deployangel 0.1.24 → 0.1.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2304a80caf17ea6df84a2487145d51438244f15e38528e817fb93ed45a07dff0
-  data.tar.gz: b28c3f544144e1b4a8cd9417fbdb4407bd814d814fe88522073e4d463d25f11a
+  metadata.gz: 66a47a8fb6c86749fb8d29333b9f9f01c7d0c6512dfc7bea7c93fd7191d231a2
+  data.tar.gz: 93c324ea15c7ddc1e361d82c922a9543c9d15e23511206f93586e6fa1c7b9c4c
 SHA512:
-  metadata.gz: ba778f41f2922f597a225d2bbdefc58ffce09443ec7f4c342f8df2729103e36a49115bcd76502222a95717eace53b4c737cc836fccff3a865bb52e835501fc0a
-  data.tar.gz: 98abb8b69f7cf9e61980a68befcff22dee0ede110019a2b6e398a92efaef155e2c700ce3eaf426fb9f3346fcbe0ce320b7bd3ef78979c0459a91bc4a6f0cd263
+  metadata.gz: 0ba0355966761d97fc73b3c64eab89f448114c23de7192555913c49d97de57e6349de81eb1fb9994a1a850e170313e8cbed39249fe00d8f3045ba88ea6840fe0
+  data.tar.gz: 8d9ca49ffbd98f4feb88e10b94887f171b7bd877e77ff36396ae716defa016ccc29ebc23452475f894f67d149ad3f78421f867ace1644faff8660f7006db2763

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.26 (2026-10-11)
+
+- `deployangel setup --code=CODE` redeems a one-time code from "Set up with
+  your coding agent" and saves the app's token and a "CI deploys" token to
+  `.deployangel/credentials.json` (readable only by you, kept out of git),
+  without printing either, so tokens stay out of coding agents' chats. The
+  command and MCP server use the saved token when `DEPLOYANGEL_API_TOKEN`
+  isn't set. `deployangel token app|api` prints a saved token for piping into
+  a host's or CI's secrets.
+
+## 0.1.25 (2026-10-10)
+
+- `verify` prints what a clearance doesn't cover right under it: app-wide
+  signals without enough data, critical flows and changed items not run
+  since the deploy, and latency that rose but stayed within limits (from
+  the verdict document's new `clearance.scope`). The coding-agent
+  instructions `install agents` writes now say to report it too.
+
 ## 0.1.24 (2026-10-10)
 
 - `deployangel doctor` checks the setup: the agent in the bundle, the

data/README.md

@@ -430,6 +430,20 @@ with the `verifications:read` scope (plus `deployments` to register deploys or
 report checks). Never use the production telemetry token on a developer
 machine.
 
+To let a coding agent set DeployAngel up, use "Set up with your coding agent"
+on the app's page in DeployAngel: it gives a one-time setup code, not tokens.
+`deployangel setup --code=CODE` redeems it and saves the app's token and a "CI
+deploys" token to `.deployangel/credentials.json`, readable only by you and
+kept out of git, without printing either. The command and MCP server then use
+the saved token whenever `DEPLOYANGEL_API_TOKEN` isn't set. `deployangel token
+app` (or `api`) prints a saved token for piping into a host's or CI's
+secrets, so it never appears on screen or in an agent's conversation:
+
+```bash
+fly secrets set DEPLOYANGEL_TOKEN=$(bundle exec deployangel token app)
+bundle exec deployangel token api | gh secret set DEPLOYANGEL_API_TOKEN
+```
+
 ```bash
 export DEPLOYANGEL_API_TOKEN=da_live_...
 
@@ -545,7 +559,8 @@ verdict: call the `wait_for_verification` MCP tool with the commit and
 `until: "initial"`, calling again while it's in progress, or run
 `bundle exec deployangel verify --commit=<sha> --wait --until=initial`.
 
-- Exit 0 / verified: the release is cleared. Report the clearance line and
+- Exit 0 / verified: the release is cleared. Report the clearance line, what
+  it says it doesn't cover ("Not assessed", "Not run since the deploy"), and
   anything DeployAngel is still watching, then move on.
 - Exit 6: no problems so far, but NOT cleared. Report "no problems so far, not
   yet cleared" and the expected clearance time. DeployAngel keeps verifying and

data/lib/deployangel/cli/formatter.rb

@@ -70,7 +70,9 @@ module DeployAngel
 
       def notes(document)
         v = document["verification"] || {}
-        notes = []
+        # What a clearance doesn't cover, right under it (servers from
+        # 2026-10-10 send it).
+        notes = Array(document.dig("clearance", "scope", "lines"))
         if (check = v["initial_check"]) && v["verdict"].nil?
           notes << "Initial check: #{check["result"].tr("_", " ")}. Not cleared yet."
         end

data/lib/deployangel/cli.rb

@@ -8,6 +8,7 @@ require "optparse"
 require_relative "version"
 require_relative "configuration"
 require_relative "client"
+require_relative "credentials"
 require_relative "ci_environment"
 require_relative "verification_waiter"
 require_relative "cli/formatter"
@@ -19,7 +20,7 @@ module DeployAngel
   # Runs without booting Rails.
   class CLI
     USAGE_ERROR = 5
-    COMMANDS = %w[release verify status plan exercise exception check install doctor mcp version help].freeze
+    COMMANDS = %w[release verify status plan exercise exception check install doctor setup token mcp version help].freeze
 
     HELP = <<~TEXT
       Usage: deployangel <command> [options]
@@ -42,13 +43,18 @@ module DeployAngel
                    or set up coding agents        deployangel install agents
         doctor     Check the setup: this checkout  [--format=text|json]
                    and what DeployAngel has seen
+        setup      Redeem a one-time setup code   deployangel setup --code=CODE
+                   and save the app's tokens here, without printing them
+        token      Print a saved token, to pipe   deployangel token app|api
+                   into a host's or CI's secrets
         mcp        Run the MCP server over stdio (for coding agents)
 
       With no target, verify, plan, and check use the current git HEAD commit.
       In GitHub Actions, GitLab CI, CircleCI, and Buildkite, release fills in the
       commit, a build label (e.g. run-123), and a link to the run automatically.
       In a Kamal hook, it registers Kamal's release (KAMAL_VERSION).
-      Environment: DEPLOYANGEL_API_TOKEN (required), DEPLOYANGEL_URL (default #{Configuration::DEFAULT_ENDPOINT})
+      Token: DEPLOYANGEL_API_TOKEN, else the one `deployangel setup` saved in .deployangel/.
+      Environment: DEPLOYANGEL_URL (default #{Configuration::DEFAULT_ENDPOINT})
 
       Exit codes: 0 verified, 1 failed, 2 inconclusive, 3 still in progress / timed out,
                   4 deployment not found, 5 usage, auth, or network error,
@@ -91,7 +97,8 @@ module DeployAngel
       `until: "initial"`, calling again while it's in progress, or run
       `bundle exec deployangel verify --commit=<sha> --wait --until=initial`.
 
-      - Exit 0 / verified: the release is cleared. Report the clearance line and
+      - Exit 0 / verified: the release is cleared. Report the clearance line, what
+        it says it doesn't cover ("Not assessed", "Not run since the deploy"), and
         anything DeployAngel is still watching, then move on.
       - Exit 6: no problems so far, but NOT cleared. Report "no problems so far, not
         yet cleared" and the expected clearance time. DeployAngel keeps verifying and
@@ -152,6 +159,8 @@ module DeployAngel
       when "check" then check
       when "install" then install
       when "doctor" then doctor
+      when "setup" then setup
+      when "token" then token
       when "mcp" then mcp
       when "version", "--version", "-v" then @stdout.puts(DeployAngel::VERSION) || 0
       when nil, "help", "--help", "-h" then @stdout.puts(HELP) || 0
@@ -353,8 +362,9 @@ module DeployAngel
       def doctor_client
         return @client if @client
 
-        token = [ @env["DEPLOYANGEL_API_TOKEN"], @env["DEPLOYANGEL_TOKEN"] ].find { |value| !value.to_s.empty? } or return
-        Client.new(token: token, endpoint: @env["DEPLOYANGEL_URL"] || Configuration::DEFAULT_ENDPOINT)
+        token = [ @env["DEPLOYANGEL_API_TOKEN"], @env["DEPLOYANGEL_TOKEN"], saved_credentials["api_token"] ]
+          .find { |value| !value.to_s.empty? } or return
+        Client.new(token: token, endpoint: endpoint)
       end
 
       def install
@@ -575,9 +585,63 @@ module DeployAngel
         nil
       end
 
+      # DEPLOYANGEL_API_TOKEN, else the token `deployangel setup` saved here.
       def client
-        @client ||= Client.new(token: @env["DEPLOYANGEL_API_TOKEN"],
-          endpoint: @env["DEPLOYANGEL_URL"] || Configuration::DEFAULT_ENDPOINT)
+        token = @env["DEPLOYANGEL_API_TOKEN"].to_s.empty? ? saved_credentials["api_token"] : @env["DEPLOYANGEL_API_TOKEN"]
+        @client ||= Client.new(token: token, endpoint: endpoint)
+      end
+
+      def endpoint
+        @env["DEPLOYANGEL_URL"].to_s.empty? ? (saved_credentials["endpoint"] || Configuration::DEFAULT_ENDPOINT) : @env["DEPLOYANGEL_URL"]
+      end
+
+      def saved_credentials
+        @saved_credentials ||= Credentials.read(@root)
+      end
+
+      # Redeems a one-time code from "Set up with your coding agent" for the
+      # app's two tokens, and saves them without printing either, so they
+      # stay out of a coding agent's conversation.
+      def setup
+        options = parse(code: nil) { |o, opts| o.on("--code=CODE") { |v| opts[:code] = v } }
+        return usage_error("setup needs --code (from \"Set up with your coding agent\" on the app's page)") if options[:code].to_s.empty?
+
+        redeemer = @client || Client.new(token: nil, endpoint: endpoint, require_token: false)
+        result = redeemer.redeem_setup_code(options[:code].strip)
+        app = result["app"] || {}
+        file = Credentials.write(@root, { "app" => app, "app_token" => result["app_token"], "api_token" => result["api_token"],
+                                          "endpoint" => endpoint })
+        @saved_credentials = nil
+        relative = file.delete_prefix("#{@root}/")
+        @stdout.puts(<<~TEXT)
+          Set up DeployAngel for #{app["name"]} (#{app["environment"]}). Saved its app token and a "CI deploys" token to
+          #{relative}, kept out of git and not shown here. The deployangel command and MCP server here use them.
+
+          Give production the app token without printing it, for example:
+            fly secrets set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
+            heroku config:set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
+          and CI the "CI deploys" token:
+            #{command_name} token api | gh secret set DEPLOYANGEL_API_TOKEN
+        TEXT
+        0
+      end
+
+      # Prints a saved token, for piping into a host's or CI's secrets. Never
+      # run it bare where its output is shown, such as in an agent's chat.
+      def token
+        kind = @argv.shift
+        return usage_error("token needs app or api: deployangel token app") unless %w[app api].include?(kind)
+
+        value = saved_credentials["#{kind}_token"]
+        return usage_error("no token saved here; run deployangel setup --code=<code> first") if value.to_s.empty?
+
+        @stdout.print(value)
+        @stdout.puts if @stdout.tty?
+        0
+      end
+
+      def command_name
+        File.exist?(File.join(@root, "Gemfile")) ? "bundle exec deployangel" : "deployangel"
       end
 
       def usage_error(message)

data/lib/deployangel/client.rb

@@ -22,8 +22,11 @@ module DeployAngel
 
     attr_reader :endpoint
 
-    def initialize(token:, endpoint: Configuration::DEFAULT_ENDPOINT, timeout: 15)
-      raise Unauthorized, "DEPLOYANGEL_API_TOKEN is not set" if token.to_s.empty?
+    # token: nil only for redeeming a setup code, which is its own credential.
+    def initialize(token:, endpoint: Configuration::DEFAULT_ENDPOINT, timeout: 15, require_token: true)
+      if require_token && token.to_s.empty?
+        raise Unauthorized, "DEPLOYANGEL_API_TOKEN is not set, and no token was saved here by `deployangel setup`"
+      end
 
       @token = token
       @endpoint = endpoint.to_s.chomp("/")
@@ -41,6 +44,9 @@ module DeployAngel
       get("/api/v1/deployments/#{deployment_id}/verification", all_findings ? { findings: "all" } : {})
     end
 
+    # The app's token and a "CI deploys" token, for a one-time setup code.
+    def redeem_setup_code(code) = post("/api/v1/setup_codes/redeem", { code: code })
+
     def register_deployment(commit: nil, version: nil, kind: nil, provider: nil, source_url: nil)
       post("/api/v1/deployments", { commit: commit, version: version, kind: kind, provider: provider, source_url: source_url }.compact)
     end
@@ -71,7 +77,7 @@ module DeployAngel
       end
 
       def request(request)
-        request["Authorization"] = "Bearer #{@token}"
+        request["Authorization"] = "Bearer #{@token}" unless @token.to_s.empty?
         request["Accept"] = "application/json"
         request["User-Agent"] = "deployangel-cli/#{DeployAngel::VERSION}"
         uri = request.uri

data/lib/deployangel/credentials.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module DeployAngel
+  # Tokens `deployangel setup` saved for a project, so they never have to be
+  # printed, pasted into a coding agent's chat, or kept in the environment:
+  # .deployangel/credentials.json, readable only by its owner. The directory
+  # carries its own .gitignore, so it stays out of git without touching the
+  # project's.
+  module Credentials
+    DIR = ".deployangel"
+    FILE = "credentials.json"
+
+    module_function
+
+    def path(root)
+      File.join(root, DIR, FILE)
+    end
+
+    # From root or a parent directory, as git finds .git.
+    def find(root)
+      dir = File.expand_path(root)
+      loop do
+        candidate = path(dir)
+        return candidate if File.file?(candidate)
+
+        parent = File.dirname(dir)
+        return nil if parent == dir
+
+        dir = parent
+      end
+    end
+
+    def read(root)
+      file = find(root) or return {}
+      data = JSON.parse(File.read(file))
+      data.is_a?(Hash) ? data : {}
+    rescue JSON::ParserError, SystemCallError
+      {}
+    end
+
+    def write(root, data)
+      dir = File.join(root, DIR)
+      FileUtils.mkdir_p(dir)
+      File.write(File.join(dir, ".gitignore"), "*\n")
+      file = path(root)
+      File.open(file, File::WRONLY | File::CREAT | File::TRUNC, 0o600) { |io| io.write(JSON.pretty_generate(data)) }
+      File.chmod(0o600, file)
+      file
+    end
+  end
+end

data/lib/deployangel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeployAngel
-  VERSION = "0.1.24"
+  VERSION = "0.1.26"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: deployangel
 version: !ruby/object:Gem::Version
-  version: 0.1.24
+  version: 0.1.26
 platform: ruby
 authors:
 - Jordan Owens
@@ -46,6 +46,7 @@ files:
 - lib/deployangel/core/redaction.rb
 - lib/deployangel/core/release.rb
 - lib/deployangel/core/transport.rb
+- lib/deployangel/credentials.rb
 - lib/deployangel/doctor.rb
 - lib/deployangel/exerciser.rb
 - lib/deployangel/fork_hook.rb