wayscloud-cli 0.4.0__tar.gz → 0.5.0__tar.gz

wayscloud_cli-0.5.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 WAYSCloud AS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: wayscloud-cli
-Version: 0.4.0
-Summary: Command-line interface for WAYSCloud — manage VPS, DNS, databases, storage, apps, IoT, and more
+Version: 0.5.0
+Summary: Command-line interface for WAYSCloud — manage VPS, DNS, databases, storage, apps, Kubernetes, IoT, and more
 License: MIT
 Project-URL: Homepage, https://wayscloud.services
 Project-URL: Documentation, https://docs.wayscloud.services/integrations/#wayscloud-cli
@@ -19,10 +19,12 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
-Requires-Dist: wayscloud>=0.3.0
+License-File: LICENSE
+Requires-Dist: wayscloud>=0.4.0
 Requires-Dist: typer>=0.9
 Requires-Dist: rich>=13.0
 Requires-Dist: websockets>=12.0
+Dynamic: license-file
 
 # WAYSCloud CLI
 
@@ -34,6 +36,8 @@ Command-line interface for [WAYSCloud](https://wayscloud.services). Built on the
 pip install wayscloud-cli
 ```
 
+Version 0.5.0 adds Managed Kubernetes (`cloud k8s …`) and requires SDK `wayscloud>=0.4.0`.
+
 ## Authentication
 
 ```bash
@@ -94,7 +98,8 @@ cloud redis plans
 cloud storage buckets
 cloud storage buckets-create my-bucket
 cloud storage buckets-delete my-bucket --confirm
-cloud storage credentials
+cloud storage keys my-bucket
+cloud storage keys-create my-bucket --name ci
 ```
 
 ### Apps
@@ -108,6 +113,30 @@ cloud app stop <id>
 cloud app delete <id> --confirm
 ```
 
+### Kubernetes
+
+```bash
+cloud k8s plans --kind node
+cloud k8s list
+cloud k8s create shop --pool k8s-node-2c4g:2 --plan k8s-cluster-dev --region no --wait
+cloud k8s info <cluster-id>
+cloud k8s kubeconfig <cluster-id> -o ~/.kube/shop.yaml   # written with mode 0600
+cloud k8s scale <cluster-id> default 4
+cloud k8s add-pool <cluster-id> batch --plan k8s-node-4c16g --count 2 \
+  --label role=worker --taint dedicated=gpu:NoSchedule --ssh-key-id <key-id>
+cloud k8s delete-pool <cluster-id> batch
+cloud k8s api-access <cluster-id> --cidr 203.0.113.0/24
+cloud k8s ip-allocate <cluster-id>
+cloud k8s ip-release <cluster-id> <address>
+cloud k8s ptr <cluster-id> <address> mail.example.com
+cloud k8s backups <cluster-id>
+cloud k8s backup <cluster-id>
+cloud k8s restore <cluster-id> <backup-id> -n shop
+cloud k8s upgrade <cluster-id>            # list available versions
+cloud k8s upgrade <cluster-id> 1.34       # upgrade to a version
+cloud k8s delete <cluster-id> --confirm-name shop --wait
+```
+
 ### IoT
 
 ```bash
@@ -119,6 +148,15 @@ cloud iot groups
 cloud iot groups-create --name "Floor 2"
 ```
 
+### Impact
+
+```bash
+cloud impact forest create "My forest"
+cloud impact forest status --visualize emoji
+cloud impact tree grow --count 10 --idempotency-key <key>
+cloud impact commitments list
+```
+
 ### Shell
 
 ```bash
@@ -138,7 +176,7 @@ cloud vps list --json
 ## Requirements
 
 - Python 3.9+
-- wayscloud (SDK)
+- [wayscloud](https://pypi.org/project/wayscloud/) SDK `>=0.4.0` (installed automatically; the Kubernetes commands need a release that exposes `client.kubernetes`)
 
 ## Documentation
 

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/README.md

@@ -8,6 +8,8 @@ Command-line interface for [WAYSCloud](https://wayscloud.services). Built on the
 pip install wayscloud-cli
 ```
 
+Version 0.5.0 adds Managed Kubernetes (`cloud k8s …`) and requires SDK `wayscloud>=0.4.0`.
+
 ## Authentication
 
 ```bash
@@ -68,7 +70,8 @@ cloud redis plans
 cloud storage buckets
 cloud storage buckets-create my-bucket
 cloud storage buckets-delete my-bucket --confirm
-cloud storage credentials
+cloud storage keys my-bucket
+cloud storage keys-create my-bucket --name ci
 ```
 
 ### Apps
@@ -82,6 +85,30 @@ cloud app stop <id>
 cloud app delete <id> --confirm
 ```
 
+### Kubernetes
+
+```bash
+cloud k8s plans --kind node
+cloud k8s list
+cloud k8s create shop --pool k8s-node-2c4g:2 --plan k8s-cluster-dev --region no --wait
+cloud k8s info <cluster-id>
+cloud k8s kubeconfig <cluster-id> -o ~/.kube/shop.yaml   # written with mode 0600
+cloud k8s scale <cluster-id> default 4
+cloud k8s add-pool <cluster-id> batch --plan k8s-node-4c16g --count 2 \
+  --label role=worker --taint dedicated=gpu:NoSchedule --ssh-key-id <key-id>
+cloud k8s delete-pool <cluster-id> batch
+cloud k8s api-access <cluster-id> --cidr 203.0.113.0/24
+cloud k8s ip-allocate <cluster-id>
+cloud k8s ip-release <cluster-id> <address>
+cloud k8s ptr <cluster-id> <address> mail.example.com
+cloud k8s backups <cluster-id>
+cloud k8s backup <cluster-id>
+cloud k8s restore <cluster-id> <backup-id> -n shop
+cloud k8s upgrade <cluster-id>            # list available versions
+cloud k8s upgrade <cluster-id> 1.34       # upgrade to a version
+cloud k8s delete <cluster-id> --confirm-name shop --wait
+```
+
 ### IoT
 
 ```bash
@@ -93,6 +120,15 @@ cloud iot groups
 cloud iot groups-create --name "Floor 2"
 ```
 
+### Impact
+
+```bash
+cloud impact forest create "My forest"
+cloud impact forest status --visualize emoji
+cloud impact tree grow --count 10 --idempotency-key <key>
+cloud impact commitments list
+```
+
 ### Shell
 
 ```bash
@@ -112,7 +148,7 @@ cloud vps list --json
 ## Requirements
 
 - Python 3.9+
-- wayscloud (SDK)
+- [wayscloud](https://pypi.org/project/wayscloud/) SDK `>=0.4.0` (installed automatically; the Kubernetes commands need a release that exposes `client.kubernetes`)
 
 ## Documentation
 

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wayscloud-cli"
-version = "0.4.0"
-description = "Command-line interface for WAYSCloud — manage VPS, DNS, databases, storage, apps, IoT, and more"
+version = "0.5.0"
+description = "Command-line interface for WAYSCloud — manage VPS, DNS, databases, storage, apps, Kubernetes, IoT, and more"
 readme = "README.md"
 requires-python = ">=3.9"
 license = {text = "MIT"}
@@ -22,7 +22,7 @@ classifiers = [
     "Operating System :: OS Independent",
 ]
 dependencies = [
-    "wayscloud>=0.3.0",
+    "wayscloud>=0.4.0",
     "typer>=0.9",
     "rich>=13.0",
     "websockets>=12.0",

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = wayscloud-cli
-version = 0.4.0
+version = 0.5.0
 
 [options]
 packages = find:

wayscloud_cli-0.5.0/tests/test_k8s_cli.py

@@ -0,0 +1,101 @@
+"""k8s command tests -- option parsing, payloads and file handling."""
+
+import os
+import stat
+
+from typer.testing import CliRunner
+
+from wayscloud_cli.__main__ import app
+from wayscloud_cli.commands import k8s as k8s_cmd
+
+runner = CliRunner()
+
+
+class FakeKubernetes:
+    def __init__(self):
+        self.calls = []
+
+    def add_node_pool(self, *args, **kwargs):
+        self.calls.append((args, kwargs))
+        return {"id": "c1"}
+
+    def kubeconfig(self, cluster_id):
+        return "apiVersion: v1\nkind: Config\n"
+
+
+class FakeClient:
+    def __init__(self, kubernetes):
+        self.kubernetes = kubernetes
+
+
+def patch_client(monkeypatch, kubernetes):
+    monkeypatch.setattr(k8s_cmd, "get_client", lambda token=None: FakeClient(kubernetes))
+
+
+def test_parse_labels_and_taints():
+    assert k8s_cmd._parse_labels([]) == {}
+    assert k8s_cmd._parse_labels(["role=worker", "zone=a=b"]) == {"role": "worker", "zone": "a=b"}
+    assert k8s_cmd._parse_taints([]) == []
+    assert k8s_cmd._parse_taints(["dedicated=gpu:NoSchedule", "spot=:PreferNoSchedule"]) == [
+        {"key": "dedicated", "value": "gpu", "effect": "NoSchedule"},
+        {"key": "spot", "value": "", "effect": "PreferNoSchedule"},
+    ]
+
+
+def test_add_pool_passes_labels_taints_and_ssh_keys(monkeypatch):
+    kube = FakeKubernetes()
+    patch_client(monkeypatch, kube)
+
+    result = runner.invoke(app, [
+        "k8s", "add-pool", "c1", "workers", "--plan", "k8s-node-2c4g", "--count", "3",
+        "--label", "role=worker", "--label", "tier=compute",
+        "--taint", "dedicated=gpu:NoExecute",
+        "--ssh-key-id", "11111111-1111-1111-1111-111111111111",
+    ])
+
+    assert result.exit_code == 0, result.output
+    (args, kwargs), = kube.calls
+    assert args == ("c1", "workers", "k8s-node-2c4g", 3)
+    assert kwargs["labels"] == {"role": "worker", "tier": "compute"}
+    assert kwargs["taints"] == [{"key": "dedicated", "value": "gpu", "effect": "NoExecute"}]
+    assert kwargs["ssh_key_ids"] == ["11111111-1111-1111-1111-111111111111"]
+
+
+def test_add_pool_defaults_to_no_labels_taints_or_keys(monkeypatch):
+    kube = FakeKubernetes()
+    patch_client(monkeypatch, kube)
+
+    result = runner.invoke(app, ["k8s", "add-pool", "c1", "workers", "--plan", "k8s-node-2c4g"])
+
+    assert result.exit_code == 0, result.output
+    (args, kwargs), = kube.calls
+    assert args == ("c1", "workers", "k8s-node-2c4g", 1)
+    assert kwargs == {"labels": {}, "taints": [], "ssh_key_ids": []}
+
+
+def test_add_pool_rejects_malformed_label_and_taint(monkeypatch):
+    patch_client(monkeypatch, FakeKubernetes())
+
+    for value in ("novalue", "=noKey"):
+        result = runner.invoke(app, ["k8s", "add-pool", "c1", "workers", "--plan", "k8s-node-2c4g", "--label", value])
+        assert result.exit_code != 0
+        assert "key=value" in result.output
+
+    for value in ("novalue", "key:NoSchedule", "key=value:Sometimes"):
+        result = runner.invoke(app, ["k8s", "add-pool", "c1", "workers", "--plan", "k8s-node-2c4g", "--taint", value])
+        assert result.exit_code != 0
+        assert "key=value:Effect" in result.output or "taint effect" in result.output
+
+
+def test_kubeconfig_output_file_is_0600_for_new_and_existing_files(monkeypatch, tmp_path):
+    patch_client(monkeypatch, FakeKubernetes())
+
+    existing = tmp_path / "kubeconfig-existing.yaml"
+    existing.write_text("stale-content")
+    os.chmod(existing, 0o644)
+
+    for target in (existing, tmp_path / "kubeconfig-new.yaml"):
+        result = runner.invoke(app, ["k8s", "kubeconfig", "c1", "-o", str(target)])
+        assert result.exit_code == 0, result.output
+        assert stat.S_IMODE(target.stat().st_mode) == 0o600
+        assert target.read_text() == "apiVersion: v1\nkind: Config\n"

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/tests/test_smoke.py

@@ -30,7 +30,7 @@ def test_version_flag():
 
 # ── Command groups registered ───────────────────────────────────
 
-EXPECTED_GROUPS = ["auth", "vps", "dns", "storage", "db", "redis", "app", "iot", "shell"]
+EXPECTED_GROUPS = ["auth", "vps", "dns", "storage", "db", "redis", "app", "iot", "shell", "impact"]
 
 
 def test_all_command_groups_registered():
@@ -144,3 +144,56 @@ def test_iot_devices_create_has_required_flags():
     assert result.exit_code == 0
     assert "--device-id" in result.output
     assert "--name" in result.output
+
+
+# ── Impact commands ─────────────────────────────────────────────
+
+def test_impact_subgroups_registered():
+    """cloud impact has forest / tree / commitments subgroups."""
+    result = runner.invoke(app, ["impact", "--help"])
+    assert result.exit_code == 0
+    for sub in ("forest", "tree", "commitments"):
+        assert sub in result.output, f"Missing impact subgroup: {sub}"
+
+
+def test_impact_tree_grow_has_count_flag():
+    result = runner.invoke(app, ["impact", "tree", "grow", "--help"])
+    assert result.exit_code == 0
+    assert "--count" in result.output
+    assert "--idempotency-key" in result.output
+
+
+def test_impact_forest_create_help():
+    result = runner.invoke(app, ["impact", "forest", "create", "--help"])
+    assert result.exit_code == 0
+    # Argument should be the forest name; --token override always accepted.
+    assert "--token" in result.output
+
+
+def test_impact_forest_status_has_visualize():
+    result = runner.invoke(app, ["impact", "forest", "status", "--help"])
+    assert result.exit_code == 0
+    assert "--visualize" in result.output
+
+
+def test_impact_forbidden_strings_not_in_help():
+    """Anti-greenwashing wording lock: these strings must NEVER appear
+    anywhere in the impact CLI surface, not even in help text."""
+    forbidden = ["carbon neutral", "offset", "net zero", "Carbon Neutral", "Net Zero"]
+    for sub_path in (
+        ["impact", "--help"],
+        ["impact", "forest", "--help"],
+        ["impact", "tree", "--help"],
+        ["impact", "tree", "grow", "--help"],
+        ["impact", "tree", "inspect", "--help"],
+        ["impact", "tree", "water", "--help"],
+        ["impact", "commitments", "--help"],
+        ["impact", "forest", "status", "--help"],
+        ["impact", "forest", "feed", "--help"],
+    ):
+        result = runner.invoke(app, sub_path)
+        assert result.exit_code == 0, f"help failed for {sub_path}"
+        for s in forbidden:
+            assert s not in result.output, (
+                f"Forbidden string {s!r} appeared in help for {sub_path}"
+            )

wayscloud_cli-0.5.0/wayscloud_cli/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/wayscloud_cli/__main__.py

@@ -18,8 +18,10 @@ from .commands.dns import app as dns_app
 from .commands.storage import app as storage_app
 from .commands.db import app as db_app
 from .commands.redis import app as redis_app
+from .commands.k8s import app as k8s_app
 from .commands.app import app as app_platform_app
 from .commands.iot import app as iot_app
+from .commands.impact import app as impact_app
 
 app = typer.Typer(
     name="cloud",
@@ -57,9 +59,11 @@ app.add_typer(dns_app, name="dns", help="DNS zones and records")
 app.add_typer(storage_app, name="storage", help="Object storage (S3)")
 app.add_typer(db_app, name="db", help="Managed databases")
 app.add_typer(redis_app, name="redis", help="Managed Redis")
+app.add_typer(k8s_app, name="k8s", help="Managed Kubernetes")
 app.add_typer(app_platform_app, name="app", help="App platform")
 app.add_typer(iot_app, name="iot", help="IoT platform")
 app.add_typer(shell_app, name="shell", help="CloudShell")
+app.add_typer(impact_app, name="impact", help="Impact: forests, trees, contributions")
 
 # Top-level shortcuts for login/logout/whoami
 app.command("login")(login)

{wayscloud_cli-0.4.0 → wayscloud_cli-0.5.0}/wayscloud_cli/commands/app.py

@@ -17,7 +17,7 @@ app.add_typer(env_app, name="env")
 
 @env_app.command("list")
 def env_list(
-    app_id: str = typer.Argument(..., help="App ID or name"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
     """List environment variable keys for an app."""
@@ -39,7 +39,7 @@ def env_list(
 
 @env_app.command("set")
 def env_set(
-    app_id: str = typer.Argument(..., help="App ID or name"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     pairs: List[str] = typer.Argument(..., help="KEY=value pairs"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
@@ -59,7 +59,7 @@ def env_set(
 
 @env_app.command("unset")
 def env_unset(
-    app_id: str = typer.Argument(..., help="App ID or name"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     keys: List[str] = typer.Argument(..., help="Variable names to remove"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
@@ -92,14 +92,16 @@ def list_apps(
         print("No apps found.")
         return
 
-    rows = [{"id": str(a.get("id", ""))[:14], "name": a.get("name", ""),
+    rows = [{"id": str(a.get("id", "")), "short_id": a.get("short_id", ""),
+             "name": a.get("name", ""),
              "status": a.get("status", ""), "plan": a.get("plan", a.get("plan_code", "")),
              "url": a.get("default_url", ""), "created_at": a.get("created_at", "")}
             for a in apps_list]
 
     print_table(rows, [
-        ("id", "ID", 14), ("name", "Name", 20), ("status", "Status", 10),
-        ("plan", "Plan", 16), ("url", "URL", 30), ("created_at", "Created", 20),
+        ("id", "ID", 30), ("short_id", "Short", 10), ("name", "Name", 20),
+        ("status", "Status", 10), ("plan", "Plan", 16),
+        ("url", "URL", 30), ("created_at", "Created", 20),
     ])
 
 
@@ -124,7 +126,7 @@ def create_app(
 
 @app.command("info")
 def info_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
     """Show app details."""
@@ -139,7 +141,7 @@ def info_app(
 
 @app.command("delete")
 def delete_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
     confirm: bool = typer.Option(False, "--confirm", help="Skip confirmation"),
 ):
@@ -159,7 +161,7 @@ def delete_app(
 
 @app.command("deploy")
 def deploy_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     image: str = typer.Option(..., "--image", help="Container image URI"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
@@ -174,7 +176,7 @@ def deploy_app(
 
 @app.command("start")
 def start_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
     """Start an app."""
@@ -188,7 +190,7 @@ def start_app(
 
 @app.command("stop")
 def stop_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
     """Stop an app."""
@@ -202,7 +204,7 @@ def stop_app(
 
 @app.command("restart")
 def restart_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
     """Restart an app."""
@@ -216,7 +218,7 @@ def restart_app(
 
 @app.command("logs")
 def logs_app(
-    app_id: str = typer.Argument(..., help="App ID"),
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
     lines: int = typer.Option(100, "--lines", "-n", help="Number of lines"),
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),
 ):
@@ -272,6 +274,151 @@ def list_plans(
     ])
 
 
+# ── GitHub auto-deploy sub-group ────────────────────────────────
+auto_deploy_app = typer.Typer(help="GitHub auto-deploy")
+app.add_typer(auto_deploy_app, name="auto-deploy")
+
+
+def _print_secret_once(secret: str, webhook_url: str) -> None:
+    """Format the one-time secret reveal for terminal output."""
+    print()
+    print("=" * 72)
+    print("  This is the only time this secret is shown. Copy it now.")
+    print("=" * 72)
+    print(f"  Webhook URL:  {webhook_url}")
+    print(f"  Secret:       {secret}")
+    print( "  Content type: application/json")
+    print( "  Events:       Just the push event")
+    print("=" * 72)
+    print()
+
+
+@auto_deploy_app.command("status")
+def auto_deploy_status(
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
+    token: Optional[str] = typer.Option(None, "--token", help="Override token"),
+):
+    """Show GitHub auto-deploy configuration for an app."""
+    c = get_client(token)
+    data = sdk_call(c.apps.auto_deploy_get, app_id)
+
+    if is_json_mode():
+        print_json(data)
+        return
+
+    if not data.get("configured"):
+        print("Auto-deploy: not configured.")
+        print(f"Webhook URL: {data.get('webhook_url', '')}")
+        return
+
+    print_object(data, [
+        ("provider", "Provider"),
+        ("repo_url", "Repository"),
+        ("branch", "Branch"),
+        ("auto_deploy_enabled", "Enabled"),
+        ("secret_configured", "Per-app secret"),
+        ("credential_linked", "Credential linked"),
+        ("webhook_url", "Webhook URL"),
+        ("last_push_event_at", "Last push"),
+        ("last_auto_deploy_at", "Last deploy"),
+        ("last_auto_deploy_commit", "Last commit"),
+    ])
+    if not data.get("secret_configured"):
+        print()
+        print("  [!] This app is using the legacy shared webhook secret.")
+        print("      Run `cloud app auto-deploy rotate-secret <app>` to")
+        print("      get a per-app secret only GitHub and this app know.")
+
+
+@auto_deploy_app.command("enable")
+def auto_deploy_enable(
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
+    repo_url: str = typer.Option(..., "--repo", help="GitHub repository URL"),
+    branch: str = typer.Option("main", "--branch", help="Branch to auto-deploy"),
+    token: Optional[str] = typer.Option(None, "--token", help="Override token"),
+):
+    """Enable GitHub auto-deploy for an app.
+
+    First invocation generates a per-app webhook secret and prints it
+    once. Re-invoking with new repo/branch keeps the existing secret.
+    """
+    c = get_client(token)
+    data = sdk_call(
+        c.apps.auto_deploy_configure,
+        app_id, repo_url, branch=branch, auto_deploy_enabled=True,
+    )
+
+    if is_json_mode():
+        print_json(data)
+        return
+
+    print(f"Auto-deploy enabled: {data.get('repo_url')}:{data.get('branch')}")
+    secret = data.get("webhook_secret")
+    if secret:
+        _print_secret_once(secret, data.get("webhook_url", ""))
+    else:
+        print("Per-app webhook secret already configured — reusing existing.")
+
+
+@auto_deploy_app.command("disable")
+def auto_deploy_disable(
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
+    token: Optional[str] = typer.Option(None, "--token", help="Override token"),
+):
+    """Pause auto-deploy without clearing the repo configuration.
+
+    Webhook secret is kept so re-enabling does not require updating
+    GitHub. To delete the config entirely, use `cloud app auto-deploy
+    remove` (not yet implemented — reconfigure with a new repo_url
+    instead).
+    """
+    c = get_client(token)
+    # Re-PUT with auto_deploy_enabled=false; backend preserves secret.
+    current = sdk_call(c.apps.auto_deploy_get, app_id)
+    if not current.get("configured"):
+        print("Auto-deploy is not configured for this app.")
+        raise typer.Exit(code=1)
+    data = sdk_call(
+        c.apps.auto_deploy_configure,
+        app_id,
+        repo_url=current["repo_url"],
+        branch=current["branch"],
+        auto_deploy_enabled=False,
+    )
+    if is_json_mode():
+        print_json(data)
+    else:
+        print(f"Auto-deploy paused for {app_id}.")
+
+
+@auto_deploy_app.command("rotate-secret")
+def auto_deploy_rotate(
+    app_id: str = typer.Argument(..., help="App ID, short ID, or name"),
+    token: Optional[str] = typer.Option(None, "--token", help="Override token"),
+    confirm: bool = typer.Option(False, "--confirm",
+                                 help="Skip interactive confirmation"),
+):
+    """Generate a new webhook secret. The previous one stops working."""
+    if not confirm:
+        print("This rotates the webhook secret immediately. Pushes from")
+        print("GitHub will fail until you update the secret in the repo")
+        print("webhook settings. Re-run with --confirm to proceed.")
+        raise typer.Exit(code=1)
+
+    c = get_client(token)
+    data = sdk_call(c.apps.auto_deploy_rotate_secret, app_id)
+
+    if is_json_mode():
+        print_json(data)
+        return
+
+    secret = data.get("webhook_secret")
+    if not secret:
+        print("Error: response did not include a new secret.", err=True)
+        raise typer.Exit(code=1)
+    _print_secret_once(secret, data.get("webhook_url", ""))
+
+
 @app.command("regions")
 def list_regions(
     token: Optional[str] = typer.Option(None, "--token", help="Override token"),