Claude/implement p1 guardrails dc og i

.dev.vars.example

@@ -2,6 +2,17 @@
 # .dev.vars is gitignored and used by wrangler dev
 
 ANTHROPIC_API_KEY=sk-ant-...
+# OPENAI_API_KEY=sk-...
+
+# Cloudflare AI Gateway (alternative to direct provider keys)
+# CLOUDFLARE_AI_GATEWAY_API_KEY=your-provider-api-key
+# CF_AI_GATEWAY_ACCOUNT_ID=your-account-id
+# CF_AI_GATEWAY_GATEWAY_ID=your-gateway-id
+# CF_AI_GATEWAY_MODEL=workers-ai/@cf/meta/llama-3.3-70b-instruct-fp8-fast
+
+# Legacy AI Gateway (still supported)
+# AI_GATEWAY_API_KEY=your-key
+# AI_GATEWAY_BASE_URL=https://gateway.ai.cloudflare.com/v1/{account_id}/{gateway_id}/anthropic
 
 # Local development mode - skips Cloudflare Access auth and bypasses device pairing
 # DEV_MODE=true

.github/workflows/deploy.yml

@@ -0,0 +1,53 @@
+name: Deploy to Cloudflare Workers
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:  # Allow manual trigger
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    name: Deploy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Deploy to Cloudflare Workers
+        run: npx wrangler deploy
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+
+      - name: Set OpenRouter API Key
+        run: |
+          if [ -n "$OPENROUTER_API_KEY" ]; then
+            echo "$OPENROUTER_API_KEY" | npx wrangler secret put OPENROUTER_API_KEY
+          fi
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+
+      - name: Set Telegram Bot Token
+        run: |
+          if [ -n "$TELEGRAM_BOT_TOKEN" ]; then
+            echo "$TELEGRAM_BOT_TOKEN" | npx wrangler secret put TELEGRAM_BOT_TOKEN
+          fi
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}

.github/workflows/test.yml

@@ -23,6 +23,12 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Lint
+        run: npm run lint
+
+      - name: Format check
+        run: npm run format:check
+
       - name: Type check
         run: npm run typecheck
 
@@ -31,7 +37,7 @@ jobs:
 
   e2e:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     permissions:
       contents: write
       pull-requests: write
@@ -50,6 +56,9 @@ jobs:
             env:
               DISCORD_BOT_TOKEN: "fake-discord-bot-token-for-e2e"
               DISCORD_DM_POLICY: "pairing"
+          - name: workers-ai
+            env:
+              CF_AI_GATEWAY_MODEL: "workers-ai/@cf/meta/llama-3.3-70b-instruct-fp8-fast"
 
     name: e2e (${{ matrix.config.name }})
 
@@ -65,6 +74,11 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_wrapper: false
+
       - name: Install Playwright
         run: npx playwright install --with-deps chromium
 
@@ -80,12 +94,24 @@ jobs:
         id: e2e
         continue-on-error: true
         env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.E2E_CLOUDFLARE_API_TOKEN }}
+          CF_ACCOUNT_ID: ${{ secrets.E2E_CF_ACCOUNT_ID }}
+          WORKERS_SUBDOMAIN: ${{ secrets.E2E_WORKERS_SUBDOMAIN }}
+          CF_ACCESS_TEAM_DOMAIN: ${{ secrets.E2E_CF_ACCESS_TEAM_DOMAIN }}
+          R2_ACCESS_KEY_ID: ${{ secrets.E2E_R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.E2E_R2_SECRET_ACCESS_KEY }}
           AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
           AI_GATEWAY_BASE_URL: ${{ secrets.AI_GATEWAY_BASE_URL }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          CLOUDFLARE_AI_GATEWAY_API_KEY: ${{ secrets.CLOUDFLARE_AI_GATEWAY_API_KEY }}
+          CF_AI_GATEWAY_ACCOUNT_ID: ${{ secrets.E2E_CF_ACCOUNT_ID }}
+          CF_AI_GATEWAY_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_GATEWAY_ID }}
+          CF_AI_GATEWAY_MODEL: ${{ matrix.config.env.CF_AI_GATEWAY_MODEL }}
           TELEGRAM_BOT_TOKEN: ${{ matrix.config.env.TELEGRAM_BOT_TOKEN }}
           TELEGRAM_DM_POLICY: ${{ matrix.config.env.TELEGRAM_DM_POLICY }}
           DISCORD_BOT_TOKEN: ${{ matrix.config.env.DISCORD_BOT_TOKEN }}
           DISCORD_DM_POLICY: ${{ matrix.config.env.DISCORD_DM_POLICY }}
+          E2E_TEST_RUN_ID: "${{ github.run_id }}-${{ matrix.config.name }}"
         run: cctr -vv test/e2e
 
       - name: Convert video and generate thumbnail
@@ -97,15 +123,15 @@ jobs:
             for webm in /tmp/moltworker-e2e-videos/*.webm; do
               mp4="${webm%.webm}.mp4"
               thumb="${webm%.webm}.png"
-              
+
               # Convert to mp4
               ffmpeg -y -i "$webm" -c:v libx264 -preset fast -crf 22 -c:a aac "$mp4"
-              
+
               # Extract middle frame as thumbnail
               duration=$(ffprobe -v error -show_entries format=duration -of csv=p=0 "$mp4")
               midpoint=$(echo "$duration / 2" | bc -l)
               ffmpeg -y -ss "$midpoint" -i "$mp4" -vframes 1 -update 1 -q:v 2 "$thumb"
-              
+
               # Add play button overlay using ImageMagick
               width=$(identify -format '%w' "$thumb")
               height=$(identify -format '%h' "$thumb")
@@ -115,7 +141,7 @@ jobs:
                 -fill 'rgba(0,0,0,0.6)' -draw "circle ${cx},${cy} $((cx+50)),${cy}" \
                 -fill 'white' -draw "polygon $((cx-15)),$((cy-25)) $((cx-15)),$((cy+25)) $((cx+30)),${cy}" \
                 "$thumb"
-              
+
               echo "video_path=$mp4" >> $GITHUB_OUTPUT
               echo "video_name=$(basename $mp4)" >> $GITHUB_OUTPUT
               echo "thumb_path=$thumb" >> $GITHUB_OUTPUT

.gitignore

@@ -34,6 +34,9 @@ Thumbs.db
 # TypeScript
 *.tsbuildinfo
 
+# Generated by wrangler types (regenerated during typecheck)
+worker-configuration.d.ts
+
 # Docker build artifacts
 *.tar
 
@@ -44,4 +47,20 @@ Thumbs.db
 *.greger
 
 # playwright-cli
-.playwright-cli/
+.playwright-cli/
+
+# Terraform
+*.tfstate
+*.tfstate.*
+.terraform/
+.terraform.lock.hcl
+terraform.tfvars
+
+# E2E test credentials
+test/e2e/.dev.vars
+
+# Temporary e2e wrangler configs
+.wrangler-e2e-*.jsonc
+
+# npm config (may contain registry overrides for @cloudflare packages)
+.npmrc

.oxfmtrc.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "singleQuote": true,
+  "tabWidth": 2,
+  "useTabs": false,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "arrowParens": "always",
+  "endOfLine": "lf",
+  "ignorePatterns": ["dist", "node_modules"]
+}

.oxlintrc.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://raw.githubusercontent.com/oxc-project/oxc/main/npm/oxlint/configuration_schema.json",
+  "plugins": ["react", "typescript", "unicorn", "oxc", "import", "vitest"],
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn",
+    "perf": "warn"
+  },
+  "rules": {
+    "no-unused-vars": "warn",
+    "react/react-in-jsx-scope": "off",
+    "import/no-unassigned-import": "off"
+  },
+  "ignorePatterns": ["dist", "node_modules", "*.d.ts"]
+}

AGENTS.md

@@ -2,6 +2,8 @@
 
 Guidelines for AI agents working on this codebase.
 
+> **IMPORTANT:** Also read `CLAUDE.md` for project instructions and `claude-share/core/SYNC_CHECKLIST.md` for post-task requirements.
+
 ## Project Overview
 
 This is a Cloudflare Worker that runs [Moltbot](https://molt.bot/) in a Cloudflare Sandbox container. It provides:
@@ -244,3 +246,83 @@ R2 is mounted via s3fs at `/data/moltbot`. Important gotchas:
 - **Never delete R2 data**: The mount directory `/data/moltbot` IS the R2 bucket. Running `rm -rf /data/moltbot/*` will DELETE your backup data. Always check mount status before any destructive operations.
 
 - **Process status**: The sandbox API's `proc.status` may not update immediately after a process completes. Instead of checking `proc.status === 'completed'`, verify success by checking for expected output (e.g., timestamp file exists after sync).
+
+---
+
+## Multi-Agent Coordination
+
+> Multiple AI assistants (Claude, Codex, others) work on this codebase simultaneously.
+> These rules ensure coordination without conflicts.
+
+### Orchestration Documentation
+
+Orchestration docs are stored in a **private companion repo** and symlinked into `claude-share/`.
+If `claude-share/` exists locally, read and follow those docs. If not, follow the protocols below.
+
+### Branch Naming Convention
+
+| AI Agent | Branch Pattern | Example |
+|----------|---------------|---------|
+| Claude | `claude/<task-slug>-<id>` | `claude/parallel-tools-x7k2` |
+| Codex | `codex/<task-slug>-<id>` | `codex/cost-tracking-m3p1` |
+| Other AI | `bot/<task-slug>-<id>` | `bot/gemini-flash-tools-q2w3` |
+| Human | `feat/<slug>` or `fix/<slug>` | `feat/mcp-integration` |
+
+### Session Start Protocol
+
+1. Fetch latest main: `git fetch origin main`
+2. Check recent merges: `git log origin/main --oneline -10`
+3. Read `claude-share/core/SYNC_CHECKLIST.md`
+4. Read `claude-share/core/next_prompt.md` for current task
+5. Acknowledge with format:
+   ```
+   ACK: [Task ID] — [Task Name]
+   Branch: [branch-name]
+   Files to modify: [list]
+   Starting now.
+   ```
+
+### Session End Protocol
+
+1. Update session log (`claude-share/core/claude-log.md` or equivalent)
+2. Update `claude-share/core/GLOBAL_ROADMAP.md` — task status + changelog entry
+3. Update `claude-share/core/WORK_STATUS.md` — sprint state
+4. Update `claude-share/core/next_prompt.md` — point to next task
+5. Run `npm test && npm run typecheck`
+6. Commit and push
+
+### Verification Checklist (Before Claiming "Done")
+
+- [ ] All changes compile: `npm run typecheck`
+- [ ] All tests pass: `npm test`
+- [ ] No secrets committed (check `git diff --staged`)
+- [ ] Session log updated
+- [ ] Global roadmap updated
+- [ ] Work status updated
+- [ ] Next prompt updated
+- [ ] Branch pushed
+
+### Parallel Work Rules
+
+1. **Check WORK_STATUS.md** before starting — avoid working on same files as another agent
+2. **Claim your task** — Update the Parallel Work Tracking table immediately
+3. **Small, atomic PRs** — One task per branch, one concern per PR
+4. **No cross-branch dependencies** — Each branch must work independently
+5. **Communicate via docs** — If you discover something another agent needs to know, write it in WORK_STATUS.md under "Notes for Other Agents"
+
+### Handoff Protocol
+
+When handing off work to another AI agent:
+1. Commit all changes (even partial work)
+2. Update `next_prompt.md` with detailed context
+3. Add "Notes for Next Session" to your session log entry
+4. Push your branch
+5. If blocked, add to the "Blocked" table in WORK_STATUS.md
+
+### Human Checkpoint Format
+
+```
+🧑 HUMAN CHECK X.X: [Description of what to test] — ⏳ PENDING
+```
+
+Human checkpoints require manual verification before the next phase can begin. Never skip or auto-resolve these.