fix(cloud-agent-next): stop deploy from wiping control-plane enrollment

ENVIRONMENT.md

@@ -392,8 +392,8 @@ The key is team-scoped for all topics and valid in both the sandbox and producti
 - `KILO_BIN_PATH` - Path or name of the `kilo` CLI binary; used by `services/cloud-agent-next/scripts/update-default-slash-commands.mjs`. [SERVER]
 - `WORKSPACE_PATH` - Filesystem path of the agent workspace. [SERVER]
 - `SESSION_ID` - Reserved session identifier for the `cloud-agent-next` runtime; reserved in `RESERVED_ENV_VARS`. [SERVER]
-- `CONTROL_PLANE_IDS` - Comma-separated user or org IDs admitted to the call-home control plane at interactive web (`cloud-agent-web`) session creation. Empty admits nobody. `*` includes personal accounts. Production defaults to empty. Wrangler `dev` defaults to `*`. Non-interactive origins (Slack, scheduled, code review, and similar) keep legacy `agent_` sessions even when enrolled. Does not enable new worktree creation by itself; that also requires `WORKTREE_CREATION_ENABLED_IDS` enrollment. [SERVER]
-- `WORKTREE_CREATION_ENABLED_IDS` - Comma-separated user or org IDs allowed to create new worktrees, or `*` for all, including personal accounts. Production defaults to empty/off. Wrangler `dev` defaults to `*`. Also requires enrollment in `CONTROL_PLANE_IDS`. Disabling it does not block existing worktrees or sibling chats in them. [SERVER]
+- `CONTROL_PLANE_IDS` - Comma-separated user or org IDs admitted to the call-home control plane at interactive web (`cloud-agent-web`) session creation. Empty admits nobody. `*` includes personal accounts. Omitted from production `wrangler.jsonc` so the Cloudflare dashboard value survives deploy; unset admits nobody. Wrangler `dev` and `.dev.vars.example` default to `*`. Non-interactive origins (Slack, scheduled, code review, and similar) keep legacy `agent_` sessions even when enrolled. Does not enable new worktree creation by itself; that also requires `WORKTREE_CREATION_ENABLED_IDS` enrollment. [SERVER]
+- `WORKTREE_CREATION_ENABLED_IDS` - Comma-separated user or org IDs allowed to create new worktrees, or `*` for all, including personal accounts. Omitted from production `wrangler.jsonc` so the Cloudflare dashboard value survives deploy; unset is off. Wrangler `dev` and `.dev.vars.example` default to `*`. Also requires enrollment in `CONTROL_PLANE_IDS`. Disabling it does not block existing worktrees or sibling chats in them. [SERVER]
 - `VERCEL_SANDBOX_ORG_IDS` - Comma-separated org IDs routed to Vercel sandboxes. Empty is off. `*` includes personal accounts. [SERVER]
 - `HOME` - Reserved in `RESERVED_ENV_VARS` for cloud-agent-next session home management. [SYSTEM]
 

services/cloud-agent-next/.dev.vars.example

@@ -41,6 +41,9 @@ REAPER_INTERVAL_MS=300000
 # Comma-separated list of org IDs that use per-session Cloudflare sandboxes, or `*` for all orgs
 PER_SESSION_SANDBOX_ORG_IDS=
 
+# Control-plane and worktree enrollment (optional)
+# Comma-separated user or org IDs, or `*` for all including personal accounts.
+# Local wrangler `dev` also defaults these to `*` in wrangler.jsonc.
 CONTROL_PLANE_IDS=*
 WORKTREE_CREATION_ENABLED_IDS=*
 

services/cloud-agent-next/src/callbacks/queue-config.test.ts

@@ -37,12 +37,12 @@ describe('callback queue retry configuration', () => {
     expect(dev?.max_retries).toBe(CONFIGURED_REDELIVERIES);
   });
 
-  it('keeps production enrollment disabled and enables control-plane and worktree on wrangler dev', () => {
+  it('omits production control-plane enrollment from wrangler and enables it on wrangler dev', () => {
     const config = readWranglerConfig();
 
     expect(config.vars?.VERCEL_SANDBOX_ORG_IDS).toBe('');
-    expect(config.vars?.CONTROL_PLANE_IDS).toBe('');
-    expect(config.vars?.WORKTREE_CREATION_ENABLED_IDS).toBe('');
+    expect(config.vars?.CONTROL_PLANE_IDS).toBeUndefined();
+    expect(config.vars?.WORKTREE_CREATION_ENABLED_IDS).toBeUndefined();
     expect(config.env?.dev?.vars?.VERCEL_SANDBOX_ORG_IDS).toBe('');
     expect(config.env?.dev?.vars?.CONTROL_PLANE_IDS).toBe('*');
     expect(config.env?.dev?.vars?.WORKTREE_CREATION_ENABLED_IDS).toBe('*');

services/cloud-agent-next/worker-configuration.d.ts

@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 8d45d333d1f69f2f8355e9778e2fd5e3)
+// Generated by Wrangler by running `wrangler types` (hash: c8a767d5a742c2b932c5d8038b7dec5e)
 // Runtime types generated with workerd@1.20260714.1 2026-06-03 nodejs_compat
 interface __BaseEnv_Env {
 	SHARED_SANDBOX_OVERRIDES: KVNamespace;
@@ -28,8 +28,8 @@ interface __BaseEnv_Env {
 	CREDENTIAL_CONTAINMENT_ENABLED: "false" | "true";
 	REPO_SNAPSHOT_ORG_IDS?: "";
 	CONTAINER_BILLING_HEARTBEAT_SECONDS: "60" | "300";
-	CONTROL_PLANE_IDS: "";
-	WORKTREE_CREATION_ENABLED_IDS: "";
+	CONTROL_PLANE_IDS?: "*";
+	WORKTREE_CREATION_ENABLED_IDS?: "*";
 	VERCEL_SANDBOX_ORG_IDS: "";
 	VERCEL_PROJECT_ID: "";
 	VERCEL_TEAM_ID: "";
@@ -92,8 +92,8 @@ declare namespace Cloudflare {
 		CREDENTIAL_CONTAINMENT_ENABLED: "false";
 		REPO_SNAPSHOT_ORG_IDS: "";
 		CONTAINER_BILLING_HEARTBEAT_SECONDS: "60";
-		CONTROL_PLANE_IDS: "";
-		WORKTREE_CREATION_ENABLED_IDS: "";
+		CONTROL_PLANE_IDS: "*";
+		WORKTREE_CREATION_ENABLED_IDS: "*";
 		VERCEL_SANDBOX_ORG_IDS: "";
 		VERCEL_PROJECT_ID: "";
 		VERCEL_TEAM_ID: "";

services/cloud-agent-next/wrangler.jsonc

@@ -64,8 +64,6 @@
     "CLOUD_AGENT_CONTAINER_BILLING_USER_IDS": "f1a848ca-bade-48d8-a5ad-1042d08651e6",
     "CLOUD_AGENT_CONTAINER_BILLING_ORG_IDS": "9d278969-5453-4ae3-a51f-a8d2274a7b56",
     "CONTAINER_BILLING_HEARTBEAT_SECONDS": "300",
-    "CONTROL_PLANE_IDS": "",
-    "WORKTREE_CREATION_ENABLED_IDS": "",
     "VERCEL_SANDBOX_ORG_IDS": "",
     "VERCEL_PROJECT_ID": "",
     "VERCEL_TEAM_ID": "",