Make the repository list explicit
When several local repositories contain dotenv credentials, Phantom can preview and initialize eligible projects in a workspace. Treat the preview as the starting inventory. The scanner has deliberate depth and nesting limits, so one workspace command does not prove that every project or secret has been covered.
1. Preview the exact workspace
Install the reviewed CLI and keep independent recoverable copies of credentials before initialization. Run a dry run against the directory you intend to protect, then review the listed repositories before applying changes.
phantom init --all ~/code --dry-run2. Account for nested and excluded projects
The scan searches at most five directory levels for repositories containing a supported dotenv filename. It stops descending below the first matching repository and skips already-protected repositories, dot-directories and known dependency or build directories.
Deeper or nested repositories may need their own invocation. In a monorepo, inspect the intended dotenv path instead of assuming the workspace scan initializes every application directory. For a selected project, the documented explicit-file form is phantom init --from .env.local.
3. Apply the reviewed selection
Run the workspace command from a trusted terminal only after reviewing the preview. Initialization stores detected values and rewrites managed dotenv entries with persistent mappings. Those mappings are sensitive metadata; do not paste them into issues or agent chat.
phantom init --all ~/code4. Verify each project in its own directory
Check each intended repository's secret names, dotenv scan and local readiness before delegating work there. A successful command in one repository is evidence for that checkout, not for a neighboring project. Connect the selected coding client and use phantom exec for its supported credentialed work.
phantom list
phantom check
phantom agent doctorStop on an uncertain write
Do not blindly rerun after a CommittedButUncertain, durability or Partial warning. A write may already have committed. Use phantom doctor and inspect the intended project from a trusted terminal before retrying. Workspace initialization is local protection; it does not establish hosted sync, team entitlement or organizational acceptance.