@biznetgio/neo-app 0.4.47 → 0.4.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.47",
+  "version": "0.4.49",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/deploySource.js

@@ -54,7 +54,9 @@ function collectExcludes(dir) {
     for (let line of readFileSync(p, 'utf8').split(/\r?\n/)) {
       line = line.trim();
       if (!line || line.startsWith('#') || line.startsWith('!')) continue;
-      excludes.add(line.replace(/^\/+/, '').replace(/\/+$/, ''));
+      // Keep a leading slash: a gitignore anchor like `/themes` matches ONLY the root
+      // entry, not every nested `themes/` segment (JNG #116). Trailing slash is dropped.
+      excludes.add(line.replace(/\/+$/, ''));
     }
   }
   return excludes;
@@ -67,6 +69,13 @@ function matchesExclude(rel, excludes) {
   const parts = rel.split('/');
   const base = parts[parts.length - 1];
   for (const pat of excludes) {
+    if (pat.startsWith('/')) {
+      // Anchored (gitignore `/themes`): matches only at the repo root — the entry itself
+      // or something directly under it — NOT every nested `themes/` segment (JNG #116).
+      const a = pat.slice(1);
+      if (rel === a || rel.startsWith(a + '/')) return true;
+      continue;
+    }
     if (pat === base || pat === rel || parts.includes(pat)) return true;
     if (pat.startsWith('*.') && base.endsWith(pat.slice(1))) return true;
   }
@@ -84,6 +93,9 @@ function collectIncludedFiles(dir) {
     let entries;
     try { entries = readdirSync(d, { withFileTypes: true }); } catch { return; }
     for (const e of entries) {
+      // Skip macOS cruft: AppleDouble resource forks (._*) and .DS_Store break Linux
+      // builds and are never part of the app (JNG #115).
+      if (e.name === '.DS_Store' || e.name.startsWith('._')) continue;
       const r = rel ? `${rel}/${e.name}` : e.name;
       if (matchesExclude(r, excludes) || isSecretPath(r)) continue;
       if (e.isDirectory()) walk(join(d, e.name), r);
@@ -267,7 +279,10 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
       if (src.repo && app.repoUrl !== src.repo) patch.repoUrl = src.repo;
       if (src.branch && app.branch !== src.branch) patch.branch = src.branch;
     }
-    if (buildType && app.buildType && app.buildType !== buildType) patch.buildType = buildType;
+    // Only change an existing service's build-type when EXPLICITLY asked (--build/build),
+    // never from an auto-detected buildType (e.g. a Dockerfile that appeared in the repo):
+    // a silent build-type switch on redeploy surprised users (JNG #131).
+    if (build && app.buildType && app.buildType !== buildType) patch.buildType = buildType;
     if (Object.keys(patch).length) {
       plan.push(`update "${svc}": ${Object.keys(patch).join(', ')}`);
       if (!previewOnly) {
@@ -337,7 +352,10 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
         const listFile = join(tmpdir(), `neo-files-${app.id}-${Date.now()}.txt`);
         writeFileSync(listFile, files.join('\n') + '\n');
         try {
-          execFileSync('tar', ['czf', archive, '-C', src.dir, '-T', listFile], { stdio: 'ignore' });
+          // COPYFILE_DISABLE=1 stops macOS bsdtar from SYNTHESIZING AppleDouble (._*)
+          // entries for files that carry extended attributes — those break Linux glob
+          // builds even though they aren't on disk (JNG #115).
+          execFileSync('tar', ['czf', archive, '-C', src.dir, '-T', listFile], { stdio: 'ignore', env: { ...process.env, COPYFILE_DISABLE: '1' } });
         } finally {
           rmSync(listFile, { force: true });
         }

package/src/mcp/tools.js

@@ -1293,7 +1293,9 @@ export const TOOLS = [
       required: ['planId', 'planHash', 'confirmationId'],
     },
     async call(api, args) {
-      const { status, data } = await api.post(`/api/v1/plans/${args.planId}/apply`, { planHash: args.planHash, confirmationId: args.confirmationId, idempotencyKey: args.idempotencyKey });
+      // Always send an idempotency key (reuse the same one on a retry to dedup/resume).
+      const idempotencyKey = args.idempotencyKey || `idem-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+      const { status, data } = await api.post(`/api/v1/plans/${args.planId}/apply`, { planHash: args.planHash, confirmationId: args.confirmationId, idempotencyKey });
       return redactSecrets(result(status, data));
     },
   },