@lizard-build/cli 0.3.38 → 0.3.40

package/dist/lib/updater.js

@@ -1,11 +1,14 @@
-import { createWriteStream, existsSync, renameSync, chmodSync } from "node:fs";
+import { createWriteStream, existsSync, renameSync, chmodSync, unlinkSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-export const CURRENT_VERSION = "0.3.38";
+import { join, dirname } from "node:path";
+import os from "node:os";
+import { spawn } from "node:child_process";
+export const CURRENT_VERSION = "0.3.40";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
+/** Minimum gap between background update checks. */
+const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6h
 function getBinaryName() {
     const os = process.platform;
     const arch = process.arch;
@@ -19,6 +22,21 @@ function getBinaryName() {
         return "lizard-linux-arm64";
     return null;
 }
+/**
+ * True only when running as the Bun-compiled standalone binary. Under
+ * npm/node, `process.execPath` is the *node* executable — self-update would
+ * overwrite the user's Node.js install with the lizard binary.
+ */
+export function isStandaloneBinary() {
+    return typeof globalThis.Bun !== "undefined";
+}
+function stateDir() {
+    return process.env.LIZARD_HOME
+        ? join(process.env.LIZARD_HOME, ".lizard")
+        : join(os.homedir(), ".lizard");
+}
+const checkStampFile = () => join(stateDir(), "update-check.json");
+const updateNoticeFile = () => join(stateDir(), "update-notice.json");
 export async function getLatestVersion() {
     try {
         const res = await fetch(RELEASES_API, {
@@ -39,64 +57,134 @@ export async function getLatestVersion() {
         return { kind: "error" };
     }
 }
+export function isNewerVersion(latest, current) {
+    const [maj, min, pat] = latest.split(".").map(Number);
+    const [cmaj, cmin, cpat] = current.split(".").map(Number);
+    if (![maj, min, pat, cmaj, cmin, cpat].every(Number.isFinite))
+        return false;
+    return maj > cmaj || (maj === cmaj && min > cmin) || (maj === cmaj && min === cmin && pat > cpat);
+}
 export async function selfUpdate(onProgress) {
     const binaryName = getBinaryName();
     if (!binaryName)
         return false;
-    // Find current executable path
+    // Refuse to replace anything that isn't the standalone lizard binary —
+    // under npm the execPath is the user's node executable.
+    if (!isStandaloneBinary())
+        return false;
     const currentBin = process.execPath;
     if (!existsSync(currentBin))
         return false;
     const url = `${RELEASE_BASE}/${binaryName}`;
-    const tmp = join(tmpdir(), `lizard-update-${Date.now()}`);
+    // Download next to the target binary: rename() must stay on one filesystem
+    // (tmpdir is often tmpfs on Linux → EXDEV).
+    const tmp = join(dirname(currentBin), `.lizard-update-${process.pid}`);
     onProgress?.(`Downloading ${binaryName}...`);
-    const res = await fetch(url, { signal: AbortSignal.timeout(60000) });
-    if (!res.ok)
-        throw new Error(`Download failed: ${res.status}`);
-    const writer = createWriteStream(tmp);
-    await pipeline(Readable.fromWeb(res.body), writer);
-    chmodSync(tmp, 0o755);
-    onProgress?.("Installing...");
-    renameSync(tmp, currentBin);
-    return true;
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(60000) });
+        if (!res.ok)
+            throw new Error(`Download failed: ${res.status}`);
+        const writer = createWriteStream(tmp);
+        await pipeline(Readable.fromWeb(res.body), writer);
+        chmodSync(tmp, 0o755);
+        onProgress?.("Installing...");
+        renameSync(tmp, currentBin);
+        return true;
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch { }
+        throw err;
+    }
 }
-/** Check for a newer version and auto-install it in the background.
- *  Prints a one-line notice on exit — either "Updated to vX.Y.Z" or nothing on failure.
- *  Never blocks or crashes the current command. */
+function readJSON(file) {
+    try {
+        return JSON.parse(readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeJSON(file, data) {
+    try {
+        mkdirSync(stateDir(), { recursive: true });
+        writeFileSync(file, JSON.stringify(data));
+    }
+    catch { }
+}
+function autoUpdateDisabled() {
+    return Boolean(process.env.LIZARD_NO_UPDATE || process.env.CI);
+}
+/** Print (once) the notice left behind by a completed background update. */
+function flushUpdateNotice() {
+    const notice = readJSON(updateNoticeFile());
+    if (!notice?.to)
+        return;
+    try {
+        unlinkSync(updateNoticeFile());
+    }
+    catch { }
+    // We are already running the replaced binary, so notice.to should match.
+    if (notice.to === CURRENT_VERSION && notice.from !== CURRENT_VERSION) {
+        process.stderr.write(`  lizard auto-updated: v${notice.from} → v${notice.to}\n`);
+    }
+}
+/**
+ * Kick off an update check without delaying the current command.
+ *
+ * The check+download runs in a *detached child process* (`lizard
+ * __lizard-update`): an in-process fetch would keep the event loop alive and
+ * make every command linger until GitHub answers. Checks are throttled via a
+ * stamp file (6h), disabled with LIZARD_NO_UPDATE/CI, and only run for the
+ * standalone binary — npm installs upgrade through npm.
+ */
 export function checkForUpdateInBackground() {
-    // Only auto-update in TTY; skip CI / piped output
     if (!process.stdout.isTTY)
         return;
-    let updateMessage = null;
-    const promise = getLatestVersion().then(async (r) => {
-        if (r.kind !== "ok")
-            return;
-        const latest = r.version;
-        if (latest === CURRENT_VERSION)
-            return;
-        const [maj, min, pat] = latest.split(".").map(Number);
-        const [cmaj, cmin, cpat] = CURRENT_VERSION.split(".").map(Number);
-        const isNewer = maj > cmaj || (maj === cmaj && min > cmin) || (maj === cmaj && min === cmin && pat > cpat);
-        if (!isNewer)
-            return;
-        try {
-            const ok = await selfUpdate();
-            if (ok) {
-                updateMessage =
-                    `\n  Updating lizard v${CURRENT_VERSION} → v${latest}...\n` +
-                        `  lizard updated to v${latest}\n`;
-            }
-        }
-        catch {
-            // silent — don't interrupt the current command
+    if (autoUpdateDisabled())
+        return;
+    flushUpdateNotice();
+    if (!isStandaloneBinary())
+        return;
+    const stamp = readJSON(checkStampFile());
+    if (stamp?.lastCheckAt && Date.now() - stamp.lastCheckAt < CHECK_INTERVAL_MS)
+        return;
+    // Stamp before spawning so parallel commands don't pile up children.
+    writeJSON(checkStampFile(), { lastCheckAt: Date.now(), lastVersion: CURRENT_VERSION });
+    try {
+        const child = spawn(process.execPath, ["__lizard-update"], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.unref();
+    }
+    catch {
+        // never break the actual command over an update check
+    }
+}
+/**
+ * Body of the hidden `__lizard-update` command: check the latest release and
+ * install it, leaving a notice file for the next foreground run.
+ */
+export async function runBackgroundUpdate() {
+    if (autoUpdateDisabled() || !isStandaloneBinary())
+        return;
+    const r = await getLatestVersion();
+    writeJSON(checkStampFile(), { lastCheckAt: Date.now(), lastVersion: r.kind === "ok" ? r.version : CURRENT_VERSION });
+    if (r.kind !== "ok")
+        return;
+    if (!isNewerVersion(r.version, CURRENT_VERSION))
+        return;
+    try {
+        const ok = await selfUpdate();
+        if (ok) {
+            writeJSON(updateNoticeFile(), { from: CURRENT_VERSION, to: r.version, at: Date.now() });
         }
-    }).catch(() => { });
-    process.on("exit", () => {
-        if (updateMessage)
-            process.stderr.write(updateMessage);
-    });
-    // Don't block process exit
-    if (typeof promise.unref === "function")
-        promise.unref();
+    }
+    catch {
+        // silent — retried after the next throttle window
+    }
 }
 //# sourceMappingURL=updater.js.map

package/dist/lib/updater.js.map

@@ -1 +1 @@
-{"version":3,"file":"updater.js","sourceRoot":"","sources":["../../src/lib/updater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAE3F,SAAS,aAAa;IACpB,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC;IACtE,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC;IAClE,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC;IAChE,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,oBAAoB,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACpC,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,+BAA+B;IAC/B,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE1D,UAAU,EAAE,CAAC,eAAe,UAAU,KAAK,CAAC,CAAC;IAE7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEtB,UAAU,EAAE,CAAC,eAAe,CAAC,CAAC;IAC9B,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,0BAA0B;IACxC,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO;IAElC,IAAI,aAAa,GAAkB,IAAI,CAAC;IAExC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC;QACzB,IAAI,MAAM,KAAK,eAAe;YAAE,OAAO;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC;QAC3G,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;YAC9B,IAAI,EAAE,EAAE,CAAC;gBACP,aAAa;oBACX,wBAAwB,eAAe,OAAO,MAAM,OAAO;wBAC3D,wBAAwB,MAAM,IAAI,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAEnB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,IAAI,aAAa;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,IAAI,OAAQ,OAAe,CAAC,KAAK,KAAK,UAAU;QAAG,OAAe,CAAC,KAAK,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"updater.js","sourceRoot":"","sources":["../../src/lib/updater.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC;AACxC,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,YAAY,GAAG,qEAAqE,CAAC;AAE3F,oDAAoD;AACpD,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;AAEnD,SAAS,aAAa;IACpB,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC;IACtE,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,mBAAmB,CAAC;IAClE,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,kBAAkB,CAAC;IAChE,IAAI,EAAE,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,oBAAoB,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAQ,UAAkB,CAAC,GAAG,KAAK,WAAW,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW;QAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AACD,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAOtE,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE;YACpC,OAAO,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAe;IAC5D,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkC;IACjE,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,GAAG,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IAC5C,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,kBAAkB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEvE,UAAU,EAAE,CAAC,eAAe,UAAU,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAW,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtB,UAAU,EAAE,CAAC,eAAe,CAAC,CAAC;QAC9B,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,IAAa;IAC5C,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,4EAA4E;AAC5E,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,EAAE;QAAE,OAAO;IACxB,IAAI,CAAC;QAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAChD,yEAAyE;IACzE,IAAI,MAAM,CAAC,EAAE,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO;IAClC,IAAI,kBAAkB,EAAE;QAAE,OAAO;IAEjC,iBAAiB,EAAE,CAAC;IAEpB,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAElC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,GAAG,iBAAiB;QAAE,OAAO;IACrF,qEAAqE;IACrE,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;IAEvF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE;YACzD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO;IAE1D,MAAM,CAAC,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACnC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO;IAC5B,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC;QAAE,OAAO;IAExD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC9B,IAAI,EAAE,EAAE,CAAC;YACP,SAAS,CAAC,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lizard-build/cli",
-  "version": "0.3.38",
+  "version": "0.3.40",
   "description": "Lizard CLI — deploy and manage apps on Lizard",
   "type": "module",
   "bin": {

package/src/commands/add.ts

@@ -318,7 +318,7 @@ async function runAdd(input: AddInput): Promise<void> {
               ? opts.repo
               : `https://github.com/${opts.repo}`,
             region,
-            variables,
+            envVars: variables,
             ...(detectedPort ? { containerPort: detectedPort } : {}),
             ...(input.noDeploy ? { skipInitialDeploy: true } : {}),
           },
@@ -349,7 +349,7 @@ async function runAdd(input: AddInput): Promise<void> {
           {
             name: opts.service,
             region,
-            variables,
+            envVars: variables,
           },
         );
         if (isJSONMode()) printJSON(app);

package/src/commands/git.ts

@@ -112,22 +112,27 @@ export function registerGit(program: Command) {
       });
       spinner.succeed(`Branch set to ${chalk.cyan(branch)}`);
 
-      // Trigger redeploy
+      // Trigger redeploy — the endpoint returns the freshly created Build
+      // record; using its id avoids racing against a previous build.
       const deploySpinner = ora("Starting redeploy...").start();
-      await api.post(withScope(`/api/apps/${serviceId}/redeploy`, scope));
+      const build = await api.post<{ id?: string }>(
+        withScope(`/api/apps/${serviceId}/redeploy`, scope),
+        undefined,
+        { "X-Deploy-Source": "cli" },
+      );
       deploySpinner.stop();
 
       if (opts.detach || isJSONMode()) {
-        if (isJSONMode()) printJSON({ id: serviceId, branch, status: "deploying" });
+        if (isJSONMode()) printJSON({ id: serviceId, buildId: build?.id, branch, status: "deploying" });
         else success(`Redeploy started on branch ${chalk.cyan(branch)}`);
         return;
       }
 
       info(`Redeploying ${chalk.bold(serviceName)} on ${chalk.cyan(branch)}...`);
 
-      // Wait for build to appear
-      let buildId: string | null = null;
-      for (let i = 0; i < 30; i++) {
+      let buildId: string | null = build?.id ?? null;
+      // Fallback for older servers that respond without a Build record.
+      for (let i = 0; !buildId && i < 30; i++) {
         await new Promise((r) => setTimeout(r, 2000));
         try {
           const app = await api.get<{ builds?: Array<{ id: string; status: string }> }>(`/api/apps/${serviceId}`);

package/src/commands/login.ts

@@ -4,6 +4,7 @@ import { Command } from "commander";
 import {
   saveCredentials,
   openURL,
+  jwtExpiryMs,
   type Credentials,
 } from "../lib/auth.js";
 import { getBaseURL } from "../lib/api.js";
@@ -86,9 +87,11 @@ export async function performLogin(): Promise<Credentials> {
 
       if (result.status === "complete" && result.accessToken && result.user) {
         spinner.stop();
+        const expMs = jwtExpiryMs(result.accessToken);
         const creds: Credentials = {
           accessToken: result.accessToken,
           refreshToken: result.refreshToken,
+          expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
           userId: result.user.id,
           username: result.user.username,
           email: result.user.email,
@@ -139,8 +142,10 @@ export function registerLogin(program: Command) {
         });
         if (!res.ok) throw new Error("Invalid token");
         const user = (await res.json()) as any;
+        const expMs = jwtExpiryMs(token);
         saveCredentials({
           accessToken: token,
+          expiresAt: expMs ? new Date(expMs).toISOString() : undefined,
           userId: user.id,
           username: user.username,
           email: user.email,

package/src/commands/logs.ts

@@ -347,12 +347,19 @@ async function showBuildLogs(
   info(chalk.dim(`Build ${buildId}\n`));
 
   if (tailN !== undefined) {
+    // Snapshot semantics: the server replays history immediately; if the
+    // build is still running the stream would otherwise follow it forever.
+    // Stop after 3s without new events and print what we have.
     const lines: string[] = [];
-    await streamSSE(`/api/builds/${buildId}/logs`, (event, data) => {
-      if (event === "done" || event === "error") return false;
-      lines.push(data);
-      return true;
-    });
+    await streamSSE(
+      `/api/builds/${buildId}/logs`,
+      (event, data) => {
+        if (event === "done" || event === "error") return false;
+        lines.push(data);
+        return true;
+      },
+      { idleTimeoutMs: 3000 },
+    );
     for (const line of lines.slice(-tailN)) printLogLine(line);
     return;
   }

package/src/commands/redeploy.ts

@@ -54,24 +54,30 @@ export function registerRedeploy(program: Command) {
       }
 
       const spinner = ora("Starting redeploy...").start();
-      await api.post(`/api/apps/${id}/redeploy`);
+      // The endpoint pre-creates and returns the Build record — use its id
+      // instead of polling builds[0], which races against a previous build.
+      const build = await api.post<{ id?: string; status?: string }>(
+        `/api/apps/${id}/redeploy`,
+        undefined,
+        { "X-Deploy-Source": "cli" },
+      );
       spinner.stop();
 
       if (opts.detach || isJSONMode()) {
         if (isJSONMode()) {
-          printJSON({ id, status: "deploying" });
+          printJSON({ id, buildId: build?.id, status: "deploying" });
         } else {
           success("Redeploy started");
-          info(chalk.dim(`  Check status: lizard deploy status ${id}`));
+          info(chalk.dim(`  Check status: lizard up status ${id}`));
         }
         return;
       }
 
       info("Redeploying...");
 
-      // Poll for build
-      let buildId: string | null = null;
-      for (let i = 0; i < 30; i++) {
+      let buildId: string | null = build?.id ?? null;
+      // Fallback for older servers that respond without a Build record.
+      for (let i = 0; !buildId && i < 30; i++) {
         await new Promise((r) => setTimeout(r, 2000));
         try {
           const app = await api.get<{ builds?: Array<{ id: string; status: string }> }>(

package/src/commands/secrets.ts

@@ -278,6 +278,14 @@ Notes:
     .option("-s, --service <name>", "Service to scope to (overrides linked)")
     .option("-p, --project <id>", "Project to scope to")
     .action(async (opts, sub) => {
+      // Reading a TTY stdin waits for Ctrl+D forever — fail fast instead.
+      if (process.stdin.isTTY) {
+        throw new Error(
+          "secrets import reads KEY=value lines from stdin. Pipe a file:\n" +
+            "  lizard secrets import < .env",
+        );
+      }
+
       const inherited = sub.parent?.opts() || {};
       const scope = await resolveScope(
         opts.project ?? inherited.project,

package/src/commands/ssh.ts

@@ -2,7 +2,7 @@ import chalk from "chalk";
 import * as p from "@clack/prompts";
 import { Command } from "commander";
 import { api, getBaseURL, streamSSE, withScope } from "../lib/api.js";
-import { resolveProjectScope } from "../lib/resolve.js";
+import { resolveProjectScope, resolveService } from "../lib/resolve.js";
 import { error, isTTY } from "../lib/format.js";
 import { getToken } from "../lib/auth.js";
 import * as https from "node:https";
@@ -22,10 +22,19 @@ Examples:
   lizard ssh -s my-app -- bash -c "ps aux | head"`)
     .action(async (cmdArgs: string[], opts) => {
       const { projectId, scope } = await resolveProjectScope(opts.project);
-      let serviceId = opts.service as string | undefined;
-
-      // Resolve service interactively if not given
-      if (!serviceId) {
+      let serviceId: string | undefined;
+
+      if (opts.service) {
+        // Resolve by name or ID through the shared resolver — guessing
+        // "looks like an ID" by length breaks for long service names.
+        const svc = await resolveService(projectId, opts.service);
+        if (svc.kind !== "app") {
+          error(`"${svc.name}" is an addon — ssh works only for app services.`);
+          process.exit(1);
+        }
+        serviceId = svc.id;
+      } else {
+        // Resolve service interactively if not given
         const data = await api.get<{ apps: Array<{ id: string; name: string; status: string }> }>(
           withScope(`/api/projects/${projectId}/services`, scope),
         );
@@ -49,17 +58,6 @@ Examples:
         }
       }
 
-      // Resolve service ID if a name was given (lookup by name)
-      if (serviceId && !serviceId.match(/^[A-Za-z0-9_-]{20,}$/)) {
-        const data = await api.get<{ apps: Array<{ id: string; name: string; serviceName?: string }> }>(
-          withScope(`/api/projects/${projectId}/services`, scope),
-        );
-        const match = (data.apps || []).find(
-          (a) => a.name === serviceId || a.serviceName === serviceId || a.id === serviceId,
-        );
-        if (match) serviceId = match.id;
-      }
-
       if (cmdArgs.length === 0) {
         error("No command given. Usage: lizard ssh -s <service> -- <cmd> [args...]");
         process.exit(1);
@@ -71,29 +69,29 @@ Examples:
       const cmd = cmdArgs.map(shellQuote).join(" ");
       process.stdout.write(chalk.dim(`$ ${cmd}\n`));
 
-      let exitCode = 0;
-
-      await execStream(serviceId!, cmd, (stream, line) => {
+      const exitCode = await execStream(serviceId!, cmd, (stream, line) => {
         if (stream === "stderr") {
           process.stderr.write(line + "\n");
         } else {
           process.stdout.write(line + "\n");
         }
-      }, (code) => {
-        exitCode = code;
       });
 
       process.exit(exitCode);
     });
 }
 
+/** Run a command on the VM, streaming output. Resolves with the exit code:
+ *  the remote command's code from the `exit` event, or 1 when the server
+ *  reported an `error` event without one. */
 function execStream(
   appId: string,
   cmd: string,
   onLine: (stream: string, line: string) => void,
-  onExit: (code: number) => void,
-): Promise<void> {
+): Promise<number> {
   return new Promise((resolve, reject) => {
+    let exitCode: number | null = null;
+    let sawError = false;
     const baseURL = getBaseURL();
     const url = new URL(`${baseURL}/api/apps/${appId}/exec`);
     const token = getToken();
@@ -141,8 +139,9 @@ function execStream(
             } else if (trimmed.startsWith("data:")) {
               const data = trimmed.slice(5).trimStart();
               if (currentEvent === "exit") {
-                try { onExit(JSON.parse(data).exitCode ?? 0); } catch {}
+                try { exitCode = JSON.parse(data).exitCode ?? 0; } catch {}
               } else if (currentEvent === "error") {
+                sawError = true;
                 error(data);
               } else {
                 try {
@@ -156,7 +155,7 @@ function execStream(
           }
         });
 
-        res.on("end", resolve);
+        res.on("end", () => resolve(exitCode ?? (sawError ? 1 : 0)));
         res.on("error", reject);
       },
     );

package/src/commands/up.ts

@@ -198,7 +198,7 @@ async function deployFromLocal(args: {
       : success(`Deploy started  ${chalk.dim(`lizard up status ${newApp.id}`)}`);
     return;
   }
-  await streamBuildLogs(newApp.id, args.opts.ci);
+  await streamBuildLogs(newApp.id, args.opts.ci, newApp.buildId);
 }
 
 // ── helpers ──────────────────────────────────────────────────────────────────
@@ -260,12 +260,16 @@ const EXCLUDE_DIRS = new Set([
   ".turbo",
   ".vercel",
 ]);
-const EXCLUDE_EXT = new Set([".pyc", ".pyo", ".log", ".DS_Store"]);
+const EXCLUDE_EXT = new Set([".pyc", ".pyo", ".log"]);
+// Matched by full name — `path.extname(".DS_Store")` is "" (dotfile), so
+// extension matching never catches these.
+const EXCLUDE_FILES = new Set([".DS_Store"]);
 
 function collectFilesManually(root: string, dir: string): string[] {
   const results: string[] = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     if (EXCLUDE_DIRS.has(entry.name)) continue;
+    if (EXCLUDE_FILES.has(entry.name)) continue;
     if (EXCLUDE_EXT.has(path.extname(entry.name))) continue;
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) results.push(...collectFilesManually(root, full));
@@ -324,23 +328,28 @@ function prompt(question: string): Promise<string> {
   });
 }
 
-async function streamBuildLogs(appId: string, ciMode: boolean = false) {
-  const spinner = ora("Waiting for build...").start();
-  let buildId: string | null = null;
-  for (let i = 0; i < 30; i++) {
-    await sleep(2000);
-    try {
-      const app = await api.get<App>(`/api/apps/${appId}`);
-      if (app.builds?.length) {
-        const latest = app.builds[0];
-        if (["building", "deploying", "running", "failed"].includes(latest.status)) {
-          buildId = latest.id;
-          break;
+async function streamBuildLogs(appId: string, ciMode: boolean = false, knownBuildId?: string) {
+  // Prefer the buildId returned by the upload/redeploy response — polling
+  // builds[0] races against a still-running previous build and can attach
+  // to the wrong one.
+  let buildId: string | null = knownBuildId ?? null;
+  if (!buildId) {
+    const spinner = ora("Waiting for build...").start();
+    for (let i = 0; i < 30; i++) {
+      await sleep(2000);
+      try {
+        const app = await api.get<App>(`/api/apps/${appId}`);
+        if (app.builds?.length) {
+          const latest = app.builds[0];
+          if (["building", "deploying", "running", "failed"].includes(latest.status)) {
+            buildId = latest.id;
+            break;
+          }
         }
-      }
-    } catch {}
+      } catch {}
+    }
+    spinner.stop();
   }
-  spinner.stop();
   if (!buildId) {
     info(chalk.dim("No build found. Check `lizard up status <id>`."));
     return;

package/src/commands/upgrade.ts

@@ -1,7 +1,7 @@
 import chalk from "chalk";
 import { Command } from "commander";
 import { info, success, isJSONMode, printJSON } from "../lib/format.js";
-import { CURRENT_VERSION, getLatestVersion, selfUpdate } from "../lib/updater.js";
+import { CURRENT_VERSION, getLatestVersion, selfUpdate, isStandaloneBinary } from "../lib/updater.js";
 
 export function registerUpgrade(program: Command) {
   program
@@ -67,6 +67,26 @@ export function registerUpgrade(program: Command) {
         return;
       }
 
+      // npm install — self-replacing process.execPath would overwrite the
+      // user's node binary. Point at npm instead.
+      if (!isStandaloneBinary()) {
+        if (isJSONMode()) {
+          printJSON({
+            currentVersion: CURRENT_VERSION,
+            latestVersion: latest,
+            updateAvailable: true,
+            upgraded: false,
+            method: "npm",
+            hint: "npm install -g @lizard-build/cli@latest",
+          });
+          return;
+        }
+        info(`Update available: v${CURRENT_VERSION} → ${chalk.green("v" + latest)}`);
+        info(`This copy was installed via npm. Upgrade with:`);
+        info(`  ${chalk.cyan("npm install -g @lizard-build/cli@latest")}`);
+        return;
+      }
+
       info(`Upgrading v${CURRENT_VERSION} → ${chalk.green("v" + latest)}...`);
 
       try {