@biznetgio/neo-app 0.4.66 → 0.4.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.66",
+  "version": "0.4.67",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -313,7 +313,8 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'service_usage', 'create', 'list', 'get', 'update', 'verify', 'enable_public_access', 'disable_public_access', 'deploy', 'scale', 'add_domain', 'remove_domain', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'cron_questionnaire', 'presign_object', 'backup', 'restore', 'delete', 'delete_project', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'plan_promotion', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'service_usage', 'create', 'list', 'get', 'update', 'verify', 'enable_public_access', 'disable_public_access', 'deploy', 'scale', 'add_domain', 'remove_domain', 'domain_status', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'cron_questionnaire', 'presign_object', 'backup', 'restore', 'delete', 'delete_project', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        promotion: { supported: true, byCopy: true, tool: 'neo_plan_promotion', note: 'staging→production promotion by copy (JNG #112 §8.7): an immutable costed prod stack plan; applied with neo_apply_stack; copies build/compute/env/bound foundations, never custom domains or secret values, never mutates the source.' },
         bindings: { supported: true, targets: ['neo_db', 'neo_queue', 'neo_object_storage'], writeOnly: true, note: 'neo_bind_resource + neo_plan_stack bindings inject DATABASE_URL / NATS_URL (+ NATS_HOST/PORT/USER/PASSWORD) / S3_* server-side at deploy; secrets never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
@@ -1764,6 +1765,24 @@ export const TOOLS = [
       return result(status, data);
     },
   },
+  {
+    name: 'neo_plan_promotion',
+    description:
+      'Plan a COPY of a non-production service (and the foundations it binds) INTO production — staging→prod promotion by copy (JNG #112 §8.7). Zero-write: it returns an immutable costed production stack plan (planId, planHash, incremental cost, expiry) — it creates nothing and NEVER changes the source service. Copies the build/image spec, compute, port, command, replicas, non-secret env, and its bound database/queue/bucket (fresh prod copies + bindings). Does NOT copy custom domains, and never copies secret values — the response `secrets.requiresReentry` lists secret env keys to set with neo_set_service_variable after prod is healthy. Review the cost + graph with the user, then apply with neo_apply_stack (planId + planHash). Returns distinct production resources; the staging service stays live and unchanged.',
+    mutating: false,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id of the source (non-production) service'),
+        appId: str('The source service/app id to promote (from neo_list_services)'),
+      },
+      required: ['projectId', 'appId'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/projects/${args.projectId}/promotions`, { appId: args.appId });
+      return result(status, data);
+    },
+  },
   {
     name: 'neo_get_operation',
     description: 'Get the status of a stack apply (the operationId/planId from neo_apply_stack). Overall status: applying | applied | partial | failed. Per-resource status: creating | deploying | deployed | ready | blocked | failed, plus a `healthy` flag + `url` for services (apply probes the public URL — "ready" means it actually responded) and `blockedBy` when a consumer\'s foundation failed. Poll until terminal.',

package/src/skill/SKILL.md

@@ -23,6 +23,20 @@ NEO App is Biznet Gio's managed-app platform. You operate it two ways:
 - Prefer **staging** for every change: deploy, test, and read logs on staging before touching production.
 - Only deploy to production when the user explicitly asks (pin `production` deliberately), and expect it to require approval (see below).
 
+## Analyzing a repo & asking questions (vibecoder-friendly)
+
+- `neo_scan_repo` detects deployable components, service/build types, ports, and managed-resource `deps` (database/queue/object_storage). Treat manifests as **optional evidence, not prerequisites** — a repo without a lockfile or Dockerfile is still deployable.
+- **Ask only on genuine ambiguity** (several deployable components, or an unclear target). When you must ask, ask **one short question at a time**, and give the **recommended answer first**. Don't batch a questionnaire.
+- **Follow the user's language.** If they write in Bahasa Indonesia, ask in clear Bahasa Indonesia.
+- **Don't ask a vibecoder about platform internals** (ingress, build contexts, runtime classes, Dockerfile paths, resource classes). Infer sensible defaults and proceed; expose those only if an advanced user asks.
+- Preserve the selected root path, build context, and Dockerfile path as-is. Store the confirmed topology **with the plan** (`neo_plan_stack` resource `deps` + bindings) — never modify the repo to record it.
+- Wire detected dependencies: if a component `deps` on a queue/database, create it and bind it, or the plan is flagged `incompleteTopology` and apply refuses it.
+
+## Promotion (staging → production, by copy)
+
+- To copy a healthy staging service to production, use `neo_plan_promotion({projectId, appId})` → review the incremental cost + graph with the user → apply with `neo_apply_stack` (planId + planHash). It never changes staging.
+- After production is healthy: re-enter secret env (`secrets.requiresReentry`) with `neo_set_service_variable(secret:true)`, then attach any custom domain (`neo_add_service_domain`) and confirm it with `neo_get_domain_status`. Domains and secret values are never copied.
+
 ## Deployments
 
 - Deploy with `neo_deploy` (or `neo-app deploy`), passing the `projectId` and environment.