pest-controller-suit

# Pest-Controller-Suit Start with [README.md](README.md) for the workflow map and detailed references. Pest Controller-suit is the routing skill for The Wasp Nest, the agentic development system distributed by Vibe Coding Tools. The Wasp Nest works across Claude Code, Cursor, ChatGPT Codex, and Claude Cowork. It is built from Drones (subagents, one per domain) and Stingers (the paired skill each Drone reads before it touches anything). Pest Controller-suit does not do the work itself. Given a request, it names the Drone that owns it, makes sure that Drone arms itself with its Stinger, and enforces the Ship Gate before anything gets committed or pushed. The application stack this colony serves is SvelteKit with Svelte 5, Payload CMS, Vercel, Neon Postgres with Drizzle, WorkOS auth, Stripe with custom Elements, Doppler for secrets, PostHog for analytics, Sentry for error tracking, Tailscale for private networking, and GoHighLevel for CRM integration. Most of the roster below speaks that stack directly. The rest handles the process around it: documentation, git hygiene, project management, CI, and other platforms a client project might touch (Discord, Slack, Telegram, mobile app stores). A small number of Drones still carry description or body text from a prior product this repo does not run anymore. They stay in the roster, because an unregistered Drone is a Drone the orchestrator can't find, but they are marked below and logged in full in [`PAIRING-AUDIT.md`](PAIRING-AUDIT.md). --- ## The pairing law Every Drone pairs with exactly one Stinger: `<base>-wasp-drone` to `<base>-stinger`. No exceptions inside the roster below; every row checks out. Core has three orchestrator skills without paired Drones. Skill-only capabilities are also allowed when their frontmatter explicitly declares `metadata.hive-tier: standalone`; the validator checks this for every pack. A standalone skill does not claim a specialist Drone exists. - `pest-controller-suit` (this file, the router) - `queen-wasp-stinger` (the forge that creates and validates new Drones and Stingers) - `get-started-stinger` (repository initialization and hardening) --- ## Installed capability prerequisites Read Core's `plugin-catalog.json` before selecting a specialist. Every component has one plugin owner. Core remains required; Website Audit also requires Browser and App Testing. Full KB Refresh additionally requires Code Audit. For local installed plugins, run Core's `hooks/resolve-component.py` with the paired skill name. It reads `~/.wasp-nest/installed-plugins.json`, or Claude Code's own `~/.claude/plugins/installed_plugins.json` after a `/plugin install` when that file is absent, and returns the checked installed path. Load that path before dispatch. If no shell is available, inspect the installed capability list and manifests to verify the same prerequisites. Stop a dependent workflow when its owner or prerequisite is missing; do not follow a source-repository link as an installed runtime substitute. ## Roster For a user asking which capability fits a desired result, use [outcome discovery](guides/outcome-discovery.md). Its packaged shortlist keeps proposed gaps distinct from existing scope and verified installed availability. 164 Drones routed across Core and optional plugins, sorted into domain groups. Website Audit dispatches its separate twenty-Drone engagement. The Domain column is a one-line summary of the Drone's own frontmatter description. Trigger keywords are pulled from that same description, not invented. ### Stack and frameworks | Drone | Domain | Trigger keywords | Paired Stinger | |---|---|---|---| | `svelte-wasp-drone` | Svelte language/runtime and accessible form contracts: runes, actions, progressive enhancement, server validation and version-qualified behavior | "runes", "SvelteKit form actions", "accessible forms", "robust validation" | `svelte-stinger` | | `shadcn-svelte-wasp-drone` | shadcn-svelte component library: CLI, copy-in-repo model, registry system, theming, Superforms and Formsnap, accessibility via Bits UI | "install shadcn-svelte", "add a shadcn-svelte component", "theme shadcn-svelte", "build a shadcn-svelte registry" | `shadcn-svelte-stinger` | | `tailwind-wasp-drone` | Tailwind v4 framework and component fit: CSS-first config, source detection, tokens and selected shadcn/framework boundaries | "migrate to Tailwind v4", "use Tailwind and shadcn", "component framework fit", "source detection" | `tailwind-stinger` | | `tanstack-wasp-drone` | TanStack inside SvelteKit: Query SSR/caching/mutations, runes-native Table, Form snippet validation, Virtual | "add TanStack Query", "set up svelte-query", "build a data table", "virtualize this list" | `tanstack-stinger` | | `preact-wasp-drone` | Preact 11: signals API, preact/compat migration from React, embed widgets, Astro islands, Fresh 2.x | "Preact vs React", "migrate a React codebase to Preact", "embed a widget on third-party pages", "Astro island" | `preact-stinger` | | `react-wasp-drone` | React architecture and separate-backend Vite apps: state ownership, component extraction, request ordering and explicit emitted-bundle measurement | "review React architecture", "build React Vite with a backend", "split a giant component", "measure bundle weight", "simplify state" | `react-stinger` | | `xyflow-wasp-drone` | React Flow and Svelte Flow (xyflow) node editors and diagram canvases: setup, flow state, custom nodes, edges and handles, layout engines, sub flows, theming, React Flow UI, SSR, performance, accessibility, tests, and v11 or 0.x migrations | "build a workflow builder", "add a React Flow node editor", "custom Svelte Flow node", "auto layout this graph with dagre", "migrate reactflow to @xyflow/react" | `xyflow-stinger` | | `typescript-node-wasp-drone` | TypeScript/Node code review and conventions: strict config, module resolution, test suites, boundary validation (body still cites a legacy package's specifics; see PAIRING-AUDIT.md) | "review this TypeScript code", "audit this Node code", "write a Vitest suite", "tighten the tsconfig" | `typescript-node-stinger` | | `python-wasp-drone` | Python architecture and measured ORM access: Django/FastAPI, typed boundaries, jobs, migrations, authorization and N+1 characterization | "review Django code", "audit ORM patterns", "eliminate N+1 queries", "set up Celery" | `python-stinger` | | `rust-wasp-drone` | Rust architecture and native background boundaries: bounded admission, errors, cooperative cancellation, shutdown and observed compiler/platform proof | "implement Rust", "native background work", "bounded Rust worker", "review Cargo" | `rust-stinger` | | `tauri-wasp-drone` | Tauri native boundaries: sidecar credentials, local data migration, secure update/data compatibility, OS integrations and qualified native test evidence | "build Tauri app", "sidecar credentials", "desktop storage", "native update", "native app tests" | `tauri-stinger` | | `electron-app-wasp-drone` | Electron desktop applications: main, preload, renderer, IPC, sandbox, permissions, packaging, and native verification | "build an Electron app", "Electron preload", "Electron IPC", "package Electron" | `electron-app-stinger` | | `ux-ui-svelte-wasp-drone` | Enforces a project's SvelteKit UI standard (OSPRY's ADR-007 is the worked example): shadcn-svelte on Bits UI plus Melt UI, Tailwind v4 token bridge, white-label brand contract. Impeccable remains the primary router for UI/design implementation | "add a Button", "copy in this shadcn-svelte component", "convert this bespoke style to Tailwind", "does the white-label still work" | `ux-ui-svelte-stinger` | | `dark-mode-theming-wasp-drone` | Dark-mode theming: CSS variable token architecture, theme-provider wiring, FOWT prevention, SSR hydration safety, Tailwind v4 dark variant | "set up dark mode", "dark mode on SSR", "multi-brand theming", "FOWT fix" | `dark-mode-theming-stinger` | | `modal-toast-dialog-wasp-drone` | Accessible overlay primitives: dialog, alert dialog, drawer, toast, command menu; focus trap, escape, scroll lock, aria contract | "choosing between overlay primitives", "debugging focus trap regressions", "building a command palette" | `modal-toast-dialog-stinger` | | `icon-system-wasp-drone` | Icon library selection and delivery: tree-shake vs sprite, dynamic-import-by-name, custom SVG components, icon accessibility contract | "choosing an icon library", "bundle-size regressions from icon imports", "icon accessibility" | `icon-system-stinger` | | `typography-font-wasp-drone` | Typography system: variable fonts, font source selection, the FOIT/FOUT/FOFT story, fluid type scales, type-token architecture | "set up fonts", "audit our typography", "fix FOIT/FOUT", "build a type scale" | `typography-font-stinger` | | `font-loading-wasp-drone` | Font loading pipeline: font-display strategy, preload/crossorigin correctness, variable-font subsetting, CLS-from-font-swap elimination | "audit font loading", "fix FOIT", "CLS from font swap", "subset variable font" | `font-loading-stinger` | | `markdown-mdx-content-pipeline-wasp-drone` | Markdown/MDX pipeline: compiler selection, remark/rehype chains, syntax highlighting, AST manipulation, XSS sanitization | "set up MDX", "configure Shiki", "write a remark plugin", "sanitize user markdown" | `markdown-mdx-content-pipeline-stinger` | | `csv-xlsx-import-export-wasp-drone` | Spreadsheet upload and export feature: CSV/XLSX parsing, large-file streaming, column-mapping wizard, row validation, CSV injection prevention | "build a CSV import", "add XLSX upload", "column-mapping wizard", "CSV injection safe" | `csv-xlsx-import-export-stinger` | | `design-system-wasp-drone` | Bootstraps a complete design system from scratch: tokens, utility layer, per-component and per-screen specs, static HTML examples. Impeccable owns frontend UI/UX/design implementation and uses DESIGN.md drift rules plus its detector gate to make enforcement mechanical | "build a design system for X", "bootstrap UI for product Y", "create tokens and utilities for this product" | `design-system-stinger` | | `impeccable-wasp-drone` | Frontend-design operating system for all UI/UX/design implementation, redesign, refinement, new surfaces, components, and design-system capture. Runs Start -> Iterate -> Polish -> Maintain, the context contract, motion/keyboard evidence and the deterministic detector gate | "polish the pricing page", "build a dashboard", "redo this hero", "make this not look like AI slop", "design a settings screen", "audit this UI" | `impeccable-stinger` | | `http-rest-fundamentals-wasp-drone` | HTTP/REST protocol correctness: method safety and idempotency, status-code honesty, headers, conditional and range requests | "is this status code correct", "why is CORS failing", "explain preflight", "PUT vs PATCH" | `http-rest-fundamentals-stinger` | | `image-optimization-wasp-drone` | Image delivery: AVIF/WebP format selection, responsive srcset/sizes, blur placeholders, remote image config, CLI tooling | "optimize my images", "convert to AVIF", "fix layout shift from images", "audit our images" | `image-optimization-stinger` | | `go-wasp-drone` | Go implementation drone for modules, toolchains, vendoring/fork freezes, cgo .so plugin builds, and project layout | "go" | `go-stinger` | | `react-to-svelte-wasp-drone` | Port-wave drone converting React surfaces to Svelte 5 against an immutable API contract - contract extraction, behavior inventory, runes/snippets port, per-row verification | "react to svelte" | `react-to-svelte-stinger` | | `ux-ui-wasp-drone` | Product system and UI contract guidance: governing inputs, React primitives, mobile task priorities and exact manual/device evidence; Impeccable owns implementation | "design system", "React primitive contract", "mobile task flows", "UI review" | `ux-ui-stinger` | ### Browser and desktop engineering | Drone | Domain | Trigger keywords | Paired Stinger | |---|---|---|---| | `browser-automation-wasp-drone` | Playwright and Puppeteer automation: browser tests, scripts, traces, screenshots, browser installs, and CI reliability | "write a Playwright test", "Puppeteer script", "browser automation", "Playwright browser install" | `browser-automation-stinger` | | `chrome-chromium-wasp-drone` | Chrome DevTools Protocol and Chromium engineering: remote debugging, developer profiles, protocol inspection, source builds, and browser-engine diagnosis | "Chrome DevTools Protocol", "remote debugging Chrome", "Chromium build", "debug Chromium" | `chrome-chromium-stinger` | | `webapp-capture-wasp-drone` | Capture a running web app as demos, screenshots, component inventory, design tokens, and visual/code inconsistency reports | "record a walkthrough", "screenshot every page", "capture our component library", "audit UI drift" | `webapp-capture-stinger` | `webapp-capture-wasp-drone` and its Stinger live in the optional `browser-and-app-testing-tools` plugin. Confirm the pack is installed before dispatch; a core-only install cannot run its capture scripts. ### Data and persistence | Drone | Domain | Trigger keywords | Paired Stinger | |---|---|---|---| | `db-wasp-drone` | PostgreSQL architecture, live-schema migration and tenant-boundary evidence: provenance, mixed writers, constraints, owner/bypass/session and query/data denial checks | "design this schema", "migrate live schema", "no guessed backfill", "multi-tenant data boundaries" | `db-stinger` | | `neon-drizzle-wasp-drone` | Neon Postgres plus Drizzle ORM for this SvelteKit/Vercel stack: connection driver choice, schema/migration review, pgvector wiring, RLS-without-Supabase | "set up Neon", "pick a connection driver for Vercel", "review this Drizzle schema/migration", "wire pgvector" | `neon-drizzle-stinger` | | `deeplake-dataset-wasp-drone` | Deep Lake data architecture specialist for Hivemind - the 7-table ColumnDef schema, `USING deeplake` DDL, FLOAT4[768] embeddings, additive schema healing, append-only version-bump writes, indexing (deeplake_index... | "design this table", "review this ColumnDef", "should this be JSONB or a column?", "is this index right?" | `deeplake-dataset-stinger` | ### Auth and security | Drone | Domain | Trigger keywords | Paired Stinger | |---|---|---|---| | `auth-wasp-drone` | Authentication and takeover-resistant recovery: provider/application boundaries, MFA preservation, token scope, revocation and approved support policy | "set up auth", "account recovery", "reset token", "MFA recovery" | `auth-stinger` | | `workos-wasp-drone` | WorkOS specialist: AuthKit, sealed sessions, JWT/JWKS verification, User Management, RBAC, SSO, Directory Sync, MFA/passkeys, webhooks | "set up WorkOS", "wire up AuthKit", "AuthKit in SvelteKit", "WorkOS SCIM" | `workos-stinger` | | `security-wasp-drone` | Risk-bounded security design/review: threat and tenant/data boundaries, durable verified webhooks, browser/log secrets and exact candidate verification | "security review", "threat model", "tenant data responses", "webhook replay", "secret exposure" | `security-stinger` | | `dependency-audit-wasp-drone` | Supply-chain hygiene, artifact-bound SBOM, safe major upgrades and manifest reading with exact source/consumer proof | "audit dependencies", "artifact SBOM", "upgrade major versions", "lockfile discipline" | `dependency-audit-stinger` | | `lovable-audit-wasp-drone` | Empirical security audit of Lovable-built Supabase apps: row-level-security denial verification, role-differential visibility probes, Edge Function gating checks, auth-posture readout, client-bundle key and endpoint... | "audit this Supabase app", "pentest the Lovable build", "check the RLS on this project", "probe the Edge Functions" | `lovable-audit-stinger` | ### Payments and integrations | Drone | Domain | Trigger keywords | Paired Stinger | |---|---|---|---| | `payments-wasp-drone` | Stripe Elements and server billing/access contracts: durable webhook intake, independent entitlements, trials/access states and approved refund/cancel preparation | "integrate Stripe", "server entitlements", "trial access", "refund cancellation workflow" | `payments-stinger` | | `gohighlevel-wasp-drone` | GoHighLevel API integration: OAuth vs Private Integration Tokens, contacts/opportunities/pipelines, webhooks, workflows, Marketplace apps | "integrate GoHighLevel", "wire up a GHL webhook", "push leads into GoHighLevel", "GoHighLevel OAuth" | `gohighlevel-stinger` | | `ghl-to-mermaid-wasp-drone` | Offline HighLevel export conversion into per-workflow JSON and Mermaid diagrams | "turn this GHL export into a flowchart", "map HighLevel automations", "split a location export" | `ghl-to-mermaid-stinger` | | `elevenlabs-api-wasp-drone` | ElevenLabs API integration: speech, voices, streaming, usage metadata, and safe server boundaries | "integrate ElevenLabs", "ElevenLabs text to speech", "ElevenLabs streaming", "ElevenLabs API key" | `elevenlabs-api-stinger` | | `heygen-api-wasp-drone` | HeyGen API integration: asynchronous video jobs, avatars, assets, webhooks, limits, and safe delivery | "integrate HeyGen", "HeyGen API", "HeyGen video generation", "HeyGen webhook" | `heygen-api-stinger` | | `highlevel-ai-studio-wasp-drone` | HighLevel AI Studio and AI creation: Vibe sites, Content AI selection, Visual Edits, Code Editor, forms, calendars, publishing, domains, SEO, and troubleshooting | "HighLevel AI Studio", "AI Content Studio", "AI website builder", "HighLevel vibe code", "AI Studio form" | `highlevel-ai-studio-stinger` | | `crm-integration-wasp-drone` | CRM connectivity specialist for HubSpot, Salesforce, Pipedrive, Attio, Folk, Close, and Copper | "integrate with HubSpot", "bi-directional CRM sync", "CRM field mapping", "Merge.dev or native API?" | `crm-integration-stinger` | | `tawk-to-api-wasp-drone` | Reference for the tawk.to REST API v1.1.0 (https://api.tawk.to/v1) | "tawk to api" | `tawk-to-api-stinger` | The `gohighlevel`, `highlevel-ai-studio`, and `ghl-to-mermaid` pairs above live in the optional `highlevel` pack. A core-only install can identify the request but cannot dispatch those Drones. Confirm that `highlevel` is installed before arming one; if absent, tell the user to install that pack rather than pretending the Drone or Stinger is available. ### Communication and bots | Drone | Domain | Trigger keywords | Paired Stinger |