| name | lq-deploy-cloudflare |
| description | Deploy this LQ debate agent template to Cloudflare Workers with Workers AI and Kimi K2.6. |
LQ Cloudflare Deploy
Prerequisites
pnpm install- Cloudflare account with Workers enabled
- Wrangler authenticated, or headless env vars:
export CLOUDFLARE_ACCOUNT_ID=...
export CLOUDFLARE_API_TOKEN=...
Deploy
pnpm lqbot deploy --agent <slug>
The deploy command:
- Regenerates
src/generated/agents.ts.
- Validates the selected debater.
- Runs
pnpm check.
- Generates a high-entropy bearer token.
- Stores only the token hash in Cloudflare secret
AGENT_TOKEN_HASHES.
- Runs
wrangler deploy.
- Prints the LQ URL and bearer token.
For multiple debaters:
pnpm lqbot deploy --all
The CLI preserves existing token hashes in ignored .lqbot/token-hashes.json, so deploying one
debater does not invalidate others. Add --save-local only when you want plaintext token copies
under ignored .lqbot/tokens/. If Wrangler fails after token generation, the CLI saves token copies
there automatically so the new hashes are not orphaned.
Headless
CLOUDFLARE_ACCOUNT_ID=... \
CLOUDFLARE_API_TOKEN=... \
pnpm lqbot deploy --agent <slug> --headless
Verify
pnpm lqbot smoke --url https://<worker>.workers.dev/agents/<slug>/debate --token <token>
Diagnose Requests
Use Cloudflare observability first instead of adding an application request-log database:
pnpm exec wrangler tail lq-debate-agent
The Worker emits structured logs for lq_request_accepted, lq_model_input_prepared,
lq_request_completed, lq_provider_attempt_started, lq_provider_empty_response,
lq_provider_attempt_completed, lq_provider_attempt_failed, lq_context_budget_exceeded,
lq_request_rejected, lq_request_failed, and lq_spend_cap_reached. These include request
shape, JSON keys, field types, body hash, schema issue paths/codes, response keys, text length,
provider attempts, context-budget numbers, and route metadata. Production sets
LOG_PUBLIC_DEBATE_PAYLOADS=true because LQ debates are public, so accepted request logs include
parsed public prompts/context, model-input logs include constructed provider messages with the
per-request security marker redacted, and completion logs include successful model text. Logs still
never include bearer tokens, provider secrets, or raw authorization values. Workers Logs persistence
and Workers Traces are enabled in wrangler.jsonc with full head sampling; use the Cloudflare
dashboard Query Builder for retained logs and trace timelines.
Safety
- Do not commit
.lqbot/, .env, .dev.vars, .wrangler/, or tokens.
- Use
wrangler secret put through pnpm lqbot secret set <NAME> for provider keys. Paste
provider API keys into Wrangler's prompt or pipe through stdin; do not pass them with --value.
- Default model:
@cf/moonshotai/kimi-k2.6.
- Default monthly budget:
$50 per debater. Change monthlyBudgetUsd in the debater config.
- Default context guard:
MODEL_CONTEXT_TOKENS=262144.
- Default model timeout:
MODEL_TIMEOUT_MS=270000; timed-out requests refund local reservations and
return a valid LQ { text } fallback.
