-transport-https curl ca-certificates lxc pigz iptables gnupg2
-
-# Swap to legacy iptables for compatibility
-if type iptables-legacy > /dev/null 2>&1; then
-    update-alternatives --set iptables /usr/sbin/iptables-legacy
-    update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
-fi
-
-# Install Docker / Moby CLI if not already installed
-if type docker > /dev/null 2>&1 && type dockerd > /dev/null 2>&1; then
-    echo "Docker / Moby CLI and Engine already installed."
-else
-    # Source /etc/os-release to get OS info
-    . /etc/os-release
-    if [ "${USE_MOBY}" = "true" ]; then
-        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
-        get_common_setting MICROSOFT_GPG_KEYS_URI
-        curl -sSL ${MICROSOFT_GPG_KEYS_URI} | gpg --dearmor > /usr/share/keyrings/microsoft-archive-keyring.gpg
-        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/repos/microsoft-${ID}-${VERSION_CODENAME}-prod ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/microsoft.list
-        apt-get update
-        apt-get -y install --no-install-recommends moby-cli moby-buildx moby-compose moby-engine
-    else
-        # Import key safely (new 'signed-by' method rather than deprecated apt-key approach) and install
-        curl -fsSL https://download.docker.com/linux/${ID}/gpg | gpg --dearmor > /usr/share/keyrings/docker-archive-keyring.gpg
-        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/${ID} ${VERSION_CODENAME} stable" > /etc/apt/sources.list.d/docker.list
-        apt-get update
-        apt-get -y install --no-install-recommends docker-ce-cli docker-ce
-    fi
-fi
-
-echo "Finished installing docker / moby"
-
-# Install Docker Compose if not already installed  and is on a supported architecture
-if type docker-compose > /dev/null 2>&1; then
-    echo "Docker Compose already installed."
-else
-    TARGET_COMPOSE_ARCH="$(uname -m)"
-    if [ "${TARGET_COMPOSE_ARCH}" = "amd64" ]; then
-        TARGET_COMPOSE_ARCH="x86_64"
-    fi
-    if [ "${TARGET_COMPOSE_ARCH}" != "x86_64" ]; then
-        # Use pip to get a version that runns on this architecture
-        if ! dpkg -s python3-minimal python3-pip libffi-dev python3-venv > /dev/null 2>&1; then
-            apt_get_update_if_needed
-            apt-get -y install python3-minimal python3-pip libffi-dev python3-venv
-        fi
-        export PIPX_HOME=/usr/local/pipx
-        mkdir -p ${PIPX_HOME}
-        export PIPX_BIN_DIR=/usr/local/bin
-        export PYTHONUSERBASE=/tmp/pip-tmp
-        export PIP_CACHE_DIR=/tmp/pip-tmp/cache
-        pipx_bin=pipx
-        if ! type pipx > /dev/null 2>&1; then
-            pip3 install --disable-pip-version-check --no-warn-script-location  --no-cache-dir --user pipx
-            pipx_bin=/tmp/pip-tmp/bin/pipx
-        fi
-        ${pipx_bin} install --system-site-packages --pip-args '--no-cache-dir --force-reinstall' docker-compose
-        rm -rf /tmp/pip-tmp
-    else
-        LATEST_COMPOSE_VERSION=$(basename "$(curl -fsSL -o /dev/null -w "%{url_effective}" https://github.com/docker/compose/releases/latest)")
-        curl -fsSL "https://github.com/docker/compose/releases/download/${LATEST_COMPOSE_VERSION}/docker-compose-$(uname -s)-${TARGET_COMPOSE_ARCH}" -o /usr/local/bin/docker-compose
-        chmod +x /usr/local/bin/docker-compose
-    fi
-fi
-
-# If init file already exists, exit
-if [ -f "/usr/local/share/docker-init.sh" ]; then
-    echo "/usr/local/share/docker-init.sh already exists, so exiting."
-    exit 0
-fi
-echo "docker-init doesnt exist..."
-
-# Add user to the docker group
-if [ "${ENABLE_NONROOT_DOCKER}" = "true" ]; then
-    if ! getent group docker > /dev/null 2>&1; then
-        groupadd docker
-    fi
-
-    usermod -aG docker ${USERNAME}
-fi
-
-tee /usr/local/share/docker-init.sh > /dev/null \
-<< 'EOF'
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-
-sudoIf()
-{
-    if [ "$(id -u)" -ne 0 ]; then
-        sudo "$@"
-    else
-        "$@"
-    fi
-}
-
-# explicitly remove dockerd and containerd PID file to ensure that it can start properly if it was stopped uncleanly
-# ie: docker kill <ID>
-sudoIf find /run /var/run -iname 'docker*.pid' -delete || :
-sudoIf find /run /var/run -iname 'container*.pid' -delete || :
-
-set -e
-
-## Dind wrapper script from docker team
-# Maintained: https://github.com/moby/moby/blob/master/hack/dind
-
-export container=docker
-
-if [ -d /sys/kernel/security ] && ! sudoIf mountpoint -q /sys/kernel/security; then
-	sudoIf mount -t securityfs none /sys/kernel/security || {
-		echo >&2 'Could not mount /sys/kernel/security.'
-		echo >&2 'AppArmor detection and --privileged mode might break.'
-	}
-fi
-
-# Mount /tmp (conditionally)
-if ! sudoIf mountpoint -q /tmp; then
-	sudoIf mount -t tmpfs none /tmp
-fi
-
-# cgroup v2: enable nesting
-if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
-	# move the init process (PID 1) from the root group to the /init group,
-	# otherwise writing subtree_control fails with EBUSY.
-	sudoIf mkdir -p /sys/fs/cgroup/init
-	sudoIf echo 1 > /sys/fs/cgroup/init/cgroup.procs
-	# enable controllers
-	sudoIf sed -e 's/ / +/g' -e 's/^/+/' < /sys/fs/cgroup/cgroup.controllers \
-		> /sys/fs/cgroup/cgroup.subtree_control
-fi
-## Dind wrapper over.
-
-# Handle DNS
-set +e
-cat /etc/resolv.conf | grep -i 'internal.cloudapp.net'
-if [ $? -eq 0 ]
-then
-  echo "Setting dockerd Azure DNS."
-  CUSTOMDNS="--dns 168.63.129.16"
-else
-  echo "Not setting dockerd DNS manually."
-  CUSTOMDNS=""
-fi
-set -e
-
-# Start docker/moby engine
-( sudoIf dockerd $CUSTOMDNS > /tmp/dockerd.log 2>&1 ) &
-
-set +e
-
-# Execute whatever commands were passed in (if any). This allows us
-# to set this script to ENTRYPOINT while still executing the default CMD.
-exec "$@"
-EOF
-
-chmod +x /usr/local/share/docker-init.sh
-chown ${USERNAME}:root /usr/local/share/docker-init.sh

.devcontainer/library-scripts/git-from-src-debian.sh

@@ -1,140 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/git-from-src.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./git-from-src-debian.sh [version] [use PPA if available]
-
-GIT_VERSION=${1:-"latest"}
-USE_PPA_IF_AVAILABLE=${2:-"false"}
-
-GIT_CORE_PPA_ARCHIVE_GPG_KEY=E1DD270288B4E6030699E45FA1715D88E1DF1F24
-GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
-keyserver hkps://keys.openpgp.org
-keyserver hkp://keyserver.pgp.com"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Import the specified key in a variable name passed in as 
-receive_gpg_keys() {
-    get_common_setting $1
-    local keys=${!1}
-    get_common_setting GPG_KEY_SERVERS true
-    local keyring_args=""
-    if [ ! -z "$2" ]; then
-        mkdir -p "$(dirname \"$2\")"
-        keyring_args="--no-default-keyring --keyring $2"
-    fi
-
-    # Use a temporary locaiton for gpg keys to avoid polluting image
-    export GNUPGHOME="/tmp/tmp-gnupg"
-    mkdir -p ${GNUPGHOME}
-    chmod 700 ${GNUPGHOME}
-    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
-    # GPG key download sometimes fails for some reason and retrying fixes it.
-    local retry_count=0
-    local gpg_ok="false"
-    set +e
-    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
-    do
-        echo "(*) Downloading GPG key..."
-        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
-        if [ "${gpg_ok}" != "true" ]; then
-            echo "(*) Failed getting key, retring in 10s..."
-            (( retry_count++ ))
-            sleep 10s
-        fi
-    done
-    set -e
-    if [ "${gpg_ok}" = "false" ]; then
-        echo "(!) Failed to install rvm."
-        exit 1
-    fi
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-export DEBIAN_FRONTEND=noninteractive
-
-# Source /etc/os-release to get OS info
-. /etc/os-release
-# If ubuntu, PPAs allowed, and latest - install from there
-if ([ "${GIT_VERSION}" = "latest" ] || [ "${GIT_VERSION}" = "lts" ] || [ "${GIT_VERSION}" = "current" ]) && [ "${ID}" = "ubuntu" ] && [ "${USE_PPA_IF_AVAILABLE}" = "true" ]; then
-    echo "Using PPA to install latest git..."
-    check_packages apt-transport-https curl ca-certificates gnupg2
-    receive_gpg_keys GIT_CORE_PPA_ARCHIVE_GPG_KEY /usr/share/keyrings/gitcoreppa-archive-keyring.gpg
-    echo -e "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gitcoreppa-archive-keyring.gpg] http://ppa.launchpad.net/git-core/ppa/ubuntu ${VERSION_CODENAME} main\ndeb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gitcoreppa-archive-keyring.gpg] http://ppa.launchpad.net/git-core/ppa/ubuntu ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/git-core-ppa.list
-    apt-get update
-    apt-get -y install --no-install-recommends git 
-    rm -rf "/tmp/tmp-gnupg"
-    exit 0
-fi
-
-# Install required packages to build if missing
-check_packages build-essential curl ca-certificates tar gettext libssl-dev zlib1g-dev libcurl?-openssl-dev libexpat1-dev
-
-# Partial version matching
-if [ "$(echo "${GIT_VERSION}" | grep -o '\.' | wc -l)" != "2" ]; then
-    requested_version="${GIT_VERSION}"
-    version_list="$(curl -sSL -H "Accept: application/vnd.github.v3+json" "https://api.github.com/repos/git/git/tags" | grep -oP '"name":\s*"v\K[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"' | sort -rV )"
-    if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "lts" ] || [ "${requested_version}" = "current" ]; then
-        GIT_VERSION="$(echo "${version_list}" | head -n 1)"
-    else
-        set +e
-        GIT_VERSION="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
-        set -e
-    fi
-    if [ -z "${GIT_VERSION}" ] || ! echo "${version_list}" | grep "^${GIT_VERSION//./\\.}$" > /dev/null 2>&1; then
-        echo "Invalid git version: ${requested_version}" >&2
-        exit 1
-    fi
-fi
-
-echo "Downloading source for ${GIT_VERSION}..."
-curl -sL https://github.com/git/git/archive/v${GIT_VERSION}.tar.gz | tar -xzC /tmp 2>&1
-echo "Building..."
-cd /tmp/git-${GIT_VERSION}
-make -s prefix=/usr/local all && make -s prefix=/usr/local install 2>&1
-rm -rf /tmp/git-${GIT_VERSION}
-echo "Done!"

.devcontainer/library-scripts/github-debian.sh

@@ -1,188 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/github.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./github-debian.sh [version]
-
-CLI_VERSION=${1:-"latest"}
-
-GITHUB_CLI_ARCHIVE_GPG_KEY=C99B11DEB97541F0
-GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
-keyserver hkps://keys.openpgp.org
-keyserver hkp://keyserver.pgp.com"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Import the specified key in a variable name passed in as 
-receive_gpg_keys() {
-    get_common_setting $1
-    local keys=${!1}
-    get_common_setting GPG_KEY_SERVERS true
-
-    # Use a temporary locaiton for gpg keys to avoid polluting image
-    export GNUPGHOME="/tmp/tmp-gnupg"
-    mkdir -p ${GNUPGHOME}
-    chmod 700 ${GNUPGHOME}
-    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
-    # GPG key download sometimes fails for some reason and retrying fixes it.
-    local retry_count=0
-    local gpg_ok="false"
-    set +e
-    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
-    do
-        echo "(*) Downloading GPG key..."
-        ( echo "${keys}" | xargs -n 1 gpg --recv-keys) 2>&1 && gpg_ok="true"
-        if [ "${gpg_ok}" != "true" ]; then
-            echo "(*) Failed getting key, retring in 10s..."
-            (( retry_count++ ))
-            sleep 10s
-        fi
-    done
-    set -e
-    if [ "${gpg_ok}" = "false" ]; then
-        echo "(!) Failed to install rvm."
-        exit 1
-    fi
-}
-
-# Figure out correct version of a three part version number is not passed
-find_version_from_git_tags() {
-    local variable_name=$1
-    local requested_version=${!variable_name}
-    if [ "${requested_version}" = "none" ]; then return; fi
-    local repository=$2
-    local prefix=${3:-"tags/v"}
-    local separator=${4:-"."}
-    local last_part_optional=${5:-"false"}    
-    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
-        local escaped_separator=${separator//./\\.}
-        local last_part
-        if [ "${last_part_optional}" = "true" ]; then
-            last_part="(${escaped_separator}[0-9]+)?"
-        else
-            last_part="${escaped_separator}[0-9]+"
-        fi
-        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
-        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
-        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
-            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
-        else
-            set +e
-            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
-            set -e
-        fi
-    fi
-    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
-        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
-        exit 1
-    fi
-    echo "${variable_name}=${!variable_name}"
-}
-
-# Import the specified key in a variable name passed in as 
-receive_gpg_keys() {
-    get_common_setting $1
-    local keys=${!1}
-    get_common_setting GPG_KEY_SERVERS true
-    local keyring_args=""
-    if [ ! -z "$2" ]; then
-        keyring_args="--no-default-keyring --keyring $2"
-    fi
-
-    # Use a temporary locaiton for gpg keys to avoid polluting image
-    export GNUPGHOME="/tmp/tmp-gnupg"
-    mkdir -p ${GNUPGHOME}
-    chmod 700 ${GNUPGHOME}
-    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
-    # GPG key download sometimes fails for some reason and retrying fixes it.
-    local retry_count=0
-    local gpg_ok="false"
-    set +e
-    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
-    do
-        echo "(*) Downloading GPG key..."
-        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
-        if [ "${gpg_ok}" != "true" ]; then
-            echo "(*) Failed getting key, retring in 10s..."
-            (( retry_count++ ))
-            sleep 10s
-        fi
-    done
-    set -e
-    if [ "${gpg_ok}" = "false" ]; then
-        echo "(!) Failed to install rvm."
-        exit 1
-    fi
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-export DEBIAN_FRONTEND=noninteractive
-
-# Install curl, apt-transport-https, curl, gpg, or dirmngr, git if missing
-check_packages curl ca-certificates apt-transport-https dirmngr gnupg2
-if ! type git > /dev/null 2>&1; then
-    apt_get_update_if_needed
-    apt-get -y install --no-install-recommends git
-fi
-
-# Soft version matching
-if [ "${CLI_VERSION}" != "latest" ] && [ "${CLI_VERSION}" != "lts" ] && [ "${CLI_VERSION}" != "stable" ]; then
-    find_version_from_git_tags CLI_VERSION "https://github.com/cli/cli"
-    version_suffix="=${CLI_VERSION}"
-else
-    version_suffix=""
-fi
-
-# Install the GitHub CLI
-echo "Downloading github CLI..."
-# Import key safely (new method rather than deprecated apt-key approach) and install
-. /etc/os-release
-receive_gpg_keys GITHUB_CLI_ARCHIVE_GPG_KEY /usr/share/keyrings/githubcli-archive-keyring.gpg
-echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/github-cli.list
-apt-get update
-apt-get -y install "gh${version_suffix}"
-rm -rf "/tmp/gh/gnupg"
-echo "Done!"

.devcontainer/library-scripts/go-debian.sh

@@ -1,201 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/go.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./go-debian.sh [Go version] [GOROOT] [GOPATH] [non-root user] [Add GOPATH, GOROOT to rc files flag] [Install tools flag]
-
-TARGET_GO_VERSION=${1:-"latest"}
-TARGET_GOROOT=${2:-"/usr/local/go"}
-TARGET_GOPATH=${3:-"/go"}
-USERNAME=${4:-"automatic"}
-UPDATE_RC=${5:-"true"}
-INSTALL_GO_TOOLS=${6:-"true"}
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Ensure that login shells get the correct path if the user updated the PATH using ENV.
-rm -f /etc/profile.d/00-restore-env.sh
-echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
-chmod +x /etc/profile.d/00-restore-env.sh
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-updaterc() {
-    if [ "${UPDATE_RC}" = "true" ]; then
-        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
-        echo -e "$1" >> /etc/bash.bashrc
-        if [ -f "/etc/zsh/zshrc" ]; then
-            echo -e "$1" >> /etc/zsh/zshrc
-        fi
-    fi
-}
-
-# Figure out correct version of a three part version number is not passed
-find_version_from_git_tags() {
-    local variable_name=$1
-    local requested_version=${!variable_name}
-    if [ "${requested_version}" = "none" ]; then return; fi
-    local repository=$2
-    local prefix=${3:-"tags/v"}
-    local separator=${4:-"."}
-    local last_part_optional=${5:-"false"}    
-    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
-        local escaped_separator=${separator//./\\.}
-        local last_part
-        if [ "${last_part_optional}" = "true" ]; then
-            last_part="(${escaped_separator}[0-9]+)?"
-        else
-            last_part="${escaped_separator}[0-9]+"
-        fi
-        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
-        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
-        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
-            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
-        else
-            set +e
-            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
-            set -e
-        fi
-    fi
-    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
-        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
-        exit 1
-    fi
-    echo "${variable_name}=${!variable_name}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-export DEBIAN_FRONTEND=noninteractive
-
-# Install curl, tar, git, other dependencies if missing
-check_packages curl ca-certificates tar g++ gcc libc6-dev make pkg-config
-if ! type git > /dev/null 2>&1; then
-    apt_get_update_if_needed
-    apt-get -y install --no-install-recommends git
-fi
-
-# Get closest match for version number specified
-find_version_from_git_tags TARGET_GO_VERSION "https://go.googlesource.com/go" "tags/go" "." "true"
-
-architecture="$(uname -m)"
-case $architecture in
-    x86_64) architecture="amd64";;
-    aarch64 | armv8*) architecture="arm64";;
-    aarch32 | armv7* | armvhf*) architecture="armv6l";;
-    i?86) architecture="386";;
-    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
-esac
-
-# Install Go
-GO_INSTALL_SCRIPT="$(cat <<EOF
-    set -e
-    echo "Downloading Go ${TARGET_GO_VERSION}..."
-    curl -sSL -o /tmp/go.tar.gz "https://golang.org/dl/go${TARGET_GO_VERSION}.linux-${architecture}.tar.gz"
-    echo "Extracting Go ${TARGET_GO_VERSION}..."
-    tar -xzf /tmp/go.tar.gz -C "${TARGET_GOROOT}" --strip-components=1
-    rm -f /tmp/go.tar.gz
-EOF
-)"
-if [ "${TARGET_GO_VERSION}" != "none" ] && ! type go > /dev/null 2>&1; then
-    mkdir -p "${TARGET_GOROOT}" "${TARGET_GOPATH}" 
-    chown -R ${USERNAME} "${TARGET_GOROOT}" "${TARGET_GOPATH}"
-    su ${USERNAME} -c "${GO_INSTALL_SCRIPT}"
-else
-    echo "Go already installed. Skipping."
-fi
-
-# Install Go tools that are isImportant && !replacedByGopls based on
-# https://github.com/golang/vscode-go/blob/0ff533d408e4eb8ea54ce84d6efa8b2524d62873/src/goToolsInformation.ts
-# Exception `dlv-dap` is a copy of github.com/go-delve/delve/cmd/dlv built from the master.
-GO_TOOLS="\
-    golang.org/x/tools/gopls@latest \
-    honnef.co/go/tools/cmd/staticcheck@latest \
-    golang.org/x/lint/golint@latest \
-    github.com/mgechev/revive@latest \
-    github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest \
-    github.com/ramya-rao-a/go-outline@latest \
-    github.com/go-delve/delve/cmd/dlv@latest \
-    github.com/golangci/golangci-lint/cmd/golangci-lint@latest"
-if [ "${INSTALL_GO_TOOLS}" = "true" ]; then
-    echo "Installing common Go tools..."
-    export PATH=${TARGET_GOROOT}/bin:${PATH}
-    mkdir -p /tmp/gotools /usr/local/etc/vscode-dev-containers ${TARGET_GOPATH}/bin
-    cd /tmp/gotools
-    export GOPATH=/tmp/gotools
-    export GOCACHE=/tmp/gotools/cache
-
-    # Use go get for versions of go under 1.17
-    go_install_command=install
-    if [[ "1.16" > "$(go version | grep -oP 'go\K[0-9]+\.[0-9]+(\.[0-9]+)?')" ]]; then
-        export GO111MODULE=on
-        go_install_command=get
-        echo "Go version < 1.17, using go get."
-    fi 
-
-    (echo "${GO_TOOLS}" | xargs -n 1 go ${go_install_command} -v )2>&1 | tee -a /usr/local/etc/vscode-dev-containers/go.log
-
-    # Move Go tools into path and clean up
-    mv /tmp/gotools/bin/* ${TARGET_GOPATH}/bin/
-
-    # install dlv-dap (dlv@master)
-    go ${go_install_command} -v github.com/go-delve/delve/cmd/dlv@master 2>&1 | tee -a /usr/local/etc/vscode-dev-containers/go.log
-    mv /tmp/gotools/bin/dlv ${TARGET_GOPATH}/bin/dlv-dap
-
-    rm -rf /tmp/gotools
-    chown -R ${USERNAME} "${TARGET_GOPATH}"
-fi
-
-# Add GOPATH variable and bin directory into PATH in bashrc/zshrc files (unless disabled)
-updaterc "$(cat << EOF
-export GOPATH="${TARGET_GOPATH}"
-if [[ "\${PATH}" != *"\${GOPATH}/bin"* ]]; then export PATH="\${PATH}:\${GOPATH}/bin"; fi
-export GOROOT="${TARGET_GOROOT}"
-if [[ "\${PATH}" != *"\${GOROOT}/bin"* ]]; then export PATH="\${PATH}:\${GOROOT}/bin"; fi
-EOF
-)"
-
-echo "Done!"
-

.devcontainer/library-scripts/k3s-debian.sh

@@ -1,105 +0,0 @@
-
-#!/usr/bin/env bash
-#
-# This is a replicated script.
-#
-# Syntax: ./k3s-debian.sh [k3s version] [k3s SHA256]
-
-set -e
-
-K3S_VERSION="${1:-"latest"}" # latest is also valid
-K3S_SHA256="${2:-"automatic"}"
-
-GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
-keyserver hkps://keys.openpgp.org
-keyserver hkp://keyserver.pgp.com"
-
-architecture="$(uname -m)"
-case $architecture in
-    x86_64) architecture="amd64";;
-    aarch64 | armv8*) architecture="arm64";;
-    aarch32 | armv7* | armvhf*) architecture="armhf";;
-    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
-esac
-
-# Figure out correct version of a three part version number is not passed
-find_version_from_git_tags() {
-    local variable_name=$1
-    local requested_version=${!variable_name}
-    if [ "${requested_version}" = "none" ]; then return; fi
-    local repository=$2
-    local prefix=${3:-"tags/v"}
-    local separator=${4:-"."}
-    local last_part_optional=${5:-"false"}    
-    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
-        local escaped_separator=${separator//./\\.}
-        local last_part
-        if [ "${last_part_optional}" = "true" ]; then
-            last_part="(${escaped_separator}[0-9ks\+]+)?"
-        else
-            last_part="${escaped_separator}[0-9ks\+]+"
-        fi
-        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
-        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
-        echo $version_list
-        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
-            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
-        else
-            set +e
-            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s+]|$)")"
-            set -e
-        fi
-    fi
-    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
-        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
-        exit 1
-    fi
-    echo "${variable_name}=${!variable_name}"
-}
-
-# Install K3s, verify checksum
-if [ "${K3S_VERSION}" != "none" ]; then
-    echo "Downloading k3s..."
-    urlPrefix=
-    if [ "${K3S_VERSION}" = "latest" ] || [ "${K3S_VERSION}" = "lts" ] || [ "${K3S_VERSION}" = "current" ] || [ "${K3S_VERSION}" = "stable" ]; then
-        K3S_VERSION="latest"
-        urlPrefix="https://github.com/k3s-io/k3s/releases/latest/download"
-    else
-        find_version_from_git_tags K3S_VERSION https://github.com/k3s-io/k3s
-        if [ "${K3S_VERSION::1}" != "v" ]; then
-            K3S_VERSION="v${K3S_VERSION}"
-        fi
-        urlPrefix="https://github.com/k3s-io/k3s/releases/download/${K3S_VERSION}"
-    fi
-    
-    # URL encode plus sign
-    K3S_VERSION="$(echo $K3S_VERSION | sed --expression='s/+/%2B/g')"
-
-    # latest is also valid in the download URLs
-    downloadUrl="${urlPrefix}/k3s${architecture}"
-    if [ "${architecture}" = "amd64" ]; then
-        downloadUrl="${urlPrefix}/k3s"
-    fi
-
-    curl -sSL -o /usr/local/bin/k3s "${downloadUrl}"
-    chmod 0755 /usr/local/bin/k3s
-
-    if [ "$K3S_SHA256" = "automatic" ]; then
-
-        shaUrl="${urlPrefix}/sha256sum-${architecture}.txt"
-        if [ "${architecture}" = "armhf" ]; then
-            shaUrl="${urlPrefix}/sha256sum-arm.txt"
-        fi
-
-        # Manifest contains image hashes, but we only need the binary
-        K3S_SHA256="$(curl -sSL $shaUrl | grep -P '(^|\s)\Kk3s(?=\s|$)' | cut -d ' ' -f1 )"
-    fi
-    echo $K3S_SHA256
-    ([ "${K3S_SHA256}" = "dev-mode" ] || (echo "${K3S_SHA256} */usr/local/bin/k3s" | sha256sum -c -))
-    if ! type k3s > /dev/null 2>&1; then
-        echo '(!) k3s installation failed!'
-        exit 1
-    fi
-fi
-
-echo -e "\nDone!"

.devcontainer/library-scripts/kubectl-helm-debian.sh

@@ -1,218 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/kubectl-helm.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./kubectl-helm-debian.sh [kubectl verison] [Helm version] [minikube version] [kubectl SHA256] [Helm SHA256] [minikube SHA256]
-
-set -e
-
-KUBECTL_VERSION="${1:-"latest"}"
-HELM_VERSION="${2:-"latest"}"
-MINIKUBE_VERSION="${3:-"none"}" # latest is also valid
-KUBECTL_SHA256="${4:-"automatic"}"
-HELM_SHA256="${5:-"automatic"}"
-MINIKUBE_SHA256="${6:-"automatic"}"
-
-HELM_GPG_KEYS_URI="https://raw.githubusercontent.com/helm/helm/main/KEYS"
-GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
-keyserver hkps://keys.openpgp.org
-keyserver hkp://keyserver.pgp.com"
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Figure out correct version of a three part version number is not passed
-find_version_from_git_tags() {
-    local variable_name=$1
-    local requested_version=${!variable_name}
-    if [ "${requested_version}" = "none" ]; then return; fi
-    local repository=$2
-    local prefix=${3:-"tags/v"}
-    local separator=${4:-"."}
-    local last_part_optional=${5:-"false"}    
-    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
-        local escaped_separator=${separator//./\\.}
-        local last_part
-        if [ "${last_part_optional}" = "true" ]; then
-            last_part="(${escaped_separator}[0-9]+)?"
-        else
-            last_part="${escaped_separator}[0-9]+"
-        fi
-        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
-        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
-        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
-            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
-        else
-            set +e
-            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
-            set -e
-        fi
-    fi
-    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
-        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
-        exit 1
-    fi
-    echo "${variable_name}=${!variable_name}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install dependencies
-check_packages curl ca-certificates coreutils gnupg2 dirmngr bash-completion
-if ! type git > /dev/null 2>&1; then
-    apt_get_update_if_needed
-    apt-get -y install --no-install-recommends git
-fi
-
-architecture="$(uname -m)"
-case $architecture in
-    x86_64) architecture="amd64";;
-    aarch64 | armv8*) architecture="arm64";;
-    aarch32 | armv7* | armvhf*) architecture="arm";;
-    i?86) architecture="386";;
-    *) echo "(!) Architecture $architecture unsupported"; exit 1 ;;
-esac
-
-# Install the kubectl, verify checksum
-echo "Downloading kubectl..."
-if [ "${KUBECTL_VERSION}" = "latest" ] || [ "${KUBECTL_VERSION}" = "lts" ] || [ "${KUBECTL_VERSION}" = "current" ] || [ "${KUBECTL_VERSION}" = "stable" ]; then
-    KUBECTL_VERSION="$(curl -sSL https://dl.k8s.io/release/stable.txt)"
-else
-    find_version_from_git_tags KUBECTL_VERSION https://github.com/kubernetes/kubernetes
-fi
-if [ "${KUBECTL_VERSION::1}" != 'v' ]; then
-    KUBECTL_VERSION="v${KUBECTL_VERSION}"
-fi
-curl -sSL -o /usr/local/bin/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${architecture}/kubectl"
-chmod 0755 /usr/local/bin/kubectl
-if [ "$KUBECTL_SHA256" = "automatic" ]; then
-    KUBECTL_SHA256="$(curl -sSL "https://dl.k8s.io/${KUBECTL_VERSION}/bin/linux/${architecture}/kubectl.sha256")"
-fi
-([ "${KUBECTL_SHA256}" = "dev-mode" ] || (echo "${KUBECTL_SHA256} */usr/local/bin/kubectl" | sha256sum -c -))
-if ! type kubectl > /dev/null 2>&1; then
-    echo '(!) kubectl installation failed!'
-    exit 1
-fi
-
-# kubectl bash completion
-kubectl completion bash > /etc/bash_completion.d/kubectl
-
-# kubectl zsh completion
-mkdir -p /home/${USERNAME}/.oh-my-zsh/completions
-kubectl completion zsh > /home/${USERNAME}/.oh-my-zsh/completions/_kubectl
-
-# Install Helm, verify signature and checksum
-echo "Downloading Helm..."
-find_version_from_git_tags HELM_VERSION "https://github.com/helm/helm"
-if [ "${HELM_VERSION::1}" != 'v' ]; then
-    HELM_VERSION="v${HELM_VERSION}"
-fi
-mkdir -p /tmp/helm
-helm_filename="helm-${HELM_VERSION}-linux-${architecture}.tar.gz"
-tmp_helm_filename="/tmp/helm/${helm_filename}"
-curl -sSL "https://get.helm.sh/${helm_filename}" -o "${tmp_helm_filename}"
-curl -sSL "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${helm_filename}.asc" -o "${tmp_helm_filename}.asc"
-export GNUPGHOME="/tmp/helm/gnupg"
-mkdir -p "${GNUPGHOME}"
-chmod 700 ${GNUPGHOME}
-get_common_setting HELM_GPG_KEYS_URI
-get_common_setting GPG_KEY_SERVERS true
-curl -sSL "${HELM_GPG_KEYS_URI}" -o /tmp/helm/KEYS
-echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
-gpg -q --import "/tmp/helm/KEYS"
-if ! gpg --verify "${tmp_helm_filename}.asc" > ${GNUPGHOME}/verify.log 2>&1; then
-    echo "Verification failed!"
-    cat /tmp/helm/gnupg/verify.log
-    exit 1
-fi
-if [ "${HELM_SHA256}" = "automatic" ]; then
-    curl -sSL "https://get.helm.sh/${helm_filename}.sha256" -o "${tmp_helm_filename}.sha256"
-    curl -sSL "https://github.com/helm/helm/releases/download/${HELM_VERSION}/${helm_filename}.sha256.asc" -o "${tmp_helm_filename}.sha256.asc"
-    if ! gpg --verify "${tmp_helm_filename}.sha256.asc" > /tmp/helm/gnupg/verify.log 2>&1; then
-        echo "Verification failed!"
-        cat /tmp/helm/gnupg/verify.log
-        exit 1
-    fi
-    HELM_SHA256="$(cat "${tmp_helm_filename}.sha256")"
-fi
-([ "${HELM_SHA256}" = "dev-mode" ] || (echo "${HELM_SHA256} *${tmp_helm_filename}" | sha256sum -c -))
-tar xf "${tmp_helm_filename}" -C /tmp/helm
-mv -f "/tmp/helm/linux-${architecture}/helm" /usr/local/bin/
-chmod 0755 /usr/local/bin/helm
-rm -rf /tmp/helm
-if ! type helm > /dev/null 2>&1; then
-    echo '(!) Helm installation failed!'
-    exit 1
-fi
-
-# Install Minikube, verify checksum
-if [ "${MINIKUBE_VERSION}" != "none" ]; then
-    echo "Downloading minikube..."
-    if [ "${MINIKUBE_VERSION}" = "latest" ] || [ "${MINIKUBE_VERSION}" = "lts" ] || [ "${MINIKUBE_VERSION}" = "current" ] || [ "${MINIKUBE_VERSION}" = "stable" ]; then
-        MINIKUBE_VERSION="latest"
-    else
-        find_version_from_git_tags MINIKUBE_VERSION https://github.com/kubernetes/minikube
-        if [ "${MINIKUBE_VERSION::1}" != "v" ]; then
-            MINIKUBE_VERSION="v${MINIKUBE_VERSION}"
-        fi
-    fi
-    # latest is also valid in the download URLs 
-    curl -sSL -o /usr/local/bin/minikube "https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-${architecture}"    
-    chmod 0755 /usr/local/bin/minikube
-    if [ "$MINIKUBE_SHA256" = "automatic" ]; then
-        MINIKUBE_SHA256="$(curl -sSL "https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-${architecture}.sha256")"
-    fi
-    ([ "${MINIKUBE_SHA256}" = "dev-mode" ] || (echo "${MINIKUBE_SHA256} */usr/local/bin/minikube" | sha256sum -c -))
-    if ! type minikube > /dev/null 2>&1; then
-        echo '(!) minikube installation failed!'
-        exit 1
-    fi
-fi
-
-if ! type docker > /dev/null 2>&1; then
-    echo -e '\n(*) Warning: The docker command was not found.\n\nYou can use one of the following scripts to install it:\n\nhttps://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker-in-docker.md\n\nor\n\nhttps://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/docker.md'
-fi
-
-echo -e "\nDone!"

.devcontainer/library-scripts/meta.env

@@ -1 +0,0 @@
-VERSION='dev'

.devcontainer/library-scripts/node-debian.sh

@@ -1,141 +0,0 @@
-#!/bin/bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/node.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./node-debian.sh [directory to install nvm] [node version to install (use "none" to skip)] [non-root user] [Update rc files flag]
-
-export NVM_DIR=${1:-"/usr/local/share/nvm"}
-export NODE_VERSION=${2:-"lts"}
-USERNAME=${3:-"automatic"}
-UPDATE_RC=${4:-"true"}
-export NVM_VERSION="0.38.0"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Ensure that login shells get the correct path if the user updated the PATH using ENV.
-rm -f /etc/profile.d/00-restore-env.sh
-echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
-chmod +x /etc/profile.d/00-restore-env.sh
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-updaterc() {
-    if [ "${UPDATE_RC}" = "true" ]; then
-        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
-        echo -e "$1" >> /etc/bash.bashrc
-        if [ -f "/etc/zsh/zshrc" ]; then
-            echo -e "$1" >> /etc/zsh/zshrc
-        fi
-    fi
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install dependencies
-check_packages apt-transport-https curl ca-certificates tar gnupg2
-
-# Install yarn
-if type yarn > /dev/null 2>&1; then
-    echo "Yarn already installed."
-else
-    # Import key safely (new method rather than deprecated apt-key approach) and install
-    curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg
-    echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list
-    apt-get update
-    apt-get -y install --no-install-recommends yarn
-fi
-
-# Adjust node version if required
-if [ "${NODE_VERSION}" = "none" ]; then
-    export NODE_VERSION=
-elif [ "${NODE_VERSION}" = "lts" ]; then
-    export NODE_VERSION="lts/*"
-fi
-
-# Install the specified node version if NVM directory already exists, then exit
-if [ -d "${NVM_DIR}" ]; then
-    echo "NVM already installed."
-    if [ "${NODE_VERSION}" != "" ]; then
-       su ${USERNAME} -c ". $NVM_DIR/nvm.sh && nvm install ${NODE_VERSION} && nvm clear-cache"
-    fi
-    exit 0
-fi
-
-# Create nvm group, nvm dir, and set sticky bit
-if ! cat /etc/group | grep -e "^nvm:" > /dev/null 2>&1; then
-    groupadd -r nvm
-fi
-umask 0002
-usermod -a -G nvm ${USERNAME}
-mkdir -p ${NVM_DIR}
-chown :nvm ${NVM_DIR}
-chmod g+s ${NVM_DIR}
-su ${USERNAME} -c "$(cat << EOF
-    set -e
-    umask 0002
-    # Do not update profile - we'll do this manually
-    export PROFILE=/dev/null
-    curl -so- https://raw.githubusercontent.com/nvm-sh/nvm/v${NVM_VERSION}/install.sh | bash 
-    source ${NVM_DIR}/nvm.sh
-    if [ "${NODE_VERSION}" != "" ]; then
-        nvm alias default ${NODE_VERSION}
-    fi
-    nvm clear-cache 
-EOF
-)" 2>&1
-# Update rc files
-if [ "${UPDATE_RC}" = "true" ]; then
-updaterc "$(cat <<EOF
-export NVM_DIR="${NVM_DIR}"
-[ -s "\$NVM_DIR/nvm.sh" ] && . "\$NVM_DIR/nvm.sh"
-[ -s "\$NVM_DIR/bash_completion" ] && . "\$NVM_DIR/bash_completion"
-EOF
-)"
-fi 
-
-echo "Done!"

.devcontainer/library-scripts/python-debian.sh

@@ -1,307 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/python.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./python-debian.sh [Python Version] [Python intall path] [PIPX_HOME] [non-root user] [Update rc files flag] [install tools]
-
-PYTHON_VERSION=${1:-"latest"}
-PYTHON_INSTALL_PATH=${2:-"/usr/local/python"}
-export PIPX_HOME=${3:-"/usr/local/py-utils"}
-USERNAME=${4:-"automatic"}
-UPDATE_RC=${5:-"true"}
-INSTALL_PYTHON_TOOLS=${6:-"true"}
-USE_PPA_IF_AVAILABLE=${7:-"true"}
-
-DEADSNAKES_PPA_ARCHIVE_GPG_KEY="F23C5A6CF475977595C89F51BA6932366A755776"
-PYTHON_SOURCE_GPG_KEYS="64E628F8D684696D B26995E310250568 2D347EA6AA65421D FB9921286F5E1540 3A5CA953F73C700D 04C367C218ADD4FF 0EDDC5F26A45C816 6AF053F07D9DC8D2 C9BE28DEE6DF025C 126EB563A74B06BF D9866941EA5BBD71 ED9D77D5"
-GPG_KEY_SERVERS="keyserver hkp://keyserver.ubuntu.com:80
-keyserver hkps://keys.openpgp.org
-keyserver hkp://keyserver.pgp.com"
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Ensure that login shells get the correct path if the user updated the PATH using ENV.
-rm -f /etc/profile.d/00-restore-env.sh
-echo "export PATH=${PATH//$(sh -lc 'echo $PATH')/\$PATH}" > /etc/profile.d/00-restore-env.sh
-chmod +x /etc/profile.d/00-restore-env.sh
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-updaterc() {
-    if [ "${UPDATE_RC}" = "true" ]; then
-        echo "Updating /etc/bash.bashrc and /etc/zsh/zshrc..."
-        echo -e "$1" >> /etc/bash.bashrc
-        if [ -f "/etc/zsh/zshrc" ]; then
-            echo -e "$1" >> /etc/zsh/zshrc
-        fi
-    fi
-}
-
-# Get central common setting
-get_common_setting() {
-    if [ "${common_settings_file_loaded}" != "true" ]; then
-        curl -sfL "https://aka.ms/vscode-dev-containers/script-library/settings.env" 2>/dev/null -o /tmp/vsdc-settings.env || echo "Could not download settings file. Skipping."
-        common_settings_file_loaded=true
-    fi
-    if [ -f "/tmp/vsdc-settings.env" ]; then
-        local multi_line=""
-        if [ "$2" = "true" ]; then multi_line="-z"; fi
-        local result="$(grep ${multi_line} -oP "$1=\"?\K[^\"]+" /tmp/vsdc-settings.env | tr -d '\0')"
-        if [ ! -z "${result}" ]; then declare -g $1="${result}"; fi
-    fi
-    echo "$1=${!1}"
-}
-
-# Import the specified key in a variable name passed in as 
-receive_gpg_keys() {
-    get_common_setting $1
-    local keys=${!1}
-    get_common_setting GPG_KEY_SERVERS true
-    local keyring_args=""
-    if [ ! -z "$2" ]; then
-        mkdir -p "$(dirname \"$2\")"
-        keyring_args="--no-default-keyring --keyring $2"
-    fi
-
-    # Use a temporary locaiton for gpg keys to avoid polluting image
-    export GNUPGHOME="/tmp/tmp-gnupg"
-    mkdir -p ${GNUPGHOME}
-    chmod 700 ${GNUPGHOME}
-    echo -e "disable-ipv6\n${GPG_KEY_SERVERS}" > ${GNUPGHOME}/dirmngr.conf
-    # GPG key download sometimes fails for some reason and retrying fixes it.
-    local retry_count=0
-    local gpg_ok="false"
-    set +e
-    until [ "${gpg_ok}" = "true" ] || [ "${retry_count}" -eq "5" ]; 
-    do
-        echo "(*) Downloading GPG key..."
-        ( echo "${keys}" | xargs -n 1 gpg -q ${keyring_args} --recv-keys) 2>&1 && gpg_ok="true"
-        if [ "${gpg_ok}" != "true" ]; then
-            echo "(*) Failed getting key, retring in 10s..."
-            (( retry_count++ ))
-            sleep 10s
-        fi
-    done
-    set -e
-    if [ "${gpg_ok}" = "false" ]; then
-        echo "(!) Failed to install rvm."
-        exit 1
-    fi
-}
-
-# Figure out correct version of a three part version number is not passed
-find_version_from_git_tags() {
-    local variable_name=$1
-    local requested_version=${!variable_name}
-    if [ "${requested_version}" = "none" ]; then return; fi
-    local repository=$2
-    local prefix=${3:-"tags/v"}
-    local separator=${4:-"."}
-    local last_part_optional=${5:-"false"}    
-    if [ "$(echo "${requested_version}" | grep -o "." | wc -l)" != "2" ]; then
-        local escaped_separator=${separator//./\\.}
-        local last_part
-        if [ "${last_part_optional}" = "true" ]; then
-            last_part="(${escaped_separator}[0-9]+)?"
-        else
-            last_part="${escaped_separator}[0-9]+"
-        fi
-        local regex="${prefix}\\K[0-9]+${escaped_separator}[0-9]+${last_part}$"
-        local version_list="$(git ls-remote --tags ${repository} | grep -oP "${regex}" | tr -d ' ' | tr "${separator}" "." | sort -rV)"
-        if [ "${requested_version}" = "latest" ] || [ "${requested_version}" = "current" ] || [ "${requested_version}" = "lts" ]; then
-            declare -g ${variable_name}="$(echo "${version_list}" | head -n 1)"
-        else
-            set +e
-            declare -g ${variable_name}="$(echo "${version_list}" | grep -E -m 1 "^${requested_version//./\\.}([\\.\\s]|$)")"
-            set -e
-        fi
-    fi
-    if [ -z "${!variable_name}" ] || ! echo "${version_list}" | grep "^${!variable_name//./\\.}$" > /dev/null 2>&1; then
-        echo -e "Invalid ${variable_name} value: ${requested_version}\nValid values:\n${version_list}" >&2
-        exit 1
-    fi
-    echo "${variable_name}=${!variable_name}"
-}
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-install_from_ppa() {
-    local requested_version="python${PYTHON_VERSION}"
-    echo "Using PPA to install Python..."
-    check_packages apt-transport-https curl ca-certificates gnupg2
-    receive_gpg_keys DEADSNAKES_PPA_ARCHIVE_GPG_KEY /usr/share/keyrings/deadsnakes-archive-keyring.gpg 
-    echo -e "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] http://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main\ndeb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] http://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main" > /etc/apt/sources.list.d/deadsnakes-ppa.list
-    apt-get update
-    if [ "${PYTHON_VERSION}" = "latest" ] || [ "${PYTHON_VERSION}" = "current" ] || [ "${PYTHON_VERSION}" = "lts" ]; then
-        requested_version="$(apt-cache search '^python3\.[0-9]$' | grep -oE '^python3\.[0-9]' | sort -rV | head -n 1)"
-        echo "Using ${requested_version} in place of ${PYTHON_VERSION}."
-    fi
-    apt-get -y install ${requested_version}
-    rm -rf /tmp/tmp-gnupg
-    exit 0
-}
-
-install_from_source() {
-    if [ -d "${PYTHON_INSTALL_PATH}" ]; then
-        echo "Path ${PYTHON_INSTALL_PATH} already exists. Remove this existing path or select a different one."
-        exit 1
-    else
-        echo "Building Python ${PYTHON_VERSION} from source..."
-        # Install prereqs if missing
-        check_packages curl ca-certificates tar make build-essential libssl-dev zlib1g-dev \
-                    wget libbz2-dev libreadline-dev libxml2-dev xz-utils tk-dev gnupg2 \
-                    libxmlsec1-dev libsqlite3-dev libffi-dev liblzma-dev llvm dirmngr
-        if ! type git > /dev/null 2>&1; then
-            apt_get_update_if_needed
-            apt-get -y install --no-install-recommends git
-        fi
-
-        # Find version using soft match
-        find_version_from_git_tags PYTHON_VERSION "https://github.com/python/cpython"
-
-        # Download tgz of source
-        mkdir -p /tmp/python-src "${PYTHON_INSTALL_PATH}"
-        cd /tmp/python-src
-        TGZ_FILENAME="Python-${PYTHON_VERSION}.tgz"
-        TGZ_URL="https://www.python.org/ftp/python/${PYTHON_VERSION}/${TGZ_FILENAME}"
-        echo "Downloading ${TGZ_FILENAME}..."
-        curl -sSL -o "/tmp/python-src/${TGZ_FILENAME}" "${TGZ_URL}"
-
-        # Verify signature
-        if [ "${SKIP_SIGNATURE_CHECK}" != "true" ]; then
-            receive_gpg_keys PYTHON_SOURCE_GPG_KEYS
-            echo "Downloading ${TGZ_FILENAME}.asc..."
-            curl -sSL -o "/tmp/python-src/${TGZ_FILENAME}.asc" "${TGZ_URL}.asc"
-            gpg --verify "${TGZ_FILENAME}.asc"
-        fi
-
-        # Update min protocol for testing only - https://bugs.python.org/issue41561
-        cp /etc/ssl/openssl.cnf /tmp/python-src/
-        sed -i -E 's/MinProtocol[=\ ]+.*/MinProtocol = TLSv1.0/g' /tmp/python-src/openssl.cnf
-        export OPENSSL_CONF=/tmp/python-src/openssl.cnf
-
-        # Untar and build
-        tar -xzf "/tmp/python-src/${TGZ_FILENAME}" -C "/tmp/python-src" --strip-components=1
-        ./configure --prefix="${PYTHON_INSTALL_PATH}" --enable-optimizations --with-ensurepip=install
-        make -j 8
-        make install
-        cd /tmp
-        rm -rf /tmp/python-src ${GNUPGHOME} /tmp/vscdc-settings.env
-        chown -R ${USERNAME} "${PYTHON_INSTALL_PATH}"
-        ln -s ${PYTHON_INSTALL_PATH}/bin/python3 ${PYTHON_INSTALL_PATH}/bin/python
-        ln -s ${PYTHON_INSTALL_PATH}/bin/pip3 ${PYTHON_INSTALL_PATH}/bin/pip
-        ln -s ${PYTHON_INSTALL_PATH}/bin/idle3 ${PYTHON_INSTALL_PATH}/bin/idle
-        ln -s ${PYTHON_INSTALL_PATH}/bin/pydoc3 ${PYTHON_INSTALL_PATH}/bin/pydoc
-        ln -s ${PYTHON_INSTALL_PATH}/bin/python3-config ${PYTHON_INSTALL_PATH}/bin/python-config
-        updaterc "export PATH=${PYTHON_INSTALL_PATH}/bin:\${PATH}"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install python from source if needed
-if [ "${PYTHON_VERSION}" != "none" ]; then
-    # Source /etc/os-release to get OS info
-    . /etc/os-release
-    # If ubuntu, PPAs allowed - install from there
-    if [ "${ID}" = "ubuntu" ] && [ "${USE_PPA_IF_AVAILABLE}" = "true" ]; then
-        install_from_ppa
-    else
-        install_from_source
-    fi
-fi
-
-# If not installing python tools, exit
-if [ "${INSTALL_PYTHON_TOOLS}" != "true" ]; then
-    echo "Done!"
-    exit 0;
-fi
-
-DEFAULT_UTILS="\
-    pylint \
-    flake8 \
-    autopep8 \
-    black \
-    yapf \
-    mypy \
-    pydocstyle \
-    pycodestyle \
-    bandit \
-    pipenv \
-    virtualenv"
-
-export PIPX_BIN_DIR=${PIPX_HOME}/bin
-export PATH=${PYTHON_INSTALL_PATH}/bin:${PIPX_BIN_DIR}:${PATH}
-
-# Update pip
-echo "Updating pip..."
-python3 -m pip install --no-cache-dir --upgrade pip
-
-# Create pipx group, dir, and set sticky bit
-if ! cat /etc/group | grep -e "^pipx:" > /dev/null 2>&1; then
-    groupadd -r pipx
-fi
-usermod -a -G pipx ${USERNAME}
-umask 0002
-mkdir -p ${PIPX_BIN_DIR}
-chown :pipx ${PIPX_HOME} ${PIPX_BIN_DIR}
-chmod g+s ${PIPX_HOME} ${PIPX_BIN_DIR}
-
-# Install tools
-echo "Installing Python tools..."
-export PYTHONUSERBASE=/tmp/pip-tmp
-export PIP_CACHE_DIR=/tmp/pip-tmp/cache
-pip3 install --disable-pip-version-check --no-warn-script-location  --no-cache-dir --user pipx
-/tmp/pip-tmp/bin/pipx install --pip-args=--no-cache-dir pipx
-echo "${DEFAULT_UTILS}" | xargs -n 1 /tmp/pip-tmp/bin/pipx install --system-site-packages --pip-args '--no-cache-dir --force-reinstall'
-rm -rf /tmp/pip-tmp
-
-updaterc "$(cat << EOF
-export PIPX_HOME="${PIPX_HOME}"
-export PIPX_BIN_DIR="${PIPX_BIN_DIR}"
-if [[ "\${PATH}" != *"\${PIPX_BIN_DIR}"* ]]; then export PATH="\${PATH}:\${PIPX_BIN_DIR}"; fi
-EOF
-)"

.devcontainer/library-scripts/replicated-debian.sh

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-
-# k3d
-# v5 RC is needed to deterministically set the Registry port. Should be replaces with official release
-curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | TAG=v5.0.0-rc.4 bash
-
-# kustomize
-pushd /tmp
-curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
-popd
-sudo mv /tmp/kustomize /usr/local/bin/ 
-
-

.devcontainer/library-scripts/replicated-userspace.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-# install Krew 
-# TODO (dans): ditch krew and just download the latest binaries on the path in Dockerfile
-(
-  set -x; cd "$(mktemp -d)" &&
-  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
-  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
-  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/krew.tar.gz" &&
-  tar zxvf krew.tar.gz &&
-  KREW=./krew-"${OS}_${ARCH}" &&
-  "$KREW" install krew
-)
-
-# install krew plugins
-kubectl krew install schemahero
-kubectl krew install support-bundle
-kubectl krew install preflights
-kubectl krew install view-secret
-
-# Make the cache from master branch
-pushd /tmp 
-git clone https://github.com/replicatedhq/troubleshoot.git
-pushd troubleshoot
-# TODO (dans): find a way to cache images on image build
-go mod download
-popd
-rm -rf kots
-popd
-
-# Clone any extra repos here
-
-# Autocomplete Kubernetes
-cat >> ~/.zshrc << EOF
-
-source <(kubectl completion zsh)
-alias k=kubectl
-complete -F __start_kubectl k
-EOF
-
-# Set Git Editor Preference
-cat >> ~/.zshrc << EOF
-
-export VISUAL=vim
-export EDITOR="$VISUAL"
-EOF

.devcontainer/library-scripts/setup-user.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-# modified from https://github.com/microsoft/vscode-dev-containers/blob/main/containers/codespaces-linux/.devcontainer/setup-user.sh
-# not part of the standard script library
-
-USERNAME=${1:-codespace}
-SECURE_PATH_BASE=${2:-$PATH}
-
-echo "Defaults secure_path=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/bin:${SECURE_PATH_BASE}\"" >> /etc/sudoers.d/securepath
-
-# Add user to a Docker group
-sudo -u ${USERNAME} mkdir /home/${USERNAME}/.vsonline
-groupadd -g 800 docker
-usermod -a -G docker ${USERNAME}
-
-# Create user's .local/bin
-sudo -u ${USERNAME} mkdir -p /home/${USERNAME}/.local/bin

.devcontainer/library-scripts/sshd-debian.sh

@@ -1,165 +0,0 @@
-#!/usr/bin/env bash
-#-------------------------------------------------------------------------------------------------------------
-# Copyright (c) Microsoft Corporation. All rights reserved.
-# Licensed under the MIT License. See https://go.microsoft.com/fwlink/?linkid=2090316 for license information.
-#-------------------------------------------------------------------------------------------------------------
-#
-# Docs: https://github.com/microsoft/vscode-dev-containers/blob/main/script-library/docs/sshd.md
-# Maintainer: The VS Code and Codespaces Teams
-#
-# Syntax: ./sshd-debian.sh [SSH Port (don't use 22)] [non-root user] [start sshd now flag] [new password for user] [fix environment flag]
-#
-# Note: You can change your user's password with "sudo passwd $(whoami)" (or just "passwd" if running as root).
-
-SSHD_PORT=${1:-"2222"}
-USERNAME=${2:-"automatic"}
-START_SSHD=${3:-"false"}
-NEW_PASSWORD=${4:-"skip"}
-FIX_ENVIRONMENT=${5:-"true"}
-
-set -e
-
-if [ "$(id -u)" -ne 0 ]; then
-    echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
-    exit 1
-fi
-
-# Determine the appropriate non-root user
-if [ "${USERNAME}" = "auto" ] || [ "${USERNAME}" = "automatic" ]; then
-    USERNAME=""
-    POSSIBLE_USERS=("vscode" "node" "codespace" "$(awk -v val=1000 -F ":" '$3==val{print $1}' /etc/passwd)")
-    for CURRENT_USER in ${POSSIBLE_USERS[@]}; do
-        if id -u ${CURRENT_USER} > /dev/null 2>&1; then
-            USERNAME=${CURRENT_USER}
-            break
-        fi
-    done
-    if [ "${USERNAME}" = "" ]; then
-        USERNAME=root
-    fi
-elif [ "${USERNAME}" = "none" ] || ! id -u ${USERNAME} > /dev/null 2>&1; then
-    USERNAME=root
-fi
-
-# Function to run apt-get if needed
-apt_get_update_if_needed()
-{
-    if [ ! -d "/var/lib/apt/lists" ] || [ "$(ls /var/lib/apt/lists/ | wc -l)" = "0" ]; then
-        echo "Running apt-get update..."
-        apt-get update
-    else
-        echo "Skipping apt-get update."
-    fi
-}
-
-# Checks if packages are installed and installs them if not
-check_packages() {
-    if ! dpkg -s "$@" > /dev/null 2>&1; then
-        apt_get_update_if_needed
-        apt-get -y install --no-install-recommends "$@"
-    fi
-}
-
-# Ensure apt is in non-interactive to avoid prompts
-export DEBIAN_FRONTEND=noninteractive
-
-# Install openssh-server openssh-client
-check_packages openssh-server openssh-client lsof
-
-# Generate password if new password set to the word "random"
-if [ "${NEW_PASSWORD}" = "random" ]; then
-    NEW_PASSWORD="$(openssl rand -hex 16)"
-    EMIT_PASSWORD="true"
-elif [ "${NEW_PASSWORD}" != "skip" ]; then
-    # If new password not set to skip, set it for the specified user
-    echo "${USERNAME}:${NEW_PASSWORD}" | chpasswd
-fi
-
-# Add user to ssh group
-if [ "${USERNAME}" != "root" ]; then
-    usermod -aG ssh ${USERNAME}
-fi
-
-# Setup sshd
-mkdir -p /var/run/sshd
-sed -i 's/session\s*required\s*pam_loginuid\.so/session optional pam_loginuid.so/g' /etc/pam.d/sshd
-sed -i 's/#*PermitRootLogin prohibit-password/PermitRootLogin yes/g' /etc/ssh/sshd_config
-sed -i -E "s/#*\s*Port\s+.+/Port ${SSHD_PORT}/g" /etc/ssh/sshd_config
-# Need to UsePAM so /etc/environment is processed
-sed -i -E "s/#?\s*UsePAM\s+.+/UsePAM yes/g" /etc/ssh/sshd_config
-
-# Script to store variables that exist at the time the ENTRYPOINT is fired
-store_env_script="$(cat << 'EOF'
-# Wire in codespaces secret processing to zsh if present (since may have been added to image after script was run)
-if [ -f  /etc/zsh/zlogin ] && ! grep '/etc/profile.d/00-restore-secrets.sh' /etc/zsh/zlogin > /dev/null 2>&1; then
-    echo -e "if [ -f /etc/profile.d/00-restore-secrets.sh ]; then . /etc/profile.d/00-restore-secrets.sh; fi\n$(cat /etc/zsh/zlogin 2>/dev/null || echo '')" | sudoIf tee /etc/zsh/zlogin > /dev/null
-fi
-EOF
-)"
-
-# Script to ensure login shells get the latest Codespaces secrets
-restore_secrets_script="$(cat << 'EOF'
-#!/bin/sh
-if [ "${CODESPACES}" != "true" ] || [ "${VSCDC_FIXED_SECRETS}" = "true" ] || [ ! -z "${GITHUB_CODESPACES_TOKEN}" ]; then
-    # Not codespaces, already run, or secrets already in environment, so return
-    return
-fi
-if [ -f /workspaces/.codespaces/shared/.env ]; then
-    set -o allexport
-    . /workspaces/.codespaces/shared/.env
-    set +o allexport
-fi
-export VSCDC_FIXED_SECRETS=true
-EOF
-)"
-
-# Write out a scripts that can be referenced as an ENTRYPOINT to auto-start sshd and fix login environments
-tee /usr/local/share/ssh-init.sh > /dev/null \
-<< 'EOF'
-#!/usr/bin/env bash
-# This script is intended to be run as root with a container that runs as root (even if you connect with a different user)
-# However, it supports running as a user other than root if passwordless sudo is configured for that same user.
-
-set -e 
-
-sudoIf()
-{
-    if [ "$(id -u)" -ne 0 ]; then
-        sudo "$@"
-    else
-        "$@"
-    fi
-}
-
-EOF
-if [ "${FIX_ENVIRONMENT}" = "true" ]; then
-    echo "${store_env_script}" >> /usr/local/share/ssh-init.sh
-    echo "${restore_secrets_script}" > /etc/profile.d/00-restore-secrets.sh
-    chmod +x /etc/profile.d/00-restore-secrets.sh
-    # Wire in zsh if present
-    if type zsh > /dev/null 2>&1; then
-        echo -e "if [ -f /etc/profile.d/00-restore-secrets.sh ]; then . /etc/profile.d/00-restore-secrets.sh; fi\n$(cat /etc/zsh/zlogin 2>/dev/null || echo '')" > /etc/zsh/zlogin
-    fi
-fi
-tee -a /usr/local/share/ssh-init.sh > /dev/null \
-<< 'EOF'
-
-# ** Start SSH server **
-sudoIf /etc/init.d/ssh start 2>&1 | sudoIf tee /tmp/sshd.log > /dev/null
-
-set +e
-exec "$@"
-EOF
-chmod +x /usr/local/share/ssh-init.sh
-
-# If we should start sshd now, do so
-if [ "${START_SSHD}" = "true" ]; then
-    /usr/local/share/ssh-init.sh
-fi
-
-# Output success details
-echo -e "Done!\n\n- Port: ${SSHD_PORT}\n- User: ${USERNAME}"
-if [ "${EMIT_PASSWORD}" = "true" ]; then
-    echo "- Password: ${NEW_PASSWORD}"
-fi
-echo -e "\nForward port ${SSHD_PORT} to your local machine and run:\n\n  ssh -p ${SSHD_PORT} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o GlobalKnownHostsFile=/dev/null ${USERNAME}@localhost\n"

.devcontainer/lifecycle-scripts/onCreate.sh

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-# Setup the cluster
-k3d cluster create --config /etc/replicated/k3d-cluster.yaml --kubeconfig-update-default
-
-# Clone any extra repos here
-
-

.devcontainer/lifecycle-scripts/onStart.sh

@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-# Start the cluster here
-k3d cluster start replicated
-

.factory-workflows/dependency-update.yaml

@@ -0,0 +1,180 @@
+schema_version: v1
+name: dependency-update-troubleshoot
+enabled: true
+
+trigger:
+  cron:
+    schedule: "0 21 * * *"
+    timezone: "America/Chicago"
+    overlap_policy: skip
+    timeout: 2h
+
+enable_manual_trigger: true
+
+tags: ["cron", "dependencies"]
+color: cyan
+
+stages:
+  - id: start
+    label: Start
+    entry: true
+    on_enter:
+      inject: |
+        Workflow task: run the Go dependency update maintenance workflow for Troubleshoot.
+
+        This is an unattended dependency maintenance workflow. Scope: Go
+        dependency updates for the top-level go.mod/go.sum plus examples/sdk/helm-template. After updates
+        are applied, you will review the changes, fix any compatibility issues,
+        validate with make build and make test, and open one grouped PR.
+
+        Do not ask for permission to start. Immediately say exactly [PROCEED]
+        to run the dependency updater. Detailed post-update instructions will
+        follow.
+
+  - id: working
+    label: Working
+    triggers:
+      - message_contains: "[PROCEED]"
+    on_enter:
+      run:
+        command: |
+          bash -lc '
+            set -euo pipefail
+
+            if ! command -v go >/dev/null 2>&1; then
+              nix profile install nixpkgs#go_1_26 || nix-env -iA nixpkgs.go_1_26
+            fi
+
+            go_path="$(command -v go)"
+            go_version="$(go version)"
+            printf "{\"status\":\"ready\",\"go_path\":\"%s\",\"go_version\":\"%s\"}\n" "$go_path" "$go_version"
+          '
+        output: go_toolchain
+        timeout: 10m
+      dependency_updates:
+        ecosystems: [go]
+        paths: ["."]
+        output: dependency_updates
+        timeout: 30m
+      inject: |
+        Dependency updates were applied for the root Go module.
+
+        Scope this workflow to Go dependency updates only. Focus on the
+        top-level go.mod/go.sum. Exclude Node dependencies and any non-Go
+        modules.
+
+        Treat compatibility fixes as part of this workflow. If an updated
+        dependency causes build, lint, type, or test failures, first attempt
+        reasonable scoped code changes within the affected Go module to support
+        the new version. Do not downgrade, pin, or skip an update just because
+        it has breaking API changes unless the required changes are broad,
+        risky, unrelated to this workflow's scope, or cannot be completed within
+        reasonable effort. If you defer an update, explain exactly why.
+
+        Review {{ .Outputs.dependency_updates.files_changed }}.
+        Before opening a PR, validate using the repo make targets in the Nix
+        development environment (nix develop -c). Do not run ad-hoc go
+        commands; use exactly these targets:
+
+        - make build
+        - make test
+
+        Note: make test-integration requires a Kubernetes cluster. Only add it
+        to the validation if the workflow environment provides one.
+
+        Fix any failures and open one grouped PR.
+        Say [DONE] with the PR URL only when the PR is open.
+        If {{ .Outputs.dependency_updates.files_changed }} is empty and no PR is
+        needed, say [NO_CHANGES] instead of [DONE].
+
+  - id: no-changes
+    label: No Changes
+    triggers:
+      - message_contains: "[NO_CHANGES]"
+      - message_contains: "[DONE] No changes"
+    terminal: true
+
+  - id: validate
+    label: Validate
+    triggers:
+      - message_contains: "[DONE]"
+    on_enter:
+      run:
+        command: |
+          nix develop -c bash -lc '
+            set +e
+            tmpdir="$(mktemp -d)"
+
+            make build >"$tmpdir/build.log" 2>&1
+            build_status=$?
+
+            make test >"$tmpdir/test.log" 2>&1
+            test_status=$?
+
+            python3 - "$tmpdir" "$build_status" "$test_status" <<PY
+          import json
+          import pathlib
+          import sys
+
+          tmpdir = pathlib.Path(sys.argv[1])
+          statuses = {
+              "build": int(sys.argv[2]),
+              "test": int(sys.argv[3]),
+          }
+
+          checks = []
+          for name, code in statuses.items():
+              log = (tmpdir / f"{name}.log").read_text(errors="replace")
+              checks.append({
+                  "name": name,
+                  "status": "passed" if code == 0 else "failed",
+                  "exit_code": code,
+                  "log_tail": log[-12000:],
+              })
+
+          failed = [check for check in checks if check["exit_code"] != 0]
+          print(json.dumps({
+              "status": "passed" if not failed else "failed",
+              "reason": "all validation checks passed" if not failed else "one or more validation checks failed",
+              "checks": checks,
+          }))
+          PY
+          '
+        output: validation
+        timeout: 45m
+    gate:
+      output: validation
+      pass:
+        path: status
+        values: [passed]
+      fail:
+        path: status
+        values: [failed, error]
+      required: true
+
+  - id: fix-validation
+    label: Fix Validation
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: fail
+    on_enter:
+      inject: |
+        Validation failed before completion.
+
+        Status: {{ .Outputs.validation.status }}
+        Reason: {{ .Outputs.validation.reason }}
+
+        Checks:
+        {{ .Outputs.validation.checks }}
+
+        Fix the failures above, commit the changes to the same PR branch, and
+        say [DONE] with the PR URL again when the PR is ready for validation.
+
+  - id: complete
+    label: Complete
+    triggers:
+      - gate_result:
+          stage: validate
+          verdict: pass
+    terminal: true

.github/CODEOWNERS

@@ -1,21 +0,0 @@
-# Lines starting with '#' are comments.
-# Each line is a file pattern followed by one or more owners.
-
-# More details are here: https://help.github.com/articles/about-codeowners/
-
-# The '*' pattern is global owners.
-
-# Order is important. The last matching pattern has the most precedence.
-# The folders are ordered as follows:
-
-# In each subsection folders are ordered first by depth, then alphabetically.
-# This should make it easy to add new rules without breaking existing ones.
-
-## RULES 
-
-* @replicatedhq/troubleshoot
-*.md @replicatedhq/cre
-go.mod
-go.sum
-/examples/sdk/helm-template/go.mod
-/examples/sdk/helm-template/go.sum

.github/ISSUE_TEMPLATE/feature_epic.md

@@ -7,7 +7,7 @@ labels: 'epic'
 
 # Design Proposal
 
-Link to the [proposal](https://github.com/replicatedhq/troubleshoot/tree/main/design/template.md)
+Link to the [proposal](https://github.com/replicatedhq/troubleshoot/tree/main/docs/design/template.md)
 
 # Definition of done
 

.github/workflows/automated-prs-manager.yaml

@@ -1,97 +0,0 @@
-name: Automated PRs Manager
-
-on:
-  schedule:
-  - cron: "0 */6 * * *" # every 6 hours
-  workflow_dispatch: {}
-
-jobs:
-  list-prs:
-    runs-on: ubuntu-latest
-    outputs:
-      prs: ${{ steps.list-prs.outputs.prs }}
-    env:
-      GH_TOKEN: ${{ secrets.REPLICATED_GH_PAT }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: List PRs
-        id: list-prs
-        run: |
-          set -euo pipefail
-
-          # list prs that are less than 24h old and exclude prs from forks
-
-          dependabot_prs=$(
-            gh pr list \
-              --author 'dependabot[bot]' \
-              --json url,createdAt,headRefName,headRepository,headRepositoryOwner \
-              -q '.[] | select((.createdAt | fromdateiso8601 > now - 24*60*60) and .headRepositoryOwner.login == "replicatedhq" and .headRepository.name == "troubleshoot")'
-          )
-
-          prs=$(echo "$dependabot_prs" | jq -sc '. | unique')
-          echo "prs=$prs" >> "$GITHUB_OUTPUT"
-
-  process-prs:
-    needs: list-prs
-    runs-on: ubuntu-latest
-    if: needs.list-prs.outputs.prs != '[]'
-    strategy:
-      matrix:
-        pr: ${{ fromJson(needs.list-prs.outputs.prs) }}
-      fail-fast: false
-      max-parallel: 1
-    env:
-      GH_TOKEN: ${{ secrets.REPLICATED_GH_PAT }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ matrix.pr.headRefName }}
-
-      - name: Process PR
-        run: |
-          set -euo pipefail
-
-          echo "Ensuring required labels..."
-          gh pr edit "${{ matrix.pr.url }}" --add-label "type::security"
-
-          echo "Checking status of tests..."
-          run_id=$(gh run list --branch "${{ matrix.pr.headRefName }}" --workflow build-test-deploy --limit 1 --json databaseId -q '.[0].databaseId')
-
-          # If there are still pending jobs, skip.
-
-          num_of_pending_jobs=$(gh run view "$run_id" --json jobs -q '.jobs[] | select(.conclusion == "") | .name' | wc -l)
-          if [ "$num_of_pending_jobs" -gt 0 ]; then
-            echo "There are still pending jobs. Skipping."
-            exit 0
-          fi
-
-          # If all checks passed, approve and merge.
-          if gh run view "$run_id" --json jobs -q '.jobs[] | select(.name == "validate-success") | .conclusion' | grep -q "success"; then
-            if gh pr checks "${{ matrix.pr.url }}"; then
-              echo "All tests passed. Approving and merging."
-              echo -e "LGTM :thumbsup: \n\nThis PR was automatically approved and merged by the [automated-prs-manager](https://github.com/replicatedhq/troubleshoot/blob/main/.github/workflows/automated-prs-manager.yaml) GitHub action" > body.txt
-              gh pr review --approve "${{ matrix.pr.url }}" --body-file body.txt
-              sleep 10
-              gh pr merge --auto --squash "${{ matrix.pr.url }}"
-              exit 0
-            else
-              echo "Some checks did not pass. Skipping."
-              exit 0
-            fi
-          fi
-
-          # If more than half of the jobs are successful, re-run the failed jobs.
-
-          num_of_jobs=$(gh run view "$run_id" --json jobs -q '.jobs[].name ' | wc -l)
-          num_of_successful_jobs=$(gh run view "$run_id" --json jobs -q '.jobs[] | select(.conclusion == "success") | .name' | wc -l)
-
-          if [ "$num_of_successful_jobs" -gt $((num_of_jobs / 2)) ]; then
-            echo "More than half of the jobs are successful. Re-running failed jobs."
-            gh run rerun "$run_id" --failed
-            exit 0
-          fi
-
-          echo "Less than half of the jobs are successful. Skipping."

.github/workflows/build-test-deploy.yaml

@@ -22,350 +22,137 @@ concurrency:
 jobs:
   fail_if_pull_request_is_draft:
     if: github.event.pull_request.draft == true
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Fails in order to indicate that pull request needs to be marked as ready to review and unit tests workflow needs to pass.
         run: exit 1
 
-  test:
-    runs-on: ubuntu-20.04
+  tidy-check:
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: "1.21"
-
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-
-      - uses: actions/checkout@v4
-
-      - run: make test
+          go-version-file: 'go.mod'
+      - run: make tidy-diff
 
   test-integration:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: "1.21"
-
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-
-      - uses: actions/checkout@v4
+          go-version-file: 'go.mod'
       - uses: replicatedhq/action-k3s@main
         id: k3s
         with:
-          version: v1.24.1-k3s1
-
+          version: v1.31.2-k3s1
+      # test-integration includes unit tests
       - run: make test-integration
 
-  ensure-schemas-are-generated:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.21"
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - run: make check-schemas
 
   compile-preflight:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: "1.21"
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@v4
+          go-version-file: 'go.mod'
       - run: make generate preflight
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: preflight
           path: bin/preflight
 
-  validate-preflight:
-    runs-on: ubuntu-latest
-    needs: compile-preflight
-    steps:
-      - uses: replicatedhq/action-k3s@main
-        id: k3s
-        with:
-          version: v1.23.6-k3s1
-      - name: Download preflight binary
-        uses: actions/download-artifact@v4
-        with:
-          name: preflight
-          path: bin/
-      - run: chmod +x bin/preflight
-      - run: |
-          set +e
-          ./bin/preflight --interactive=false --format=json https://preflight.replicated.com > result.json
-          EXIT_CODE=$?
-          cat result.json
-
-          EXIT_STATUS=0
-          if [ $EXIT_CODE -ne 3 ]; then
-            echo "Expected exit code of 3 (some checks failed), got $EXIT_CODE"
-            EXIT_STATUS=1
-          fi
-
-          if grep -q "was not collected" result.json; then
-            echo "Some files were not collected"
-            EXIT_STATUS=1
-          fi
-
-          if (( `jq '.pass | length' result.json` < 1 )); then
-            echo "No passing preflights found"
-            EXIT_STATUS=1
-          fi
-
-          if (( `jq '.warn | length' result.json` < 1 )); then
-            echo "No warnings found"
-            EXIT_STATUS=1
-          fi
-
-          if (( `jq '.fail | length' result.json` < 1 )); then
-            echo "No failed preflights found"
-            EXIT_STATUS=1
-          fi
-
-          exit $EXIT_STATUS
-
   validate-preflight-e2e:
     runs-on: ubuntu-latest
     needs: compile-preflight
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: replicatedhq/action-k3s@main
         id: k3s
         with:
-          version: v1.23.6-k3s1
+          version: v1.31.2-k3s1
       - name: Download preflight binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: preflight
           path: bin/
       - run: chmod +x bin/preflight
       - run: make preflight-e2e-test
 
-  run-examples:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: make run-examples
-
   compile-supportbundle:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          go-version: "1.21"
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@v4
+          go-version-file: 'go.mod'
       - run: make generate support-bundle
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: support-bundle
           path: bin/support-bundle
 
-  validate-supportbundle:
+  compile-collect:
     runs-on: ubuntu-latest
-    needs: compile-supportbundle
     steps:
-      - uses: actions/checkout@v4
-      - uses: replicatedhq/action-k3s@main
-        id: k3s
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
         with:
-          version: v1.23.6-k3s1
-      - name: Download support-bundle binary
-        uses: actions/download-artifact@v4
+          go-version-file: 'go.mod'
+      - run: make generate collect
+      - uses: actions/upload-artifact@v7
         with:
-          name: support-bundle
-          path: bin/
-      - run: chmod +x bin/support-bundle
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-collectors.yaml
-      - run: ./bin/support-bundle ./examples/support-bundle/sample-supportbundle.yaml
-      - run: ./bin/support-bundle https://kots.io
+          name: collect
+          path: bin/collect
 
   validate-supportbundle-e2e:
     runs-on: ubuntu-latest
     needs: compile-supportbundle
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: replicatedhq/action-k3s@main
         id: k3s
         with:
-          version: v1.23.6-k3s1
+          version: v1.31.2-k3s1
       - name: Download support bundle binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: support-bundle
           path: bin/
       - run: chmod +x bin/support-bundle
       - run: make support-bundle-e2e-test
 
-  validate-supportbundle-e2e-go-test:
-    runs-on: ubuntu-latest
-    needs: compile-supportbundle
-    steps:
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.21"
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@v4
+  # Additional e2e tests for support bundle that run in Go, these create a Kind cluster
+  validate-supportbundle-e2e-go:
+     runs-on: ubuntu-latest
+     needs: [compile-supportbundle, compile-collect, compile-preflight]
+     steps:
+      - uses: actions/checkout@v7
       - name: Download support bundle binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: support-bundle
           path: bin/
       - run: chmod +x bin/support-bundle
+      - name: Download preflight binary
+        uses: actions/download-artifact@v8
+        with:
+          name: preflight
+          path: bin/
+      - run: chmod +x bin/preflight
       - run: make support-bundle-e2e-go-test
 
-  compile-collect:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.21"
-      - name: setup env
-        run: |
-          echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
-          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-        shell: bash
-      - uses: actions/checkout@v4
-      - run: make generate collect
-      - uses: actions/upload-artifact@v4
-        with:
-          name: collect
-          path: bin/collect
-
-  goreleaser-test:
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v') != true
-    strategy:
-      matrix:
-        goarch: [amd64, arm64]
-        goos: [darwin, linux, windows]
-        include:
-          - goarch: arm
-            goos: linux
-          - goarch: riscv64
-            goos: linux
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.21"
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
-        with:
-          version: "v0.183.0"
-          args: build --rm-dist --snapshot --config deploy/.goreleaser.yaml --single-target
-        env:
-          GOARCH: ${{ matrix.goarch }}
-          GOOS: ${{ matrix.goos }}
-
-  goreleaser:
-    runs-on: ubuntu-latest
-    needs:
-      - validate-preflight
-      - validate-preflight-e2e
-      - validate-supportbundle
-    if: startsWith(github.ref, 'refs/tags/v')
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: azure/docker-login@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USER }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.21"
-
-      - uses: sigstore/cosign-installer@v3
-        with:
-          # DO NOT USE v2 until we decide on whether to use Rekor or not
-          cosign-release: "v1.13.1"  # Binary version to install
-
-      - name: Get Cosign Key
-        run: |
-          echo $COSIGN_KEY | base64 -d > ./cosign.key
-        env:
-          COSIGN_KEY: ${{secrets.COSIGN_KEY}}
-
-      - name: Generate SBOM
-        run: |
-          make sbom
-        env:
-          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
-          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
-        with:
-          version: "v1.x"  # Binary version to install
-          args: release --rm-dist --config deploy/.goreleaser.yaml
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Update new preflight version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.46
-        with:
-          krew_template_file: deploy/krew/preflight.yaml
-      - name: Update new support-bundle version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.46
-        with:
-          krew_template_file: deploy/krew/support-bundle.yaml
-
-
 # summary jobs, these jobs will only run if all the other jobs have succeeded
   validate-pr-tests:
     runs-on: ubuntu-latest
     needs:
-      - test
+      - tidy-check
       - test-integration
-      - run-examples
-      - compile-collect
-      - validate-preflight
       - validate-preflight-e2e
-      - validate-supportbundle
       - validate-supportbundle-e2e
-      - validate-supportbundle-e2e-go-test
-      - ensure-schemas-are-generated
+      - validate-supportbundle-e2e-go
     steps:
       - run: echo "All PR tests passed"
 
@@ -386,4 +173,4 @@ jobs:
       # if the validate-pr-tests job was successful, this job will succeed
       - name: succeed if validate-pr-tests job succeeded
         if: needs.validate-pr-tests.result == 'success'
-        run: echo "Validation succeeded"
+        run: echo "Validation succeeded"

.github/workflows/build-test.yaml

@@ -0,0 +1,299 @@
+name: build-test
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Detect changes to optimize test execution
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      go-files: ${{ steps.filter.outputs.go-files }}
+      preflight: ${{ steps.filter.outputs.preflight }}
+      support-bundle: ${{ steps.filter.outputs.support-bundle }}
+      examples: ${{ steps.filter.outputs.examples }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            go-files:
+              - '**/*.go'
+              - 'go.{mod,sum}'
+              - 'Makefile'
+            preflight:
+              - 'cmd/preflight/**'
+              - 'pkg/preflight/**'
+            support-bundle:
+              - 'cmd/troubleshoot/**'
+              - 'pkg/supportbundle/**'
+
+  # Lint
+  lint:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Check go mod tidy
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum || {
+            echo "::error::Please run 'go mod tidy' and commit changes"
+            exit 1
+          }
+
+      - name: Format and vet
+        run: |
+          make fmt
+          git diff --exit-code || {
+            echo "::error::Please run 'make fmt' and commit changes"
+            exit 1
+          }
+          make vet
+
+  # Unit and integration tests
+  test:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Run tests
+        run: make test-integration
+
+  # Build binaries
+  build:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - run: make build
+      - uses: actions/upload-artifact@v7
+        with:
+          name: binaries
+          path: bin/
+          retention-days: 1
+
+  # Minimal linux architecture smoke tests
+  linux-arch-smoke:
+    if: needs.changes.outputs.go-files == 'true'
+    needs: [changes, lint]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - goarch: amd64
+            docker_platform: linux/amd64
+            expected_machine: x86_64
+          - goarch: arm64
+            docker_platform: linux/arm64
+            expected_machine: aarch64
+          - goarch: arm
+            goarm: "7"
+            docker_platform: linux/arm/v7
+            expected_machine: armv7l
+          - goarch: riscv64
+            docker_platform: linux/riscv64
+            expected_machine: riscv64
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+      - name: Setup K3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+      - uses: docker/setup-qemu-action@v4
+        with:
+          platforms: arm64,arm,riscv64
+
+      - name: Build linux/${{ matrix.goarch }} binaries
+        env:
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+        run: |
+          if [ -n "${GOARM}" ]; then
+            echo "Building for GOARCH=${GOARCH} GOARM=${GOARM}"
+          else
+            echo "Building for GOARCH=${GOARCH}"
+          fi
+          make build
+
+      - name: Collect a minimal support bundle on ${{ matrix.docker_platform }}
+        env:
+          PREFLIGHT_AUTO_UPDATE: "false"
+          TROUBLESHOOT_AUTO_UPDATE: "false"
+        run: |
+          set -euo pipefail
+          tmpdir="$(mktemp -d)"
+          trap 'rm -rf "$tmpdir"' EXIT
+          kubeconfig_path="${KUBECONFIG:-$HOME/.kube/config}"
+
+          assert_tar_member() {
+            local pattern="$1"
+            local label="$2"
+            local member
+            member="$(grep -m1 "$pattern" "$tmpdir/archive-members.txt" || true)"
+            if [ -z "$member" ]; then
+              echo "Expected ${label} was not found in ${archive}"
+              exit 1
+            fi
+            echo "Found ${label}: ${member}"
+          }
+
+          echo "Using kubeconfig at ${kubeconfig_path}"
+          test -f "${kubeconfig_path}"
+          cp "${kubeconfig_path}" "$tmpdir/kubeconfig"
+
+          echo "Verifying K3s cluster is reachable on the host"
+          kubectl --kubeconfig "$tmpdir/kubeconfig" get nodes -o wide
+
+          docker run --rm \
+            --platform ${{ matrix.docker_platform }} \
+            --network host \
+            -v "$PWD:/src" \
+            -v "$tmpdir:/tmp/linux-arch-smoke" \
+            -w /src \
+            alpine:3.23 \
+            sh -ec '
+              export PREFLIGHT_AUTO_UPDATE=false
+              export TROUBLESHOOT_AUTO_UPDATE=false
+              /src/bin/support-bundle \
+                --kubeconfig /tmp/linux-arch-smoke/kubeconfig \
+                --interactive=false \
+                /src/test/e2e/support-bundle/spec/linuxArchSmokeLocalHostCollectors.yaml \
+                --output /tmp/linux-arch-smoke/linux-arch-support-bundle.tar.gz
+            '
+
+          archive="$tmpdir/linux-arch-support-bundle.tar.gz"
+          test -f "$archive"
+          echo "Generated support bundle archive: $archive"
+          tar -tf "$archive" > "$tmpdir/archive-members.txt"
+
+          assert_tar_member '/host-collectors/system/cpu.json$' 'cpu.json'
+          assert_tar_member '/host-collectors/system/memory.json$' 'memory.json'
+          assert_tar_member '/host-collectors/run-host/uname.txt$' 'uname.txt'
+          assert_tar_member '/cluster-resources/nodes.json$' 'cluster-resources nodes.json'
+          assert_tar_member '/cluster-resources/resources.json$' 'cluster-resources resources.json'
+          assert_tar_member '/analysis.json$' 'analysis.json'
+
+          echo "Checking uname -m output"
+          uname_path="$(grep -m1 '/host-collectors/run-host/uname.txt$' "$tmpdir/archive-members.txt")"
+          uname_machine="$(tar -xOf "$archive" "$uname_path" | tr -d '\r\n')"
+          if [ "$uname_machine" != '${{ matrix.expected_machine }}' ]; then
+            echo "Unexpected uname -m output: ${uname_machine}"
+            exit 1
+          fi
+          echo "Analyzer input check passed: uname -m reported ${uname_machine}"
+
+          echo "Checking analysis.json"
+          analysis_path="$(grep -m1 '/analysis.json$' "$tmpdir/archive-members.txt")"
+          tar -xOf "$archive" "$analysis_path" > "$tmpdir/analysis.json"
+          jq -e '
+            .[]
+            | select(.insight.primary == "Linux arch smoke node count")
+            | select(.insight.detail == "This cluster has exactly 1 node")
+            | select(.severity == "debug")
+          ' "$tmpdir/analysis.json" >/dev/null
+          echo "Found expected analyzer result: Linux arch smoke node count -> This cluster has exactly 1 node"
+
+  # E2E tests
+  e2e:
+    if: needs.changes.outputs.go-files == 'true' || github.event_name == 'push'
+    needs: [changes, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: preflight
+            target: preflight-e2e-test
+            needs-k3s: true
+          - name: support-bundle-shell
+            target: support-bundle-e2e-test
+            needs-k3s: true
+          - name: support-bundle-go
+            target: support-bundle-e2e-go-test
+            needs-k3s: false
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup K3s
+        if: matrix.needs-k3s
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - uses: actions/download-artifact@v8
+        with:
+          name: binaries
+          path: bin/
+
+      - run: chmod +x bin/*
+      - run: make ${{ matrix.target }}
+
+  # Success summary
+  success:
+    if: always()
+    needs: [lint, test, build, linux-arch-smoke, e2e]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check results
+        run: |
+          # Check if any required jobs failed
+          if [[ "${{ needs.lint.result }}" == "failure" ]] || \
+             [[ "${{ needs.test.result }}" == "failure" ]] || \
+             [[ "${{ needs.build.result }}" == "failure" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "failure" ]] || \
+             [[ "${{ needs.e2e.result }}" == "failure" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          # Check if any required jobs were cancelled  
+          if [[ "${{ needs.lint.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.test.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.build.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.linux-arch-smoke.result }}" == "cancelled" ]] || \
+             [[ "${{ needs.e2e.result }}" == "cancelled" ]]; then
+            echo "::error::Some jobs failed or were cancelled"
+            exit 1
+          fi
+          
+          echo "✅ All tests passed!"

.github/workflows/daily-scan.yaml

@@ -1,27 +0,0 @@
-name: Scan vulnerabilities
-
-on:
-  schedule:
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-jobs:
-  scan_troubleshoot_files_systems:
-    runs-on: ubuntu-20.04
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          ignore-unfixed: true
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: 'HIGH,CRITICAL'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/factory-update.yaml

@@ -0,0 +1,31 @@
+name: Publish ElasticClaw Workflow
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".factory-workflows/dependency-update.yaml"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    name: Publish workflow (${{ matrix.workflow }})
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        workflow:
+          - .factory-workflows/dependency-update.yaml
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Publish workflow (dependency-update)
+        uses: elasticclaw/actions/publish-workflow@main
+        with:
+          hub-endpoint: https://factory.repldev.com
+          token: ${{ secrets.ELASTICCLAW_TOKEN }}
+          workspace: replicated-troubleshoot
+          path: ${{ matrix.workflow }}

.github/workflows/license.yaml

@@ -1,44 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-env:
-  TRIVY_VERSION: 0.44.1
-
-name: License scan
-
-jobs:
-  license:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: 1.21
-
-      - name: Install Go deps
-        run: go mod download
-
-      - name: Install trivy
-        run: |
-          wget https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb
-          sudo dpkg -i trivy_${TRIVY_VERSION}_Linux-64bit.deb
-
-      - name: Create license report artifact
-        run: trivy fs --scanners license --skip-dirs ".github" . | tee license-report.txt
-
-      - name: Upload license report artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: license-report
-          path: license-report.txt
-
-      - name: Check for unknown licenses
-        run: trivy fs --scanners license --skip-dirs ".github" --exit-code 1 --severity UNKNOWN . || echo "::warning::Unknown licenses found, please verify"
-
-      - name: Check for forbidden licenses and fail
-        run: trivy fs --scanners license --skip-dirs ".github" --exit-code 1 --severity CRITICAL,HIGH .

.github/workflows/publish-securebuild.yml

@@ -0,0 +1,101 @@
+name: publish-securebuild
+
+env:
+  SECUREBUILD_CLI_VERSION: v0.0.498
+  SECUREBUILD_CLI_SHA256: d259aa99d85aef957fe1e40c6f26e1983cc7fd72277e08599a82adc6681d3b37
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+    secrets:
+      SECUREBUILD_API_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+
+jobs:
+  validate-version:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Require a stable release version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "SecureBuild only supports stable release versions (for example, v0.130.0): $VERSION"
+            exit 1
+          fi
+
+  build-package:
+    needs: validate-version
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Set version
+        id: version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build package
+        env:
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          ./securebuild build package \
+            --package-family-name troubleshoot \
+            --tag "$VERSION" \
+            --api-token "$SECUREBUILD_API_TOKEN"
+
+  build-image:
+    needs: build-package
+    if: ${{ !cancelled() && needs.build-package.result == 'success' }}
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        image-name:
+          - troubleshoot
+          - preflight
+    steps:
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build image
+        env:
+          IMAGE_NAME: ${{ matrix.image-name }}
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ needs.build-package.outputs.version }}
+        run: |
+          IMAGE_VERSION="${VERSION#v}"
+          MAJOR_MINOR_VERSION="${IMAGE_VERSION%.*}"
+          MAJOR_VERSION="${IMAGE_VERSION%%.*}"
+
+          ./securebuild build image \
+            --image-name "$IMAGE_NAME" \
+            --tag "$VERSION" \
+            --image-tag "$MAJOR_MINOR_VERSION" \
+            --image-tag "$MAJOR_VERSION" \
+            --image-tag latest \
+            --api-token "$SECUREBUILD_API_TOKEN"

.github/workflows/regression-test.yaml

@@ -0,0 +1,497 @@
+name: Regression Test Suite
+
+on:
+  push:
+    branches: [main, v1beta3]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      update_baselines:
+        description: 'Update baselines after run (use with caution)'
+        type: boolean
+        default: false
+
+jobs:
+  # Build binaries once (shared by all test jobs)
+  build-binaries:
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Build binaries
+        run: |
+          echo "Building preflight and support-bundle binaries..."
+          make bin/preflight bin/support-bundle
+          ./bin/preflight version
+          ./bin/support-bundle version
+
+      - name: Upload binaries
+        uses: actions/upload-artifact@v7
+        with:
+          name: binaries-${{ github.run_id }}
+          path: |
+            bin/preflight
+            bin/support-bundle
+          retention-days: 1
+
+  # Preflight v1beta3 test (parallel job 1)
+  test-preflight-v1beta3:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run preflight v1beta3
+        continue-on-error: true
+        run: |
+          echo "Running preflight v1beta3..."
+          ./bin/preflight \
+            examples/preflight/complex-v1beta3.yaml \
+            --values examples/preflight/values-complex-full.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta3.json 2>&1 | tee test/output/v1beta3.log || true
+
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta3-bundle.tar.gz
+            echo "✓ v1beta3 bundle saved"
+          fi
+
+      - name: Compare preflight v1beta3 bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta3 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta3/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta3 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta3/baseline.tar.gz \
+            --current test/output/preflight-v1beta3-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta3.json \
+            --spec-type preflight
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta3-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta3-bundle.tar.gz
+            test/output/preflight-results-v1beta3.json
+            test/output/diff-report-v1beta3.json
+            test/output/v1beta3.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Preflight v1beta2 test (parallel job 2)
+  test-preflight-v1beta2:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/preflight version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run preflight v1beta2
+        continue-on-error: true
+        run: |
+          echo "Running preflight v1beta2..."
+          ./bin/preflight \
+            examples/preflight/all-analyzers-v1beta2.yaml \
+            --interactive=false \
+            --format=json \
+            --auto-update=false \
+            --output=test/output/preflight-results-v1beta2.json 2>&1 | tee test/output/v1beta2.log || true
+
+          BUNDLE=$(ls -t preflightbundle-*.tar.gz 2>/dev/null | head -1)
+          if [ -n "$BUNDLE" ]; then
+            mv "$BUNDLE" test/output/preflight-v1beta2-bundle.tar.gz
+            echo "✓ v1beta2 bundle saved"
+          fi
+
+      - name: Compare preflight v1beta2 bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing v1beta2 preflight bundle against baseline..."
+          if [ ! -f test/baselines/preflight-v1beta2/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for v1beta2 - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/preflight-v1beta2/baseline.tar.gz \
+            --current test/output/preflight-v1beta2-bundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-v1beta2.json \
+            --spec-type preflight
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-v1beta2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/preflight-v1beta2-bundle.tar.gz
+            test/output/preflight-results-v1beta2.json
+            test/output/diff-report-v1beta2.json
+            test/output/v1beta2.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Support bundle test (parallel job 3)
+  test-supportbundle:
+    needs: [build-binaries]
+    if: github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Create output directory
+        run: mkdir -p test/output
+
+      - name: Create k3s cluster
+        uses: replicatedhq/action-k3s@main
+        with:
+          version: v1.31.2-k3s1
+
+      - name: Verify cluster access
+        run: kubectl get nodes -o wide
+
+      - name: Wait for all pods to be ready
+        run: |
+          echo "Waiting for all pods to be running..."
+          kubectl get pods --all-namespaces
+          kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s || true
+          kubectl get pods --all-namespaces
+
+      - name: Download binaries
+        uses: actions/download-artifact@v8
+        with:
+          name: binaries-${{ github.run_id }}
+          path: bin/
+
+      - name: Make binaries executable
+        run: |
+          chmod +x bin/preflight bin/support-bundle
+          ./bin/support-bundle version
+
+      - name: Setup Python for comparison
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Run support bundle
+        continue-on-error: true
+        run: |
+          echo "Running support bundle..."
+          ./bin/support-bundle \
+            examples/collect/host/all-kubernetes-collectors.yaml \
+            --interactive=false \
+            --auto-update=false \
+            --output=test/output/supportbundle.tar.gz 2>&1 | tee test/output/supportbundle.log || true
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            echo "✓ Support bundle saved"
+          fi
+
+      - name: Compare support bundle
+        id: compare
+        continue-on-error: true
+        run: |
+          echo "Comparing support bundle against baseline..."
+          if [ ! -f test/baselines/supportbundle/baseline.tar.gz ]; then
+            echo "⚠ No baseline found for support bundle - skipping comparison"
+            echo "baseline_missing=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          python3 scripts/compare_bundles.py \
+            --baseline test/baselines/supportbundle/baseline.tar.gz \
+            --current test/output/supportbundle.tar.gz \
+            --rules scripts/compare_rules.yaml \
+            --report test/output/diff-report-supportbundle.json \
+            --spec-type supportbundle
+
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-supportbundle-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            test/output/supportbundle.tar.gz
+            test/output/diff-report-supportbundle.json
+            test/output/supportbundle.log
+          retention-days: 30
+
+      - name: Set job outcome
+        if: ${{ !cancelled() }}
+        run: |
+          if [ "${{ steps.compare.outcome }}" == "failure" ] && [ "${{ steps.compare.outputs.baseline_missing }}" != "true" ]; then
+            echo "comparison_failed=true" >> $GITHUB_OUTPUT
+            exit 1
+          fi
+
+  # Report results (runs after all tests complete)
+  report-results:
+    needs: [test-preflight-v1beta3, test-preflight-v1beta2, test-supportbundle]
+    if: ${{ !cancelled() && github.actor != 'dependabot[bot]' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.11'
+
+      - name: Install Python dependencies
+        run: pip install pyyaml deepdiff
+
+      - name: Download all test artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: test/output
+          pattern: test-results-*
+
+      - name: Reorganize artifacts
+        run: |
+          # Move artifacts from nested directories to test/output
+          # Use shopt to handle glob patterns that don't match
+          shopt -s nullglob
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type f -exec mv {} test/output/ \;
+            fi
+          done
+          # Clean up empty directories
+          for dir in test/output/test-results-*; do
+            if [ -d "$dir" ]; then
+              find "$dir" -type d -empty -delete || true
+            fi
+          done
+          shopt -u nullglob
+
+      - name: Generate summary report
+        run: |
+          # Handle case where no reports exist
+          shopt -s nullglob
+          REPORTS=(test/output/diff-report-*.json)
+          shopt -u nullglob
+          
+          if [ ${#REPORTS[@]} -eq 0 ]; then
+            echo "⚠ No comparison reports found - test jobs may have failed before generating reports"
+            echo "## Summary Report" >> $GITHUB_STEP_SUMMARY
+            echo "No comparison reports available. Check individual test job results." >> $GITHUB_STEP_SUMMARY
+          else
+            python3 scripts/generate_summary.py \
+              --reports test/output/diff-report-*.json \
+              --output-file $GITHUB_STEP_SUMMARY \
+              --output-console
+          fi
+
+      - name: Check for regressions
+        run: |
+          echo "Checking comparison results..."
+
+          FAILURES=0
+
+          if [ "${{ needs.test-preflight-v1beta3.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta3.result }}" == "skipped" ]; then
+              echo "❌ v1beta3 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta3 comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ needs.test-preflight-v1beta2.result }}" == "failure" ] || [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-preflight-v1beta2.result }}" == "skipped" ]; then
+              echo "❌ v1beta2 test was skipped (likely due to build failure)"
+            else
+              echo "❌ v1beta2 comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ "${{ needs.test-supportbundle.result }}" == "failure" ] || [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+            if [ "${{ needs.test-supportbundle.result }}" == "skipped" ]; then
+              echo "❌ Support bundle test was skipped (likely due to build failure)"
+            else
+              echo "❌ Support bundle comparison failed"
+            fi
+            FAILURES=$((FAILURES + 1))
+          fi
+
+          if [ $FAILURES -gt 0 ]; then
+            echo ""
+            echo "❌ $FAILURES regression(s) detected!"
+            echo "Review the comparison reports in the artifacts."
+            exit 1
+          else
+            echo "✅ All comparisons passed or skipped (no baseline)"
+          fi
+
+      - name: Update baselines
+        if: ${{ !cancelled() && github.event.inputs.update_baselines == 'true' && github.event_name == 'workflow_dispatch' }}
+        run: |
+          echo "Updating baselines with current bundles..."
+
+          # Copy new bundles as baselines
+          if [ -f test/output/preflight-v1beta3-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta3
+            cp test/output/preflight-v1beta3-bundle.tar.gz test/baselines/preflight-v1beta3/baseline.tar.gz
+            echo "✓ Updated v1beta3 baseline"
+          fi
+
+          if [ -f test/output/preflight-v1beta2-bundle.tar.gz ]; then
+            mkdir -p test/baselines/preflight-v1beta2
+            cp test/output/preflight-v1beta2-bundle.tar.gz test/baselines/preflight-v1beta2/baseline.tar.gz
+            echo "✓ Updated v1beta2 baseline"
+          fi
+
+          if [ -f test/output/supportbundle.tar.gz ]; then
+            mkdir -p test/baselines/supportbundle
+            cp test/output/supportbundle.tar.gz test/baselines/supportbundle/baseline.tar.gz
+            echo "✓ Updated support bundle baseline"
+          fi
+
+          # Create metadata file
+          cat > test/baselines/metadata.json <<EOF
+          {
+            "updated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+            "git_sha": "${{ github.sha }}",
+            "k8s_version": "v1.31.2-k3s1",
+            "workflow_run": "${{ github.run_id }}"
+          }
+          EOF
+
+          # Commit and push
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add test/baselines/
+          git commit -m "chore: update regression test baselines from run ${{ github.run_id }}"
+          git push

.github/workflows/release.yaml

@@ -0,0 +1,71 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  goreleaser:
+    runs-on: troubleshoot_release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version: '1.26'
+          check-latest: true
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.2
+        with:
+          cosign-release: 'v3.1.3'
+
+      - name: Generate and sign SBOM
+        run: make sbom
+        env:
+          COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v7
+        with:
+          version: "v2.12.3"
+          args: release --clean --config deploy/.goreleaser.yaml
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_GITHUB_TOKEN }}
+
+      - name: Update new preflight version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.51
+        with:
+          krew_template_file: deploy/krew/preflight.yaml
+
+      - name: Update new support-bundle version in krew-index
+        if: ${{ !contains(github.ref_name, '-') }}
+        uses: rajatjindal/krew-release-bot@v0.0.51
+        with:
+          krew_template_file: deploy/krew/support-bundle.yaml
+
+  securebuild:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: ./.github/workflows/publish-securebuild.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets:
+      SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+
+  notify:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: replicatedhq/reusable-workflows/.github/workflows/notify-release.yml@0432fb838fc83852b78be97a150b35991a85d56f
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      slack_webhook: ${{ secrets.RELEASE_SLACK_WEBHOOK }}

.gitignore

@@ -48,3 +48,16 @@ sbom/
 # Ignore generated support bundles
 *.tar.gz
 !testdata/supportbundle/*.tar.gz
+!test/baselines/**/baseline.tar.gz
+
+# Ignore built binaries (use / prefix to avoid catching source files)
+/troubleshoot
+/troubleshoot-test
+cmd/troubleshoot/troubleshoot
+cmd/*/troubleshoot
+/support-bundle
+/.worktrees/
+
+# IDEs
+## IntelliJ / GoLand
+/troubleshoot.iml

.golangci.yaml

@@ -1,13 +0,0 @@
-# https://golangci-lint.run/usage/configuration/#config-file
-
-run:
-  allow-parallel-runners: true
-  timeout: 30s
-
-linters:
-  enable:
-    - gocritic
-    - gocyclo
-    - gofmt
-    - gosec
-    - govet

.grype.tmpl

@@ -0,0 +1,4 @@
+NAME	INSTALLED	FIXED-IN	TYPE	VULNERABILITY	SEVERITY	EPSS	RISK	PATH
+{{- range .Matches}}
+{{.Artifact.Name}}	{{.Artifact.Version}}	{{join .Vulnerability.Fix.Versions ","}}	{{.Artifact.Type}}	{{.Vulnerability.ID}}	{{.Vulnerability.Severity}}	{{.Vulnerability.EPSS}}	{{.Vulnerability.Risk}}	{{range .Artifact.Locations}}{{.AccessPath}}{{end}}
+{{- end}}

.grype.yaml

@@ -0,0 +1,3 @@
+exclude:
+  - ./examples/**
+  - ./bin/**

AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md
+
+ALWAYS read and follow the instructions in CLAUDE.md before starting any work in this repository.

CLAUDE.md

@@ -0,0 +1,30 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Replicated Troubleshoot is a Kubernetes diagnostic framework providing two kubectl plugins: `preflight` (pre-installation cluster validation) and `support-bundle` (post-installation diagnostics with log collection, redaction, and analysis). Specs use the Kubernetes custom resource format (as a serialization convention, not installed in-cluster) and are defined by application vendors and executed by cluster operators.
+
+## Build & Test Commands
+
+```bash
+make build                        # Build bin/support-bundle and bin/preflight
+make test                         # Unit tests (includes generate, fmt, vet)
+make test RUN=TestMyFunction      # Run a single test
+make test-integration             # Integration tests (requires k8s cluster)
+make e2e                          # All e2e tests
+make generate                     # Regenerate types/clients after modifying pkg/apis/
+```
+
+## Architecture
+
+The core data flow is: **Spec loading → Collection → Redaction → Analysis → Results**. The two main workflows are orchestrated by `pkg/supportbundle/` and `pkg/preflight/`.
+
+Three API versions coexist in `pkg/apis/troubleshoot/`: v1beta1, v1beta2 (primary, all types defined here), and v1beta3 (in-progress, adds `StringOrValueFrom` for Secret/ConfigMap references, converts to v1beta2 at runtime).
+
+Collectors live in `pkg/collect/`, analyzers in `pkg/analyze/`. When adding either, follow the pattern of existing implementations and run `make generate` after modifying API types.
+
+## Code Review
+
+See [.cursor/BUGBOT.md](.cursor/BUGBOT.md) for the full review checklist covering basic checks (API breaks, pattern violations, security, test coverage) and advanced checks (cross-feature impact, CLI vs SDK consumers, documentation needs).

CODE_OF_CONDUCT.md

@@ -1,128 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement at
-oss@replicated.com.
-All complaints will be reviewed and investigated promptly and fairly.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -1,12 +1,10 @@
 # Contributing to Troubleshoot
 
-Thank you for your interest in Troubleshoot, we welcome your participation. Please familiarize yourself with our [Code of Conduct](https://github.com/replicatedhq/troubleshoot/blob/main/CODE_OF_CONDUCT.md) prior to contributing. There are a number of ways to participate in Troubleshoot as outlined below:
+Thank you for your interest in Troubleshoot, we welcome your participation. There are a number of ways to participate in Troubleshoot as outlined below:
 
 # Community
 
-For discussions about developing Troubleshoot, there's an [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot), plus IRC using [Libera](ircs://irc.libera.chat:6697/#troubleshoot) (#troubleshoot).
-
-There are [community meetings](https://calendar.google.com/calendar/u/0?cid=Y19mMGx1aGhiZGtscGllOGo5dWpicXMwNnN1a0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t) on a regular basis, with a shared calendar and [public notes](https://hackmd.io/yZbotEHdTg6TfRZBzb8Tcg)
+For discussions about developing Troubleshoot, there's an [#app-troubleshoot channel in Kubernetes Slack](https://kubernetes.slack.com/channels/app-troubleshoot).
 
 ## Issues
 
@@ -21,44 +19,15 @@ When implementing a new feature please review the [design principles](./docs/des
 
 To get started we recommend:
 
-1. Go (v1.20 or later)
-2. A Kubernetes cluster (we recommend <https://k3d.io/>. This requires Docker v20.10.5 or later)
+1. Go (v1.24 or later)
+2. For cluster-based collectors, you will need access to a Kubernetes cluster
 3. Fork and clone repo
 4. Run `make clean build` to generate binaries
-5. Run `make run-support-bundle` to generate a support bundle with the `sample-troubleshoot.yaml` in the root of the repo
+5. You can now run `./bin/preflight` and/or `./bin/support-bundle` to use the code you've been writing
 
-> Note: recent versions of Go support easy cross-compilation.  For example, to cross-compile a Linux binary from MacOS:
+> Note: to cross-compile a Linux binary from MacOS:
 > `GOOS=linux GOARCH=amd64 make clean build`
 
-6. Install [golangci-lint] linter and run `make lint` to execute additional code linters.
-
-### Build automatically on save with `watch`
-
-1. Install `npm`
-2. Run `make watch` to build binaries automatically on saving.  Note:  you may still have to run `make schemas` if you've added API changes, like a new collector or analyzer type.
-
-### Syncing to a test cluster with `watchrsync`
-
-1. Install `npm`
-2. Export `REMOTES=<user>@<ip>` so that `watchrsync` knows where to sync.
-3. Maybe run `export GOOS=linux` and `export GOARCH=amd64` so that you build Linux binaries.
-4. run `make watchrsync` to build and sync binaries automatically on saving.
-
-```
-ssh-add --apple-use-keychain ~/.ssh/google_compute_engine
-export REMOTES=ada@35.229.61.56
-export GOOS=linux
-export GOARCH=amd64
-make watchrsync
-# bin/watchrsync.js
-# make support-bundle
-# go build -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo -ldflags " -s -w -X github.com/replicatedhq/troubleshoot/pkg/version.version=`git describe --tags --dirty` -X github.com/replicatedhq/troubleshoot/pkg/version.gitSHA=`git rev-parse HEAD` -X github.com/replicatedhq/troubleshoot/pkg/version.buildTime=`date -u +"%Y-%m-%dT%H:%M:%SZ"` " -o bin/support-bundle github.com/replicatedhq/troubleshoot/cmd/troubleshoot
-# rsync bin/support-bundle ada@35.229.61.56:
-# date
-# Tue May 16 14:14:13 EDT 2023
-# synced
-```
-
 ### Testing
 
 To run the tests locally run the following:
@@ -104,42 +73,4 @@ More on profiling please visit https://go.dev/doc/diagnostics#profiling
 
 ## Contribution workflow
 
-This is a rough outline of how to prepare a contribution:
-
-- Create a fork of this repo.
-- Create a topic branch from where you want to base your work (branched from `main` is a safe choice).
-- Make commits of logical units.
-- When your changes are ready to merge, squash your history to 1 commit.
-  - For example, if you want to squash your last 3 commits and write a new commit message:
-
-      ```
-      git reset --soft HEAD~3 &&
-      git commit
-      ```
-
-  - If you want to keep the previous commit messages and concatenate them all into a new commit, you can do something like this instead:
-
-      ```
-      git reset --soft HEAD~3 &&
-      git commit --edit -m"$(git log --format=%B --reverse HEAD..HEAD@{1})"
-      ```
-
-- Push your changes to a topic branch in your fork of the repository.
-- Submit a pull request to the original repository. It will be reviewed in a timely manner.
-
-### Pull Requests
-
-A pull request should address a single issue, feature or bug. For example, lets say you've written code that fixes two issues. That's great! However, you should submit two small pull requests, one for each issue as opposed to combining them into a single larger pull request. In general the size of the pull request should be kept small in order to make it easy for a reviewer to understand, and to minimize risks from integrating many changes at the same time. For example, if you are working on a large feature you should break it into several smaller PRs by implementing the feature as changes to several packages and submitting a separate pull request for each one.  Squash commit history when preparing your PR so it merges as 1 commit.
-
-Code submitted in pull requests must be properly documented, formatted and tested in order to be approved and merged. The following guidelines describe the things a reviewer will look for when they evaluate your pull request. Here's a tip. If your reviewer doesn't understand what the code is doing, they won't approve the pull request. Strive to make code clear and well documented. If possible, request a reviewer that has some context on the PR.
-
-### Commit messages
-
-Commit messages should follow the general guidelines:
-
-- Breaking changes should be highlighted in the heading of the commit message.
-- Commits should be clear about their purpose (and a single commit per thing that changed)
-- Messages should be descriptive:
-  - First line, 50 chars or less, as a heading/title that people can find
-  - Then a paragraph explaining things
-- Consider a footer with links to which bugs they fix etc, bearing in mind that Github does some of this magic already
+We'd love to talk before you dig into a a large feature. 

Makefile

@@ -34,7 +34,8 @@ define LDFLAGS
 "
 endef
 
-BUILDFLAGS = -tags "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp" -installsuffix netgo
+BUILDTAGS = "netgo containers_image_ostree_stub exclude_graphdriver_devicemapper exclude_graphdriver_btrfs containers_image_openpgp"
+BUILDFLAGS = -tags ${BUILDTAGS} -installsuffix netgo
 BUILDPATHS = ./pkg/... ./cmd/... ./internal/...
 E2EPATHS = ./test/e2e/...
 TESTFLAGS ?= -v -coverprofile cover.out
@@ -57,8 +58,11 @@ test: generate fmt vet
 # Go tests that require a K8s instance
 # TODOLATER: merge with test, so we get unified coverage reports? it'll add 21~sec to the test job though...
 .PHONY: test-integration
-test-integration:
-	go test -v --tags "integration exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" ${BUILDPATHS}
+test-integration: generate fmt vet
+	go test -v --tags="integration exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" ${BUILDPATHS}
+
+.PHONY: e2e
+e2e: preflight-e2e-test support-bundle-e2e-test support-bundle-e2e-go-test
 
 .PHONY: preflight-e2e-test
 preflight-e2e-test:
@@ -85,7 +89,7 @@ rebuild: clean build
 # Build all binaries in parallel ( -j )
 build: tidy
 	@echo "Build cli binaries"
-	$(MAKE) -j bin/support-bundle bin/preflight bin/analyze bin/collect
+	$(MAKE) -j bin/support-bundle bin/preflight
 
 .PHONY: clean
 clean:
@@ -102,18 +106,42 @@ clean:
 tidy:
 	go mod tidy
 
-bin/support-bundle:
+# Prints  the diff of the changes that would be made by `go mod tidy`. Used in CI
+.PHONY: tidy-diff
+tidy-diff:
+	go mod tidy -diff
+
+# Only build when any of the files in SOURCES changes, or if bin/<file> is absent
+MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+SOURCES := $(shell find $(MAKEFILE_DIR) -type f \( -name "*.go" -o -name "go.mod" -o -name "go.sum" \))
+bin/support-bundle: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/support-bundle github.com/replicatedhq/troubleshoot/cmd/troubleshoot
 
-bin/preflight:
+bin/preflight: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/preflight github.com/replicatedhq/troubleshoot/cmd/preflight
 
-bin/analyze:
+bin/analyze: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/analyze github.com/replicatedhq/troubleshoot/cmd/analyze
 
-bin/collect:
+bin/collect: $(SOURCES)
 	go build ${BUILDFLAGS} ${LDFLAGS} -o bin/collect github.com/replicatedhq/troubleshoot/cmd/collect
 
+.PHONY: support-bundle
+support-bundle: bin/support-bundle
+
+.PHONY: preflight
+preflight: bin/preflight
+
+.PHONY: analyze
+analyze: bin/analyze
+
+.PHONY: collect
+collect: bin/collect
+
+build-linux: tidy
+	@echo "Build cli binaries for Linux"
+	GOOS=linux GOARCH=amd64 $(MAKE) -j bin/support-bundle bin/preflight bin/analyze bin/collect
+
 .PHONY: fmt
 fmt:
 	go fmt ${BUILDPATHS}
@@ -124,16 +152,10 @@ vet:
 
 .PHONY: generate
 generate: controller-gen client-gen
-	$(CONTROLLER_GEN) \
-		object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
-	$(CLIENT_GEN) \
-		--output-base=./../../../ \
-		--output-package=github.com/replicatedhq/troubleshoot/pkg/client \
-		--clientset-name troubleshootclientset \
-		--input-base github.com/replicatedhq/troubleshoot/pkg/apis \
-		--input troubleshoot/v1beta1 \
-		--input troubleshoot/v1beta2 \
-		-h ./hack/boilerplate.go.txt
+	$(CONTROLLER_GEN) object:headerFile=./hack/boilerplate.go.txt paths=./pkg/apis/...
+	$(CLIENT_GEN) --output-dir=. --output-pkg=github.com/replicatedhq/troubleshoot/pkg/client --clientset-name troubleshootclientset --input-base github.com/replicatedhq/troubleshoot/pkg/apis --input troubleshoot/v1beta1 --input troubleshoot/v1beta2 --input troubleshoot/v1beta3 --go-header-file ./hack/boilerplate.go.txt
+	cp -r troubleshootclientset pkg/client
+	rm -rf troubleshootclientset
 
 .PHONY: openapischema
 openapischema: controller-gen
@@ -141,14 +163,14 @@ openapischema: controller-gen
 	controller-gen crd +output:dir=./config/crds  paths=./pkg/apis/troubleshoot/v1beta2
 
 check-schemas: generate schemas
-	@if [ -n "$(shell git status --short)" ]; then \
+	@if [ -n "$$(git status --short)" ]; then \
     	echo -e "\033[31mThe git repo is dirty :( Ensure all generated files are committed e.g CRD schema files\033[0;m"; \
     	git status --short; \
     	exit 1; \
 	fi
 
 .PHONY: schemas
-schemas: fmt vet openapischema bin/schemagen
+schemas: openapischema bin/schemagen
 	./bin/schemagen --output-dir ./schemas
 
 bin/schemagen:
@@ -162,33 +184,19 @@ bin/docsgen:
 	go build ${LDFLAGS} -o bin/docsgen github.com/replicatedhq/troubleshoot/cmd/docsgen
 
 controller-gen:
-	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.14.0
-CONTROLLER_GEN=$(shell which controller-gen)
+	go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0
+CONTROLLER_GEN=$(shell go env GOPATH)/bin/controller-gen
 
 .PHONY: client-gen
 client-gen:
-	go install k8s.io/code-generator/cmd/client-gen@v0.28.8
-CLIENT_GEN=$(shell which client-gen)
+	go install k8s.io/code-generator/cmd/client-gen@v0.34.0
+CLIENT_GEN=$(shell go env GOPATH)/bin/client-gen
 
 .PHONY: release
 release: export GITHUB_TOKEN = $(shell echo ${GITHUB_TOKEN_TROUBLESHOOT})
 release:
 	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --config deploy/.goreleaser.yml
 
-.PHONY: snapshot-release
-snapshot-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.snapshot.yml
-	docker push replicated/troubleshoot:alpha
-	docker push replicated/preflight:alpha
-
-.PHONY: local-release
-local-release:
-	curl -sL https://git.io/goreleaser | bash -s -- --rm-dist --snapshot --config deploy/.goreleaser.yaml
-	docker tag replicated/troubleshoot:alpha localhost:32000/troubleshoot:alpha
-	docker tag replicated/preflight:alpha localhost:32000/preflight:alpha
-	docker push localhost:32000/troubleshoot:alpha
-	docker push localhost:32000/preflight:alpha
-
 .PHONY: run-preflight
 run-preflight: bin/preflight
 	./bin/preflight ./examples/preflight/sample-preflight.yaml
@@ -219,25 +227,28 @@ sbom/assets/troubleshoot-sbom.tgz: generate-sbom
 	tar -czf sbom/assets/troubleshoot-sbom.tgz sbom/spdx/*.spdx
 
 sbom: sbom/assets/troubleshoot-sbom.tgz
-	cosign sign-blob -key cosign.key sbom/assets/troubleshoot-sbom.tgz > sbom/assets/troubleshoot-sbom.tgz.sig
-	cosign public-key -key cosign.key -outfile sbom/assets/key.pub
+	cosign sign-blob \
+		--key ./cosign.key \
+		--tlog-upload \
+		--yes \
+		--rekor-url=https://rekor.sigstore.dev \
+		--bundle sbom/assets/troubleshoot-sbom.tgz.bundle \
+		sbom/assets/troubleshoot-sbom.tgz
+	cosign public-key --key cosign.key --outfile sbom/assets/key.pub
+
+.PHONY: get-govulncheck
+get-govulncheck:
+	@command -v govulncheck >/dev/null 2>&1 || go install golang.org/x/vuln/cmd/govulncheck@latest
+
+.PHONY: get-grype
+get-grype:
+	@command -v grype >/dev/null 2>&1 || curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b $(GOPATH)/bin
 
 .PHONY: scan
-scan:
-	trivy fs \
-		--scanners vuln \
-		--exit-code=1 \
-		--severity="HIGH,CRITICAL" \
-		--ignore-unfixed \
-		./
-
-.PHONY: lint
-lint:
-	golangci-lint run --new -c .golangci.yaml ${BUILDPATHS}
-
-.PHONY: lint-and-fix
-lint-and-fix:
-	golangci-lint run --new --fix -c .golangci.yaml ${BUILDPATHS}
+scan: get-govulncheck get-grype
+	govulncheck ./...
+	grype db update
+	grype dir:. --only-fixed --fail-on high -o template -t .grype.tmpl
 
 .PHONY: watch
 watch: npm-install
@@ -256,18 +267,6 @@ npm-install:
 
 ######## Lagacy make targets ###########
 # Deprecated: These can be removed
-.PHONY: support-bundle
-support-bundle: clean bin/support-bundle
-
-.PHONY: preflight
-preflight: clean bin/preflight
-
-.PHONY: analyze
-analyze: clean bin/analyze
-
-.PHONY: collect
-collect: clean bin/collect
-
 .PHONY: run-troubleshoot
 run-troubleshoot: run-support-bundle
 

README.md

@@ -56,19 +56,12 @@ For questions about using Troubleshoot, how to contribute and engaging with the
 # Software Bill of Materials
 A signed SBOM  that includes Troubleshoot dependencies is included in each release.
 - **troubleshoot-sbom.tgz** contains a software bill of materials for Troubleshoot.
-- **troubleshoot-sbom.tgz.sig** is the digital signature for troubleshoot-sbom.tgz
+- **troubleshoot-sbom.tgz.bundle** contains the signature and transparency log material used by Cosign.
 - **key.pub** is the public key from the key pair used to sign troubleshoot-sbom.tgz
 
 The following example illustrates using [cosign](https://github.com/sigstore/cosign) to verify that **troubleshoot-sbom.tgz** has
-not been tampered with.
+not been tampered with. Install [Cosign v3](https://github.com/sigstore/cosign/releases).
 ```sh
-$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz
-Verified OK
-```
-
-If you were to get an error similar to the one below, it means you are verifying an SBOM signed using cosign `v1` using a newer `v2` of the binary. This version introduced [breaking changes](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md#breaking-changes) which require an additional flag `--insecure-ignore-tlog=true` to successfully verify SBOMs like so.
-```sh
-$ cosign verify-blob --key key.pub --signature troubleshoot-sbom.tgz.sig troubleshoot-sbom.tgz --insecure-ignore-tlog=true
-WARNING: Skipping tlog verification is an insecure practice that lacks of transparency and auditability verification for the blob.
+$ cosign verify-blob --key key.pub --bundle troubleshoot-sbom.tgz.bundle troubleshoot-sbom.tgz
 Verified OK
 ```

bin/watch.js

@@ -1,29 +0,0 @@
-#!/usr/bin/env node
-
-const gri = require('gaze-run-interrupt');
-
-const commands = [
-  // {
-  //   command: 'rm',
-  //   args: binList,
-  // },
-  {
-    command: 'make',
-    args: ['build'],
-  },
-];
-
-commands.push({
-  command: "date",
-  args: [],
-});
-
-commands.push({
-  command: "echo",
-  args: ["synced"],
-});
-
-gri([
-  'cmd/**/*.go',
-  'pkg/**/*.go',
-], commands);

bin/watchrsync.js

@@ -1,51 +0,0 @@
-#!/usr/bin/env node
-
-const gri = require('gaze-run-interrupt');
-
-if (!process.env.REMOTES) {
-  console.log("Usage: `REMOTES='user@h1.1.1.1,user@1.1.1.2' ./watchrsync.js`");
-  process.exit(1);
-}
-
-process.env.GOOS = 'linux';
-process.env.GOARCH = 'amd64';
-
-const binList = [
-  // 'bin/analyze',
-  // 'bin/preflight',
-  'bin/support-bundle',
-  // 'bin/collect'
-]
-
-const commands = [
-  // {
-  //   command: 'rm',
-  //   args: binList,
-  // },
-  {
-    command: 'make',
-    args: ['build'],
-  },
-];
-
-process.env.REMOTES.split(",").forEach(function (remote) {
-  commands.push({
-    command: 'rsync',
-    args: binList.concat(`${remote}:`),
-  });
-});
-
-commands.push({
-  command: "date",
-  args: [],
-});
-
-commands.push({
-  command: "echo",
-  args: ["synced"],
-});
-
-gri([
-  'cmd/**/*.go',
-  'pkg/**/*.go',
-], commands);

cmd/analyze/cli/root.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
@@ -12,10 +13,26 @@ import (
 	"k8s.io/klog/v2"
 )
 
+// validateArgs allows certain flags to run without requiring bundle arguments
+func validateArgs(cmd *cobra.Command, args []string) error {
+	// Special flags that don't require bundle arguments
+	if cmd.Flags().Changed("check-ollama") || cmd.Flags().Changed("setup-ollama") ||
+		cmd.Flags().Changed("list-models") || cmd.Flags().Changed("pull-model") {
+		return nil
+	}
+
+	// For all other cases, require at least 1 argument (the bundle path)
+	if len(args) < 1 {
+		return fmt.Errorf("requires at least 1 arg(s), only received %d. Usage: analyze [bundle-path] or use --check-ollama/--setup-ollama", len(args))
+	}
+
+	return nil
+}
+
 func RootCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:          "analyze [url]",
-		Args:         cobra.MinimumNArgs(1),
+		Args:         validateArgs,
 		Short:        "Analyze a support bundle",
 		Long:         `Run a series of analyzers on a support bundle archive`,
 		SilenceUsage: true,
@@ -32,7 +49,13 @@ func RootCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
-			return runAnalyzers(v, args[0])
+			// Handle cases where no bundle argument is provided (for utility flags)
+			var bundlePath string
+			if len(args) > 0 {
+				bundlePath = args[0]
+			}
+
+			return runAnalyzers(v, bundlePath)
 		},
 		PostRun: func(cmd *cobra.Command, args []string) {
 			if err := util.StopProfiling(); err != nil {
@@ -48,6 +71,23 @@ func RootCmd() *cobra.Command {
 	cmd.Flags().String("analyzers", "", "filename or url of the analyzers to use")
 	cmd.Flags().Bool("debug", false, "enable debug logging")
 
+	// Advanced analysis flags
+	cmd.Flags().Bool("advanced-analysis", false, "use advanced analysis engine with AI capabilities")
+	cmd.Flags().StringSlice("agents", []string{"local"}, "analysis agents to use: local, hosted, ollama")
+	cmd.Flags().Bool("enable-ollama", false, "enable Ollama AI-powered analysis")
+	cmd.Flags().Bool("disable-ollama", false, "explicitly disable Ollama AI-powered analysis")
+	cmd.Flags().String("ollama-endpoint", "http://localhost:11434", "Ollama server endpoint")
+	cmd.Flags().String("ollama-model", "llama2:7b", "Ollama model to use for analysis")
+	cmd.Flags().Bool("use-codellama", false, "use CodeLlama model for code-focused analysis")
+	cmd.Flags().Bool("use-mistral", false, "use Mistral model for fast analysis")
+	cmd.Flags().Bool("auto-pull-model", true, "automatically pull model if not available")
+	cmd.Flags().Bool("list-models", false, "list all available/installed Ollama models and exit")
+	cmd.Flags().Bool("pull-model", false, "pull the specified model and exit")
+	cmd.Flags().Bool("setup-ollama", false, "automatically setup and configure Ollama")
+	cmd.Flags().Bool("check-ollama", false, "check Ollama installation status and exit")
+	cmd.Flags().Bool("include-remediation", true, "include remediation suggestions in analysis results")
+	cmd.Flags().String("output-file", "", "save analysis results to file (e.g., --output-file results.json)")
+
 	viper.BindPFlags(cmd.Flags())
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))

cmd/analyze/cli/run.go

@@ -1,18 +1,408 @@
 package cli
 
 import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
 
 	"github.com/pkg/errors"
 	"github.com/replicatedhq/troubleshoot/internal/util"
 	analyzer "github.com/replicatedhq/troubleshoot/pkg/analyze"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/local"
+	"github.com/replicatedhq/troubleshoot/pkg/analyze/agents/ollama"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
 	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+	"sigs.k8s.io/yaml"
 )
 
 func runAnalyzers(v *viper.Viper, bundlePath string) error {
+	// Handle Ollama-specific commands first (these don't require a bundle)
+	if v.GetBool("setup-ollama") {
+		return handleOllamaSetup(v)
+	}
+
+	if v.GetBool("check-ollama") {
+		return handleOllamaStatus(v)
+	}
+
+	if v.GetBool("list-models") {
+		return handleListModels(v)
+	}
+
+	if v.GetBool("pull-model") {
+		return handlePullModel(v)
+	}
+
+	// For all other operations, we need a bundle path
+	if bundlePath == "" {
+		return errors.New("bundle path is required for analysis operations")
+	}
+
+	// Check if advanced analysis is requested
+	useAdvanced := v.GetBool("advanced-analysis") ||
+		v.GetBool("enable-ollama") ||
+		(len(v.GetStringSlice("agents")) > 1 ||
+			(len(v.GetStringSlice("agents")) == 1 && v.GetStringSlice("agents")[0] != "local"))
+
+	if useAdvanced {
+		return runAdvancedAnalysis(v, bundlePath)
+	}
+
+	// Only fall back to legacy analysis if no advanced flags are used at all
+	return runLegacyAnalysis(v, bundlePath)
+}
+
+// handleOllamaSetup automatically sets up Ollama for the user
+func handleOllamaSetup(v *viper.Viper) error {
+	fmt.Println("🚀 Ollama Setup Assistant")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	helper := analyzer.NewOllamaHelper()
+
+	// Check current status
+	status := helper.GetHealthStatus()
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Installing Ollama...")
+		if err := helper.DownloadAndInstall(); err != nil {
+			return errors.Wrap(err, "failed to install Ollama")
+		}
+		fmt.Println("✅ Ollama installed successfully!")
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 Starting Ollama service...")
+		if err := helper.StartService(); err != nil {
+			return errors.Wrap(err, "failed to start Ollama service")
+		}
+		fmt.Println("✅ Ollama service started!")
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 Downloading recommended model...")
+		helper.PrintModelRecommendations()
+
+		model := v.GetString("ollama-model")
+		if model == "" {
+			model = "llama2:7b"
+		}
+
+		fmt.Printf("\n⬇️  Pulling model: %s (this may take several minutes)...\n", model)
+		if err := helper.PullModel(model); err != nil {
+			return errors.Wrapf(err, "failed to pull model %s", model)
+		}
+	}
+
+	fmt.Println("\n🎉 Ollama setup complete!")
+	fmt.Println("\n💡 Next steps:")
+	fmt.Printf("   troubleshoot analyze --enable-ollama %s\n", filepath.Base(os.Args[len(os.Args)-1]))
+
+	return nil
+}
+
+// handleOllamaStatus shows current Ollama installation and service status
+func handleOllamaStatus(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🔍 Ollama Status Report")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Print(status.String())
+
+	if !status.Installed {
+		fmt.Println("\n🔧 Setup Instructions:")
+		fmt.Println(helper.GetInstallInstructions())
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("\n🚀 To start Ollama service:")
+		fmt.Println("   ollama serve &")
+		fmt.Println("   # or")
+		fmt.Println("   troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if len(status.Models) == 0 {
+		fmt.Println("\n📚 No models installed. Recommended models:")
+		helper.PrintModelRecommendations()
+	} else {
+		fmt.Println("\n✅ Ready for AI-powered analysis!")
+		fmt.Printf("   troubleshoot analyze --enable-ollama your-bundle.tar.gz\n")
+	}
+
+	return nil
+}
+
+// handleListModels lists available and installed Ollama models
+func handleListModels(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	fmt.Println("🤖 Ollama Model Management")
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return nil
+	}
+
+	if !status.Running {
+		fmt.Println("⚠️  Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return nil
+	}
+
+	// Show installed models
+	fmt.Println("📚 Installed Models:")
+	if len(status.Models) == 0 {
+		fmt.Println("   No models installed")
+	} else {
+		for _, model := range status.Models {
+			fmt.Printf("   ✅ %s\n", model)
+		}
+	}
+
+	// Show available models for download
+	fmt.Println("\n🌐 Available Models:")
+	helper.PrintModelRecommendations()
+
+	// Show usage examples
+	fmt.Println("💡 Usage Examples:")
+	fmt.Println("   # Use specific model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b bundle.tar.gz\n")
+	fmt.Println("   # Use preset models:")
+	fmt.Printf("   troubleshoot analyze --use-codellama bundle.tar.gz\n")
+	fmt.Printf("   troubleshoot analyze --use-mistral bundle.tar.gz\n")
+	fmt.Println("   # Pull a new model:")
+	fmt.Printf("   troubleshoot analyze --ollama-model llama2:13b --pull-model\n")
+
+	return nil
+}
+
+// handlePullModel pulls a specific model
+func handlePullModel(v *viper.Viper) error {
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		fmt.Println("❌ Ollama is not installed")
+		fmt.Println("💡 Install with: troubleshoot analyze --setup-ollama")
+		return errors.New("Ollama must be installed to pull models")
+	}
+
+	if !status.Running {
+		fmt.Println("❌ Ollama service is not running")
+		fmt.Println("🚀 Start with: ollama serve &")
+		return errors.New("Ollama service must be running to pull models")
+	}
+
+	// Determine which model to pull
+	model := determineOllamaModel(v)
+
+	fmt.Printf("📥 Pulling model: %s\n", model)
+	fmt.Println("=" + strings.Repeat("=", 50))
+
+	if err := helper.PullModel(model); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("\n✅ Model %s ready for analysis!\n", model)
+	fmt.Println("\n💡 Test it with:")
+	fmt.Printf("   troubleshoot analyze --ollama-model %s bundle.tar.gz\n", model)
+
+	return nil
+}
+
+// runAdvancedAnalysis uses the new analysis engine with agent support
+func runAdvancedAnalysis(v *viper.Viper, bundlePath string) error {
+	ctx := context.Background()
+
+	// Create the analysis engine
+	engine := analyzer.NewAnalysisEngine()
+
+	// Determine which agents to use
+	agents := v.GetStringSlice("agents")
+
+	// Handle Ollama flags
+	enableOllama := v.GetBool("enable-ollama")
+	disableOllama := v.GetBool("disable-ollama")
+
+	if enableOllama && !disableOllama {
+		// Add ollama to agents if not already present
+		hasOllama := false
+		for _, agent := range agents {
+			if agent == "ollama" {
+				hasOllama = true
+				break
+			}
+		}
+		if !hasOllama {
+			agents = append(agents, "ollama")
+		}
+	}
+
+	if disableOllama {
+		// Remove ollama from agents
+		filteredAgents := []string{}
+		for _, agent := range agents {
+			if agent != "ollama" {
+				filteredAgents = append(filteredAgents, agent)
+			}
+		}
+		agents = filteredAgents
+	}
+
+	// Register requested agents
+	registeredAgents := []string{}
+	for _, agentName := range agents {
+		switch agentName {
+		case "ollama":
+			if err := registerOllamaAgent(engine, v); err != nil {
+				return err
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		case "local":
+			opts := &local.LocalAgentOptions{}
+			agent := local.NewLocalAgent(opts)
+			if err := engine.RegisterAgent("local", agent); err != nil {
+				return errors.Wrap(err, "failed to register local agent")
+			}
+			registeredAgents = append(registeredAgents, agentName)
+
+		default:
+			klog.Warningf("Unknown agent type: %s", agentName)
+		}
+	}
+
+	if len(registeredAgents) == 0 {
+		return errors.New("no analysis agents available - check your configuration")
+	}
+
+	fmt.Printf("🔍 Using analysis agents: %s\n", strings.Join(registeredAgents, ", "))
+
+	// Load support bundle
+	bundle, err := loadSupportBundle(bundlePath)
+	if err != nil {
+		return errors.Wrap(err, "failed to load support bundle")
+	}
+
+	// Load analyzer specs if provided
+	var customAnalyzers []*troubleshootv1beta2.Analyze
+	if specPath := v.GetString("analyzers"); specPath != "" {
+		customAnalyzers, err = loadAnalyzerSpecs(specPath)
+		if err != nil {
+			return errors.Wrap(err, "failed to load analyzer specs")
+		}
+	}
+
+	// Configure analysis options
+	opts := analyzer.AnalysisOptions{
+		Agents:             registeredAgents,
+		IncludeRemediation: v.GetBool("include-remediation"),
+		CustomAnalyzers:    customAnalyzers,
+		Timeout:            5 * time.Minute,
+		Concurrency:        2,
+	}
+
+	// Run analysis
+	fmt.Printf("🚀 Starting advanced analysis of bundle: %s\n", bundlePath)
+	result, err := engine.Analyze(ctx, bundle, opts)
+	if err != nil {
+		return errors.Wrap(err, "analysis failed")
+	}
+
+	// Display results
+	return displayAdvancedResults(result, v.GetString("output"), v.GetString("output-file"))
+}
+
+// registerOllamaAgent creates and registers an Ollama agent
+func registerOllamaAgent(engine analyzer.AnalysisEngine, v *viper.Viper) error {
+	// Check if Ollama is available
+	helper := analyzer.NewOllamaHelper()
+	status := helper.GetHealthStatus()
+
+	if !status.Installed {
+		return showOllamaSetupHelp("Ollama is not installed")
+	}
+
+	if !status.Running {
+		return showOllamaSetupHelp("Ollama service is not running")
+	}
+
+	if len(status.Models) == 0 {
+		return showOllamaSetupHelp("No Ollama models are installed")
+	}
+
+	// Determine which model to use
+	selectedModel := determineOllamaModel(v)
+
+	// Auto-pull model if requested and not available
+	if v.GetBool("auto-pull-model") {
+		if err := ensureModelAvailable(selectedModel); err != nil {
+			return errors.Wrapf(err, "failed to ensure model %s is available", selectedModel)
+		}
+	}
+
+	// Create Ollama agent
+	opts := &ollama.OllamaAgentOptions{
+		Endpoint:    v.GetString("ollama-endpoint"),
+		Model:       selectedModel,
+		Timeout:     5 * time.Minute,
+		MaxTokens:   2000,
+		Temperature: 0.2,
+	}
+
+	agent, err := ollama.NewOllamaAgent(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to create Ollama agent")
+	}
+
+	// Register with engine
+	if err := engine.RegisterAgent("ollama", agent); err != nil {
+		return errors.Wrap(err, "failed to register Ollama agent")
+	}
+
+	return nil
+}
+
+// showOllamaSetupHelp displays helpful setup instructions when Ollama is not available
+func showOllamaSetupHelp(reason string) error {
+	fmt.Printf("❌ Ollama AI analysis not available: %s\n\n", reason)
+
+	helper := analyzer.NewOllamaHelper()
+	fmt.Println("🔧 Quick Setup:")
+	fmt.Println("   troubleshoot analyze --setup-ollama")
+	fmt.Println()
+	fmt.Println("📋 Manual Setup:")
+	fmt.Println("   1. Install: curl -fsSL https://ollama.ai/install.sh | sh")
+	fmt.Println("   2. Start service: ollama serve &")
+	fmt.Println("   3. Pull model: ollama pull llama2:7b")
+	fmt.Println("   4. Retry analysis with: --enable-ollama")
+	fmt.Println()
+	fmt.Println("💡 Check status: troubleshoot analyze --check-ollama")
+	fmt.Println()
+	fmt.Println(helper.GetInstallInstructions())
+
+	return errors.New("Ollama setup required for AI-powered analysis")
+}
+
+// runLegacyAnalysis runs the original analysis logic for backward compatibility
+func runLegacyAnalysis(v *viper.Viper, bundlePath string) error {
 	specPath := v.GetString("analyzers")
 
 	specContent := ""
@@ -66,3 +456,302 @@ func runAnalyzers(v *viper.Viper, bundlePath string) error {
 
 	return nil
 }
+
+// loadSupportBundle loads and parses a support bundle from file
+func loadSupportBundle(bundlePath string) (*analyzer.SupportBundle, error) {
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return nil, errors.Errorf("support bundle not found: %s", bundlePath)
+	}
+
+	klog.Infof("Loading support bundle: %s", bundlePath)
+
+	// Open the tar.gz file
+	file, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open support bundle")
+	}
+	defer file.Close()
+
+	// Create gzip reader
+	gzipReader, err := gzip.NewReader(file)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gzipReader.Close()
+
+	// Create tar reader
+	tarReader := tar.NewReader(gzipReader)
+
+	// Create bundle structure
+	bundle := &analyzer.SupportBundle{
+		Files: make(map[string][]byte),
+		Metadata: &analyzer.SupportBundleMetadata{
+			CreatedAt:   time.Now(),
+			Version:     "1.0.0",
+			GeneratedBy: "troubleshoot-cli",
+		},
+	}
+
+	// Extract all files from tar
+	for {
+		header, err := tarReader.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+
+		// Skip directories
+		if header.Typeflag == tar.TypeDir {
+			continue
+		}
+
+		// Read file content
+		content, err := io.ReadAll(tarReader)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to read file %s", header.Name)
+		}
+
+		// Remove bundle directory prefix from file path for consistent access
+		// e.g., "live-cluster-bundle/cluster-info/version.json" → "cluster-info/version.json"
+		cleanPath := header.Name
+		if parts := strings.SplitN(header.Name, "/", 2); len(parts) == 2 {
+			cleanPath = parts[1]
+		}
+
+		bundle.Files[cleanPath] = content
+		klog.V(2).Infof("Loaded file: %s (%d bytes)", cleanPath, len(content))
+	}
+
+	klog.Infof("Successfully loaded support bundle with %d files", len(bundle.Files))
+
+	return bundle, nil
+}
+
+// loadAnalyzerSpecs loads analyzer specifications from file or URL
+func loadAnalyzerSpecs(specPath string) ([]*troubleshootv1beta2.Analyze, error) {
+	klog.Infof("Loading analyzer specs from: %s", specPath)
+
+	// Read the analyzer spec file (same logic as runLegacyAnalysis)
+	specContent := ""
+	var err error
+	if _, err = os.Stat(specPath); err == nil {
+		b, err := os.ReadFile(specPath)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec file")
+		}
+		specContent = string(b)
+	} else {
+		if !util.IsURL(specPath) {
+			return nil, errors.Errorf("analyzer spec %s is not a URL and was not found", specPath)
+		}
+
+		req, err := http.NewRequest("GET", specPath, nil)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to create HTTP request")
+		}
+		req.Header.Set("User-Agent", "Replicated_Analyzer/v1beta2")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to fetch analyzer spec")
+		}
+		defer resp.Body.Close()
+
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read analyzer spec response")
+		}
+		specContent = string(body)
+	}
+
+	// Parse the YAML/JSON into troubleshoot analyzer struct
+	var analyzerSpec troubleshootv1beta2.Analyzer
+	if err := yaml.Unmarshal([]byte(specContent), &analyzerSpec); err != nil {
+		return nil, errors.Wrap(err, "failed to parse analyzer spec")
+	}
+
+	// Return the analyzer specs from the parsed document
+	return analyzerSpec.Spec.Analyzers, nil
+}
+
+// displayAdvancedResults formats and displays analysis results
+func displayAdvancedResults(result *analyzer.AnalysisResult, outputFormat, outputFile string) error {
+	if result == nil {
+		return errors.New("no analysis results to display")
+	}
+
+	// Display summary
+	fmt.Println("\n📊 Analysis Summary")
+	fmt.Println("=" + strings.Repeat("=", 50))
+	fmt.Printf("Total Analyzers: %d\n", result.Summary.TotalAnalyzers)
+	fmt.Printf("✅ Pass: %d\n", result.Summary.PassCount)
+	fmt.Printf("⚠️  Warn: %d\n", result.Summary.WarnCount)
+	fmt.Printf("❌ Fail: %d\n", result.Summary.FailCount)
+	fmt.Printf("🚫 Errors: %d\n", result.Summary.ErrorCount)
+	fmt.Printf("⏱️  Duration: %s\n", result.Summary.Duration)
+	fmt.Printf("🤖 Agents Used: %s\n", strings.Join(result.Summary.AgentsUsed, ", "))
+
+	if result.Summary.Confidence > 0 {
+		fmt.Printf("🎯 Confidence: %.1f%%\n", result.Summary.Confidence*100)
+	}
+
+	// Display results based on format
+	switch outputFormat {
+	case "json":
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results to JSON")
+		}
+		fmt.Println("\n📄 Full Results (JSON):")
+		fmt.Println(string(jsonData))
+
+	default:
+		// Human-readable format
+		fmt.Println("\n🔍 Analysis Results")
+		fmt.Println("=" + strings.Repeat("=", 50))
+
+		for _, analyzerResult := range result.Results {
+			status := "❓"
+			if analyzerResult.IsPass {
+				status = "✅"
+			} else if analyzerResult.IsWarn {
+				status = "⚠️"
+			} else if analyzerResult.IsFail {
+				status = "❌"
+			}
+
+			fmt.Printf("\n%s %s", status, analyzerResult.Title)
+			if analyzerResult.AgentName != "" {
+				fmt.Printf(" [%s]", analyzerResult.AgentName)
+			}
+			if analyzerResult.Confidence > 0 {
+				fmt.Printf(" (%.0f%% confidence)", analyzerResult.Confidence*100)
+			}
+			fmt.Println()
+
+			if analyzerResult.Message != "" {
+				fmt.Printf("   %s\n", analyzerResult.Message)
+			}
+
+			if analyzerResult.Category != "" {
+				fmt.Printf("   Category: %s\n", analyzerResult.Category)
+			}
+
+			// Display insights if available
+			if len(analyzerResult.Insights) > 0 {
+				fmt.Println("   💡 Insights:")
+				for _, insight := range analyzerResult.Insights {
+					fmt.Printf("   • %s\n", insight)
+				}
+			}
+
+			// Display remediation if available
+			if analyzerResult.Remediation != nil {
+				fmt.Printf("   🔧 Remediation: %s\n", analyzerResult.Remediation.Description)
+				if analyzerResult.Remediation.Command != "" {
+					fmt.Printf("   💻 Command: %s\n", analyzerResult.Remediation.Command)
+				}
+			}
+		}
+
+		// Display overall remediation suggestions
+		if len(result.Remediation) > 0 {
+			fmt.Println("\n🔧 Recommended Actions")
+			fmt.Println("=" + strings.Repeat("=", 50))
+			for i, remedy := range result.Remediation {
+				fmt.Printf("%d. %s\n", i+1, remedy.Description)
+				if remedy.Command != "" {
+					fmt.Printf("   Command: %s\n", remedy.Command)
+				}
+				if remedy.Documentation != "" {
+					fmt.Printf("   Docs: %s\n", remedy.Documentation)
+				}
+			}
+		}
+
+		// Display errors if any
+		if len(result.Errors) > 0 {
+			fmt.Println("\n⚠️  Errors During Analysis")
+			fmt.Println("=" + strings.Repeat("=", 30))
+			for _, analysisError := range result.Errors {
+				fmt.Printf("• [%s] %s: %s\n", analysisError.Agent, analysisError.Category, analysisError.Error)
+			}
+		}
+
+		// Display agent metadata
+		if len(result.Metadata.Agents) > 0 {
+			fmt.Println("\n🤖 Agent Performance")
+			fmt.Println("=" + strings.Repeat("=", 40))
+			for _, agent := range result.Metadata.Agents {
+				fmt.Printf("• %s: %d results, %s duration", agent.Name, agent.ResultCount, agent.Duration)
+				if agent.ErrorCount > 0 {
+					fmt.Printf(" (%d errors)", agent.ErrorCount)
+				}
+				fmt.Println()
+			}
+		}
+	}
+
+	// Save results to file if requested
+	if outputFile != "" {
+		jsonData, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal results for file output")
+		}
+
+		if err := os.WriteFile(outputFile, jsonData, 0644); err != nil {
+			return errors.Wrapf(err, "failed to write results to %s", outputFile)
+		}
+
+		fmt.Printf("\n💾 Analysis results saved to: %s\n", outputFile)
+	}
+
+	return nil
+}
+
+// determineOllamaModel selects the appropriate model based on flags
+func determineOllamaModel(v *viper.Viper) string {
+	// Check for specific model flags first
+	if v.GetBool("use-codellama") {
+		return "codellama:7b"
+	}
+	if v.GetBool("use-mistral") {
+		return "mistral:7b"
+	}
+
+	// Fall back to explicit model specification or default
+	return v.GetString("ollama-model")
+}
+
+// ensureModelAvailable checks if model exists and pulls it if needed
+func ensureModelAvailable(model string) error {
+	// Check if model is already available
+	cmd := exec.Command("ollama", "list")
+	output, err := cmd.Output()
+	if err != nil {
+		return errors.Wrap(err, "failed to check available models")
+	}
+
+	// Parse model list to see if our model exists
+	lines := strings.Split(string(output), "\n")
+	for _, line := range lines {
+		if strings.Contains(line, model) {
+			klog.Infof("Model %s is already available", model)
+			return nil
+		}
+	}
+
+	// Model not found, pull it
+	fmt.Printf("📚 Model %s not found, pulling automatically...\n", model)
+	pullCmd := exec.Command("ollama", "pull", model)
+	pullCmd.Stdout = os.Stdout
+	pullCmd.Stderr = os.Stderr
+
+	if err := pullCmd.Run(); err != nil {
+		return errors.Wrapf(err, "failed to pull model %s", model)
+	}
+
+	fmt.Printf("✅ Model %s pulled successfully!\n", model)
+	return nil
+}

cmd/analyze/main.go

@@ -1,10 +1,13 @@
 package main
 
 import (
-	"github.com/replicatedhq/troubleshoot/cmd/analyze/cli"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
+	"os"
+
+	analyzecli "github.com/replicatedhq/troubleshoot/cmd/analyze/cli"
 )
 
 func main() {
-	cli.InitAndExecute()
+	if err := analyzecli.RootCmd().Execute(); err != nil {
+		os.Exit(1)
+	}
 }

cmd/collect/cli/chroot_darwin.go

@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}

cmd/collect/cli/chroot_linux.go

@@ -0,0 +1,21 @@
+package cli
+
+import (
+	"errors"
+	"syscall"
+
+	"github.com/replicatedhq/troubleshoot/internal/util"
+)
+
+func checkAndSetChroot(newroot string) error {
+	if newroot == "" {
+		return nil
+	}
+	if !util.IsRunningAsRoot() {
+		return errors.New("Can only chroot when run as root")
+	}
+	if err := syscall.Chroot(newroot); err != nil {
+		return err
+	}
+	return nil
+}

cmd/collect/cli/chroot_windows.go

@@ -0,0 +1,9 @@
+package cli
+
+import (
+	"errors"
+)
+
+func checkAndSetChroot(newroot string) error {
+	return errors.New("chroot is only implimented in linux/darwin")
+}

cmd/collect/cli/clickhouse.go

@@ -0,0 +1,88 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// ClickhouseCmd runs the clickhouse collector against a single database and
+// prints the native result JSON ({"isConnected":..,"version":..,"error":..}).
+func ClickhouseCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "clickhouse",
+		Short: "Run the clickhouse collector against a database",
+		Long: `Run the clickhouse collector: connect to a ClickHouse server, run "SELECT version()",
+and print the collector result as JSON.
+
+--uri is a clickhouse-go DSN:
+  clickhouse://user:password@host:9000/dbname
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect clickhouse --uri "clickhouse://default:@ch.default.svc:9000/default"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "clickhouse"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectClickhouse{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "ClickHouse connection DSN, e.g. clickhouse://user:pass@host:9000/db (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/collectors_common.go

@@ -0,0 +1,47 @@
+// Package cli implements the `collect` command and its subcommands.
+//
+// The per-collector subcommands (http, postgres, mysql, mssql, redis) run a
+// single collector and print its native result JSON to stdout. This lets a
+// collector run inside a Pod using the troubleshoot image — e.g. as a runPod
+// collector — so the check executes from within the cluster instead of from
+// wherever the CLI happens to be invoked.
+package cli
+
+import (
+	"fmt"
+
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/k8sutil"
+	"github.com/replicatedhq/troubleshoot/pkg/version"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// printCollectorResult writes the native collector result JSON to stdout.
+// The single-collector subcommands run with an empty BundlePath, so the result
+// is held in memory (map value = the JSON bytes) rather than written to disk.
+func printCollectorResult(res collect.CollectorResult) error {
+	for _, b := range res {
+		fmt.Println(string(b))
+	}
+	return nil
+}
+
+// k8sClientForCollectors builds a Kubernetes client from the ambient kubeconfig
+// or in-cluster config. Only the collectors that resolve TLS material from a
+// Secret need this; plain connections and inline/file TLS do not.
+func k8sClientForCollectors() (kubernetes.Interface, *rest.Config, error) {
+	cfg, err := k8sutil.GetRESTConfig()
+	if err != nil {
+		return nil, nil, err
+	}
+	cfg.QPS = constants.DEFAULT_CLIENT_QPS
+	cfg.Burst = constants.DEFAULT_CLIENT_BURST
+	cfg.UserAgent = fmt.Sprintf("%s/%s", constants.DEFAULT_CLIENT_USER_AGENT, version.Version())
+	client, err := kubernetes.NewForConfig(cfg)
+	if err != nil {
+		return nil, nil, err
+	}
+	return client, cfg, nil
+}

cmd/collect/cli/http.go

@@ -0,0 +1,79 @@
+package cli
+
+import (
+	"fmt"
+	"strings"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+)
+
+// HTTPCmd runs the http collector against a single endpoint and prints the
+// native result JSON ({"response":{"status":...}} or {"error":{...}}).
+func HTTPCmd() *cobra.Command {
+	var (
+		method   string
+		url      string
+		headers  map[string]string
+		body     string
+		timeout  string
+		proxy    string
+		insecure bool
+		caCert   string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "http",
+		Short: "Run the http collector against an endpoint",
+		Long: `Run the http collector: issue an HTTP request and print the collector result as JSON.
+
+The result contains the response status, body and headers, or an error object.
+
+Examples:
+  collect http --url http://myapp.default.svc:8080/healthz
+  collect http --method POST --url https://api.internal/ping \
+      --header 'Content-Type=application/json' --body '{"ping":true}'`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var tls *troubleshootv1beta2.TLSParams
+			if caCert != "" {
+				tls = &troubleshootv1beta2.TLSParams{CACert: caCert}
+			}
+
+			spec := &troubleshootv1beta2.HTTP{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "http"},
+			}
+			switch strings.ToUpper(method) {
+			case "GET":
+				spec.Get = &troubleshootv1beta2.Get{URL: url, Headers: headers, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			case "POST":
+				spec.Post = &troubleshootv1beta2.Post{URL: url, Headers: headers, Body: body, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			case "PUT":
+				spec.Put = &troubleshootv1beta2.Put{URL: url, Headers: headers, Body: body, Timeout: timeout, Proxy: proxy, InsecureSkipVerify: insecure, TLS: tls}
+			default:
+				return fmt.Errorf("unsupported --method %q (use GET, POST, or PUT)", method)
+			}
+
+			c := &collect.CollectHTTP{Collector: spec}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&url, "url", "", "request URL (required)")
+	cmd.MarkFlagRequired("url")
+	f.StringVar(&method, "method", "GET", "HTTP method: GET, POST, or PUT")
+	f.StringToStringVar(&headers, "header", nil, "request header as key=value (repeatable)")
+	f.StringVar(&body, "body", "", "request body (POST/PUT only)")
+	f.StringVar(&timeout, "timeout", "", "request timeout, e.g. 15s (empty = no timeout)")
+	f.StringVar(&proxy, "proxy", "", "proxy URL to use for the request")
+	f.BoolVar(&insecure, "insecure-skip-verify", false, "do not verify the server's TLS certificate")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate to trust (PEM contents or a file path)")
+
+	return cmd
+}

cmd/collect/cli/mssql.go

@@ -0,0 +1,49 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+)
+
+// MssqlCmd runs the mssql collector against a single database and prints the
+// native result JSON ({"isConnected":..,"version":..,"error":..}).
+//
+// Unlike the other database collectors, the mssql collector does not honor a
+// separate TLS field — TLS is configured through the connection URI query
+// parameters (e.g. encrypt=true) — so this subcommand only takes --uri.
+func MssqlCmd() *cobra.Command {
+	var uri string
+
+	cmd := &cobra.Command{
+		Use:   "mssql",
+		Short: "Run the mssql collector against a database",
+		Long: `Run the mssql collector: connect to a Microsoft SQL Server, run "select @@VERSION",
+and print the collector result as JSON.
+
+--uri is a go-mssqldb connection URL; TLS options are passed as query parameters:
+  sqlserver://user:password@host:1433?database=app&encrypt=true
+
+Example:
+  collect mssql --uri "sqlserver://sa:pass@mssql.default.svc:1433?encrypt=true"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "mssql"},
+				URI:           uri,
+			}
+
+			c := &collect.CollectMssql{Collector: db, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	cmd.Flags().StringVar(&uri, "uri", "", "SQL Server connection URI, e.g. sqlserver://user:pass@host:1433 (required)")
+	cmd.MarkFlagRequired("uri")
+
+	return cmd
+}

cmd/collect/cli/mysql.go

@@ -0,0 +1,90 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// MysqlCmd runs the mysql collector against a single database and prints the
+// native result JSON ({"isConnected":..,"version":..,"variables":..,"error":..}).
+func MysqlCmd() *cobra.Command {
+	var (
+		uri             string
+		parameters      []string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "mysql",
+		Short: "Run the mysql collector against a database",
+		Long: `Run the mysql collector: connect to a MySQL server, run "select version()",
+optionally collect server variables, and print the collector result as JSON.
+
+--uri is a go-sql-driver DSN (note: not a URL):
+  user:password@tcp(host:3306)/dbname
+
+--parameters names server variables to collect via "SHOW VARIABLES"; the matching
+values are returned under "variables" in the result. This flag is unique to mysql.
+
+Example:
+  collect mysql --uri "root:pass@tcp(mysql.default.svc:3306)/" --parameters max_connections,version`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "mysql"},
+				URI:           uri,
+				Parameters:    parameters,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectMysql{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "MySQL connection DSN, e.g. user:pass@tcp(host:3306)/db (required)")
+	cmd.MarkFlagRequired("uri")
+	f.StringSliceVar(&parameters, "parameters", nil, "server variables to collect via SHOW VARIABLES (comma-separated or repeatable)")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/postgres.go

@@ -0,0 +1,88 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// PostgresCmd runs the postgres collector against a single database and prints
+// the native result JSON ({"isConnected":..,"version":..,"error":..}).
+func PostgresCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "postgres",
+		Short: "Run the postgres collector against a database",
+		Long: `Run the postgres collector: connect to a PostgreSQL server, run "select version()",
+and print the collector result as JSON.
+
+--uri is a libpq/pgx connection URI:
+  postgres://user:password@host:5432/dbname?sslmode=disable
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect postgres --uri "postgres://user:pass@pg.default.svc:5432/app?sslmode=disable"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "postgres"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectPostgres{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "PostgreSQL connection URI (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/redis.go

@@ -0,0 +1,89 @@
+package cli
+
+import (
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+// RedisCmd runs the redis collector against a single instance and prints the
+// native result JSON ({"isConnected":..,"version":..,"error":..}).
+func RedisCmd() *cobra.Command {
+	var (
+		uri             string
+		skipVerify      bool
+		caCert          string
+		clientCert      string
+		clientKey       string
+		secretName      string
+		secretNamespace string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "redis",
+		Short: "Run the redis collector against an instance",
+		Long: `Run the redis collector: connect to a Redis server, read "INFO server" (server
+version), and print the collector result as JSON.
+
+--uri is a go-redis connection URL:
+  redis://host:6379            (plaintext)
+  rediss://user:pass@host:6379 (TLS)
+
+TLS material may be provided inline / by file path (--tls-cacert, --tls-client-cert,
+--tls-client-key) or sourced from a Secret (--tls-secret-name), which requires
+cluster access.
+
+Example:
+  collect redis --uri "redis://redis.default.svc:6379"`,
+		SilenceUsage: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			db := &troubleshootv1beta2.Database{
+				CollectorMeta: troubleshootv1beta2.CollectorMeta{CollectorName: "redis"},
+				URI:           uri,
+			}
+
+			var (
+				client kubernetes.Interface
+				cfg    *rest.Config
+			)
+			if skipVerify || caCert != "" || clientCert != "" || clientKey != "" || secretName != "" {
+				tls := &troubleshootv1beta2.TLSParams{
+					SkipVerify: skipVerify,
+					CACert:     caCert,
+					ClientCert: clientCert,
+					ClientKey:  clientKey,
+				}
+				if secretName != "" {
+					tls.Secret = &troubleshootv1beta2.TLSSecret{Name: secretName, Namespace: secretNamespace}
+					var err error
+					client, cfg, err = k8sClientForCollectors()
+					if err != nil {
+						return err
+					}
+				}
+				db.TLS = tls
+			}
+
+			c := &collect.CollectRedis{Collector: db, ClientConfig: cfg, Client: client, Context: cmd.Context()}
+			res, err := c.Collect(nil)
+			if err != nil {
+				return err
+			}
+			return printCollectorResult(res)
+		},
+	}
+
+	f := cmd.Flags()
+	f.StringVar(&uri, "uri", "", "Redis connection URL, e.g. redis://host:6379 (required)")
+	cmd.MarkFlagRequired("uri")
+	f.BoolVar(&skipVerify, "tls-skip-verify", false, "skip TLS certificate verification")
+	f.StringVar(&caCert, "tls-cacert", "", "CA certificate (PEM contents or a file path)")
+	f.StringVar(&clientCert, "tls-client-cert", "", "client certificate (PEM contents or a file path)")
+	f.StringVar(&clientKey, "tls-client-key", "", "client key (PEM contents or a file path)")
+	f.StringVar(&secretName, "tls-secret-name", "", "name of a Secret holding TLS material (requires cluster access)")
+	f.StringVar(&secretNamespace, "tls-secret-namespace", "default", "namespace of the TLS Secret")
+
+	return cmd
+}

cmd/collect/cli/root.go

@@ -19,7 +19,9 @@ func RootCmd() *cobra.Command {
 		Short:        "Run a collector",
 		Long:         `Run a collector and output the results.`,
 		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
+		// PersistentPreRun/PersistentPostRun (rather than PreRun/PostRun) so this
+		// setup also runs for the per-collector subcommands, not just `collect [url]`.
+		PersistentPreRun: func(cmd *cobra.Command, args []string) {
 			v := viper.GetViper()
 			v.BindPFlags(cmd.Flags())
 
@@ -32,9 +34,13 @@ func RootCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
 
+			if err := checkAndSetChroot(v.GetString("chroot")); err != nil {
+				return err
+			}
+
 			return runCollect(v, args[0])
 		},
-		PostRun: func(cmd *cobra.Command, args []string) {
+		PersistentPostRun: func(cmd *cobra.Command, args []string) {
 			if err := util.StopProfiling(); err != nil {
 				klog.Errorf("Failed to stop profiling: %v", err)
 			}
@@ -45,6 +51,17 @@ func RootCmd() *cobra.Command {
 
 	cmd.AddCommand(util.VersionCmd())
 
+	// Per-collector subcommands: run a single collector and print its native
+	// result JSON. Each has its own flags and help. These let a collector run
+	// inside a Pod via the troubleshoot image (e.g. as a runPod collector), so
+	// the check executes from within the cluster rather than wherever the CLI runs.
+	cmd.AddCommand(HTTPCmd())
+	cmd.AddCommand(PostgresCmd())
+	cmd.AddCommand(MysqlCmd())
+	cmd.AddCommand(MssqlCmd())
+	cmd.AddCommand(RedisCmd())
+	cmd.AddCommand(ClickhouseCmd())
+
 	cmd.Flags().StringSlice("redactors", []string{}, "names of the additional redactors to use")
 	cmd.Flags().Bool("redact", true, "enable/disable default redactions")
 	cmd.Flags().String("format", "json", "output format, one of json or raw.")
@@ -52,7 +69,8 @@ func RootCmd() *cobra.Command {
 	cmd.Flags().String("collector-pull-policy", "", "the pull policy of the collector image")
 	cmd.Flags().String("selector", "", "selector (label query) to filter remote collection nodes on.")
 	cmd.Flags().Bool("collect-without-permissions", false, "always generate a support bundle, even if it some require additional permissions")
-	cmd.Flags().Bool("debug", false, "enable debug logging")
+	cmd.PersistentFlags().Bool("debug", false, "enable debug logging")
+	cmd.Flags().String("chroot", "", "Chroot to path")
 
 	// hidden in favor of the `insecure-skip-tls-verify` flag
 	cmd.Flags().Bool("allow-insecure-connections", false, "when set, do not verify TLS certs when retrieving spec and reporting results")
@@ -62,7 +80,7 @@ func RootCmd() *cobra.Command {
 
 	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
 
-	k8sutil.AddFlags(cmd.Flags())
+	k8sutil.AddFlags(cmd.PersistentFlags())
 
 	// Initialize klog flags
 	logger.InitKlogFlags(cmd)

cmd/collect/cli/run.go

@@ -2,6 +2,7 @@ package cli
 
 import (
 	"fmt"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"os"
@@ -49,6 +50,13 @@ func runCollect(v *viper.Viper, arg string) error {
 		}
 
 		collectorContent = spec
+	} else if arg == "-" {
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return err
+		}
+
+		collectorContent = b
 	} else if _, err = os.Stat(arg); err == nil {
 		b, err := os.ReadFile(arg)
 		if err != nil {

cmd/docsgen/cli/root.go

@@ -1,37 +0,0 @@
-package cli
-
-import (
-	"log"
-	"os"
-
-	preflightcli "github.com/replicatedhq/troubleshoot/cmd/preflight/cli"
-	troubleshootcli "github.com/replicatedhq/troubleshoot/cmd/troubleshoot/cli"
-	"github.com/spf13/cobra"
-
-	"github.com/spf13/cobra/doc"
-)
-
-func RootCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "docsgen",
-		Short: "Generate markdown docs for the commands in this project",
-	}
-	preflight := preflightcli.RootCmd()
-	troubleshoot := troubleshootcli.RootCmd()
-	commands := []*cobra.Command{preflight, troubleshoot}
-
-	for _, command := range commands {
-		err := doc.GenMarkdownTree(command, "./docs")
-		if err != nil {
-			log.Fatal(err)
-		}
-	}
-
-	return cmd
-}
-
-func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
-		os.Exit(1)
-	}
-}

cmd/docsgen/main.go

@@ -1,10 +0,0 @@
-package main
-
-import (
-	"github.com/replicatedhq/troubleshoot/cmd/docsgen/cli"
-	_ "k8s.io/client-go/plugin/pkg/client/auth"
-)
-
-func main() {
-	cli.InitAndExecute()
-}

cmd/preflight/cli/convert.go

@@ -0,0 +1,132 @@
+package cli
+
+import (
+	"fmt"
+	"io/ioutil"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/convert"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func ConvertCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "convert [input-file]",
+		Args:  cobra.ExactArgs(1),
+		Short: "Convert v1beta2 preflight specs to v1beta3 format",
+		Long: `Convert v1beta2 preflight specs to v1beta3 format with templating and values.
+
+This command converts a v1beta2 preflight spec to the new v1beta3 templated format. It will:
+- Update the apiVersion to troubleshoot.sh/v1beta3
+- Extract hardcoded values and create a values.yaml file
+- Add conditional templating ({{- if .Values.feature.enabled }})
+- Add placeholder docString comments for you to fill in
+- Template hardcoded values with {{ .Values.* }} expressions
+
+The conversion will create two files:
+- [input-file]-v1beta3.yaml: The templated v1beta3 spec
+- [input-file]-values.yaml: The values file with extracted configuration
+
+Example:
+  preflight convert my-preflight.yaml
+
+This creates:
+  my-preflight-v1beta3.yaml
+  my-preflight-values.yaml`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			inputFile := args[0]
+			outputSpec := v.GetString("output-spec")
+			outputValues := v.GetString("output-values")
+
+			// Generate default output filenames if not specified
+			if outputSpec == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputSpec = base + "-v1beta3" + ext
+			}
+
+			if outputValues == "" {
+				ext := filepath.Ext(inputFile)
+				base := strings.TrimSuffix(inputFile, ext)
+				outputValues = base + "-values" + ext
+			}
+
+			return runConvert(v, inputFile, outputSpec, outputValues)
+		},
+	}
+
+	cmd.Flags().String("output-spec", "", "Output file for the templated v1beta3 spec (default: [input]-v1beta3.yaml)")
+	cmd.Flags().String("output-values", "", "Output file for the values (default: [input]-values.yaml)")
+	cmd.Flags().Bool("dry-run", false, "Preview the conversion without writing files")
+
+	return cmd
+}
+
+func runConvert(v *viper.Viper, inputFile, outputSpec, outputValues string) error {
+	// Read input file
+	inputData, err := ioutil.ReadFile(inputFile)
+	if err != nil {
+		return errors.Wrapf(err, "failed to read input file %s", inputFile)
+	}
+
+	// Check if it's a valid v1beta2 preflight spec
+	if !strings.Contains(string(inputData), "troubleshoot.sh/v1beta2") {
+		return fmt.Errorf("input file does not appear to be a v1beta2 troubleshoot spec")
+	}
+
+	if !strings.Contains(string(inputData), "kind: Preflight") {
+		return fmt.Errorf("input file does not appear to be a Preflight spec")
+	}
+
+	// Convert to v1beta3
+	result, err := convert.ConvertToV1Beta3(inputData)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert spec")
+	}
+
+	dryRun := v.GetBool("dry-run")
+
+	if dryRun {
+		fmt.Println("=== Templated v1beta3 Spec ===")
+		fmt.Println(result.TemplatedSpec)
+		fmt.Println("\n=== Values File ===")
+		fmt.Println(result.ValuesFile)
+		fmt.Println("\n=== Conversion Summary ===")
+		fmt.Printf("Would write templated spec to: %s\n", outputSpec)
+		fmt.Printf("Would write values to: %s\n", outputValues)
+		return nil
+	}
+
+	// Write templated spec
+	err = ioutil.WriteFile(outputSpec, []byte(result.TemplatedSpec), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write templated spec to %s", outputSpec)
+	}
+
+	// Write values file
+	err = ioutil.WriteFile(outputValues, []byte(result.ValuesFile), 0644)
+	if err != nil {
+		return errors.Wrapf(err, "failed to write values to %s", outputValues)
+	}
+
+	fmt.Printf("Successfully converted %s to v1beta3 format:\n", inputFile)
+	fmt.Printf("  Templated spec: %s\n", outputSpec)
+	fmt.Printf("  Values file: %s\n", outputValues)
+	fmt.Println("\nNext steps:")
+	fmt.Println("1. Add docStrings with Title, Requirement, and rationale for each check")
+	fmt.Println("2. Customize the values in the values file")
+	fmt.Println("3. Test the conversion with:")
+	fmt.Printf("   preflight template %s --values %s\n", outputSpec, outputValues)
+	fmt.Println("4. Run the templated preflight:")
+	fmt.Printf("   preflight run %s --values %s\n", outputSpec, outputValues)
+
+	return nil
+}

cmd/preflight/cli/docs.go

@@ -0,0 +1,368 @@
+package cli
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"text/template"
+
+	"github.com/Masterminds/sprig/v3"
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"gopkg.in/yaml.v2"
+	"helm.sh/helm/v3/pkg/strvals"
+)
+
+func DocsCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "docs [preflight-file...]",
+		Short: "Extract and display documentation from a preflight spec",
+		Long: `Extract all docString fields from enabled requirements in one or more preflight YAML files.
+This command processes templated preflight specs, evaluates conditionals, and outputs
+only the documentation for requirements that would be included based on the provided values.
+
+Examples:
+  # Extract docs with default values
+  preflight docs ml-platform-preflight.yaml
+
+  # Extract docs from multiple specs with values from files
+  preflight docs spec1.yaml spec2.yaml --values base-values.yaml --values prod-values.yaml
+
+  # Extract docs with inline values
+  preflight docs ml-platform-preflight.yaml --set jupyter.enabled=true --set monitoring.enabled=false
+
+  # Extract docs and save to file
+  preflight docs ml-platform-preflight.yaml --output requirements.md`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			templateFiles := args
+			valuesFiles := v.GetStringSlice("values")
+			outputFile := v.GetString("output")
+			setValues := v.GetStringSlice("set")
+
+			return extractDocs(templateFiles, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	// Bind flags to viper
+	viper.BindPFlag("values", cmd.Flags().Lookup("values"))
+	viper.BindPFlag("set", cmd.Flags().Lookup("set"))
+	viper.BindPFlag("output", cmd.Flags().Lookup("output"))
+
+	return cmd
+}
+
+// PreflightDoc supports both legacy (requirements) and beta3 (spec.analyzers)
+type PreflightDoc struct {
+	APIVersion string                 `yaml:"apiVersion"`
+	Kind       string                 `yaml:"kind"`
+	Metadata   map[string]interface{} `yaml:"metadata"`
+	Spec       struct {
+		Analyzers []map[string]interface{} `yaml:"analyzers"`
+	} `yaml:"spec"`
+	// Legacy (pre-beta3 drafts)
+	Requirements []Requirement `yaml:"requirements"`
+}
+
+type Requirement struct {
+	Name      string                   `yaml:"name"`
+	DocString string                   `yaml:"docString"`
+	Checks    []map[string]interface{} `yaml:"checks,omitempty"`
+}
+
+func extractDocs(templateFiles []string, valuesFiles []string, setValues []string, outputFile string) error {
+	// Prepare the values map (merge all files, then apply sets)
+	values := make(map[string]interface{})
+
+	for _, valuesFile := range valuesFiles {
+		fileValues, err := loadValuesFile(valuesFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to load values file %s", valuesFile)
+		}
+		values = preflight.MergeMaps(values, fileValues)
+	}
+
+	// Normalize maps for Helm set merging
+	values = normalizeStringMaps(values)
+
+	for _, setValue := range setValues {
+		if err := applySetValue(values, setValue); err != nil {
+			return errors.Wrapf(err, "failed to apply set value: %s", setValue)
+		}
+	}
+
+	var combinedDocs strings.Builder
+
+	for _, templateFile := range templateFiles {
+		templateContent, err := os.ReadFile(templateFile)
+		if err != nil {
+			return errors.Wrapf(err, "failed to read template file %s", templateFile)
+		}
+
+		useHelm := shouldUseHelmEngine(string(templateContent))
+		var rendered string
+		if useHelm {
+			// Seed default-false for referenced boolean values to avoid nil map errors
+			preflight.SeedDefaultBooleans(string(templateContent), values)
+			rendered, err = preflight.RenderWithHelmTemplate(string(templateContent), values)
+			if err != nil {
+				execValues := legacyContext(values)
+				rendered, err = renderTemplate(string(templateContent), execValues)
+				if err != nil {
+					return errors.Wrap(err, "failed to render template (helm fallback also failed)")
+				}
+			}
+		} else {
+			execValues := legacyContext(values)
+			rendered, err = renderTemplate(string(templateContent), execValues)
+			if err != nil {
+				return errors.Wrap(err, "failed to render template")
+			}
+		}
+
+		docs, err := extractDocStrings(rendered)
+		if err != nil {
+			return errors.Wrap(err, "failed to extract documentation")
+		}
+
+		if strings.TrimSpace(docs) != "" {
+			if combinedDocs.Len() > 0 {
+				combinedDocs.WriteString("\n\n")
+			}
+			combinedDocs.WriteString(docs)
+		}
+	}
+
+	if outputFile != "" {
+		if err := os.WriteFile(outputFile, []byte(combinedDocs.String()), 0644); err != nil {
+			return errors.Wrapf(err, "failed to write output file %s", outputFile)
+		}
+		fmt.Printf("Documentation extracted successfully to %s\n", outputFile)
+	} else {
+		fmt.Print(combinedDocs.String())
+	}
+
+	return nil
+}
+
+func shouldUseHelmEngine(content string) bool {
+	return strings.Contains(content, ".Values")
+}
+
+func legacyContext(values map[string]interface{}) map[string]interface{} {
+	ctx := make(map[string]interface{}, len(values)+1)
+	for k, v := range values {
+		ctx[k] = v
+	}
+	ctx["Values"] = values
+	return ctx
+}
+
+func normalizeStringMaps(v interface{}) map[string]interface{} {
+	// Avoid unsafe type assertion; normalizeMap may return non-map types.
+	if v == nil {
+		return map[string]interface{}{}
+	}
+	normalized := normalizeMap(v)
+	if m, ok := normalized.(map[string]interface{}); ok {
+		return m
+	}
+	return map[string]interface{}{}
+}
+
+func normalizeMap(v interface{}) interface{} {
+	switch t := v.(type) {
+	case map[string]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			m[k] = normalizeMap(val)
+		}
+		return m
+	case map[interface{}]interface{}:
+		m := make(map[string]interface{}, len(t))
+		for k, val := range t {
+			key := fmt.Sprintf("%v", k)
+			m[key] = normalizeMap(val)
+		}
+		return m
+	case []interface{}:
+		a := make([]interface{}, len(t))
+		for i, val := range t {
+			a[i] = normalizeMap(val)
+		}
+		return a
+	default:
+		return v
+	}
+}
+
+func extractDocStrings(yamlContent string) (string, error) {
+	var preflightDoc PreflightDoc
+	if err := yaml.Unmarshal([]byte(yamlContent), &preflightDoc); err != nil {
+		return "", errors.Wrap(err, "failed to parse YAML")
+	}
+
+	var docs strings.Builder
+	first := true
+
+	// Prefer beta3 analyzers docStrings
+	if len(preflightDoc.Spec.Analyzers) > 0 {
+		for _, analyzer := range preflightDoc.Spec.Analyzers {
+			if raw, ok := analyzer["docString"]; ok {
+				text, _ := raw.(string)
+				text = strings.TrimSpace(text)
+				if text == "" {
+					continue
+				}
+				if !first {
+					docs.WriteString("\n\n")
+				}
+				first = false
+				writeMarkdownSection(&docs, text, "")
+			}
+		}
+		return docs.String(), nil
+	}
+
+	// Fallback: legacy requirements with docString
+	for _, req := range preflightDoc.Requirements {
+		if strings.TrimSpace(req.DocString) == "" {
+			continue
+		}
+		if !first {
+			docs.WriteString("\n\n")
+		}
+		first = false
+		writeMarkdownSection(&docs, req.DocString, req.Name)
+	}
+
+	return docs.String(), nil
+}
+
+// writeMarkdownSection prints a heading from Title: or name, then the rest
+func writeMarkdownSection(b *strings.Builder, docString string, fallbackName string) {
+	lines := strings.Split(docString, "\n")
+	title := strings.TrimSpace(fallbackName)
+	contentStart := 0
+	for i, line := range lines {
+		trim := strings.TrimSpace(line)
+		if strings.HasPrefix(trim, "Title:") {
+			parts := strings.SplitN(trim, ":", 2)
+			if len(parts) == 2 {
+				t := strings.TrimSpace(parts[1])
+				if t != "" {
+					title = t
+				}
+			}
+			contentStart = i + 1
+			break
+		}
+	}
+	if title != "" {
+		b.WriteString("### ")
+		b.WriteString(title)
+		b.WriteString("\n\n")
+	}
+	remaining := strings.Join(lines[contentStart:], "\n")
+	remaining = strings.TrimSpace(remaining)
+	if remaining != "" {
+		b.WriteString(remaining)
+		b.WriteString("\n")
+	}
+}
+
+// loadValuesFile loads values from a YAML file
+func loadValuesFile(filename string) (map[string]interface{}, error) {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return nil, err
+	}
+
+	var values map[string]interface{}
+	if err := yaml.Unmarshal(data, &values); err != nil {
+		return nil, errors.Wrap(err, "failed to parse values file as YAML")
+	}
+
+	return values, nil
+}
+
+// applySetValue applies a single --set value to the values map (Helm semantics)
+func applySetValue(values map[string]interface{}, setValue string) error {
+	if idx := strings.Index(setValue, "="); idx > 0 {
+		key := setValue[:idx]
+		val := setValue[idx+1:]
+		if strings.HasPrefix(key, "Values.") {
+			key = strings.TrimPrefix(key, "Values.")
+			setValue = key + "=" + val
+		}
+	}
+	if err := strvals.ParseInto(setValue, values); err != nil {
+		return fmt.Errorf("parsing --set: %w", err)
+	}
+	return nil
+}
+
+// setNestedValue sets a value in a nested map structure
+func setNestedValue(m map[string]interface{}, keys []string, value interface{}) {
+	if len(keys) == 0 {
+		return
+	}
+	if len(keys) == 1 {
+		m[keys[0]] = value
+		return
+	}
+	if _, ok := m[keys[0]]; !ok {
+		m[keys[0]] = make(map[string]interface{})
+	}
+	if nextMap, ok := m[keys[0]].(map[string]interface{}); ok {
+		setNestedValue(nextMap, keys[1:], value)
+	} else {
+		m[keys[0]] = make(map[string]interface{})
+		setNestedValue(m[keys[0]].(map[string]interface{}), keys[1:], value)
+	}
+}
+
+func renderTemplate(templateContent string, values map[string]interface{}) (string, error) {
+	tmpl := template.New("preflight").Funcs(sprig.FuncMap())
+	tmpl, err := tmpl.Parse(templateContent)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to parse template")
+	}
+	var buf bytes.Buffer
+	if err := tmpl.Execute(&buf, values); err != nil {
+		return "", errors.Wrap(err, "failed to execute template")
+	}
+	result := cleanRenderedYAML(buf.String())
+	return result, nil
+}
+
+func cleanRenderedYAML(content string) string {
+	lines := strings.Split(content, "\n")
+	var cleaned []string
+	var lastWasEmpty bool
+	for _, line := range lines {
+		trimmed := strings.TrimRight(line, " \t")
+		if trimmed == "" {
+			if !lastWasEmpty {
+				cleaned = append(cleaned, "")
+				lastWasEmpty = true
+			}
+		} else {
+			cleaned = append(cleaned, trimmed)
+			lastWasEmpty = false
+		}
+	}
+	for len(cleaned) > 0 && cleaned[len(cleaned)-1] == "" {
+		cleaned = cleaned[:len(cleaned)-1]
+	}
+	return strings.Join(cleaned, "\n") + "\n"
+}

cmd/preflight/cli/lint.go

@@ -0,0 +1,100 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/pkg/errors"
+	"github.com/replicatedhq/troubleshoot/pkg/constants"
+	"github.com/replicatedhq/troubleshoot/pkg/lint"
+	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+func LintCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "lint [spec-files...]",
+		Args:  cobra.MinimumNArgs(1),
+		Short: "Lint v1beta2/v1beta3 preflight specs for syntax and structural errors",
+		Long: `Lint v1beta2/v1beta3 preflight specs for syntax and structural errors.
+
+This command validates v1beta2/v1beta3 preflight specs and checks for:
+- YAML syntax errors
+- Missing required fields (apiVersion, kind, metadata, spec)
+- Invalid template syntax ({{ .Values.* }})
+- Missing analyzers or collectors
+- Common structural issues
+- Missing docStrings (warning)
+
+Examples:
+  # Lint a single spec file
+  preflight lint my-preflight.yaml
+
+  # Lint multiple spec files
+  preflight lint spec1.yaml spec2.yaml spec3.yaml
+
+  # Lint with automatic fixes
+  preflight lint --fix my-preflight.yaml
+
+  # Lint and output as JSON for CI/CD integration
+  preflight lint --format json my-preflight.yaml
+
+Notes:
+- v1beta2 does not support templating; template syntax in v1beta2 files will be flagged as errors.
+- v1beta3 supports templating and is linted with template-awareness.
+
+Exit codes:
+  0 - No errors found
+  2 - Validation errors found`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+
+			opts := lint.LintOptions{
+				FilePaths:   args,
+				Fix:         v.GetBool("fix"),
+				Format:      v.GetString("format"),
+				ValuesFiles: v.GetStringSlice("values"),
+				SetValues:   v.GetStringSlice("set"),
+			}
+
+			return runLint(opts)
+		},
+	}
+
+	cmd.Flags().Bool("fix", false, "Automatically fix issues where possible")
+	cmd.Flags().String("format", "text", "Output format: text or json")
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files with template values (required for v1beta3 specs)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values via command line (e.g., --set key=value)")
+
+	return cmd
+}
+
+func runLint(opts lint.LintOptions) error {
+	// Validate file paths exist
+	for _, filePath := range opts.FilePaths {
+		if _, err := os.Stat(filePath); err != nil {
+			return errors.Wrapf(err, "file not found: %s", filePath)
+		}
+	}
+
+	// Run linting
+	results, err := lint.LintFiles(opts)
+	if err != nil {
+		return errors.Wrap(err, "failed to lint files")
+	}
+
+	// Format and print results
+	output := lint.FormatResults(results, opts.Format)
+	fmt.Print(output)
+
+	// Return appropriate exit code
+	if lint.HasErrors(results) {
+		return types.NewExitCodeError(constants.EXIT_CODE_SPEC_ISSUES, nil)
+	}
+
+	return nil
+}

cmd/preflight/cli/root.go

@@ -13,6 +13,7 @@ import (
 	"github.com/replicatedhq/troubleshoot/pkg/logger"
 	"github.com/replicatedhq/troubleshoot/pkg/preflight"
 	"github.com/replicatedhq/troubleshoot/pkg/types"
+	"github.com/replicatedhq/troubleshoot/pkg/updater"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"k8s.io/klog/v2"
@@ -24,7 +25,13 @@ func RootCmd() *cobra.Command {
 		Args:  cobra.MinimumNArgs(1),
 		Short: "Run and retrieve preflight checks in a cluster",
 		Long: `A preflight check is a set of validations that can and should be run to ensure
-that a cluster meets the requirements to run an application.`,
+that a cluster meets the requirements to run an application.
+
+Unlike support-bundle, preflight does not support --load-cluster-specs because
+preflight checks are designed to run before an application is installed or
+upgraded. Since no deployment has occurred yet, there are no in-cluster specs
+to discover. Preflight specs must be provided via a URL, local file path, or
+stdin (e.g. "helm template ... | kubectl preflight -").`,
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PreRun: func(cmd *cobra.Command, args []string) {
@@ -37,6 +44,25 @@ that a cluster meets the requirements to run an application.`,
 			if err := util.StartProfiling(); err != nil {
 				klog.Errorf("Failed to start profiling: %v", err)
 			}
+
+			// Auto-update preflight unless disabled by flag or env
+			envAuto := os.Getenv("PREFLIGHT_AUTO_UPDATE")
+			autoFromEnv := true
+			if envAuto != "" {
+				if strings.EqualFold(envAuto, "0") || strings.EqualFold(envAuto, "false") {
+					autoFromEnv = false
+				}
+			}
+			if v.GetBool("auto-update") && autoFromEnv {
+				exe, err := os.Executable()
+				if err == nil {
+					_ = updater.CheckAndUpdate(cmd.Context(), updater.Options{
+						BinaryName:  "preflight",
+						CurrentPath: exe,
+						Printf:      func(f string, a ...interface{}) { fmt.Fprintf(os.Stderr, f, a...) },
+					})
+				}
+			}
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			v := viper.GetViper()
@@ -50,7 +76,7 @@ that a cluster meets the requirements to run an application.`,
 
 			err = preflight.RunPreflights(v.GetBool("interactive"), v.GetString("output"), v.GetString("format"), args)
 			if !v.GetBool("dry-run") && (v.GetBool("debug") || v.IsSet("v")) {
-				fmt.Printf("\n%s", traces.GetExporterInstance().GetSummary())
+				fmt.Fprintf(os.Stderr, "\n%s", traces.GetExporterInstance().GetSummary())
 			}
 
 			return err
@@ -66,11 +92,22 @@ that a cluster meets the requirements to run an application.`,
 
 	cmd.AddCommand(util.VersionCmd())
 	cmd.AddCommand(OciFetchCmd())
+	cmd.AddCommand(TemplateCmd())
+	cmd.AddCommand(DocsCmd())
+	cmd.AddCommand(ConvertCmd())
+	cmd.AddCommand(LintCmd())
+
 	preflight.AddFlags(cmd.PersistentFlags())
 
 	// Dry run flag should be in cmd.PersistentFlags() flags made available to all subcommands
 	// Adding here to avoid that
 	cmd.Flags().Bool("dry-run", false, "print the preflight spec without running preflight checks")
+	cmd.Flags().Bool("no-uri", false, "When this flag is used, Preflight does not attempt to retrieve the spec referenced by the uri: field`")
+	cmd.Flags().Bool("auto-update", true, "enable automatic binary self-update check and install")
+
+	// Template values for v1beta3 specs
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values for v1beta3 specs (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line for v1beta3 specs (can be used multiple times)")
 
 	k8sutil.AddFlags(cmd.Flags())
 

cmd/preflight/cli/template.go

@@ -0,0 +1,42 @@
+package cli
+
+import (
+	"github.com/replicatedhq/troubleshoot/pkg/preflight"
+	"github.com/spf13/cobra"
+)
+
+func TemplateCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "template [template-file]",
+		Short: "Render a templated preflight spec with values",
+		Long: `Process a templated preflight YAML file, substituting variables and removing conditional sections based on provided values.
+
+Examples:
+  # Render template with default values
+  preflight template sample-preflight-templated.yaml
+
+  # Render template with values from files
+  preflight template sample-preflight-templated.yaml --values values-base.yaml --values values-prod.yaml
+
+  # Render template with inline values
+  preflight template sample-preflight-templated.yaml --set postgres.enabled=true --set cluster.minNodes=5
+
+  # Render template and save to file
+  preflight template sample-preflight-templated.yaml --output rendered.yaml`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			templateFile := args[0]
+			valuesFiles, _ := cmd.Flags().GetStringSlice("values")
+			outputFile, _ := cmd.Flags().GetString("output")
+			setValues, _ := cmd.Flags().GetStringSlice("set")
+
+			return preflight.RunTemplate(templateFile, valuesFiles, setValues, outputFile)
+		},
+	}
+
+	cmd.Flags().StringSlice("values", []string{}, "Path to YAML files containing template values (can be used multiple times)")
+	cmd.Flags().StringSlice("set", []string{}, "Set template values on the command line (can be used multiple times)")
+	cmd.Flags().StringP("output", "o", "", "Output file (default: stdout)")
+
+	return cmd
+}

cmd/schemagen/cli/root.go

@@ -1,174 +0,0 @@
-package cli
-
-import (
-	"encoding/json"
-	"io/ioutil"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-
-	"github.com/pkg/errors"
-	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
-	extensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	extensionsscheme "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset/scheme"
-	"k8s.io/client-go/kubernetes/scheme"
-)
-
-func RootCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:          "schemagen",
-		Short:        "Generate openapischemas for the kinds in this project",
-		SilenceUsage: true,
-		PreRun: func(cmd *cobra.Command, args []string) {
-			viper.BindPFlags(cmd.Flags())
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			v := viper.GetViper()
-
-			return generateSchemas(v)
-		},
-	}
-
-	cobra.OnInitialize(initConfig)
-
-	cmd.Flags().String("output-dir", "./schemas", "directory to save the schemas in")
-
-	viper.BindPFlags(cmd.Flags())
-
-	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
-
-	return cmd
-}
-
-func InitAndExecute() {
-	if err := RootCmd().Execute(); err != nil {
-		os.Exit(1)
-	}
-}
-
-func initConfig() {
-	viper.SetEnvPrefix("TROUBLESHOOT")
-	viper.AutomaticEnv()
-}
-
-func generateSchemas(v *viper.Viper) error {
-	// we generate schemas from the config/crds in the root of this project
-	// those crds can be created from controller-gen or by running `make openapischema`
-
-	workdir, err := os.Getwd()
-	if err != nil {
-		return errors.Wrap(err, "failed to get workdir")
-	}
-
-	files := []struct {
-		inFilename  string
-		outFilename string
-	}{
-		{
-			"troubleshoot.replicated.com_preflights.yaml",
-			"preflight-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_collectors.yaml",
-			"collector-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_redactors.yaml",
-			"redactor-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.replicated.com_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta1.json",
-		},
-		{
-			"troubleshoot.sh_analyzers.yaml",
-			"analyzer-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_collectors.yaml",
-			"collector-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_preflights.yaml",
-			"preflight-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_redactors.yaml",
-			"redactor-troubleshoot-v1beta2.json",
-		},
-		{
-			"troubleshoot.sh_supportbundles.yaml",
-			"supportbundle-troubleshoot-v1beta2.json",
-		},
-	}
-
-	for _, file := range files {
-		contents, err := ioutil.ReadFile(filepath.Join(workdir, "config", "crds", file.inFilename))
-		if err != nil {
-			return errors.Wrapf(err, "failed to read crd from %s", file.inFilename)
-		}
-		if err := generateSchemaFromCRD(contents, filepath.Join(workdir, v.GetString("output-dir"), file.outFilename)); err != nil {
-			return errors.Wrapf(err, "failed to write crd schema to %s", file.outFilename)
-		}
-	}
-
-	return nil
-}
-
-func generateSchemaFromCRD(crd []byte, outfile string) error {
-	extensionsscheme.AddToScheme(scheme.Scheme)
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode(crd, nil, nil)
-	if err != nil {
-		return errors.Wrap(err, "failed to decode crd")
-	}
-
-	customResourceDefinition := obj.(*extensionsv1.CustomResourceDefinition)
-
-	if len(customResourceDefinition.Spec.Versions) == 0 {
-		return errors.New("no versions found for CRD")
-	}
-
-	crdSchema := customResourceDefinition.Spec.Versions[0].Schema
-	if crdSchema == nil {
-		return errors.New("CRD has a nil schema")
-	}
-
-	b, err := json.MarshalIndent(crdSchema.OpenAPIV3Schema, "", "  ")
-	if err != nil {
-		return errors.Wrap(err, "failed to marshal json")
-	}
-
-	_, err = os.Stat(outfile)
-	if err == nil {
-		if err := os.Remove(outfile); err != nil {
-			return errors.Wrap(err, "failed to remove file")
-		}
-	}
-
-	d, _ := path.Split(outfile)
-	_, err = os.Stat(d)
-	if os.IsNotExist(err) {
-		if err = os.MkdirAll(d, 0755); err != nil {
-			return errors.Wrap(err, "failed to mkdir")
-		}
-	}
-
-	// whoa now
-	// working around the fact that controller-gen doesn't have tags to generate oneOf schemas, so this is hacky.
-	// going to work to add an issue there to support and if they accept, this terrible thing can go away
-	boolStringed := strings.ReplaceAll(string(b), `"type": "BoolString"`, `"oneOf": [{"type": "string"},{"type": "boolean"}]`)
-
-	err = ioutil.WriteFile(outfile, []byte(boolStringed), 0644)
-	if err != nil {
-		return errors.Wrap(err, "failed to write file")
-	}
-
-	return nil
-}

cmd/schemagen/main.go

@@ -1,9 +0,0 @@
-package main
-
-import (
-	"github.com/replicatedhq/troubleshoot/cmd/schemagen/cli"
-)
-
-func main() {
-	cli.InitAndExecute()
-}

cmd/troubleshoot/cli/auto_discovery.go

@@ -0,0 +1,372 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/pkg/errors"
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/klog/v2"
+)
+
+// AutoDiscoveryConfig contains configuration for auto-discovery
+type AutoDiscoveryConfig struct {
+	Enabled                 bool
+	IncludeImages           bool
+	RBACCheck               bool
+	Profile                 string
+	ExcludeNamespaces       []string
+	IncludeNamespaces       []string
+	IncludeSystemNamespaces bool
+	Timeout                 time.Duration
+}
+
+// DiscoveryProfile defines different levels of auto-discovery
+type DiscoveryProfile struct {
+	Name          string
+	Description   string
+	IncludeImages bool
+	RBACCheck     bool
+	MaxDepth      int
+	Timeout       time.Duration
+}
+
+// GetAutoDiscoveryConfig extracts auto-discovery configuration from viper
+func GetAutoDiscoveryConfig(v *viper.Viper) AutoDiscoveryConfig {
+	return AutoDiscoveryConfig{
+		Enabled:                 v.GetBool("auto"),
+		IncludeImages:           v.GetBool("include-images"),
+		RBACCheck:               v.GetBool("rbac-check"),
+		Profile:                 v.GetString("discovery-profile"),
+		ExcludeNamespaces:       v.GetStringSlice("exclude-namespaces"),
+		IncludeNamespaces:       v.GetStringSlice("include-namespaces"),
+		IncludeSystemNamespaces: v.GetBool("include-system-namespaces"),
+		Timeout:                 30 * time.Second, // Default timeout
+	}
+}
+
+// GetDiscoveryProfiles returns available discovery profiles
+func GetDiscoveryProfiles() map[string]DiscoveryProfile {
+	return map[string]DiscoveryProfile{
+		"minimal": {
+			Name:          "minimal",
+			Description:   "Minimal collection: cluster info, basic logs",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      1,
+			Timeout:       15 * time.Second,
+		},
+		"standard": {
+			Name:          "standard",
+			Description:   "Standard collection: logs, configs, secrets, events",
+			IncludeImages: false,
+			RBACCheck:     true,
+			MaxDepth:      2,
+			Timeout:       30 * time.Second,
+		},
+		"comprehensive": {
+			Name:          "comprehensive",
+			Description:   "Comprehensive collection: everything + image metadata",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      3,
+			Timeout:       60 * time.Second,
+		},
+		"paranoid": {
+			Name:          "paranoid",
+			Description:   "Paranoid collection: maximum data with extended timeouts",
+			IncludeImages: true,
+			RBACCheck:     true,
+			MaxDepth:      5,
+			Timeout:       120 * time.Second,
+		},
+	}
+}
+
+// ApplyAutoDiscovery applies auto-discovery to the support bundle spec
+func ApplyAutoDiscovery(ctx context.Context, client kubernetes.Interface, restConfig *rest.Config,
+	mainBundle *troubleshootv1beta2.SupportBundle, config AutoDiscoveryConfig, namespace string) error {
+
+	if !config.Enabled {
+		return nil // Auto-discovery not enabled
+	}
+
+	klog.V(2).Infof("Applying auto-discovery with profile: %s", config.Profile)
+
+	// Get discovery profile
+	profiles := GetDiscoveryProfiles()
+	profile, exists := profiles[config.Profile]
+	if !exists {
+		klog.Warningf("Unknown discovery profile '%s', using 'standard'", config.Profile)
+		profile = profiles["standard"]
+	}
+
+	// Override profile settings with explicit flags
+	if config.IncludeImages {
+		profile.IncludeImages = true
+	}
+	if config.Timeout > 0 {
+		profile.Timeout = config.Timeout
+	}
+
+	// Create auto-discovery options
+	discoveryOpts := autodiscovery.DiscoveryOptions{
+		IncludeImages: profile.IncludeImages,
+		RBACCheck:     config.RBACCheck,
+		MaxDepth:      profile.MaxDepth,
+		Timeout:       profile.Timeout,
+	}
+
+	// Handle namespace filtering
+	if namespace != "" {
+		discoveryOpts.Namespaces = []string{namespace}
+	} else {
+		// Use include/exclude patterns if specified
+		if len(config.IncludeNamespaces) > 0 || len(config.ExcludeNamespaces) > 0 {
+			// Create namespace scanner to resolve include/exclude patterns
+			nsScanner := autodiscovery.NewNamespaceScanner(client)
+			scanOpts := autodiscovery.ScanOptions{
+				IncludePatterns:         config.IncludeNamespaces,
+				ExcludePatterns:         config.ExcludeNamespaces,
+				IncludeSystemNamespaces: config.IncludeSystemNamespaces,
+			}
+
+			targetNamespaces, err := nsScanner.GetTargetNamespaces(ctx, nil, scanOpts)
+			if err != nil {
+				klog.Warningf("Failed to resolve namespace patterns, using all accessible namespaces: %v", err)
+				// Continue with empty namespace list (all namespaces)
+			} else {
+				discoveryOpts.Namespaces = targetNamespaces
+				klog.V(2).Infof("Resolved namespace patterns to %d namespaces: %v", len(targetNamespaces), targetNamespaces)
+			}
+		}
+	}
+
+	// Create autodiscovery instance
+	discoverer, err := autodiscovery.NewDiscoverer(restConfig, client)
+	if err != nil {
+		return errors.Wrap(err, "failed to create auto-discoverer")
+	}
+
+	// Check if we have existing YAML collectors (Path 2) or just auto-discovery (Path 1)
+	hasYAMLCollectors := len(mainBundle.Spec.Collectors) > 0
+
+	var autoCollectors []autodiscovery.CollectorSpec
+
+	if hasYAMLCollectors {
+		// Path 2: Augment existing YAML collectors with foundational collectors
+		klog.V(2).Info("Auto-discovery: Augmenting YAML collectors with foundational collectors (Path 2)")
+
+		// Convert existing collectors to autodiscovery format
+		yamlCollectors, err := convertToCollectorSpecs(mainBundle.Spec.Collectors)
+		if err != nil {
+			return errors.Wrap(err, "failed to convert YAML collectors")
+		}
+
+		discoveryOpts.AugmentMode = true
+		autoCollectors, err = discoverer.AugmentWithFoundational(ctx, yamlCollectors, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to augment with foundational collectors")
+		}
+	} else {
+		// Path 1: Pure foundational discovery
+		klog.V(2).Info("Auto-discovery: Collecting foundational data only (Path 1)")
+
+		discoveryOpts.FoundationalOnly = true
+		autoCollectors, err = discoverer.DiscoverFoundational(ctx, discoveryOpts)
+		if err != nil {
+			return errors.Wrap(err, "failed to discover foundational collectors")
+		}
+	}
+
+	// Convert auto-discovered collectors back to troubleshoot specs
+	troubleshootCollectors, err := convertToTroubleshootCollectors(autoCollectors)
+	if err != nil {
+		return errors.Wrap(err, "failed to convert auto-discovered collectors")
+	}
+
+	// Update the support bundle spec
+	if hasYAMLCollectors {
+		// Replace existing collectors with augmented set
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	} else {
+		// Set foundational collectors
+		mainBundle.Spec.Collectors = troubleshootCollectors
+	}
+
+	klog.V(2).Infof("Auto-discovery complete: %d collectors configured", len(troubleshootCollectors))
+	return nil
+}
+
+// convertToCollectorSpecs converts troubleshootv1beta2.Collect to autodiscovery.CollectorSpec
+func convertToCollectorSpecs(collectors []*troubleshootv1beta2.Collect) ([]autodiscovery.CollectorSpec, error) {
+	var specs []autodiscovery.CollectorSpec
+
+	for i, collect := range collectors {
+		// Determine collector type and extract relevant information
+		spec := autodiscovery.CollectorSpec{
+			Priority: 100, // High priority for YAML specs
+			Source:   autodiscovery.SourceYAML,
+		}
+
+		// Map troubleshoot collectors to autodiscovery types
+		switch {
+		case collect.Logs != nil:
+			spec.Type = autodiscovery.CollectorTypeLogs
+			spec.Name = fmt.Sprintf("yaml-logs-%d", i)
+			spec.Namespace = collect.Logs.Namespace
+			spec.Spec = collect.Logs
+		case collect.ConfigMap != nil:
+			spec.Type = autodiscovery.CollectorTypeConfigMaps
+			spec.Name = fmt.Sprintf("yaml-configmap-%d", i)
+			spec.Namespace = collect.ConfigMap.Namespace
+			spec.Spec = collect.ConfigMap
+		case collect.Secret != nil:
+			spec.Type = autodiscovery.CollectorTypeSecrets
+			spec.Name = fmt.Sprintf("yaml-secret-%d", i)
+			spec.Namespace = collect.Secret.Namespace
+			spec.Spec = collect.Secret
+		case collect.ClusterInfo != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterInfo
+			spec.Name = fmt.Sprintf("yaml-clusterinfo-%d", i)
+			spec.Spec = collect.ClusterInfo
+		case collect.ClusterResources != nil:
+			spec.Type = autodiscovery.CollectorTypeClusterResources
+			spec.Name = fmt.Sprintf("yaml-clusterresources-%d", i)
+			spec.Spec = collect.ClusterResources
+		default:
+			// For other collector types, create a generic spec
+			spec.Type = "other"
+			spec.Name = fmt.Sprintf("yaml-other-%d", i)
+			spec.Spec = collect
+		}
+
+		specs = append(specs, spec)
+	}
+
+	return specs, nil
+}
+
+// convertToTroubleshootCollectors converts autodiscovery.CollectorSpec to troubleshootv1beta2.Collect
+func convertToTroubleshootCollectors(collectors []autodiscovery.CollectorSpec) ([]*troubleshootv1beta2.Collect, error) {
+	var troubleshootCollectors []*troubleshootv1beta2.Collect
+
+	for _, spec := range collectors {
+		collect, err := spec.ToTroubleshootCollect()
+		if err != nil {
+			klog.Warningf("Failed to convert collector spec %s: %v", spec.Name, err)
+			continue
+		}
+		troubleshootCollectors = append(troubleshootCollectors, collect)
+	}
+
+	return troubleshootCollectors, nil
+}
+
+// ValidateAutoDiscoveryFlags validates auto-discovery flag combinations
+func ValidateAutoDiscoveryFlags(v *viper.Viper) error {
+	// If include-images is used without auto, it's an error
+	if v.GetBool("include-images") && !v.GetBool("auto") {
+		return errors.New("--include-images flag requires --auto flag to be enabled")
+	}
+
+	// Validate discovery profile
+	profile := v.GetString("discovery-profile")
+	profiles := GetDiscoveryProfiles()
+	if _, exists := profiles[profile]; !exists {
+		return fmt.Errorf("unknown discovery profile: %s. Available profiles: minimal, standard, comprehensive, paranoid", profile)
+	}
+
+	// Validate namespace patterns
+	includeNS := v.GetStringSlice("include-namespaces")
+	excludeNS := v.GetStringSlice("exclude-namespaces")
+
+	if len(includeNS) > 0 && len(excludeNS) > 0 {
+		klog.Warning("Both include-namespaces and exclude-namespaces specified. Include patterns take precedence")
+	}
+
+	return nil
+}
+
+// ShouldUseAutoDiscovery determines if auto-discovery should be used
+func ShouldUseAutoDiscovery(v *viper.Viper, args []string) bool {
+	// Auto-discovery is enabled by the --auto flag
+	autoEnabled := v.GetBool("auto")
+
+	if !autoEnabled {
+		return false
+	}
+
+	// Auto-discovery can be used with or without YAML specs
+	return true
+}
+
+// GetAutoDiscoveryMode returns the auto-discovery mode based on arguments
+func GetAutoDiscoveryMode(args []string, autoEnabled bool) string {
+	if !autoEnabled {
+		return "disabled"
+	}
+
+	if len(args) == 0 {
+		return "foundational-only" // Path 1
+	}
+
+	return "yaml-augmented" // Path 2
+}
+
+// CreateImageCollectionOptions creates image collection options from CLI config
+func CreateImageCollectionOptions(config AutoDiscoveryConfig) images.CollectionOptions {
+	options := images.GetDefaultCollectionOptions()
+
+	// Configure based on profile and flags
+	profiles := GetDiscoveryProfiles()
+	if profile, exists := profiles[config.Profile]; exists {
+		options.Timeout = profile.Timeout
+		options.IncludeConfig = profile.Name == "comprehensive" || profile.Name == "paranoid"
+		options.IncludeLayers = profile.Name == "paranoid"
+	}
+
+	// Override based on explicit flags
+	if config.Timeout > 0 {
+		options.Timeout = config.Timeout
+	}
+
+	// For auto-discovery, always continue on error to maximize collection
+	options.ContinueOnError = true
+	options.EnableCache = true
+
+	return options
+}
+
+// PrintAutoDiscoveryInfo prints information about auto-discovery configuration
+func PrintAutoDiscoveryInfo(config AutoDiscoveryConfig, mode string) {
+	if !config.Enabled {
+		return
+	}
+
+	fmt.Printf("Auto-discovery enabled (mode: %s, profile: %s)\n", mode, config.Profile)
+
+	if config.IncludeImages {
+		fmt.Println("  - Container image metadata collection enabled")
+	}
+
+	if len(config.IncludeNamespaces) > 0 {
+		fmt.Printf("  - Including namespaces: %v\n", config.IncludeNamespaces)
+	}
+
+	if len(config.ExcludeNamespaces) > 0 {
+		fmt.Printf("  - Excluding namespaces: %v\n", config.ExcludeNamespaces)
+	}
+
+	if config.IncludeSystemNamespaces {
+		fmt.Println("  - System namespaces included")
+	}
+
+	fmt.Printf("  - RBAC checking: %t\n", config.RBACCheck)
+}

cmd/troubleshoot/cli/auto_discovery_test.go

@@ -0,0 +1,389 @@
+package cli
+
+import (
+	"testing"
+	"time"
+
+	troubleshootv1beta2 "github.com/replicatedhq/troubleshoot/pkg/apis/troubleshoot/v1beta2"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/autodiscovery"
+	"github.com/replicatedhq/troubleshoot/pkg/collect/images"
+	"github.com/spf13/viper"
+)
+
+func TestGetAutoDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		viperSetup  func(*viper.Viper)
+		wantEnabled bool
+		wantImages  bool
+		wantRBAC    bool
+		wantProfile string
+	}{
+		{
+			name: "default config",
+			viperSetup: func(v *viper.Viper) {
+				// No flags set, should use defaults
+			},
+			wantEnabled: false,
+			wantImages:  false,
+			wantRBAC:    true, // Default is true
+			wantProfile: "standard",
+		},
+		{
+			name: "auto enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "auto with images",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+			},
+			wantEnabled: true,
+			wantImages:  true,
+			wantRBAC:    true,
+			wantProfile: "standard",
+		},
+		{
+			name: "comprehensive profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "comprehensive")
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    true,
+			wantProfile: "comprehensive",
+		},
+		{
+			name: "rbac disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("rbac-check", false)
+			},
+			wantEnabled: true,
+			wantImages:  false,
+			wantRBAC:    false,
+			wantProfile: "standard",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test-specific setup
+			tt.viperSetup(v)
+
+			config := GetAutoDiscoveryConfig(v)
+
+			if config.Enabled != tt.wantEnabled {
+				t.Errorf("GetAutoDiscoveryConfig() enabled = %v, want %v", config.Enabled, tt.wantEnabled)
+			}
+			if config.IncludeImages != tt.wantImages {
+				t.Errorf("GetAutoDiscoveryConfig() includeImages = %v, want %v", config.IncludeImages, tt.wantImages)
+			}
+			if config.RBACCheck != tt.wantRBAC {
+				t.Errorf("GetAutoDiscoveryConfig() rbacCheck = %v, want %v", config.RBACCheck, tt.wantRBAC)
+			}
+			if config.Profile != tt.wantProfile {
+				t.Errorf("GetAutoDiscoveryConfig() profile = %v, want %v", config.Profile, tt.wantProfile)
+			}
+		})
+	}
+}
+
+func TestGetDiscoveryProfiles(t *testing.T) {
+	profiles := GetDiscoveryProfiles()
+
+	requiredProfiles := []string{"minimal", "standard", "comprehensive", "paranoid"}
+	for _, profileName := range requiredProfiles {
+		if profile, exists := profiles[profileName]; !exists {
+			t.Errorf("Missing required discovery profile: %s", profileName)
+		} else {
+			if profile.Name != profileName {
+				t.Errorf("Profile %s has wrong name: %s", profileName, profile.Name)
+			}
+			if profile.Description == "" {
+				t.Errorf("Profile %s missing description", profileName)
+			}
+			if profile.Timeout <= 0 {
+				t.Errorf("Profile %s has invalid timeout: %v", profileName, profile.Timeout)
+			}
+		}
+	}
+
+	// Check profile progression (more features as we go up)
+	if profiles["comprehensive"].IncludeImages && !profiles["paranoid"].IncludeImages {
+		t.Error("Paranoid profile should include at least everything comprehensive does")
+	}
+}
+
+func TestValidateAutoDiscoveryFlags(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		wantErr    bool
+	}{
+		{
+			name: "valid auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-images", true)
+				v.Set("discovery-profile", "standard")
+			},
+			wantErr: false,
+		},
+		{
+			name: "include-images without auto",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+				v.Set("include-images", true)
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid discovery profile",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("discovery-profile", "invalid-profile")
+			},
+			wantErr: true,
+		},
+		{
+			name: "no auto discovery",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			wantErr: false,
+		},
+		{
+			name: "both include and exclude namespaces",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+				v.Set("include-namespaces", []string{"app1"})
+				v.Set("exclude-namespaces", []string{"system"})
+			},
+			wantErr: false, // Should warn but not error
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+
+			// Set defaults
+			v.SetDefault("rbac-check", true)
+			v.SetDefault("discovery-profile", "standard")
+
+			// Apply test setup
+			tt.viperSetup(v)
+
+			err := ValidateAutoDiscoveryFlags(v)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateAutoDiscoveryFlags() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestShouldUseAutoDiscovery(t *testing.T) {
+	tests := []struct {
+		name       string
+		viperSetup func(*viper.Viper)
+		args       []string
+		want       bool
+	}{
+		{
+			name: "auto flag enabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{},
+			want: true,
+		},
+		{
+			name: "auto flag disabled",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", false)
+			},
+			args: []string{},
+			want: false,
+		},
+		{
+			name: "auto with yaml args",
+			viperSetup: func(v *viper.Viper) {
+				v.Set("auto", true)
+			},
+			args: []string{"spec.yaml"},
+			want: true,
+		},
+		{
+			name: "no auto flag",
+			viperSetup: func(v *viper.Viper) {
+				// No auto flag set
+			},
+			args: []string{"spec.yaml"},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			v := viper.New()
+			tt.viperSetup(v)
+
+			got := ShouldUseAutoDiscovery(v, tt.args)
+			if got != tt.want {
+				t.Errorf("ShouldUseAutoDiscovery() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetAutoDiscoveryMode(t *testing.T) {
+	tests := []struct {
+		name        string
+		args        []string
+		autoEnabled bool
+		want        string
+	}{
+		{
+			name:        "foundational only",
+			args:        []string{},
+			autoEnabled: true,
+			want:        "foundational-only",
+		},
+		{
+			name:        "yaml augmented",
+			args:        []string{"spec.yaml"},
+			autoEnabled: true,
+			want:        "yaml-augmented",
+		},
+		{
+			name:        "disabled",
+			args:        []string{},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+		{
+			name:        "disabled with args",
+			args:        []string{"spec.yaml"},
+			autoEnabled: false,
+			want:        "disabled",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := GetAutoDiscoveryMode(tt.args, tt.autoEnabled)
+			if got != tt.want {
+				t.Errorf("GetAutoDiscoveryMode() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateImageCollectionOptions(t *testing.T) {
+	tests := []struct {
+		name      string
+		config    AutoDiscoveryConfig
+		checkFunc func(t *testing.T, opts images.CollectionOptions)
+	}{
+		{
+			name: "standard profile",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 30*time.Second {
+					t.Errorf("Expected standard profile timeout 30s, got %v", opts.Timeout)
+				}
+				if !opts.ContinueOnError {
+					t.Error("Should continue on error for auto-discovery")
+				}
+			},
+		},
+		{
+			name: "comprehensive profile",
+			config: AutoDiscoveryConfig{
+				Profile: "comprehensive",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 60*time.Second {
+					t.Errorf("Expected comprehensive profile timeout 60s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeConfig {
+					t.Error("Comprehensive profile should include config")
+				}
+			},
+		},
+		{
+			name: "paranoid profile",
+			config: AutoDiscoveryConfig{
+				Profile: "paranoid",
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 120*time.Second {
+					t.Errorf("Expected paranoid profile timeout 120s, got %v", opts.Timeout)
+				}
+				if !opts.IncludeLayers {
+					t.Error("Paranoid profile should include layers")
+				}
+			},
+		},
+		{
+			name: "custom timeout",
+			config: AutoDiscoveryConfig{
+				Profile: "standard",
+				Timeout: 45 * time.Second,
+			},
+			checkFunc: func(t *testing.T, opts images.CollectionOptions) {
+				if opts.Timeout != 45*time.Second {
+					t.Errorf("Expected custom timeout 45s, got %v", opts.Timeout)
+				}
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := CreateImageCollectionOptions(tt.config)
+			tt.checkFunc(t, opts)
+		})
+	}
+}
+
+func TestConvertToCollectorSpecs(t *testing.T) {
+	// This test would need actual troubleshootv1beta2.Collect instances
+	// For now, test with nil input
+	specs, err := convertToCollectorSpecs([]*troubleshootv1beta2.Collect{})
+	if err != nil {
+		t.Errorf("convertToCollectorSpecs() with empty input should not error: %v", err)
+	}
+	if len(specs) != 0 {
+		t.Errorf("convertToCollectorSpecs() with empty input should return empty slice, got %d items", len(specs))
+	}
+}
+
+func TestConvertToTroubleshootCollectors(t *testing.T) {
+	// This test would need actual autodiscovery.CollectorSpec instances
+	// For now, test with nil input
+	collectors, err := convertToTroubleshootCollectors([]autodiscovery.CollectorSpec{})
+	if err != nil {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should not error: %v", err)
+	}
+	if len(collectors) != 0 {
+		t.Errorf("convertToTroubleshootCollectors() with empty input should return empty slice, got %d items", len(collectors))
+	}
+}

cmd/troubleshoot/cli/diff.go

@@ -0,0 +1,848 @@
+package cli
+
+import (
+	"archive/tar"
+	"bufio"
+	"compress/gzip"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+	"github.com/pmezard/go-difflib/difflib"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"k8s.io/klog/v2"
+)
+
+const maxInlineDiffBytes = 256 * 1024
+
+// DiffResult represents the result of comparing two support bundles
+type DiffResult struct {
+	Summary      DiffSummary  `json:"summary"`
+	Changes      []Change     `json:"changes"`
+	Metadata     DiffMetadata `json:"metadata"`
+	Significance string       `json:"significance"`
+}
+
+// DiffSummary provides high-level statistics about the diff
+type DiffSummary struct {
+	TotalChanges      int `json:"totalChanges"`
+	FilesAdded        int `json:"filesAdded"`
+	FilesRemoved      int `json:"filesRemoved"`
+	FilesModified     int `json:"filesModified"`
+	HighImpactChanges int `json:"highImpactChanges"`
+}
+
+// Change represents a single difference between bundles
+type Change struct {
+	Type        string                 `json:"type"`     // added, removed, modified
+	Category    string                 `json:"category"` // resource, log, config, etc.
+	Path        string                 `json:"path"`     // file path or resource path
+	Impact      string                 `json:"impact"`   // high, medium, low, none
+	Details     map[string]interface{} `json:"details"`  // change-specific details
+	Remediation *RemediationStep       `json:"remediation,omitempty"`
+}
+
+// RemediationStep represents a suggested remediation action
+type RemediationStep struct {
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	Command     string `json:"command,omitempty"`
+	URL         string `json:"url,omitempty"`
+}
+
+// DiffMetadata contains metadata about the diff operation
+type DiffMetadata struct {
+	OldBundle   BundleMetadata `json:"oldBundle"`
+	NewBundle   BundleMetadata `json:"newBundle"`
+	GeneratedAt string         `json:"generatedAt"`
+	Version     string         `json:"version"`
+}
+
+// BundleMetadata contains metadata about a support bundle
+type BundleMetadata struct {
+	Path      string `json:"path"`
+	Size      int64  `json:"size"`
+	CreatedAt string `json:"createdAt,omitempty"`
+	NumFiles  int    `json:"numFiles"`
+}
+
+func Diff() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "diff <old-bundle.(tar.gz|tgz)> <new-bundle.(tar.gz|tgz)>",
+		Args:  cobra.ExactArgs(2),
+		Short: "Compare two support bundles and identify changes",
+		Long: `Compare two support bundles to identify changes over time.
+This command analyzes differences between two support bundle archives and generates
+a human-readable report showing what has changed, including:
+
+- Added, removed, or modified files
+- Configuration changes
+- Log differences
+- Resource status changes
+- Performance metric changes
+
+Use -o to write the report to a file; otherwise it prints to stdout.`,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			v := viper.GetViper()
+			return runBundleDiff(v, args[0], args[1])
+		},
+	}
+
+	cmd.Flags().StringP("output", "o", "", "file path of where to save the diff report (default prints to stdout)")
+	cmd.Flags().Int("max-diff-lines", 200, "maximum total lines to include in an inline diff for a single file")
+	cmd.Flags().Int("max-diff-files", 50, "maximum number of files to include inline diffs for; additional modified files will omit inline diffs")
+	cmd.Flags().Bool("include-log-diffs", false, "include inline diffs for log files as well")
+	cmd.Flags().Int("diff-context", 3, "number of context lines to include around changes in unified diffs")
+	cmd.Flags().Bool("hide-inline-diffs", false, "hide inline unified diffs in the report")
+	cmd.Flags().String("format", "", "output format; set to 'json' to emit machine-readable JSON to stdout or -o")
+
+	return cmd
+}
+
+func runBundleDiff(v *viper.Viper, oldBundle, newBundle string) error {
+	klog.V(2).Infof("Comparing support bundles: %s -> %s", oldBundle, newBundle)
+
+	// Validate input files
+	if err := validateBundleFile(oldBundle); err != nil {
+		return errors.Wrap(err, "invalid old bundle")
+	}
+	if err := validateBundleFile(newBundle); err != nil {
+		return errors.Wrap(err, "invalid new bundle")
+	}
+
+	// Perform the diff (placeholder implementation)
+	diffResult, err := performBundleDiff(oldBundle, newBundle, v)
+	if err != nil {
+		return errors.Wrap(err, "failed to compare bundles")
+	}
+
+	// Output the results
+	if err := outputDiffResult(diffResult, v); err != nil {
+		return errors.Wrap(err, "failed to output diff results")
+	}
+
+	return nil
+}
+
+func validateBundleFile(bundlePath string) error {
+	if bundlePath == "" {
+		return errors.New("bundle path cannot be empty")
+	}
+
+	// Check if file exists
+	if _, err := os.Stat(bundlePath); os.IsNotExist(err) {
+		return fmt.Errorf("bundle file not found: %s", bundlePath)
+	}
+
+	// Support .tar.gz and .tgz bundles
+	lower := strings.ToLower(bundlePath)
+	if !(strings.HasSuffix(lower, ".tar.gz") || strings.HasSuffix(lower, ".tgz")) {
+		return fmt.Errorf("unsupported bundle format. Expected path to end with .tar.gz or .tgz")
+	}
+
+	return nil
+}
+
+func performBundleDiff(oldBundle, newBundle string, v *viper.Viper) (*DiffResult, error) {
+	klog.V(2).Info("Performing bundle diff analysis (streaming)...")
+
+	// Stream inventories
+	oldInv, err := buildInventoryFromTarGz(oldBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory old bundle")
+	}
+	newInv, err := buildInventoryFromTarGz(newBundle)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to inventory new bundle")
+	}
+
+	var changes []Change
+	inlineDiffsIncluded := 0
+	maxDiffLines := v.GetInt("max-diff-lines")
+	if maxDiffLines <= 0 {
+		maxDiffLines = 200
+	}
+	maxDiffFiles := v.GetInt("max-diff-files")
+	if maxDiffFiles <= 0 {
+		maxDiffFiles = 50
+	}
+	includeLogDiffs := v.GetBool("include-log-diffs")
+	diffContext := v.GetInt("diff-context")
+	if diffContext <= 0 {
+		diffContext = 3
+	}
+
+	// Added files
+	for p, nf := range newInv {
+		if _, ok := oldInv[p]; !ok {
+			ch := Change{
+				Type:     "added",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("added", p),
+				Details: map[string]interface{}{
+					"size": nf.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Removed files
+	for p, of := range oldInv {
+		if _, ok := newInv[p]; !ok {
+			ch := Change{
+				Type:     "removed",
+				Category: categorizePath(p),
+				Path:     "/" + p,
+				Impact:   estimateImpact("removed", p),
+				Details: map[string]interface{}{
+					"size": of.Size,
+				},
+			}
+			if rem := suggestRemediation(ch.Type, p); rem != nil {
+				ch.Remediation = rem
+			}
+			changes = append(changes, ch)
+		}
+	}
+
+	// Modified files
+	for p, of := range oldInv {
+		if nf, ok := newInv[p]; ok {
+			if of.Digest != nf.Digest {
+				ch := Change{
+					Type:     "modified",
+					Category: categorizePath(p),
+					Path:     "/" + p,
+					Impact:   estimateImpact("modified", p),
+					Details:  map[string]interface{}{},
+				}
+				if rem := suggestRemediation(ch.Type, p); rem != nil {
+					ch.Remediation = rem
+				}
+				changes = append(changes, ch)
+			}
+		}
+	}
+
+	// Sort changes deterministically: type, then path
+	sort.Slice(changes, func(i, j int) bool {
+		if changes[i].Type == changes[j].Type {
+			return changes[i].Path < changes[j].Path
+		}
+		return changes[i].Type < changes[j].Type
+	})
+
+	// Populate inline diffs lazily for the first N eligible modified files using streaming approach
+	for i := range changes {
+		if inlineDiffsIncluded >= maxDiffFiles {
+			break
+		}
+		ch := &changes[i]
+		if ch.Type != "modified" {
+			continue
+		}
+		allowLogs := includeLogDiffs || ch.Category != "logs"
+		if !allowLogs {
+			continue
+		}
+		// Use streaming diff generation to avoid loading large files into memory
+		if d := generateStreamingUnifiedDiff(oldBundle, newBundle, ch.Path, diffContext, maxDiffLines); d != "" {
+			if ch.Details == nil {
+				ch.Details = map[string]interface{}{}
+			}
+			ch.Details["diff"] = d
+			inlineDiffsIncluded++
+		}
+	}
+
+	// Summaries
+	summary := DiffSummary{}
+	for _, c := range changes {
+		switch c.Type {
+		case "added":
+			summary.FilesAdded++
+		case "removed":
+			summary.FilesRemoved++
+		case "modified":
+			summary.FilesModified++
+		}
+		if c.Impact == "high" {
+			summary.HighImpactChanges++
+		}
+	}
+	summary.TotalChanges = summary.FilesAdded + summary.FilesRemoved + summary.FilesModified
+
+	oldMeta := getBundleMetadataWithCount(oldBundle, len(oldInv))
+	newMeta := getBundleMetadataWithCount(newBundle, len(newInv))
+
+	result := &DiffResult{
+		Summary:      summary,
+		Changes:      changes,
+		Metadata:     DiffMetadata{OldBundle: oldMeta, NewBundle: newMeta, GeneratedAt: time.Now().Format(time.RFC3339), Version: "v1"},
+		Significance: computeOverallSignificance(changes),
+	}
+	return result, nil
+}
+
+type inventoryFile struct {
+	Size   int64
+	Digest string
+}
+
+func buildInventoryFromTarGz(bundlePath string) (map[string]inventoryFile, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to open bundle")
+	}
+	defer f.Close()
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to create gzip reader")
+	}
+	defer gz.Close()
+
+	tr := tar.NewReader(gz)
+	inv := make(map[string]inventoryFile)
+
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to read tar entry")
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+
+		norm := normalizePath(hdr.Name)
+		if norm == "" {
+			continue
+		}
+
+		h := sha256.New()
+		var copied int64
+		buf := make([]byte, 32*1024)
+		for copied < hdr.Size {
+			toRead := int64(len(buf))
+			if remain := hdr.Size - copied; remain < toRead {
+				toRead = remain
+			}
+			n, rerr := io.ReadFull(tr, buf[:toRead])
+			if n > 0 {
+				_, _ = h.Write(buf[:n])
+				copied += int64(n)
+			}
+			if rerr == io.EOF || rerr == io.ErrUnexpectedEOF {
+				break
+			}
+			if rerr != nil {
+				return nil, errors.Wrap(rerr, "failed to read file content")
+			}
+		}
+
+		digest := hex.EncodeToString(h.Sum(nil))
+		inv[norm] = inventoryFile{Size: hdr.Size, Digest: digest}
+	}
+
+	return inv, nil
+}
+
+func normalizePath(name string) string {
+	name = strings.TrimPrefix(name, "./")
+	if name == "" {
+		return name
+	}
+	i := strings.IndexByte(name, '/')
+	if i < 0 {
+		return name
+	}
+	first := name[:i]
+	rest := name[i+1:]
+
+	// Known domain roots we do not strip
+	domainRoots := map[string]bool{
+		"cluster-resources": true,
+		"all-logs":          true,
+		"cluster-info":      true,
+		"execution-data":    true,
+	}
+	if domainRoots[first] {
+		return name
+	}
+	// Strip only known container prefixes
+	if first == "root" || strings.HasPrefix(strings.ToLower(first), "support-bundle") {
+		return rest
+	}
+	return name
+}
+
+func isProbablyText(sample []byte) bool {
+	if len(sample) == 0 {
+		return false
+	}
+	for _, b := range sample {
+		if b == 0x00 {
+			return false
+		}
+		if b < 0x09 {
+			return false
+		}
+	}
+	return true
+}
+
+func normalizeNewlines(s string) string {
+	return strings.ReplaceAll(s, "\r\n", "\n")
+}
+
+// generateStreamingUnifiedDiff creates a unified diff by streaming files line-by-line to avoid loading large files into memory
+func generateStreamingUnifiedDiff(oldBundle, newBundle, path string, context, maxTotalLines int) string {
+	oldReader, err := createTarFileReader(oldBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer oldReader.Close()
+
+	newReader, err := createTarFileReader(newBundle, strings.TrimPrefix(path, "/"))
+	if err != nil {
+		return ""
+	}
+	defer newReader.Close()
+
+	// Read files line by line
+	oldLines, err := readLinesFromReader(oldReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	newLines, err := readLinesFromReader(newReader, maxInlineDiffBytes)
+	if err != nil {
+		return ""
+	}
+
+	// Generate diff using the existing difflib
+	ud := difflib.UnifiedDiff{
+		A:        oldLines,
+		B:        newLines,
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+// readLinesFromReader reads lines from a reader up to maxBytes total, returning normalized lines
+func readLinesFromReader(reader io.Reader, maxBytes int) ([]string, error) {
+	var lines []string
+	var totalBytes int
+	scanner := bufio.NewScanner(reader)
+
+	for scanner.Scan() {
+		line := normalizeNewlines(scanner.Text())
+		lineWithNL := line + "\n"
+		lineBytes := len(lineWithNL)
+
+		if totalBytes+lineBytes > maxBytes {
+			lines = append(lines, "... (content truncated due to size)\n")
+			break
+		}
+
+		lines = append(lines, lineWithNL)
+		totalBytes += lineBytes
+	}
+
+	if err := scanner.Err(); err != nil {
+		return nil, err
+	}
+
+	return lines, nil
+}
+
+// generateUnifiedDiff builds a unified diff with headers and context, then truncates to maxTotalLines
+func generateUnifiedDiff(a, b string, path string, context, maxTotalLines int) string {
+	ud := difflib.UnifiedDiff{
+		A:        difflib.SplitLines(a),
+		B:        difflib.SplitLines(b),
+		FromFile: "old:" + path,
+		ToFile:   "new:" + path,
+		Context:  context,
+	}
+	s, err := difflib.GetUnifiedDiffString(ud)
+	if err != nil || s == "" {
+		return ""
+	}
+	lines := strings.Split(s, "\n")
+	if maxTotalLines > 0 && len(lines) > maxTotalLines {
+		lines = append(lines[:maxTotalLines], "... (diff truncated)")
+	}
+	if len(lines) > 0 && lines[len(lines)-1] == "" {
+		lines = lines[:len(lines)-1]
+	}
+	return strings.Join(lines, "\n")
+}
+
+func categorizePath(p string) string {
+	if strings.HasPrefix(p, "cluster-resources/pods/logs/") || strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") || strings.HasPrefix(p, "logs/") {
+		return "logs"
+	}
+	if strings.HasPrefix(p, "cluster-resources/") {
+		rest := strings.TrimPrefix(p, "cluster-resources/")
+		seg := rest
+		if i := strings.IndexByte(rest, '/'); i >= 0 {
+			seg = rest[:i]
+		}
+		if seg == "" {
+			return "resources"
+		}
+		return "resources:" + seg
+	}
+	if strings.HasPrefix(p, "config/") || strings.HasSuffix(p, ".yaml") || strings.HasSuffix(p, ".yml") || strings.HasSuffix(p, ".json") {
+		return "config"
+	}
+	return "files"
+}
+
+// estimateImpact determines impact based on change type and path patterns
+func estimateImpact(changeType, p string) string {
+	// High impact cases
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		if changeType == "removed" || changeType == "modified" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		if changeType != "added" { // reductions or changes can break access
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/secrets/") || strings.HasSuffix(p, "-secrets.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		if changeType != "added" { // node status changes can be severe
+			return "high"
+		}
+	}
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	if strings.HasPrefix(p, "cluster-resources/") && strings.Contains(p, "/kube-system") {
+		if changeType != "added" {
+			return "high"
+		}
+	}
+	// Medium default for cluster resources
+	if strings.HasPrefix(p, "cluster-resources/") {
+		return "medium"
+	}
+	// Logs and others default low
+	if strings.Contains(p, "/logs/") || strings.HasPrefix(p, "all-logs/") {
+		return "low"
+	}
+	return "low"
+}
+
+// suggestRemediation returns a basic remediation suggestion based on category and change
+func suggestRemediation(changeType, p string) *RemediationStep {
+	// RBAC
+	if strings.HasPrefix(p, "cluster-resources/clusterrole") || strings.HasPrefix(p, "cluster-resources/clusterrolebindings") || strings.Contains(p, "/rolebindings/") {
+		return &RemediationStep{Description: "Validate RBAC permissions and recent changes", Command: "kubectl auth can-i --list"}
+	}
+	// CRDs
+	if strings.HasPrefix(p, "cluster-resources/custom-resource-definitions") {
+		return &RemediationStep{Description: "Check CRD presence and reconcile operator status", Command: "kubectl get crds"}
+	}
+	// Nodes
+	if strings.HasPrefix(p, "cluster-resources/nodes") {
+		return &RemediationStep{Description: "Inspect node conditions and recent events", Command: "kubectl describe nodes"}
+	}
+	// Network policy
+	if strings.Contains(p, "/network-policy/") || strings.HasSuffix(p, "/networkpolicies.json") {
+		return &RemediationStep{Description: "Validate connectivity and recent NetworkPolicy changes", Command: "kubectl get networkpolicy -A"}
+	}
+	// Secrets/Config
+	if strings.Contains(p, "/secrets/") || strings.HasPrefix(p, "config/") {
+		return &RemediationStep{Description: "Review configuration or secret changes for correctness"}
+	}
+	// Workloads
+	if strings.Contains(p, "/deployments/") || strings.Contains(p, "/statefulsets/") || strings.Contains(p, "/daemonsets/") {
+		return &RemediationStep{Description: "Check rollout and pod status", Command: "kubectl rollout status -n <ns> <kind>/<name>"}
+	}
+	return nil
+}
+
+func computeOverallSignificance(changes []Change) string {
+	high, medium := 0, 0
+	for _, c := range changes {
+		switch c.Impact {
+		case "high":
+			high++
+		case "medium":
+			medium++
+		}
+	}
+	if high > 0 {
+		return "high"
+	}
+	if medium > 0 {
+		return "medium"
+	}
+	if len(changes) > 0 {
+		return "low"
+	}
+	return "none"
+}
+
+func getBundleMetadata(bundlePath string) BundleMetadata {
+	metadata := BundleMetadata{
+		Path: bundlePath,
+	}
+
+	if stat, err := os.Stat(bundlePath); err == nil {
+		metadata.Size = stat.Size()
+		metadata.CreatedAt = stat.ModTime().Format(time.RFC3339)
+	}
+
+	return metadata
+}
+
+// getBundleMetadataWithCount sets NumFiles directly to avoid re-reading the archive
+func getBundleMetadataWithCount(bundlePath string, numFiles int) BundleMetadata {
+	md := getBundleMetadata(bundlePath)
+	md.NumFiles = numFiles
+	return md
+}
+
+func outputDiffResult(result *DiffResult, v *viper.Viper) error {
+	outputPath := v.GetString("output")
+	showInlineDiffs := !v.GetBool("hide-inline-diffs")
+	formatMode := strings.ToLower(v.GetString("format"))
+
+	var output []byte
+	if formatMode == "json" {
+		data, err := json.MarshalIndent(result, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "failed to marshal diff result to JSON")
+		}
+		output = data
+	} else {
+		output = []byte(generateTextDiffReport(result, showInlineDiffs))
+	}
+
+	if outputPath != "" {
+		// Write to file
+		if err := os.WriteFile(outputPath, output, 0644); err != nil {
+			return errors.Wrap(err, "failed to write diff output to file")
+		}
+		fmt.Printf("Diff report written to: %s\n", outputPath)
+	} else {
+		// Write to stdout
+		fmt.Print(string(output))
+	}
+
+	return nil
+}
+
+func generateTextDiffReport(result *DiffResult, showInlineDiffs bool) string {
+	var report strings.Builder
+
+	report.WriteString("Support Bundle Diff Report\n")
+	report.WriteString("==========================\n\n")
+
+	report.WriteString(fmt.Sprintf("Generated: %s\n", result.Metadata.GeneratedAt))
+	report.WriteString(fmt.Sprintf("Old Bundle: %s (%s)\n", result.Metadata.OldBundle.Path, formatSize(result.Metadata.OldBundle.Size)))
+	report.WriteString(fmt.Sprintf("New Bundle: %s (%s)\n\n", result.Metadata.NewBundle.Path, formatSize(result.Metadata.NewBundle.Size)))
+
+	// Summary
+	report.WriteString("Summary:\n")
+	report.WriteString(fmt.Sprintf("  Total Changes: %d\n", result.Summary.TotalChanges))
+	report.WriteString(fmt.Sprintf("  Files Added: %d\n", result.Summary.FilesAdded))
+	report.WriteString(fmt.Sprintf("  Files Removed: %d\n", result.Summary.FilesRemoved))
+	report.WriteString(fmt.Sprintf("  Files Modified: %d\n", result.Summary.FilesModified))
+	report.WriteString(fmt.Sprintf("  High Impact Changes: %d\n", result.Summary.HighImpactChanges))
+	report.WriteString(fmt.Sprintf("  Significance: %s\n\n", result.Significance))
+
+	if len(result.Changes) == 0 {
+		report.WriteString("No changes detected between bundles.\n")
+	} else {
+		report.WriteString("Changes:\n")
+		for i, change := range result.Changes {
+			report.WriteString(fmt.Sprintf("  %d. [%s] %s (%s impact)\n",
+				i+1, strings.ToUpper(change.Type), change.Path, change.Impact))
+			if change.Remediation != nil {
+				report.WriteString(fmt.Sprintf("     Remediation: %s\n", change.Remediation.Description))
+			}
+			if showInlineDiffs {
+				if diffStr, ok := change.Details["diff"].(string); ok && diffStr != "" {
+					report.WriteString("     Diff:\n")
+					for _, line := range strings.Split(diffStr, "\n") {
+						report.WriteString("       " + line + "\n")
+					}
+				}
+			}
+		}
+	}
+
+	return report.String()
+}
+
+func formatSize(bytes int64) string {
+	const unit = 1024
+	if bytes < unit {
+		return fmt.Sprintf("%d B", bytes)
+	}
+	div, exp := int64(unit), 0
+	for n := bytes / unit; n >= unit; n /= unit {
+		div *= unit
+		exp++
+	}
+	return fmt.Sprintf("%.1f %ciB", float64(bytes)/float64(div), "KMGTPE"[exp])
+}
+
+// tarFileReader provides a streaming interface to read a specific file from a tar.gz archive
+type tarFileReader struct {
+	file   *os.File
+	gz     *gzip.Reader
+	tr     *tar.Reader
+	found  bool
+	header *tar.Header
+}
+
+// createTarFileReader creates a streaming reader for a specific file in a tar.gz archive
+func createTarFileReader(bundlePath, normalizedPath string) (*tarFileReader, error) {
+	f, err := os.Open(bundlePath)
+	if err != nil {
+		return nil, err
+	}
+
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+
+	tr := tar.NewReader(gz)
+
+	// Find the target file
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			gz.Close()
+			f.Close()
+			return nil, err
+		}
+		if !hdr.FileInfo().Mode().IsRegular() {
+			continue
+		}
+		if normalizePath(hdr.Name) == normalizedPath {
+			// Check if file is probably text
+			sample := make([]byte, 512)
+			n, _ := io.ReadFull(tr, sample[:])
+			if n > 0 && !isProbablyText(sample[:n]) {
+				gz.Close()
+				f.Close()
+				return nil, fmt.Errorf("file is not text")
+			}
+
+			// Reopen to start from beginning of file
+			gz.Close()
+			f.Close()
+
+			f, err = os.Open(bundlePath)
+			if err != nil {
+				return nil, err
+			}
+			gz, err = gzip.NewReader(f)
+			if err != nil {
+				f.Close()
+				return nil, err
+			}
+			tr = tar.NewReader(gz)
+
+			// Find the file again
+			for {
+				hdr, err = tr.Next()
+				if err == io.EOF {
+					gz.Close()
+					f.Close()
+					return nil, fmt.Errorf("file not found on second pass")
+				}
+				if err != nil {
+					gz.Close()
+					f.Close()
+					return nil, err
+				}
+				if normalizePath(hdr.Name) == normalizedPath {
+					return &tarFileReader{
+						file:   f,
+						gz:     gz,
+						tr:     tr,
+						found:  true,
+						header: hdr,
+					}, nil
+				}
+			}
+		}
+	}
+
+	gz.Close()
+	f.Close()
+	return nil, fmt.Errorf("file not found: %s", normalizedPath)
+}
+
+// Read implements io.Reader interface
+func (r *tarFileReader) Read(p []byte) (n int, err error) {
+	if !r.found {
+		return 0, io.EOF
+	}
+	return r.tr.Read(p)
+}
+
+// Close closes the underlying file handles
+func (r *tarFileReader) Close() error {
+	if r.gz != nil {
+		r.gz.Close()
+	}
+	if r.file != nil {
+		return r.file.Close()
+	}
+	return nil
+}

cmd/troubleshoot/cli/diff_test.go

@@ -0,0 +1,552 @@
+package cli
+
+import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+func TestValidateBundleFile(t *testing.T) {
+	// Create temporary test files
+	tempDir := t.TempDir()
+
+	// Create bundle files
+	validBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	if err := os.WriteFile(validBundle, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	validTgz := filepath.Join(tempDir, "test-bundle.tgz")
+	if err := os.WriteFile(validTgz, []byte("dummy content"), 0644); err != nil {
+		t.Fatalf("Failed to create test tgz bundle: %v", err)
+	}
+
+	tests := []struct {
+		name       string
+		bundlePath string
+		wantErr    bool
+	}{
+		{
+			name:       "valid tar.gz bundle",
+			bundlePath: validBundle,
+			wantErr:    false,
+		},
+		{
+			name:       "valid tgz bundle",
+			bundlePath: validTgz,
+			wantErr:    false,
+		},
+		{
+			name:       "empty path",
+			bundlePath: "",
+			wantErr:    true,
+		},
+		{
+			name:       "non-existent file",
+			bundlePath: "/path/to/nonexistent.tar.gz",
+			wantErr:    true,
+		},
+		{
+			name:       "invalid extension",
+			bundlePath: filepath.Join(tempDir, "invalid.txt"),
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// For invalid extension test, create the file
+			if strings.HasSuffix(tt.bundlePath, "invalid.txt") {
+				os.WriteFile(tt.bundlePath, []byte("content"), 0644)
+			}
+
+			err := validateBundleFile(tt.bundlePath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateBundleFile() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestGetBundleMetadata(t *testing.T) {
+	// Create a temporary test file
+	tempDir := t.TempDir()
+	testBundle := filepath.Join(tempDir, "test-bundle.tar.gz")
+	testContent := []byte("test bundle content")
+
+	if err := os.WriteFile(testBundle, testContent, 0644); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	metadata := getBundleMetadata(testBundle)
+
+	if metadata.Path != testBundle {
+		t.Errorf("getBundleMetadata() path = %v, want %v", metadata.Path, testBundle)
+	}
+
+	if metadata.Size != int64(len(testContent)) {
+		t.Errorf("getBundleMetadata() size = %v, want %v", metadata.Size, len(testContent))
+	}
+
+	if metadata.CreatedAt == "" {
+		t.Error("getBundleMetadata() createdAt should not be empty")
+	}
+
+	// Validate timestamp format
+	if _, err := time.Parse(time.RFC3339, metadata.CreatedAt); err != nil {
+		t.Errorf("getBundleMetadata() createdAt has invalid format: %v", err)
+	}
+}
+
+func TestPerformBundleDiff(t *testing.T) {
+	// Create temporary test bundles
+	tempDir := t.TempDir()
+
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v1\n",
+		"root/logs/app.log":                  "line1\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/cluster-resources/version.txt": "v2\n",
+		"root/logs/app.log":                  "line1\nline2\n",
+		"root/added.txt":                     "new\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	v := viper.New()
+	result, err := performBundleDiff(oldBundle, newBundle, v)
+
+	if err != nil {
+		t.Fatalf("performBundleDiff() error = %v", err)
+	}
+
+	if result == nil {
+		t.Fatal("performBundleDiff() returned nil result")
+	}
+
+	// Verify result structure
+	if result.Metadata.Version != "v1" {
+		t.Errorf("performBundleDiff() version = %v, want v1", result.Metadata.Version)
+	}
+
+	if result.Metadata.OldBundle.Path != oldBundle {
+		t.Errorf("performBundleDiff() old bundle path = %v, want %v", result.Metadata.OldBundle.Path, oldBundle)
+	}
+
+	if result.Metadata.NewBundle.Path != newBundle {
+		t.Errorf("performBundleDiff() new bundle path = %v, want %v", result.Metadata.NewBundle.Path, newBundle)
+	}
+
+	if result.Metadata.GeneratedAt == "" {
+		t.Error("performBundleDiff() generatedAt should not be empty")
+	}
+}
+
+// writeTarGz creates a gzipped tar file at tarPath with the provided files map.
+// Keys are entry names inside the archive, values are file contents.
+func writeTarGz(tarPath string, files map[string]string) error {
+	f, err := os.Create(tarPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	gz := gzip.NewWriter(f)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	for name, content := range files {
+		data := []byte(content)
+		hdr := &tar.Header{
+			Name:     name,
+			Mode:     0644,
+			Size:     int64(len(data)),
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return err
+		}
+		if _, err := bytes.NewReader(data).WriteTo(tw); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func TestGenerateTextDiffReport(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{
+			TotalChanges:      3,
+			FilesAdded:        1,
+			FilesRemoved:      1,
+			FilesModified:     1,
+			HighImpactChanges: 1,
+		},
+		Changes: []Change{
+			{
+				Type:     "added",
+				Category: "config",
+				Path:     "/new-config.yaml",
+				Impact:   "medium",
+				Remediation: &RemediationStep{
+					Description: "Review new configuration",
+				},
+			},
+			{
+				Type:     "removed",
+				Category: "resource",
+				Path:     "/old-deployment.yaml",
+				Impact:   "high",
+			},
+		},
+		Metadata: DiffMetadata{
+			OldBundle: BundleMetadata{
+				Path: "/old/bundle.tar.gz",
+				Size: 1024,
+			},
+			NewBundle: BundleMetadata{
+				Path: "/new/bundle.tar.gz",
+				Size: 2048,
+			},
+			GeneratedAt: "2023-01-01T00:00:00Z",
+		},
+		Significance: "high",
+	}
+
+	report := generateTextDiffReport(result, true)
+
+	// Check that report contains expected elements
+	expectedStrings := []string{
+		"Support Bundle Diff Report",
+		"Total Changes: 3",
+		"Files Added: 1",
+		"High Impact Changes: 1",
+		"Significance: high",
+		"/new-config.yaml",
+		"/old-deployment.yaml",
+		"Remediation: Review new configuration",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(report, expected) {
+			t.Errorf("generateTextDiffReport() missing expected string: %s", expected)
+		}
+	}
+}
+
+func TestOutputDiffResult_JSON(t *testing.T) {
+	// Minimal result
+	result := &DiffResult{
+		Summary: DiffSummary{},
+		Metadata: DiffMetadata{
+			OldBundle:   BundleMetadata{Path: "/old.tar.gz"},
+			NewBundle:   BundleMetadata{Path: "/new.tar.gz"},
+			GeneratedAt: time.Now().Format(time.RFC3339),
+			Version:     "v1",
+		},
+		Changes:      []Change{{Type: "modified", Category: "files", Path: "/a", Impact: "low"}},
+		Significance: "low",
+	}
+
+	v := viper.New()
+	v.Set("format", "json")
+
+	// Write to a temp file via -o to exercise file write path
+	tempDir := t.TempDir()
+	outPath := filepath.Join(tempDir, "diff.json")
+	v.Set("output", outPath)
+
+	if err := outputDiffResult(result, v); err != nil {
+		t.Fatalf("outputDiffResult(json) error = %v", err)
+	}
+
+	data, err := os.ReadFile(outPath)
+	if err != nil {
+		t.Fatalf("failed to read output: %v", err)
+	}
+
+	// Basic JSON sanity checks
+	s := string(data)
+	if !strings.Contains(s, "\"summary\"") || !strings.Contains(s, "\"changes\"") {
+		t.Fatalf("json output missing keys: %s", s)
+	}
+	if !strings.Contains(s, "\"path\": \"/a\"") {
+		t.Fatalf("json output missing change path: %s", s)
+	}
+}
+
+func TestGenerateTextDiffReport_DiffVisibility(t *testing.T) {
+	result := &DiffResult{
+		Summary: DiffSummary{TotalChanges: 1, FilesModified: 1},
+		Changes: []Change{
+			{
+				Type:     "modified",
+				Category: "files",
+				Path:     "/path.txt",
+				Impact:   "low",
+				Details:  map[string]interface{}{"diff": "--- old:/path.txt\n+++ new:/path.txt\n@@\n-a\n+b"},
+			},
+		},
+		Metadata: DiffMetadata{GeneratedAt: time.Now().Format(time.RFC3339)},
+	}
+
+	reportShown := generateTextDiffReport(result, true)
+	if !strings.Contains(reportShown, "Diff:") || !strings.Contains(reportShown, "+ new:/path.txt") {
+		t.Fatalf("expected diff to be shown when enabled; got: %s", reportShown)
+	}
+
+	reportHidden := generateTextDiffReport(result, false)
+	if strings.Contains(reportHidden, "Diff:") {
+		t.Fatalf("expected diff to be hidden when disabled; got: %s", reportHidden)
+	}
+}
+
+func TestCategorizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"cluster-resources/pods/logs/ns/pod/container.log", "logs"},
+		{"some/ns/logs/thing.log", "logs"},
+		{"all-logs/ns/pod/container.log", "logs"},
+		{"logs/app.log", "logs"},
+		{"cluster-resources/configmaps/ns.json", "resources:configmaps"},
+		{"cluster-resources/", "resources"},
+		{"config/settings.yaml", "config"},
+		{"random/file.json", "config"},
+		{"random/file.txt", "files"},
+	}
+	for _, c := range cases {
+		if got := categorizePath(c.in); got != c.out {
+			t.Errorf("categorizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestNormalizePath(t *testing.T) {
+	cases := []struct {
+		in  string
+		out string
+	}{
+		{"root/foo.txt", "foo.txt"},
+		{"support-bundle-123/foo.txt", "foo.txt"},
+		{"Support-Bundle-ABC/bar/baz.txt", "bar/baz.txt"},
+		{"cluster-resources/pods/logs/whatever.log", "cluster-resources/pods/logs/whatever.log"},
+		{"all-logs/whatever.log", "all-logs/whatever.log"},
+	}
+	for _, c := range cases {
+		if got := normalizePath(c.in); got != c.out {
+			t.Errorf("normalizePath(%q)=%q want %q", c.in, got, c.out)
+		}
+	}
+}
+
+func TestGenerateUnifiedDiff_TruncationAndContext(t *testing.T) {
+	old := "line1\nline2\nline3\nline4\nline5\n"
+	newv := "line1\nline2-mod\nline3\nline4\nline5\n"
+	// context=1 should include headers and minimal context; max lines small to force truncation
+	diff := generateUnifiedDiff(old, newv, "/file.txt", 1, 5)
+	if diff == "" {
+		t.Fatal("expected non-empty diff")
+	}
+	if !strings.Contains(diff, "old:/file.txt") || !strings.Contains(diff, "new:/file.txt") {
+		t.Errorf("diff missing headers: %s", diff)
+	}
+	if !strings.Contains(diff, "... (diff truncated)") {
+		t.Errorf("expected truncated marker in diff: %s", diff)
+	}
+}
+
+func TestFormatSize(t *testing.T) {
+	tests := []struct {
+		name  string
+		bytes int64
+		want  string
+	}{
+		{
+			name:  "bytes",
+			bytes: 512,
+			want:  "512 B",
+		},
+		{
+			name:  "kilobytes",
+			bytes: 1536, // 1.5 KB
+			want:  "1.5 KiB",
+		},
+		{
+			name:  "megabytes",
+			bytes: 1572864, // 1.5 MB
+			want:  "1.5 MiB",
+		},
+		{
+			name:  "zero",
+			bytes: 0,
+			want:  "0 B",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := formatSize(tt.bytes)
+			if got != tt.want {
+				t.Errorf("formatSize() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateTarFileReader(t *testing.T) {
+	tempDir := t.TempDir()
+	bundlePath := filepath.Join(tempDir, "test-bundle.tar.gz")
+
+	// Create test bundle with text and binary files
+	testFiles := map[string]string{
+		"root/text-file.txt":   "line1\nline2\nline3\n",
+		"root/config.yaml":     "key: value\nother: data\n",
+		"root/binary-file.bin": string([]byte{0x00, 0x01, 0x02, 0xFF}), // Binary content
+	}
+
+	if err := writeTarGz(bundlePath, testFiles); err != nil {
+		t.Fatalf("Failed to create test bundle: %v", err)
+	}
+
+	// Test reading existing text file
+	reader, err := createTarFileReader(bundlePath, "text-file.txt")
+	if err != nil {
+		t.Fatalf("createTarFileReader() error = %v", err)
+	}
+	defer reader.Close()
+
+	content := make([]byte, 100)
+	n, err := reader.Read(content)
+	if err != nil && err != io.EOF {
+		t.Errorf("Read() error = %v", err)
+	}
+
+	contentStr := string(content[:n])
+	if !strings.Contains(contentStr, "line1") {
+		t.Errorf("Expected file content not found, got: %s", contentStr)
+	}
+
+	// Test reading non-existent file
+	_, err = createTarFileReader(bundlePath, "non-existent.txt")
+	if err == nil {
+		t.Error("Expected error for non-existent file")
+	}
+
+	// Test reading binary file (should fail)
+	_, err = createTarFileReader(bundlePath, "binary-file.bin")
+	if err == nil {
+		t.Error("Expected error for binary file")
+	}
+}
+
+func TestGenerateStreamingUnifiedDiff(t *testing.T) {
+	tempDir := t.TempDir()
+	oldBundle := filepath.Join(tempDir, "old-bundle.tar.gz")
+	newBundle := filepath.Join(tempDir, "new-bundle.tar.gz")
+
+	// Create bundles with different versions of the same file
+	if err := writeTarGz(oldBundle, map[string]string{
+		"root/config.yaml": "version: 1.0\napp: test\nfeature: disabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create old bundle: %v", err)
+	}
+
+	if err := writeTarGz(newBundle, map[string]string{
+		"root/config.yaml": "version: 2.0\napp: test\nfeature: enabled\n",
+	}); err != nil {
+		t.Fatalf("Failed to create new bundle: %v", err)
+	}
+
+	// Generate streaming diff
+	diff := generateStreamingUnifiedDiff(oldBundle, newBundle, "/config.yaml", 3, 100)
+
+	// Verify diff content
+	if diff == "" {
+		t.Error("Expected non-empty diff")
+	}
+
+	expectedStrings := []string{
+		"old:/config.yaml",
+		"new:/config.yaml",
+		"-version: 1.0",
+		"+version: 2.0",
+		"-feature: disabled",
+		"+feature: enabled",
+	}
+
+	for _, expected := range expectedStrings {
+		if !strings.Contains(diff, expected) {
+			t.Errorf("Diff missing expected string '%s'. Got: %s", expected, diff)
+		}
+	}
+}
+
+func TestReadLinesFromReader(t *testing.T) {
+	tests := []struct {
+		name     string
+		content  string
+		maxBytes int
+		wantLen  int
+		wantLast string
+	}{
+		{
+			name:     "small content",
+			content:  "line1\nline2\nline3\n",
+			maxBytes: 1000,
+			wantLen:  3,
+			wantLast: "line3\n",
+		},
+		{
+			name:     "content exceeds limit",
+			content:  "line1\nline2\nline3\nline4\nline5\n",
+			maxBytes: 15, // Only allows first 2 lines plus truncation marker
+			wantLen:  3,
+			wantLast: "... (content truncated due to size)\n",
+		},
+		{
+			name:     "empty content",
+			content:  "",
+			maxBytes: 1000,
+			wantLen:  0,
+			wantLast: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reader := strings.NewReader(tt.content)
+			lines, err := readLinesFromReader(reader, tt.maxBytes)
+
+			if err != nil {
+				t.Errorf("readLinesFromReader() error = %v", err)
+			}
+
+			if len(lines) != tt.wantLen {
+				t.Errorf("readLinesFromReader() got %d lines, want %d", len(lines), tt.wantLen)
+			}
+
+			if tt.wantLen > 0 && lines[len(lines)-1] != tt.wantLast {
+				t.Errorf("readLinesFromReader() last line = %s, want %s", lines[len(lines)-1], tt.wantLast)
+			}
+		})
+	}
+}

cmd/troubleshoot/cli/discovery_config.go

@@ -0,0 +1,239 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/pkg/errors"
+	"k8s.io/klog/v2"
+)
+
+// DiscoveryConfig represents the configuration for auto-discovery
+type DiscoveryConfig struct {
+	Version  string                      `json:"version" yaml:"version"`
+	Profiles map[string]DiscoveryProfile `json:"profiles" yaml:"profiles"`
+	Patterns DiscoveryPatterns           `json:"patterns" yaml:"patterns"`
+}
+
+// DiscoveryPatterns defines inclusion/exclusion patterns for discovery
+type DiscoveryPatterns struct {
+	NamespacePatterns    PatternConfig `json:"namespacePatterns" yaml:"namespacePatterns"`
+	ResourceTypePatterns PatternConfig `json:"resourceTypePatterns" yaml:"resourceTypePatterns"`
+	RegistryPatterns     PatternConfig `json:"registryPatterns" yaml:"registryPatterns"`
+}
+
+// PatternConfig defines include/exclude patterns
+type PatternConfig struct {
+	Include []string `json:"include" yaml:"include"`
+	Exclude []string `json:"exclude" yaml:"exclude"`
+}
+
+// LoadDiscoveryConfig loads discovery configuration from file or returns defaults
+func LoadDiscoveryConfig(configPath string) (*DiscoveryConfig, error) {
+	// If no config path specified, use built-in defaults
+	if configPath == "" {
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Check if config file exists
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		klog.V(2).Infof("Discovery config file not found: %s, using defaults", configPath)
+		return getDefaultDiscoveryConfig(), nil
+	}
+
+	// Read config file
+	data, err := ioutil.ReadFile(configPath)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to read discovery config file")
+	}
+
+	// Parse config file (support JSON for now)
+	var config DiscoveryConfig
+	if err := json.Unmarshal(data, &config); err != nil {
+		return nil, errors.Wrap(err, "failed to parse discovery config")
+	}
+
+	// Validate config
+	if err := validateDiscoveryConfig(&config); err != nil {
+		return nil, errors.Wrap(err, "invalid discovery config")
+	}
+
+	return &config, nil
+}
+
+// getDefaultDiscoveryConfig returns the built-in default configuration
+func getDefaultDiscoveryConfig() *DiscoveryConfig {
+	return &DiscoveryConfig{
+		Version:  "v1",
+		Profiles: GetDiscoveryProfiles(),
+		Patterns: DiscoveryPatterns{
+			NamespacePatterns: PatternConfig{
+				Include: []string{"*"}, // Include all by default
+				Exclude: []string{
+					"kube-system",
+					"kube-public",
+					"kube-node-lease",
+					"kubernetes-dashboard",
+					"cattle-*",
+					"rancher-*",
+				},
+			},
+			ResourceTypePatterns: PatternConfig{
+				Include: []string{
+					"pods",
+					"deployments",
+					"services",
+					"configmaps",
+					"secrets",
+					"events",
+				},
+				Exclude: []string{
+					"*.tmp",
+					"*.log", // Exclude raw log files in favor of structured logs
+				},
+			},
+			RegistryPatterns: PatternConfig{
+				Include: []string{"*"}, // Include all registries
+				Exclude: []string{},    // No exclusions by default
+			},
+		},
+	}
+}
+
+// validateDiscoveryConfig validates a discovery configuration
+func validateDiscoveryConfig(config *DiscoveryConfig) error {
+	if config.Version == "" {
+		config.Version = "v1" // Default version
+	}
+
+	if config.Profiles == nil {
+		return errors.New("profiles section is required")
+	}
+
+	// Validate each profile
+	requiredProfiles := []string{"minimal", "standard", "comprehensive"}
+	for _, profileName := range requiredProfiles {
+		if _, exists := config.Profiles[profileName]; !exists {
+			return fmt.Errorf("required profile missing: %s", profileName)
+		}
+	}
+
+	return nil
+}
+
+// ApplyDiscoveryPatterns applies include/exclude patterns to a list
+func ApplyDiscoveryPatterns(items []string, patterns PatternConfig) ([]string, error) {
+	if len(patterns.Include) == 0 && len(patterns.Exclude) == 0 {
+		return items, nil // No patterns to apply
+	}
+
+	var result []string
+
+	for _, item := range items {
+		include := true
+
+		// Check exclude patterns first
+		for _, excludePattern := range patterns.Exclude {
+			if matched, err := matchPattern(item, excludePattern); err != nil {
+				return nil, errors.Wrapf(err, "invalid exclude pattern: %s", excludePattern)
+			} else if matched {
+				include = false
+				break
+			}
+		}
+
+		// If not excluded, check include patterns
+		if include && len(patterns.Include) > 0 {
+			include = false // Default to exclude if include patterns exist
+			for _, includePattern := range patterns.Include {
+				if matched, err := matchPattern(item, includePattern); err != nil {
+					return nil, errors.Wrapf(err, "invalid include pattern: %s", includePattern)
+				} else if matched {
+					include = true
+					break
+				}
+			}
+		}
+
+		if include {
+			result = append(result, item)
+		}
+	}
+
+	return result, nil
+}
+
+// matchPattern checks if an item matches a glob pattern
+func matchPattern(item, pattern string) (bool, error) {
+	// Simple glob pattern matching
+	if pattern == "*" {
+		return true, nil
+	}
+
+	if pattern == item {
+		return true, nil
+	}
+
+	// Handle basic wildcard patterns
+	if strings.HasPrefix(pattern, "*") && strings.HasSuffix(pattern, "*") {
+		// Pattern is "*substring*"
+		substring := pattern[1 : len(pattern)-1]
+		return strings.Contains(item, substring), nil
+	}
+
+	if strings.HasPrefix(pattern, "*") {
+		// Pattern is "*suffix"
+		suffix := pattern[1:]
+		return strings.HasSuffix(item, suffix), nil
+	}
+
+	if strings.HasSuffix(pattern, "*") {
+		// Pattern is "prefix*"
+		prefix := pattern[:len(pattern)-1]
+		return strings.HasPrefix(item, prefix), nil
+	}
+
+	return false, nil
+}
+
+// SaveDiscoveryConfig saves discovery configuration to a file
+func SaveDiscoveryConfig(config *DiscoveryConfig, configPath string) error {
+	// Create directory if it doesn't exist
+	dir := filepath.Dir(configPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return errors.Wrap(err, "failed to create config directory")
+	}
+
+	// Marshal to JSON
+	data, err := json.MarshalIndent(config, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "failed to marshal config")
+	}
+
+	// Write to file
+	if err := ioutil.WriteFile(configPath, data, 0644); err != nil {
+		return errors.Wrap(err, "failed to write config file")
+	}
+
+	return nil
+}
+
+// GetDiscoveryConfigPath returns the default path for discovery configuration
+func GetDiscoveryConfigPath() string {
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		return "./troubleshoot-discovery.json"
+	}
+
+	return filepath.Join(homeDir, ".troubleshoot", "discovery.json")
+}
+
+// CreateDefaultDiscoveryConfigFile creates a default discovery config file
+func CreateDefaultDiscoveryConfigFile(configPath string) error {
+	config := getDefaultDiscoveryConfig()
+	return SaveDiscoveryConfig(config, configPath)
+}

cmd/troubleshoot/cli/discovery_config_test.go

@@ -0,0 +1,422 @@
+package cli
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name        string
+		setupConfig func(string) error
+		configPath  string
+		wantErr     bool
+		checkFunc   func(*testing.T, *DiscoveryConfig)
+	}{
+		{
+			name:       "no config path - use defaults",
+			configPath: "",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Default config should have profiles")
+				}
+			},
+		},
+		{
+			name:       "non-existent config file - use defaults",
+			configPath: "/non/existent/path.json",
+			wantErr:    false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+			},
+		},
+		{
+			name: "valid config file",
+			setupConfig: func(path string) error {
+				configContent := `{
+					"version": "v1",
+					"profiles": {
+						"minimal": {
+							"name": "minimal",
+							"description": "Minimal collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 1,
+							"timeout": 15000000000
+						},
+						"standard": {
+							"name": "standard",
+							"description": "Standard collection",
+							"includeImages": false,
+							"rbacCheck": true,
+							"maxDepth": 2,
+							"timeout": 30000000000
+						},
+						"comprehensive": {
+							"name": "comprehensive",
+							"description": "Comprehensive collection",
+							"includeImages": true,
+							"rbacCheck": true,
+							"maxDepth": 3,
+							"timeout": 60000000000
+						}
+					},
+					"patterns": {
+						"namespacePatterns": {
+							"include": ["app-*"],
+							"exclude": ["kube-*"]
+						}
+					}
+				}`
+				return os.WriteFile(path, []byte(configContent), 0644)
+			},
+			wantErr: false,
+			checkFunc: func(t *testing.T, config *DiscoveryConfig) {
+				if config.Version != "v1" {
+					t.Errorf("Expected version v1, got %s", config.Version)
+				}
+				if len(config.Profiles) == 0 {
+					t.Error("Config should have profiles")
+				}
+			},
+		},
+		{
+			name: "invalid json config",
+			setupConfig: func(path string) error {
+				return os.WriteFile(path, []byte(`{invalid json`), 0644)
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var configPath string
+			if tt.configPath != "" {
+				configPath = tt.configPath
+			}
+
+			// Setup config file if needed
+			if tt.setupConfig != nil {
+				tempDir := t.TempDir()
+				configPath = filepath.Join(tempDir, "config.json")
+				if err := tt.setupConfig(configPath); err != nil {
+					t.Fatalf("Failed to setup config: %v", err)
+				}
+			}
+
+			config, err := LoadDiscoveryConfig(configPath)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("LoadDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+
+			if !tt.wantErr && tt.checkFunc != nil {
+				tt.checkFunc(t, config)
+			}
+		})
+	}
+}
+
+func TestApplyDiscoveryPatterns(t *testing.T) {
+	tests := []struct {
+		name     string
+		items    []string
+		patterns PatternConfig
+		want     []string
+	}{
+		{
+			name:  "no patterns",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2", "kube-system"},
+		},
+		{
+			name:  "exclude patterns only",
+			items: []string{"app1", "app2", "kube-system", "kube-public"},
+			patterns: PatternConfig{
+				Include: []string{},
+				Exclude: []string{"kube-*"},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include patterns only",
+			items: []string{"app1", "app2", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "app2"},
+		},
+		{
+			name:  "include and exclude patterns",
+			items: []string{"app1", "app2", "app-system", "kube-system"},
+			patterns: PatternConfig{
+				Include: []string{"app*"},
+				Exclude: []string{"*system"},
+			},
+			want: []string{"app1", "app2"}, // app-system excluded, kube-system not included
+		},
+		{
+			name:  "exact match patterns",
+			items: []string{"app1", "app2", "special"},
+			patterns: PatternConfig{
+				Include: []string{"special", "app1"},
+				Exclude: []string{},
+			},
+			want: []string{"app1", "special"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ApplyDiscoveryPatterns(tt.items, tt.patterns)
+			if err != nil {
+				t.Errorf("ApplyDiscoveryPatterns() error = %v", err)
+				return
+			}
+
+			if len(got) != len(tt.want) {
+				t.Errorf("ApplyDiscoveryPatterns() length = %v, want %v", len(got), len(tt.want))
+				return
+			}
+
+			// Check that all expected items are present
+			gotMap := make(map[string]bool)
+			for _, item := range got {
+				gotMap[item] = true
+			}
+
+			for _, wantItem := range tt.want {
+				if !gotMap[wantItem] {
+					t.Errorf("ApplyDiscoveryPatterns() missing expected item: %s", wantItem)
+				}
+			}
+		})
+	}
+}
+
+func TestMatchPattern(t *testing.T) {
+	tests := []struct {
+		name    string
+		item    string
+		pattern string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "exact match",
+			item:    "app1",
+			pattern: "app1",
+			want:    true,
+		},
+		{
+			name:    "wildcard all",
+			item:    "anything",
+			pattern: "*",
+			want:    true,
+		},
+		{
+			name:    "prefix wildcard",
+			item:    "app-namespace",
+			pattern: "app*",
+			want:    true,
+		},
+		{
+			name:    "suffix wildcard",
+			item:    "kube-system",
+			pattern: "*system",
+			want:    true,
+		},
+		{
+			name:    "substring wildcard",
+			item:    "my-app-namespace",
+			pattern: "*app*",
+			want:    true,
+		},
+		{
+			name:    "no match",
+			item:    "different",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "prefix no match",
+			item:    "other-app",
+			pattern: "app*",
+			want:    false,
+		},
+		{
+			name:    "suffix no match",
+			item:    "system-app",
+			pattern: "*system",
+			want:    false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := matchPattern(tt.item, tt.pattern)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("matchPattern() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("matchPattern() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSaveDiscoveryConfig(t *testing.T) {
+	config := getDefaultDiscoveryConfig()
+
+	tempDir := t.TempDir()
+	configPath := filepath.Join(tempDir, "test-config.json")
+
+	err := SaveDiscoveryConfig(config, configPath)
+	if err != nil {
+		t.Fatalf("SaveDiscoveryConfig() error = %v", err)
+	}
+
+	// Verify file was created
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		t.Error("SaveDiscoveryConfig() did not create config file")
+	}
+
+	// Verify we can load it back
+	loadedConfig, err := LoadDiscoveryConfig(configPath)
+	if err != nil {
+		t.Fatalf("Failed to reload saved config: %v", err)
+	}
+
+	if loadedConfig.Version != config.Version {
+		t.Errorf("Reloaded config version = %v, want %v", loadedConfig.Version, config.Version)
+	}
+}
+
+func TestGetDiscoveryConfigPath(t *testing.T) {
+	path := GetDiscoveryConfigPath()
+
+	if path == "" {
+		t.Error("GetDiscoveryConfigPath() should not return empty string")
+	}
+
+	// Should end with expected filename
+	expectedSuffix := "discovery.json"
+	if !strings.HasSuffix(path, expectedSuffix) {
+		t.Errorf("GetDiscoveryConfigPath() should end with %s, got %s", expectedSuffix, path)
+	}
+}
+
+func TestValidateDiscoveryConfig(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  *DiscoveryConfig
+		wantErr bool
+	}{
+		{
+			name: "valid config",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "missing version gets default",
+			config: &DiscoveryConfig{
+				Profiles: GetDiscoveryProfiles(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "nil profiles",
+			config: &DiscoveryConfig{
+				Version:  "v1",
+				Profiles: nil,
+			},
+			wantErr: true,
+		},
+		{
+			name: "missing required profile",
+			config: &DiscoveryConfig{
+				Version: "v1",
+				Profiles: map[string]DiscoveryProfile{
+					"custom": {Name: "custom"},
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateDiscoveryConfig(tt.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateDiscoveryConfig() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func BenchmarkMatchPattern(b *testing.B) {
+	testCases := []struct {
+		item    string
+		pattern string
+	}{
+		{"app-namespace", "app*"},
+		{"kube-system", "*system"},
+		{"my-app-test", "*app*"},
+		{"exact-match", "exact-match"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		for _, tc := range testCases {
+			_, err := matchPattern(tc.item, tc.pattern)
+			if err != nil {
+				b.Fatalf("matchPattern failed: %v", err)
+			}
+		}
+	}
+}
+
+func BenchmarkApplyDiscoveryPatterns(b *testing.B) {
+	items := make([]string, 100)
+	for i := 0; i < 100; i++ {
+		if i%3 == 0 {
+			items[i] = fmt.Sprintf("app-%d", i)
+		} else if i%3 == 1 {
+			items[i] = fmt.Sprintf("kube-system-%d", i)
+		} else {
+			items[i] = fmt.Sprintf("other-%d", i)
+		}
+	}
+
+	patterns := PatternConfig{
+		Include: []string{"app*", "other*"},
+		Exclude: []string{"*system*"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, err := ApplyDiscoveryPatterns(items, patterns)
+		if err != nil {
+			b.Fatalf("ApplyDiscoveryPatterns failed: %v", err)
+		}
+	}
+}

cmd/troubleshoot/cli/interactive_results.go

@@ -2,10 +2,6 @@ package cli
 
 import (
 	"fmt"
-	"io/ioutil"
-	"os"
-	"path"
-	"time"
 
 	"github.com/mitchellh/go-wordwrap"
 	"github.com/pkg/errors"
@@ -19,15 +15,14 @@ import (
 var (
 	selectedResult = 0
 	table          = widgets.NewTable()
-	isShowingSaved = false
 )
 
-func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) error {
+func showInteractiveResults(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) error {
 	if err := ui.Init(); err != nil {
 		return errors.Wrap(err, "failed to create terminal ui")
 	}
 	defer ui.Close()
-	drawUI(supportBundleName, analyzeResults)
+	drawUI(supportBundleName, analyzeResults, archivePath)
 
 	uiEvents := ui.PollEvents()
 	for {
@@ -37,29 +32,10 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 			case "<C-c>":
 				return nil
 			case "q":
-				if isShowingSaved == true {
-					isShowingSaved = false
-					ui.Clear()
-					drawUI(supportBundleName, analyzeResults)
-				} else {
-					return nil
-				}
-			case "s":
-				filename, err := save(analyzeResults)
-				if err != nil {
-					// show
-				} else {
-					showSaved(filename)
-					go func() {
-						time.Sleep(time.Second * 5)
-						isShowingSaved = false
-						ui.Clear()
-						drawUI(supportBundleName, analyzeResults)
-					}()
-				}
+				return nil
 			case "<Resize>":
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Down>":
 				if selectedResult < len(analyzeResults)-1 {
 					selectedResult++
@@ -69,7 +45,7 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollDown()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			case "<Up>":
 				if selectedResult > 0 {
 					selectedResult--
@@ -79,16 +55,16 @@ func showInteractiveResults(supportBundleName string, analyzeResults []*analyzer
 				}
 				table.ScrollUp()
 				ui.Clear()
-				drawUI(supportBundleName, analyzeResults)
+				drawUI(supportBundleName, analyzeResults, archivePath)
 			}
 		}
 	}
 }
 
-func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult) {
+func drawUI(supportBundleName string, analyzeResults []*analyzerunner.AnalyzeResult, archivePath string) {
 	drawGrid(analyzeResults)
 	drawHeader(supportBundleName)
-	drawFooter()
+	drawFooter(archivePath)
 }
 
 func drawGrid(analyzeResults []*analyzerunner.AnalyzeResult) {
@@ -101,9 +77,7 @@ func drawHeader(supportBundleName string) {
 
 	title := widgets.NewParagraph()
 	title.Text = fmt.Sprintf("%s Support Bundle Analysis", util.AppName(supportBundleName))
-	title.TextStyle.Fg = ui.ColorWhite
-	title.TextStyle.Bg = ui.ColorClear
-	title.TextStyle.Modifier = ui.ModifierBold
+	title.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
 	title.Border = false
 
 	left := termWidth/2 - 2*len(title.Text)/3
@@ -113,11 +87,18 @@ func drawHeader(supportBundleName string) {
 	ui.Render(title)
 }
 
-func drawFooter() {
+func drawFooter(archivePath string) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
+	archivePathMsg := widgets.NewParagraph()
+	archivePathMsg.Text = "Support bundle archive: " + archivePath
+	archivePathMsg.Border = false
+	archivePathMsg.TextStyle = ui.NewStyle(ui.ColorWhite, ui.ColorClear, ui.ModifierBold)
+
+	archivePathMsg.SetRect(0, termHeight-3, termWidth, termHeight-2)
+
 	instructions := widgets.NewParagraph()
-	instructions.Text = "[q] quit    [s] save    [↑][↓] scroll"
+	instructions.Text = "[q] quit    [↑][↓] scroll"
 	instructions.Border = false
 
 	left := 0
@@ -126,13 +107,13 @@ func drawFooter() {
 	bottom := termHeight
 
 	instructions.SetRect(left, top, right, bottom)
-	ui.Render(instructions)
+	ui.Render(archivePathMsg, instructions)
 }
 
 func drawAnalyzersTable(analyzeResults []*analyzerunner.AnalyzeResult) {
 	termWidth, termHeight := ui.TerminalDimensions()
 
-	table.SetRect(0, 3, termWidth/2, termHeight-6)
+	table.SetRect(0, 3, termWidth/2, termHeight-4)
 	table.FillRow = true
 	table.Border = true
 	table.Rows = [][]string{}
@@ -213,60 +194,3 @@ func drawDetails(analysisResult *analyzerunner.AnalyzeResult) {
 	message.SetRect(termWidth/2, currentTop, termWidth, currentTop+height)
 	ui.Render(message)
 }
-
-func showSaved(filename string) {
-	termWidth, termHeight := ui.TerminalDimensions()
-
-	savedMessage := widgets.NewParagraph()
-	savedMessage.Text = fmt.Sprintf("Support Bundle analysis results saved to\n\n%s", filename)
-	savedMessage.WrapText = true
-	savedMessage.Border = true
-
-	left := termWidth/2 - 20
-	right := termWidth/2 + 20
-	top := termHeight/2 - 4
-	bottom := termHeight/2 + 4
-
-	savedMessage.SetRect(left, top, right, bottom)
-	ui.Render(savedMessage)
-
-	isShowingSaved = true
-}
-
-func save(analyzeResults []*analyzerunner.AnalyzeResult) (string, error) {
-	filename := path.Join(util.HomeDir(), fmt.Sprintf("%s-results.txt", "support-bundle"))
-	_, err := os.Stat(filename)
-	if err == nil {
-		os.Remove(filename)
-	}
-
-	results := ""
-	for _, analyzeResult := range analyzeResults {
-		result := ""
-
-		if analyzeResult.IsPass {
-			result = "Check PASS\n"
-		} else if analyzeResult.IsWarn {
-			result = "Check WARN\n"
-		} else if analyzeResult.IsFail {
-			result = "Check FAIL\n"
-		}
-
-		result = result + fmt.Sprintf("Title: %s\n", analyzeResult.Title)
-		result = result + fmt.Sprintf("Message: %s\n", analyzeResult.Message)
-
-		if analyzeResult.URI != "" {
-			result = result + fmt.Sprintf("URI: %s\n", analyzeResult.URI)
-		}
-
-		result = result + "\n------------\n"
-
-		results = results + result
-	}
-
-	if err := ioutil.WriteFile(filename, []byte(results), 0644); err != nil {
-		return "", errors.Wrap(err, "failed to save preflight results")
-	}
-
-	return filename, nil
-}