Repository navigation
Patch release. The headline is a fix for agent skill installation that was
silently affecting every machine still carrying the superseded cloudflare
skill, plus a governance correction to how API-token update reports itself.
Agent skill installation could not migrate
If your machine still had the superseded contract-2 cloudflare skill,
cfctl agents install refused with "has local drift; use cfctl agents sync
to replace it" — and agents sync skipped the agent entirely, because it only
touches agents that already have a managed skill. The two commands deadlocked,
and the advice pointed at the one that could not help. Machines in that state
were being served the older catalog-search-first doctrine instead of the
current resolve-first instructions.
Removability now depends on the frozen hash rather than the install mode: a
byte-exact match is the artifact cfctl itself wrote, so treating it as your
local drift was wrong. Anything that is not a byte-exact match is still
refused, and a file cfctl did not write is never deleted.
Migration also no longer follows symlinks. Where the skill directory is a
symlink into a shared tool tree, cfctl leaves the shared copy alone and
installs beside it rather than reaching outside the agent home it manages.
cfctl agents sync now names the agents it passed over instead of reporting
"synchronized" for work it did not do.
API-token update says why it is blocked
account-api-tokens-update-token and user-api-tokens-update-token were
blocked with the generic reason "operation contract incomplete: risk/effect/
cost missing", which told agents that supplying those fields would unlock
them. It would not — token mutation is reserved to the inventory-bound keys
workflow so every permission change is resolved against a fresh live
inventory. They now carry a blocked by design: reason that says so, and a
test pins that a future classifier cannot silently promote them.
KV namespace deletion
Deleting an empty KV namespace is available as a reviewed compensation with a
live emptiness proof bound into the plan. Arbitrary namespace deletion stays
blocked: Cloudflare does not document whether deleting a populated namespace
bills its contained key deletions, so its cost is unbounded.
Internal: drift gates
Several things that were kept true by hand are now kept true by the build.
Intra-workspace version pins are checked by equality (Cargo alone accepts a
stale pin, because the bumped crate still satisfies it), the QUICKSTART
download path must match the release, and every cfctl example in a tracked
file or in the managed agent instructions is validated against the real command
tree and the real parser — subcommands at full depth, and flags. These caught
no existing drift; they close the gaps before one appears.
Install
Releases are unsigned by operator decision; integrity is checksum-based. Verify
every download against SHA256SUMS. Each binary is reproducible from the
tagged source and carries an SPDX SBOM.
curl -fsSLO https://github.com/rogu3bear/cfctl/releases/download/v1.2.1/cfctl-aarch64-apple-darwin
curl -fsSLO https://github.com/rogu3bear/cfctl/releases/download/v1.2.1/SHA256SUMS
shasum -a 256 --check --ignore-missing SHA256SUMS
install -m 0755 cfctl-aarch64-apple-darwin ~/.local/bin/cfctl