@biznetgio/neo-app 0.4.16 → 0.4.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -28,6 +28,17 @@ function result(status, data) {
 // (password, connection string, access/secret key, token) back to the agent.
 // Recursively replace any secret-looking value with a reference marker so the
 // agent still sees the resource's shape and non-secret identifiers.
+// §2 safety: a create/deploy mutation must name its environment explicitly —
+// NEVER default to production. A silent prod mutation is the exact risk the
+// handoff calls out ("Never default a missing environment to production").
+function requireEnv(env) {
+  const e = String(env || '').toLowerCase();
+  if (e !== 'staging' && e !== 'production') {
+    throw new Error('environment is required and must be "staging" or "production" — it is never defaulted (handoff §2: never silently mutate production). Test on staging first.');
+  }
+  return e;
+}
+
 const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey)/i;
 function redactSecrets(value) {
   if (Array.isArray(value)) return value.map(redactSecrets);
@@ -85,7 +96,7 @@ export const TOOLS = [
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
         { type: 'database', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_database (0.4.15); update/plan still TODO (handoff 4.4)' },
         { type: 'queue', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_queue (0.4.15); update/plan still TODO (handoff 4.5)' },
-        { type: 'cron', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_cron (0.4.15); manual-run/history still TODO (handoff 4.6)' },
+        { type: 'cron', create: true, get: true, list: true, run: true, delete: true, note: 'neo_create/list/get/run/delete_cron (0.4.15-0.4.17); run-history still TODO (handoff 4.6)' },
         { type: 'object_storage', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_bucket (0.4.15); object put/get still TODO (handoff 4.7)' },
       ];
 
@@ -329,12 +340,13 @@ export const TOOLS = [
         name: str('Service name (optional)'),
         serviceType: { type: 'string', enum: ['web', 'worker', 'static_site'], description: 'web (default) | worker (no public URL) | static_site. Auto-detects static_site for a static-only folder; else web.' },
         port: int('Container port (optional; ignored for worker)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production. Never defaulted (handoff §2). Deploy to staging first.' },
         dryRun: { type: 'boolean', description: 'Preview the plan without creating/uploading/deploying anything (JNG #93)' },
       },
-      required: ['projectId', 'path'],
+      required: ['projectId', 'path', 'environment'],
     },
     async call(api, args) {
+      const environment = requireEnv(args.environment);
       const p = resolve(args.path);
       let src;
       try {
@@ -351,7 +363,7 @@ export const TOOLS = [
         name: args.name,
         serviceType: args.serviceType,
         port: args.port,
-        environment: args.environment || 'production',
+        environment,
         dryRun: !!args.dryRun,
       });
       if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment, estimatedCost: r.estimatedCost };
@@ -390,14 +402,15 @@ export const TOOLS = [
         name: str('Database name'),
         engine: { type: 'string', description: 'postgres | mysql (engine)' },
         version: str('Engine version, e.g. "16" (optional)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         replicas: int('Read/failover replicas for HA (optional; postgres/CNPG only)'),
         deploymentMode: { type: 'string', description: 'single | ha (optional)' },
       },
-      required: ['projectId', 'name', 'engine'],
+      required: ['projectId', 'name', 'engine', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases`, body);
       return redactSecrets(result(status, data));
@@ -431,13 +444,14 @@ export const TOOLS = [
         projectId: str('Project id'),
         name: str('Queue name'),
         planClass: str('Plan/engine class (optional)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional)' },
       },
-      required: ['projectId', 'name'],
+      required: ['projectId', 'name', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues`, body);
       return redactSecrets(result(status, data));
@@ -480,11 +494,12 @@ export const TOOLS = [
         command: { type: 'array', items: { type: 'string' }, description: 'Command argv (mode=app_command)' },
         url: str('Target URL (mode=http_endpoint)'),
         method: str('HTTP method (mode=http_endpoint), e.g. GET/POST'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
       },
-      required: ['projectId', 'name', 'mode', 'scheduleType'],
+      required: ['projectId', 'name', 'mode', 'scheduleType', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons`, body);
       return redactSecrets(result(status, data));
@@ -508,6 +523,16 @@ export const TOOLS = [
       return redactSecrets((await api.get(`/api/v1/crons/${args.cronId}`)).data);
     },
   },
+  {
+    name: 'neo_run_cron',
+    description: 'Trigger a scheduled job (cron) to run now, out of schedule (handoff 4.6). Returns the run result. Not applicable to a continuous "seconds" cron.',
+    mutating: true,
+    schema: { type: 'object', properties: { cronId: str('Cron/scheduled-job id') }, required: ['cronId'] },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/crons/${args.cronId}/run`);
+      return redactSecrets(result(status, data));
+    },
+  },
   {
     name: 'neo_create_bucket',
     description: 'Create an S3-compatible object-storage bucket in a project (handoff 4.7). Access keys are provisioned server-side and are NOT returned (write-only). May return pending_approval.',