@sentry/junior-cloudflare 0.80.0

package/LICENSE

@@ -0,0 +1,201 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@sentry/junior-cloudflare",
+  "version": "0.80.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getsentry/junior.git",
+    "directory": "packages/junior-cloudflare"
+  },
+  "files": [
+    "plugin.yaml",
+    "skills"
+  ]
+}

package/plugin.yaml

@@ -0,0 +1,13 @@
+name: cloudflare
+display-name: Cloudflare
+description: Cloudflare production operations — Workers monitoring, deployments, builds, logs, DNS, and observability via the Cloudflare API MCP server
+
+capabilities:
+  - api
+
+config-keys:
+  - account.id
+  - zone.id
+
+mcp:
+  url: https://mcp.cloudflare.com/mcp

package/skills/cloudflare/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: cloudflare
+description: Cloudflare production operations via the Cloudflare API MCP server. Use when users ask to investigate Workers errors or performance, check build or deployment status, query logs, inspect DNS records, check load balancer pool health, review Zero Trust tunnels, or manage Cloudflare resources. Do not use for Sentry issues, GitHub/Linear ticketing, or non-Cloudflare infrastructure.
+---
+
+# Cloudflare Operations
+
+Use this skill for Cloudflare production operations through Cloudflare's hosted API MCP.
+
+Default to read-only investigation. Cloudflare OAuth or API token scopes are the permission boundary; this plugin cannot allowlist individual Cloudflare API operations inside MCP.
+
+## MCP basics
+
+Cloudflare MCP exposes three tools:
+
+- `docs`: search Cloudflare developer documentation for product behavior and terminology.
+- `search`: inspect the current Cloudflare API spec.
+- `execute`: call Cloudflare APIs with minimal JavaScript.
+
+Use `docs` when Cloudflare product behavior is unclear. Use `search` before every `execute`; the spec is the source of truth for current methods, paths, parameters, and response shapes. Keep `execute` calls small, scoped, and read-only unless the user has explicitly approved a state-changing change.
+
+## Reference loading
+
+Load references conditionally based on the request:
+
+| Need                                                                                                     | Read                                                                                   |
+| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
+| Worker errors, failed builds, logs, Logpush, DNS checks, LB health, tunnels                              | [references/workflows.md](references/workflows.md)                                     |
+| Any state-changing request: deploy, rollback, DNS, WAF, LB, Access, Logpush, storage, account membership | [references/safety-and-permissions.md](references/safety-and-permissions.md)           |
+| Auth failures, permission errors, multiple accounts/zones, rate limits, stale operations                 | [references/troubleshooting-workarounds.md](references/troubleshooting-workarounds.md) |
+
+## Workflow
+
+1. Classify the request as read-only investigation or state-changing work.
+2. Resolve target scope: explicit user account/zone/resource wins; otherwise use `cloudflare.account.id` and `cloudflare.zone.id` config; otherwise discover with MCP and ask one focused question if ambiguous.
+3. For any Cloudflare API call, search the MCP API spec first. Do not call Cloudflare API paths from memory or from bundled docs.
+4. Keep investigation bounded: last 30 minutes for "right now", last 24 hours for retrospective checks, and recent N builds/deployments unless the user asks for more.
+5. Before any state-changing API call, load [references/safety-and-permissions.md](references/safety-and-permissions.md), show current state and the intended change, then wait for explicit approval.
+6. Lead with concrete findings, then evidence. Include dashboard links when IDs are available.
+
+## Guardrails
+
+- **Read-first.** Default to investigation. Do not execute writes in response to ambiguous requests like "fix this" or "roll it back" — investigate and propose a plan first.
+- **Search owns API selection.** The bundled references give workflows, not API authority.
+- **Confirm before writes.** No Worker deploy, rollback, DNS create/update/delete, load balancer change, WAF rule change, Access policy change, or R2/KV/D1 destructive action without explicit user approval after showing current state and change summary.
+- **Never delete data by default.** For R2, KV, and D1, support list/inspect/read. Avoid delete/truncate/drop unless the user explicitly asks and confirms.
+- **Redact sensitive data.** Do not paste raw log bodies, Worker source, env var values, token values, or authorization headers.
+- **Stop on auth failures.** If the MCP server returns an auth error, stop and tell the user. Do not guess at missing permissions.
+- **No scope creep.** Operate only on the account/zone/resource the user specified. Do not enumerate or modify resources in other accounts or zones.

package/skills/cloudflare/references/safety-and-permissions.md

@@ -0,0 +1,69 @@
+# Safety and Permissions
+
+## Write operations requiring explicit confirmation
+
+**Never execute the following without fetching current state, showing a before/after summary, and receiving explicit user approval:**
+
+| Category            | Requires confirmation                                                                            |
+| ------------------- | ------------------------------------------------------------------------------------------------ |
+| Workers             | Deploy (new version), rollback, route create/update/delete, script delete, env var/secret change |
+| DNS                 | Record create, update, delete (any type — A, AAAA, CNAME, MX, TXT, SRV)                          |
+| Load Balancers      | Pool create/update/delete, monitor create/update/delete, LB failover                             |
+| WAF / Firewall      | Rule create, update, disable, delete; ruleset deploy                                             |
+| Access / Zero Trust | App policy change, tunnel create/delete, connector restart                                       |
+| Logpush             | Job enable/disable, destination change, job delete                                               |
+| Storage             | R2 bucket delete, KV namespace delete, D1 database drop; **no destructive ops by default**       |
+| Account             | API token create/delete, member add/remove                                                       |
+
+## Pre-write checklist
+
+Before executing any state-changing API call:
+
+1. **Identify the resource exactly.** Confirm account ID, zone ID, resource name, and resource ID.
+2. **Fetch current state.** Use a `GET` call to show what exists now.
+3. **State the intended change.** Name the Cloudflare operation, method, and the exact fields that will change.
+4. **Summarize impact.** What breaks if this fails? Is there a rollback path?
+5. **Ask for approval.** Do not proceed until the user explicitly confirms.
+6. **Execute and verify.** After the write, confirm the new state with a follow-up `GET`.
+
+## Rollback runbook
+
+1. Search for Workers script deployments and list recent deployments.
+2. Identify target (last known good version by timestamp or user input).
+3. Diff compatibility date, bindings metadata, routes, and cron triggers between current and target.
+4. Confirm the rollback target with the user — include version tag, deploy timestamp, and any config deltas.
+5. Search for the current deployment operation, then execute it with the target version pinned.
+6. Verify: check tail logs and analytics for error rate stabilization.
+
+## DNS change safety
+
+- Always fetch the existing record by name and type before modifying.
+- Show full current record: name, type, content, TTL, proxied status, priority (if MX).
+- Warn on apex (`@`) records — TTL and CNAME flattening can affect zone behavior.
+- Warn on DMARC (`_dmarc`), SPF (TXT on root), and DKIM records — changes can break email delivery.
+- Confirm zone ID matches the user's intended domain — zone names can be ambiguous in multi-zone accounts.
+- Do not delete records by ID without showing the full record content first.
+
+## Recommended API token permission sets
+
+Suggest least-privilege tokens. Do not request or use an all-powerful token by default.
+
+| Task                                        | Minimum token permissions                                                               |
+| ------------------------------------------- | --------------------------------------------------------------------------------------- |
+| Read-only ops (monitoring, logs, analytics) | Account Resources: Read, Zone: Read, Workers Scripts: Read, Logs: Read, Analytics: Read |
+| Worker deploy / rollback                    | Workers Scripts: Edit (add Workers Routes: Edit if routes change)                       |
+| DNS management                              | DNS: Edit, Zone: Read                                                                   |
+| Load balancer management                    | Load Balancers: Edit, Zone: Read                                                        |
+| Logpush job management                      | Logs: Edit                                                                              |
+| Zero Trust / Access                         | Access: Edit, Zero Trust: Edit                                                          |
+| R2 / KV / D1 read-only                      | corresponding Read scopes only                                                          |
+
+When the user's token lacks required permissions, stop and explain what permission is needed rather than attempting workarounds.
+
+## Sensitive data redaction
+
+- Do not print Worker script source code in responses.
+- Do not print env var values, secrets, or binding credentials.
+- Do not print full authorization headers, cookies, or tokens from log samples.
+- For log bodies and HTTP payloads, print only a short representative sample (1–3 lines) and summarize the pattern.
+- For DNS records, printing record values is fine (they are public) — but flag if a TXT record appears to contain a secret.

package/skills/cloudflare/references/troubleshooting-workarounds.md

@@ -0,0 +1,85 @@
+# Troubleshooting and Workarounds
+
+## Auth failures
+
+**Symptom:** MCP returns 401 or "unauthorized" errors.
+
+- Stop and tell the user the session is not authorized for the Cloudflare MCP.
+- The Cloudflare MCP uses OAuth. If the user has not authorized yet, they will see an auth prompt — follow Junior's OAuth resume flow.
+- Do not attempt to bypass auth. Do not guess at token scopes.
+
+**Symptom:** API calls return 403 "Permission denied" or "Insufficient permissions".
+
+- The authorized account lacks the required permission for this resource.
+- Tell the user which operation failed and which Cloudflare permission scope is needed (see `safety-and-permissions.md`).
+- Suggest creating a more scoped token from `dash.cloudflare.com/profile/api-tokens`.
+
+## Multiple accounts
+
+**Symptom:** account discovery returns more than one account.
+
+- Do not guess which account to use.
+- Show the user the list (name + ID) and ask them to specify.
+- Once identified, suggest they configure `cloudflare.account.id` for this channel.
+
+## Zone name ambiguity
+
+**Symptom:** zone lookup by domain returns multiple zones (e.g. test + production zones).
+
+- Show all matching zones with their IDs and statuses.
+- Ask the user to confirm the intended zone.
+- Note: some accounts have zone aliases; the `status: active` zone is usually the production zone.
+
+## MCP tool failures
+
+**Symptom:** `execute` returns an unexpected error or empty result.
+
+- Use `search` to re-confirm the operation shape before retrying.
+- Check whether the operation requires `account_id` vs `zone_id` — this is a common mistake.
+- Use `docs` to verify current product behavior if the spec seems stale.
+- If the MCP server itself returns 5xx, note this and retry once. If it persists, report the error.
+
+**Symptom:** `search` returns no results for an expected operation.
+
+- Try a broader search term (e.g. `workers` instead of `workers/scripts/deployments`).
+- The spec may use different names than Cloudflare's product docs; use `docs` to clarify terminology.
+
+## Analytics data delays
+
+Cloudflare analytics pipelines typically have a 1–2 minute delay. For "right now" questions, note this delay and use tail logs for live data instead of analytics queries.
+
+## Log retention and plan limits
+
+- Workers tail logs are live only — they do not provide historical log retrieval.
+- Logpush provides historical logs but requires configuration (destination bucket or external service). If the user has not configured Logpush, tail is the only real-time option.
+- Workers analytics retention varies by plan. Enterprise customers may have longer retention.
+- If a query returns fewer results than expected, check whether plan limits or retention windows are truncating the data.
+
+## Rate limits
+
+**Symptom:** API returns 429 Too Many Requests.
+
+- Wait a few seconds and retry the query once.
+- If still throttled, report the rate limit and stop.
+- Do not loop or retry aggressively — Cloudflare enforces per-second and per-minute limits.
+
+## Operation changed or not found
+
+**Symptom:** An expected Cloudflare operation returns 404.
+
+- Use `search` against the current spec. Do not hand-guess a corrected path.
+- Use `docs` to look up the current API surface for the product area.
+- Cloudflare frequently changes API surfaces; the spec in `search` is authoritative.
+
+## Workers Builds vs Pages
+
+Cloudflare has two CI systems:
+
+- **Workers Builds** — for Worker scripts deployed via `wrangler`
+- **Pages** — for static sites and Pages Functions
+
+If the user asks about "builds" and it's unclear which system, ask whether they are deploying a Worker or a Pages project.
+
+## GraphQL Analytics API
+
+Some deep analytics (request counts by colo, detailed error breakdown, Web Analytics) are only available through Cloudflare's GraphQL Analytics API at `https://api.cloudflare.com/client/v4/graphql`. Use the `docs` tool to find the relevant GraphQL datasets. Note that GraphQL queries are POST requests with a JSON body containing the query string.

package/skills/cloudflare/references/workflows.md

@@ -0,0 +1,121 @@
+# Cloudflare Workflows
+
+## Investigate Worker errors after a deploy
+
+1. List recent deployments to identify which version is live:
+   - Search for Workers script deployments, then execute the current list operation.
+2. Check Worker analytics for error rate change after the deploy:
+   - Search for Workers analytics queries and filter by script name and time window covering the deploy.
+3. Check Worker tail/live logs if the script is still erroring:
+   - Search for Workers tail or live logs and start a diagnostic tail session if available.
+4. Cross-reference with Sentry if errors are instrumented — hand off to the sentry skill for event details.
+
+**Report:** current deployment version, error rate before/after deploy, sample error messages, and relevant Cloudflare dashboard link.
+
+---
+
+## Find latest failed Workers Build
+
+1. List recent builds for the account:
+   - Search for Workers Builds list operations and filter for failed or recent builds.
+2. Get the failing build's details:
+   - Search for the build detail operation using the build ID.
+3. Fetch the build logs:
+   - Search for build log retrieval and execute it only for the relevant build.
+
+**Report:** build ID, trigger (branch/commit), failure timestamp, error lines from build log, dashboard link.
+
+---
+
+## Query logs for a specific ray ID or error
+
+1. Tail logs for the Worker in question (live or recent):
+   - Search for Workers tail or live logs and start a diagnostic tail session if available.
+2. For Logpush (stored logs), check job health first:
+   - Search for account-level or zone-level Logpush jobs.
+   - Look for `last_complete` and `last_error` fields to confirm delivery health
+3. If the user has a ray ID (`CF-Ray` header value), it can be used to search stored logs in the configured destination (R2, S3, Splunk, etc.) — note this is outside Cloudflare's API surface.
+
+---
+
+## Check Logpush delivery health
+
+1. List jobs:
+   - Search for account-level or zone-level Logpush jobs.
+2. For each job, check:
+   - `enabled`: whether the job is active
+   - `last_complete`: last successful delivery timestamp
+   - `last_error`: last error timestamp and message
+   - `error_message`: most recent error detail
+3. Flag jobs where `last_error` is more recent than `last_complete`.
+
+**Report:** table of job names, destinations, enabled status, last complete, last error.
+
+---
+
+## Check DNS record and proxy status
+
+1. Resolve zone ID from domain name:
+   - Search for zone lookup by name and execute it with the requested domain.
+2. List DNS records (optionally filter by name or type):
+   - Search for DNS record list/filter operations and constrain by record name or type.
+3. For each relevant record, note:
+   - `name`, `type`, `content` (IP/value), `ttl`, `proxied` (orange/grey cloud)
+   - For MX records: `priority`
+   - For TXT records: full content (SPF/DMARC)
+
+**Caution:** Report what exists before suggesting changes. See `safety-and-permissions.md` before making DNS changes.
+
+---
+
+## Check load balancer pool health
+
+1. List pools:
+   - Search for load balancer pool list operations.
+2. Get health for a specific pool:
+   - Search for pool health operations.
+3. Check origins within the pool for `healthy` flag and failure counts.
+4. Check associated monitors for their health check config:
+   - Search for load balancer monitor detail operations.
+
+**Report:** pool name, total origins, healthy origin count, failing origins and their IPs, monitor type and expected response.
+
+---
+
+## Prepare a Worker rollback
+
+**This is a write operation. Follow the safety workflow in `safety-and-permissions.md`.**
+
+1. List deployments to find the rollback target:
+   - Search for Workers script deployments and list recent versions/deployments.
+2. Identify last known good deployment (by version tag, timestamp, or user input).
+3. Compare compatibility date, bindings, routes, and env var metadata between current and target.
+4. Show the proposed rollback: current version → target version, timestamp delta, any binding or config changes.
+5. **Wait for explicit user approval.**
+6. Deploy the target version:
+   - Search for the current Worker deployment operation and execute it with the target version pinned.
+7. Monitor error rate and tail logs after rollback.
+
+---
+
+## Audit recent configuration changes
+
+1. Fetch account audit log:
+   - Search for account audit logs and fetch a bounded recent page.
+2. Filter by actor, action type, or resource type relevant to the incident window.
+3. For zone-level changes, also check zone-specific audit entries.
+
+**Report:** timestamp, actor (user/API key), action, resource type/name, change summary.
+
+---
+
+## Inspect Zero Trust tunnel health
+
+1. List tunnels:
+   - Search for Access or Zero Trust tunnel list operations.
+2. Get tunnel details and connection status:
+   - Search for tunnel detail and tunnel connection operations.
+3. Check `status` field: `healthy`, `degraded`, `inactive`, `down`.
+4. Note the number of active connections and their originating connectors.
+
+**Report:** tunnel name, status, connector count, edge locations connected, dashboard link.