Need (hit today, 2026-07-24): handing a Cloudflare API token to the fleet requires a cloudflare provider in HSM Keys, and Cloudflare auth is two-part — API token plus Account ID — so a single secret field doesn't model it.
Proposal: either (a) add a cloudflare provider with api_token + account_id fields, or better (b) a generic/custom provider type where the operator defines the env-var name(s) per key, so the next provider (Squarespace, SMSPool, whatever) doesn't need a code change. Multiple named fields per provider entry, each mapping to one env var in assigned agents' .env.
Workaround in use meanwhile: creds handed over via a gitignored env file outside HSM — works but bypasses the vault, which is exactly what HSM exists to prevent.
Flagging for the gardener lane.
🤖 Generated with Claude Code
Need (hit today, 2026-07-24): handing a Cloudflare API token to the fleet requires a
cloudflareprovider in HSM Keys, and Cloudflare auth is two-part — API token plus Account ID — so a single secret field doesn't model it.Proposal: either (a) add a
cloudflareprovider withapi_token+account_idfields, or better (b) a generic/custom provider type where the operator defines the env-var name(s) per key, so the next provider (Squarespace, SMSPool, whatever) doesn't need a code change. Multiple named fields per provider entry, each mapping to one env var in assigned agents'.env.Workaround in use meanwhile: creds handed over via a gitignored env file outside HSM — works but bypasses the vault, which is exactly what HSM exists to prevent.
Flagging for the gardener lane.
🤖 Generated with Claude Code