# Cloudflare

> Self-contained deploy automation — invoke directly, do not decompose. Deploys a Vibes app to Cloudflare Workers via the Deploy API. Use when deploying, publishing, going live, pushing to production, or hosting on the edge. Authenticates with Pocket ID.

- **Type:** Skill
- **Install:** `agentstack add skill-popmechanic-vibesos-cloudflare`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [popmechanic](https://agentstack.voostack.com/s/popmechanic)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [popmechanic](https://github.com/popmechanic)
- **Source:** https://github.com/popmechanic/VibesOS/tree/main/vibes-desktop/build/stable-macos-arm64/VibesOS.app/Contents/Resources/vibes-plugin/skills/cloudflare
- **Website:** https://install.vibesos.com

## Install

```sh
agentstack add skill-popmechanic-vibesos-cloudflare
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

> **Plan mode**: If you are planning work, this entire skill is ONE plan step: "Invoke /vibes:cloudflare". Do not decompose the steps below into separate plan tasks.

```
  ╔═══════════════════════════════════════════════╗
  ║   ☁️  CLOUDFLARE WORKERS DEPLOY               ║
  ║   Deploy API · Pocket ID · Edge Functions      ║
  ╚═══════════════════════════════════════════════╝
```

## Deploy to Cloudflare

Deploy your Vibes app to Cloudflare Workers via the Deploy API.

### Prerequisites

1. **Assembled HTML file** (from `/vibes:vibes` or `/vibes:sell`)
2. **Pocket ID account** (browser login on first deploy)

No Cloudflare account or wrangler CLI needed — the Deploy API handles infrastructure.

### Quick Deploy

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
bun "$VIBES_ROOT/scripts/deploy-cloudflare.js" --name myapp --file index.html
```

On first run, a browser window opens for Pocket ID authentication. Tokens are cached for subsequent deploys.

**Static Assets:** Place images, fonts, or other static files in an `assets/` directory next to the app file. The deploy script auto-discovers and includes them (binary files are base64-encoded). Reference in code with absolute paths like `/assets/logo.png`.

### Deploy with AI enabled

```bash
VIBES_ROOT="${CLAUDE_PLUGIN_ROOT:-$(dirname "$(dirname "${CLAUDE_SKILL_DIR}")")}"
bun "$VIBES_ROOT/scripts/deploy-cloudflare.js" --name myapp --file index.html --ai-key "sk-or-v1-your-key"
```

The `--ai-key` flag configures the OpenRouter API key for the `useAI()` hook. Without it, `/api/ai/chat` returns `{"error": "AI not configured"}`.

### Endpoints

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/registry.json` | GET | Public registry read |
| `/check/:subdomain` | GET | Check subdomain availability |
| `/claim` | POST | Claim a subdomain (auth required) |
| `/api/ai/chat` | POST | AI proxy to OpenRouter (requires AI key) |

### Important: Custom Domain Required for Subdomains

Workers.dev domains only support one subdomain level for SSL. For multi-tenant
apps with subdomains (tenant.myapp.workers.dev), you MUST use a custom domain.

**Won't work:** `tenant.myapp.username.workers.dev` (SSL error)
**Will work:** `tenant.myapp.com` (with custom domain)

On workers.dev, use the `?subdomain=` query parameter for testing:
- `myapp.username.workers.dev` → landing page
- `myapp.username.workers.dev?subdomain=tenant` → tenant app
- `myapp.username.workers.dev?subdomain=admin` → admin dashboard

### Custom Domain Setup

1. **Add domain to Cloudflare** (get nameservers from Cloudflare DNS dashboard)
2. **Point registrar nameservers** to Cloudflare's assigned nameservers
3. **Delete conflicting DNS records** for the apex domain (A, AAAA, CNAME)
4. **Add Custom Domain** in Workers & Pages → your worker → Settings → Domains & Routes → Add → Custom Domain (apex: yourdomain.com)
5. **Add wildcard CNAME** in DNS: Name: `*`, Target: `..workers.dev` (Proxied: ON)
6. **Add Route** in Workers & Pages → your worker → Settings → Domains & Routes → Add → Route: `*.yourdomain.com/*`

After setup:
- `yourdomain.com` → landing page
- `tenant.yourdomain.com` → tenant app
- `admin.yourdomain.com` → admin dashboard

### Troubleshooting

| Problem | Cause | Fix |
|---------|-------|-----|
| Browser doesn't open for auth | Headless environment | Copy the printed URL and open manually |
| Deploy API returns 401 | Expired or invalid token | Delete `~/.vibes/auth.json` and retry |
| 404 on subdomain URL | Workers.dev doesn't support nested subdomains | Set up a custom domain (see Custom Domain Setup above) |
| `/api/ai/chat` returns "AI not configured" | Missing OpenRouter key | Redeploy with `--ai-key` |
| Stale content after redeploy | Browser cache | Hard refresh (Cmd+Shift+R) or clear cache |

### What's Next?

After successful deployment, present these options:

AskUserQuestion:
  question: "Your app is deployed! What would you like to do next?"
  header: "Next steps"
  options:
    - label: "Set up custom domain"
      description: "Configure DNS for subdomain routing (required for multi-tenant)"
    - label: "Enable AI features"
      description: "Add OpenRouter API key for the useAI() hook"
    - label: "Add auth & SaaS features"
      description: "Transform into SaaS with /vibes:sell (Pocket ID auth), then redeploy"
    - label: "Open in browser"
      description: "Visit the deployed URL to verify everything works"

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [popmechanic](https://github.com/popmechanic)
- **Source:** [popmechanic/VibesOS](https://github.com/popmechanic/VibesOS)
- **License:** MIT
- **Homepage:** https://install.vibesos.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-popmechanic-vibesos-cloudflare
- Seller: https://agentstack.voostack.com/s/popmechanic
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.