Menu
Set up and run local development for the secret-vault Worker and hfs CLI. Use when starting development, running locally, or onboarding.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Add a new CLI command to the hfs tool. Use when adding user-facing commands, subcommands, or flags to the CLI.
Create a new D1 database migration for the secret-vault. Use when adding tables, columns, or indexes to the vault's schema.
Review code changes for security issues specific to this encrypted secret vault. Use when modifying auth, encryption, scope enforcement, or any data-access paths.
Diagnose and fix issues with the secret-vault Worker, hfs CLI, D1 database, Cloudflare Access auth, and encryption. Use when something is broken, returning errors, or behaving unexpectedly.
Add a new API endpoint to the secret-vault Cloudflare Worker. Use when creating new routes, resources, or API functionality in the vault.
Write tests for the secret-vault Worker and hfs CLI. Use when adding test coverage, fixing bugs with regression tests, or validating behavior.
| name | local-dev |
| description | Set up and run local development for the secret-vault Worker and hfs CLI. Use when starting development, running locally, or onboarding. |
hfs login)npx wrangler or npm i -g wrangler)cd secret-vault
npm install
# Create local D1 and apply migrations
npm run db:migrate:local
# Generate encryption key and add to .dev.vars
npm run generate-keys
# Copy .dev.vars.example and fill in values (or create from scratch)
cp .dev.vars.example .dev.vars
# Edit .dev.vars - set ENCRYPTION_KEY, ALLOWED_EMAILS, TEAM_DOMAIN, POLICY_AUD
# Set DEV_AUTH_BYPASS = "true" to skip Access auth locally
# Start local Worker at http://localhost:8787
npm run dev
Auth bypass: Set DEV_AUTH_BYPASS = "true" in .dev.vars to skip Cloudflare Access auth locally. This is gitignored and cannot reach production. Without it, all requests return 401 (no Access JWT available locally).
For testing against real Access auth, use wrangler dev --remote.
cd hfs
npm install
npm run build # or: npm run dev (watch mode)
npm link # link for local testing
hfs config set --url http://localhost:8787
wrangler d1 execute secret-vault-db --local --command "SELECT key FROM secrets"
wrangler d1 execute secret-vault-db --local --command "SELECT * FROM audit_log ORDER BY timestamp DESC LIMIT 10"