keboola-cli 0.64.0__tar.gz → 0.65.0__tar.gz

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/CLAUDE.md

@@ -424,13 +424,26 @@ kbagent workspace from-transformation --project ALIAS --component-id ID --config
 
 kbagent data-app list [--project NAME ...] [--branch ID]
 kbagent data-app detail --project NAME --app-id ID [--branch ID]
-kbagent data-app create --project ALIAS --name NAME --slug SLUG --git-repo URL [--description STR | --description-file PATH] [--git-branch main] [--git-public/--no-git-public] [--git-username USER] [--git-pat-env VAR | --git-pat-file PATH | --git-pat-encrypted KBC::Project...] [--auth password|public] [--size tiny|small|medium|large] [--auto-suspend SECONDS] [--type python-js|python|streamlit|r|...] [--branch ID] [--no-deploy] [--wait] [--timeout SECONDS] [--keep-on-failure] [--dry-run]
+kbagent data-app create --project ALIAS --name NAME --slug SLUG (--git-repo URL | --use-managed-git-repo) [--description STR | --description-file PATH] [--git-branch main] [--git-public/--no-git-public] [--git-username USER] [--git-pat-env VAR | --git-pat-file PATH | --git-pat-encrypted KBC::Project...] [--auth password|public] [--size tiny|small|medium|large] [--auto-suspend SECONDS] [--type python-js|python|streamlit|r|...] [--branch ID] [--no-deploy] [--wait] [--timeout SECONDS] [--keep-on-failure] [--dry-run]
+# Exactly one git source is required: --git-repo URL (external) OR --use-managed-git-repo (0.65.0+).
+# --use-managed-git-repo provisions an EMPTY Keboola-hosted repo (POST useManagedGitRepo:true), writes
+#   NO parameters.dataApp.git block, and forces --no-deploy (nothing to run yet). Mutually exclusive with
+#   --git-repo and all --git-*/PAT auth flags. Full flow to a RUNNING managed-repo app (0.65.0+):
+#   (1) create --use-managed-git-repo -> (2) `git-credentials-create --type http_token --permissions
+#   readWrite` + `git push` code to the managed repo URL (from `git-repo`) -> (3) `data-app
+#   git-bind-credential` (mints an http_token ON the app, encrypts it under the project KMS, and writes
+#   parameters.dataApp.git so the runtime's `git clone` can authenticate -- required on stacks that do NOT
+#   inject managed-repo creds at deploy time) -> (4) `data-app deploy`. deploy pins the LATEST
+#   configVersion when a git block is present and omits it for a PURE managed repo (deploys from
+#   managedGitRepoId). Use `data-app runs` to debug a deploy that reverts to stopped (setup-phase
+#   failures, e.g. git-clone "could not read Username", produce no container logs).
 kbagent data-app deploy --project NAME --app-id ID [--config-version N] [--wait] [--timeout SECONDS] [--branch ID]
 kbagent data-app start --project NAME --app-id ID [--wait] [--timeout SECONDS]
 kbagent data-app stop --project NAME --app-id ID [--wait] [--timeout SECONDS]
 kbagent data-app delete --project NAME --app-id ID [--yes]
 kbagent data-app password --project NAME --app-id ID
 kbagent data-app logs --project NAME --app-id ID [--lines N] [--since ISO8601]
+kbagent data-app runs --project NAME --app-id ID [--limit N]
 kbagent data-app secrets-set --project ALIAS --app-id ID --secret '#KEY=VALUE' [--secret ...] [--secrets-file PATH] [--branch ID] [--allow-plaintext-on-encrypt-failure] [--dry-run] [--no-hint-next]
 kbagent data-app secrets-list --project ALIAS --app-id ID [--branch ID] [--show-fingerprint]
 kbagent data-app secrets-get --project ALIAS --app-id ID --key 'KEY' [--branch ID]   # '#' optional; plain values return their value, encrypted return metadata only
@@ -441,6 +454,7 @@ kbagent data-app git-branches --project NAME --app-id ID
 kbagent data-app git-entrypoints --project NAME --app-id ID
 kbagent data-app git-credentials --project NAME --app-id ID
 kbagent data-app git-credentials-create --project NAME --app-id ID --type ssh_key|http_token --permissions readOnly|readWrite [--public-key KEY | --public-key-file PATH] [--name LABEL] [--yes]
+kbagent data-app git-bind-credential --project NAME --app-id ID [--branch-name main] [--permissions readOnly|readWrite] [--dry-run]
 # git-repo/git-branches/git-entrypoints introspect the deployed-from git repo (sandboxes-service /apps/{id}/git-repo/*); they return 409 "no Git repository configured" until the app has been DEPLOYED at least once (git config syncs Storage->DS record at deploy). git-credentials* manage credentials for a MANAGED repo only; apps from `data-app create --git-repo` are external => git-credentials-create returns 409. http_token mints a ONE-TIME secret (shown once); credentials endpoints need an admin storage token.
 
 kbagent component list [--project NAME] [--type TYPE] [--query QUERY]

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keboola-cli
-Version: 0.64.0
+Version: 0.65.0
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: MIT

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.64.0"
+version = "0.65.0"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/changelog.py

@@ -24,6 +24,48 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
+    "0.65.0": [
+        "New: deploy a data app from a Keboola-MANAGED git repository end-to-end. "
+        "`data-app create --use-managed-git-repo` provisions an EMPTY Keboola-hosted repo (POST "
+        "`useManagedGitRepo:true`, no `parameters.dataApp.git` block, forces `--no-deploy`; "
+        "mutually exclusive with `--git-repo` and every `--git-*`/PAT flag). The full flow to a "
+        "running app: create -> `git-credentials-create --type http_token --permissions readWrite` "
+        "+ `git push` to the managed URL -> `data-app git-bind-credential` -> `data-app deploy`. "
+        "Verified live (tic-tac-toe serving from a managed repo).",
+        "New: `data-app git-bind-credential --project P --app-id ID [--branch-name main] "
+        "[--permissions readOnly|readWrite]` mints an `http_token` ON the app, encrypts it under "
+        "the project KMS, and writes `parameters.dataApp.git` (repository + placeholder username + "
+        "encrypted `#password` + branch). Required on stacks that do not inject managed-repo "
+        "credentials at deploy time -- without it the runtime's `git clone` of the managed repo "
+        "fails `could not read Username` and the deploy reverts to stopped. The token is encrypted "
+        "in place and never printed; `--dry-run` previews what would be wired without minting the "
+        "one-time credential or touching the config.",
+        "New: `data-app runs --project P --app-id ID [--limit N]` lists a data app's recent "
+        "deployment attempts with `failure_reason` + `startup_logs`, including setup-phase failures "
+        "(e.g. a git-clone error during `app_setup`) that produce no container logs. It works on "
+        "never-started / failed apps where `data-app logs` returns HTTP 400 -- the canonical way to "
+        "find out why a deploy reverted to `stopped` without the app ever serving.",
+        "Fix: `data-app deploy` now resolves the deployed `configVersion` by source location -- it "
+        "pins the latest Storage version when a git block is present (external repos AND a "
+        "credential-wired managed repo) so the operator reads the current source, and omits "
+        "`configVersion` only for a pure managed repo (deploys from `app.managedGitRepoId`). "
+        "Previously it always pinned, which pointed managed-repo deploys at a config snapshot with "
+        "no git source and made them silently revert to stopped.",
+        "UX: when `data-app deploy --wait` times out or the app reaches state=error, the error now "
+        "auto-fetches the latest run's `failure_reason` (via /apps/{id}/runs) and includes it inline "
+        '-- including setup-phase failures with no container logs -- instead of a bare "timed out" '
+        "message. A managed-repo clone-auth failure (`could not read Username`) adds an actionable "
+        "hint to run `data-app git-bind-credential`. The diagnostic is best-effort and never masks "
+        "the original error.",
+        "All of the above are mirrored 1:1 on the `kbagent serve` REST API "
+        "(`/data-app/.../runs`, `/data-app/.../git-repo/bind-credential`, and the "
+        "`use_managed_git_repo` field on create).",
+        "New (#446): the `install.sh` bootstrap got a first-run onboarding pass -- it "
+        "auto-installs `uv` when it is missing (opt out with `KBAGENT_NO_UV_BOOTSTRAP=1`), quiets "
+        "the install output behind tidy step lines, and finishes with a Keboola banner plus a "
+        "'next steps' footer (`kbagent project add`, `kbagent --help`) so first-time users know "
+        "what to run next.",
+    ],
     "0.64.0": [
         "New: data-app git-repo introspection + managed-repo credentials -- five `data-app "
         "git-*` commands over the sandboxes-service `/apps/{id}/git-repo/*` endpoints. "

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/commands/_data_app_git.py

@@ -341,3 +341,70 @@ def register_git_commands(app: typer.Typer) -> None:
                 )
 
         formatter.output(result, _human)
+
+    @app.command("git-bind-credential")
+    def data_app_git_bind_credential(
+        ctx: typer.Context,
+        project: str = typer.Option(..., "--project", help="Project alias"),
+        app_id: str = typer.Option(..., "--app-id", help="Data Science numeric app id"),
+        branch: str = typer.Option(
+            "main", "--branch-name", help="Managed-repo branch to deploy from (default main)."
+        ),
+        permissions: str = typer.Option(
+            "readOnly",
+            "--permissions",
+            help="Credential access level: readOnly (default) | readWrite.",
+        ),
+        dry_run: bool = typer.Option(
+            False,
+            "--dry-run",
+            help="Preview what would be wired (repo/branch/permissions) WITHOUT minting a credential or editing the config.",
+        ),
+    ) -> None:
+        """Make a MANAGED-repo app deployable by wiring a credential into its config.
+
+        A `--use-managed-git-repo` app owns an empty Keboola-hosted repo but its
+        Storage config has no git block. On stacks that do NOT inject managed-repo
+        credentials at deploy time, the runtime's `git clone` of the managed repo
+        fails ("could not read Username") and the deploy reverts to stopped. This
+        command mints a fresh `http_token` ON the app, encrypts it under the
+        project KMS, and writes `parameters.dataApp.git` (repository + placeholder
+        username + encrypted `#password` + branch) so the next `data-app deploy`
+        can clone. The token is encrypted in-place and never printed.
+
+        `--dry-run` validates the app + resolves the managed repo URL but mints
+        nothing and leaves the config untouched -- the http_token is one-time, so
+        a real run that you abort would orphan it.
+        """
+        formatter = get_formatter(ctx)
+        service = get_service(ctx, "data_app_service")
+        try:
+            result = service.bind_managed_credential(
+                project, app_id, branch=branch, permissions=permissions, dry_run=dry_run
+            )
+        except KeboolaApiError as exc:
+            formatter.error(
+                message=exc.message,
+                error_code=exc.error_code,
+                retryable=exc.retryable,
+                details=exc.details,
+            )
+            raise typer.Exit(code=map_error_to_exit_code(exc)) from None
+        except ConfigError as exc:
+            formatter.error(message=exc.message, error_code=ErrorCode.CONFIG_ERROR)
+            raise typer.Exit(code=5) from None
+
+        def _human(c: Console, d: dict) -> None:
+            if d.get("dry_run"):
+                c.print("[bold]DRY RUN -- no credential minted, config unchanged.[/bold]")
+                c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
+                c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
+                c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
+                return
+            c.print(f"[bold green]Success:[/bold green] {d['message']}")
+            c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
+            c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
+            c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
+            c.print(f"  [bold]Config version:[/bold] {d.get('config_version', '')}")
+
+        formatter.output(result, _human)

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/commands/context.py

@@ -727,7 +727,8 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     Full merged view: state, desiredState, url, deployed configVersion, slug,
     runtime size, git settings (PAT redacted as <encrypted>).
 
-  kbagent data-app create --project ALIAS --name NAME --slug SLUG --git-repo URL
+  kbagent data-app create --project ALIAS --name NAME --slug SLUG
+    (--git-repo URL | --use-managed-git-repo)
     [--description STR | --description-file PATH] [--git-branch main]
     [--git-public/--no-git-public] [--git-username USER]
     [--git-pat-env VAR | --git-pat-file PATH | --git-pat-encrypted KBC::Project...]
@@ -740,6 +741,13 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     Pre-encrypted PATs MUST start with KBC::Project (project-scoped KMS).
     Cleanup-in-finally if PUT or initial deploy fails (orphan shell deleted
     by default; --keep-on-failure preserves it for forensics).
+    --use-managed-git-repo (0.65.0+) provisions an EMPTY Keboola-hosted repo
+    instead of cloning an external one; writes no git block, forces --no-deploy,
+    mutually exclusive with --git-repo and all --git-*/PAT flags. Managed deploy
+    works via: create --use-managed-git-repo -> git-credentials-create
+    --type http_token + push code to the managed repo URL ->
+    `data-app git-bind-credential` (wires an encrypted credential into the
+    config) -> deploy.
 
   kbagent data-app deploy --project NAME --app-id ID [--config-version N]
     [--wait] [--timeout SECONDS] [--branch ID]
@@ -783,6 +791,13 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     the app printed to stdout/stderr -- consider hygiene before piping
     --json output into AI agent context.
 
+  kbagent data-app runs --project NAME --app-id ID [--limit N]
+    List deployment attempts (runs) newest-first with failure_reason +
+    startup_logs, including setup-phase failures (e.g. git-clone errors)
+    that produce no container logs. Works on never-started/failed apps
+    where 'data-app logs' returns HTTP 400 -- the canonical way to find
+    WHY a deploy reverted to stopped. Project storage token only.
+
   kbagent data-app secrets-set --project ALIAS --app-id ID --secret '#KEY=VALUE'
         [--secret '#KEY2=VALUE2' ...] [--secrets-file PATH] [--branch ID]
         [--allow-plaintext-on-encrypt-failure] [--dry-run] [--no-hint-next]
@@ -866,6 +881,15 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     are EXTERNAL (not managed) -> 409 "no managed Git repository".
     Confirmation prompt unless --yes or --json.
 
+  kbagent data-app git-bind-credential --project NAME --app-id ID
+        [--branch-name main] [--permissions readOnly|readWrite] [--dry-run]
+    Mint an http_token ON the app's MANAGED repo, encrypt it under the
+    project KMS, and wire it into parameters.dataApp.git (repository +
+    placeholder username + encrypted #password + branch) so the runtime can
+    `git clone` the managed repo at deploy time. Needed on stacks that do
+    NOT inject managed-repo credentials at deploy (clone fails with "could
+    not read Username"). The token is encrypted in-place and never printed.
+
 ### Project Sync
 
   kbagent sync init --project ALIAS [--directory DIR] [--git-branching] [--adopt-existing]

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/commands/data_app.py

@@ -211,7 +211,24 @@ def data_app_create(
     slug: str = typer.Option(
         ..., "--slug", help="URL slug (lowercase alphanumeric, hyphens; 2-64 chars)"
     ),
-    git_repo: str = typer.Option(..., "--git-repo", help="GitHub repository URL"),
+    git_repo: str = typer.Option(
+        "",
+        "--git-repo",
+        help=(
+            "External git repository URL to deploy from. Required unless "
+            "--use-managed-git-repo is set (mutually exclusive with it)."
+        ),
+    ),
+    use_managed_git_repo: bool = typer.Option(
+        False,
+        "--use-managed-git-repo",
+        help=(
+            "Provision an empty Keboola-managed git repository for the app "
+            "instead of cloning an external one. Mints code via "
+            "`data-app git-credentials-create`, then push + deploy. "
+            "Mutually exclusive with --git-repo and all --git-* auth flags."
+        ),
+    ),
     git_branch: str = typer.Option("main", "--git-branch", help="Git branch to clone"),
     git_public: bool = typer.Option(
         False,
@@ -310,6 +327,23 @@ def data_app_create(
             )
             raise typer.Exit(code=2) from None
 
+    # Source-of-code selection: exactly one of an external --git-repo or a
+    # Keboola --use-managed-git-repo. Catch the two obvious mistakes at the CLI
+    # boundary with a clean usage error (the service re-checks the full flag
+    # matrix defensively for non-CLI callers).
+    if use_managed_git_repo and git_repo:
+        formatter.error(
+            message="--use-managed-git-repo is mutually exclusive with --git-repo.",
+            error_code=ErrorCode.USAGE_ERROR,
+        )
+        raise typer.Exit(code=2)
+    if not use_managed_git_repo and not git_repo:
+        formatter.error(
+            message="One of --git-repo or --use-managed-git-repo is required.",
+            error_code=ErrorCode.USAGE_ERROR,
+        )
+        raise typer.Exit(code=2)
+
     # Mutual exclusion of git PAT input modes (CLI layer).
     pat_inputs_set = sum(1 for v in (git_pat_env, git_pat_file, git_pat_encrypted) if v is not None)
     if pat_inputs_set > 1:
@@ -342,6 +376,7 @@ def data_app_create(
             git_username=git_username,
             git_pat_plaintext=pat_plaintext,
             git_pat_encrypted=git_pat_encrypted,
+            use_managed_git_repo=use_managed_git_repo,
             auth=auth,
             size=size,
             auto_suspend_after_seconds=auto_suspend,
@@ -377,6 +412,9 @@ def data_app_create(
             )
             formatter.console.print(f"  [bold]App ID:[/bold] {result['app_id']}")
             formatter.console.print(f"  [bold]Config ID:[/bold] {result['config_id']}")
+            if result.get("use_managed_git_repo"):
+                repo_id = result.get("managed_git_repo_id") or "(provisioning)"
+                formatter.console.print(f"  [bold]Managed git repo:[/bold] {repo_id}")
             if result.get("url"):
                 formatter.console.print(f"  [bold]URL:[/bold] {result['url']}")
             formatter.console.print(
@@ -726,6 +764,67 @@ def data_app_logs(
     formatter.output(result, _print_logs)
 
 
+@data_app_app.command("runs")
+def data_app_runs(
+    ctx: typer.Context,
+    project: str = typer.Option(..., "--project", help="Project alias"),
+    app_id: str = typer.Option(..., "--app-id", help="Data Science numeric app id"),
+    limit: int = typer.Option(5, "--limit", help="Max runs to return (newest first)."),
+) -> None:
+    """List a data app's recent deployment attempts (runs), newest first.
+
+    Unlike ``data-app logs`` (which needs a running container), ``runs`` works on
+    never-started / failed apps and surfaces the ``failure_reason`` +
+    ``startup_logs`` the platform records for each attempt -- including
+    setup-phase failures (e.g. a git-clone error during ``app_setup``) that
+    produce no container logs. This is the way to find out *why* a deploy
+    reverted to ``stopped`` without the app ever serving.
+
+    Auth: project Storage token only.
+    """
+    formatter = get_formatter(ctx)
+    service = get_service(ctx, "data_app_service")
+    try:
+        result = service.list_app_runs(project, app_id, limit=limit)
+    except KeboolaApiError as exc:
+        formatter.error(
+            message=exc.message,
+            error_code=exc.error_code,
+            retryable=exc.retryable,
+            details=exc.details,
+        )
+        raise typer.Exit(code=map_error_to_exit_code(exc)) from None
+    except ConfigError as exc:
+        formatter.error(message=exc.message, error_code=ErrorCode.CONFIG_ERROR)
+        raise typer.Exit(code=5) from None
+
+    def _human(c: Console, d: dict) -> None:
+        runs = d.get("runs", [])
+        if not runs:
+            c.print("[dim]No runs found.[/dim]")
+            return
+        c.print(
+            f"\n[bold]{d['count']} run(s)[/bold] for data app "
+            f"[cyan]{escape(str(d['app_id']))}[/cyan] in "
+            f"[magenta]{escape(d['project_alias'])}[/magenta]"
+        )
+        for r in runs:
+            state = r.get("state", "")
+            color = "green" if state in ("running", "finished") else "red"
+            c.print(
+                f"  [{color}]{state}[/{color}] {r.get('id', '')} (created {r.get('created_at')})"
+            )
+            fr = r.get("failure_reason")
+            if fr:
+                reason = fr.get("reason", "") if isinstance(fr, dict) else str(fr)
+                message = fr.get("message", "") if isinstance(fr, dict) else ""
+                c.print(f"    [red]reason:[/red] {escape(reason)}")
+                if message:
+                    c.print(f"    [dim]{escape(message)}[/dim]", markup=True, highlight=False)
+
+    formatter.output(result, _human)
+
+
 # ---------------------------------------------------------------------------
 # data-app validate-repo
 # ---------------------------------------------------------------------------

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/data_science_client.py

@@ -89,6 +89,26 @@ class DataScienceClient(BaseHttpClient):
         response = self._do_request("GET", f"/apps/{quote(str(app_id), safe='')}")
         return response.json()
 
+    def list_app_runs(
+        self, app_id: str, *, limit: int = 5, offset: int = 0
+    ) -> list[dict[str, Any]]:
+        """List deployment attempts (runs) of a data app, newest first.
+
+        Each run carries ``state`` (starting/running/finished/failed) plus a
+        ``failureReason`` and ``startupLogs`` for unsuccessful attempts --
+        including setup-phase failures (e.g. a clone/build error) that never
+        produce container logs and so are invisible to ``/apps/{id}/logs/tail``.
+        This is the canonical way to find out *why* a deploy reverted to
+        ``stopped`` without the app ever serving.
+        """
+        response = self._do_request(
+            "GET",
+            f"/apps/{quote(str(app_id), safe='')}/runs",
+            params={"limit": limit, "offset": offset},
+        )
+        payload = response.json()
+        return payload if isinstance(payload, list) else payload.get("runs", [])
+
     def create_app(
         self,
         *,
@@ -97,6 +117,7 @@ class DataScienceClient(BaseHttpClient):
         description: str,
         config: dict[str, Any],
         branch_id: int | None = None,
+        use_managed_git_repo: bool = False,
     ) -> dict[str, Any]:
         """Create the deployment shell + linked Storage config in one call.
 
@@ -111,6 +132,14 @@ class DataScienceClient(BaseHttpClient):
         possible but the encryption step depends on knowing
         ``config_id`` first, so the canonical flow is:
         ``create_app`` -> encrypt secrets -> ``update_config``.
+
+        ``use_managed_git_repo`` -> POST ``useManagedGitRepo: true`` so the
+        sandboxes-service provisions a *managed* git repository on the Git
+        Service and links it to the app (``managedGitRepoId``). The repo
+        starts empty -- the caller mints a credential
+        (``create_git_credential``), pushes code, then deploys. Repo
+        creation failure aborts app creation server-side; the repo is
+        deleted when the app is deleted.
         """
         payload: dict[str, Any] = {
             "branchId": branch_id,
@@ -119,6 +148,8 @@ class DataScienceClient(BaseHttpClient):
             "description": description,
             "config": config,
         }
+        if use_managed_git_repo:
+            payload["useManagedGitRepo"] = True
         response = self._do_request(
             "POST",
             "/apps",
@@ -146,6 +177,14 @@ class DataScienceClient(BaseHttpClient):
         ``desired_state="running"`` + ``config_version=<N>``
         + ``restart_if_running=True`` together when bumping the deployed
         config version; sending ``config_version`` alone yields HTTP 422.
+
+        EXCEPTION (python-js managed repos): a *pure* managed-repo app
+        (``useManagedGitRepo``, no ``parameters.dataApp.git`` block) deploys its
+        source from ``app.managedGitRepoId``, not from a Storage configVersion,
+        so the caller passes ``config_version=None`` and this PATCH omits the
+        field entirely -- payload ``{desiredState, restartIfRunning}``. This
+        matches keboola-mcp-server / Kai behavior; see
+        ``DataAppService.deploy_data_app`` for the source-location branch.
         """
         payload: dict[str, Any] = {}
         if desired_state is not None:

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/permissions.py

@@ -154,6 +154,7 @@ OPERATION_REGISTRY: dict[str, str] = {
     "data-app.detail": "read",
     "data-app.password": "read",
     "data-app.logs": "read",
+    "data-app.runs": "read",
     "data-app.create": "write",
     "data-app.deploy": "write",
     "data-app.start": "write",
@@ -171,6 +172,7 @@ OPERATION_REGISTRY: dict[str, str] = {
     "data-app.git-entrypoints": "read",
     "data-app.git-credentials": "read",
     "data-app.git-credentials-create": "write",
+    "data-app.git-bind-credential": "write",
     # Developer Portal — identity sub-app leaves (composed by the
     # identity_app callback as "dev-portal.identity.<subcommand>")
     "dev-portal.identity.add": "write",

{keboola_cli-0.64.0 → keboola_cli-0.65.0}/src/keboola_agent_cli/server/routers/data_apps.py

@@ -39,7 +39,10 @@ class DataAppCreate(BaseModel):
     name: str
     description: str = ""
     slug: str
-    git_repo: str
+    # Exactly one git source: an external git_repo URL OR use_managed_git_repo.
+    # The service validates the mutex (and the rest of the flag matrix).
+    git_repo: str = ""
+    use_managed_git_repo: bool = False
     git_branch: str = "main"
     git_public: bool = False
     git_username: str | None = None
@@ -87,6 +90,13 @@ class GitCredentialCreate(BaseModel):
     name: str | None = None
 
 
+class GitBindCredential(BaseModel):
+    branch: str = "main"
+    permissions: str = "readOnly"
+    branch_id: int | None = None
+    dry_run: bool = False
+
+
 @router.get("", summary="List data apps across projects")
 def list_apps(
     project: list[str] | None = Query(None),
@@ -124,6 +134,7 @@ def create(
         git_username=body.git_username,
         git_pat_plaintext=body.git_pat_plaintext,
         git_pat_encrypted=body.git_pat_encrypted,
+        use_managed_git_repo=body.use_managed_git_repo,
         auth=body.auth,
         size=body.size,
         auto_suspend_after_seconds=body.auto_suspend_after_seconds,
@@ -382,3 +393,48 @@ def git_credentials_create(
         public_key=body.public_key,
         name=body.name,
     )
+
+
+@router.get("/{project}/{app_id}/runs", summary="List a data app's deployment attempts")
+def runs(
+    project: str,
+    app_id: str,
+    limit: int = 5,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """List recent deployment attempts (runs) with failure reasons.
+
+    Mirrors `kbagent data-app runs`. Each run carries `failure_reason` +
+    `startup_logs`, including setup-phase failures (e.g. a git-clone error) that
+    produce no container logs; works on never-started / failed apps where the
+    logs endpoint returns HTTP 400.
+    """
+    return registry.data_app.list_app_runs(project, app_id, limit=limit)
+
+
+@router.post(
+    "/{project}/{app_id}/git-repo/bind-credential",
+    summary="Wire a managed-repo credential into a data app's config",
+)
+def git_bind_credential(
+    project: str,
+    app_id: str,
+    body: GitBindCredential,
+    registry: ServiceRegistry = Depends(get_registry),
+) -> dict[str, Any]:
+    """Make a MANAGED-repo app deployable by wiring a credential into its config.
+
+    Mirrors `kbagent data-app git-bind-credential`. Mints an `http_token` on the
+    app, encrypts it under the project KMS, and writes `parameters.dataApp.git`
+    so the runtime can clone the managed repo at deploy. The token is encrypted
+    in place and never returned. Needs an admin storage token; non-managed apps
+    are rejected.
+    """
+    return registry.data_app.bind_managed_credential(
+        project,
+        app_id,
+        branch=body.branch,
+        permissions=body.permissions,
+        branch_id=body.branch_id,
+        dry_run=body.dry_run,
+    )