cloudflare-temporary-deploy

1---2name: cloudflare-temporary-deploy3description: Deploy a Worker live, no account, via wrangler --temporary.4version: 1.0.05author: Hermes Agent6license: MIT7platforms: [linux, macos, windows]8metadata:9  hermes:10    tags: [cloudflare, workers, wrangler, deploy, temporary, agent, serverless, web-development]11    category: web-development12---13 14# Cloudflare Temporary Deploy Skill15 16Deploy a Cloudflare Worker to a live `workers.dev` URL with zero account setup, using `wrangler deploy --temporary`. Cloudflare provisions a throwaway account, deploys, and prints a claim URL valid for 60 minutes; unclaimed accounts auto-delete. This gives an agent a tight write → deploy → verify loop without any OAuth, signup, or token copy-paste.17 18This skill does NOT cover production deploys (use `wrangler login` + a permanent account for those), nor non-Worker Cloudflare products beyond the temporary-account limits below.19 20## When to Use21 22Load this skill when the user wants to:23 24- **Ship agent-written code to a live URL** without first creating a Cloudflare account — "deploy this and give me a link"25- **Iterate in a background/autonomous session** where a browser OAuth step would be a hard stop26- **Prototype or evaluate Workers** quickly with a throwaway, claimable target27- **Build a self-verifying deploy loop** — deploy, `curl` the live URL, confirm output matches the code, redeploy28 29## When NOT to Use30 31- **Production or CI/CD** → use a permanent account (`wrangler login` or `CLOUDFLARE_API_TOKEN`). `--temporary` errors out if any credential is present.32- **Wrangler is already authenticated** → `--temporary` returns an error by design. Run `wrangler logout` first only if the user explicitly wants a throwaway deploy.33- **Long-lived hosting** → temporary deployments are deleted after 60 minutes unless claimed.34 35## Prerequisites36 37- **Wrangler 4.102.0 or later.** This is the version that introduced `--temporary`. Earlier versions do not have it. Verify with `npx wrangler@latest --version`.38- **Node 18+ / npm** (or `npx`, `yarn`, `pnpm`). No global install needed — `npx wrangler@latest` works.39- **No Cloudflare credentials present.** `--temporary` only works when Wrangler is unauthenticated: no OAuth login, no `CLOUDFLARE_API_TOKEN` / `CLOUDFLARE_API_KEY` env var, no `~/.wrangler` / `~/.config/.wrangler` cached OAuth. Use the `terminal` tool's environment as-is; do not set those vars.40- Network egress to `cloudflare.com` and `workers.dev`.41- Using `--temporary` accepts Cloudflare's Terms of Service and Privacy Policy.42 43## How to Run44 45Use the `terminal` tool for every step. Always pin the version (`wrangler@latest` or `wrangler@4.102.0` or newer) so you don't accidentally run an old global wrangler that lacks the flag.46 471. **Scaffold a minimal Worker** (skip if the project already exists). A Worker needs a `wrangler.toml` (or `wrangler.jsonc`) and an entry script. Minimal TypeScript example — write these with `write_file`:48 49   `wrangler.jsonc`:50   ```jsonc51   {52     "name": "hello-agent",53     "main": "src/index.ts",54     "compatibility_date": "2025-01-01"55   }56   ```57 58   `src/index.ts`:59   ```typescript60   export default {61     async fetch(): Promise<Response> {62       return new Response("hello cloudflare");63     },64   };65   ```66 672. **Deploy with `--temporary`** from the project directory:68   ```69   npx wrangler@latest deploy --temporary70   ```71   The proof-of-work check adds a short automatic delay. On success Wrangler prints an `Account: <name> (created)` (or `(reused)`) line, a `Claim URL`, and the live `https://<worker>.<account>.workers.dev` URL.72 733. **Parse the URLs** from that output. Run the helper to extract them reliably instead of eyeballing:74   ```75   npx wrangler@latest deploy --temporary 2>&1 | python scripts/parse_deploy_output.py76   ```77   (Resolve `scripts/parse_deploy_output.py` to this skill's absolute path.) It prints JSON: `{"live_url", "claim_url", "account", "account_state", "expires_minutes", "deployed"}`.78 794. **Verify the deploy is actually live** — do not trust the deploy log alone. `curl` the live URL and confirm the body matches what the code returns:80   ```81   curl -sS <live_url>82   ```83 845. **Iterate.** Edit the code, redeploy with the same `npx wrangler@latest deploy --temporary`. Within the 60-minute window Wrangler reuses the cached temporary account (`Account: <name> (reused)`), so the URL stays stable. `curl` again to confirm the change.85 866. **Hand the claim URL to the user.** Tell them: open it within 60 minutes to keep the deployment and any resources; if they don't claim it, everything auto-deletes. Treat the claim URL as a secret — it grants ownership of the account.87 88## Quick Reference89 90| Step | Command |91|---|---|92| Check version (need 4.102.0+) | `npx wrangler@latest --version` |93| Deploy (no account) | `npx wrangler@latest deploy --temporary` |94| Deploy + parse URLs | `npx wrangler@latest deploy --temporary 2>&1 \| python scripts/parse_deploy_output.py` |95| Verify live | `curl -sS <live_url>` |96| Clear cached temp account | `npx wrangler@latest logout` |97 98### Temporary account product limits99 100| Product | Limit on a temporary account |101|---|---|102| Workers | Deploys to `workers.dev` |103| Static Assets | Up to 1,000 files, 5 MiB each |104| KV | Allowed |105| D1 | 1 database, 100 MB per DB / 100 MB total |106| Durable Objects | Allowed |107| Hyperdrive | 2 configs, 10 connections |108| Queues | Up to 10 |109| SSL/TLS certs | Allowed |110 111## Pitfalls112 113- **`--temporary` is not in `wrangler deploy --help` and is not a global flag.** It is intentionally hidden and surfaced dynamically: when an unauthenticated `wrangler deploy` fails, Wrangler prints "rerun with `--temporary`". Don't conclude the flag is missing just because `--help` omits it — check the version instead.114- **Old global wrangler.** A stale globally-installed `wrangler` (`< 4.102.0`) silently lacks the flag. Always invoke `npx wrangler@latest` (or a pinned `>=4.102.0`) so you control the version.115- **Auth present → hard error.** If `wrangler login` was ever run, or `CLOUDFLARE_API_TOKEN`/`CLOUDFLARE_API_KEY` is set, `--temporary` errors. Either unset the var for this shell or `wrangler logout`. Never strip a user's real credentials without telling them.116- **Rate limiting.** Creating temporary accounts too fast fails. Reuse the cached account (just redeploy) within the 60-minute window instead of forcing a new one; if rate-limited, wait or use a permanent account.117- **60-minute hard expiry, not extendable.** If the deploy must outlive an hour, the user must claim it. Surface this clearly.118- **`curl` may briefly serve the old body after a redeploy.** `workers.dev` has a short edge cache; the `(reused)` line plus a new `Current Version ID` confirm the deploy succeeded even if `curl` shows stale content for a few seconds. Re-curl, or add a cache-busting query string, before concluding a redeploy failed.119- **Don't log the claim URL into shared transcripts as "just a link."** It is credential-equivalent.120 121## Verification122 123- `npx wrangler@latest --version` returns `>= 4.102.0`.124- `npx wrangler@latest deploy --temporary` prints a `workers.dev` live URL and a `claim-preview?claimToken=` claim URL.125- `curl -sS <live_url>` returns the exact body the Worker code produces.126- A second deploy reports `Account: <name> (reused)` and the live URL is unchanged.127- The parser script's self-test passes: `python scripts/parse_deploy_output.py --selftest`.128