@lizard-build/cli 4.0.17 → 4.0.19

package/src/commands/sandbox-ssh.ts

@@ -0,0 +1,97 @@
+import chalk from "chalk";
+import WebSocket from "ws";
+import { getBaseURL, getRequestToken } from "../lib/api.js";
+
+/**
+ * `lizard sandbox ssh <id>` — an interactive shell in a running sandbox.
+ *
+ * Not the SSH protocol: it opens the same terminal the dashboard uses
+ * (wss://…/api/sandboxes/terminal), which the platform bridges onto an exec into the
+ * sandbox's pod with a TTY. So there are no keys to set up and nothing to open — the
+ * CLI's own API key is the credential, and a workspace- or project-scoped key only
+ * reaches sandboxes in its scope.
+ *
+ * Wire protocol (server/src/routes/ws.ts): binary frames are raw terminal bytes both
+ * ways; a text frame {"type":"resize","cols":N,"rows":M} resizes the remote TTY.
+ */
+export async function sandboxShell(id: string): Promise<number> {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("`lizard sandbox ssh` needs an interactive terminal. To run a command, use `lizard sandbox exec <id> -- <cmd>`.");
+  }
+  const token = getRequestToken();
+  if (!token) throw new Error("Not logged in. Run `lizard login` first.");
+
+  const base = new URL(getBaseURL());
+  base.protocol = base.protocol === "http:" ? "ws:" : "wss:";
+  const url = new URL(`/api/sandboxes/terminal?id=${encodeURIComponent(id)}`, base);
+
+  const ws = new WebSocket(url, { headers: { Authorization: `Bearer ${token}` } });
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  let rawMode = false;
+
+  const restore = () => {
+    if (rawMode) { try { stdin.setRawMode(false); } catch { /* stdin closed */ } rawMode = false; }
+    stdin.pause();
+    stdin.removeAllListeners("data");
+    stdout.removeAllListeners("resize");
+  };
+  const sendSize = () => {
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify({ type: "resize", cols: stdout.columns || 80, rows: stdout.rows || 24 }));
+    }
+  };
+
+  return await new Promise<number>((settle) => {
+    let opened = false;
+    // ws emits `error` and then `close` for one failure: report and settle once.
+    let finished = false;
+    const resolve = (code: number) => { if (!finished) { finished = true; settle(code); } };
+
+    ws.on("open", () => {
+      stdin.setRawMode(true);
+      rawMode = true;
+      stdin.resume();
+      // Raw mode: Ctrl-C, Ctrl-Z, arrows and tab completion all go to the remote shell.
+      stdin.on("data", (chunk: Buffer) => { if (ws.readyState === WebSocket.OPEN) ws.send(chunk, { binary: true }); });
+      stdout.on("resize", sendSize);
+      sendSize();
+    });
+
+    ws.on("message", (data: WebSocket.RawData) => {
+      // The socket opens before the server has checked the sandbox, so "connected" is
+      // only true once the shell itself speaks.
+      if (!opened) {
+        opened = true;
+        stdout.write(chalk.dim(`Connected to ${id}. Type \`exit\` or press Ctrl-D to leave.\r\n`));
+      }
+      stdout.write(Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data as ArrayBuffer));
+    });
+
+    ws.on("close", (code: number, reasonBuf: Buffer) => {
+      if (finished) return;
+      restore();
+      const reason = reasonBuf.toString();
+      // 1000 with "Shell exited" is the normal end of a session.
+      if (code === 1000 || code === 1005) {
+        if (opened) stdout.write(chalk.dim(`\r\nConnection to ${id} closed.\r\n`));
+        resolve(0);
+        return;
+      }
+      const why: Record<number, string> = {
+        4001: "Not authorized — your login or API key was rejected. Run `lizard login`.",
+        4003: reason || "Forbidden — this sandbox is not in a workspace your key can reach.",
+        4004: `Sandbox ${id} not found.`,
+      };
+      stdout.write(chalk.red(`\r\n${why[code] ?? (reason || `Connection closed (${code}).`)}\r\n`));
+      resolve(1);
+    });
+
+    ws.on("error", (err: Error) => {
+      if (finished) return;
+      restore();
+      stdout.write(chalk.red(`\r\nCould not connect to ${id}: ${err.message}\r\n`));
+      resolve(1);
+    });
+  });
+}

package/src/commands/sandbox.ts

@@ -11,6 +11,8 @@ import { getToken } from "../lib/auth.js";
 import { resolveProjectScope } from "../lib/resolve.js";
 import { resolveProjectId } from "../lib/config.js";
 import { resolveVolume } from "../lib/volume.js";
+import { sandboxShell } from "./sandbox-ssh.js";
+import { registerSandboxAgentCommands } from "./agents.js";
 import { success, info, error, isJSONMode, printJSON, table, statusColor, timeAgo, isTTY } from "../lib/format.js";
 
 // Templates are per-region rows in sandbox_templates, not a constant. Hardcoding them
@@ -269,6 +271,28 @@ Examples:
       process.exit(exitCode);
     });
 
+  registerSandboxAgentCommands(sb);
+
+  sb.command("ssh")
+    .alias("shell")
+    .argument("<id>", "Sandbox ID")
+    .description("Open an interactive shell in a running sandbox")
+    .addHelpText(
+      "after",
+      `
+Works for every running sandbox with no keys to set up: it uses your Lizard login,
+and a scoped API key only reaches sandboxes in its scope. Ctrl-C, arrows and tab
+completion go to the sandbox; type \`exit\` or press Ctrl-D to leave.
+
+To run one command non-interactively, use \`lizard sandbox exec <id> -- <cmd>\`.
+
+Example:
+  lizard sandbox ssh sb_abc123`,
+    )
+    .action(async (id: string) => {
+      process.exit(await sandboxShell(id));
+    });
+
   sb.command("logs")
     .argument("<id>", "Sandbox ID")
     .description("Stream sandbox vm-agent logs")

package/src/index.ts

@@ -83,6 +83,7 @@ import { registerRestart } from "./commands/restart.js";
 import { registerRun } from "./commands/run.js";
 import { registerS3 } from "./commands/s3.js";
 import { registerSandbox } from "./commands/sandbox.js";
+import { registerAgents } from "./commands/agents.js";
 import { registerScale } from "./commands/scale.js";
 import { registerSecrets } from "./commands/secrets.js";
 import { registerService } from "./commands/service.js";
@@ -178,6 +179,7 @@ registerRestart(program);
 registerRun(program);
 registerS3(program);
 registerSandbox(program);
+registerAgents(program);
 registerScale(program);
 registerSecrets(program);
 registerService(program);

package/src/lib/updater.ts

@@ -5,7 +5,7 @@ import { join, dirname } from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "4.0.17";
+export const CURRENT_VERSION = "4.0.19";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";