@biznetgio/neo-app 0.4.31 → 0.4.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.31",
+  "version": "0.4.32",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -65,13 +65,17 @@ async function confirmCost(api, args, spec) {
   };
 }
 
-const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey)/i;
+const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey|authorization)/i;
+// Deployment snapshots (exact keys) embed rendered configs with plaintext creds — a
+// queue's `--pass`, a DB's POSTGRES_PASSWORD. Redact by EXACT key so we don't also
+// hit resourceId/source-of-truth-style names (substring match would catch "reSOURCEid").
+const SECRET_EXACT = new Set(['source', 'installed']);
 function redactSecrets(value) {
   if (Array.isArray(value)) return value.map(redactSecrets);
   if (value && typeof value === 'object') {
     const out = {};
     for (const [k, v] of Object.entries(value)) {
-      out[k] = SECRET_KEY.test(k) ? '[redacted — credentials are write-only; bind them to a consumer instead]' : redactSecrets(v);
+      out[k] = (SECRET_KEY.test(k) || SECRET_EXACT.has(k.toLowerCase())) ? '[redacted — credentials are write-only; bind them to a consumer instead]' : redactSecrets(v);
     }
     return out;
   }
@@ -152,6 +156,25 @@ export const TOOLS = [
       return (await api.get(`/api/v1/orgs/${orgId}/projects`)).data;
     },
   },
+  {
+    name: 'neo_create_project',
+    description: 'Create a new project in an organization — use it for a disposable project (e.g. isolated testing) or a fresh project to deploy into. orgId defaults to your primary org. Returns the new project (id, name).',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        name: str('Project name'),
+        description: str('Project description (optional)'),
+        orgId: str('Organization id (optional; defaults to your primary org)'),
+      },
+      required: ['name'],
+    },
+    async call(api, args) {
+      const orgId = await api.resolveOrgId(args.orgId);
+      const { status, data } = await api.post(`/api/v1/orgs/${orgId}/projects`, { name: args.name, description: args.description || '' });
+      return result(status, data);
+    },
+  },
   {
     name: 'neo_get_project',
     description: 'Get one project by id.',
@@ -399,6 +422,7 @@ export const TOOLS = [
           // root suggests worker; static → static_site; else web.
           suggestedServiceType: support ? null : (role === 'worker' ? 'worker' : (s.type === 'static' ? 'static_site' : 'web')),
           suggestedBuildType: s.type === 'docker' ? 'dockerfile' : 'railpack',
+          suggestedPort: s.port || undefined, // from the Dockerfile EXPOSE, when present
           contextDir: s.path || undefined,
           detectedDependencies: s.deps || [], // database | queue | object_storage, inferred from the manifest
           // Confidence (handoff 6): a Dockerfile/index.html is high; a worker guess from
@@ -1301,25 +1325,33 @@ export const TOOLS = [
       ]);
       const arr = (x, k) => (Array.isArray(x) ? x : (x && Array.isArray(x[k]) ? x[k] : []));
       const inv = {
-        services: arr(apps, 'apps').map((a) => a.name || a.id),
+        services: arr(apps, 'applications').map((a) => a.name || a.id), // list endpoint wraps as {applications:[…]}
         databases: arr(dbs, 'databases').map((d) => d.name || d.id),
         queues: arr(queues, 'queues').map((q) => q.name || q.id),
         crons: arr(crons, 'crons').map((c) => c.name || c.id),
         buckets: arr(buckets, 'buckets').map((b) => b.name || b.id),
       };
       const total = Object.values(inv).reduce((n, a) => n + a.length, 0);
+      // Fail-safe: if any inventory fetch FAILED (null, not empty), we can't prove the
+      // project is empty — treat it as non-empty so the empty-path can't silently
+      // delete hidden resources (the preview must be trustworthy).
+      const inventoryIncomplete = [apps, dbs, queues, crons, buckets].some((x) => x === null);
       const preview = {
         project: proj ? { id: proj.id, name: proj.name, organizationId: proj.organizationId } : { id: pid },
         resourceInventory: inv,
         resourceCount: total,
         meteringSnapshot: usage ? { period: usage.period, total: usage.total ?? usage.totalCost, currency: usage.currency } : null,
+        inventoryIncomplete: inventoryIncomplete || undefined,
         warning: 'IRREVERSIBLE: deletes the project, every resource above, and their data (database/queue volumes included). No refund for prepaid or accrued usage.',
       };
+      // Treat an unverifiable inventory as non-empty — never allow the no-cascade path
+      // when we could not confirm the project is actually empty.
+      const requireCascade = total > 0 || inventoryIncomplete;
       if (args.confirm !== true) {
-        return { ...preview, deleted: false, requiresConfirmation: true, message: total > 0 ? 'Show this inventory to the user. To delete, re-call with confirm:true AND cascade:true.' : 'Empty project. To delete, re-call with confirm:true.' };
+        return { ...preview, deleted: false, requiresConfirmation: true, message: requireCascade ? 'Show this inventory to the user. To delete, re-call with confirm:true AND cascade:true.' : 'Empty project. To delete, re-call with confirm:true.' };
       }
-      if (total > 0 && args.cascade !== true) {
-        return { ...preview, deleted: false, error: 'cascade_required', message: `This project has ${total} resource(s). Re-call with confirm:true AND cascade:true to delete them all.` };
+      if (requireCascade && args.cascade !== true) {
+        return { ...preview, deleted: false, error: 'cascade_required', message: inventoryIncomplete ? 'Could not fully verify the project inventory — re-call with confirm:true AND cascade:true to delete anyway.' : `This project has ${total} resource(s). Re-call with confirm:true AND cascade:true to delete them all.` };
       }
       const { status, data } = await api.del(`/api/v1/projects/${pid}`);
       return { deleted: true, project: preview.project, removed: inv, resourceCount: total, meteringSnapshot: preview.meteringSnapshot, result: result(status, data) };