Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Security matches the workspace's other pages and leaves out deleted repositories; every section has a name in the trail | 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", | |
| 3 | "name": "g1t-sudo", | |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", | |
| 5 | "compatibility_date": "2026-09-26", | |
| 6 | "placement": { "mode": "off" }, | |
| 7 | "main": "./workers/app.ts", | |
| 8 | // Staff only: reachable at sudo.g1t.sh, behind Cloudflare Access, and | |
| 9 | // nowhere else. No workers.dev address and no preview URLs, so there is | |
| 10 | // no way round Access to the worker. | |
| 11 | "routes": [{ "pattern": "sudo.g1t.sh", "custom_domain": true }], | |
| 12 | "workers_dev": false, | |
| 13 | "preview_urls": false, | |
| 14 | // Even the stylesheet goes through the worker, which checks the Access | |
| 15 | // token on every request before anything is served. | |
| 16 | "assets": { "binding": "ASSETS", "run_worker_first": true }, | |
| 17 | // Billing's and identity's staff-only methods (admin_*). Nothing else | |
| 18 | // binds to identity's admin_* methods. The event log, read-only, for | |
| 19 | // `abuse.flagged` (Abuse & fraud). | |
| 20 | "services": [ | |
| 21 | { "binding": "BILLING", "service": "g1t-billing" }, | |
| 22 | { "binding": "IDENTITY", "service": "g1t-identity" }, | |
| 23 | { "binding": "EVENTS", "service": "g1t-events" }, | |
| 24 | // The status page's staff-only entrypoint: posting incidents to | |
| 25 | // status.g1t.sh (apps/status). Only bindings reach it. | |
| The site no longer has g1t's own agents. g1t is where the coding agents you already use do their work, so the Agents mode is gone from the rail, with every page under /<workspace>/-/agents: personas, faces, skills, abilities, routines, computers, sessions and agent spend. Customize (skills, connectors, plugins, marketplaces), the context hub, model providers, the AI Gateway page, the Spend page and pill, Ask g1t, and the repository's Agents, Plans and agent settings pages go too, and their addresses now answer 404. | 26 | { "binding": "STATUS", "service": "g1t-status", "entrypoint": "StatusAdmin" } |
| Security matches the workspace's other pages and leaves out deleted repositories; every section has a name in the trail | 27 | ], |
| 28 | "vars": { | |
| 29 | // The Zero Trust team domain, such as `g1t.cloudflareaccess.com`. | |
| 30 | "ACCESS_TEAM_DOMAIN": "syntaqx.cloudflareaccess.com", | |
| 31 | // The Access application's Audience (AUD) tag. | |
| 32 | "ACCESS_AUD": "5479fcf84130fc7ae68c207ae69a81b2aa17d97714443c6f1dddd058c530b8cf", | |
| 33 | // Who may use sudo, comma separated. Access lets them in; this | |
| 34 | // decides again, in case the Access policy is ever widened. | |
| sudo: Access service tokens listed in STAFF_SERVICE_TOKENS are staff, recorded as <name>@service.g1t.sh | 35 | "STAFF_EMAILS": "syntaqx@gmail.com, @g1t.sh", |
| 36 | // Access service tokens let in as staff: `<client id>=<name>`, comma | |
| 37 | // separated. Each acts, and is recorded, as `<name>@service.g1t.sh`. | |
| 38 | // The Access application needs a Service Auth policy including it. | |
| 39 | "STAFF_SERVICE_TOKENS": "434297ede60761875e84742d0486cf27.access=claude" | |
| Security matches the workspace's other pages and leaves out deleted repositories; every section has a name in the trail | 40 | }, |
| Merge branch 'worktree-agent-a8752162fea25f63f' into spend-guardrails | 41 | // Every log kept: staff only, few requests. |
| 42 | "observability": { "enabled": true, "head_sampling_rate": 1 }, | |
| Security matches the workspace's other pages and leaves out deleted repositories; every section has a name in the trail | 43 | "upload_source_maps": true |
| 44 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.