keboola-cli 0.65.0__tar.gz → 0.65.1__tar.gz

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/CLAUDE.md

@@ -430,13 +430,11 @@ kbagent data-app create --project ALIAS --name NAME --slug SLUG (--git-repo URL
 #   NO parameters.dataApp.git block, and forces --no-deploy (nothing to run yet). Mutually exclusive with
 #   --git-repo and all --git-*/PAT auth flags. Full flow to a RUNNING managed-repo app (0.65.0+):
 #   (1) create --use-managed-git-repo -> (2) `git-credentials-create --type http_token --permissions
-#   readWrite` + `git push` code to the managed repo URL (from `git-repo`) -> (3) `data-app
-#   git-bind-credential` (mints an http_token ON the app, encrypts it under the project KMS, and writes
-#   parameters.dataApp.git so the runtime's `git clone` can authenticate -- required on stacks that do NOT
-#   inject managed-repo creds at deploy time) -> (4) `data-app deploy`. deploy pins the LATEST
-#   configVersion when a git block is present and omits it for a PURE managed repo (deploys from
-#   managedGitRepoId). Use `data-app runs` to debug a deploy that reverts to stopped (setup-phase
-#   failures, e.g. git-clone "could not read Username", produce no container logs).
+#   readWrite` + `git push` code to the managed repo URL (from `git-repo`) -> (3) `data-app deploy`.
+#   The platform injects the clone credentials at deploy time, so no credential wiring is needed.
+#   deploy pins the LATEST configVersion when a git block is present and omits it for a PURE managed
+#   repo (deploys from managedGitRepoId). Use `data-app runs` to debug a deploy that reverts to
+#   stopped (setup-phase failures produce no container logs).
 kbagent data-app deploy --project NAME --app-id ID [--config-version N] [--wait] [--timeout SECONDS] [--branch ID]
 kbagent data-app start --project NAME --app-id ID [--wait] [--timeout SECONDS]
 kbagent data-app stop --project NAME --app-id ID [--wait] [--timeout SECONDS]
@@ -454,7 +452,6 @@ kbagent data-app git-branches --project NAME --app-id ID
 kbagent data-app git-entrypoints --project NAME --app-id ID
 kbagent data-app git-credentials --project NAME --app-id ID
 kbagent data-app git-credentials-create --project NAME --app-id ID --type ssh_key|http_token --permissions readOnly|readWrite [--public-key KEY | --public-key-file PATH] [--name LABEL] [--yes]
-kbagent data-app git-bind-credential --project NAME --app-id ID [--branch-name main] [--permissions readOnly|readWrite] [--dry-run]
 # git-repo/git-branches/git-entrypoints introspect the deployed-from git repo (sandboxes-service /apps/{id}/git-repo/*); they return 409 "no Git repository configured" until the app has been DEPLOYED at least once (git config syncs Storage->DS record at deploy). git-credentials* manage credentials for a MANAGED repo only; apps from `data-app create --git-repo` are external => git-credentials-create returns 409. http_token mints a ONE-TIME secret (shown once); credentials endpoints need an admin storage token.
 
 kbagent component list [--project NAME] [--type TYPE] [--query QUERY]

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keboola-cli
-Version: 0.65.0
+Version: 0.65.1
 Summary: AI-friendly CLI for managing Keboola projects
 Author-email: Keboola <dev@keboola.com>
 License-Expression: MIT

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "keboola-cli"
-version = "0.65.0"
+version = "0.65.1"
 description = "AI-friendly CLI for managing Keboola projects"
 readme = "README.md"
 requires-python = ">=3.12"

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/changelog.py

@@ -24,6 +24,21 @@ from .constants import CHANGELOG_HEADLINE_MAX_CHARS
 
 # Ordered newest-first.  Each value is a list of brief one-line descriptions.
 CHANGELOG: dict[str, list[str]] = {
+    "0.65.1": [
+        "BREAKING: Removed `data-app git-bind-credential` (and its `kbagent serve` endpoint). It shipped in "
+        "0.65.0 on a misdiagnosis: managed-repo deploys were failing and we believed the platform "
+        "did not inject the git-clone credential, so the command wired an encrypted credential into "
+        "`parameters.dataApp.git`. A clean reproduction on `data-science.us-east4.gcp` confirmed the "
+        "platform DOES inject the clone credential at deploy time (matching the sandboxes-service "
+        "`testManagedGitRepo.sh` contract) -- the command was unnecessary. The real fix was the "
+        "0.65.0 `configVersion`-omit change; pinning a managed app's no-git-block config is what made "
+        "the runtime demand `dataApp.git.repository` and revert the deploy to stopped.",
+        "Change: Corrected the managed-repo guidance everywhere: the canonical flow is `data-app create "
+        "--use-managed-git-repo` -> `git-credentials-create --type http_token --permissions readWrite` "
+        "+ `git push` your code -> `data-app deploy`. No credential wiring is needed. The earlier "
+        "'platform does not inject credentials' / `could not read Username` framing was wrong "
+        "(GitHub issue #454 closed as not-a-bug).",
+    ],
     "0.65.0": [
         "New: deploy a data app from a Keboola-MANAGED git repository end-to-end. "
         "`data-app create --use-managed-git-repo` provisions an EMPTY Keboola-hosted repo (POST "
@@ -39,7 +54,9 @@ CHANGELOG: dict[str, list[str]] = {
         "credentials at deploy time -- without it the runtime's `git clone` of the managed repo "
         "fails `could not read Username` and the deploy reverts to stopped. The token is encrypted "
         "in place and never printed; `--dry-run` previews what would be wired without minting the "
-        "one-time credential or touching the config.",
+        "one-time credential or touching the config. (Removed in 0.65.1 -- this was based on a "
+        "misdiagnosis; the platform does inject the clone credential, so the command was "
+        "unnecessary. See the 0.65.1 notes.)",
         "New: `data-app runs --project P --app-id ID [--limit N]` lists a data app's recent "
         "deployment attempts with `failure_reason` + `startup_logs`, including setup-phase failures "
         "(e.g. a git-clone error during `app_setup`) that produce no container logs. It works on "

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/commands/_data_app_git.py

@@ -341,70 +341,3 @@ def register_git_commands(app: typer.Typer) -> None:
                 )
 
         formatter.output(result, _human)
-
-    @app.command("git-bind-credential")
-    def data_app_git_bind_credential(
-        ctx: typer.Context,
-        project: str = typer.Option(..., "--project", help="Project alias"),
-        app_id: str = typer.Option(..., "--app-id", help="Data Science numeric app id"),
-        branch: str = typer.Option(
-            "main", "--branch-name", help="Managed-repo branch to deploy from (default main)."
-        ),
-        permissions: str = typer.Option(
-            "readOnly",
-            "--permissions",
-            help="Credential access level: readOnly (default) | readWrite.",
-        ),
-        dry_run: bool = typer.Option(
-            False,
-            "--dry-run",
-            help="Preview what would be wired (repo/branch/permissions) WITHOUT minting a credential or editing the config.",
-        ),
-    ) -> None:
-        """Make a MANAGED-repo app deployable by wiring a credential into its config.
-
-        A `--use-managed-git-repo` app owns an empty Keboola-hosted repo but its
-        Storage config has no git block. On stacks that do NOT inject managed-repo
-        credentials at deploy time, the runtime's `git clone` of the managed repo
-        fails ("could not read Username") and the deploy reverts to stopped. This
-        command mints a fresh `http_token` ON the app, encrypts it under the
-        project KMS, and writes `parameters.dataApp.git` (repository + placeholder
-        username + encrypted `#password` + branch) so the next `data-app deploy`
-        can clone. The token is encrypted in-place and never printed.
-
-        `--dry-run` validates the app + resolves the managed repo URL but mints
-        nothing and leaves the config untouched -- the http_token is one-time, so
-        a real run that you abort would orphan it.
-        """
-        formatter = get_formatter(ctx)
-        service = get_service(ctx, "data_app_service")
-        try:
-            result = service.bind_managed_credential(
-                project, app_id, branch=branch, permissions=permissions, dry_run=dry_run
-            )
-        except KeboolaApiError as exc:
-            formatter.error(
-                message=exc.message,
-                error_code=exc.error_code,
-                retryable=exc.retryable,
-                details=exc.details,
-            )
-            raise typer.Exit(code=map_error_to_exit_code(exc)) from None
-        except ConfigError as exc:
-            formatter.error(message=exc.message, error_code=ErrorCode.CONFIG_ERROR)
-            raise typer.Exit(code=5) from None
-
-        def _human(c: Console, d: dict) -> None:
-            if d.get("dry_run"):
-                c.print("[bold]DRY RUN -- no credential minted, config unchanged.[/bold]")
-                c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
-                c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
-                c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
-                return
-            c.print(f"[bold green]Success:[/bold green] {d['message']}")
-            c.print(f"  [bold]Repository:[/bold] {d.get('repository', '')}")
-            c.print(f"  [bold]Branch:[/bold] {d.get('branch', '')}")
-            c.print(f"  [bold]Permissions:[/bold] {d.get('permissions', '')}")
-            c.print(f"  [bold]Config version:[/bold] {d.get('config_version', '')}")
-
-        formatter.output(result, _human)

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/commands/context.py

@@ -745,9 +745,9 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     instead of cloning an external one; writes no git block, forces --no-deploy,
     mutually exclusive with --git-repo and all --git-*/PAT flags. Managed deploy
     works via: create --use-managed-git-repo -> git-credentials-create
-    --type http_token + push code to the managed repo URL ->
-    `data-app git-bind-credential` (wires an encrypted credential into the
-    config) -> deploy.
+    --type http_token --permissions readWrite + push code to the managed repo
+    URL -> deploy. The platform injects the clone credentials at deploy time,
+    so no credential wiring is needed.
 
   kbagent data-app deploy --project NAME --app-id ID [--config-version N]
     [--wait] [--timeout SECONDS] [--branch ID]
@@ -881,15 +881,6 @@ git block, slug, runtime size, encrypted secrets) with the Data Science API
     are EXTERNAL (not managed) -> 409 "no managed Git repository".
     Confirmation prompt unless --yes or --json.
 
-  kbagent data-app git-bind-credential --project NAME --app-id ID
-        [--branch-name main] [--permissions readOnly|readWrite] [--dry-run]
-    Mint an http_token ON the app's MANAGED repo, encrypt it under the
-    project KMS, and wire it into parameters.dataApp.git (repository +
-    placeholder username + encrypted #password + branch) so the runtime can
-    `git clone` the managed repo at deploy time. Needed on stacks that do
-    NOT inject managed-repo credentials at deploy (clone fails with "could
-    not read Username"). The token is encrypted in-place and never printed.
-
 ### Project Sync
 
   kbagent sync init --project ALIAS [--directory DIR] [--git-branching] [--adopt-existing]

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/permissions.py

@@ -172,7 +172,6 @@ OPERATION_REGISTRY: dict[str, str] = {
     "data-app.git-entrypoints": "read",
     "data-app.git-credentials": "read",
     "data-app.git-credentials-create": "write",
-    "data-app.git-bind-credential": "write",
     # Developer Portal — identity sub-app leaves (composed by the
     # identity_app callback as "dev-portal.identity.<subcommand>")
     "dev-portal.identity.add": "write",

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/server/routers/data_apps.py

@@ -90,13 +90,6 @@ class GitCredentialCreate(BaseModel):
     name: str | None = None
 
 
-class GitBindCredential(BaseModel):
-    branch: str = "main"
-    permissions: str = "readOnly"
-    branch_id: int | None = None
-    dry_run: bool = False
-
-
 @router.get("", summary="List data apps across projects")
 def list_apps(
     project: list[str] | None = Query(None),
@@ -410,31 +403,3 @@ def runs(
     logs endpoint returns HTTP 400.
     """
     return registry.data_app.list_app_runs(project, app_id, limit=limit)
-
-
-@router.post(
-    "/{project}/{app_id}/git-repo/bind-credential",
-    summary="Wire a managed-repo credential into a data app's config",
-)
-def git_bind_credential(
-    project: str,
-    app_id: str,
-    body: GitBindCredential,
-    registry: ServiceRegistry = Depends(get_registry),
-) -> dict[str, Any]:
-    """Make a MANAGED-repo app deployable by wiring a credential into its config.
-
-    Mirrors `kbagent data-app git-bind-credential`. Mints an `http_token` on the
-    app, encrypts it under the project KMS, and writes `parameters.dataApp.git`
-    so the runtime can clone the managed repo at deploy. The token is encrypted
-    in place and never returned. Needs an admin storage token; non-managed apps
-    are rejected.
-    """
-    return registry.data_app.bind_managed_credential(
-        project,
-        app_id,
-        branch=body.branch,
-        permissions=body.permissions,
-        branch_id=body.branch_id,
-        dry_run=body.dry_run,
-    )

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/src/keboola_agent_cli/services/data_app_service.py

@@ -87,13 +87,6 @@ MAX_GIT_REPO_LENGTH = 1024
 MAX_GIT_BRANCH_LENGTH = 255
 MAX_GIT_USERNAME_LENGTH = 255
 
-# Placeholder HTTPS basic-auth username written into a managed-repo git block.
-# The Keboola git-service ignores the username and only validates the token
-# (RFC: managed_repo_data_apps_mvp), so any non-secret value works; we never
-# put the token itself in this plaintext field.
-MANAGED_GIT_CREDENTIAL_USERNAME = "kbagent"
-DEFAULT_MANAGED_GIT_BRANCH = "main"
-
 POLL_INTERVAL_SECONDS = 5.0
 TERMINAL_ERROR_STATE = "error"
 RUNNING_STATE = "running"
@@ -792,18 +785,17 @@ class DataAppService(BaseService):
             # configVersion resolution depends on where the app's *source*
             # lives, which we infer from the latest Storage config:
             #
-            #  * Streamlit / external-git / a managed repo with a wired
-            #    credential block (parameters.dataApp.git present) -> the source
-            #    pointer lives IN the Storage config, so we PIN the latest
-            #    version. This stack resolves an omitted configVersion to the
-            #    previously-DEPLOYED snapshot, not the latest, so pinning is the
-            #    only way the operator reads a freshly-wired git block.
-            #  * A pure managed repo (useManagedGitRepo, NO git block) -> the
-            #    source resolves via app.managedGitRepoId, not a Storage
-            #    configVersion; we OMIT it (matches keboola-mcp-server / Kai).
-            #    NOTE: such apps only deploy on stacks where the platform injects
-            #    managed-repo credentials; otherwise wire one first with
-            #    `data-app git-bind-credential` (see gotchas.md).
+            #  * Streamlit / external-git (parameters.dataApp.git present) -> the
+            #    source pointer lives IN the Storage config, so we PIN the latest
+            #    version so the operator reads the current git block.
+            #  * A managed repo (useManagedGitRepo, NO git block) -> the source
+            #    resolves via app.managedGitRepoId and the platform injects the
+            #    clone credentials at deploy time, so we OMIT configVersion
+            #    (matches keboola-mcp-server / Kai and the sandboxes-service
+            #    `testManagedGitRepo.sh` contract). Pinning a managed app's
+            #    no-git-block config instead makes the runtime demand
+            #    `dataApp.git.repository` and the deploy fails -- that was the
+            #    pre-0.65.0 bug this branch fixes.
             #
             # An explicit --config-version always wins as an escape hatch.
             effective_version: str | None = config_version
@@ -859,173 +851,6 @@ class DataAppService(BaseService):
             if storage_client is not None:
                 storage_client.close()
 
-    def bind_managed_credential(
-        self,
-        alias: str,
-        app_id: str,
-        *,
-        branch: str = DEFAULT_MANAGED_GIT_BRANCH,
-        permissions: str = "readOnly",
-        branch_id: int | None = None,
-        dry_run: bool = False,
-    ) -> dict[str, Any]:
-        """Make a managed-repo app deployable by wiring a credential into its config.
-
-        A managed-repo (``useManagedGitRepo``) app owns an empty Keboola-hosted
-        git repo but carries no ``parameters.dataApp.git`` block. On stacks where
-        the platform injects managed-repo credentials at deploy time that is
-        enough; on stacks that do not, the data-app runtime's ``git clone`` of
-        the managed repo fails with ``could not read Username`` and the deploy
-        reverts to ``stopped``. This method closes that gap the same way Kai's
-        dev-twin flow does (RFC: managed_repo_data_apps_mvp): it
-
-        1. resolves the managed repo's HTTPS clone URL (``get_git_repo``),
-        2. mints a fresh ``http_token`` credential ON the app (``create_git_credential``),
-        3. encrypts that token under the project KMS (``_build_git_block``), and
-        4. writes ``parameters.dataApp.git = {repository, username, '#password', branch}``
-           into the Storage config.
-
-        The minted token never leaves this process in plaintext: it is encrypted
-        in-place and only the ``KBC::...`` ciphertext is persisted. ``username``
-        is a non-secret placeholder the git-service ignores. After binding, call
-        ``deploy_data_app`` to start the app.
-
-        Known limitation: the credential is minted BEFORE it is encrypted and
-        written to the config. If the encryption or ``update_config`` step fails,
-        the minted credential stays registered on the managed repo but its config
-        write never lands -- the one-time secret is lost and the credential is
-        orphaned (a harmless leaked slot). There is no rollback (the credential
-        DELETE endpoint is not wired here); re-running the command simply mints a
-        fresh credential and overwrites the git block.
-        """
-        projects = self.resolve_projects([alias])
-        project = projects[alias]
-        ds_client = self._ds_client_factory(project.stack_url, project.token)
-        storage_client: Any | None = None
-        try:
-            app = ds_client.get_app(app_id)
-            if not app.get("hasManagedGitRepo"):
-                raise KeboolaApiError(
-                    message=(
-                        f"Data app {app_id} has no managed git repository. "
-                        "bind-managed-credential only applies to apps created with "
-                        "--use-managed-git-repo; external repos already carry their "
-                        "own credentials."
-                    ),
-                    status_code=0,
-                    error_code=ErrorCode.VALIDATION_ERROR,
-                    retryable=False,
-                )
-            config_id = str(app.get("configId") or "")
-            if not config_id:
-                raise KeboolaApiError(
-                    message=f"Data app {app_id} has no associated configId",
-                    status_code=500,
-                    error_code=ErrorCode.API_ERROR,
-                    retryable=False,
-                )
-
-            repo = ds_client.get_git_repo(app_id)
-            https_url = str(repo.get("httpsUrl") or "")
-            if not https_url:
-                raise KeboolaApiError(
-                    message=(
-                        f"Managed git repo for app {app_id} returned no HTTPS clone "
-                        "URL; cannot wire an HTTPS credential."
-                    ),
-                    status_code=0,
-                    error_code=ErrorCode.API_ERROR,
-                    retryable=False,
-                )
-
-            if dry_run:
-                # Show exactly what WOULD be wired without minting a credential
-                # (which is one-time and would orphan if not written) or touching
-                # the Storage config. All validation above has already run.
-                return {
-                    "dry_run": True,
-                    "project_alias": alias,
-                    "app_id": str(app_id),
-                    "config_id": config_id,
-                    "repository": https_url,
-                    "branch": branch,
-                    "permissions": permissions,
-                    "username": MANAGED_GIT_CREDENTIAL_USERNAME,
-                    "message": (
-                        f"Dry run -- no credential minted, config unchanged. Would mint an "
-                        f"http_token ({permissions}) on app {app_id} and write "
-                        f"parameters.dataApp.git -> {https_url} (branch {branch})."
-                    ),
-                }
-
-            # Mint a credential ON the app's managed repo. The one-time secret is
-            # consumed immediately by the encryption step below and never returned.
-            credential = ds_client.create_git_credential(
-                app_id,
-                type_="http_token",
-                permissions=permissions,
-                name="kbagent-managed-deploy",
-            )
-            secret = str(credential.get("secret") or "")
-            if not secret:
-                raise KeboolaApiError(
-                    message=(
-                        "create_git_credential returned no one-time secret for the "
-                        "http_token; cannot wire the managed-repo credential."
-                    ),
-                    status_code=500,
-                    error_code=ErrorCode.API_ERROR,
-                    retryable=False,
-                )
-
-            git_block = self._build_git_block(
-                alias=alias,
-                git_repo=https_url,
-                git_branch=branch,
-                git_public=False,
-                git_username=MANAGED_GIT_CREDENTIAL_USERNAME,
-                git_pat_plaintext=secret,
-                git_pat_encrypted=None,
-            )
-
-            storage_client = self._client_factory(project.stack_url, project.token)
-            detail = storage_client.get_config_detail(
-                DATA_APP_COMPONENT_ID, config_id, branch_id=branch_id
-            )
-            configuration = _coerce_config_dict(detail.get("configuration"))
-            parameters = dict(configuration.get("parameters") or {})
-            data_app = dict(parameters.get("dataApp") or {})
-            data_app["git"] = git_block
-            parameters["dataApp"] = data_app
-            configuration["parameters"] = parameters
-
-            updated = storage_client.update_config(
-                component_id=DATA_APP_COMPONENT_ID,
-                config_id=config_id,
-                configuration=configuration,
-                change_description="Bind managed git credential for deploy (kbagent)",
-                branch_id=branch_id,
-            )
-            return {
-                "project_alias": alias,
-                "app_id": str(app_id),
-                "config_id": config_id,
-                "repository": https_url,
-                "branch": branch,
-                "permissions": permissions,
-                "credential_id": str(credential.get("id") or ""),
-                "config_version": str(updated.get("version", "") or ""),
-                "git": _redact_git_block(git_block),
-                "message": (
-                    f"Wired a managed-repo credential into data app {app_id}. "
-                    "Run `kbagent data-app deploy` to start it."
-                ),
-            }
-        finally:
-            ds_client.close()
-            if storage_client is not None:
-                storage_client.close()
-
     def list_app_runs(self, alias: str, app_id: str, *, limit: int = 5) -> dict[str, Any]:
         """List a data app's recent deployment attempts (runs), newest first.
 
@@ -2304,18 +2129,14 @@ class DataAppService(BaseService):
         self,
         ds_client: DataScienceClient,
         app_id: str,
-        *,
-        is_managed: bool,
     ) -> tuple[str, dict[str, Any]]:
         """Best-effort: fetch the latest run's ``failureReason`` to enrich a deploy
         error message. Returns ``(message_suffix, details)``; NEVER raises -- a
         diagnostic fetch failure must not mask the original deploy error.
 
-        Setup-phase failures (e.g. a managed-repo git-clone auth error) produce
-        no container logs, so ``data-app logs`` cannot show them; the run record
-        is the only place the reason surfaces. We also turn the most common
-        managed-repo failure (``could not read Username``) into an actionable
-        hint pointing at ``git-bind-credential``.
+        Setup-phase failures (e.g. a git-clone error) produce no container logs,
+        so ``data-app logs`` cannot show them; the run record is the only place
+        the reason surfaces.
         """
         try:
             runs = ds_client.list_app_runs(app_id, limit=1)
@@ -2337,14 +2158,6 @@ class DataAppService(BaseService):
         if detail_line:
             suffix += f": {detail_line}"
         suffix += ". See `kbagent data-app runs` for the full startup log."
-        lowered = raw_message.lower()
-        if is_managed and (
-            "could not read username" in lowered or "authentication failed" in lowered
-        ):
-            suffix += (
-                " This managed-repo app cannot authenticate its git clone -- wire a"
-                " credential with `kbagent data-app git-bind-credential` and redeploy."
-            )
         details = {
             "run_id": run.get("id"),
             "run_state": run.get("state"),
@@ -2377,11 +2190,8 @@ class DataAppService(BaseService):
         while True:
             last_record = ds_client.get_app(app_id)
             state = str(last_record.get("state", ""))
-            is_managed = bool(last_record.get("hasManagedGitRepo"))
             if state == TERMINAL_ERROR_STATE:
-                suffix, details = self._deploy_failure_diagnostic(
-                    ds_client, app_id, is_managed=is_managed
-                )
+                suffix, details = self._deploy_failure_diagnostic(ds_client, app_id)
                 raise KeboolaApiError(
                     message=(
                         f"Data app {app_id} reached state=error during deploy.{suffix}"
@@ -2400,9 +2210,7 @@ class DataAppService(BaseService):
             if state == target_desired_state:
                 return last_record
             if time.monotonic() >= deadline:
-                suffix, details = self._deploy_failure_diagnostic(
-                    ds_client, app_id, is_managed=is_managed
-                )
+                suffix, details = self._deploy_failure_diagnostic(ds_client, app_id)
                 raise KeboolaApiError(
                     message=(
                         f"Timed out after {timeout_seconds:.0f}s waiting for data app "
@@ -2457,16 +2265,14 @@ class DataAppService(BaseService):
         if use_managed_git_repo:
             # Managed repos are provisioned empty -- there is no code to deploy
             # yet. Spell out the follow-up steps so the operator (human or agent)
-            # knows the create call is only step one. Step 3 (git-bind-credential)
-            # is what makes the runtime able to clone on stacks that do not inject
-            # managed-repo credentials at deploy time.
+            # knows the create call is only step one. The platform injects the
+            # clone credentials at deploy time, so no credential wiring is needed.
             return (
                 f"Data app '{name}' created with an empty Keboola-managed Git "
                 "repository. Next: 1) `kbagent data-app git-credentials-create "
                 "--type http_token --permissions readWrite` + push your code to the "
-                "managed repo (`data-app git-repo` shows the URL), 2) `kbagent "
-                "data-app git-bind-credential` to wire a deploy credential, then "
-                "3) `kbagent data-app deploy`."
+                "managed repo (`data-app git-repo` shows the URL), then "
+                "2) `kbagent data-app deploy`."
             )
         if not deployed:
             return (

{keboola_cli-0.65.0 → keboola_cli-0.65.1}/tests/test_data_app_cli.py

@@ -761,72 +761,3 @@ class TestDataAppRuns:
         body = json.loads(result.output)
         assert body["data"]["runs"][0]["failure_reason"]["reason"] == "StartupProbeFailed"
         mock.list_app_runs.assert_called_once_with("prod", "42", limit=3)
-
-
-class TestDataAppGitBindCredential:
-    def test_bind_credential_json(self, tmp_path: Path) -> None:
-        config_dir = tmp_path / "config"
-        config_dir.mkdir()
-        store = _setup_config(config_dir, {"prod": {"token": TEST_TOKEN}})
-        mock = MagicMock()
-        mock.bind_managed_credential.return_value = {
-            "project_alias": "prod",
-            "app_id": "42",
-            "repository": "https://git.example.com/keboola/app-42.git",
-            "branch": "main",
-            "permissions": "readOnly",
-            "config_version": "9",
-            "git": {"#password": "<encrypted>"},
-            "message": "Wired a managed-repo credential into data app 42.",
-        }
-        result = _invoke(
-            [
-                "--json",
-                "data-app",
-                "git-bind-credential",
-                "--project",
-                "prod",
-                "--app-id",
-                "42",
-            ],
-            store=store,
-            data_app_mock=mock,
-        )
-        assert result.exit_code == 0, result.output
-        body = json.loads(result.output)
-        # The one-time token is never echoed -- only the redacted ciphertext marker.
-        assert body["data"]["git"]["#password"] == "<encrypted>"
-        mock.bind_managed_credential.assert_called_once_with(
-            "prod", "42", branch="main", permissions="readOnly", dry_run=False
-        )
-
-    def test_bind_credential_dry_run_passes_flag(self, tmp_path: Path) -> None:
-        config_dir = tmp_path / "config"
-        config_dir.mkdir()
-        store = _setup_config(config_dir, {"prod": {"token": TEST_TOKEN}})
-        mock = MagicMock()
-        mock.bind_managed_credential.return_value = {
-            "dry_run": True,
-            "project_alias": "prod",
-            "app_id": "42",
-            "repository": "https://git.example.com/keboola/app-42.git",
-            "branch": "main",
-            "permissions": "readOnly",
-            "message": "Dry run -- no credential minted, config unchanged.",
-        }
-        result = _invoke(
-            [
-                "data-app",
-                "git-bind-credential",
-                "--project",
-                "prod",
-                "--app-id",
-                "42",
-                "--dry-run",
-            ],
-            store=store,
-            data_app_mock=mock,
-        )
-        assert result.exit_code == 0, result.output
-        assert "DRY RUN" in result.output
-        assert mock.bind_managed_credential.call_args.kwargs["dry_run"] is True