devspace-ultra-setup

DevSpace Ultra guided setup

Use this Skill as an interactive installation and recovery runbook. The Agent executes every safe local command it can execute, verifies each result itself, and asks the user only for account, router, or physical-network actions that cannot be completed locally. Do not merely paste a long command and leave the user to diagnose it.

Operating rules

• Prefer DuckDNS/DDNS + Caddy direct ingress.
• Use a stable Cloudflare named tunnel only when the user has CGNAT, cannot forward ports, or has no usable DDNS route.
• Treat Worker-based Cloudflare relay traffic as quota-governed; never describe it as unlimited.
• Keep Gateway, Core, Blender MCP, and application ports loopback-only. Public exposure terminates at Caddy or the named tunnel.
• Never ask the user to paste a DuckDNS token, Cloudflare token, OAuth token, cookie, API key, or password into chat. Use a secure local prompt or a process-scoped environment variable, then clear it.
• Never write secrets to Git, config.json, logs, generated status JSON, shell history, Task Scheduler arguments, or progress narration.
• Do not impose a Core heap cap, workspace limit, MCP-session count limit, or work timeout. Production Core uses the system-managed heap profile.
• Keep autoCompactEnabled=false. Enable goalRoundRecoveryEnabled=true only when the installed release contains the exact-conversation page-composer recovery gate: one successful recovery per Goal round, no Primary repair, no window activation, no page navigation/reload, and duplicate conversations fail closed. Retain DEVSPACE_GOAL_ROUND_RECOVERY=0 as the explicit operator hold.
• Use devspace_progress_report before substantive work on a multi-step setup and after each meaningful medium-sized setup step, not after every command and not only at the very end. The Local Gateway may reject a second substantive tool, stale-report continuation, or Plan completion with devspace_progress_preflight_required; when that happens, author the progress update yourself, verify the current conversation owns it, and retry the blocked operation.