Cloud Tasks

Install and deploy the open-source "Cloud Tasks" project into my own Cloudflare account, then tell me how to connect this agent to it. Do every step for me and pause only when you need my input (for example, to approve a login).

1. Clone the repo and work inside it:
   git clone https://github.com/onurkerem/cloud-tasks.git
   The Worker source lives in packages/worker/ — run every command from there.

2. Run: npm install

3. Authenticate Wrangler. Run: npx wrangler login
   Tell me to complete the browser approval. If I can't use a browser, ask me for a CLOUDFLARE_API_TOKEN instead.

4. Create the D1 database and write its id into wrangler.jsonc:
   npm run deploy:prepare

5. Apply the schema to the remote database:
   npm run db:migrate:remote

6. Generate API key material and store it as a Worker secret for REST API use.
   Create one or more "name:secret" pairs (32 random hex bytes each; the name
   identifies the channel in task records, e.g. cli, pipeline, worker):
   npx wrangler secret put API_KEYS
   Enter a value like: cli:9f2c...,pipeline:77ab...
   Remember these - each key is a channel identity.

7. Configure Cloudflare Access for the MCP endpoint. Create a Self-hosted Access application for <worker-url>/mcp, then store:
   npx wrangler secret put CF_ACCESS_TEAM_DOMAIN
   npx wrangler secret put CF_ACCESS_POLICY_AUD
   If I do not have the Access application yet, pause and tell me the exact dashboard steps.

8. Optional - outbound webhooks:
   npx wrangler secret put WEBHOOK_SECRET
   npx wrangler secret put QUEUE_WEBHOOKS
   QUEUE_WEBHOOKS is a comma-separated queue=url list, e.g.
   builds=https://your-tunnel-host/hook - the worker pings that URL whenever a
   task is created in the queue, and POSTs {event, task} to a task's
   callback_url when it finishes. Webhooks are best-effort wake-ups; claiming
   never depends on them. Skip both to disable.

9. Deploy the Worker:
   npm run deploy
   The cron trigger (lease reaper) is enabled automatically by the repo's wrangler config.

10. Capture the deployed URL (https://cloud-tasks.<my-subdomain>.workers.dev, or your custom domain if you added one) and run the REST production smoke test:
    WORKER_URL=<that url> API_KEY=<the key> npm run smoke:prod
    If anything fails, read the error, fix it, and retry.

11. Do NOT modify this agent's own config. When done, report back:
    - the Worker URL,
    - the API_KEYS values,
    - the REST API index (<url>/api),
    - the OAuth MCP endpoint (<url>/mcp), protected by Cloudflare Access,
    - the API-key MCP endpoint (<url>/api/mcp), authenticated with an API key (no OAuth — ideal for persistent local MCP clients).