@gadgets/gatekeeper-kit is a library, not a deployable Worker. Do not add a cloudflare.config.ts: the wrangler.jsonc generated from it is what makes release tooling treat this package as a gatekeeper deployment. - Only Layer 1 leaf modules are shipped. Layer 2 remains a proposal in ../../plans/gatekeeper-kit.md. - Keep leaf modules independently usable. Do not make one depend on a future assembly layer. - Add a leaf, or a leaf option, only for behavior several gatekeepers share under one contract. Behavior only…
12k55d agoReviewMountCreate a free account to mount
Microsoft 365 (Entra ID OAuth, Microsoft Graph). It has three resources. SharePoint's binding is one of: all of SharePoint & OneDrive, a site, a library or OneDrive, a folder, a file, a list, or a page; its configurator starts at "all" and drills down. Outlook's is one mailbox (own or shared), optionally narrowed to a folder, a conversation or senders, at read/draft/send. Calendar's is every calendar (for chat), one calendar (own or shared) at freeBusy/limited/full detail (for a gadget shared…
12k55d agoReviewMountCreate a free account to mount
Web Search — an auto-provisioned gatekeeper whose account provides an ambient WEB_SEARCH singleton. The README is the design record. - It searches the public web through its own Workers AI binding (websearch(), through the AI Gateway its CF_AI_GATEWAY var names, provider pinned to Ceramic). The deploy service sets that var to the instance's gateway, the backend's; anywhere else it defaults to the account's default gateway. - Each query is recorded as an observation before it is sent. A workspace that…
12k55d agoReviewMountCreate a free account to mount
X (formerly Twitter) — account / post / List / read-only profile resources over plain fetch (the twitter-api-v2 package breaks on Workers). plans/x-gatekeeper.md is the design record. X's API is pay-per-use and bills every resource a read returns, so cost is part of the design and easy to undo by accident: - Every read goes through the gatekeeper's #read, which reserves against the connection's daily read limit (X_DAILY_READ_LIMIT, counted per UTC day in the UserAccount DO across all of the…
12k55d agoReviewMountCreate a free account to mount
The shared implementation behind the two MCP gatekeepers — gatekeeper-mcp (endpoints a user pastes) and gatekeeper-mcp-portal (one admin-configured portal). Not a Worker; a library both import, holding the MCP client, the OAuth chain, the account DO base, the resource-URL scope grammar, and the queued-action store. See README.md and each connector's README. - The trust boundary is tools.ts, and nothing outside it reads a tool's annotations: a tool the server declares readOnlyHint: true runs as an observation, everything else is queued…
12k55d agoReviewMountCreate a free account to mount
@gadgets/observability: server-side logging, issue reporting and usage metrics. Frontend browser console.* is out of scope, and frontend error reporting is packages/error-reporting/AGENTS.md. Server-side logging uses @gadgets/observability/logger: - Define a package-owned field type and module-scoped logger with a stable dot-separated component and, for gatekeepers, vendorId: const logger = createLogger<GitHubLogFields>({ component: "gatekeeper.github", vendorId: VENDOR_ID });. - Emit concrete event names and relevant typed fields, for example: logger.warn("failed to notify credential expiry", { event: "credentials.expiry.notify.failed", error: err });. Each call emits one indexed object;…
12k55d agoReviewMountCreate a free account to mount
@gadgets/ui is the shared runtime React UI layer for the Workshop and gatekeeper management apps. Kumo owns low-level controls and semantic tokens; this package owns reusable Gadgets interaction patterns and composed components. - Add a component here when at least two independent frontends need the same feature-independent behavior or when consistency across those frontends is an explicit product requirement. - Keep product data fetching, routing, RPC, permissions, and domain workflows in the consuming app. - Check Kumo before adding a…
12k55d agoReviewMountCreate a free account to mount
The Gadgets Workshop server on Cloudflare Workers: the kernel, held to the bar in the root AGENTS.md (The kernel). The backend installs the bundled blueprints from @gadgets/bundled-blueprints on a deployment's first /api request, and offers them as the deployment's standard output formats. scripts/build-bundled-blueprints.ts generates the gitignored src/generated/bundled-blueprints.ts they are installed from, which holds each blueprint's manifest and built files (BUNDLED_BLUEPRINTS_DIR overrides the source directory), so build and test both run the generator first; pnpm import:bundled-blueprint updates or adds a blueprint…
12k55d agoReviewMountCreate a free account to mount
This package is the Workshop single-page application. It uses React, TanStack Router, Tailwind, and Kumo. Follow the repository-wide guidance in ../../AGENTS.md in addition to this file. Organize new code by product ownership first and implementation type second. The existing tree predates this convention. Apply it to new code and to code being substantially reworked; do not migrate unrelated files opportunistically. Feature directories own product behavior. A feature may contain components, hooks, tests, and utilities that belong to that behavior. Start…
12k55d agoReviewMountCreate a free account to mount
How customer instances get deployed. - build-release.ts bundles every deployable worker byte-identically (wrangler dry-run with the pinned wrangler), builds the Access-mode frontend asset build, and generates the release manifest — the contract between this repo's CI and the deploy service, produced by manifest-lib.ts from each package's wrangler.jsonc with account-specific values replaced by placeholders ($ACCOUNT_ID, $WORKER_NAME(...), $SECRET(...), $PUBLIC_BASE_URL, ...). - upload-release.ts mirrors the release to R2 content-addressed, manifest last; with --candidate the manifest lands under candidates/<id>/ (invisible to the deploy service)…
12k55d agoReviewMountCreate a free account to mount
- README.md — what this repo is and how the pieces fit together. - CONTRIBUTING.md — public contribution paths. - COLLABORATORS.md — setup, checks, commit and pull request conventions. The canonical source for the day-to-day workflow. - docs/README.md — design specification. Forward- looking; treat as intent, not as a description of main. - docs/08_capnweb_interface.md — the RPC contract between the Durable Object and computerd. Required reading before touching packages/rpc or packages/computer. - Each package's own README.md — implementation status and…
Steady5 mentions in 2 weeks
No other project uses it yet
9.9k3mo agoReviewMountCreate a free account to mount
capnweb RPC patterns for this repo, with a heavy focus on stub lifecycle and disposal. Load when touching anything that crosses the Durable Object ↔ computerd boundary: packages/rpc, packages/computer, the computerd client, or the Durable Object server. Triggers include "capnweb", "RpcTarget", "stub", "RPC wire", "promise pipelining", "stub disposal", "RpcPromise".
Steady5 mentions in 2 weeks
No other project uses it yet
9.9k3mo agoReviewMountCreate a free account to mount
Index of Cloudflare-platform skills relevant to this repo. Load when working on anything that touches Workers, Durable Objects, wrangler, the sandbox SDK, the agents SDK, or other Cloudflare platform surface. Triggers include "Cloudflare", "Workers", "Durable Object", "wrangler", "KV", "R2", "D1", "Vectorize", "Containers", "sandbox".
Style guidance for the written word. Use when asked to write code comments, commit messages, pull requests, READMEs, or documentation. Triggers might be phrases like "write a commit", "document this", or "add a README".
Steady5 mentions in 2 weeks
14 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Describes how to write pull/merge requests. Use when asked to write or edit a pull request or merge request description. This skill is not relevant to commit messages.
Steady5 mentions in 2 weeks
15 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Drives development with tests. Use when implementing any logic, fixing any bug, or changing any behavior. Use when you need to prove that code works, when a bug report arrives, or when you're about to modify existing functionality.
How exec works in this workspace. The command is the source of an ECMAScript module, evaluated in a fresh Dynamic Worker, not a shell command. Read this before running code, and when a run fails with "Disallowed operation called within global scope" or returns nothing.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
How exec works in this workspace. Commands run in bash in a real Linux container, with Node.js, git and network access, and the workspace is synced in and out around each call. Read this before running commands, installing packages, or debugging files that don't show up where you expect.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
A sample skill shipped with the Worker. Read it to see how files bundled with computerBundle() reach the workspace, or run its script to check the shell works.
Steady5 mentions in 2 weeks
7 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
How exec works in this workspace. Commands run in just-bash, a bash interpreter inside a Dynamic Worker, not on a Linux machine. Read this before running a command, and when a command is "not found" or behaves differently from real bash.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md or AGENTS.md?
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
What is a skill?
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Can I search my own team's files too?
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
CloudflareAGENTS.md