A trusted deployment boundary
Deployment credentials are not given to the agent. A separate trusted service owns the Telegram CLI token and executes push, migrate and webhook sync.
The agent produces a deployment request with the project and the intended operation. The service performs the upload, applies the revision checks and returns a structured result - success, a rejected revision, or a failure with logs.
This keeps one dangerous capability behind one boundary. The agent can reason about deployment state without ever holding the credential that changes it.
No credentials in context
The CLI token stays with the deployment service.
Centralized deploys
Push, migrate and webhook sync run through one adapter.
Structured results
The agent receives outcomes and logs, not raw shell access.
Explore more
Describe your next change.
The agent plans, writes, validates, and deploys it to Telegram.