codeSplitters: verify hosted deploys (#244) on Cloudflare #247

#244 adds hosted deploys, but every test used a fake container and a fake runner. Nothing has been deployed to Cloudflare yet.

Needs you first (one-time setup)

• Install the 1Password CLI (brew install 1password-cli) and turn on Settings → Developer → "Integrate with 1Password CLI" in the 1Password app. It isn't installed on this machine yet.
• In a 1Password vault named codesplitters, create a Password item named DEPLOY_SECRETS_KEY whose password is openssl rand -base64 32. If you put it somewhere else, set DEPLOY_SECRETS_KEY_OP to its secret reference.
• Containers need the Workers Paid plan. Price it before turning this on: DEPLOY_RUNNER is one basic instance that runs only during a deploy.

Done 2026-10-10: the CLI is signed in through the app, the codesplitters vault and DEPLOY_SECRETS_KEY item exist, and varlock run resolved the key (32 bytes) through the committed .env.schema.

Then

• CODESPLITTERS_DEPLOYS=1 rustybuns generate, then commit the .env.schema it writes (it holds names and the 1Password reference, never values).
• CODESPLITTERS_DEPLOYS=1 rustybuns deploy --yes from apps/codesplitters. This applies migration 0016_deploy_keys.sql and builds the deploy-sandbox/ image. It's also the first real run of the wheel's 1Password path, which REFERENCE.md says has never run against a real vault.
• Do one real hosted deploy of a small throwaway Rusty Buns repo with a scoped token: clone, bun install, rustybuns deploy, check. Confirm the token doesn't show up in the log, then destroy the stage.
• Confirm a Durable Object alarm can run a full deploy in time (alarms have a wall-clock limit). If it can't, move the run into the container.

Caution: once DeployRunner (or AgentSandbox) has been deployed, turning its flag off again leaves its Durable Object class unbound. That needs a deleted_classes migration in worker.migrations; rustybuns generate warns about it.

#214 is closed (an admin is set) and #251 merged. Goes with #216.

🤖 Generated with Claude Code