run402 4.80.0 → 4.80.1

package/lib/logs.mjs

@@ -1,163 +1,192 @@
 /**
  * run402 logs — Top-level shortcut for fetching function logs by request id.
  *
- * Capability `astro-ssr-runtime` (Run402 v1.52). When an SSR response
- * returns 5xx, the response includes `x-run402-request-id: req_...` and
- * `x-run402-error-code: R402_SSR_RUNTIME_ERROR`. The agent (or user)
- * copies the request id and runs:
+ * Capability `astro-ssr-runtime` (Run402 v1.52). Every function response
+ * (routed and direct) carries `x-run402-request-id: req_...`; a 5xx from the
+ * SSR runtime adds `x-run402-error-code: R402_SSR_RUNTIME_ERROR`. The agent
+ * (or user) copies the request id and runs:
  *
  *   run402 logs --request-id req_...
  *
- * Resolves project + function from env (RUN402_PROJECT_ID + --function)
- * OR explicit flags. For multi-function projects, you can omit --function
- * and the command scans every function in the project.
+ * No function name needed: the SDK's `functions.logsByRequestId` fans the
+ * read out across every function in the project (the gateway has no
+ * project-wide logs route). `--function <name>` (or a leading positional)
+ * narrows it to one; with `--function` alone the command is that function's
+ * plain tail.
  *
- * Delegates to `run402 functions logs` for single-function lookups.
+ * App output only by default — Lambda's own INIT_START / START / END / REPORT
+ * lines are `origin: "platform"` and hidden unless `--platform` / `--all`.
  */
 
 import { getSdk } from "./sdk.mjs";
+import { getActiveProjectId } from "./config.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, parseIntegerFlag, positionalArgs } from "./argparse.mjs";
+import {
+  FUNCTION_LOG_TAIL_MAX,
+  assertLogRequestIdFlag,
+  parseLogSinceFlag,
+  platformHiddenHint,
+  resolveLogOriginFlag,
+} from "./functions.mjs";
 
 const HELP = `run402 logs — Fetch function logs by request id
 
 Usage:
-  run402 logs --request-id <req_id> [--function <name>] [--project <id>] [--tail <n>]
+  run402 logs --request-id <id> [<function> | --function <name>] [--project <id>] [options]
+  run402 logs --function <name> [--project <id>] [options]
 
-Required:
-  --request-id <req_id>   The req_... id (from x-run402-request-id header)
+Required (one of):
+  --request-id <id>       A req_... id (the x-run402-request-id response header),
+                          or a fnrun_... / fnatt_... durable-run id. Without
+                          --function, every function in the project is scanned.
+  --function <name>       Limit to one function. Alone (no --request-id) this
+                          is that function's recent tail. A leading positional
+                          <function> means the same thing.
 
 Optional:
-  --function <name>       Limit to one function (default: scan all functions in the project)
-  --project <id>          Project id (default: \$RUN402_PROJECT_ID)
-  --tail <n>              Max entries per function (default 100)
+  --project <id>          Project id (default: \$RUN402_PROJECT_ID, else the active project)
+  --tail <n>              Max entries per function BEFORE the origin filter (default 100, max 1000)
+  --since <ts>            ISO timestamp or epoch ms; only entries at or after this
+  --app                   Only the function's own output (default). Lambda runtime
+                          lines (INIT_START, START/END/REPORT RequestId, billed
+                          duration) are hidden; "hidden.platform" counts them and a
+                          "hint" appears when hiding them left the result empty.
+  --platform              Only the Lambda runtime lines
+  --all                   Both (the raw CloudWatch stream)
 
 Output:
-  Stdout is JSON { ok, request_id, project_id, scanned, entries, errors? }.
+  Stdout is JSON { ok, request_id, project_id, scanned, entries, errors?, origin, hidden?, hint? }.
+  Every entry carries "function" and "origin": "app" | "platform". "ok" is
+  false only when a function's log read failed (it is named in "errors").
 
 Examples:
   run402 logs --request-id req_abc123
   run402 logs --request-id req_abc123 --function ssr
-  run402 logs --request-id req_abc123 --project prj_xyz
+  run402 logs ssr --request-id req_abc123 --all
+  run402 logs --request-id fnrun_abc123 --project prj_xyz
+  run402 logs --function checkout --tail 20
 
 Tip: the request id appears in:
-  - The 'x-run402-request-id' response header on every SSR response
+  - The 'x-run402-request-id' response header on every function response
   - The 'requestId' field of any R402_SSR_RUNTIME_ERROR envelope
   - The 'request_id' field in deploy / cache invalidate result envelopes
+  - The 'samples' of 'run402 errors' (each sample names a runnable logs command)
 `;
 
+const VALUE_FLAGS = ["--request-id", "--function", "--project", "--tail", "--since"];
+const KNOWN_FLAGS = [...VALUE_FLAGS, "--app", "--platform", "--all", "--help", "-h"];
+
 export async function run(sub, args = []) {
-  const all = [sub, ...args].filter(Boolean);
+  const all = normalizeArgv([sub, ...args].filter(Boolean));
   if (!all.length || all.includes("--help") || all.includes("-h")) {
     console.log(HELP);
     return;
   }
+  assertKnownFlags(all, KNOWN_FLAGS, VALUE_FLAGS);
 
-  const requestId = pickFlagValue(all, "--request-id");
-  const fnName = pickFlagValue(all, "--function");
-  const projectIdArg = pickFlagValue(all, "--project");
-  const tailArg = pickFlagValue(all, "--tail");
+  const requestId = flagValue(all, "--request-id") ?? undefined;
+  const functionFlag = flagValue(all, "--function") ?? undefined;
+  const projectIdArg = flagValue(all, "--project") ?? undefined;
+  const tailArg = flagValue(all, "--tail") ?? undefined;
+  const sinceArg = flagValue(all, "--since") ?? undefined;
+  const origin = resolveLogOriginFlag(all);
 
-  if (!requestId) {
+  const positionals = positionalArgs(all, VALUE_FLAGS);
+  if (positionals.length > 1) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing --request-id <req_id>.",
-      hint: "Pass the request id from the 'x-run402-request-id' response header.",
+      message: `Unexpected argument: ${positionals[1]}`,
+      hint: "run402 logs [<function>] --request-id <id> [--project <id>]",
+      details: { argument: positionals[1] },
     });
   }
-  if (!requestId.startsWith("req_")) {
+  if (positionals.length === 1 && functionFlag !== undefined && positionals[0] !== functionFlag) {
     fail({
       code: "BAD_USAGE",
-      message: `--request-id must look like 'req_...' (got: ${requestId})`,
+      message: `Function named twice: positional '${positionals[0]}' and --function '${functionFlag}'`,
+      details: { positional: positionals[0], flag: functionFlag },
     });
   }
+  const fnName = functionFlag ?? positionals[0];
 
-  const projectId = projectIdArg ?? process.env.RUN402_PROJECT_ID;
-  if (!projectId) {
+  if (!requestId && !fnName) {
     fail({
       code: "BAD_USAGE",
-      message: "Missing project id.",
-      hint: "Pass --project <id> or set RUN402_PROJECT_ID env var.",
+      message: "Missing --request-id <id> (or --function <name> for a plain tail).",
+      hint: "Pass the request id from the 'x-run402-request-id' response header.",
     });
   }
+  assertLogRequestIdFlag(requestId);
 
-  const tail = tailArg ? parseInt(tailArg, 10) : 100;
-  if (Number.isNaN(tail) || tail < 1 || tail > 5000) {
+  const projectId = projectIdArg ?? process.env.RUN402_PROJECT_ID ?? getActiveProjectId() ?? undefined;
+  if (!projectId) {
     fail({
       code: "BAD_USAGE",
-      message: `--tail must be an integer between 1 and 5000 (got: ${tailArg})`,
+      message: "Missing project id.",
+      hint: "Pass --project <id>, set RUN402_PROJECT_ID, or 'run402 projects use <id>'.",
     });
   }
 
-  const sdk = getSdk();
+  const tail = parseIntegerFlag("--tail", tailArg, { min: 1, max: FUNCTION_LOG_TAIL_MAX, def: 100 });
+  const since = parseLogSinceFlag(sinceArg);
 
+  const sdk = getSdk();
   try {
-    let fnNames;
-    if (fnName) {
-      fnNames = [fnName];
-    } else {
-      // Scan every function in the project.
-      const list = await sdk.functions.list(projectId);
-      fnNames = (list?.functions ?? []).map((f) => f.name);
-      if (fnNames.length === 0) {
-        console.log(JSON.stringify({ ok: true, request_id: requestId, project_id: projectId, entries: [], scanned: [] }, null, 2));
-        return;
-      }
+    if (requestId) {
+      const result = await sdk.functions.logsByRequestId(projectId, requestId, {
+        tail,
+        since,
+        origin,
+        ...(fnName !== undefined && { functionName: fnName }),
+      });
+      emit({
+        ok: result.errors.length === 0,
+        request_id: result.request_id,
+        project_id: projectId,
+        scanned: result.scanned,
+        entries: result.entries,
+        errors: result.errors,
+        origin: result.origin,
+        hidden: result.hidden,
+      });
+      return;
     }
 
-    // Query each function in parallel; aggregate entries. SDK returns
-    // FunctionLogsResult = { logs: FunctionLogEntry[] }; unwrap to the array
-    // so the aggregated JSON has a flat entries[] field.
-    const results = await Promise.allSettled(
-      fnNames.map((name) =>
-        sdk.functions
-          .logs(projectId, name, { requestId, tail })
-          .then((result) => ({ name, entries: result?.logs ?? [] })),
-      ),
-    );
-
-    const allEntries = [];
-    const scanned = [];
-    const errors = [];
-    for (const r of results) {
-      if (r.status === "fulfilled") {
-        scanned.push(r.value.name);
-        for (const e of r.value.entries) {
-          allEntries.push({ function: r.value.name, ...e });
-        }
-      } else {
-        errors.push({ name: "?", error: r.reason?.message ?? String(r.reason) });
-      }
-    }
-
-    // Sort by timestamp ascending. FunctionLogEntry.timestamp is an ISO 8601
-    // string; convert to epoch ms for comparison.
-    allEntries.sort((a, b) => {
-      const ta = a.timestamp ? Date.parse(a.timestamp) : 0;
-      const tb = b.timestamp ? Date.parse(b.timestamp) : 0;
-      return ta - tb;
+    // --function alone: that function's recent tail, same envelope.
+    const result = await sdk.functions.logs(projectId, fnName, { tail, since, origin });
+    emit({
+      ok: true,
+      request_id: null,
+      project_id: projectId,
+      scanned: [fnName],
+      entries: (result.logs ?? []).map((entry) => ({ function: fnName, ...entry })),
+      errors: [],
+      origin: result.origin ?? origin,
+      hidden: result.hidden,
     });
-
-    console.log(
-      JSON.stringify(
-        {
-          ok: errors.length === 0,
-          request_id: requestId,
-          project_id: projectId,
-          scanned,
-          entries: allEntries,
-          ...(errors.length > 0 && { errors }),
-        },
-        null,
-        2,
-      ),
-    );
   } catch (err) {
     reportSdkError(err);
   }
 }
 
-function pickFlagValue(args, flag) {
-  const idx = args.indexOf(flag);
-  if (idx === -1) return undefined;
-  return args[idx + 1];
+function emit({ ok, request_id, project_id, scanned, entries, errors, origin, hidden }) {
+  const hint = platformHiddenHint(entries, hidden);
+  console.log(
+    JSON.stringify(
+      {
+        ok,
+        request_id,
+        project_id,
+        scanned,
+        entries,
+        ...(errors.length > 0 && { errors }),
+        origin,
+        ...(hidden && { hidden }),
+        ...(hint && { hint }),
+      },
+      null,
+      2,
+    ),
+  );
 }

package/lib/repos.mjs

@@ -63,7 +63,7 @@ Usage:
   run402 repos <verb> [options] — fifteen verbs, tiered by how often you reach for them:
 
 Common:
-  run402 repos create [name]  [--org <org_id>] [--dir <path>] [--tier <tier>] [--project <id>]
+  run402 repos create [name]  [--org <org_id>] [--dir <path>] [--nested] [--tier <tier>] [--project <id>]
                               [--byo <s3://bucket/prefix>] [--profile <name> | --ambient] [--region <r>] [--endpoint <url>] [--no-init]
   run402 repos view           [--project <id>] [--repo <repo_id>] [--human]
   run402 repos list           [--org <org_id>] [--human]
@@ -383,6 +383,19 @@ Options:
   --dir <path>      create: the working tree to scaffold (default: cwd). Not
                     a git repository yet? One is created — \`repos create\` is
                     a from-a-directory-to-a-hosted-repo verb by definition.
+                    A directory INSIDE another repository (a monorepo app) is
+                    not: the vault is still allocated, but the remote scaffold
+                    is skipped (\`remote.status\` "skipped", the enclosing
+                    toplevel named) and the response carries a
+                    \`create_nested_repo\` next_action — re-run with --nested.
+  --nested          create: make the working tree its OWN repository even when
+                    it lies inside another one — \`git init -b main\` there, the
+                    remote added there, and exactly one line
+                    (\`/<relative path>/\`) appended to the ENCLOSING
+                    repository's local .git/info/exclude so it never shows the
+                    app as untracked noise. Nothing else in the enclosing
+                    repository is touched (no .gitignore, index, or submodule).
+                    No-op on a directory that is already its own toplevel.
   --tier <tier>     create: project tier (default: prototype) — new projects only
   --idempotency-key <key>
                     create: re-running with the same key resolves to the
@@ -740,7 +753,14 @@ function slugifyRepoName(name) {
 async function remoteBasenameCandidate(dir) {
   try {
     const { hardenedGit } = await import("#sdk/node");
-    await hardenedGit(dir, ["rev-parse", "--git-dir"]);
+    const { realpathSync } = await import("node:fs");
+    // Only a remote of `dir`'s OWN repository names this repo. A directory
+    // that merely lies inside another checkout (a monorepo app, whether or
+    // not it is about to become a nested repository via --nested) would
+    // otherwise inherit the ENCLOSING repository's origin basename — the
+    // monorepo's name, never the app's.
+    const toplevel = (await hardenedGit(dir, ["rev-parse", "--show-toplevel"])).text().trim();
+    if (realpathSync(toplevel) !== realpathSync(dir)) return null;
     for (const name of ["run402", "origin"]) {
       let url;
       try {
@@ -834,9 +854,15 @@ async function printCreateResult({ sdk, projectId, vault, adopted, name, verbose
     if (name) console.error(`repo name not claimed (non-fatal): ${err?.message ?? String(err)}`);
   }
 
-  const pushAction = vault.remote
+  // A `push_repo` action names a remote that EXISTS — only a scaffolded
+  // result has one. A skipped scaffold (the working tree lies inside another
+  // repository) allocated the vault but added no remote; its own
+  // `next_actions` (the SDK's `create_nested_repo`) name the way out.
+  const remoteScaffolded = vault.remote != null && vault.remote.status !== "skipped";
+  const pushAction = remoteScaffolded
     ? nextAction("push_repo", { command: `git push -u ${vault.remote.name} HEAD`, why: "Publish the current branch to the encrypted Run402 remote." })
     : null;
+  const remoteSkippedActions = vault.remote?.status === "skipped" ? (vault.remote.next_actions ?? []) : [];
   const claimAction = address ? null : orgSlug ? claimRepoNameAction(projectId) : claimOrgSlugAction();
   // gitvault-byo-primary-bucket task 3.5: a BYO vault's "add a copy" remedy
   // names a SECOND customer-held location (D7) — the plain mirror hint
@@ -846,7 +872,7 @@ async function printCreateResult({ sdk, projectId, vault, adopted, name, verbose
   const mirrorAction = isByo
     ? nextAction("configure_mirror", { command: "run402 repos mirror <destination>", why: GITVAULT_BYO_UNMIRRORED_REMEDY_STATEMENT })
     : nextAction("configure_mirror", { command: "run402 repos mirror <destination>", why: GITVAULT_MIRROR_SETUP_HINT });
-  const nextActions = [pushAction, mirrorAction, claimAction].filter(Boolean);
+  const nextActions = [pushAction, ...remoteSkippedActions, mirrorAction, claimAction].filter(Boolean);
 
   // Secret-bearing (recovery_receipt): built fresh every call, printed once,
   // and never spilled into any cache path — see spillIfLarge's own doc
@@ -873,8 +899,14 @@ async function printCreateResult({ sdk, projectId, vault, adopted, name, verbose
   if (address) console.error(`address: ${address}`);
   else if (!orgSlug) console.error("no named address yet — claim an org slug (run402 org slug <slug>) to get run402::<slug>/<name> addresses");
   else console.error(`no address claimed — run 'run402 repos rename <name> --project ${projectId}' to claim one`);
-  if (vault.remote) console.error(`remote '${vault.remote.name}' -> ${vault.remote.url} (${vault.remote.reason})`);
+  if (remoteScaffolded) {
+    console.error(`remote '${vault.remote.name}' -> ${vault.remote.url} (${vault.remote.reason})`);
+    if (vault.remote.nested) console.error(`nested repository inside ${vault.remote.enclosing_toplevel}${vault.remote.excluded_in_enclosing ? " — excluded there via .git/info/exclude" : " — could not write its .git/info/exclude"}`);
+  } else if (vault.remote?.status === "skipped") {
+    console.error(`remote skipped: ${vault.remote.reason}`);
+  }
   if (pushAction) console.error(`next: ${pushAction.command}`);
+  for (const action of remoteSkippedActions) if (action?.command) console.error(`next: ${action.command}`);
   if (isByo) {
     console.error(`storage: byo (${vault.byo_destination}) — ${GITVAULT_BYO_HEADLINE_STATEMENT}`);
     console.error(GITVAULT_BYO_NO_PAYLOAD_COPY_STATEMENT);
@@ -903,7 +935,7 @@ async function createAdopt(projectId, dir, a) {
   }
   try {
     const byo = resolveByoOption(a);
-    const vault = await sdk.gitvault.init({ org_id: orgId, project_id: projectId, repo_dir: dir, ...(byo ? { byo } : {}) });
+    const vault = await sdk.gitvault.init({ org_id: orgId, project_id: projectId, repo_dir: dir, ...(a.includes("--nested") ? { nested: true } : {}), ...(byo ? { byo } : {}) });
     await printCreateResult({ sdk, projectId, vault, adopted: true, name: null, verboseArgv: a });
   } catch (err) {
     reportSdkError(err);
@@ -986,7 +1018,7 @@ async function createProvision(name, dir, a) {
 
   try {
     const byo = resolveByoOption(a);
-    const vault = await sdk.gitvault.init({ org_id: effectiveOrgId, project_id: provisioned.project_id, repo_dir: dir, ...(byo ? { byo } : {}) });
+    const vault = await sdk.gitvault.init({ org_id: effectiveOrgId, project_id: provisioned.project_id, repo_dir: dir, ...(a.includes("--nested") ? { nested: true } : {}), ...(byo ? { byo } : {}) });
     await printCreateResult({ sdk, projectId: provisioned.project_id, vault, adopted: false, name, verboseArgv: a });
   } catch (err) {
     reportSdkError(err);
@@ -995,7 +1027,7 @@ async function createProvision(name, dir, a) {
 
 async function create(args) {
   const a = normalizeArgv(args);
-  assertKnownFlags(a, [...CREATE_VALUE_FLAGS, "--ambient", "--no-init", "--help", "-h", "-v", "--verbose"], CREATE_VALUE_FLAGS);
+  assertKnownFlags(a, [...CREATE_VALUE_FLAGS, "--ambient", "--no-init", "--nested", "--help", "-h", "-v", "--verbose"], CREATE_VALUE_FLAGS);
   const positionals = requirePositionalCount(a, CREATE_VALUE_FLAGS, {
     min: 0, max: 1, command: "run402 repos create [name]", missing: "",
   });

package/lib/up.mjs

@@ -10,7 +10,7 @@ import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.
 const HELP = `run402 up — Provision/link/deploy the current app
 
 Usage:
-  run402 up [repo-or-path] [--name <name>] [--project <id>] [--manifest <path>] [--dir <path>] [--tier <tier>] [-y|--yes] [--check|--print-spec|--plan|--require-plan <id>|--repo-only] [--verify] [--human|--json-stream] [--quiet]
+  run402 up [repo-or-path] [--name <name>] [--project <id>] [--manifest <path>] [--dir <path>] [--tier <tier>] [-y|--yes] [--check|--print-spec|--plan|--require-plan <id>|--repo-only] [--nested] [--verify] [--human|--json-stream] [--quiet]
   run402 up verify [repo-or-path] [--project <id>] [--manifest <path>] [--dir <path>] [--human|--json-stream]
 
 Options:
@@ -55,12 +55,24 @@ Options:
                       bearing deploy against a project with a live release is
                       rehearsed on a contained branch and committed only on a
                       passing report; a first deploy has nothing to protect and
-                      commits directly (result.deploy.rehearsal says which).
+                      commits directly, and a plan whose migrations are all
+                      already applied with an identical checksum is not
+                      rehearsed either (result.deploy.rehearsal says which:
+                      no_live_release / migrations_unchanged / no_migrations).
   --repo-only         Provision + scaffold the run402 remote + first push,
                       and stop there — no deploy. The vault-only track
                       (D8), composed through up instead of run402 repos
                       create. Incompatible with --check/--print-spec/--plan/
                       --require-plan/--verify.
+  --nested            Give an app root that lies INSIDE another repository (a
+                      monorepo workspace) its own nested repository: git init
+                      -b main there, the run402 remote added there, the first
+                      push made from there, and exactly one line
+                      (/<relative path>/) appended to the ENCLOSING
+                      repository's local .git/info/exclude. Nothing else in
+                      the enclosing repository is touched (no .gitignore,
+                      index, or submodule). No-op when the app root is already
+                      its own repository.
 
 Repo composition (D4): against a local directory (not a git URL source), up
 composes git init (only when the app root is not already a repository) +
@@ -68,17 +80,25 @@ provision + a run402 remote scaffold (origin is never claimed) + a first
 gitvault push — one command, the fly-launch shape. The app root is the
 manifest's directory; an app root that lies INSIDE another repository is
 left untouched (result.repo.status "skipped", reason
-"inside_other_repository", toplevel named). The scaffold and first push are
-best-effort: a git or vault hiccup never turns an otherwise-successful deploy
-into a failure, and is reported under result.repo (default apply) or result
-(--repo-only) instead.
+"inside_other_repository", toplevel named) and result.repo.next_actions
+carries create_nested_repo — re-run with --nested to give the app its own
+encrypted remote (result.repo.gitvault.nested true, enclosing_toplevel,
+excluded_in_enclosing). The scaffold and first push are best-effort: a git
+or vault hiccup never turns an otherwise-successful deploy into a failure,
+and is reported under result.repo (default apply) or result (--repo-only)
+instead.
 
 Identity: up makes sure this principal has a display name before the deploy
-that will be credited to it — an existing name is kept, otherwise the
-detected client name (claude-code, codex, cursor, grok, or agent) is set (approved)
-by -y, or asked once) — and joins the project room under it. Change it any
-time with 'run402 org whoami --set-name <name>'. Reported under
-result.identity.
+that will be credited to it, then joins the project room under it. An
+existing name is kept; otherwise the detected client name (claude-code,
+codex, cursor, or grok) is set (approved by -y, or asked once); when no
+client is detected nothing is written and the room presence is 'agent' for
+coordination only. RUN402_AGENT_NAME=<name> sets the name, overriding an
+existing one; RUN402_CLIENT=<name> declares the client when it is not
+auto-detected. A detected client that was not applied (the principal is
+already named) is still reported. Change the name any time with
+'run402 org whoami --set-name <name>'. Reported under result.identity
+(source, detected, detection).
   --json              Emit one final JSON object on stdout (default; compatibility no-op).
   --human             Emit the legacy human success/blocking summary on stdout.
   --json-stream       Emit NDJSON progress events on stdout and a final result event.
@@ -165,6 +185,7 @@ export async function run(args = []) {
       "--json-stream",
       "--repo-only",
       "--no-rehearse",
+      "--nested",
     ],
     [
       "--name",
@@ -276,6 +297,7 @@ export async function run(args = []) {
     });
   }
   const repoOnly = parsed.includes("--repo-only");
+  const nested = parsed.includes("--nested");
   if (repoOnly && (dryRun || isNonApplyingMode(mode) || isApplyReviewedMode(mode) || verifyEdge)) {
     fail({
       code: "BAD_USAGE",
@@ -307,7 +329,7 @@ export async function run(args = []) {
 
     let result;
     if (repoOnly) {
-      result = await runRepoOnly({ sdk, workDir, createdRepository, opts: parsed, tier, allowWarningCodes, idempotencyKey: flagValue(parsed, "--idempotency-key") ?? undefined });
+      result = await runRepoOnly({ sdk, workDir, createdRepository, nested, opts: parsed, tier, allowWarningCodes, idempotencyKey: flagValue(parsed, "--idempotency-key") ?? undefined });
     } else {
       result = await sdk.up({
         source,
@@ -345,7 +367,7 @@ export async function run(args = []) {
       if (composeRepo && mode === undefined) {
         const projectId = result?.result?.project_id ?? result?.result?.deploy?.project_id ?? null;
         if (projectId) {
-          const repoResult = await composeRepoPushStep({ sdk, workDir, projectId, createdRepository });
+          const repoResult = await composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested });
           if (result.result) result.result.repo = repoResult;
         }
       }
@@ -364,9 +386,9 @@ export async function run(args = []) {
     } else if (mode === "printSpec") {
       console.log(JSON.stringify(result.result?.spec ?? null, null, 2));
     } else if (human && result?.result?.app_result) {
-      console.log(formatAppUpHuman(result.result.app_result));
+      console.log([formatAppUpHuman(result.result.app_result), formatRepoSkipLine(result)].filter(Boolean).join("\n"));
     } else if (human && shouldRenderHumanSuccess(result)) {
-      console.log(formatLegacyUpSuccess(result));
+      console.log([formatLegacyUpSuccess(result), formatRepoSkipLine(result)].filter(Boolean).join("\n"));
     } else {
       console.log(JSON.stringify(result, null, 2));
     }
@@ -637,12 +659,20 @@ async function gitInitIfNeeded(dir) {
  * fold-in follows (`gitvault-scaffold.mjs`): a git or vault hiccup here must
  * never turn an otherwise-successful `up` into a failure.
  */
-async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository }) {
+async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository, nested = false }) {
   const { resolveOwningOrgId } = await import("./org-context.mjs");
   const { scaffoldGitvaultRemote } = await import("./gitvault-scaffold.mjs");
   const orgId = await resolveOwningOrgId(projectId);
-  const scaffold = await scaffoldGitvaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false });
+  // `--nested`: an app root INSIDE another repository (a monorepo workspace)
+  // becomes its own repository with the encrypted remote — the enclosing
+  // checkout only gains one local `.git/info/exclude` line. Without it the
+  // scaffold is skipped there and the result's `next_actions` name
+  // `run402 up --nested` (the caller's own spelling of the way out).
+  const scaffold = await scaffoldGitvaultRemote({ repoDir: workDir, projectId, orgId: orgId ?? undefined, createRepoIfMissing: false, nested, nestedCommand: "run402 up --nested" });
   if (createdRepository && scaffold.gitvault) scaffold.gitvault.created_repository = true;
+  // A nested repository the scaffold itself just created is as fresh as one
+  // `up`'s own git init made: nothing committed, every file untracked.
+  const freshRepository = createdRepository || scaffold.gitvault?.created_repository === true;
   const out = { ...scaffold, first_push: null, first_push_error: null };
   if (scaffold.status !== "scaffolded") {
     // Nothing was scaffolded (the app root is inside another repository, or
@@ -666,7 +696,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository
       project_id: projectId,
       org_id: orgId,
       repo_dir: workDir,
-      ...(createdRepository ? { snapshot: { allowDirty: true } } : {}),
+      ...(freshRepository ? { snapshot: { allowDirty: true } } : {}),
       onVaultCreated: (created) => { vaultCreated = created; },
     });
     out.first_push = {
@@ -674,7 +704,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository
       form: pushed.form,
       gitvault_commit: pushed.gitvault_commit,
       vault_created: vaultCreated,
-      ...(createdRepository ? { captured_dirty: true, modified_captured: pushed.snapshot?.modified_captured ?? null, untracked_captured: pushed.snapshot?.untracked_captured ?? null } : {}),
+      ...(freshRepository ? { captured_dirty: true, modified_captured: pushed.snapshot?.modified_captured ?? null, untracked_captured: pushed.snapshot?.untracked_captured ?? null } : {}),
     };
   } catch (err) {
     out.first_push_error = { code: err?.body?.code ?? err?.code ?? "GITVAULT_PUSH_FAILED", message: err?.message ?? String(err) };
@@ -688,7 +718,7 @@ async function composeRepoPushStep({ sdk, workDir, projectId, createdRepository
  * create`'s own shape (task 2.6); `up --repo-only` is the "I'm already
  * inside `up`'s mental model" entry point to the same outcome.
  */
-async function runRepoOnly({ sdk, workDir, createdRepository, opts, tier, idempotencyKey }) {
+async function runRepoOnly({ sdk, workDir, createdRepository, nested = false, opts, tier, idempotencyKey }) {
   // `sdk.up()`'s action graph auto-approves prerequisites (allowance, tier)
   // for a cold start; calling projects.provision directly bypasses that, so
   // this mirrors the SAME gate `run402 projects provision` itself uses —
@@ -697,7 +727,7 @@ async function runRepoOnly({ sdk, workDir, createdRepository, opts, tier, idempo
   if (!isCoreApiTarget() && !loadLiveControlPlaneSession()) allowanceAuthHeaders("/projects/v1");
   const name = flagValue(opts, "--name") ?? undefined;
   const provisioned = await sdk.projects.provision({ tier, name, idempotencyKey });
-  const repo = await composeRepoPushStep({ sdk, workDir, projectId: provisioned.project_id, createdRepository });
+  const repo = await composeRepoPushStep({ sdk, workDir, projectId: provisioned.project_id, createdRepository, nested });
   return {
     action: "up",
     mode: "repo-only",
@@ -744,6 +774,22 @@ function shouldRenderHumanSuccess(result) {
     result?.result?.deploy?.release_id;
 }
 
+/**
+ * One line for the human summary when the repo compose was skipped — the
+ * reason and, when the app root lies inside another repository, the exact
+ * `--nested` command that gives it an encrypted remote of its own.
+ */
+function formatRepoSkipLine(result) {
+  const repo = result?.result?.repo;
+  // Only the actionable skip gets a human line: an app root inside another
+  // repository has a remedy (--nested). Other skips stay JSON-only.
+  if (repo?.status !== "skipped" || repo.reason !== "inside_other_repository") return null;
+  const where = repo.toplevel ? ` (inside ${repo.toplevel})` : "";
+  const nestedAction = (Array.isArray(repo.next_actions) ? repo.next_actions : []).find((action) => action?.type === "create_nested_repo");
+  const remedy = nestedAction?.command ? ` Give it its own encrypted remote with: ${nestedAction.command}` : "";
+  return `Encrypted remote skipped: ${repo.reason ?? "skipped"}${where}.${remedy}`;
+}
+
 function formatLegacyUpSuccess(result) {
   const urls = result?.result?.deploy?.urls ?? {};
   const origin = urls.site ?? urls.subdomain ?? urls.deployment;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.80.0",
+  "version": "4.80.1",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {