@biznetgio/neo-app 0.4.34 → 0.4.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.34",
+  "version": "0.4.36",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -40,6 +40,26 @@ function requireEnv(env) {
   return e;
 }
 
+// deleteAndConverge deletes a resource, then polls its endpoint until the inventory
+// actually converges (GET → 404), so a delete isn't reported done while the record
+// still exists. Returns a durable operation reference (`del-<id>`) + convergence
+// state (handoff 3.6; 0.4.34 retest §9 "every delete returns a durable operation ID").
+async function deleteAndConverge(api, path, resourceId, kind) {
+  const { status, data } = await api.del(path);
+  let converged = false, checks = 0;
+  for (let i = 0; i < 12; i++) {
+    checks++;
+    try {
+      await api.get(path);
+      await new Promise((r) => setTimeout(r, 500)); // still present — keep polling
+    } catch (e) {
+      if (e && e.status === 404) { converged = true; break; }
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  }
+  return { operationId: 'del-' + resourceId, kind, status: (data && data.status) || 'deleted', converged, convergenceChecks: checks };
+}
+
 // gbFromSize parses "10Gi"/"10G"/"10" → 10 (integer GB), else undefined.
 function gbFromSize(v) {
   if (v == null) return undefined;
@@ -313,7 +333,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_scale_service',
-    description: 'Scale a service to N replicas. May return pending_approval under org policy.',
+    description: 'Scale a service to N replicas. Scaling changes cost, so without confirm:true it returns the new estimated cost and scales nothing (re-call with confirm:true). May return pending_approval under org policy.',
     mutating: true,
     schema: {
       type: 'object',
@@ -321,10 +341,22 @@ export const TOOLS = [
         projectId: str('Project id'),
         service: str('Service/app name'),
         replicas: int('Desired replica count (>=0)'),
+        confirm: { type: 'boolean', description: 'Approve the cost change: without confirm:true the tool returns the new cost and scales nothing.' },
       },
       required: ['projectId', 'service', 'replicas'],
     },
     async call(api, args) {
+      if (args.confirm !== true) {
+        let computeTier;
+        try {
+          const apps = (await api.get(`/api/v1/projects/${args.projectId}/apps`)).data;
+          const list = Array.isArray(apps) ? apps : (apps.applications || []);
+          const svc = list.find((a) => a.name === args.service || a.id === args.service);
+          computeTier = svc && (svc.cpuLimit || svc.computeTier);
+        } catch { /* best effort — gate regardless */ }
+        const gate = await confirmCost(api, args, { computeTier, replicas: args.replicas });
+        if (gate) return { ...gate, change: `scale "${args.service}" to ${args.replicas} replica(s)`, message: 'Scaling changes cost — show the user and re-call with confirm:true to apply.' };
+      }
       const { status, data } = await api.post(
         `/api/v1/projects/${args.projectId}/services/${args.service}/scale`,
         { replicas: args.replicas }
@@ -621,10 +653,16 @@ export const TOOLS = [
         databaseId: str('Database id'),
         volumeSize: str('New storage size, e.g. "20Gi" — must be >= current (grow-only)'),
         replicas: int('Read/failover replicas (CNPG/postgres); total instances = 1 + replicas'),
+        confirm: { type: 'boolean', description: 'Approve the cost change: without confirm:true a storage/replica resize returns the new cost and applies nothing.' },
       },
       required: ['databaseId'],
     },
     async call(api, args) {
+      const costChanging = args.volumeSize || args.replicas !== undefined;
+      if (costChanging && args.confirm !== true) {
+        const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize), replicas: args.replicas });
+        if (gate) return { ...gate, change: 'resize database (storage/replicas)', message: 'Resizing changes cost — re-call with confirm:true to apply.' };
+      }
       const body = {};
       if (args.volumeSize) body.volumeSize = args.volumeSize;
       if (args.replicas !== undefined) body.replicas = args.replicas;
@@ -787,11 +825,17 @@ export const TOOLS = [
         dlqEnabled: { type: 'boolean', description: 'Enable/disable the dead-letter queue' },
         volumeSize: str('New storage size, e.g. "20Gi" — must be >= current (grow-only)'),
         retention: { type: 'object', description: 'Retention policy {maxAgeSeconds, maxBytes, maxMsgs}' },
+        confirm: { type: 'boolean', description: 'Approve the cost change: without confirm:true a storage/plan change returns the new cost and applies nothing. DLQ/retention-only edits apply directly.' },
       },
       required: ['queueId'],
     },
     async call(api, args) {
-      const { queueId, ...body } = args;
+      const costChanging = args.volumeSize || args.planClass;
+      if (costChanging && args.confirm !== true) {
+        const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize) });
+        if (gate) return { ...gate, change: 'update queue (storage/plan)', message: 'This changes cost — re-call with confirm:true to apply.' };
+      }
+      const { queueId, confirm, orgId, ...body } = args;
       const { status, data } = await api.put(`/api/v1/queues/${queueId}`, body);
       return redactSecrets(result(status, data));
     },
@@ -820,8 +864,16 @@ export const TOOLS = [
         ],
         branches: {
           app_command: 'Provide serviceId (an existing service) OR image, plus command (argv array).',
-          http_endpoint: 'Provide url and method (GET/POST/…).',
+          http_endpoint: 'Provide url and method (GET/POST/…). Optional: headers (object), body + contentType, expectedStatus (exact code required for success), timeoutSeconds, retryCount, concurrencyPolicy (Allow|Forbid|Replace).',
         },
+        httpOptions: [
+          { field: 'headers', ask: 'Any request headers? (e.g. Authorization) — object', optional: true },
+          { field: 'body', ask: 'A request body? (+ contentType, e.g. application/json)', optional: true },
+          { field: 'expectedStatus', ask: 'A specific expected HTTP status for success? (default: any 2xx)', optional: true },
+          { field: 'timeoutSeconds', ask: 'A per-run timeout (seconds)?', optional: true },
+          { field: 'retryCount', ask: 'How many retries on failure?', optional: true },
+          { field: 'concurrencyPolicy', ask: 'If a run overruns the next schedule: Allow | Forbid | Replace?', optional: true },
+        ],
         examples: [
           { intent: 'Run `node cleanup.js` in my web service every night at 2am Jakarta', args: { name: 'nightly-cleanup', mode: 'app_command', scheduleType: 'cron', schedule: '0 2 * * *', timezone: 'Asia/Jakarta', serviceId: '<web service id>', command: ['node', 'cleanup.js'], environment: 'staging' } },
           { intent: 'Ping a health URL every 15 minutes', args: { name: 'healthcheck', mode: 'http_endpoint', scheduleType: 'interval', intervalMinutes: 15, url: 'https://example.app/health', method: 'GET', environment: 'production' } },
@@ -849,6 +901,13 @@ export const TOOLS = [
         command: { type: 'array', items: { type: 'string' }, description: 'Command argv (mode=app_command)' },
         url: str('Target URL (mode=http_endpoint)'),
         method: str('HTTP method (mode=http_endpoint), e.g. GET/POST'),
+        headers: { type: 'object', description: 'HTTP request headers (mode=http_endpoint), e.g. {"Authorization":"Bearer …"}. Secret header values are redacted when read back.' },
+        body: str('HTTP request body (mode=http_endpoint)'),
+        contentType: str('Content-Type for the body (mode=http_endpoint), e.g. "application/json" — merged into headers'),
+        expectedStatus: int('Exact HTTP status a run must receive to count as success (mode=http_endpoint; default: any 2xx)'),
+        timeoutSeconds: int('Per-run timeout in seconds (optional) → activeDeadlineSeconds'),
+        retryCount: int('Retries on failure (optional) → backoffLimit'),
+        concurrencyPolicy: { type: 'string', enum: ['Allow', 'Forbid', 'Replace'], description: 'Overlap policy if a run is still going when the next is due (optional, default Allow)' },
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost (crons are billed per run — variable) and creates nothing. Re-call with confirm:true to create.' },
       },
@@ -858,7 +917,11 @@ export const TOOLS = [
       requireEnv(args.environment);
       const gate = await confirmCost(api, args, {}); // cron cost is variable (per-run) — gate surfaces the rate
       if (gate) return gate;
-      const { projectId, confirm, orgId, ...body } = args;
+      // Merge contentType into headers for convenience (unless already set).
+      if (args.contentType) {
+        args = { ...args, headers: { 'Content-Type': args.contentType, ...(args.headers || {}) } };
+      }
+      const { projectId, confirm, orgId, contentType, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons`, body);
       return redactSecrets(result(status, data));
     },
@@ -1228,8 +1291,7 @@ export const TOOLS = [
     destructive: true,
     schema: { type: 'object', properties: { appId: str('Service/app id (from neo_list_services)') }, required: ['appId'] },
     async call(api, args) {
-      const { status, data } = await api.del(`/api/v1/apps/${args.appId}`);
-      return result(status, data);
+      return deleteAndConverge(api, `/api/v1/apps/${args.appId}`, args.appId, 'service');
     },
   },
   {
@@ -1239,8 +1301,7 @@ export const TOOLS = [
     destructive: true,
     schema: { type: 'object', properties: { databaseId: str('Database id') }, required: ['databaseId'] },
     async call(api, args) {
-      const { status, data } = await api.del(`/api/v1/databases/${args.databaseId}`);
-      return result(status, data);
+      return deleteAndConverge(api, `/api/v1/databases/${args.databaseId}`, args.databaseId, 'database');
     },
   },
   {
@@ -1250,8 +1311,7 @@ export const TOOLS = [
     destructive: true,
     schema: { type: 'object', properties: { queueId: str('Queue id') }, required: ['queueId'] },
     async call(api, args) {
-      const { status, data } = await api.del(`/api/v1/queues/${args.queueId}`);
-      return result(status, data);
+      return deleteAndConverge(api, `/api/v1/queues/${args.queueId}`, args.queueId, 'queue');
     },
   },
   {
@@ -1261,8 +1321,7 @@ export const TOOLS = [
     destructive: true,
     schema: { type: 'object', properties: { cronId: str('Cron/scheduled-job id') }, required: ['cronId'] },
     async call(api, args) {
-      const { status, data } = await api.del(`/api/v1/crons/${args.cronId}`);
-      return result(status, data);
+      return deleteAndConverge(api, `/api/v1/crons/${args.cronId}`, args.cronId, 'cron');
     },
   },
   {
@@ -1272,8 +1331,7 @@ export const TOOLS = [
     destructive: true,
     schema: { type: 'object', properties: { bucketId: str('Bucket id') }, required: ['bucketId'] },
     async call(api, args) {
-      const { status, data } = await api.del(`/api/v1/buckets/${args.bucketId}`);
-      return result(status, data);
+      return deleteAndConverge(api, `/api/v1/buckets/${args.bucketId}`, args.bucketId, 'bucket');
     },
   },
   {