Overview
VaporForge uses Cloudflare Workers for auth and orchestration, with sandboxed containers running the Claude Agent SDK. API costs are $0 to the platform since users bring their own Anthropic OAuth accounts.
Architecture
Browser → Worker (auth/orchestration) → Sandbox Container (SDK) → Anthropic API. The SDK runs inside the container as node /workspace/claude-agent.js.
Container Spec
standard-2: 1 vCPU, 6 GiB RAM, 12 GB disk. Estimated $7.02/user/mo at $20/mo pricing = ~80% margin.
OAuth Note
OAuth-only auth. Users connect their Anthropic account. sk-ant-oat... tokens are routed through the Claude CLI subprocess — never to the Messages API directly.
Format
<type>: <description>
[optional body]
Types
feat new feature fix bug fix refactor no behavior change docs docs only test tests chore maintenance perf performance ci CI/CD
Rules
Always lowercase. Imperative mood — "add" not "added". No period at end. Description under 72 characters. Attribution line disabled globally in settings.json.
What Was Built
Added user profile biographical background injected into every AI coach prompt. Added routine costs table with high-cost flagging (⚠ badge). Added AI provider selector with fallback chain.
Key Decisions
Fallback order: Anthropic → DeepSeek → Groq → Gemini (Gemini last — quota-prone). Column named life_values not values — reserved word in SQLite.
DB Notes
Schema drift on drizzle-kit push (expires_at in account table). Use Turso HTTP API for manual migrations when drizzle-kit push fails.
WP Dispatch v1.0 Plan
23-task implementation plan completed. 78 tests, 87.9% lib coverage. Features: WP site management, client portal, Basecamp sync, Bricks Builder editing, AI chat via Claude, rate limiting, AES-256-GCM encryption.
Stack
Next.js 16 + React 19 + Turso/Drizzle + shadcn/ui + Tailwind v4. Deployed to Vercel (prj_ubYLGkM92excbEj8stFZutXDmt6z).
Title Format
#project / ENV_VAR_NAME
Examples:
#vaporforge / ANTHROPIC_API_KEY
#clarity / TURSO_AUTH_TOKEN
#cross-app / GITHUB_TOKEN
Vaults
App Dev — project-specific env vars Business — paid API keys (Anthropic, OpenAI, etc.) Personal — personal accounts only
Gotcha
get_api_key defaults to "Private" vault — always specify vault: "App Dev" or vault: "Business" explicitly.
Critical Rule
OAuth tokens (sk-ant-oat01-...) are REJECTED by the Anthropic Messages API. They ONLY work inside the Claude Code CLI subprocess (claude -p).
Direct API Calls Always Need an API Key
Any app calling client.messages.create() must use an API key (sk-ant-api01-...) from console.anthropic.com. This includes Clarity, WP Dispatch, and any app with a direct Anthropic SDK call.
Pattern
function createClient(token) {
if (token.startsWith('sk-ant-oat'))
return new Anthropic({ authToken: token })
return new Anthropic({ apiKey: token })
}
Workers SDK Patterns
Use @cloudflare/workers-types for type safety. Hono is the recommended router for Workers. Bindings are declared in wrangler.toml and typed via Env interface.
D1 Query Pattern
const result = await env.DB.prepare(
'SELECT * FROM items WHERE id = ?'
).bind(id).first()
Tab Bar Rule
NEVER use fixed height on a tab bar that also has padding-bottom: env(safe-area-inset-bottom) — they conflict and clip content on notched iPhones.
Touch Targets
44×44px minimum per HIG. Buttons at 36×36 are a bug. Use min-height: 44px; min-width: 44px.
Body Clearance
padding-bottom: calc(56px + env(safe-area-inset-bottom, 20px))