diff --git a/advanced/cancel-previous.md b/advanced/cancel-previous.md index 0fe5847..ebd77b5 100644 --- a/advanced/cancel-previous.md +++ b/advanced/cancel-previous.md @@ -5,7 +5,6 @@ nobody is waiting on their verdict, but they still sit in the queue and still cost you. `--cancel-previous` cancels them when the newer run is submitted. It is opt-in and off by default. Without it, nothing about your runs changes. -Requires DeviceCloud CLI 5.6.0 or later. ## What it does diff --git a/advanced/visual-testing.md b/advanced/visual-testing.md index c450c3d..b64a17f 100644 --- a/advanced/visual-testing.md +++ b/advanced/visual-testing.md @@ -9,8 +9,6 @@ Maestro's `assertScreenshot` command compares the current screen against a refer DeviceCloud runs these assertions like any other command. The one thing you need to set up is getting your baseline images onto the device. ::: warning -**Requires DeviceCloud CLI 5.6.0 or later**, the first version that uploads your baselines. - **Use Maestro 2.10.0**, the default version. Maestro 2.2.0 resolves the baseline path against a different working directory and reports `Screenshot file not found` no matter where you put the file, so don't pin `--maestro-version` to it — see [Maestro Versions](../configuration/maestro-versions.md). ::: diff --git a/cli/dcd-cloud.md b/cli/dcd-cloud.md index dcbf2a7..b9062d6 100644 --- a/cli/dcd-cloud.md +++ b/cli/dcd-cloud.md @@ -34,7 +34,7 @@ See [Authentication](../getting-started/api-keys.md) for the full picture. | `--app-url ` | Signed URL to an Expo iOS build (`.tar.gz`). The archive is downloaded and extracted automatically. Expo signed URLs expire after ~1 hour. Mutually exclusive with `--app-file` | | `--app-file ` | Path to the app binary (alternative to the positional `` argument) | | `--ignore-sha-check` | Force re-upload even if a binary with the same SHA already exists | -| `--encrypt` / `--no-encrypt` | Encryption is on by default (CLI 5.7.0 and later): the app binary, flow files and `--env` values are encrypted on your machine before upload, each with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to upload them unencrypted. An unchanged binary is still deduplicated, so it isn't uploaded again. See [Data Encryption](../security/security-overview.md#data-encryption) | +| `--encrypt` / `--no-encrypt` | Envelope encryption is on by default: the app binary, flow files and `--env` values are encrypted on your machine before upload, each with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to turn it off; the upload is still encrypted in transit. An unchanged binary is still deduplicated, so it isn't uploaded again. See [Data Encryption](../security/security-overview.md#data-encryption) | ### Device diff --git a/cli/dcd-upload.md b/cli/dcd-upload.md index 8ab0ded..3a9c3bb 100644 --- a/cli/dcd-upload.md +++ b/cli/dcd-upload.md @@ -2,7 +2,7 @@ Upload an app binary to DeviceCloud and get back a binary ID. Use the binary ID in subsequent `dcd cloud` runs to skip re-uploading the same binary. -DeviceCloud deduplicates binaries by SHA checksum — if you upload the same binary twice, the existing ID is returned and no upload occurs. Encrypted uploads are only matched against your earlier encrypted uploads, so a binary you previously uploaded unencrypted is uploaded once more the first time it's encrypted. +DeviceCloud deduplicates binaries by SHA checksum — if you upload the same binary twice, the existing ID is returned and no upload occurs. An envelope-encrypted upload is only matched against your earlier envelope-encrypted uploads, so a binary you previously uploaded with `--no-encrypt` is uploaded once more the first time it's envelope-encrypted. ```bash dcd upload [flags] @@ -21,7 +21,7 @@ dcd upload [flags] | `--api-key ` | Your DeviceCloud API key. Defaults to `DEVICE_CLOUD_API_KEY` env var | | `--app-url ` | Signed URL to an Expo iOS build (`.tar.gz`), used instead of ``. The archive is downloaded and extracted automatically | | `--ignore-sha-check` | Force re-upload even if a binary with the same SHA already exists | -| `--encrypt` / `--no-encrypt` | Encryption is on by default (CLI 5.7.0 and later): the binary is encrypted on your machine before upload. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to upload it unencrypted | +| `--encrypt` / `--no-encrypt` | Envelope encryption is on by default: the binary is encrypted on your machine before upload, with its own key. Pass `--no-encrypt` (or set `DCD_ENCRYPT=0`) to turn it off; the upload is still encrypted in transit. See [Data Encryption](../security/security-overview.md#data-encryption) | | `--json` | Output the binary ID as JSON | | `--debug` | Enable verbose debug logging | diff --git a/cli/overview.md b/cli/overview.md index 4770013..88050bd 100644 --- a/cli/overview.md +++ b/cli/overview.md @@ -94,7 +94,7 @@ When both are present, precedence is: `--api-key` flag → `DEVICE_CLOUD_API_KEY |----------|-------------| | `DEVICE_CLOUD_API_KEY` | API key to use when `--api-key` isn't passed. Takes precedence over a `dcd login` session | | `DCD_CONFIG_DIR` | Directory for the `dcd login` session file (default `$XDG_CONFIG_HOME/dcd`, or `~/.dcd`) | -| `DCD_ENCRYPT` | `dcd cloud`, `dcd upload` and the MCP server encrypt the app binary, flows and `--env` values on your machine before upload by default. Set to `0` to turn this off, the same as passing `--no-encrypt`. A flag on the command line takes precedence | +| `DCD_ENCRYPT` | `dcd cloud`, `dcd upload` and the MCP server apply envelope encryption to the app binary, flows and `--env` values on your machine before upload by default. Set to `0` to turn it off, the same as passing `--no-encrypt`; uploads are still encrypted in transit. A flag on the command line takes precedence | | `DCD_TELEMETRY_DISABLED` | Set to `1` to turn off [telemetry](#telemetry) | | `DCD_API_URL` | MCP server only. The API base URL to use (CLI commands take `--api-url` instead) | | `DCD_MCP_READONLY` | MCP server only. Set to `1` for [read-only mode](../mcp/overview.md#read-only-mode) | @@ -103,12 +103,12 @@ The standalone binary installers also read these: | Variable | Description | |----------|-------------| -| `DCD_VERSION` | Install a specific version instead of the latest stable release, e.g. `5.5.0` | +| `DCD_VERSION` | Install a specific version instead of the latest stable release, e.g. `5.11.1` | | `DCD_BETA` | Set to `1` to install the latest beta | | `DCD_INSTALL_DIR` | Where to install the binary (default `~/.dcd/bin`, or `$env:USERPROFILE\.dcd\bin` on Windows) | ```bash -curl -fsSL https://get.devicecloud.dev/install.sh | DCD_VERSION=5.5.0 sh +curl -fsSL https://get.devicecloud.dev/install.sh | DCD_VERSION=5.11.1 sh ``` ## Telemetry diff --git a/configuration/app-management.md b/configuration/app-management.md index 452eeaf..3db0b9d 100644 --- a/configuration/app-management.md +++ b/configuration/app-management.md @@ -51,7 +51,7 @@ The URL must point to an Expo iOS simulator build (`.tar.gz`). The CLI downloads ### SHA Hash Checking -By default, Device Cloud checks the SHA hash of your binary to avoid redundant uploads (it will automatically work out the app-binary-id for you). Encrypted uploads (the default) are only matched against your earlier encrypted uploads, so a binary you previously uploaded unencrypted is uploaded once more the first time it's encrypted. To override: +By default, Device Cloud checks the SHA hash of your binary to avoid redundant uploads (it will automatically work out the app-binary-id for you). Envelope-encrypted uploads (the default) are only matched against your earlier envelope-encrypted uploads, so a binary you previously uploaded with `--no-encrypt` is uploaded once more the first time it's envelope-encrypted. To override: ```bash dcd cloud --app-file ./app.apk flows/ --ignore-sha-check diff --git a/configuration/environment-variables.md b/configuration/environment-variables.md index a149868..1c0f21e 100644 --- a/configuration/environment-variables.md +++ b/configuration/environment-variables.md @@ -40,7 +40,7 @@ dcd cloud app.apk flows/ -e USERNAME=${CI_USERNAME} \ -e PASSWORD=${CI_PASSWORD} ``` -The CLI encrypts `--env` values on your machine before they're uploaded, along with the app binary and your flow files. This is on by default (CLI 5.7.0 and later); `--no-encrypt` or `DCD_ENCRYPT=0` turns it off. Because the values are encrypted, the console doesn't list them on the test result. +The CLI applies envelope encryption to `--env` values on your machine before they're uploaded, along with the app binary and your flow files. This is on by default; `--no-encrypt` or `DCD_ENCRYPT=0` turns it off, and the values are still encrypted in transit. Because the values are envelope-encrypted, the console doesn't list them on the test result. See [Data Encryption](../security/security-overview.md#data-encryption). ## iOS: SIMCTL Variable Passthrough diff --git a/configuration/google-play-apis.md b/configuration/google-play-apis.md index b0fa5b9..1455893 100644 --- a/configuration/google-play-apis.md +++ b/configuration/google-play-apis.md @@ -65,7 +65,7 @@ Pass the device and API level together on Google Play runs: dcd cloud ... --google-play --android-device pixel-8 --android-api-level 34 ``` -If you pass only one of them, DeviceCloud picks the other so the pair has a Google Play image: a device runs on its Google Play API level, and an API level runs on a Google Play device that offers it. If you pass neither, the run uses the default Android device, Pixel 10 on API 36, which has a Google Play image. A device with no Google Play image, or an API level no Google Play device offers, is rejected. Older CLI versions check a single value against an older default device instead, so update the CLI if one of these is refused. +If you pass only one of them, DeviceCloud picks the other so the pair has a Google Play image: a device runs on its Google Play API level, and an API level runs on a Google Play device that offers it. If you pass neither, the run uses the default Android device, Pixel 10 on API 36, which has a Google Play image. A device with no Google Play image, or an API level no Google Play device offers, is rejected. If only some flows opt in with `DEVICECLOUD_OVERRIDE_GOOGLE_PLAY`, those flows are resolved the same way, from the device and API level the flow names, then the ones the upload names. A flow that opts in and names neither runs on Pixel 10 on API 36. To choose the device, pin it on the upload, or on those flows with [per-flow devices](per-flow-devices.md). diff --git a/configuration/workspace-config.md b/configuration/workspace-config.md index 938c695..d378a46 100644 --- a/configuration/workspace-config.md +++ b/configuration/workspace-config.md @@ -35,7 +35,7 @@ If `flows` is omitted, all `.yaml` / `.yml` files at the top level of the direct ### `includedPaths` -Glob patterns selecting extra **non-flow** files to upload alongside your flows. Requires DeviceCloud CLI 5.6.0 or later; older versions warn that the key is unknown and upload nothing extra. +Glob patterns selecting extra **non-flow** files to upload alongside your flows. The CLI works out what to upload by reading your flows, so it only picks up files a command actually references by a literal path — `addMedia`, `assertScreenshot`, `runFlow` and `runScript` arguments. A path that contains a variable (`screenshots/${DCD_DEVICE}/home.png`), and anything else your test needs on the device, is invisible to it and silently absent from the run. `includedPaths` is how you declare those files. @@ -108,7 +108,7 @@ executionOrder: - checkout ``` -The bare-list form is not valid Maestro either. Older CLI versions accepted it and silently ignored it, so the flows ran **in parallel** while the run still reported success — the only symptom was flows executing out of order. The CLI now fails with an error naming the expected shape instead. +The bare-list form is not valid Maestro either. The CLI rejects it with an error naming the expected shape. ::: ::: info diff --git a/getting-started/flows-and-workspaces.md b/getting-started/flows-and-workspaces.md index 9282d3a..aa14e3b 100644 --- a/getting-started/flows-and-workspaces.md +++ b/getting-started/flows-and-workspaces.md @@ -58,4 +58,4 @@ See [Workspace Configuration](../configuration/workspace-config.md) for more inf ### Referencing flows -As of version 2.0.0, the CLI will search for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`). From version 5.6.0 it also picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths). +The CLI searches for all nested dependencies referenced by your YAML flows using Maestro keywords (`addMedia`, `runFlow`, `runScript`), and picks up `assertScreenshot` baselines named by a literal path. Files it can't find this way, such as a path containing a variable, can be added with [`includedPaths`](../configuration/workspace-config.md#includedpaths). diff --git a/mcp/tools.md b/mcp/tools.md index bdcd99d..4a7cb71 100644 --- a/mcp/tools.md +++ b/mcp/tools.md @@ -86,7 +86,7 @@ This tool consumes test credits. It's annotated as destructive so clients can pr | `priority` | `low` \| `normal` \| `high` | [Run priority](../configuration/run-priority.md) (default `normal`). Reorders only your organisation's own queued runs. | | `configFile` | string | Path to a [workspace config](../configuration/workspace-config.md) | | `ignoreShaCheck` | boolean | Force re-upload of the binary even if an identical one already exists | -| `encrypt` | boolean | Encrypt the binary, flows and `env` values on your machine before upload. Omit it to follow `DCD_ENCRYPT`, then the default, which is on; pass `false` to upload them unencrypted. See [Data Encryption](../security/security-overview.md#data-encryption) | +| `encrypt` | boolean | Apply envelope encryption to the binary, flows and `env` values on your machine before upload. Omit it to follow `DCD_ENCRYPT`, then the default, which is on; pass `false` to turn it off (the upload is still encrypted in transit). See [Data Encryption](../security/security-overview.md#data-encryption) | | `dryRun` | boolean | Preview which flows would run, without submitting | | `wait` | boolean | Block until the run completes instead of returning immediately (default `false`) | | `waitTimeoutSeconds` | integer | Max seconds to wait when `wait` is true, 30–3600 (default `600`). A flow with [extended runtime](../configuration/extended-runtime.md) can run for up to 20 minutes, so raise this when the run includes one | diff --git a/security/security-overview.md b/security/security-overview.md index a32ec97..3502b9e 100644 --- a/security/security-overview.md +++ b/security/security-overview.md @@ -24,7 +24,7 @@ DeviceCloud stores customer data and performs processing using Supabase and Rail Data held by our database and file storage providers is encrypted at rest with AES-256, and data sent over the internet is encrypted in transit via TLS. Credentials get additional protection at the application level: API keys are stored only as a one-way hash, and access tokens for connected services (such as Slack) are encrypted before being stored in the database. -Your uploads are also encrypted end to end by default. The CLI (5.7.0 and later) encrypts your app binary, flows and environment variables on your machine before they are uploaded, each with its own key, so the copies held in our storage and caches are encrypted. Only our API holds the key needed to decrypt them. To upload without this encryption, pass `--no-encrypt` or set `DCD_ENCRYPT=0`. Older CLI versions encrypt only when you pass `--encrypt` or set `DCD_ENCRYPT=1`. +On top of TLS, your uploads get envelope encryption by default. Before anything is uploaded, the CLI encrypts your app binary, flows and environment variables on your machine, each with its own random key (AES-256-GCM). It then encrypts each of those keys with DeviceCloud's public key (X25519), so the copies held in our storage and caches are ciphertext, and only our API can recover the keys that decrypt them. To turn envelope encryption off, pass `--no-encrypt` or set `DCD_ENCRYPT=0`. The upload is still encrypted in transit. ### Data Retention