@biznetgio/neo-app 0.4.40 → 0.4.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.40",
+  "version": "0.4.42",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/api.js

@@ -3,6 +3,8 @@
 // All routes are under /api/v1. A 202 + {status:"pending_approval"} is a normal
 // result (org approval policy), NOT an error, so only >=400 throws.
 
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
 export class ApiError extends Error {
   constructor(status, message, body) {
     super(message);
@@ -28,12 +30,28 @@ export class NeoApi {
     const headers = { Accept: accept || 'application/json' };
     if (this.token) headers.Authorization = `Bearer ${this.token}`;
     if (body !== undefined) headers['Content-Type'] = 'application/json';
+    const init = { method, headers, body: body !== undefined ? JSON.stringify(body) : undefined };
 
-    const res = await fetch(url, {
-      method,
-      headers,
-      body: body !== undefined ? JSON.stringify(body) : undefined,
-    });
+    // Transient-failure retry: a long stack apply polls for minutes, and a single
+    // dropped connection ("fetch failed") or a brief 502/503/504 shouldn't fail the
+    // whole operation. Only retry IDEMPOTENT methods automatically — a POST/PUT that
+    // may have been processed must not be silently re-sent.
+    const idempotent = method === 'GET' || method === 'DELETE';
+    const maxTries = idempotent ? 4 : 1;
+    let res, lastErr;
+    for (let attempt = 1; attempt <= maxTries; attempt++) {
+      try {
+        res = await fetch(url, init);
+      } catch (e) {
+        lastErr = e; // connection never completed — transient
+        if (idempotent && attempt < maxTries) { await sleep(250 * 2 ** (attempt - 1)); continue; }
+        throw new ApiError(0, `network error contacting ${this.baseUrl}: ${e?.message || e}`, null);
+      }
+      if (idempotent && [502, 503, 504].includes(res.status) && attempt < maxTries) {
+        await sleep(250 * 2 ** (attempt - 1)); continue;
+      }
+      break;
+    }
 
     const ctype = res.headers.get('content-type') || '';
     const isJson = ctype.includes('application/json');

package/src/commands/deploy.js

@@ -8,7 +8,7 @@ import { getCredential } from '../creds.js';
 import { NeoApi } from '../api.js';
 import { readLink } from '../link.js';
 import { deploySource } from '../deploySource.js';
-import { log, ok, fail, warn, step, c } from '../util.js';
+import { log, ok, fail, warn, step, c, confirm } from '../util.js';
 
 function isGitUrl(s) {
   if (!s) return false;
@@ -29,6 +29,13 @@ function isDir(s) {
   }
 }
 
+function showCost(r) {
+  if (r?.estimatedCost) {
+    const e = r.estimatedCost;
+    log(c.bold(`Estimated cost: ~${e.monthly} ${e.currency}/mo (${e.hourly}/h)`) + (e.assumptions ? c.dim(` — ${e.assumptions}`) : ''));
+  }
+}
+
 export async function deploy(source, opts = {}) {
   // `--source <path|.zip|git-url>` is an explicit alias for the positional source, as
   // documented in the deploy examples (JNG #75/#79); the positional still works.
@@ -74,7 +81,7 @@ export async function deploy(source, opts = {}) {
   const dryRun = !!opts['dry-run'];
   if (dryRun) log(c.dim('dry-run — no changes will be made'));
 
-  const r = await deploySource(api, {
+  const base = {
     projectId,
     src,
     name: opts.name,
@@ -82,12 +89,33 @@ export async function deploy(source, opts = {}) {
     port: opts.port,
     build: opts.build,
     environment,
-    dryRun,
     timeout: Number(opts.timeout) || 300,
     log: step,
-  });
+  };
+
+  // Cost gate: a real deploy is billable, so it needs explicit approval. `--yes` approves
+  // up front (headless/CI); otherwise preview the cost first, then confirm (interactive)
+  // or require `--yes` (non-interactive). A spec-bound confirmToken links the approval to
+  // the exact cost shown, so nothing deploys if the spec drifts.
+  let confirmToken;
+  if (!dryRun && !opts.yes) {
+    const prev = await deploySource(api, { ...base, dryRun: true });
+    showCost(prev);
+    if (!process.stdin.isTTY) {
+      fail('billable deploy — re-run with --yes to approve (non-interactive)');
+      process.exit(1);
+    }
+    if (!(await confirm('Proceed with this billable deploy?'))) {
+      ok('cancelled — nothing deployed');
+      return prev;
+    }
+    confirmToken = prev.confirmToken;
+  }
+
+  const r = await deploySource(api, { ...base, dryRun, confirm: !!opts.yes, confirmToken });
 
   if (r.dryRun) {
+    showCost(r);
     ok(`dry-run complete — ${r.plan.length} step(s) planned, nothing written`);
     return r;
   }

package/src/deploySource.js

@@ -155,7 +155,7 @@ function looksStatic(dir) {
 // With `dryRun`, it performs NO create/update/upload/deploy — only the GETs needed to
 // build a plan — and returns { dryRun:true, plan } (JNG #93).
 // Returns { pending, approvalId } or { appId, url, result }. `log(msg)` is optional.
-export async function deploySource(api, { projectId, src, name, port, build, serviceType, buildCommand, publishDirectory, environment, confirmToken, dryRun = false, timeout = 300, log = () => {} }) {
+export async function deploySource(api, { projectId, src, name, port, build, serviceType, buildCommand, publishDirectory, environment, confirmToken, confirm = false, dryRun = false, timeout = 300, log = () => {} }) {
   const defaultName =
     src.mode === 'image' ? src.image.split('/').pop().split(':')[0]
     : src.mode === 'git' ? basename(src.repo, '.git')
@@ -220,10 +220,16 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
     }
   }
 
+  // Cost gate (0.4.40 retest A — a bare deploy must not create a billable service with
+  // no cost consent): a real deploy needs explicit approval BEFORE any mutation —
+  // either confirm:true or a matching confirmToken from a prior dry-run. Unapproved →
+  // run read-only (like a dry-run) and return requiresConfirmation.
+  const previewOnly = dryRun || !(confirmToken || confirm === true);
+
   const plan = [];
   if (!app) {
     plan.push(`create ${svcType} service "${svc}" (${buildType}) in ${targetEnv}`);
-    if (!dryRun) {
+    if (!previewOnly) {
       const res = await api.post(`/api/v1/projects/${projectId}/apps`, {
         name: svc,
         environment: targetEnv,
@@ -264,7 +270,7 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
     if (buildType && app.buildType && app.buildType !== buildType) patch.buildType = buildType;
     if (Object.keys(patch).length) {
       plan.push(`update "${svc}": ${Object.keys(patch).join(', ')}`);
-      if (!dryRun) {
+      if (!previewOnly) {
         const upd = await api.put(`/api/v1/apps/${app.id}`, patch);
         // If the source-config update needs approval, STOP — deploying now would ship
         // the OLD config while the change is still pending (JNG #96 re-validation).
@@ -279,28 +285,37 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
   if (src.mode === 'dir' || src.mode === 'zip') plan.push(`upload build context (${src.mode})`);
   plan.push(`deploy "${svc}"`);
 
-  if (dryRun) {
-    for (const p of plan) log(`[dry-run] would ${p}`);
-    // Cost confirmation before a billable deploy (handoff 3.3/3.4). A new service
-    // starts on the default compute tier; estimate from the live price book so the
-    // user sees the cost in the dry-run. Best-effort — never fail the dry-run on it.
+  const token = deployToken({ svc, targetEnv, svcType, port, buildCommand, publishDirectory, src });
+  // Build the cost preview (+ spec-bound confirmToken) once — used for the dry-run AND
+  // for the mandatory pre-deploy gate below.
+  const buildPreview = async () => {
     let estimatedCost;
     try {
       const book = (await api.get('/api/v1/pricing')).data;
       estimatedCost = estimateCost(book, { computeTier: 'micro' });
+    } catch { /* price book unavailable — skip the estimate */ }
+    return { dryRun: true, plan, service: svc, environment: targetEnv, serviceType: svcType, estimatedCost, confirmToken: token };
+  };
+
+  // Preview path (explicit dry-run OR an unapproved real deploy). No mutation ran above,
+  // so this returns the cost + spec-bound confirmToken and deploys NOTHING. An explicit
+  // dry-run returns the plain preview; an unapproved real deploy adds requiresConfirmation
+  // (MANDATORY gate 0.4.40 retest A — a bare deploy previously created a billable service
+  // with no cost consent).
+  if (previewOnly) {
+    for (const p of plan) log(`[dry-run] would ${p}`);
+    const prev = await buildPreview();
+    if (prev.estimatedCost) {
       const build = svcType === 'static_site' ? 'native nginx static hosting (not Railpack)' : 'built server-side';
-      log(`[dry-run] estimated cost (${svcType}, ${build}, default micro compute): ~${estimatedCost.monthly} ${estimatedCost.currency}/mo (${estimatedCost.hourly}/h) — ${estimatedCost.assumptions}. Use neo_estimate for a specific size.`);
-    } catch { /* price book unavailable — skip the estimate, not the dry-run */ }
-    return { dryRun: true, plan, service: svc, environment: targetEnv, serviceType: svcType, estimatedCost, confirmToken: deployToken({ svc, targetEnv, svcType, port, buildCommand, publishDirectory, src }) };
+      log(`[dry-run] estimated cost (${svcType}, ${build}, default micro compute): ~${prev.estimatedCost.monthly} ${prev.estimatedCost.currency}/mo (${prev.estimatedCost.hourly}/h) — ${prev.estimatedCost.assumptions}. Use neo_estimate for a specific size.`);
+    }
+    if (dryRun) return prev;
+    return { ...prev, requiresConfirmation: true, note: 'Billable deploy — show the user the cost, then re-call with this confirmToken (or confirm:true) to deploy. Nothing was deployed.' };
   }
 
-  // Crypto link: if the caller passed the dry-run's confirmToken, the spec about to
-  // deploy must still hash to it — otherwise the cost/spec the user approved changed.
-  if (confirmToken) {
-    const now = deployToken({ svc, targetEnv, svcType, port, buildCommand, publishDirectory, src });
-    if (now !== confirmToken) {
-      throw new Error(`deploy spec changed since the dry-run (confirmToken ${confirmToken} → ${now}) — re-run with dryRun:true, show the new cost, and confirm again`);
-    }
+  // Approved deploy. A supplied confirmToken must still match the resolved spec (cost unchanged).
+  if (confirmToken && token !== confirmToken) {
+    throw new Error(`deploy spec changed since the dry-run (confirmToken ${confirmToken} → ${token}) — re-run with dryRun:true, show the new cost, and confirm again`);
   }
 
   if (src.mode === 'dir' || src.mode === 'zip') {

package/src/index.js

@@ -33,7 +33,7 @@ ${c.bold('Options')}
   --agent <codex|claude-code>   Target one agent (config install-mcp)
   --url <url>              Override the control-plane URL (also NEO_APP_URL)
   --token <kap_...>        API key (also NEO_APP_TOKEN; prompted if omitted)
-  --yes                    Non-interactive (headless/CI)
+  --yes                    Non-interactive (headless/CI); also approves a billable deploy without the cost prompt
   --dry-run               Print intended changes without writing
   -v, --version           Print version
   -h, --help              Show this help`;

package/src/mcp/tools.js

@@ -614,7 +614,7 @@ export const TOOLS = [
   {
     name: 'neo_deploy_folder',
     description:
-      'Deploy a local folder or .zip in a project (built server-side). The path is on the machine running this MCP server. Pick the environment with `environment` (JNG #72). Pick the service type with `serviceType`: web (default), worker (background job, no public URL), or static_site; a plainly-static folder auto-detects as static_site. A worker is never given a public port/ingress; its type is never silently changed on redeploy (handoff 4.2/4.3).',
+      'Deploy a local folder or .zip in a project (built server-side). The path is on the machine running this MCP server. COST GATE (mandatory): a billable deploy requires a confirmToken — call once to get the cost + confirmToken (returns status:requires_confirmation, deploys nothing), show the user, then re-call with that confirmToken to deploy. Pick the environment with `environment` (JNG #72). Pick the service type with `serviceType`: web (default), worker (background job, no public URL), or static_site; a plainly-static folder auto-detects as static_site. A worker is never given a public port/ingress; its type is never silently changed on redeploy (handoff 4.2/4.3).',
     mutating: true,
     schema: {
       type: 'object',
@@ -629,6 +629,7 @@ export const TOOLS = [
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production. Never defaulted (handoff §2). Deploy to staging first.' },
         dryRun: { type: 'boolean', description: 'Preview the plan without creating/uploading/deploying anything (JNG #93). Returns a confirmToken.' },
         confirmToken: str('The confirmToken from a prior dryRun — pass it on the real deploy to guarantee the spec/cost the user approved has not changed (rejected on mismatch).'),
+        confirm: { type: 'boolean', description: 'Approve the billable deploy after showing the user the cost (alternative to confirmToken). Without confirmToken or confirm:true the tool returns the cost and deploys nothing.' },
       },
       required: ['projectId', 'path', 'environment'],
     },
@@ -654,9 +655,10 @@ export const TOOLS = [
         port: args.port,
         environment,
         confirmToken: args.confirmToken,
+        confirm: args.confirm === true,
         dryRun: !!args.dryRun,
       });
-      if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment, estimatedCost: r.estimatedCost, confirmToken: r.confirmToken, note: 'To deploy exactly this, re-call without dryRun and pass this confirmToken.' };
+      if (r.dryRun) return { status: r.requiresConfirmation ? 'requires_confirmation' : 'dry_run', requiresConfirmation: r.requiresConfirmation || undefined, plan: r.plan, service: r.service, environment: r.environment, estimatedCost: r.estimatedCost, confirmToken: r.confirmToken, note: r.note || 'To deploy exactly this, re-call without dryRun and pass this confirmToken.' };
       if (r.pending) return { status: 'pending_approval', approvalId: r.approvalId };
       return { status: r.result, url: r.url || undefined, appId: r.appId };
     },
@@ -1242,6 +1244,13 @@ export const TOOLS = [
               targetService: str('cron http_endpoint: name of a web app resource IN THIS STACK to hit — its deployed URL is resolved at apply (use instead of a literal url for a same-stack service)'),
               targetPath: str('cron http_endpoint: path appended to the targetService URL (e.g. "/cron")'),
               method: str('cron http_endpoint: HTTP method'),
+              headers: { type: 'object', description: 'cron http_endpoint: request headers (secret values redacted on read-back)' },
+              body: str('cron http_endpoint: request body'),
+              contentType: str('cron http_endpoint: Content-Type for the body (merged into headers)'),
+              expectedStatus: int('cron http_endpoint: exact HTTP status required for a run to succeed (default any 2xx)'),
+              timeoutSeconds: int('cron: per-run timeout (seconds)'),
+              retryCount: int('cron: retries on failure'),
+              concurrencyPolicy: { type: 'string', enum: ['Allow', 'Forbid', 'Replace'], description: 'cron: overlap policy (default Allow)' },
             },
             required: ['kind', 'name'],
           },