[penalosa]

Summary

Adds hidden global --temporary-account and --event-code flags. When no Cloudflare credentials are available, cf creates or reuses a short-lived account through @cloudflare/workers-auth, prints its claim URL, and uses that account's ID and scoped API token for the command.

• --temporary-account works on every command. cf does not keep a per-command allow-list; the API reports operations the temporary token cannot perform.
• It is rejected when credentials already exist (env token or stored OAuth, even expired) and with --local.
• --event-code requires --temporary-account, is trimmed, and rejects blank or repeated values. It is sent only when a new account is created, and is never cached, printed, or recorded in telemetry.
• Missing-credential errors suggest --temporary-account, and cf auth whoami suggests it when unauthenticated.
• cf auth logout now delegates to workers-auth's shared logout, matching Wrangler: it clears a cached temporary account and prints the shared messages. With CLOUDFLARE_API_TOKEN set, it asks you to unset the variable and leaves any stored OAuth login in place.
• cf relies on workers-auth to keep the temporary account active for the invocation rather than caching it itself.
• Generated and runtime-schema API fields that would shadow the new global flags are omitted.

Comparison with Wrangler

Both CLIs use the same workers-auth flow, so terms prompt/notice, proof-of-work, caching and reuse (per API environment), the already-authenticated refusal, the compliance-region check, clearing on login and logout, and logout messages behave the same. The differences are deliberate:

• The flag is spelled --temporary-account. Shared workers-auth messages are rewritten to use that spelling.
• The flags are global instead of per-command opt-in, so --event-code is also accepted on workers versions create.
• cf's auth logger writes temporary-account notices and logout messages to stderr, so stdout stays reserved for command output.

Tests

• cf: temporary-accounts.test.ts plus updates to the context, auth-token, errors, profiles, schema-flags, arg-derivation, and telemetry sanitization tests.
• wrangler-tests: ported Wrangler's temporary-account cases for deploy (14 cases in the new deploy/core.test.ts), versions upload, d1 migrations apply, logout, whoami, and root help. The logout tests now assert Wrangler's shared messages. Removed the ported identities from the fallback shards and the generator skip lists, and updated MANIFEST.md (624 passing, 1,498 todo, 3,354 skip).
• pnpm test (cli and wrangler-tests), pnpm check:type, pnpm check:lint, and pnpm check:format pass locally.

[pkg-pr-new]

npm i https://pkg.pr.new/cf@298

commit: 2f1e53f

[github-actions]

cf --help startup

	mean	stddev	min	max
PR	257.7 ms	3.2 ms	252.8 ms	265.4 ms
base	261.6 ms	4.6 ms	254.9 ms	271.4 ms

Δ (PR vs base): ↓ -4.0 ms (-1.5%)

Measured with hyperfine on ubuntu-latest (3 warmup runs, 20 timed runs). CI numbers carry ±a few ms of runner jitter; treat small deltas as noise.

[ask-bonk]

Review: 1 findings.

🤖 I've done a thorough review of your PR.
Adds global temporary-account provisioning and event-code support.

1. Warning: cf auth whoami --temporary-account reports "authSource": "none" despite authenticating with the temporary token. The attempted inline suggestion could not attach because the affected branch is unchanged in the PR diff.

github run

[ask-bonk]

Review: 1 findings.

Posted 1 inline suggestion.

github run

[ask-bonk]

Review: 1 findings.

🤖 I've done a thorough review of your PR.

Adds global temporary-account and event-code support.

• Warning: Posted 1 inline suggestion.

github run

[ask-bonk]

Review: 2 findings.
🤖 I've done a thorough review of your PR.

Adds global temporary-account provisioning and event-code support.

1. Blocking: Build Output deploy, Preview deploy, and trigger deploy provision temporary tokens before resolving the output’s compliance region. FedRAMP prebuilt output can mint a public-region temporary account. packages/cli/src/commands/deploy/shared.ts:143, packages/cli/src/commands/previews/deploy.ts:110, packages/cli/src/commands/workers/triggers/deploy.ts:94.
2. Warning: cf auth whoami --temporary-account catches credential-conflict and provisioning failures, returning unauthenticated JSON instead of rejecting as required. packages/cli/src/commands/auth/whoami.ts:42.

github run

[ask-bonk]

No new concerns since the last review

github run

[ask-bonk]

🤖 I've done a thorough review of your PR.

Adds temporary-account authentication and event-code support across cf workflows.

1. Warning: Posted an inline suggestion for camelCase API fields bypassing reserved global-flag detection in generator/plugin/args.ts.

github run

[irvinebroque]

@edevil @sidharthachatterjee

[clanky-the-clanker]

💬 Approved with comments — The temporary-account flow is implemented carefully and well tested. It covers flag validation, rejection when credentials exist or with --local/--dry-run, telemetry redaction of --event-code, and collisions with flag names. I found no correctness, security or performance problems. The two documentation suggestions are optional.

Findings: 2 suggestions

_{The decision is advisory: this comment never approves, blocks or requests changes on the pull request.}

🔧 Fix with your agent

Paste the following into your coding agent to investigate and fix these issues.

Fix the following code review issues found in pull request #298.

Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
  for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

## SUGGESTION (2)

### [AGENTS.md] packages/cli/AGENTS.md:118-121: add the `--temporary-account` path to the account ID and token resolution summary.
- **File:** packages/cli/AGENTS.md:118

### [Documentation] packages/cli/README.md:34-41 lists the credential-resolution order without the `--temporary-account` fallback. Consider mentioning it, unless keeping the flag undocumented is intentional because it is hidden.
- **File:** packages/cli/README.md:34

---

📖 AGENTS.md: 💬 1 suggestion

The account and token resolution summary in packages/cli/AGENTS.md doesn't include the temporary-account path.

Recommendation: 💬 Optional Nits

• [SUGGESTION] packages/cli/AGENTS.md:118-121: add the --temporary-account path to the account ID and token resolution summary. (packages/cli/AGENTS.md:118)

View full review

• packages/cli/AGENTS.md:118-121 says account IDs come from the environment, project settings and workers-auth, and tokens come from CLOUDFLARE_API_TOKEN or stored OAuth. It doesn't mention that --temporary-account supplies both values when no credentials exist. The Global Flags paragraph just above describes the flag, so this is only a consistency gap.

---

📝 Documentation: 💬 1 suggestion

The README's credential-resolution section doesn't mention the temporary-account fallback.

Recommendation: 💬 Optional Nits

• [SUGGESTION] packages/cli/README.md:34-41 lists the credential-resolution order without the --temporary-account fallback. Consider mentioning it, unless keeping the flag undocumented is intentional because it is hidden. (packages/cli/README.md:34)

View full review

• packages/cli/README.md:34-41 lists CLOUDFLARE_API_TOKEN and OAuth profiles as the complete credential-resolution order. The flags are intentionally hidden, so leaving them out of the public README may be deliberate. If the README should be complete, a short note that --temporary-account is a fallback used only when no credentials exist would help.

---

✅ All other checks passed

🚀 Release: ✅ LGTM

Risk: Low. The changeset is present for this user-facing change.

---

🔒 Security: ✅ LGTM

I found no exploitable problems.

• Event code: telemetry sanitization allow-lists only temporary-account, so --event-code stays redacted. Its coerce function throws without echoing the value.
• Flag combinations: --temporary-account is rejected with --local, --event-code is rejected without --temporary-account, and --dry-run is rejected when a temporary account is requested.
• Token handling: the temporary token is returned only through getAuthToken and the account resolvers. Nothing in the diff logs or prints it.
• Not verified: the "reject when credentials already exist" behaviour lives in @cloudflare/workers-auth, which this review did not inspect.

---

📋 Code Quality: ✅ LGTM

I found no correctness, error-handling, convention or test-coverage problems.

• Dry run: generated commands check argv.dryRun before calling createCommandClient, so the new dry-run guard only affects the hand-written schema-backed commands, ai run and registrar registrations create. temporary-accounts.test.ts covers both.
• Build Output commands: deploy, workers versions create, workers triggers deploy and previews deploy all go through resolveBuildOutputAuth / validateBuildOutputAccount. Compliance-region rejection is tested for all four.
• Flag collisions: collisions with the new global flags are handled in the generator (args.ts), in the runtime-schema code (schema-flags.ts), and in the CF_FLAGS body-input exclusion. Tests cover all three.
• Credential classification: expired OAuth credentials and refresh failures are not treated as missing credentials, so those errors don't suggest --temporary-account.

---

⚡ Performance: ✅ LGTM

No performance concerns.

---

_{Reviewed commit: 2f1e53f5}

[ask-bonk]

🤖 I've done a thorough review of your PR.

Adds global temporary-account provisioning and event-code support.

1. Warning: Posted a suggestion fixing runtime-schema dry runs that fetch using "<account-id>" after provisioning a temporary token.

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

No new concerns since the last review

github run

[ask-bonk]

🤖 I've done a thorough review of your PR.

Adds global temporary-account provisioning and event-code support.

1. Suggestion: Posted an inline fix removing forbidden JSDoc @param / @returns tags from the new test helper.

github run

[ask-bonk]

No new concerns since the last review

github run

[ask-bonk]

No new concerns since the last review

github run

[petebacondarwin]

A whole load of NITs sorry.
But none blocking, and otherwise LGTM.

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM

github run

[ask-bonk]

LGTM!

github run