@biznetgio/neo-app 0.4.22 → 0.4.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.22",
+  "version": "0.4.24",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -105,7 +105,7 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'create', 'list', 'get', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'bind', 'unbind', 'run_cron', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'create', 'list', 'get', 'update', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'presign_object', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
         bindings: { supported: true, targets: ['neo_db', 'neo_queue'], writeOnly: true, note: 'neo_bind_resource injects DATABASE_URL/NATS_URL server-side at deploy; the secret is never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
@@ -232,6 +232,26 @@ export const TOOLS = [
       return out;
     },
   },
+  {
+    name: 'neo_set_service_variable',
+    description:
+      'Set ONE PER-SERVICE environment variable on a specific service (merged server-side — other vars are preserved, unlike project-wide neo_set_variable). Pass secret:true to store it as a cluster Secret. Redeploy the service (neo_deploy) for it to take effect. The value is never echoed back.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        appId: str('Service/app id (from neo_list_services)'),
+        key: str('Variable name'),
+        value: str('Variable value'),
+        secret: { type: 'boolean', description: 'Store as a secret (default false)' },
+      },
+      required: ['appId', 'key', 'value'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/apps/${args.appId}/variables`, { key: args.key, value: args.value, secret: !!args.secret });
+      return result(status, data); // {status:"set", key, redeployRequired} — no value returned
+    },
+  },
   {
     name: 'neo_scale_service',
     description: 'Scale a service to N replicas. May return pending_approval under org policy.',
@@ -328,17 +348,20 @@ export const TOOLS = [
         suggestedServiceType: s.type === 'static' ? 'static_site' : 'web',
         suggestedBuildType: s.type === 'docker' ? 'dockerfile' : 'railpack',
         contextDir: s.path || undefined,
+        detectedDependencies: s.deps || [], // database | queue | object_storage, inferred from the manifest
       }));
+      const anyDeps = components.some((c) => c.detectedDependencies.length);
       return {
         repoUrl: args.repoUrl,
         count: components.length,
         components,
         note:
-          components.length > 1
+          (components.length > 1
             ? 'Monorepo: multiple deployable components. Ask the user which to deploy and create each selected one with its `contextDir` — do NOT collapse them into one service (handoff 6). Worker vs web cannot be inferred from the tree alone; confirm the type with the user.'
             : components.length === 1
               ? 'One deployable component found.'
-              : 'No deployable component found (no Dockerfile/package.json/go.mod/requirements.txt/index.html/… at any root).',
+              : 'No deployable component found (no Dockerfile/package.json/go.mod/requirements.txt/index.html/… at any root).')
+          + (anyDeps ? ' A component lists detectedDependencies (database/queue/object_storage) from its manifest — consider planning those resources and binding them (neo_bind_resource); confirm with the user first.' : ''),
       };
     },
   },
@@ -661,21 +684,30 @@ export const TOOLS = [
       return result(status, data);
     },
   },
+  {
+    name: 'neo_presign_bucket_object',
+    description: 'Get a time-limited presigned URL to download an object from a bucket (handoff 4.7 — object get). The URL is a short-lived signed link, not long-term credentials.',
+    mutating: false,
+    schema: { type: 'object', properties: { bucketId: str('Bucket id'), object: str('Object key/path') }, required: ['bucketId', 'object'] },
+    async call(api, args) {
+      return (await api.get(`/api/v1/buckets/${args.bucketId}/objects/presign`, { query: { object: args.object } })).data;
+    },
+  },
   // --- Typed bindings (handoff 5): attach a DB/queue to a consumer service. The
   // connection string is injected as an env var SERVER-SIDE at the consumer's next
   // deploy (marked a secret) — it is never returned to the agent (write-only). ---
   {
     name: 'neo_bind_resource',
     description:
-      'Bind a managed database or queue to a consumer service so its connection is injected as an environment variable at the consumer\'s next deploy — WITHOUT ever exposing the secret to you (handoff 5, write-only). envKey defaults to DATABASE_URL (neo_db) or NATS_URL (neo_queue). After binding, redeploy the consumer (neo_deploy) for it to take effect. The target and consumer must be in the same project.',
+      'Bind a managed database, queue, or object-storage bucket to a consumer service so its connection is injected as environment variable(s) at the consumer\'s next deploy — WITHOUT ever exposing the secret to you (handoff 5, write-only). envKey defaults: DATABASE_URL (neo_db), NATS_URL (neo_queue); for neo_object_storage it is a PREFIX (default S3) injecting <P>_ENDPOINT/_BUCKET/_REGION + secret <P>_ACCESS_KEY/_SECRET_KEY. After binding, redeploy the consumer. Target and consumer must be in the same project.',
     mutating: true,
     schema: {
       type: 'object',
       properties: {
         appId: str('Consumer service/app id that will receive the env var (from neo_list_services)'),
-        targetType: { type: 'string', enum: ['neo_db', 'neo_queue'], description: 'neo_db | neo_queue — the resource to attach' },
-        targetId: str('The database or queue id to bind'),
-        envKey: str('Env var name to inject (optional; default DATABASE_URL for neo_db, NATS_URL for neo_queue)'),
+        targetType: { type: 'string', enum: ['neo_db', 'neo_queue', 'neo_object_storage'], description: 'neo_db | neo_queue | neo_object_storage — the resource to attach' },
+        targetId: str('The database, queue, or bucket id to bind'),
+        envKey: str('Env var name / prefix (optional; default DATABASE_URL, NATS_URL, or S3 prefix)'),
       },
       required: ['appId', 'targetType', 'targetId'],
     },
@@ -785,13 +817,35 @@ export const TOOLS = [
   },
   {
     name: 'neo_get_operation',
-    description: 'Get the status of a stack apply (the operationId/planId from neo_apply_stack): overall status (applying | applied | failed) plus per-resource status (creating | deploying | deployed | failed). Apply waits for each deploy — "applied" means every resource reached a successful deploy (databases/queues rollout-ready), not merely that the manifest was submitted. Poll until terminal.',
+    description: 'Get the status of a stack apply (the operationId/planId from neo_apply_stack). Overall status: applying | applied | partial | failed. Per-resource status: creating | deploying | deployed | ready | blocked | failed, plus a `healthy` flag + `url` for services (apply probes the public URL — "ready" means it actually responded) and `blockedBy` when a consumer\'s foundation failed. Poll until terminal.',
     mutating: false,
     schema: { type: 'object', properties: { operationId: str('Operation id (= plan id from neo_apply_stack)') }, required: ['operationId'] },
     async call(api, args) {
       return redactSecrets((await api.get(`/api/v1/plans/${args.operationId}`)).data);
     },
   },
+  {
+    name: 'neo_wait_operation',
+    description: 'Wait for a stack apply (operationId from neo_apply_stack) to finish — polls until the status is terminal (applied | partial | failed) or the timeout elapses, then returns the final operation with per-resource status (secrets redacted). Convenience over polling neo_get_operation yourself.',
+    mutating: false,
+    schema: {
+      type: 'object',
+      properties: { operationId: str('Operation id (= plan id)'), timeoutMs: int('Max wait in milliseconds (default 180000)') },
+      required: ['operationId'],
+    },
+    async call(api, args) {
+      const deadline = Date.now() + (args.timeoutMs && args.timeoutMs > 0 ? args.timeoutMs : 180000);
+      const terminal = new Set(['applied', 'partial', 'failed']);
+      let op;
+      for (;;) {
+        op = redactSecrets((await api.get(`/api/v1/plans/${args.operationId}`)).data);
+        if (terminal.has(op.status) || Date.now() >= deadline) break;
+        await new Promise((r) => setTimeout(r, 5000));
+      }
+      if (op && !terminal.has(op.status)) return { ...op, timedOut: true, note: 'still in progress at timeout — call neo_get_operation again' };
+      return op;
+    },
+  },
   // --- Cleanup (handoff 3.6): MCP can delete every resource type it can reach, so
   // an agent never leaks a resource it created. These are DESTRUCTIVE and permanent;
   // the server hard-deletes the record and tears down the running workload. ---