deployangel 0.1.26 → 0.1.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66a47a8fb6c86749fb8d29333b9f9f01c7d0c6512dfc7bea7c93fd7191d231a2
-  data.tar.gz: 93c324ea15c7ddc1e361d82c922a9543c9d15e23511206f93586e6fa1c7b9c4c
+  metadata.gz: fde8310f8129827b4b759369146c2346542a776ab13ac91fe7001617e93a7ebb
+  data.tar.gz: 15a216435704ea45fce03e0a1433d615dc28f6c07fdd6e33c90bebed23361779
 SHA512:
-  metadata.gz: 0ba0355966761d97fc73b3c64eab89f448114c23de7192555913c49d97de57e6349de81eb1fb9994a1a850e170313e8cbed39249fe00d8f3045ba88ea6840fe0
-  data.tar.gz: 8d9ca49ffbd98f4feb88e10b94887f171b7bd877e77ff36396ae716defa016ccc29ebc23452475f894f67d149ad3f78421f867ace1644faff8660f7006db2763
+  metadata.gz: e6e7ae24a04e3999af5865e2cf5be14054cdfc92b5644b1a4f5d8bd56c407faf874b122db23508bbcb3b268e461a89d68a16a3a235e166cf457e10e063a4c3f9
+  data.tar.gz: 3e2bb9e11c4d8b35134fdb9088beabcaf0ba5b99b484c9e4b0e2dfc3b710aa544507b55f6a3a222c0446d4b6edbec0f935f0049f03e2039cc19e253767560530

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.28 (2026-10-12)
+
+- Clearer setup for coding agents, from a first-day rehearsal: `setup` says
+  the running app reads its token only from `DEPLOYANGEL_TOKEN` and points to
+  the per-host steps instead of printing Fly and Heroku examples; `install
+  agents` says the saved token is used here once `setup` has run; `doctor`'s
+  fix for an agent that hasn't reported says how to pass a saved app token;
+  and the help says `release` defaults to the current commit and when
+  `--format` defaults to json.
+
+## 0.1.27 (2026-10-12)
+
+- The MCP server's instructions, and the ones `deployangel install agents`
+  writes, tell coding agents that a medium-confidence clearance is a full
+  clearance and to report warnings as "watching closely" with the verdict's
+  new `watching_closely` list, rather than calling a release "suspicious" or
+  its confidence "only medium".
+
 ## 0.1.26 (2026-10-11)
 
 - `deployangel setup --code=CODE` redeems a one-time code from "Set up with

data/lib/deployangel/cli.rb

@@ -49,7 +49,8 @@ module DeployAngel
                    into a host's or CI's secrets
         mcp        Run the MCP server over stdio (for coding agents)
 
-      With no target, verify, plan, and check use the current git HEAD commit.
+      With no target, release, verify, plan, and check use the current git HEAD commit.
+      --format defaults to text in a terminal and json otherwise, such as in a pipe or an agent.
       In GitHub Actions, GitLab CI, CircleCI, and Buildkite, release fills in the
       commit, a build label (e.g. run-123), and a link to the run automatically.
       In a Kamal hook, it registers Kamal's release (KAMAL_VERSION).
@@ -116,13 +117,26 @@ module DeployAngel
         plan's read-only requests and records them on the release. Offer to
         exercise what it skips: routes that change data only with a test account
         or after asking. If the status is "warm_up", nothing run can clear it.
+      - Confidence `medium` clears a release just as `high` does (high also needs 80%
+        coverage and a full baseline), so don't call a medium clearance weak.
+        Warnings (`suspicious: true`) aren't failures: report them as "watching
+        closely:" and the `watching_closely` items, never as "suspicious".
       #{AGENTS_END}
     MARKDOWN
 
+    # After `deployangel setup`, the MCP server and CLI here use its saved token.
+    AGENTS_SAVED_TOKEN_HELP = <<~HELP.chomp
+      Here, the MCP server and CLI use the token `deployangel setup` saved in .deployangel/.
+      Teammates redeem their own setup code, or set DEPLOYANGEL_API_TOKEN to a
+      "CLI & coding agents" token from the app's Settings, for example in an .envrc
+      with direnv. These files hold no token and are meant to be committed.
+      Codex reads .codex/config.toml only in projects you've marked as trusted.
+    HELP
     AGENTS_TOKEN_HELP = <<~HELP.chomp
       The MCP server and CLI need DEPLOYANGEL_API_TOKEN, a "CLI & coding agents" token
       from the app's Settings, in the environment your agent runs in (for example in
-      an .envrc with direnv). Never put it in these files: they're meant to be committed.
+      an .envrc with direnv), or a token saved here by `deployangel setup`.
+      Never put it in these files: they're meant to be committed.
       Codex reads .codex/config.toml only in projects you've marked as trusted.
     HELP
 
@@ -410,7 +424,7 @@ module DeployAngel
           install_codex_mcp(command),
           *install_agent_instructions
         ]
-        @stdout.puts(*lines, "", AGENTS_TOKEN_HELP)
+        @stdout.puts(*lines, "", Credentials.find(@root) ? AGENTS_SAVED_TOKEN_HELP : AGENTS_TOKEN_HELP)
         0
       end
 
@@ -617,11 +631,11 @@ module DeployAngel
           Set up DeployAngel for #{app["name"]} (#{app["environment"]}). Saved its app token and a "CI deploys" token to
           #{relative}, kept out of git and not shown here. The deployangel command and MCP server here use them.
 
-          Give production the app token without printing it, for example:
-            fly secrets set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
-            heroku config:set DEPLOYANGEL_TOKEN=$(#{command_name} token app)
-          and CI the "CI deploys" token:
-            #{command_name} token api | gh secret set DEPLOYANGEL_API_TOKEN
+          The running app reads its token only from DEPLOYANGEL_TOKEN in its environment, so give it the app
+          token without printing it: $(#{command_name} token app) in the command that starts it or sets your
+          host's secrets, or #{command_name} token app | <a command that reads a secret>. The same goes for CI and
+          the "CI deploys" token (#{command_name} token api). Steps for each host:
+          https://www.deployangel.com/setup-for-agents.md
         TEXT
         0
       end

data/lib/deployangel/doctor.rb

@@ -2,6 +2,7 @@
 
 require "time"
 require_relative "configuration"
+require_relative "credentials"
 require_relative "metadata"
 require_relative "rails/metadata"
 require_relative "core/release"
@@ -99,8 +100,20 @@ module DeployAngel
           Check.new(status: :warn, message: "The agent last reported #{time(agent["last_received_at"])}, and nothing since",
             fix: "Check the app is running, and that DEPLOYANGEL_TOKEN is still set on its processes.")
         else
-          Check.new(status: :warn, message: "The agent hasn't reported yet",
-            fix: "Deploy with DEPLOYANGEL_TOKEN set to the app's agent token (Settings, Tokens: \"Deployed application\").")
+          Check.new(status: :warn, message: "The agent hasn't reported yet", fix: token_fix)
+        end
+      end
+
+      # The running app reads its token only from DEPLOYANGEL_TOKEN in its
+      # environment, never from the file `deployangel setup` saves.
+      def token_fix
+        if Credentials.find(@root)
+          command = File.exist?(File.join(@root, "Gemfile")) ? "bundle exec deployangel" : "deployangel"
+          "Start or deploy the app with DEPLOYANGEL_TOKEN in its processes' environment. The app token is saved here, " \
+            "so pass it without printing it: $(#{command} token app) in the start command or your host's secrets command."
+        else
+          "Start or deploy the app with DEPLOYANGEL_TOKEN in its processes' environment, set to its app token " \
+            "(\"Deployed application\" in the app's Settings, under API tokens)."
         end
       end
 

data/lib/deployangel/mcp.rb

@@ -19,6 +19,10 @@ module DeployAngel
         with until "initial" (about 15 minutes) or "verdict". Verdicts: verified means cleared, so you may
         report the release as successful. inconclusive means NOT verified: never report it as success.
         failed means production regressed: read the findings and exceptions and investigate.
+        Confidence medium clears a release just as high does (high also needs 80% coverage and a full
+        baseline): never call a medium clearance weak. suspicious true means warnings DeployAngel is
+        watching closely, not a failure: report them as "watching closely:" and the watching_closely items,
+        never as "suspicious".
         Findings are deterministic evidence; any "investigation" field is AI inference. These tools cannot
         change production. Do not roll back or change production without explicit approval.
         If a release isn't cleared yet, get_exercise_plan says what to exercise against production so it

data/lib/deployangel/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeployAngel
-  VERSION = "0.1.26"
+  VERSION = "0.1.28"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: deployangel
 version: !ruby/object:Gem::Version
-  version: 0.1.26
+  version: 0.1.28
 platform: ruby
 authors:
 - Jordan Owens
@@ -86,7 +86,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.0
+rubygems_version: 3.6.9
 specification_version: 4
 summary: 'DeployAngel agent for Rails: production verification for every deployment.'
 test_files: []