deployangel 0.1.25 → 0.1.27

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05e4cde0e2b605e294d51c73f25af3a2b5d9496c6a8e0b3270c358a9a5b9e4ec
-  data.tar.gz: 722541542ff63d2cb8eedb0020a974a71ecf4eaaff3338e50e1002bc88e7ebbd
+  metadata.gz: 480a4d0a0e8ff4206659a86d40ea0fbfb2c5cc20f55e205aa5a724914add1acf
+  data.tar.gz: bdd81c91faac1642d5f78633ab48bd2efb80e15d6a8b3022d4a0d8e18c967f4f
 SHA512:
-  metadata.gz: c9674f14d5c5f09540e2fe9a102fd1e16571c6492214a47b70a155bb6c70c98af1e333c58734b8eca2079aab323aca6090a47bf8b964111a59e6734dcee316d3
-  data.tar.gz: 71fad66b1e6f4d36b1794e8f403b05524a0b151a2b4232067e39f3f7341c80d6673b28362215bdf2250ef179640124249c397ec366c85556a9eae5f9d87ce10a
+  metadata.gz: e669f7ad136b1328c7f672120dc00b7f5afb20a09a6ca7b27a37c25e26709f678aec6c5fb24dcc1de68c2ffd04a73e1687d2132f09c94ea95cabf72d4731c597
+  data.tar.gz: 88e02d9c250287ac051b233bada6a7469507860aa62cc03390dee8b566770eba38c79431b0e882778b9351a9ca59d03c68b26c8d9cd188c390ee65ad0a4093e8

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.27 (2026-10-12)
+
+- The MCP server's instructions, and the ones `deployangel install agents`
+  writes, tell coding agents that a medium-confidence clearance is a full
+  clearance and to report warnings as "watching closely" with the verdict's
+  new `watching_closely` list, rather than calling a release "suspicious" or
+  its confidence "only medium".
+
+## 0.1.26 (2026-10-11)
+
+- `deployangel setup --code=CODE` redeems a one-time code from "Set up with
+  your coding agent" and saves the app's token and a "CI deploys" token to
+  `.deployangel/credentials.json` (readable only by you, kept out of git),
+  without printing either, so tokens stay out of coding agents' chats. The
+  command and MCP server use the saved token when `DEPLOYANGEL_API_TOKEN`
+  isn't set. `deployangel token app|api` prints a saved token for piping into
+  a host's or CI's secrets.
+
 ## 0.1.25 (2026-10-10)
 
 - `verify` prints what a clearance doesn't cover right under it: app-wide

data/README.md

@@ -430,6 +430,20 @@ with the `verifications:read` scope (plus `deployments` to register deploys or
 report checks). Never use the production telemetry token on a developer
 machine.
 
+To let a coding agent set DeployAngel up, use "Set up with your coding agent"
+on the app's page in DeployAngel: it gives a one-time setup code, not tokens.
+`deployangel setup --code=CODE` redeems it and saves the app's token and a "CI
+deploys" token to `.deployangel/credentials.json`, readable only by you and
+kept out of git, without printing either. The command and MCP server then use
+the saved token whenever `DEPLOYANGEL_API_TOKEN` isn't set. `deployangel token
+app` (or `api`) prints a saved token for piping into a host's or CI's
+secrets, so it never appears on screen or in an agent's conversation:
+
+```bash
+fly secrets set DEPLOYANGEL_TOKEN=$(bundle exec deployangel token app)
+bundle exec deployangel token api | gh secret set DEPLOYANGEL_API_TOKEN
+```
+
 ```bash
 export DEPLOYANGEL_API_TOKEN=da_live_...
 

data/lib/deployangel/cli.rb

@@ -8,6 +8,7 @@ require "optparse"
 require_relative "version"
 require_relative "configuration"
 require_relative "client"
+require_relative "credentials"
 require_relative "ci_environment"
 require_relative "verification_waiter"
 require_relative "cli/formatter"
@@ -19,7 +20,7 @@ module DeployAngel
   # Runs without booting Rails.
   class CLI
     USAGE_ERROR = 5
-    COMMANDS = %w[release verify status plan exercise exception check install doctor mcp version help].freeze
+    COMMANDS = %w[release verify status plan exercise exception check install doctor setup token mcp version help].freeze
 
     HELP = <<~TEXT
       Usage: deployangel <command> [options]
@@ -42,13 +43,18 @@ module DeployAngel
                    or set up coding agents        deployangel install agents
         doctor     Check the setup: this checkout  [--format=text|json]
                    and what DeployAngel has seen
+        setup      Redeem a one-time setup code   deployangel setup --code=CODE
+                   and save the app's tokens here, without printing them
+        token      Print a saved token, to pipe   deployangel token app|api
+                   into a host's or CI's secrets
         mcp        Run the MCP server over stdio (for coding agents)
 
       With no target, verify, plan, and check use the current git HEAD commit.
       In GitHub Actions, GitLab CI, CircleCI, and Buildkite, release fills in the
       commit, a build label (e.g. run-123), and a link to the run automatically.
       In a Kamal hook, it registers Kamal's release (KAMAL_VERSION).
-      Environment: DEPLOYANGEL_API_TOKEN (required), DEPLOYANGEL_URL (default #{Configuration::DEFAULT_ENDPOINT})
+      Token: DEPLOYANGEL_API_TOKEN, else the one `deployangel setup` saved in .deployangel/.
+      Environment: DEPLOYANGEL_URL (default #{Configuration::DEFAULT_ENDPOINT})
 
       Exit codes: 0 verified, 1 failed, 2 inconclusive, 3 still in progress / timed out,
                   4 deployment not found, 5 usage, auth, or network error,
@@ -110,6 +116,10 @@ module DeployAngel
         plan's read-only requests and records them on the release. Offer to
         exercise what it skips: routes that change data only with a test account
         or after asking. If the status is "warm_up", nothing run can clear it.
+      - Confidence `medium` clears a release just as `high` does (high also needs 80%
+        coverage and a full baseline), so don't call a medium clearance weak.
+        Warnings (`suspicious: true`) aren't failures: report them as "watching
+        closely:" and the `watching_closely` items, never as "suspicious".
       #{AGENTS_END}
     MARKDOWN
 
@@ -153,6 +163,8 @@ module DeployAngel
       when "check" then check
       when "install" then install
       when "doctor" then doctor
+      when "setup" then setup
+      when "token" then token
       when "mcp" then mcp
       when "version", "--version", "-v" then @stdout.puts(DeployAngel::VERSION) || 0
       when nil, "help", "--help", "-h" then @stdout.puts(HELP) || 0
@@ -354,8 +366,9 @@ module DeployAngel
       def doctor_client
         return @client if @client
 
-        token = [ @env["DEPLOYANGEL_API_TOKEN"], @env["DEPLOYANGEL_TOKEN"] ].find { |value| !value.to_s.empty? } or return
-        Client.new(token: token, endpoint: @env["DEPLOYANGEL_URL"] || Configuration::DEFAULT_ENDPOINT)
+        token = [ @env["DEPLOYANGEL_API_TOKEN"], @env["DEPLOYANGEL_TOKEN"], saved_credentials["api_token"] ]
+          .find { |value| !value.to_s.empty? } or return
+        Client.new(token: token, endpoint: endpoint)
       end
 
       def install
@@ -576,9 +589,63 @@ module DeployAngel
         nil
       end
 
+      # DEPLOYANGEL_API_TOKEN, else the token `deployangel setup` saved here.
       def client
-        @client ||= Client.new(token: @env["DEPLOYANGEL_API_TOKEN"],
-          endpoint: @env["DEPLOYANGEL_URL"] || Configuration::DEFAULT_ENDPOINT)
+        token = @env["DEPLOYANGEL_API_TOKEN"].to_s.empty? ? saved_credentials["api_token"] : @env["DEPLOYANGEL_API_TOKEN"]
+        @client ||= Client.new(token: token, endpoint: endpoint)
+      end
+
+      def endpoint
+        @env["DEPLOYANGEL_URL"].to_s.empty? ? (saved_credentials["endpoint"] || Configuration::DEFAULT_ENDPOINT) : @env["DEPLOYANGEL_URL"]
+      end
+
+      def saved_credentials
+        @saved_credentials ||= Credentials.read(@root)
+      end
+
+      # Redeems a one-time code from "Set up with your coding agent" for the
+      # app's two tokens, and saves them without printing either, so they
+      # stay out of a coding agent's conversation.
+      def setup
+        options = parse(code: nil) { |o, opts| o.on("--code=CODE") { |v| opts[:code] = v } }
+        return usage_error("setup needs --code (from \"Set up with your coding agent\" on the app's page)") if options[:code].to_s.empty?
+
+        redeemer = @client || Client.new(token: nil, endpoint: endpoint, require_token: false)
+        result = redeemer.redeem_setup_code(options[:code].strip)
+        app = result["app"] || {}
+        file = Credentials.write(@root, { "app" => app, "app_token" => result["app_token"], "api_token" => result["api_token"],
+                                          "endpoint" => endpoint })
+        @saved_credentials = nil
+        relative = file.delete_prefix("#{@root}/")
+        @stdout.puts(<<~TEXT)
+          Set up DeployAngel for #{app["name"]} (#{app["environment"]}). Saved its app token and a "CI deploys" token to
+          #{relative}, kept out of git and not shown here. The deployangel command and MCP server here use them.
+
+          Give production the app token without printing it, for example:
+            fly secrets set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
+            heroku config:set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
+          and CI the "CI deploys" token:
+            #{command_name} token api | gh secret set DEPLOYANGEL_API_TOKEN
+        TEXT
+        0
+      end
+
+      # Prints a saved token, for piping into a host's or CI's secrets. Never
+      # run it bare where its output is shown, such as in an agent's chat.
+      def token
+        kind = @argv.shift
+        return usage_error("token needs app or api: deployangel token app") unless %w[app api].include?(kind)
+
+        value = saved_credentials["#{kind}_token"]
+        return usage_error("no token saved here; run deployangel setup --code=<code> first") if value.to_s.empty?
+
+        @stdout.print(value)
+        @stdout.puts if @stdout.tty?
+        0
+      end
+
+      def command_name
+        File.exist?(File.join(@root, "Gemfile")) ? "bundle exec deployangel" : "deployangel"
       end
 
       def usage_error(message)

data/lib/deployangel/client.rb

@@ -22,8 +22,11 @@ module DeployAngel
 
     attr_reader :endpoint
 
-    def initialize(token:, endpoint: Configuration::DEFAULT_ENDPOINT, timeout: 15)
-      raise Unauthorized, "DEPLOYANGEL_API_TOKEN is not set" if token.to_s.empty?
+    # token: nil only for redeeming a setup code, which is its own credential.
+    def initialize(token:, endpoint: Configuration::DEFAULT_ENDPOINT, timeout: 15, require_token: true)
+      if require_token && token.to_s.empty?
+        raise Unauthorized, "DEPLOYANGEL_API_TOKEN is not set, and no token was saved here by `deployangel setup`"
+      end
 
       @token = token
       @endpoint = endpoint.to_s.chomp("/")
@@ -41,6 +44,9 @@ module DeployAngel
       get("/api/v1/deployments/#{deployment_id}/verification", all_findings ? { findings: "all" } : {})
     end
 
+    # The app's token and a "CI deploys" token, for a one-time setup code.
+    def redeem_setup_code(code) = post("/api/v1/setup_codes/redeem", { code: code })
+
     def register_deployment(commit: nil, version: nil, kind: nil, provider: nil, source_url: nil)
       post("/api/v1/deployments", { commit: commit, version: version, kind: kind, provider: provider, source_url: source_url }.compact)
     end
@@ -71,7 +77,7 @@ module DeployAngel
       end
 
       def request(request)
-        request["Authorization"] = "Bearer #{@token}"
+        request["Authorization"] = "Bearer #{@token}" unless @token.to_s.empty?
         request["Accept"] = "application/json"
         request["User-Agent"] = "deployangel-cli/#{DeployAngel::VERSION}"
         uri = request.uri

data/lib/deployangel/credentials.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+
+module DeployAngel
+  # Tokens `deployangel setup` saved for a project, so they never have to be
+  # printed, pasted into a coding agent's chat, or kept in the environment:
+  # .deployangel/credentials.json, readable only by its owner. The directory
+  # carries its own .gitignore, so it stays out of git without touching the
+  # project's.
+  module Credentials
+    DIR = ".deployangel"
+    FILE = "credentials.json"
+
+    module_function
+
+    def path(root)
+      File.join(root, DIR, FILE)
+    end
+
+    # From root or a parent directory, as git finds .git.
+    def find(root)
+      dir = File.expand_path(root)
+      loop do
+        candidate = path(dir)
+        return candidate if File.file?(candidate)
+
+        parent = File.dirname(dir)
+        return nil if parent == dir
+
+        dir = parent
+      end
+    end
+
+    def read(root)
+      file = find(root) or return {}
+      data = JSON.parse(File.read(file))
+      data.is_a?(Hash) ? data : {}
+    rescue JSON::ParserError, SystemCallError
+      {}
+    end
+
+    def write(root, data)
+      dir = File.join(root, DIR)
+      FileUtils.mkdir_p(dir)
+      File.write(File.join(dir, ".gitignore"), "*\n")
+      file = path(root)
+      File.open(file, File::WRONLY | File::CREAT | File::TRUNC, 0o600) { |io| io.write(JSON.pretty_generate(data)) }
+      File.chmod(0o600, file)
+      file
+    end
+  end
+end

data/lib/deployangel/mcp.rb

@@ -19,6 +19,10 @@ module DeployAngel
         with until "initial" (about 15 minutes) or "verdict". Verdicts: verified means cleared, so you may
         report the release as successful. inconclusive means NOT verified: never report it as success.
         failed means production regressed: read the findings and exceptions and investigate.
+        Confidence medium clears a release just as high does (high also needs 80% coverage and a full
+        baseline): never call a medium clearance weak. suspicious true means warnings DeployAngel is
+        watching closely, not a failure: report them as "watching closely:" and the watching_closely items,
+        never as "suspicious".
         Findings are deterministic evidence; any "investigation" field is AI inference. These tools cannot
         change production. Do not roll back or change production without explicit approval.
         If a release isn't cleared yet, get_exercise_plan says what to exercise against production so it

data/lib/deployangel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeployAngel
-  VERSION = "0.1.25"
+  VERSION = "0.1.27"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: deployangel
 version: !ruby/object:Gem::Version
-  version: 0.1.25
+  version: 0.1.27
 platform: ruby
 authors:
 - Jordan Owens
@@ -46,6 +46,7 @@ files:
 - lib/deployangel/core/redaction.rb
 - lib/deployangel/core/release.rb
 - lib/deployangel/core/transport.rb
+- lib/deployangel/credentials.rb
 - lib/deployangel/doctor.rb
 - lib/deployangel/exerciser.rb
 - lib/deployangel/fork_hook.rb