Cloudflare deployment hard constraints. MUST authenticate via scoped API Token in CLOUDFLARE_API_TOKEN env var (loaded from git-ignored .env), MUST bypass HTTP proxy on every Cloudflare API call (curl --noproxy '*', wrangler with NO_PROXY="*" no_proxy="*"), MUST extract account ID from /zones?name=<domain> when token lacks Account:Read and persist as CLOUDFLARE_ACCOUNT_ID. NEVER run `wrangler login` (OAuth breaks behind proxies/VPN), NEVER let a Cloudflare request traverse the local ClashX/HTTP proxy, NEVER commit credentials. Activates on any wrangler command, api.cloudflare.com call, or CLOUDFLARE_* env edit. MUST read SKILL.md BEFORE running wrangler commands, calling Cloudflare API, or editing CLOUDFLARE_* env vars.
2026-04-21