@biznetgio/neo-app 0.4.36 → 0.4.38

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.36",
+  "version": "0.4.38",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -4,7 +4,6 @@
 
 import { resolve, basename } from 'node:path';
 import { statSync, readFileSync } from 'node:fs';
-import { createHash } from 'node:crypto';
 import { deploySource } from '../deploySource.js';
 import { pkgVersion } from '../util.js';
 import { estimateCost } from '../pricing.js';
@@ -44,8 +43,8 @@ function requireEnv(env) {
 // actually converges (GET → 404), so a delete isn't reported done while the record
 // still exists. Returns a durable operation reference (`del-<id>`) + convergence
 // state (handoff 3.6; 0.4.34 retest §9 "every delete returns a durable operation ID").
-async function deleteAndConverge(api, path, resourceId, kind) {
-  const { status, data } = await api.del(path);
+async function deleteAndConverge(api, path, resourceId, kind, delQuery = '') {
+  const { status, data } = await api.del(path + delQuery);
   let converged = false, checks = 0;
   for (let i = 0; i < 12; i++) {
     checks++;
@@ -67,15 +66,6 @@ function gbFromSize(v) {
   return m ? parseInt(m[1], 10) : undefined;
 }
 
-// deletionHashOf is an immutable approval token for a project deletion: a short hash
-// of the exact inventory being deleted. The preview returns it; a cascade delete must
-// echo it back, and the tool recomputes the live inventory and refuses a mismatch — so
-// a project can't be deleted against a stale/partial inventory (0.4.31 retest §7).
-function deletionHashOf(pid, inv, total) {
-  const names = Object.entries(inv).flatMap(([k, a]) => a.map((n) => k + ':' + n)).sort();
-  return createHash('sha256').update(JSON.stringify({ pid, total, names })).digest('hex').slice(0, 16);
-}
-
 // confirmCost is the Approve & Create gate for billable one-shot creates: unless
 // args.confirm===true it returns the live-priced cost and creates NOTHING — the
 // agent shows the user, then re-calls with confirm:true. plan/apply remains the
@@ -87,9 +77,11 @@ async function confirmCost(api, args, spec) {
   let book = null;
   try { book = (await api.get(orgId ? `/api/v1/orgs/${orgId}/pricing` : '/api/v1/pricing')).data; }
   catch { try { book = (await api.get('/api/v1/pricing')).data; } catch { book = null; } }
+  let cost = null;
+  if (book) { try { cost = estimateCost(book, spec); } catch { cost = null; } } // never fail the gate on an estimate error
   return {
     requiresConfirmation: true,
-    cost: book ? estimateCost(book, spec) : null,
+    cost,
     priceBook: orgId ? `org:${orgId}` : 'global-defaults',
     message: 'Billable resource — show the user this cost, then re-call with confirm:true to create. For an immutable, server-pinned quote use neo_plan_stack → neo_apply_stack.',
   };
@@ -150,10 +142,10 @@ export const TOOLS = [
       // Honest support matrix: what THIS build does, not the roadmap. `create`
       // is true, false, or 'via_folder' (created through neo_deploy_folder).
       const resourceTypes = [
-        { type: 'web', create: true, deploy: true, scale: true, logs: true, variables: true, delete: true },
-        { type: 'template', create: true, deploy: true, scale: false, logs: true, variables: true, delete: true },
-        { type: 'static_site', create: 'via_folder', deploy: true, scale: false, logs: true, variables: true, delete: true, nativeStatic: true, note: 'neo_deploy_folder serviceType=static_site with buildCommand/publishDirectory → native nginx static hosting (0.4.27); auto-detected for static-only folders' },
-        { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
+        { type: 'web', create: true, deploy: true, scale: true, update: true, domains: true, health: true, autoscale: true, logs: true, variables: true, usage: true, delete: true, note: 'neo_get/update_service (compute/replicas/autoscale/port/command/domain/tls/path/health) + scale + add/remove_service_domain + get_logs + service_usage' },
+        { type: 'template', create: true, deploy: true, scale: false, update: true, logs: true, variables: true, delete: true },
+        { type: 'static_site', create: 'via_folder', deploy: true, scale: false, update: true, domains: true, logs: true, variables: true, delete: true, nativeStatic: true, note: 'neo_deploy_folder serviceType=static_site with buildCommand/publishDirectory → native nginx (0.4.27); neo_update_service for domain/tls/path' },
+        { type: 'worker', create: 'via_folder', deploy: true, scale: true, update: true, health: true, autoscale: true, logs: true, variables: true, usage: true, delete: true, note: 'neo_deploy_folder serviceType=worker (no public ingress) + neo_update_service (compute/replicas/autoscale/command/health)' },
         { type: 'database', create: true, deploy: true, get: true, list: true, update: true, backup: true, restore: true, verify: true, publicAccess: true, delete: true, note: 'neo_create/deploy/list/get/update(resize)/delete_database + backup + restore (postgres, local backups) + verify (SQL round-trip) + enable/disable_db_public_access (handoff 4.4)' },
         { type: 'queue', create: true, deploy: true, get: true, list: true, update: true, verify: true, publicAccess: true, delete: true, note: 'neo_create/deploy/list/get/update/verify(publish→persist)/delete_queue + enable/disable_queue_public_access (handoff 4.5)' },
         { type: 'cron', create: true, get: true, list: true, run: true, runs: true, questionnaire: true, delete: true, note: 'neo_cron_questionnaire (guided) + create/list/get/run/list_runs/delete_cron (handoff 4.6)' },
@@ -165,7 +157,7 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'service_usage', 'create', 'list', 'get', 'update', 'verify', 'enable_public_access', 'disable_public_access', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'cron_questionnaire', 'presign_object', 'backup', 'restore', 'delete', 'delete_project', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'service_usage', 'create', 'list', 'get', 'update', 'verify', 'enable_public_access', 'disable_public_access', 'deploy', 'scale', 'add_domain', 'remove_domain', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'cron_questionnaire', 'presign_object', 'backup', 'restore', 'delete', 'delete_project', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
         bindings: { supported: true, targets: ['neo_db', 'neo_queue', 'neo_object_storage'], writeOnly: true, note: 'neo_bind_resource + neo_plan_stack bindings inject DATABASE_URL / NATS_URL (+ NATS_HOST/PORT/USER/PASSWORD) / S3_* server-side at deploy; secrets never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
@@ -214,6 +206,33 @@ export const TOOLS = [
       return (await api.get(`/api/v1/projects/${args.projectId}`)).data;
     },
   },
+  {
+    name: 'neo_get_confirmation',
+    description: 'Read a confirmation record (the server-side approval for a high-risk action) by id — its action, status, redacted summary, whether an exact-name phrase is required, and expiry. Read-only; never contains secrets.',
+    mutating: false,
+    schema: { type: 'object', properties: { confirmationId: str('Confirmation id (from a destructive preview or a plan)') }, required: ['confirmationId'] },
+    async call(api, args) {
+      return (await api.get(`/api/v1/confirmations/${args.confirmationId}`)).data;
+    },
+  },
+  {
+    name: 'neo_confirm_action',
+    description: 'Record a human DECISION on a confirmation (NEVER creates or deletes anything itself) — the server-enforced approval step for a high-risk action (project/service deletion, billable create). decision is approve | decline | cancel. Approving a DELETION requires confirmationPhrase to exactly equal the target name (the human must type it). After approve, call the action tool again with this confirmationId to actually perform it (single-use). Show the human the summary from the preview and ask once; never infer consent.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        confirmationId: str('Confirmation id (from a destructive preview or a plan)'),
+        decision: { type: 'string', enum: ['approve', 'decline', 'cancel'], description: 'approve | decline | cancel' },
+        confirmationPhrase: str('For a deletion: the EXACT target name, typed by the human, required to approve'),
+      },
+      required: ['confirmationId', 'decision'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/confirmations/${args.confirmationId}/decide`, { decision: args.decision, confirmationPhrase: args.confirmationPhrase });
+      return result(status, data);
+    },
+  },
   {
     name: 'neo_list_services',
     description: 'List services/apps in a project.',
@@ -223,6 +242,81 @@ export const TOOLS = [
       return (await api.get(`/api/v1/projects/${args.projectId}/apps`)).data;
     },
   },
+  {
+    name: 'neo_get_service',
+    description: 'Get one service/app by id — its type, compute, replicas/autoscale, port, command, domain/TLS/custom domains, health-check paths, and env keys (secret values redacted). Redeploy for config changes to take effect.',
+    mutating: false,
+    schema: { type: 'object', properties: { appId: str('Service/app id (from neo_list_services)') }, required: ['appId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/apps/${args.appId}`)).data);
+    },
+  },
+  {
+    name: 'neo_update_service',
+    description: 'Update a service/app config (handoff §4.1/§4.2). Exposes compute (computeTier OR cpuLimit+memoryLimit), replicas, autoscale, port, command, domain, tls, ingress path, and health/liveness/readiness/startup checks. Cost-changing fields (compute/replicas/autoscale) require confirm:true — without it the new cost is returned and nothing is applied. Redeploy the service for changes to take effect. Omitted fields are left unchanged.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        appId: str('Service/app id'),
+        computeTier: str('Bundled compute tier (micro | small | medium | large | xlarge)'),
+        cpuLimit: str('Custom CPU limit, e.g. "500m" (use with memoryLimit; unbundled)'),
+        memoryLimit: str('Custom memory limit, e.g. "512Mi" (unbundled)'),
+        replicas: int('Fixed replica count'),
+        autoscaleMin: int('Autoscale min replicas'),
+        autoscaleMax: int('Autoscale max replicas'),
+        autoscaleCpu: int('Autoscale target CPU %'),
+        autoscaleMemory: int('Autoscale target memory %'),
+        port: int('Container port'),
+        command: { type: 'array', items: { type: 'string' }, description: 'Override the image command (argv)' },
+        domain: str('Primary domain ("" clears it back to the default host)'),
+        tls: { type: 'boolean', description: 'Enable/disable managed TLS on the domain' },
+        path: str('Ingress path prefix'),
+        healthPath: str('HTTP health-check path'),
+        livenessPath: str('Liveness probe path'),
+        readinessPath: str('Readiness probe path'),
+        startupPath: str('Startup probe path'),
+        healthTimeoutSeconds: int('Health-check timeout (s)'),
+        healthGraceSeconds: int('Health-check grace period (s)'),
+        confirm: { type: 'boolean', description: 'Approve a cost change (compute/replicas/autoscale): without it the new cost is returned and nothing is applied.' },
+      },
+      required: ['appId'],
+    },
+    async call(api, args) {
+      const { appId, confirm, orgId, computeTier, ...rest } = args;
+      const body = { ...rest };
+      if (computeTier) { body.billingMode = 'bundled'; body.cpuLimit = computeTier; }
+      else if (args.cpuLimit || args.memoryLimit) { body.billingMode = 'unbundled'; }
+      const costChanging = computeTier || args.cpuLimit || args.memoryLimit || args.replicas !== undefined || args.autoscaleMax !== undefined;
+      if (costChanging && confirm !== true) {
+        const gate = await confirmCost(api, args, { computeTier, replicas: args.replicas ?? args.autoscaleMax });
+        if (gate) return { ...gate, change: 'update service compute/scaling', message: 'This changes cost — re-call with confirm:true to apply.' };
+      }
+      const { status, data } = await api.put(`/api/v1/apps/${appId}`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_add_service_domain',
+    description: 'Attach an additional custom ingress domain to a service (handoff §4.1). Point the domain\'s DNS at the platform first; managed TLS is issued automatically. The default platform host is preserved.',
+    mutating: true,
+    schema: { type: 'object', properties: { appId: str('Service/app id'), domain: str('Custom domain host, e.g. "app.example.com"') }, required: ['appId', 'domain'] },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/apps/${args.appId}/domains`, { domain: args.domain });
+      return result(status, data);
+    },
+  },
+  {
+    name: 'neo_remove_service_domain',
+    description: 'Detach a custom domain from a service. The default platform host and other domains are untouched.',
+    mutating: true,
+    destructive: true,
+    schema: { type: 'object', properties: { appId: str('Service/app id'), domain: str('Custom domain host to remove') }, required: ['appId', 'domain'] },
+    async call(api, args) {
+      const { status, data } = await api.del(`/api/v1/apps/${args.appId}/domains`, { body: { domain: args.domain } });
+      return result(status, data);
+    },
+  },
   {
     name: 'neo_get_deployment',
     description: 'Get a deployment by id (poll this after neo_deploy until status is terminal).',
@@ -1286,12 +1380,34 @@ export const TOOLS = [
   // the server hard-deletes the record and tears down the running workload. ---
   {
     name: 'neo_delete_service',
-    description: 'Permanently delete a service (web / worker / static_site) and tear down its running workload. Destructive and irreversible.',
+    description: 'Delete a service (web / worker / static_site) and tear down its workload. SAFE BY DEFAULT: with no confirmationId it returns the service details + a server-side CONFIRMATION, deleting NOTHING. Then: show the user, call neo_confirm_action(confirmationId, "approve", confirmationPhrase=<EXACT service name>), then re-call with that confirmationId. Server-enforced, single-use, exact-name. Destructive and irreversible.',
     mutating: true,
     destructive: true,
-    schema: { type: 'object', properties: { appId: str('Service/app id (from neo_list_services)') }, required: ['appId'] },
+    schema: {
+      type: 'object',
+      properties: {
+        appId: str('Service/app id (from neo_list_services)'),
+        confirmationId: str('An APPROVED confirmation id (from neo_confirm_action). Omit to get the confirmation.'),
+      },
+      required: ['appId'],
+    },
     async call(api, args) {
-      return deleteAndConverge(api, `/api/v1/apps/${args.appId}`, args.appId, 'service');
+      if (args.confirmationId) {
+        return deleteAndConverge(api, `/api/v1/apps/${args.appId}`, args.appId, 'service', `?confirmationId=${encodeURIComponent(args.confirmationId)}`);
+      }
+      let svc = null;
+      try { svc = (await api.get(`/api/v1/apps/${args.appId}`)).data; } catch { /* preview best-effort */ }
+      let c;
+      try { c = (await api.post('/api/v1/confirmations', { action: 'service_delete', targetId: args.appId })).data; }
+      catch (e) { return { deleted: false, error: 'confirmation_failed', message: 'Could not create a deletion confirmation: ' + (e.message || e) }; }
+      const phrase = (c.summary && c.summary.phraseRequired) || (svc && svc.name);
+      return {
+        deleted: false, requiresConfirmation: true,
+        service: svc ? { id: svc.id, name: svc.name, type: svc.serviceType, environment: svc.environment } : { id: args.appId },
+        warning: 'IRREVERSIBLE: deletes the service and tears down its running workload.',
+        confirmationId: c.confirmationId, phraseRequired: phrase,
+        message: `To delete: call neo_confirm_action("${c.confirmationId}", "approve", confirmationPhrase="${phrase}") — the human must type the exact service name — then re-call neo_delete_service with confirmationId="${c.confirmationId}".`,
+      };
     },
   },
   {
@@ -1390,21 +1506,24 @@ export const TOOLS = [
   },
   {
     name: 'neo_delete_project',
-    description: 'Delete a project and ALL its resources (apps, databases, queues, crons, buckets, namespace + PVCs/CNPG). SAFE BY DEFAULT: without confirm:true it returns a PREVIEW (project name, org, full resource inventory, accrued-usage snapshot, no-refund warning) and deletes NOTHING. A NON-EMPTY project additionally requires cascade:true. Destructive and irreversible. Only the creator or an org owner/admin may delete.',
+    description: 'Delete a project and ALL its resources (apps, databases, queues, crons, buckets, namespace + PVCs/CNPG). SAFE BY DEFAULT: with no confirmationId it returns a PREVIEW (name, org, full inventory, metering, no-refund) AND a server-side CONFIRMATION, deleting NOTHING. Then: show the user, call neo_confirm_action(confirmationId, "approve", confirmationPhrase=<EXACT project name>), then re-call this tool with that confirmationId. Server-enforced, single-use, exact-name. Destructive and irreversible. Only the creator or an org owner/admin may delete.',
     mutating: true,
     destructive: true,
     schema: {
       type: 'object',
       properties: {
         projectId: str('Project id'),
-        confirm: { type: 'boolean', description: 'Must be true to delete. Without it you get a preview only (nothing is deleted).' },
-        cascade: { type: 'boolean', description: 'Required true to delete a NON-EMPTY project — acknowledges every resource in the inventory is destroyed.' },
-        deletionHash: str('For a non-empty project: the deletionHash from the preview. The tool refuses if the live inventory no longer matches it (immutable approval).'),
+        confirmationId: str('An APPROVED confirmation id (from neo_confirm_action). Omit to get the preview + a fresh confirmation.'),
       },
       required: ['projectId'],
     },
     async call(api, args) {
       const pid = args.projectId;
+      // With an approved confirmation: the server consumes it atomically and deletes.
+      if (args.confirmationId) {
+        const { status, data } = await api.del(`/api/v1/projects/${pid}?confirmationId=${encodeURIComponent(args.confirmationId)}`);
+        return { deleted: true, project: { id: pid }, result: result(status, data) };
+      }
       // Gather inventory + usage BEFORE any delete (this is also the metering snapshot).
       const safeGet = async (p) => { try { return (await api.get(p)).data; } catch { return null; } };
       const [proj, apps, dbs, queues, crons, buckets, usage] = await Promise.all([
@@ -1429,36 +1548,28 @@ export const TOOLS = [
       // project is empty — treat it as non-empty so the empty-path can't silently
       // delete hidden resources (the preview must be trustworthy).
       const inventoryIncomplete = [apps, dbs, queues, crons, buckets].some((x) => x === null);
-      const preview = {
+      // Create a server-side, single-use, exact-name confirmation for this deletion.
+      let confirmationId, phraseRequired = proj && proj.name;
+      try {
+        const c = (await api.post('/api/v1/confirmations', { action: 'project_delete', projectId: pid })).data;
+        confirmationId = c.confirmationId;
+        phraseRequired = (c.summary && c.summary.phraseRequired) || phraseRequired;
+      } catch (e) {
+        return { deleted: false, error: 'confirmation_failed', message: 'Could not create a deletion confirmation: ' + (e.message || e) };
+      }
+      return {
+        deleted: false,
+        requiresConfirmation: true,
         project: proj ? { id: proj.id, name: proj.name, organizationId: proj.organizationId } : { id: pid },
         resourceInventory: inv,
         resourceCount: total,
         meteringSnapshot: usage ? { period: usage.period, total: usage.total ?? usage.totalCost, currency: usage.currency } : null,
         inventoryIncomplete: inventoryIncomplete || undefined,
-        deletionHash: deletionHashOf(pid, inv, total),
-        warning: 'IRREVERSIBLE: deletes the project, every resource above, and their data (database/queue volumes included). No refund for prepaid or accrued usage.',
+        warning: 'IRREVERSIBLE: deletes the project, every resource above, and their data (database/queue volumes included). No refund for prepaid or accrued usage. The organization itself remains.',
+        confirmationId,
+        phraseRequired,
+        message: `Show the user this inventory. To delete: call neo_confirm_action("${confirmationId}", "approve", confirmationPhrase="${phraseRequired}") — the human must type the exact project name — then re-call neo_delete_project with confirmationId="${confirmationId}".`,
       };
-      // Treat an unverifiable inventory as non-empty — never allow the no-cascade path
-      // when we could not confirm the project is actually empty.
-      const requireCascade = total > 0 || inventoryIncomplete;
-      if (args.confirm !== true) {
-        return { ...preview, deleted: false, requiresConfirmation: true, message: requireCascade ? 'Show this inventory to the user. To delete, re-call with confirm:true, cascade:true, and deletionHash.' : 'Empty project. To delete, re-call with confirm:true.' };
-      }
-      if (requireCascade && args.cascade !== true) {
-        return { ...preview, deleted: false, error: 'cascade_required', message: inventoryIncomplete ? 'Could not fully verify the project inventory — re-call with confirm:true AND cascade:true to delete anyway.' : `This project has ${total} resource(s). Re-call with confirm:true AND cascade:true to delete them all.` };
-      }
-      // Immutable approval: a non-empty cascade delete must echo the preview's
-      // deletionHash, and it must still match the live inventory.
-      if (total > 0) {
-        if (!args.deletionHash) {
-          return { ...preview, deleted: false, error: 'deletion_hash_required', message: 'Pass deletionHash (from the preview) to confirm you are deleting exactly this inventory.' };
-        }
-        if (args.deletionHash !== preview.deletionHash) {
-          return { ...preview, deleted: false, error: 'inventory_changed', message: 'The project inventory changed since your preview — re-preview and pass the new deletionHash.' };
-        }
-      }
-      const { status, data } = await api.del(`/api/v1/projects/${pid}`);
-      return { deleted: true, project: preview.project, removed: inv, resourceCount: total, meteringSnapshot: preview.meteringSnapshot, result: result(status, data) };
     },
   },
 ];