@biznetgio/neo-app 0.4.39 → 0.4.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.39",
+  "version": "0.4.41",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/prompt.md

@@ -6,7 +6,7 @@ Keep this in sync with cli/prompt.md (the npm package's bundled copy).
 -->
 # Set this repo up on NEO App
 
-**Version:** 0.4.4 · **Last updated:** 2026-10-15
+**Version:** 0.4.5 · **Last updated:** 2026-10-15
 
 These are the official setup instructions from NEO App (Biznet Gio's managed-app
 platform). If you are an AI coding agent, complete the steps below yourself by running
@@ -138,6 +138,30 @@ use `neo_enable_db_public_access` / `neo_enable_queue_public_access` (deploy it
 Never deploy to **production** without an explicit request, and never default a missing
 environment — every create/deploy names `staging` or `production`.
 
+## Talking to non-technical users (vibe coders)
+
+Most people deploying here are not platform engineers. Keep the conversation about
+*their app*, not Kubernetes.
+
+- **Ask one short question at a time**, and lead with the recommended answer, e.g.
+  "I'll deploy this as a web service (recommended) — or is it a background worker?".
+- **Follow the user's language.** If they write in Bahasa Indonesia, reply and ask in
+  Bahasa Indonesia.
+- **Don't ask about platform internals** — ingress, build contexts, runtime classes,
+  Dockerfile paths, namespaces. Infer them (`neo_scan_repo` gives contextDir, build
+  type, and a suggested port) or use safe defaults, and only surface a choice that
+  genuinely changes the outcome (web vs worker, which components, the cost).
+- **Only ask which components to deploy when there's real ambiguity** — a monorepo
+  with several runnable services. For a single component, just proceed.
+- **A scheduled job needs a target.** If the user asks for a cron but doesn't say what
+  it should hit, ask which URL or service command to run (use `neo_cron_questionnaire`).
+- **Show the cost and get an explicit yes before anything billable** (the Approve &
+  Create / confirmation gates). Never infer consent from silence or an earlier,
+  unrelated approval.
+
+The confirmed component/topology choice is captured in the immutable plan
+(`neo_plan_stack`) — you don't modify the user's repository to record it.
+
 ## Environment
 
 The CLI targets production by default. Set `NEO_APP_URL` to point it at a different

package/src/api.js

@@ -3,6 +3,8 @@
 // All routes are under /api/v1. A 202 + {status:"pending_approval"} is a normal
 // result (org approval policy), NOT an error, so only >=400 throws.
 
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
 export class ApiError extends Error {
   constructor(status, message, body) {
     super(message);
@@ -28,12 +30,28 @@ export class NeoApi {
     const headers = { Accept: accept || 'application/json' };
     if (this.token) headers.Authorization = `Bearer ${this.token}`;
     if (body !== undefined) headers['Content-Type'] = 'application/json';
+    const init = { method, headers, body: body !== undefined ? JSON.stringify(body) : undefined };
 
-    const res = await fetch(url, {
-      method,
-      headers,
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
+    // Transient-failure retry: a long stack apply polls for minutes, and a single
+    // dropped connection ("fetch failed") or a brief 502/503/504 shouldn't fail the
+    // whole operation. Only retry IDEMPOTENT methods automatically — a POST/PUT that
+    // may have been processed must not be silently re-sent.
+    const idempotent = method === 'GET' || method === 'DELETE';
+    const maxTries = idempotent ? 4 : 1;
+    let res, lastErr;
+    for (let attempt = 1; attempt <= maxTries; attempt++) {
+      try {
+        res = await fetch(url, init);
+      } catch (e) {
+        lastErr = e; // connection never completed — transient
+        if (idempotent && attempt < maxTries) { await sleep(250 * 2 ** (attempt - 1)); continue; }
+        throw new ApiError(0, `network error contacting ${this.baseUrl}: ${e?.message || e}`, null);
+      }
+      if (idempotent && [502, 503, 504].includes(res.status) && attempt < maxTries) {
+        await sleep(250 * 2 ** (attempt - 1)); continue;
+      }
+      break;
+    }
 
     const ctype = res.headers.get('content-type') || '';
     const isJson = ctype.includes('application/json');

package/src/mcp/tools.js

@@ -1242,6 +1242,13 @@ export const TOOLS = [
               targetService: str('cron http_endpoint: name of a web app resource IN THIS STACK to hit — its deployed URL is resolved at apply (use instead of a literal url for a same-stack service)'),
               targetPath: str('cron http_endpoint: path appended to the targetService URL (e.g. "/cron")'),
               method: str('cron http_endpoint: HTTP method'),
+              headers: { type: 'object', description: 'cron http_endpoint: request headers (secret values redacted on read-back)' },
+              body: str('cron http_endpoint: request body'),
+              contentType: str('cron http_endpoint: Content-Type for the body (merged into headers)'),
+              expectedStatus: int('cron http_endpoint: exact HTTP status required for a run to succeed (default any 2xx)'),
+              timeoutSeconds: int('cron: per-run timeout (seconds)'),
+              retryCount: int('cron: retries on failure'),
+              concurrencyPolicy: { type: 'string', enum: ['Allow', 'Forbid', 'Replace'], description: 'cron: overlap policy (default Allow)' },
             },
             required: ['kind', 'name'],
           },