[TriDefender]

Plugin type (required) / 插件类型（必填）

• UI Plugin / 是 UI 插件 — provides MCP Apps interactive pages / 提供 MCP Apps 交互页面
• Standard plugin / 普通插件（非 UI） — does not provide MCP Apps interactive pages / 不提供 MCP Apps 交互页面
• Not applicable / 不适用 — repository-only changes; no plugin content changed / 仅仓库级改动，不涉及插件内容

Affected plugin name(s) / 涉及的插件名称：cloudflare-clef (Standard plugin)

What / 改动内容

Adds a new community plugin external_plugins/cloudflare-clef v0.2.0 and its marketplace.json entry.

User problem. Agents often need calibrated judgments over concrete evidence — triage, routing, severity grading, accept/reject — where free-text guessing from the chat model is unreliable. This plugin exposes an MCP tool clef_evaluate that sends a state plus typed questions (boolean / choice / score, arbitrary unicode ids) to Cloudflare Workers AI CLEF Flash / CLEF and returns per-question answers with full probability distributions and usage.

Notable properties.

• Zero npm dependencies: the MCP stdio server hand-rolls newline-delimited JSON-RPC (Node >= 22 on PATH). Nothing to install at runtime.
• Credentials never touch disk in plaintext: server/store-secret.ps1 stores the Cloudflare Account ID and API token DPAPI-encrypted (bound to the current Windows user) at %USERPROFILE%\.zcode\secrets\cloudflare-clef.json; server/launch.mjs decrypts at startup via PowerShell and injects them into the process environment (MCP traffic never passes through PowerShell). Environment variables are the cross-platform fallback and take precedence. An alternative to plaintext userConfig secrets.
• Side effects, documented in both READMEs: the only network access is a POST to https://api.cloudflare.com/client/v4/accounts/<accountId>/ai/run/@cf/cloudflare/<model> (no redirects, no retries, no telemetry); response bodies capped at 1 MiB; evidence budget ~24k text bytes and <= 4 images (PNG/JPEG/WebP).

How it was tested.

• node --test external_plugins/cloudflare-clef/server/protocol.test.mjs: 15/15 pass (protocol encoding, response validation, image extraction, prototype-pollution-safe id round-trips — ported with the protocol layer).
• MCP smoke tests: initialize handshake, tools/list, unknown tool/method error codes, missing-credential guidance.
• Full chain with a throwaway fake token: DPAPI store -> launch decrypt -> env inject -> real HTTPS request -> Cloudflare 401 mapped to a clear authentication error message. Fake secret file deleted afterwards.

Versions and registration. Plugin manifest and marketplace.json entry both 0.2.0, same description and description_i18n.

Repository checks.

• python3 scripts/validate.py: OK (53 plugins).
• git diff --check: clean.
• python3 scripts/build_dist.py: on this fresh checkout it fails at the pre-existing UI plugins (excalidraw and the Craft plugins need pnpm build first, as documented in the README); unrelated to this change. The new plugin itself was verified with the repo's own build_zip(): deterministic 22,492-byte zip, sha256 e636282c849c906b….

Dependencies, network, permissions, side effects. Runtime needs Node >= 22 (node on PATH). On Windows, startup invokes powershell for the DPAPI decrypt of two short ciphertexts; MCP I/O stays in Node. No other processes, no file writes outside the plugin process, no telemetry.

Licensing / provenance. MIT (LICENSE in the plugin's source repo). The protocol layer (server/protocol.mjs, server/protocol.test.mjs) is ported byte-identical from the MIT-licensed OpenClaw plugin openclaw-cloudflare-clef 0.1.3 (distributed via the OpenClaw plugin registry, clawhub:openclaw-cloudflare-clef); authorship and derivation are stated in both plugin READMEs. All other code is new.

Source repository: https://github.com/TriDefender/zcode-cloudflare-clef

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.

[TriDefender]

Update while awaiting review: bumped to 0.3.0 with one feature — clef_evaluate state now accepts absolute local file paths (.png/.jpg/.jpeg/.webp) as image evidence; the server reads the file and embeds it as a data URL before encoding (missing path / non-file / >4 MiB fail fast with clear unsupported-input errors). Rationale: chat models cannot reliably emit megabytes of base64 inside MCP tool arguments, so inline-data-URL images were impractical for real screenshots. The protocol layer (server/protocol.mjs) remains byte-identical to the OpenClaw original. Verified live with real credentials: two path-referenced PNGs evaluated correctly (positional [image #N] binding confirmed: black-first 0.948, white-second 0.018); scripts/validate.py passes.

[panda920]

✅ Internal validation passed. A ZCode maintainer will review the change next; after acceptance, release checks run separately and this PR is closed automatically.