pi-cloudflare 0.1.0

package/skills/cloudflare/references/sandbox/gotchas.md

@@ -0,0 +1,194 @@
+# Gotchas & Best Practices
+
+## Common Errors
+
+### "Container running indefinitely"
+
+**Cause:** `keepAlive: true` without calling `destroy()`
+**Solution:** Always call `destroy()` when done with keepAlive containers
+
+```typescript
+const sandbox = getSandbox(env.Sandbox, 'temp', { keepAlive: true });
+try {
+  const result = await sandbox.exec('python script.py');
+  return result.stdout;
+} finally {
+  await sandbox.destroy();  // REQUIRED to free resources
+}
+```
+
+### "CONTAINER_NOT_READY"
+
+**Cause:** Container still provisioning (first request or after sleep)
+**Solution:** Retry after 2-3s
+
+```typescript
+async function execWithRetry(sandbox, cmd) {
+  for (let i = 0; i < 3; i++) {
+    try {
+      return await sandbox.exec(cmd);
+    } catch (e) {
+      if (e.code === 'CONTAINER_NOT_READY') {
+        await new Promise(r => setTimeout(r, 2000));
+        continue;
+      }
+      throw e;
+    }
+  }
+}
+```
+
+### "Connection refused: container port not found"
+
+**Cause:** Missing `EXPOSE` directive in Dockerfile
+**Solution:** Add `EXPOSE <port>` to Dockerfile (only needed for `wrangler dev`, production auto-exposes)
+
+### "Preview URLs not working"
+
+**Cause:** Custom domain not configured, wildcard DNS missing, `normalizeId` not set, or `proxyToSandbox()` not called
+**Solution:** Check:
+1. Custom domain configured? (not `.workers.dev`)
+2. Wildcard DNS set up? (`*.domain.com → worker.domain.com`)
+3. `normalizeId: true` in getSandbox?
+4. `proxyToSandbox()` called first in fetch?
+
+### "Slow first request"
+
+**Cause:** Cold start (container provisioning)
+**Solution:**
+- Use `sleepAfter` instead of creating new sandboxes
+- Pre-warm with cron triggers
+- Set `keepAlive: true` for critical sandboxes
+
+### "File not persisting"
+
+**Cause:** Files in `/tmp` or other ephemeral paths
+**Solution:** Use `/workspace` for persistent files
+
+### "Bucket mounting doesn't work locally"
+
+**Cause:** Bucket mounting requires FUSE, not available in `wrangler dev`
+**Solution:** Test bucket mounting in production only. Use mock data locally.
+
+### "Different normalizeId = different sandbox"
+
+**Cause:** Changing `normalizeId` option changes Durable Object ID
+**Solution:** Set `normalizeId` consistently. `normalizeId: true` lowercases the ID.
+
+```typescript
+// These create DIFFERENT sandboxes:
+getSandbox(env.Sandbox, 'MyApp');              // DO ID: hash('MyApp')
+getSandbox(env.Sandbox, 'MyApp', { normalizeId: true });  // DO ID: hash('myapp')
+```
+
+### "Code context variables disappeared"
+
+**Cause:** Container restart clears code context state
+**Solution:** Code contexts are ephemeral. Recreate context after container sleep/wake.
+
+## Performance Optimization
+
+### Sandbox ID Strategy
+
+```typescript
+// ❌ BAD: New sandbox every time (slow)
+const sandbox = getSandbox(env.Sandbox, `user-${Date.now()}`);
+
+// ✅ GOOD: Reuse per user
+const sandbox = getSandbox(env.Sandbox, `user-${userId}`);
+```
+
+### Sleep & Traffic Config
+
+```typescript
+// Cost-optimized
+getSandbox(env.Sandbox, 'id', { sleepAfter: '30m', keepAlive: false });
+
+// Always-on (requires destroy())
+getSandbox(env.Sandbox, 'id', { keepAlive: true });
+```
+
+```jsonc
+// High traffic: increase max_instances
+{ "containers": [{ "class_name": "Sandbox", "max_instances": 50 }] }
+```
+
+## Security Best Practices
+
+### Sandbox Isolation
+- Each sandbox = isolated container (filesystem, network, processes)
+- Use unique sandbox IDs per tenant for multi-tenant apps
+- Sandboxes cannot communicate directly
+
+### Input Validation
+
+```typescript
+// ❌ DANGEROUS: Command injection
+const result = await sandbox.exec(`python3 -c "${userCode}"`);
+
+// ✅ SAFE: Write to file, execute file
+await sandbox.writeFile('/workspace/user_code.py', userCode);
+const result = await sandbox.exec('python3 /workspace/user_code.py');
+```
+
+### Resource Limits
+
+```typescript
+// Timeout long-running commands
+const result = await sandbox.exec('python3 script.py', {
+  timeout: 30000  // 30 seconds
+});
+```
+
+### Secrets Management
+
+```typescript
+// ❌ NEVER hardcode secrets
+const token = 'ghp_abc123';
+
+// ✅ Use environment secrets
+const token = env.GITHUB_TOKEN;
+
+// Pass to sandbox via exec env
+const result = await sandbox.exec('git clone ...', {
+  env: { GIT_TOKEN: token }
+});
+```
+
+### Preview URL Security
+Preview URLs include auto-generated tokens:
+```
+https://8080-sandbox-abc123def456.yourdomain.com
+```
+Token changes on each expose operation, preventing unauthorized access.
+
+## Limits
+
+| Resource | Lite | Standard | Heavy |
+|----------|------|----------|-------|
+| RAM | 256MB | 512MB | 1GB |
+| vCPU | 0.5 | 1 | 2 |
+
+| Operation | Default Timeout | Override |
+|-----------|----------------|----------|
+| Container provisioning | 30s | `SANDBOX_INSTANCE_TIMEOUT_MS` |
+| Port readiness | 90s | `SANDBOX_PORT_TIMEOUT_MS` |
+| exec() | None (no default) | `timeout` option |
+| sleepAfter | 10m | `sleepAfter` option |
+
+**Performance**:
+- **First deploy**: 2-3 min for container build
+- **Cold start**: 2-3s when waking from sleep
+- **Bucket mounting**: Production only (FUSE not in dev)
+
+## Production Guide
+
+See: https://developers.cloudflare.com/sandbox/guides/production-deployment/
+
+## Resources
+
+- [Official Docs](https://developers.cloudflare.com/sandbox/)
+- [API Reference](https://developers.cloudflare.com/sandbox/api/)
+- [Examples](https://github.com/cloudflare/sandbox-sdk/tree/main/examples)
+- [npm Package](https://www.npmjs.com/package/@cloudflare/sandbox)
+- [Discord Support](https://discord.cloudflare.com)

package/skills/cloudflare/references/sandbox/patterns.md

@@ -0,0 +1,201 @@
+# Common Patterns
+
+## AI Code Execution with Code Context
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { code, variables } = await request.json();
+    const sandbox = getSandbox(env.Sandbox, 'ai-agent');
+    
+    // Create context with persistent variables
+    const ctx = await sandbox.createCodeContext({
+      language: 'python',
+      variables: variables || {}
+    });
+    
+    // Execute with rich outputs (text, images, HTML)
+    const result = await sandbox.runCode(code, { context: ctx });
+    
+    return Response.json({
+      results: result.results,  // RichOutput[] (text, html, png, json, etc.)
+      error: result.error,
+      success: !result.error
+    });
+  }
+};
+```
+
+## Interactive Dev Environment
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const proxyResponse = await proxyToSandbox(request, env);
+    if (proxyResponse) return proxyResponse;
+    
+    const sandbox = getSandbox(env.Sandbox, 'ide', { normalizeId: true });
+    
+    if (request.url.endsWith('/start')) {
+      await sandbox.exec('curl -fsSL https://code-server.dev/install.sh | sh');
+      await sandbox.startProcess('code-server --bind-addr 0.0.0.0:8080', {
+        processId: 'vscode'
+      });
+      
+      const exposed = await sandbox.exposePort(8080);
+      return Response.json({ url: exposed.url });
+    }
+    
+    return new Response('Try /start');
+  }
+};
+```
+
+## WebSocket Real-Time Service
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const proxyResponse = await proxyToSandbox(request, env);
+    if (proxyResponse) return proxyResponse;
+
+    if (request.headers.get('Upgrade')?.toLowerCase() === 'websocket') {
+      const sandbox = getSandbox(env.Sandbox, 'realtime-service');
+      return await sandbox.wsConnect(request, 8080);
+    }
+
+    // Non-WebSocket: expose preview URL
+    const sandbox = getSandbox(env.Sandbox, 'realtime-service');
+    const { url } = await sandbox.exposePort(8080, {
+      hostname: new URL(request.url).hostname
+    });
+    return Response.json({ wsUrl: url.replace('https', 'wss') });
+  }
+};
+```
+
+**Dockerfile**:
+```dockerfile
+FROM docker.io/cloudflare/sandbox:0.7.0
+RUN npm install -g ws
+EXPOSE 8080
+```
+
+## Process Readiness Pattern
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const sandbox = getSandbox(env.Sandbox, 'app-server');
+    
+    // Start server
+    const process = await sandbox.startProcess(
+      'node server.js',
+      { processId: 'server' }
+    );
+    
+    // Wait for server to be ready
+    await process.waitForPort(8080);  // Wait for port listening
+    
+    // Now safe to expose
+    const { url } = await sandbox.exposePort(8080);
+    return Response.json({ url });
+  }
+};
+```
+
+## Persistent Data with Bucket Mounting
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const sandbox = getSandbox(env.Sandbox, 'data-processor');
+    
+    // Mount R2 bucket (production only)
+    await sandbox.mountBucket(env.DATA_BUCKET, '/data', {
+      readOnly: false
+    });
+    
+    // Process files in bucket
+    const result = await sandbox.exec('python3 /workspace/process.py', {
+      env: { DATA_DIR: '/data/input' }
+    });
+    
+    // Results written to /data/output are persisted in R2
+    return Response.json({ success: result.success });
+  }
+};
+```
+
+## CI/CD Pipeline
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const { repo, branch } = await request.json();
+    const sandbox = getSandbox(env.Sandbox, `ci-${repo}-${Date.now()}`);
+    
+    await sandbox.exec(`git clone -b ${branch} ${repo} /workspace/repo`);
+    
+    const install = await sandbox.exec('npm install', {
+      cwd: '/workspace/repo',
+      stream: true,
+      onOutput: (stream, data) => console.log(data)
+    });
+    
+    if (!install.success) {
+      return Response.json({ success: false, error: 'Install failed' });
+    }
+    
+    const test = await sandbox.exec('npm test', { cwd: '/workspace/repo' });
+    
+    return Response.json({
+      success: test.success,
+      output: test.stdout,
+      exitCode: test.exitCode
+    });
+  }
+};
+```
+
+
+
+
+
+## Multi-Tenant Pattern
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const userId = request.headers.get('X-User-ID');
+    const sandbox = getSandbox(env.Sandbox, 'multi-tenant');
+    
+    // Each user gets isolated session
+    let session;
+    try {
+      session = await sandbox.getSession(userId);
+    } catch {
+      session = await sandbox.createSession({
+        id: userId,
+        cwd: `/workspace/users/${userId}`,
+        env: { USER_ID: userId }
+      });
+    }
+    
+    const code = await request.text();
+    const result = await session.exec(`python3 -c "${code}"`);
+    
+    return Response.json({ output: result.stdout });
+  }
+};
+```
+
+## Git Operations
+
+```typescript
+// Clone repo
+await sandbox.exec('git clone https://github.com/user/repo.git /workspace/repo');
+
+// Authenticated (use env secrets)
+await sandbox.exec(`git clone https://${env.GITHUB_TOKEN}@github.com/user/repo.git`);
+```

package/skills/cloudflare/references/secrets-store/README.md

@@ -0,0 +1,74 @@
+# Cloudflare Secrets Store
+
+Account-level encrypted secret management for Workers and AI Gateway.
+
+## Overview
+
+**Secrets Store**: Centralized, account-level secrets, reusable across Workers
+**Worker Secrets**: Per-Worker secrets (`wrangler secret put`)
+
+### Architecture
+
+- **Store**: Container (1/account in beta)
+- **Secret**: String ≤1024 bytes
+- **Scopes**: Permission boundaries controlling access
+  - `workers`: For Workers runtime access
+  - `ai-gateway`: For AI Gateway access
+  - Secrets must have correct scope for binding to work
+- **Bindings**: Connect secrets via `env` object
+
+**Regional Availability**: Global except China Network (unavailable)
+
+### Access Control
+
+- **Super Admin**: Full access
+- **Admin**: Create/edit/delete secrets, view metadata
+- **Deployer**: View metadata + bindings
+- **Reporter**: View metadata only
+
+API Token permissions: `Account Secrets Store Edit/Read`
+
+### Limits (Beta)
+
+- 100 secrets/account
+- 1 store/account
+- 1024 bytes max/secret
+- Production secrets count toward limit
+
+## When to Use
+
+**Use Secrets Store when:**
+- Multiple Workers share same credential
+- Centralized management needed
+- Compliance requires audit trail
+- Team collaboration on secrets
+
+**Use Worker Secrets when:**
+- Secret unique to one Worker
+- Simple single-Worker project
+- No cross-Worker sharing needed
+
+## In This Reference
+
+### Reading Order by Task
+
+| Task | Start Here | Then Read |
+|------|------------|-----------|
+| Quick overview | README.md | - |
+| First-time setup | README.md → configuration.md | api.md |
+| Add secret to Worker | configuration.md | api.md |
+| Implement access pattern | api.md | patterns.md |
+| Debug errors | gotchas.md | api.md |
+| Secret rotation | patterns.md | configuration.md |
+| Best practices | gotchas.md | patterns.md |
+
+### Files
+
+- [configuration.md](./configuration.md) - Wrangler commands, binding config
+- [api.md](./api.md) - Binding API, get/put/delete operations
+- [patterns.md](./patterns.md) - Rotation, encryption, access control
+- [gotchas.md](./gotchas.md) - Security issues, limits, best practices
+
+## See Also
+- [workers](../workers/) - Worker bindings integration
+- [wrangler](../wrangler/) - CLI secret management commands

package/skills/cloudflare/references/secrets-store/api.md

@@ -0,0 +1,200 @@
+# API Reference
+
+## Binding API
+
+### Basic Access
+
+**CRITICAL**: Async `.get()` required - secrets NOT directly available.
+
+**`.get()` throws on error** - does NOT return null. Always use try/catch.
+
+```typescript
+interface Env {
+  API_KEY: { get(): Promise<string> };
+}
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const apiKey = await env.API_KEY.get();
+    return fetch("https://api.example.com", {
+      headers: { "Authorization": `Bearer ${apiKey}` }
+    });
+  }
+}
+```
+
+### Error Handling
+
+```typescript
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    try {
+      const apiKey = await env.API_KEY.get();
+      return fetch("https://api.example.com", {
+        headers: { "Authorization": `Bearer ${apiKey}` }
+      });
+    } catch (error) {
+      console.error("Secret access failed:", error);
+      return new Response("Configuration error", { status: 500 });
+    }
+  }
+}
+```
+
+### Multiple Secrets & Patterns
+
+```typescript
+// Parallel fetch
+const [stripeKey, sendgridKey] = await Promise.all([
+  env.STRIPE_KEY.get(),
+  env.SENDGRID_KEY.get()
+]);
+
+// ❌ Missing .get()
+const key = env.API_KEY;
+
+// ❌ Module-level cache
+const CACHED_KEY = await env.API_KEY.get(); // Fails
+
+// ✅ Request-scope cache
+const key = await env.API_KEY.get(); // OK - reuse within request
+```
+
+## REST API
+
+Base: `https://api.cloudflare.com/client/v4`
+
+### Auth
+
+```bash
+curl -H "Authorization: Bearer $CF_TOKEN" \
+  https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/secrets_store/stores
+```
+
+### Store Operations
+
+```bash
+# List
+GET /accounts/{account_id}/secrets_store/stores
+
+# Create
+POST /accounts/{account_id}/secrets_store/stores
+{"name": "my-store"}
+
+# Delete
+DELETE /accounts/{account_id}/secrets_store/stores/{store_id}
+```
+
+### Secret Operations
+
+```bash
+# List
+GET /accounts/{account_id}/secrets_store/stores/{store_id}/secrets
+
+# Create (single)
+POST /accounts/{account_id}/secrets_store/stores/{store_id}/secrets
+{
+  "name": "my_secret",
+  "value": "secret_value",
+  "scopes": ["workers"],
+  "comment": "Optional"
+}
+
+# Create (batch)
+POST /accounts/{account_id}/secrets_store/stores/{store_id}/secrets
+[
+  {"name": "secret_one", "value": "val1", "scopes": ["workers"]},
+  {"name": "secret_two", "value": "val2", "scopes": ["workers", "ai-gateway"]}
+]
+
+# Get metadata
+GET /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id}
+
+# Update
+PATCH /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id}
+{"value": "new_value", "comment": "Updated"}
+
+# Delete (single)
+DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id}
+
+# Delete (batch)
+DELETE /accounts/{account_id}/secrets_store/stores/{store_id}/secrets
+{"secret_ids": ["id-1", "id-2"]}
+
+# Duplicate
+POST /accounts/{account_id}/secrets_store/stores/{store_id}/secrets/{secret_id}/duplicate
+{"name": "new_name"}
+
+# Quota
+GET /accounts/{account_id}/secrets_store/quota
+```
+
+### Responses
+
+Success:
+```json
+{
+  "success": true,
+  "result": {
+    "id": "secret-id-123",
+    "name": "my_secret",
+    "created": "2025-01-11T12:00:00Z",
+    "scopes": ["workers"]
+  }
+}
+```
+
+Error:
+```json
+{
+  "success": false,
+  "errors": [{"code": 10000, "message": "Name exists"}]
+}
+```
+
+## TypeScript Helpers
+
+Official types available via `@cloudflare/workers-types`:
+
+```typescript
+import type { SecretsStoreSecret } from "@cloudflare/workers-types";
+
+interface Env {
+  STRIPE_API_KEY: SecretsStoreSecret;
+  DATABASE_URL: SecretsStoreSecret;
+  WORKER_SECRET: string; // Regular Worker secret (direct access)
+}
+```
+
+Custom helper type:
+
+```typescript
+interface SecretsStoreBinding {
+  get(): Promise<string>;
+}
+
+// Fallback helper
+async function getSecretWithFallback(
+  primary: SecretsStoreBinding,
+  fallback?: SecretsStoreBinding
+): Promise<string> {
+  try {
+    return await primary.get();
+  } catch (error) {
+    if (fallback) return await fallback.get();
+    throw error;
+  }
+}
+
+// Batch helper
+async function getAllSecrets(
+  secrets: Record<string, SecretsStoreBinding>
+): Promise<Record<string, string>> {
+  const entries = await Promise.all(
+    Object.entries(secrets).map(async ([k, v]) => [k, await v.get()])
+  );
+  return Object.fromEntries(entries);
+}
+```
+
+See: [configuration.md](./configuration.md), [patterns.md](./patterns.md), [gotchas.md](./gotchas.md)