Highlights

Runs every local Workers project in a Windows Job Object, so stopping, quitting or even a crash of the app never leaves orphaned workerd processes behind.

Every Cloudflare change is planned as a field-by-field diff, refused if the target changed since you looked, verified by reading it back, and recorded with undo.

Maps the services a deployed Worker actually calls, from Cloudflare's own subrequest analytics, and checks each one for post-quantum TLS on demand.

Technical Implementation

Local Workers, end to end: project discovery re-scans watched folders when a wrangler config appears, detects the framework and package manager, and runs wrangler dev or any package script with auto-restart. Traffic, 5xx rate and p50/p95 latency are parsed from the dev server's own log lines. Requests can be replayed, cron triggers fired, and queue batches delivered to a consumer.

Safe local data editing: D1 rows and KV keys are edited only while the server is stopped. Each edit shows the exact SQL or command first, takes an automatic snapshot of the project's local state, and runs through the project's own wrangler, with SQL and values passed in temp files rather than on a command line.

Deploys with a review: before a deploy, Flarebox compares the config's bindings and compatibility date against the live version and diffs the local bundle against the last one it deployed, file by file. Rollbacks, gradual rollouts, write-only secrets and live production tail logs sit behind explicit confirmations.

Cloudflare beyond Workers: a Rust API client handles DNS with lint for leaked origin IPs and dangling CNAMEs, SSL/TLS settings, the WAF including managed rules and rate limiting, cache, tunnels, load balancing, Origin CA certificates generated locally, tray alerts, a zone timeline that lines up traffic spikes with deploys, and per-version Workers metrics. A read-only mode blocks every change from the machine.

Post-quantum, zone by zone: the pqdoctor engine checks each origin behind your proxied records, keeps a history with daily re-checks and regression alerts, exports a CycloneDX 1.6 CBOM, and ranks which origins to fix first. A source scan flags quantum-vulnerable crypto in the project's own code with file and line.

Observed outbound map: a Deploy-tab panel reads Cloudflare's subrequest analytics grouped by hostname to list the services a Worker really calls. Only scheme, host and port are kept; checks run one at a time and only on click; Cloudflare-owned, private and plain-HTTP hosts are never probed.

Fixing origins, not just finding them: for an origin that is not post-quantum, Flarebox fingerprints why (a config line, a TLS library too old for ML-KEM, or a provider's product), previews the exact change, and applies it only on approval: back up, write, test, reload, re-check, and roll back if the origin is not post-quantum afterwards. When the library cannot be upgraded, it generates a cloudflared or Caddy sidecar config so the hop is post-quantum today.

Shipping it: releases are built for Windows and Linux, signed with an updater key that never enters the repository, and published to a feed the app checks on its own. The 0.2.2 redesign added a Home page, a Post-quantum page with a seven-probe handshake diagram, a compact layout, and a feature registry so users switch off the parts of the app they do not use.

Design Decisions & Challenges

A desktop app that can change DNS and TLS on a live account has to be careful by default. API access uses two tokens the user creates: a read token for every view and an optional write token loaded only for a change the user has approved. Both are verified with Cloudflare, stored in Windows Credential Manager, never written to a file, and never handed back to the UI. Change plans are held in Rust, single-use and short-lived. Irreversible actions such as purges or deleting a tunnel require typing the resource name. A written security review lists each threat with the test that enforces it.

Testing a tool like this against a real account for every change is not safe, so the end-to-end suite drives the real native app in WebView2 as an isolated second instance with its own data folder and a fake Cloudflare API on loopback built from the documented response shapes. The suite runs more than 400 checks across every Cloudflare tab, alongside Rust and UI unit tests. Safety, DNS and SSL/TLS were also checked against a real account, where the numbers matched the live sites.

Real tooling surfaced real bugs: serde silently ignoring field renames on tagged enums, a wrangler version printing its ready URL in an unexpected order, local R2 keys being URL-normalised, and a DNS lint false positive on Domain Connect records. Each was fixed, logged, and covered by a test so it stays fixed.