Repository navigation
fix: use the Void Cloudflare login in dev and unblock self-hosted platform onboarding - #424
Merged
Merged
Conversation
…nd builds `void connect` and `void cloudflare login` save the Cloudflare login with the cf CLI. The Cloudflare Vite plugin and Wrangler's getPlatformProxy read Wrangler's own login store unless CLOUDFLARE_CF_AUTH is set. So `vp dev` of a direct Cloudflare app that imports void/ai stopped at startup with edge-preview error 10000 when Wrangler's login was stale or belonged to another user, while `void cloudflare status` said the user was signed in. When the plugin starts for a direct Cloudflare app, select the cf store and the OS keychain, as the Void CLI does. This covers dev, vite preview, astro preview and builds that open a remote session. CLOUDFLARE_API_TOKEN still wins. The D1 read replication error now points to `void cloudflare login`. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
…s Engine failures An AI Gateway create that failed with a server error could still create the gateway. Resume then refused the gateway as not owned and told the user to resume the owning installation, which they were already doing. The planner now accepts a same-named gateway that was created just after this installation's create intent, and the refusal says to delete the gateway in the dashboard and rerun. A Worker upload that fails with Analytics Engine error 10089 now links to a docs section that explains how to turn Analytics Engine on. Before the database is claimed, a resume takes a corrected VOID_PLATFORM_DATABASE_URL, and a failure tells the user how to choose another database. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
The installer and the platform kept separate lists of Access rules that count as a company identity, and the installer rejected Entra ID groups and authentication contexts. One shared check now serves both. A login method counts only when its identity provider is a company directory, so One-time PIN and public logins do not count. A rejected or deleted policy pick no longer sticks on resume: the picker checks the pick and asks again. Create mode can create an Allow policy for the company email domain. Interactive installs generate the JWT signing key and the project encryption key and keep them in the encrypted recovery data. Environment values still win, and headless installs still require them. The credentials docs list each credential and why it is needed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
…ll without an administrator When the first administrator sign-in failed, the page said only that login failed, nothing was logged, and no command could change the saved login settings: repair sent the same settings again, and `config auth recover` needs an administrator. With project Zero Trust on, uninstall also refused, because only an administrator can turn Zero Trust off. - `void platform repair --auth-config <file>`, or a question in an interactive repair, replaces the login settings while setup is pending. - The login failure page shows a safe error code, a hint and the expected callback URL, and the Worker logs the code. The default GitHub setup route shows the same page. Install and repair print the callback URL with the setup code. - Uninstall turns project Zero Trust off through a signed installer route while no platform user exists, and stops if a user appears meanwhile. - The install progress no longer links to /setup before the platform is ready. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6264c8ddea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Brooooooklyn
added a commit
that referenced
this pull request
Oct 14, 2026
…et (#431) ## Problem `packages/void/test/unit/db-request-pool.test.ts` failed on Windows CI (PR #424, `test (windows-latest, unit)`): ``` FAIL unit-pglite packages/void/test/unit/db-request-pool.test.ts > void/db postgresql across requests Error: Hook timed out in 10000ms. ❯ packages/void/test/unit/db-request-pool.test.ts:133:3 ``` ``` beforeAll (default hook timeout 10s) └─ new PGlite() + first exec ──▶ cold WASM start on Windows CI > 10s ──▶ timeout ``` ## What this PR changes The hook waits for `pglite.waitReady` and gets 30s on Windows. `runner-pg.test.ts` and `db-export-roundtrip.test.ts` use the same pattern. Query and test deadlines stay unchanged. ## Testing | Check | Result | | --- | --- | | `vp test run packages/void/test/unit/db-request-pool.test.ts` (macOS) | 6 passed | | Windows CI | this PR (label `test: windows`) | 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The repair login file was checked against de-duplicated login kinds. With two connections of one kind, such as two OIDC providers, a file could drop, add or rename a connection. The pending setup reset then deleted and recreated the login connections without it, and a renamed administrator connection moved the first administrator to another connection. The file must now list the same connection IDs and kinds as the saved setup; a missing ID means the install default. The error names the installed connection IDs. The interactive repair already keeps every saved connection. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8da1fe5574
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… identity Cloudflare's generic OpenID Connect and SAML connectors accept any provider, including ones with public sign-up; Cloudflare's own OIDC example points at consumer Google. A policy whose only rule is a login method for such a provider could admit anyone, while the installer called it company-only. Count a login method only when its identity provider type names one tenant in its required settings: Entra ID, Okta, OneLogin, PingOne, Centrify, Google Workspace, or the Cloudflare login restricted to account members. A policy with a generic login still passes with a Require rule such as Emails ending in the company domain, and the setup guide says so. The platform server's check is unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce916cd8c2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…p record Resume reused a same-named AI Gateway when it was created within a few minutes after this installation's create intent. A creation time is not an ownership record: if the installer stopped before its create request, a gateway made by someone else in that window was recorded as installer-owned, and --purge-resources could later delete it. The AI Gateway API has no field that could carry an ownership marker. Remove the time-window check, so the planner fails closed again. The refusal now says that Void cannot tell whether this installation created the resource, and gives the two ways forward: delete it and rerun the command if an earlier failed attempt made it, or choose another installation name. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
…y identity An Access policy that allows only the members of one Cloudflare account was rejected by both the installer and project Zero Trust, because the shared company-identity check did not know the cloudflare_account_member rule. Accept it when account_id is missing, which Cloudflare defines as the account that owns the policy, or is a 32-hex account ID. Other shapes stay rejected. The setup guide lists account members among the rules that count. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 82647d8edc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…provider The Access applications offer only the identity providers picked for the install. A policy whose only identity proof is a login method for another provider admits nobody, so administrators were locked out of a new platform. Check login method rules against the selected providers, and say which rule is wrong when that is the only problem. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2881698d6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… for a selected provider These rules name the Entra ID provider that proves them. When that provider is not one of the selected identity providers, the Access applications do not offer it at sign-in, and a policy that relies on the rule admits nobody. Check them like login method rules. Okta, Google Workspace, SAML and GitHub organization rules keep their current behavior. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Two onboarding reports, checked against the code and with live runs.
1.
void/ailocal dev stops with edge-preview error 10000Since login moved to the cf CLI, the Cloudflare Vite plugin and Wrangler's
getPlatformProxystill read Wrangler's store, because Void never setCLOUDFLARE_CF_AUTH. Logging in again through Void did not help. OnlyCLOUDFLARE_API_TOKENworked.2. Self-hosted platform onboarding dead ends
The installer also rejected Entra ID group policies that the platform accepts, kept a rejected or deleted policy pick on resume, and asked for 9 pasted values on a minimal install.
The account plan did not cause the login failure or the blocked uninstall. Every plan-gated step runs before auth init and the Zero Trust step.
What this PR changes
Decisions
void cloudflare loginsession, for every direct Cloudflare app, so user-written remote bindings use it too.CLOUDFLARE_API_TOKENstill wins.void cloudflare login.login_methodrule counts as company identity only for a company identity provider that is also one of the selected identity providers and whose required settings name one tenant (Entra ID, Okta, OneLogin, PingOne, Centrify, Google Workspace, or Cloudflare restricted to account members). One-time PIN, public logins, and generic OIDC or SAML logins do not; a Require rule such as Emails ending in fixes such a policy. A Cloudflare Account Member rule also counts. Entra ID group and authentication context rules count only for a selected identity provider.Known limits
void deployin CI of an app whose build opens a remote session (Astro prerender withai, SvelteKit 2 prerender) still fails. The deploy build removes the token from project code on purpose (void deployin CI fails when the project build opens a Cloudflare remote session (Astro prerender withai) #425).login_methodrule for any provider. It checks saved selections on every reconcile, so the fix checks strictly on save and warns on saved settings (Project Zero Trust accepts Access policies that let in anyone with a One-time PIN or public login #429).void platform keys(Addvoid platform keysto save the generated platform keys #430) prints them; it should ship in the same release.Testing
void@packed from this branch, valid Void login, stale Wrangler token, noCLOUDFLARE_API_TOKEN/api/ai200 with a real completion.astro buildwith a prerendered page: main exits 1, this branch builds.vp run check,vp lint,vp fmt --checkvp run test --base origin/main🤖 Generated with Claude Code
https://claude.ai/code/session_0123r5HnanmW2VUrZ7VWDufH