Rename prohibitAllSharing to containsRestrictedData

.agents/skills/write-gatekeeper/SKELETON.md

@@ -592,19 +592,28 @@ Add package scripts:
 ```json
 {
   "scripts": {
-    "build": "node ../../scripts/build-gatekeeper-configurator.mjs . && tsc",
-    "deploy": "node ../../scripts/build-gatekeeper-configurator.mjs . && wrangler deploy"
+    "deploy": "vp run --no-cache build:configurator && wrangler deploy"
   },
   "dependencies": {
     "@gadgets/configurator-ui": "workspace:*"
   }
 }
 ```
 
-Also add a `vite.config.ts` re-exporting the shared `build:configurator` Vite+ task, which is what
-the `pnpm dev-server` pre-flight builds (`vp run -r --cache build:configurator --dev`). It must be
-a task rather than a package.json script so `VITE_FRONTEND_ERROR_REPORTING` is passed through and
-cache-fingerprinted (vp forbids a task and a script sharing a name, so do not add the script back):
+No `build` script: `build` is one of the shared Vite+ tasks below, and vp forbids a task and a
+script sharing a name. Build this one package with `pnpm exec vp run -F <package-name> build` —
+`pnpm --filter` cannot see a task, so `pnpm --filter <package-name> build` reports nothing to run;
+the workspace-wide `pnpm build` picks it up as usual. `deploy` goes through the task rather than
+calling
+`build-gatekeeper-configurator.mjs` itself, so the codegen command lives in one place and cannot
+drift from the task that declares its env — `wrangler deploy` stays outside vp, since it has side
+effects and needs real credentials.
+
+Also add a `vite.config.ts` re-exporting the shared `build` and `build:configurator` Vite+ tasks —
+the latter is what the `pnpm dev-server` pre-flight builds (`vp run -r --cache build:configurator
+--dev`). Both are tasks rather than package.json scripts so `VITE_FRONTEND_ERROR_REPORTING` is
+passed through and cache-fingerprinted; a `build` script running the builder with `&&` would bypass
+that and silently bake the wrong value into the shipped HTML (do not add either script back):
 
 ```typescript
 // Vite+ per-package settings. The build:configurator task definition is shared by all gatekeepers

.agents/skills/write-gatekeeper/SKILL.md

@@ -119,10 +119,14 @@ If you use this:
 - `resourceUrl()` returns the selected resource URL.
 - `src/configurator/*-types.d.ts` describes the iframe-facing `ui` API.
 - `scripts/build-gatekeeper-configurator.mjs` generates `src/generated/*.txt`.
-- Package `build` / `deploy` scripts run the builder directly
-  (`node ../../scripts/build-gatekeeper-configurator.mjs .`), and `vite.config.ts` re-exports the
-  shared `build:configurator` Vite+ task from `scripts/gatekeeper-configurator-vite-config.ts` so
-  the dev-server pre-flight caches it with `VITE_FRONTEND_ERROR_REPORTING` in the fingerprint.
+- Nothing invokes `build-gatekeeper-configurator.mjs` by hand. `vite.config.ts` re-exports the
+  shared `build` and `build:configurator` Vite+ tasks from
+  `scripts/gatekeeper-configurator-vite-config.ts`; `build` is just `tsc` and depends on
+  `build:configurator`, which carries `VITE_FRONTEND_ERROR_REPORTING` in its fingerprint, and
+  `deploy` runs `vp run --no-cache build:configurator && wrangler deploy` — deploys never replay a
+  cached artifact. There is no `build` script
+  and no direct builder call, because a script running the builder gets vp's stripped environment
+  and bakes the wrong flag into the shipped HTML.
 
 ##### Pre-filling the form from a known resource URL
 
@@ -239,7 +243,7 @@ async getVerifier(): Promise<Fetcher<GatekeeperUserVerifier>> {
 
 Strategy is chosen **per `Gatekeeper` DO class / binding**, not per package — one package may use several (e.g. Google: Gmail=A, Doc=B, BigQuery=C).
 
-- **A — Private-only.** `addObserver()` always throws; `removeObserver()` is a no-op. `getVerifier()` must still exist (the overseer mints it) but is never consulted. Use when the resource is too sensitive to share and there is no per-observer access oracle (e.g. a personal Gmail mailbox).
+- **A — Private-only.** `addObserver()` always throws; `removeObserver()` is a no-op. `getVerifier()` must still exist (the overseer mints it) but is never consulted. Use when the resource is too sensitive to share and there is no per-observer access oracle (e.g. a personal Gmail mailbox). For truly sensitive data, also mark each observation with `ObservationDescription.containsRestrictedData: true`: the workspace then refuses sensitive observations while any unverified collaborator has access (with strategy A that is every collaborator) and latches into a restricted mode that blocks all actions and public web fetches, so the data cannot leak back out through other gatekeepers.
 - **B — ACL check (single unit).** The binding is one atomic resource; sub-resources inherit its ACL. `addObserver()` calls a verifier method to confirm the observer can access it and throws otherwise; `removeObserver()` is a no-op; nothing is tracked and no `excludeObservers` is ever needed. Use for repo / document / page / team / single-project bindings.
 - **C — Data-set tracking.** The binding spans sub-resources with **distinct ACLs**, and there is a **per-observer access oracle** for each. The DO logs the data sets actually observed and the current observers; `addObserver()` verifies the observer against **every** logged set (plus a coarse membership baseline) and **stores their verifier**; each later observation that first touches a **new** set re-checks all stored observers and sets `excludeObservers` for any who fail. Use for workspace / organization / dataset-spanning bindings.
 - **D — Low-stakes.** `addObserver()` / `removeObserver()` are no-ops; `getVerifier()` returns a trivial verifier with a no-op public method such as `verify(): void {}` (an empty `WorkerEntrypoint` is not registered in `ctx.exports`). Use when any collaborator may observe (personal, low-stakes services).

.github/workflows/ci.yml

@@ -13,7 +13,9 @@ env:
   NODE_VERSION: "24.19.0"
 
 jobs:
-  # Parallel to `test` so lint and test failures surface on the same run; type checking lives in Build.
+  # Parallel to `test` so lint and test failures surface on the same run. Package type checking
+  # lives in Build; `scripts/` is checked here instead, because it is deliberately kept off
+  # `pnpm build`'s hot path (see AGENTS.md) and this is the cheap job.
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -39,6 +41,9 @@ jobs:
       - name: Lint
         run: pnpm lint:check
 
+      - name: Type-check scripts/
+        run: pnpm types:scripts
+
   test:
     name: Build and test
     runs-on: ubuntu-latest

.github/workflows/preview.yml

@@ -0,0 +1,234 @@
+name: Preview
+
+# Per-PR preview deployments, on the Cloudflare account named by the CLOUDFLARE_ACCOUNT_ID
+# repository variable.
+#
+# SECURITY — read this before changing the triggers.
+#
+# Deploying a preview needs a Cloudflare API token that can create Workers, KV namespaces and R2
+# buckets on a Cloudflare-owned account. This repository is public, so anyone can open a pull
+# request. The load-bearing control is the TRIGGER, not any `if:` below: on a public repository
+# GitHub structurally withholds repository secrets from `pull_request` runs whose head is a fork,
+# so `secrets.CLOUDFLARE_API_TOKEN` interpolates to the empty string there and no fork PR can
+# deploy anything. That is the same guarantee workers-sdk's deploy-previews.yml relies on.
+#
+# Therefore: `pull_request` only. Never `pull_request_target`, never `workflow_run`, never
+# `issue_comment` — each of those runs privileged with the secret available while the code, the
+# PR number, or the artifact naming it comes from an untrusted contributor.
+#
+# The `if:` conditions and the in-job guard are defence in depth, each fail-closed, and exist so
+# that a future edit which weakens the trigger still does not leak the token. They are not what
+# makes this safe today.
+#
+# The `cache: pnpm` below is deliberate and is not a poisoning path: a fork PR's Actions cache is
+# scoped to `refs/pull/<n>/merge` and cannot be read from another PR or from `main`.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+  schedule:
+    # Nightly, off the hour. GitHub has no equivalent of GitLab's `environment.auto_stop_in`, so
+    # this is what stops abandoned previews from leaking a KV pair and an R2 bucket each.
+    - cron: "37 4 * * *"
+  workflow_dispatch:
+
+# Escalated per job. The preview jobs need no write scope at all beyond the sticky comment.
+permissions: {}
+
+env:
+  NODE_VERSION: "24.19.0"
+
+jobs:
+  deploy:
+    name: Deploy preview
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.action != 'closed' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot' &&
+      github.head_ref != 'main' &&
+      github.repository_owner == 'cloudflare'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    concurrency:
+      # Never cancel: a half-applied preview is worse than a slow one, since the tiers are
+      # deployed in sequence and an interrupted run leaves the instance wired to stale previews.
+      group: preview-${{ github.event.pull_request.number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      # First, before any step can reference a secret. Catches a future edit that flips the
+      # trigger to `pull_request_target`, and a branch pushed by a since-demoted account or a bot.
+      - name: Verify the pull request is from a maintainer
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          if [[ "$HEAD_REPO" != "$GH_REPO" ]]; then
+            echo "Preview deploys never run on fork pull requests (head: $HEAD_REPO)."
+            exit 1
+          fi
+          permission=$(gh api "repos/$GH_REPO/collaborators/$PR_AUTHOR/permission" \
+            --jq '.permission')
+          if [[ ! "$permission" =~ ^(admin|maintain|write)$ ]]; then
+            echo "$PR_AUTHOR has '$permission' on $GH_REPO; previews require write access."
+            exit 1
+          fi
+
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Ahead of setup-node, which shells out to `pnpm store path` to find the directory it caches.
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Deploy preview
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          PREVIEW_WORKERS_DEV_HOST: ${{ vars.PREVIEW_WORKERS_DEV_HOST }}
+          # Secrets, not vars: these three are uploaded to the backend's Previews settings with
+          # `wrangler preview secret bulk`, and never written into a config file — Wrangler prints
+          # the values it finds in one, and this log is public.
+          PREVIEW_ADMINS: ${{ secrets.PREVIEW_ADMINS }}
+          CF_ACCESS_AUD: ${{ secrets.CF_ACCESS_AUD }}
+          CF_ACCESS_ISS: ${{ secrets.CF_ACCESS_ISS }}
+          # AI Gateway, so a preview's chats use server-managed keys rather than asking each user
+          # for their own. Optional as a group: with CF_AI_GATEWAY unset the preview is BYOK, but
+          # once it is set the account id and the Run + Read token are required.
+          CF_AI_GATEWAY: ${{ secrets.CF_AI_GATEWAY }}
+          # This is delibaretely set to CF_OS_AI_GATEWAY_ACCOUNT_ID (gets uploaded as CF_AI_GATEWAY_ACCOUNT_ID)
+          CF_AI_GATEWAY_ACCOUNT_ID: ${{ secrets.CF_OS_AI_GATEWAY_ACCOUNT_ID }}
+          CF_AI_GATEWAY_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_API_TOKEN }}
+          CF_AI_GATEWAY_PROVIDERS: ${{ secrets.CF_AI_GATEWAY_PROVIDERS }}
+          CF_AI_GATEWAY_WAI_DIRECT: ${{ secrets.CF_AI_GATEWAY_WAI_DIRECT }}
+          # The branch, because the preview name is the first label of its hostname: a preview reads
+          # as `my-branch-os-public-router.<subdomain>.workers.dev`. The cleanup job below passes the
+          # same ref; the nightly sweep matches previews back to pull requests by slugifying every
+          # recent head ref the same way.
+          PREVIEW_NAME: ${{ github.head_ref }}
+        run: node scripts/preview/preview.ts deploy
+
+      # In this same job, deliberately: handing the comment to a privileged second workflow is
+      # the pattern workers-sdk deleted, because the privileged half read the PR number out of an
+      # artifact the unprivileged half had named.
+      - name: Comment the preview URL
+        uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+        with:
+          header: preview
+          path: output/preview-comment.md
+
+  cleanup:
+    name: Delete preview
+    if: >-
+      github.event_name == 'pull_request' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot' &&
+      github.head_ref != 'main' &&
+      github.repository_owner == 'cloudflare'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: preview-${{ github.event.pull_request.number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+    steps:
+      # Same-repo only, and — unlike the deploy job — deliberately no collaborator permission
+      # check. This job's authority is to *delete* a preview, so the failure modes run the other
+      # way: an author who has since been demoted or left is exactly when a preview would
+      # otherwise be left behind, and a check that refused to tear it down would turn a departure
+      # into a leak. A preview can only exist for a same-repo head in the first place, because
+      # that is what the deploy job requires, so this is the whole of the property that matters.
+      - name: Verify the pull request is not from a fork
+        env:
+          GH_REPO: ${{ github.repository }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+        run: |
+          if [[ "$HEAD_REPO" != "$GH_REPO" ]]; then
+            echo "Preview deploys never run on fork pull requests (head: $HEAD_REPO)."
+            exit 1
+          fi
+
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Delete preview
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          PREVIEW_WORKERS_DEV_HOST: ${{ vars.PREVIEW_WORKERS_DEV_HOST }}
+          # The same ref the deploy job used, which is what names the preview. GitHub sets it on the
+          # closed event too. No admin or Access secret is needed to tear one down.
+          PREVIEW_NAME: ${{ github.head_ref }}
+        run: node scripts/preview/preview.ts delete
+
+  sweep:
+    name: Sweep abandoned previews
+    if: >-
+      (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') &&
+      github.repository_owner == 'cloudflare'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    concurrency:
+      group: preview-sweep
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Sweep previews whose PR is closed, or older than 7 days
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          PREVIEW_WORKERS_DEV_HOST: ${{ vars.PREVIEW_WORKERS_DEV_HOST }}
+          # Reads every recent pull request's head branch, to match live previews back to them.
+          GITHUB_TOKEN: ${{ github.token }}
+        run: node scripts/preview/preview.ts sweep

.gitignore

@@ -31,6 +31,9 @@ wrangler.staging.jsonc
 # Site-specific dev server configs.
 wrangler.dev.jsonc
 
+# Scratch output from scripts/preview (the PR-preview comment body).
+/output/
+
 # macOS
 .DS_Store