@biznetgio/neo-app 0.4.63 → 0.4.65

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.63",
+  "version": "0.4.65",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -68,6 +68,19 @@ const allowCrossEnvProp = { allowCrossEnvironment: { type: 'boolean', descriptio
 // invariant in sequence (each must start from a clean, unpinned session).
 export function resetSessionEnv() { sessionEnv = null; }
 
+// assertResourceEnv enforces the session pin on an EXISTING resource addressed by id (JNG #136 §4):
+// if the session is pinned and the resource lives in a different environment, refuse so an
+// ID-based op can't touch the wrong environment's resource. allowCrossEnvironment overrides it;
+// resources with no environment (buckets are shared) and an unpinned session are not guarded.
+async function assertResourceEnv(api, getPath, allowCross = false) {
+  if (!sessionEnv || allowCross) return;
+  let env;
+  try { env = (await api.get(getPath)).data?.environment; } catch { return; } // can't resolve → don't block
+  if (env && env !== sessionEnv) {
+    throw new Error(`environment_mismatch: this session is pinned to "${sessionEnv}" but that resource is in "${env}". Staging and production must not be mixed (JNG #136). Pass allowCrossEnvironment:true to act on it anyway, or re-pin with neo_set_context.`);
+  }
+}
+
 // deleteAndConverge deletes a resource, then polls its endpoint until the inventory
 // actually converges (GET → 404), so a delete isn't reported done while the record
 // still exists. Returns a durable operation reference (`del-<id>`) + convergence
@@ -443,11 +456,13 @@ export const TOOLS = [
         healthTimeoutSeconds: int('Health-check timeout (s)'),
         healthGraceSeconds: int('Health-check grace period (s)'),
         confirm: { type: 'boolean', description: 'Approve a cost change (compute/replicas/autoscale/volume): without it the new cost is returned and nothing is applied.' },
+        ...allowCrossEnvProp,
       },
       required: ['appId'],
     },
     async call(api, args) {
-      const { appId, confirm, orgId, computeTier, ...rest } = args;
+      const { appId, confirm, orgId, computeTier, allowCrossEnvironment, ...rest } = args;
+      await assertResourceEnv(api, `/api/v1/apps/${appId}`, allowCrossEnvironment); // JNG #136 §4
       const body = { ...rest };
       if (computeTier) { body.billingMode = 'bundled'; body.cpuLimit = computeTier; }
       else if (args.cpuLimit || args.memoryLimit) { body.billingMode = 'unbundled'; }
@@ -595,8 +610,9 @@ export const TOOLS = [
     description:
       'Trigger a deployment of an app (service). Returns a deployment id — pass it to neo_wait_deployment to block until it finishes (don\'t sleep/guess), or a pending_approval result when org policy gates it. Deploy to staging first.',
     mutating: true,
-    schema: { type: 'object', properties: { appId: str('App/service id') }, required: ['appId'] },
+    schema: { type: 'object', properties: { appId: str('App/service id'), ...allowCrossEnvProp }, required: ['appId'] },
     async call(api, args) {
+      await assertResourceEnv(api, `/api/v1/apps/${args.appId}`, args.allowCrossEnvironment); // JNG #136 §4
       const { status, data } = await api.post(`/api/v1/apps/${args.appId}/deploy`);
       return result(status, data);
     },
@@ -679,8 +695,9 @@ export const TOOLS = [
     name: 'neo_restart_service',
     description: 'Rolling-restart a service with its CURRENT image + config — no rebuild (JNG #128). Use after a config-only change (neo_set_service_variable, neo_update_service) that doesn\'t need a new build, instead of a full neo_deploy. Returns immediately; poll neo_list_pods for the new pods.',
     mutating: true,
-    schema: { type: 'object', properties: { appId: str('Service/app id (from neo_list_services)') }, required: ['appId'] },
+    schema: { type: 'object', properties: { appId: str('Service/app id (from neo_list_services)'), ...allowCrossEnvProp }, required: ['appId'] },
     async call(api, args) {
+      await assertResourceEnv(api, `/api/v1/apps/${args.appId}`, args.allowCrossEnvironment); // JNG #136 §4
       return (await api.post(`/api/v1/apps/${args.appId}/restart`, {})).data;
     },
   },
@@ -695,11 +712,13 @@ export const TOOLS = [
         command: str('Shell command to run (executed via /bin/sh -c)'),
         pod: str('Specific pod name (optional; from neo_list_pods) — else the first running pod'),
         timeoutSeconds: int('Max seconds to wait (default 30, max 120)'),
+        ...allowCrossEnvProp,
       },
       required: ['appId', 'command'],
     },
     async call(api, args) {
-      const { appId, ...body } = args;
+      const { appId, allowCrossEnvironment, ...body } = args;
+      await assertResourceEnv(api, `/api/v1/apps/${appId}`, allowCrossEnvironment); // JNG #136 §4
       return (await api.post(`/api/v1/apps/${appId}/exec`, body)).data;
     },
   },
@@ -722,10 +741,12 @@ export const TOOLS = [
         databaseId: str('Database id (postgres, deployed)'),
         sql: str('SQL to run (piped into psql)'),
         readOnly: { type: 'boolean', description: 'true (default) runs in a read-only session; false allows writes' },
+        ...allowCrossEnvProp,
       },
       required: ['databaseId', 'sql'],
     },
     async call(api, args) {
+      await assertResourceEnv(api, `/api/v1/databases/${args.databaseId}`, args.allowCrossEnvironment); // JNG #136 §4
       return (await api.post(`/api/v1/databases/${args.databaseId}/query`, { sql: args.sql, readOnly: args.readOnly })).data;
     },
   },
@@ -772,10 +793,12 @@ export const TOOLS = [
         key: str('Variable name'),
         value: str('Variable value'),
         secret: { type: 'boolean', description: 'Store as a secret (default false)' },
+        ...allowCrossEnvProp,
       },
       required: ['appId', 'key', 'value'],
     },
     async call(api, args) {
+      await assertResourceEnv(api, `/api/v1/apps/${args.appId}`, args.allowCrossEnvironment); // JNG #136 §4
       const { status, data } = await api.post(`/api/v1/apps/${args.appId}/variables`, { key: args.key, value: args.value, secret: !!args.secret });
       return result(status, data); // {status:"set", key, redeployRequired} — no value returned
     },
@@ -1420,7 +1443,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_list_cron_runs',
-    description: 'List the recent runs of a scheduled job (cron) with their status/timing — run history + output verification (handoff 4.6).',
+    description: 'List the recent runs of a scheduled job (cron): status (running|succeeded|failed), startedAt/finishedAt, and for a FAILED run the terminal diagnostics — reason, message, and the container exitCode — so you can see WHY it failed, not just that it did (JNG #112, handoff 4.6).',
     mutating: false,
     schema: { type: 'object', properties: { cronId: str('Cron/scheduled-job id') }, required: ['cronId'] },
     async call(api, args) {
@@ -1541,11 +1564,29 @@ export const TOOLS = [
         targetType: { type: 'string', enum: ['neo_db', 'neo_queue', 'neo_object_storage'], description: 'neo_db | neo_queue | neo_object_storage — the resource to attach' },
         targetId: str('The database, queue, or bucket id to bind'),
         envKey: str('Env var name / prefix (optional; default DATABASE_URL, NATS_URL, or S3 prefix)'),
+        ...allowCrossEnvProp,
       },
       required: ['appId', 'targetType', 'targetId'],
     },
     async call(api, args) {
-      const { appId, ...body } = args;
+      const { appId, allowCrossEnvironment, ...body } = args;
+      // Environment isolation (JNG #136 §4): the consumer must match the session pin, and a
+      // consumer must not bind a target from a DIFFERENT environment. Buckets are shared (no env).
+      if (!allowCrossEnvironment) {
+        let cEnv;
+        try { cEnv = (await api.get(`/api/v1/apps/${appId}`)).data?.environment; } catch { /* can't resolve → don't block */ }
+        if (sessionEnv && cEnv && cEnv !== sessionEnv) {
+          throw new Error(`environment_mismatch: this session is pinned to "${sessionEnv}" but that service is in "${cEnv}" (JNG #136). Pass allowCrossEnvironment:true to override, or re-pin with neo_set_context.`);
+        }
+        if (args.targetType !== 'neo_object_storage') {
+          const tPath = args.targetType === 'neo_db' ? `/api/v1/databases/${args.targetId}` : `/api/v1/queues/${args.targetId}`;
+          let tEnv;
+          try { tEnv = (await api.get(tPath)).data?.environment; } catch { /* ignore */ }
+          if (cEnv && tEnv && cEnv !== tEnv) {
+            throw new Error(`environment_mismatch: cannot bind a "${tEnv}" ${args.targetType} to a "${cEnv}" service — binding across environments is refused (JNG #136). Pass allowCrossEnvironment:true to override.`);
+          }
+        }
+      }
       const { status, data } = await api.post(`/api/v1/apps/${appId}/bindings`, body);
       return redactSecrets(result(status, data));
     },
@@ -1639,6 +1680,7 @@ export const TOOLS = [
               image: str('app/cron: prebuilt image reference'),
               repoUrl: str('app: git repository URL'),
               branch: str('app: git branch'),
+              deps: { type: 'array', items: { type: 'string', enum: ['database', 'queue', 'object_storage'] }, description: 'app: managed-resource dependencies this service needs (from neo_scan_repo `deps`). The plan flags any dep not satisfied by a binding as incompleteTopology and apply refuses it unless acknowledged — so a service needing NATS_URL/DATABASE_URL isn\'t deployed into a 503 (JNG #112 §7).' },
               port: int('app: container port'),
               computeTier: str('app/db/queue: micro | small | medium | large | xlarge'),
               engine: str('database: postgres | mysql'),
@@ -1697,18 +1739,19 @@ export const TOOLS = [
   {
     name: 'neo_apply_stack',
     description:
-      'Apply a planned stack. REQUIRES the planId and the exact planHash from neo_plan_stack — the SERVER rejects a missing, changed, expired, or already-applied plan, so a billable stack can never be created without first creating + reviewing its costed plan (handoff 3.4/3.5, server-enforced approval). Creates resources in dependency order (foundations → services → bindings → deploy) and returns an operationId to poll with neo_get_operation.',
+      'Apply a planned stack. REQUIRES the planId and the exact planHash from neo_plan_stack — the SERVER rejects a missing, changed, expired, or already-applied plan, so a billable stack can never be created without first creating + reviewing its costed plan (handoff 3.4/3.5, server-enforced approval). Creates resources in dependency order (foundations → services → bindings → deploy) and returns an operationId to poll with neo_get_operation. If the plan has an incompleteTopology (a service dependency not bound), apply returns error "incomplete_topology" — wire the missing resource + re-plan, or pass acknowledgeIncompleteTopology:true to deploy anyway.',
     mutating: true,
     schema: {
       type: 'object',
       properties: {
         planId: str('Plan id from neo_plan_stack'),
         planHash: str('Plan hash from neo_plan_stack — must match exactly (proves you reviewed this plan)'),
+        acknowledgeIncompleteTopology: { type: 'boolean', description: 'Deploy past a detected unmet dependency (incompleteTopology) — e.g. a service that needs NATS_URL with no queue bound. Default false refuses it (JNG #112 §7).' },
       },
       required: ['planId', 'planHash'],
     },
     async call(api, args) {
-      const { status, data } = await api.post(`/api/v1/plans/${args.planId}/apply`, { planHash: args.planHash });
+      const { status, data } = await api.post(`/api/v1/plans/${args.planId}/apply`, { planHash: args.planHash, acknowledgeIncompleteTopology: !!args.acknowledgeIncompleteTopology });
       return result(status, data);
     },
   },