@lizard-build/cli 0.3.38 → 0.3.40

package/src/index.ts

@@ -5,7 +5,7 @@ import chalk from "chalk";
 import { setJSONMode, isJSONMode, error } from "./lib/format.js";
 import { requireAuth, isLoggedIn } from "./lib/auth.js";
 import { setBaseURL, setAccessToken, APIError } from "./lib/api.js";
-import { checkForUpdateInBackground, CURRENT_VERSION } from "./lib/updater.js";
+import { checkForUpdateInBackground, runBackgroundUpdate, CURRENT_VERSION } from "./lib/updater.js";
 
 const BANNER = chalk.rgb(16, 185, 129)(
   [
@@ -223,6 +223,13 @@ function dumpCommand(cmd: Command): any {
 }
 
 async function main() {
+  // Hidden entry point: detached child spawned by checkForUpdateInBackground.
+  // Handled before commander so it never shows up in help or telemetry.
+  if (process.argv.includes("__lizard-update")) {
+    await runBackgroundUpdate();
+    process.exit(0);
+  }
+
   // Set JSON mode from argv *before* parseAsync so the catch block below
   // honors --json even when commander rejects before our preAction hook
   // fires (e.g. unknown command, malformed global flag). Non-TTY auto-mode
@@ -280,10 +287,14 @@ async function main() {
       );
     } else {
       error(msg);
+      if (status === 401) {
+        process.stderr.write("Run `lizard login` to re-authenticate.\n");
+      }
     }
 
     // Exit codes derived from APIError.status (or tagged error codes), not message text
     const isAuth = status === 401 || status === 403 || code === "NOT_AUTHENTICATED";
+
     const isNotFound = status === 404;
     const isTimeout =
       status === 408 ||

package/src/lib/api.ts

@@ -129,10 +129,15 @@ export const api = {
   delete: <T = any>(path: string) => request<T>("DELETE", path),
 };
 
-/** Stream SSE and call handler for each data line. Return false to stop. */
+/** Stream SSE and call handler for each data line. Return false to stop.
+ *
+ *  `opts.idleTimeoutMs` — stop (resolve) when no *event* arrives for that
+ *  long. Heartbeat comments don't reset the timer. Used by `--tail`-style
+ *  snapshot reads that must not follow a live stream forever. */
 export function streamSSE(
   path: string,
   handler: (event: string, data: string) => boolean | void,
+  opts: { idleTimeoutMs?: number } = {},
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const url = new URL(baseURL + path);
@@ -155,6 +160,19 @@ export function streamSSE(
           return;
         }
 
+        let idleTimer: NodeJS.Timeout | undefined;
+        const finish = () => {
+          if (idleTimer) clearTimeout(idleTimer);
+          req.destroy();
+          resolve();
+        };
+        const armIdleTimer = () => {
+          if (!opts.idleTimeoutMs) return;
+          if (idleTimer) clearTimeout(idleTimer);
+          idleTimer = setTimeout(finish, opts.idleTimeoutMs);
+        };
+        armIdleTimer();
+
         let buffer = "";
         let currentEvent = "";
         let currentData = "";
@@ -169,10 +187,10 @@ export function streamSSE(
             const trimmed = line.replace(/\r$/, "");
             if (trimmed === "") {
               if (currentData) {
+                armIdleTimer();
                 const cont = handler(currentEvent, currentData);
                 if (cont === false) {
-                  req.destroy();
-                  resolve();
+                  finish();
                   return;
                 }
               }
@@ -186,7 +204,10 @@ export function streamSSE(
           }
         });
 
-        res.on("end", resolve);
+        res.on("end", () => {
+          if (idleTimer) clearTimeout(idleTimer);
+          resolve();
+        });
         res.on("error", reject);
       },
     );

package/src/lib/auth.ts

@@ -38,7 +38,32 @@ function isTTY(): boolean {
 }
 
 /**
- * Ensure the user is authenticated. If not logged in and TTY, auto-login.
+ * Expiry of a JWT in epoch-ms, decoded from the `exp` claim. Returns null
+ * for opaque/undecodable tokens — those are treated as valid and left for
+ * the server to reject.
+ */
+export function jwtExpiryMs(token: string): number | null {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return null;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof decoded.exp === "number" ? decoded.exp * 1000 : null;
+  } catch {
+    return null;
+  }
+}
+
+function isExpired(creds: Credentials): boolean {
+  const expMs =
+    jwtExpiryMs(creds.accessToken) ??
+    (creds.expiresAt ? Date.parse(creds.expiresAt) : null);
+  if (expMs === null || Number.isNaN(expMs)) return false;
+  return Date.now() > expMs - 60_000; // 60s margin
+}
+
+/**
+ * Ensure the user is authenticated. If not logged in (or the saved token
+ * has expired — there is no refresh endpoint) and TTY, auto-login.
  * Returns credentials or throws.
  */
 export async function requireAuth(): Promise<Credentials> {
@@ -51,16 +76,21 @@ export async function requireAuth(): Promise<Credentials> {
   }
 
   const creds = loadCredentials();
-  if (creds) return creds;
+  if (creds && !isExpired(creds)) return creds;
 
   if (!isTTY()) {
     const err = new Error(
-      "Not authenticated. Set LIZARD_TOKEN or run `lizard login` first.",
+      creds
+        ? "Session expired. Run `lizard login` again or set LIZARD_TOKEN."
+        : "Not authenticated. Set LIZARD_TOKEN or run `lizard login` first.",
     ) as Error & { code: string };
     err.code = "NOT_AUTHENTICATED";
     throw err;
   }
 
+  if (creds) {
+    process.stderr.write("Session expired — logging in again...\n");
+  }
   const { performLogin } = await import("../commands/login.js");
   return performLogin();
 }

package/src/lib/config.ts

@@ -96,7 +96,13 @@ export function updateProjectLink(
 ) {
   const existing = getProjectLink(cwd);
   if (!existing) return;
-  setProjectLink({ ...existing, ...patch }, cwd);
+  const merged = { ...existing, ...patch };
+  // An explicit serviceId/serviceName in the patch (including `undefined`,
+  // i.e. "clear it") must override the legacy mirror too — otherwise
+  // setProjectLink resurrects the old value from appId/appName.
+  if ("serviceId" in patch) merged.appId = patch.serviceId;
+  if ("serviceName" in patch) merged.appName = patch.serviceName;
+  setProjectLink(merged, cwd);
 }
 
 export function clearProjectLink(cwd: string = process.cwd()) {
@@ -120,8 +126,13 @@ export async function resolveProjectId(flagValue?: string): Promise<string> {
   }
   const { api } = await import("./api.js");
   const projects = await api.get<Array<{ id: string; name: string; slug: string }>>("/api/projects");
+  // Case-insensitive, matching `lizard link` / `lizard init` behaviour.
+  const lower = flagValue.toLowerCase();
   const match = projects.find(
-    (p) => p.id === flagValue || p.slug === flagValue || p.name === flagValue,
+    (p) =>
+      p.id.toLowerCase() === lower ||
+      p.slug?.toLowerCase() === lower ||
+      p.name?.toLowerCase() === lower,
   );
   if (!match) throw new Error(`Project "${flagValue}" not found.`);
   return match.id;

package/src/lib/updater.ts

@@ -1,14 +1,17 @@
-import { createWriteStream, existsSync, renameSync, chmodSync } from "node:fs";
+import { createWriteStream, existsSync, renameSync, chmodSync, unlinkSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { execFileSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import os from "node:os";
+import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "0.3.38";
+export const CURRENT_VERSION = "0.3.40";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
 
+/** Minimum gap between background update checks. */
+const CHECK_INTERVAL_MS = 6 * 60 * 60 * 1000; // 6h
+
 function getBinaryName(): string | null {
   const os = process.platform;
   const arch = process.arch;
@@ -19,6 +22,23 @@ function getBinaryName(): string | null {
   return null;
 }
 
+/**
+ * True only when running as the Bun-compiled standalone binary. Under
+ * npm/node, `process.execPath` is the *node* executable — self-update would
+ * overwrite the user's Node.js install with the lizard binary.
+ */
+export function isStandaloneBinary(): boolean {
+  return typeof (globalThis as any).Bun !== "undefined";
+}
+
+function stateDir(): string {
+  return process.env.LIZARD_HOME
+    ? join(process.env.LIZARD_HOME, ".lizard")
+    : join(os.homedir(), ".lizard");
+}
+const checkStampFile = () => join(stateDir(), "update-check.json");
+const updateNoticeFile = () => join(stateDir(), "update-notice.json");
+
 export type LatestVersionResult =
   | { kind: "ok"; version: string }
   | { kind: "rate-limited"; resetAt: number }
@@ -43,64 +63,129 @@ export async function getLatestVersion(): Promise<LatestVersionResult> {
   }
 }
 
+export function isNewerVersion(latest: string, current: string): boolean {
+  const [maj, min, pat] = latest.split(".").map(Number);
+  const [cmaj, cmin, cpat] = current.split(".").map(Number);
+  if (![maj, min, pat, cmaj, cmin, cpat].every(Number.isFinite)) return false;
+  return maj > cmaj || (maj === cmaj && min > cmin) || (maj === cmaj && min === cmin && pat > cpat);
+}
+
 export async function selfUpdate(onProgress?: (msg: string) => void): Promise<boolean> {
   const binaryName = getBinaryName();
   if (!binaryName) return false;
 
-  // Find current executable path
+  // Refuse to replace anything that isn't the standalone lizard binary —
+  // under npm the execPath is the user's node executable.
+  if (!isStandaloneBinary()) return false;
+
   const currentBin = process.execPath;
   if (!existsSync(currentBin)) return false;
 
   const url = `${RELEASE_BASE}/${binaryName}`;
-  const tmp = join(tmpdir(), `lizard-update-${Date.now()}`);
+  // Download next to the target binary: rename() must stay on one filesystem
+  // (tmpdir is often tmpfs on Linux → EXDEV).
+  const tmp = join(dirname(currentBin), `.lizard-update-${process.pid}`);
 
   onProgress?.(`Downloading ${binaryName}...`);
 
-  const res = await fetch(url, { signal: AbortSignal.timeout(60000) });
-  if (!res.ok) throw new Error(`Download failed: ${res.status}`);
+  try {
+    const res = await fetch(url, { signal: AbortSignal.timeout(60000) });
+    if (!res.ok) throw new Error(`Download failed: ${res.status}`);
+
+    const writer = createWriteStream(tmp);
+    await pipeline(Readable.fromWeb(res.body as any), writer);
+    chmodSync(tmp, 0o755);
+
+    onProgress?.("Installing...");
+    renameSync(tmp, currentBin);
+    return true;
+  } catch (err) {
+    try { unlinkSync(tmp); } catch {}
+    throw err;
+  }
+}
+
+function readJSON(file: string): any {
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
 
-  const writer = createWriteStream(tmp);
-  await pipeline(Readable.fromWeb(res.body as any), writer);
-  chmodSync(tmp, 0o755);
+function writeJSON(file: string, data: unknown) {
+  try {
+    mkdirSync(stateDir(), { recursive: true });
+    writeFileSync(file, JSON.stringify(data));
+  } catch {}
+}
 
-  onProgress?.("Installing...");
-  renameSync(tmp, currentBin);
-  return true;
+function autoUpdateDisabled(): boolean {
+  return Boolean(process.env.LIZARD_NO_UPDATE || process.env.CI);
 }
 
-/** Check for a newer version and auto-install it in the background.
- *  Prints a one-line notice on exit — either "Updated to vX.Y.Z" or nothing on failure.
- *  Never blocks or crashes the current command. */
+/** Print (once) the notice left behind by a completed background update. */
+function flushUpdateNotice(): void {
+  const notice = readJSON(updateNoticeFile());
+  if (!notice?.to) return;
+  try { unlinkSync(updateNoticeFile()); } catch {}
+  // We are already running the replaced binary, so notice.to should match.
+  if (notice.to === CURRENT_VERSION && notice.from !== CURRENT_VERSION) {
+    process.stderr.write(`  lizard auto-updated: v${notice.from} → v${notice.to}\n`);
+  }
+}
+
+/**
+ * Kick off an update check without delaying the current command.
+ *
+ * The check+download runs in a *detached child process* (`lizard
+ * __lizard-update`): an in-process fetch would keep the event loop alive and
+ * make every command linger until GitHub answers. Checks are throttled via a
+ * stamp file (6h), disabled with LIZARD_NO_UPDATE/CI, and only run for the
+ * standalone binary — npm installs upgrade through npm.
+ */
 export function checkForUpdateInBackground(): void {
-  // Only auto-update in TTY; skip CI / piped output
   if (!process.stdout.isTTY) return;
+  if (autoUpdateDisabled()) return;
 
-  let updateMessage: string | null = null;
-
-  const promise = getLatestVersion().then(async (r) => {
-    if (r.kind !== "ok") return;
-    const latest = r.version;
-    if (latest === CURRENT_VERSION) return;
-    const [maj, min, pat] = latest.split(".").map(Number);
-    const [cmaj, cmin, cpat] = CURRENT_VERSION.split(".").map(Number);
-    const isNewer = maj > cmaj || (maj === cmaj && min > cmin) || (maj === cmaj && min === cmin && pat > cpat);
-    if (!isNewer) return;
-    try {
-      const ok = await selfUpdate();
-      if (ok) {
-        updateMessage =
-          `\n  Updating lizard v${CURRENT_VERSION} → v${latest}...\n` +
-          `  lizard updated to v${latest}\n`;
-      }
-    } catch {
-      // silent — don't interrupt the current command
-    }
-  }).catch(() => {});
+  flushUpdateNotice();
+
+  if (!isStandaloneBinary()) return;
 
-  process.on("exit", () => {
-    if (updateMessage) process.stderr.write(updateMessage);
-  });
+  const stamp = readJSON(checkStampFile());
+  if (stamp?.lastCheckAt && Date.now() - stamp.lastCheckAt < CHECK_INTERVAL_MS) return;
+  // Stamp before spawning so parallel commands don't pile up children.
+  writeJSON(checkStampFile(), { lastCheckAt: Date.now(), lastVersion: CURRENT_VERSION });
 
-  // Don't block process exit
-  if (typeof (promise as any).unref === "function") (promise as any).unref();
+  try {
+    const child = spawn(process.execPath, ["__lizard-update"], {
+      detached: true,
+      stdio: "ignore",
+    });
+    child.unref();
+  } catch {
+    // never break the actual command over an update check
+  }
+}
+
+/**
+ * Body of the hidden `__lizard-update` command: check the latest release and
+ * install it, leaving a notice file for the next foreground run.
+ */
+export async function runBackgroundUpdate(): Promise<void> {
+  if (autoUpdateDisabled() || !isStandaloneBinary()) return;
+
+  const r = await getLatestVersion();
+  writeJSON(checkStampFile(), { lastCheckAt: Date.now(), lastVersion: r.kind === "ok" ? r.version : CURRENT_VERSION });
+  if (r.kind !== "ok") return;
+  if (!isNewerVersion(r.version, CURRENT_VERSION)) return;
+
+  try {
+    const ok = await selfUpdate();
+    if (ok) {
+      writeJSON(updateNoticeFile(), { from: CURRENT_VERSION, to: r.version, at: Date.now() });
+    }
+  } catch {
+    // silent — retried after the next throttle window
+  }
 }

package/test/unit/config.test.ts

@@ -75,6 +75,35 @@ describe("ProjectLink schema", () => {
     expect(got?.workspaceName).toBe("filled");
   });
 
+  test("updateProjectLink with explicit undefined clears the service (no appId resurrection)", () => {
+    setProjectLink(
+      { projectId: "proj_1", serviceId: "svc_1", serviceName: "api" },
+      tmpDir,
+    );
+    // Simulates `lizard service delete` of the linked service.
+    updateProjectLink({ serviceId: undefined, serviceName: undefined }, tmpDir);
+
+    const got = getProjectLink(tmpDir);
+    expect(got?.projectId).toBe("proj_1");
+    expect(got?.serviceId).toBeUndefined();
+    expect(got?.serviceName).toBeUndefined();
+    expect(got?.appId).toBeUndefined();
+    expect(got?.appName).toBeUndefined();
+  });
+
+  test("updateProjectLink with a new serviceId also updates the legacy mirror", () => {
+    setProjectLink(
+      { projectId: "proj_1", serviceId: "svc_old", serviceName: "old" },
+      tmpDir,
+    );
+    updateProjectLink({ serviceId: "svc_new", serviceName: "new" }, tmpDir);
+
+    const got = getProjectLink(tmpDir);
+    expect(got?.serviceId).toBe("svc_new");
+    expect(got?.appId).toBe("svc_new");
+    expect(got?.appName).toBe("new");
+  });
+
   test("config.json without workspaceId still loads (legacy compat)", () => {
     const cfgFile = path.join(tmpDir, ".lizard", "config.json");
     fs.mkdirSync(path.dirname(cfgFile), { recursive: true });