opencode-starterkit 1.0.1

package/baseline/skill/cloudflare/references/sandbox/configuration.md

@@ -0,0 +1,131 @@
+# Configuration
+
+## getSandbox Options
+
+```typescript
+const sandbox = getSandbox(env.Sandbox, 'sandbox-id', {
+  normalizeId: true,         // lowercase ID (required for preview URLs)
+  sleepAfter: '30m',         // sleep after inactivity: '5m', '1h', '2d'
+  keepAlive: false,          // false = auto-timeout, true = never sleep
+  
+  containerTimeouts: {
+    instanceGetTimeoutMS: 30000,  // 30s for provisioning
+    portReadyTimeoutMS: 90000     // 90s for container startup
+  }
+});
+```
+
+**Sleep Config**:
+- `sleepAfter`: Duration string (e.g., '5m', '30m', '1h')
+- `keepAlive: false`: Auto-sleep (default, cost-optimized)
+- `keepAlive: true`: Never sleep (higher cost, faster response)
+- Sleeping sandboxes wake automatically (cold start)
+
+## Instance Types
+
+wrangler.jsonc `instance_type`:
+- `lite`: 256MB RAM, 0.5 vCPU (default)
+- `standard`: 512MB RAM, 1 vCPU
+- `heavy`: 1GB RAM, 2 vCPU
+
+## Dockerfile Patterns
+
+**Basic**:
+```dockerfile
+FROM docker.io/cloudflare/sandbox:latest
+RUN pip3 install --no-cache-dir pandas numpy
+EXPOSE 8080  # Required for wrangler dev
+```
+
+**Scientific**:
+```dockerfile
+FROM docker.io/cloudflare/sandbox:latest
+RUN pip3 install --no-cache-dir \
+    jupyter-server ipykernel matplotlib \
+    pandas seaborn plotly scipy scikit-learn
+```
+
+**Node.js**:
+```dockerfile
+FROM docker.io/cloudflare/sandbox:latest
+RUN npm install -g typescript ts-node
+```
+
+**CRITICAL**: `EXPOSE` required for `wrangler dev` port access. Production auto-exposes all ports.
+
+## CLI Commands
+
+```bash
+# Dev
+wrangler dev                    # Start local dev server
+wrangler deploy                 # Deploy to production
+wrangler tail                   # Monitor logs
+wrangler containers list        # Check container status
+wrangler secret put KEY         # Set secret
+```
+
+## Environment & Secrets
+
+**wrangler.jsonc**:
+```jsonc
+{
+  "vars": {
+    "ENVIRONMENT": "production",
+    "API_URL": "https://api.example.com"
+  },
+  "r2_buckets": [{
+    "binding": "DATA_BUCKET",
+    "bucket_name": "my-data-bucket"
+  }]
+}
+```
+
+**Usage**:
+```typescript
+const token = env.GITHUB_TOKEN;  // From wrangler secret
+await sandbox.exec('git clone ...', {
+  env: { GIT_TOKEN: token }
+});
+```
+
+## Preview URL Setup
+
+**Prerequisites**:
+- Custom domain with wildcard DNS: `*.yourdomain.com → worker.yourdomain.com`
+- `.workers.dev` domains NOT supported
+- `normalizeId: true` in getSandbox
+- `proxyToSandbox()` called first in fetch handler
+
+## Cron Triggers (Pre-warming)
+
+```jsonc
+{
+  "triggers": {
+    "crons": ["*/5 * * * *"]  // Every 5 minutes
+  }
+}
+```
+
+```typescript
+export default {
+  async scheduled(event: ScheduledEvent, env: Env) {
+    const sandbox = getSandbox(env.Sandbox, 'main');
+    await sandbox.exec('echo "keepalive"');  // Wake sandbox
+  }
+};
+```
+
+## R2 Storage Integration
+
+```typescript
+await sandbox.mountStorage({
+  type: 'r2',
+  bucket: env.DATA_BUCKET,
+  mountPoint: '/data',
+  readOnly: false
+});
+
+// Access mounted storage
+await sandbox.exec('python3 process.py', { cwd: '/data/datasets' });
+await sandbox.writeFile('/data/output/results.csv', csvData);
+```

package/baseline/skill/cloudflare/references/sandbox/gotchas.md

@@ -0,0 +1,156 @@
+# Gotchas & Best Practices
+
+## Common Issues
+
+### Container Not Ready
+**Error**: `CONTAINER_NOT_READY`  
+**Cause**: Container still provisioning (first request or after sleep)  
+**Fix**: Retry after 2-3s
+
+```typescript
+async function execWithRetry(sandbox, cmd) {
+  for (let i = 0; i < 3; i++) {
+    try {
+      return await sandbox.exec(cmd);
+    } catch (e) {
+      if (e.code === 'CONTAINER_NOT_READY') {
+        await new Promise(r => setTimeout(r, 2000));
+        continue;
+      }
+      throw e;
+    }
+  }
+}
+```
+
+### Port Exposure Fails in Dev
+**Error**: "Connection refused: container port not found"  
+**Cause**: Missing `EXPOSE` directive in Dockerfile  
+**Fix**: Add `EXPOSE <port>` to Dockerfile (only needed for `wrangler dev`, production auto-exposes)
+
+### Preview URLs Not Working
+**Checklist**:
+1. Custom domain configured? (not `.workers.dev`)
+2. Wildcard DNS set up? (`*.domain.com → worker.domain.com`)
+3. `normalizeId: true` in getSandbox?
+4. `proxyToSandbox()` called first in fetch?
+
+### Slow First Request
+**Cause**: Cold start (container provisioning)  
+**Solutions**:
+- Use `sleepAfter` instead of creating new sandboxes
+- Pre-warm with cron triggers
+- Set `keepAlive: true` for critical sandboxes
+
+### File Not Persisting
+**Cause**: Files in `/tmp` or other ephemeral paths  
+**Fix**: Use `/workspace` for persistent files
+
+## Performance Optimization
+
+### Sandbox ID Strategy
+
+```typescript
+// ❌ BAD: Creates new sandbox every time (slow, expensive)
+const sandbox = getSandbox(env.Sandbox, `user-${Date.now()}`);
+
+// ✅ GOOD: Reuse sandbox per user
+const sandbox = getSandbox(env.Sandbox, `user-${userId}`);
+
+// ✅ GOOD: Reuse for temporary tasks
+const sandbox = getSandbox(env.Sandbox, 'shared-runner');
+```
+
+### Sleep Configuration
+
+```typescript
+// Cost-optimized: Sleep after 30min inactivity
+const sandbox = getSandbox(env.Sandbox, 'id', {
+  sleepAfter: '30m',
+  keepAlive: false
+});
+
+// Always-on (higher cost, faster response)
+const sandbox = getSandbox(env.Sandbox, 'id', {
+  keepAlive: true
+});
+```
+
+### Increase max_instances for High Traffic
+
+```jsonc
+{
+  "containers": [{
+    "class_name": "Sandbox",
+    "max_instances": 50  // Allow 50 concurrent sandboxes
+  }]
+}
+```
+
+## Security Best Practices
+
+### Sandbox Isolation
+- Each sandbox = isolated container (filesystem, network, processes)
+- Use unique sandbox IDs per tenant for multi-tenant apps
+- Sandboxes cannot communicate directly
+
+### Input Validation
+
+```typescript
+// ❌ DANGEROUS: Command injection
+const result = await sandbox.exec(`python3 -c "${userCode}"`);
+
+// ✅ SAFE: Write to file, execute file
+await sandbox.writeFile('/workspace/user_code.py', userCode);
+const result = await sandbox.exec('python3 /workspace/user_code.py');
+```
+
+### Resource Limits
+
+```typescript
+// Timeout long-running commands
+const result = await sandbox.exec('python3 script.py', {
+  timeout: 30000  // 30 seconds
+});
+```
+
+### Secrets Management
+
+```typescript
+// ❌ NEVER hardcode secrets
+const token = 'ghp_abc123';
+
+// ✅ Use environment secrets
+const token = env.GITHUB_TOKEN;
+
+// Pass to sandbox via exec env
+const result = await sandbox.exec('git clone ...', {
+  env: { GIT_TOKEN: token }
+});
+```
+
+### Preview URL Security
+Preview URLs include auto-generated tokens:
+```
+https://8080-sandbox-abc123def456.yourdomain.com
+```
+Token changes on each expose operation, preventing unauthorized access.
+
+## Limits
+
+- **Instance types**: lite (256MB), standard (512MB), heavy (1GB)
+- **Default timeout**: 120s for exec operations
+- **First deploy**: 2-3 min for container provisioning
+- **Cold start**: 2-3s when waking from sleep
+
+## Production Guide
+
+See: https://developers.cloudflare.com/sandbox/guides/production-deployment/
+
+## Resources
+
+- [Official Docs](https://developers.cloudflare.com/sandbox/)
+- [API Reference](https://developers.cloudflare.com/sandbox/api/)
+- [Examples](https://github.com/cloudflare/sandbox-sdk/tree/main/examples)
+- [npm Package](https://www.npmjs.com/package/@cloudflare/sandbox)
+- [Discord Support](https://discord.cloudflare.com)

package/baseline/skill/cloudflare/references/sandbox/patterns.md

@@ -0,0 +1,203 @@
+# Common Patterns
+
+## AI Code Execution Agent
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { code } = await request.json();
+    const sandbox = getSandbox(env.Sandbox, 'ai-agent');
+    
+    // Execute user code safely
+    await sandbox.writeFile('/workspace/user_code.py', code);
+    const result = await sandbox.exec('python3 /workspace/user_code.py');
+    
+    return Response.json({
+      output: result.stdout,
+      error: result.stderr,
+      success: result.success
+    });
+  }
+};
+```
+
+## Interactive Dev Environment
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const proxyResponse = await proxyToSandbox(request, env);
+    if (proxyResponse) return proxyResponse;
+    
+    const sandbox = getSandbox(env.Sandbox, 'ide', { normalizeId: true });
+    
+    if (request.url.endsWith('/start')) {
+      await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');
+      await sandbox.startProcess('code-server --bind-addr 0.0.0.0:8080', {
+        processId: 'vscode'
+      });
+      
+      const exposed = await sandbox.exposePort(8080);
+      return Response.json({ url: exposed.url });
+    }
+    
+    return new Response('Try /start');
+  }
+};
+```
+
+## CI/CD Pipeline
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { repo, branch } = await request.json();
+    const sandbox = getSandbox(env.Sandbox, `ci-${repo}-${Date.now()}`);
+    
+    await sandbox.exec(`git clone -b ${branch} ${repo} /workspace/repo`);
+    
+    const install = await sandbox.exec('npm install', {
+      cwd: '/workspace/repo',
+      stream: true,
+      onOutput: (stream, data) => console.log(data)
+    });
+    
+    if (!install.success) {
+      return Response.json({ success: false, error: 'Install failed' });
+    }
+    
+    const test = await sandbox.exec('npm test', { cwd: '/workspace/repo' });
+    
+    return Response.json({
+      success: test.success,
+      output: test.stdout,
+      exitCode: test.exitCode
+    });
+  }
+};
+```
+
+## Data Analysis Platform
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { notebook } = await request.json();
+    const sandbox = getSandbox(env.Sandbox, 'data-analysis');
+    
+    await sandbox.writeFile('/workspace/analysis.ipynb', JSON.stringify(notebook));
+    
+    const result = await sandbox.exec(
+      'jupyter nbconvert --to notebook --execute analysis.ipynb --output results.ipynb',
+      { cwd: '/workspace' }
+    );
+    
+    const output = await sandbox.readFile('/workspace/results.ipynb');
+    
+    return Response.json({
+      success: result.success,
+      notebook: JSON.parse(output.content)
+    });
+  }
+};
+```
+
+## Multi-Language Code Runner
+
+```typescript
+const languageConfigs = {
+  python: { cmd: 'python3', ext: 'py' },
+  javascript: { cmd: 'node', ext: 'js' },
+  typescript: { cmd: 'ts-node', ext: 'ts' },
+  bash: { cmd: 'bash', ext: 'sh' }
+};
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { language, code } = await request.json();
+    const config = languageConfigs[language];
+    
+    if (!config) {
+      return Response.json({ error: 'Unsupported language' }, { status: 400 });
+    }
+    
+    const sandbox = getSandbox(env.Sandbox, 'code-runner');
+    const filename = `/workspace/script.${config.ext}`;
+    
+    await sandbox.writeFile(filename, code);
+    const result = await sandbox.exec(`${config.cmd} ${filename}`);
+    
+    return Response.json({
+      output: result.stdout,
+      error: result.stderr,
+      exitCode: result.exitCode
+    });
+  }
+};
+```
+
+## Multi-Tenant Pattern
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const userId = request.headers.get('X-User-ID');
+    const sandbox = getSandbox(env.Sandbox, 'multi-tenant');
+    
+    // Each user gets isolated session
+    let session;
+    try {
+      session = await sandbox.getSession(userId);
+    } catch {
+      session = await sandbox.createSession({
+        id: userId,
+        cwd: `/workspace/users/${userId}`,
+        env: { USER_ID: userId }
+      });
+    }
+    
+    const code = await request.text();
+    const result = await session.exec(`python3 -c "${code}"`);
+    
+    return Response.json({ output: result.stdout });
+  }
+};
+```
+
+## Jupyter Integration
+
+**Dockerfile**:
+```dockerfile
+FROM docker.io/cloudflare/sandbox:latest
+RUN pip3 install --no-cache-dir jupyter-server ipykernel matplotlib pandas
+EXPOSE 8888
+```
+
+**Worker**:
+```typescript
+await sandbox.startProcess('jupyter notebook --ip=0.0.0.0 --port=8888 --no-browser', {
+  processId: 'jupyter',
+  cwd: '/workspace'
+});
+
+const exposed = await sandbox.exposePort(8888, { name: 'jupyter' });
+return Response.json({ url: exposed.url });
+```
+
+## Git Operations
+
+```typescript
+// Clone
+await sandbox.exec('git clone https://github.com/user/repo.git /workspace/repo');
+
+// Clone specific branch
+await sandbox.exec('git clone -b main --single-branch https://github.com/user/repo.git /workspace/repo');
+
+// Authenticated clone
+const token = env.GITHUB_TOKEN;
+await sandbox.exec(`git clone https://${token}@github.com/user/private-repo.git`);
+
+// Git ops
+await sandbox.exec('git pull', { cwd: '/workspace/repo' });
+await sandbox.exec('git checkout -b feature', { cwd: '/workspace/repo' });
+```

package/baseline/skill/cloudflare/references/secrets-store/README.md

@@ -0,0 +1,58 @@
+# Cloudflare Secrets Store
+
+Account-level encrypted secret management for Workers and AI Gateway.
+
+## Overview
+
+**Secrets Store**: Centralized, account-level secrets, reusable across Workers
+**Worker Secrets**: Per-Worker secrets (`wrangler secret put`)
+
+### Architecture
+
+- **Store**: Container (1/account in beta)
+- **Secret**: String ≤1024 bytes
+- **Scopes**: Permission boundaries (`workers`, `ai-gateway`)
+- **Bindings**: Connect secrets via `env` object
+
+### Access Control
+
+- **Super Admin**: Full access
+- **Admin**: Create/edit/delete secrets, view metadata
+- **Deployer**: View metadata + bindings
+- **Reporter**: View metadata only
+
+API Token permissions: `Account Secrets Store Edit/Read`
+
+### Limits (Beta)
+
+- 100 secrets/account
+- 1 store/account
+- 1024 bytes max/secret
+- Production secrets count toward limit
+
+## When to Use
+
+**Use Secrets Store when:**
+- Multiple Workers share same credential
+- Centralized management needed
+- Compliance requires audit trail
+- Team collaboration on secrets
+
+**Use Worker Secrets when:**
+- Secret unique to one Worker
+- Simple single-Worker project
+- No cross-Worker sharing needed
+
+## Files
+
+- [configuration.md](./configuration.md) - Wrangler commands, binding config
+- [api.md](./api.md) - Binding API, get/put/delete operations
+- [patterns.md](./patterns.md) - Rotation, encryption, access control
+- [gotchas.md](./gotchas.md) - Security issues, limits, best practices
+
+## References
+
+- [Docs](https://developers.cloudflare.com/secrets-store/)
+- [Workers Integration](https://developers.cloudflare.com/secrets-store/integrations/workers/)
+- [API Reference](https://developers.cloudflare.com/api/resources/secrets_store/)
+- [Wrangler Commands](https://developers.cloudflare.com/workers/wrangler/commands/#secrets-store)