@lizard-build/cli 4.0.44 → 4.0.46

package/src/commands/add.ts

@@ -273,7 +273,6 @@ async function runAdd(input: AddInput): Promise<void> {
         if (opts.variables?.length) {
           info(chalk.yellow("Warning: --variables is ignored for managed addons"));
         }
-        const isSingle = databases.length === 1;
         for (const db of databases) {
           const cat = CATALOG.find((c) => c.name === db)!;
           info(`Adding ${chalk.cyan(cat.label)}...`);
@@ -303,11 +302,8 @@ async function runAdd(input: AddInput): Promise<void> {
             }
           }
 
-          if (isSingle) {
-            try {
-              updateProjectLink({ serviceId: addon.id, serviceName: addon.name });
-            } catch {}
-          }
+          // The folder keeps its service link: linking it to the addon sent the next
+          // `lizard up` / `secrets set` / `logs --build` to a database ("App not found").
         }
         return;
       }

package/src/commands/agents.ts

@@ -3,7 +3,7 @@ import ora from "ora";
 import open from "open";
 import { Command } from "commander";
 import * as p from "@clack/prompts";
-import { api } from "../lib/api.js";
+import { api, APIError } from "../lib/api.js";
 import { success, info, isJSONMode, printJSON, table, timeAgo } from "../lib/format.js";
 
 // Built-in coding agents (platform: server/src/routes/agents.ts), Boat-style.
@@ -185,6 +185,24 @@ function render(e: AgentEvent, verbose: boolean) {
   }
 }
 
+/**
+ * One page of a conversation's events. The agent keeps working in the sandbox while we
+ * watch, so a dropped connection or a 5xx must not end the watch: retry for about two
+ * minutes before giving up.
+ */
+async function pollEvents(id: string, conversationId: string, after: number) {
+  const path = `/api/sandboxes/${id}/events?after=${after}&conversationId=${conversationId}&limit=500`;
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await api.get<{ events: AgentEvent[]; next: number }>(path);
+    } catch (e) {
+      const transient = !(e instanceof APIError) || e.status === 429 || e.status >= 500;
+      if (!transient || attempt >= 24) throw e;
+      await sleep(Math.min(1000 * attempt, 5000));
+    }
+  }
+}
+
 export function registerSandboxAgentCommands(sb: Command) {
   sb.command("prompt")
     .argument("<id>", "Sandbox ID")
@@ -223,9 +241,7 @@ Examples:
       });
       let after = 0;
       for (;;) {
-        const r = await api.get<{ events: AgentEvent[]; next: number }>(
-          `/api/sandboxes/${id}/events?after=${after}&conversationId=${started.conversationId}&limit=500`,
-        );
+        const r = await pollEvents(id, started.conversationId, after);
         after = r.next ?? after;
         for (const e of r.events) {
           if (e.promptId !== started.promptId) continue;

package/src/commands/domain.ts

@@ -4,7 +4,7 @@ import { Command } from "commander";
 import { api } from "../lib/api.js";
 import { resolveProjectId } from "../lib/config.js";
 import { getActiveService } from "../lib/resolve.js";
-import { success, isJSONMode, printJSON, table, isTTY } from "../lib/format.js";
+import { success, isJSONMode, printJSON, table, isTTY, info } from "../lib/format.js";
 
 interface DomainResponse {
   ok?: boolean;
@@ -92,7 +92,14 @@ export function registerDomain(program: Command) {
         return;
       }
 
-      // Attach custom hostname
+      // Attach custom hostname. Anything without a dot is a typo or a missing subcommand
+      // (`lizard domain list` once attached a domain literally named "list").
+      if (!/^(?=.{4,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9-]{2,63}$/i.test(hostname)) {
+        throw new Error(
+          `"${hostname}" is not a domain name. Attach a full hostname such as app.example.com; ` +
+            "`lizard domain list` shows the service's domains.",
+        );
+      }
       const result = await api
         .post<DomainResponse>(`/api/apps/${service.id}/domains`, {
           hostname,
@@ -250,6 +257,33 @@ export function registerDomain(program: Command) {
       }
     });
 
+  dom
+    .command("list")
+    .alias("ls")
+    .description("List the service's domains, and custom domains still waiting for DNS verification")
+    .action(async (_opts, sub) => {
+      const opts = sub.optsWithGlobals();
+      const projectId = await resolveProjectId(opts.project);
+      const service = await getActiveService(opts.service, projectId);
+      const r = await api.get<{
+        domains?: string[]; generatedDomain?: string | null; cnameTarget?: string;
+        pending?: { hostname: string; txtRecord: string; txtValue: string; cnameTarget: string }[];
+      }>(`/api/apps/${service.id}/domains`);
+      if (isJSONMode()) return printJSON({ service: service.name, ...r });
+      const active = r.domains ?? [];
+      if (!active.length && !(r.pending ?? []).length) {
+        info(`${service.name} has no domain yet. Generate one: lizard domain --service ${service.name}`);
+        return;
+      }
+      for (const d of active) console.log(`${chalk.green("●")} https://${d}`);
+      for (const p of r.pending ?? []) {
+        console.log(`${chalk.yellow("○")} ${p.hostname} ${chalk.dim("(waiting for DNS)")}`);
+        console.log(chalk.dim(`    TXT   ${p.txtRecord}  ${p.txtValue}`));
+        console.log(chalk.dim(`    CNAME ${p.hostname}  ${p.cnameTarget}`));
+        console.log(chalk.dim(`    then: lizard domain verify ${p.hostname} --service ${service.name}`));
+      }
+    });
+
   dom
     .command("verify")
     .argument("<hostname>", "Custom domain to verify")

package/src/commands/init.ts

@@ -83,6 +83,24 @@ export async function ensureLinked(opts: {
     }
   }
 
+  // A named project may live in any workspace. Look it up everywhere first: the flow
+  // below searches one workspace only and creates the project when that workspace has
+  // no match, which made a duplicate of a project in another workspace (and, for a key
+  // limited to that project, failed with 404 "Project not found").
+  if (opts.projectName && !opts.workspaceFlag) {
+    const lower = opts.projectName.toLowerCase();
+    const all = await api.get<Array<Project & { workspaceId?: string; workspaceName?: string }>>("/api/projects");
+    const matches = all.filter(
+      (pr) => pr.id.toLowerCase() === lower || pr.slug?.toLowerCase() === lower || pr.name.toLowerCase() === lower,
+    );
+    if (matches.length === 1) {
+      const m = matches[0];
+      const link: ProjectLink = { projectId: m.id, projectName: m.name, workspaceId: m.workspaceId, workspaceName: m.workspaceName };
+      setProjectLink(link);
+      return link;
+    }
+  }
+
   // 1. Workspace
   const workspaces = await fetchWorkspaces();
   const workspace = await pickWorkspace({

package/src/commands/metrics.ts

@@ -2,7 +2,7 @@ import chalk from "chalk";
 import { Command } from "commander";
 import { api, withScope, withQuery, APIError, type ResourceScope } from "../lib/api.js";
 import { getProjectLink } from "../lib/config.js";
-import { resolveProjectScope, getActiveServiceWithKind } from "../lib/resolve.js";
+import { resolveProjectScope, getActiveServiceWithKind, lookupProjectWorkspace } from "../lib/resolve.js";
 import { info, fail, isJSONMode, printJSON, table, timeAgo } from "../lib/format.js";
 
 // Shapes returned by /api/apps/:id/metrics and /api/projects/:id/metrics.
@@ -584,6 +584,11 @@ function fmtPeriodDate(ms: number): string {
 }
 
 async function showCost(projectId: string, scope: ResourceScope) {
+  // Scopes for other commands skip the workspace lookup (their routes ignore it), so an
+  // unlinked folder or --project arrives here without one: fetch it, cost needs it.
+  if (!scope.workspaceId) {
+    scope = { ...scope, workspaceId: (await lookupProjectWorkspace(projectId))?.workspaceId ?? null };
+  }
   if (!scope.workspaceId) {
     fail("Could not resolve the workspace for this project. Run `lizard link` first.");
   }
@@ -599,7 +604,11 @@ async function showCost(projectId: string, scope: ResourceScope) {
     ]);
   } catch (e) {
     if (e instanceof APIError && e.status === 403) {
-      fail("Billing is only visible to the workspace owner.", 2);
+      // A key limited to some projects can't read the workspace's billing at all; only
+      // a plain 403 means "not the owner".
+      fail(/API key/i.test(e.message)
+        ? `${e.message} Costs need a key that covers the whole workspace, or a full sign-in (lizard login).`
+        : "Billing is only visible to the workspace owner.", 2);
     }
     throw e;
   }

package/src/commands/s3.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash, createHmac } from "node:crypto";
 import chalk from "chalk";
 import { Command } from "commander";
 import { api, getBaseURL, withScope, APIError, type ResourceScope } from "../lib/api.js";
@@ -12,6 +13,41 @@ interface AddonLite {
   name: string;
   type?: string;
   status?: string;
+  connection?: { endpoint?: string; accessKeyId?: string; secretKey?: string; region?: string } | null;
+}
+
+const rfc3986 = (v: string) => encodeURIComponent(v).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+const sha256hex = (v: string) => createHash("sha256").update(v).digest("hex");
+const hmac = (key: Buffer | string, v: string) => createHmac("sha256", key).update(v).digest();
+
+/**
+ * A SigV4 presigned GET for one object (path style, the way the S3 gateway expects it).
+ * The link works for `expiresIn` seconds without any credentials, so it is safe to hand
+ * to someone who must not get the addon's keys.
+ */
+export function presignGet(o: {
+  endpoint: string; accessKeyId: string; secretKey: string; region: string;
+  bucket: string; key: string; expiresIn: number; now?: Date;
+}): string {
+  const base = new URL(o.endpoint);
+  const segments = [...base.pathname.split("/").filter(Boolean), o.bucket, ...o.key.split("/")];
+  const canonicalUri = "/" + segments.map(rfc3986).join("/");
+  const iso = (o.now ?? new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+  const date = iso.slice(0, 8);
+  const scope = `${date}/${o.region}/s3/aws4_request`;
+  const query: Record<string, string> = {
+    "X-Amz-Algorithm": "AWS4-HMAC-SHA256",
+    "X-Amz-Credential": `${o.accessKeyId}/${scope}`,
+    "X-Amz-Date": iso,
+    "X-Amz-Expires": String(o.expiresIn),
+    "X-Amz-SignedHeaders": "host",
+  };
+  const canonicalQuery = Object.keys(query).sort().map((k) => `${rfc3986(k)}=${rfc3986(query[k])}`).join("&");
+  const canonicalRequest = ["GET", canonicalUri, canonicalQuery, `host:${base.host}\n`, "host", "UNSIGNED-PAYLOAD"].join("\n");
+  const toSign = ["AWS4-HMAC-SHA256", iso, scope, sha256hex(canonicalRequest)].join("\n");
+  const key = hmac(hmac(hmac(hmac("AWS4" + o.secretKey, date), o.region), "s3"), "aws4_request");
+  const signature = createHmac("sha256", key).update(toSign).digest("hex");
+  return `${base.protocol}//${base.host}${canonicalUri}?${canonicalQuery}&X-Amz-Signature=${signature}`;
 }
 
 interface ServicesResponse {
@@ -177,6 +213,35 @@ export function registerS3(program: Command) {
       }
     });
 
+  s3.command("url")
+    .description("Print a temporary download link for an object (works without credentials until it expires)")
+    .argument("<key>", "Object key, e.g. report.txt")
+    .option("--addon <name>", "S3 addon name or ID (default: the project's only S3 addon)")
+    .option("--bucket <name>", "Bucket", "default")
+    .option("--expires <seconds>", "How long the link works, in seconds (max 604800 = 7 days)", "3600")
+    .option("-p, --project <id>", "Project name, slug, or ID")
+    .action(async (key: string, opts) => {
+      const expiresIn = Number(opts.expires);
+      if (!Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > 604800) {
+        throw new Error(`--expires must be a whole number of seconds from 1 to 604800 (got ${opts.expires}).`);
+      }
+      const { projectId, scope } = await resolveProjectScope(opts.project);
+      const addon = await resolveS3AddonId(projectId, scope, opts.addon);
+      const data = await api.get<ServicesResponse>(withScope(`/api/projects/${projectId}/services`, scope));
+      const c = (data.addons ?? []).find((a) => a.id === addon.id)?.connection;
+      if (!c?.endpoint || !c.accessKeyId || !c.secretKey) {
+        throw new Error(`S3 addon ${addon.name} has no credentials yet; wait until it is running (lizard ps).`);
+      }
+      const url = presignGet({
+        endpoint: c.endpoint, accessKeyId: c.accessKeyId, secretKey: c.secretKey, region: c.region || "us-east-1",
+        bucket: opts.bucket, key, expiresIn,
+      });
+      const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString();
+      if (isJSONMode()) return printJSON({ url, key, bucket: opts.bucket, expiresIn, expiresAt });
+      console.log(url);
+      info(chalk.dim(`Works until ${expiresAt}. Anyone with the link can download ${key}.`));
+    });
+
   s3.command("list")
     .alias("ls")
     .description("List objects in an S3 addon bucket")

package/src/commands/sandbox.ts

@@ -9,7 +9,7 @@ import open from "open";
 import { api, APIError, getBaseURL, getRawBytes, apiErrorFrom, clientHeaders, getRequestToken, withQuery, withScope, type ResourceScope } from "../lib/api.js";
 import { getToken } from "../lib/auth.js";
 import { resolveProjectScope } from "../lib/resolve.js";
-import { getProjectLink, resolveProjectId } from "../lib/config.js";
+import { getProjectLink, resolveProjectId, looksLikeId } from "../lib/config.js";
 import { resolveVolume } from "../lib/volume.js";
 import { sandboxShell } from "./sandbox-ssh.js";
 import { startVncTunnel, vncTarget } from "./sandbox-vnc.js";
@@ -21,7 +21,7 @@ import { success, info, error, isJSONMode, printJSON, table, statusColor, timeAg
 // still rejected before a request was ever sent — codex and interpreter both were. The
 // server validates against the region's actual list and answers with what IS available,
 // so let it.
-const TEMPLATE_HINT = "base, codex, interpreter, desktop";
+const TEMPLATE_HINT = "base, interpreter, codex, claude, opencode, pi, prime, desktop";
 
 // The three machines a sandbox can be, each priced per hour, billed per second by the server. The
 // platform rejects anything else, so the CLI offers exactly these.
@@ -130,7 +130,7 @@ export function registerSandbox(program: Command) {
     .option("--region <code>", "Region to create the sandbox in")
     .option("--snapshot <id>", "Create from a private saved snapshot (runs on the machine it was captured on)")
     .option("--volume <name-or-id>", "Attach a persistent volume")
-    .option("--with-token [key]", "Install this liz_ key inside the sandbox so `lizard` works there (defaults to the key you are using)")
+    .option("--with-token [key]", "Sign in `lizard` inside the sandbox with a new key limited to the sandbox's project and deleted with it (this liz_ key, or the one you use, only authorizes the request)")
     .option("-p, --project <id>", "Project to create the sandbox in (name, slug, or ID). Defaults to the linked project.")
     .action(async (opts) => {
       // A snapshot restores onto the machine it was captured on, so the server ignores a
@@ -170,7 +170,7 @@ export function registerSandbox(program: Command) {
       let volumeId: string | undefined;
       let volumeName: string | undefined;
       if (opts.volume) {
-        if (/^[A-Za-z0-9_-]{21}$/.test(opts.volume)) volumeId = opts.volume;
+        if (looksLikeId(opts.volume)) volumeId = opts.volume;
         else volumeName = opts.volume;
       }
 
@@ -543,7 +543,7 @@ Examples:
         api.get<SnapshotRecord>(`/api/sandbox-snapshots/${snapshotId}`),
         opts.project ? resolveProjectId(opts.project) : Promise.resolve(undefined),
       ]);
-      const volume = opts.volume ? (/^fcv-|^[A-Za-z0-9_-]{21}$/.test(opts.volume) ? { volumeId: opts.volume } : { volumeName: opts.volume }) : {};
+      const volume = opts.volume ? ((/^fcv-/.test(opts.volume) || looksLikeId(opts.volume)) ? { volumeId: opts.volume } : { volumeName: opts.volume }) : {};
       // A volume picks its own project when none is named; a name needs one to be found in.
       const project = projectId ?? (volume.volumeId ? undefined : snapshot.projectId);
       const sandbox = await api.post<SandboxRecord>("/api/sandboxes", { snapshotId, projectId: project, region: snapshot.region, timeoutMs: opts.timeout, ...volume });
@@ -748,6 +748,16 @@ export function execStream(
           if (currentEvent === "exit") {
             try {
               const code: unknown = JSON.parse(data).exitCode;
+              // -1: the platform stopped waiting (150 s). Say so; the bare "invalid event"
+              // left agents guessing and retrying the same long command.
+              if (code === -1) {
+                reject(new APIError(408,
+                  "The command was still running after 150 seconds, so exec stopped waiting (it may still be running in the sandbox). " +
+                  `Start long jobs in the background and read a log: lizard sandbox exec ${sandboxId} -- sh -c 'nohup <cmd> > /tmp/job.log 2>&1 &', ` +
+                  `then lizard sandbox exec ${sandboxId} -- tail -n 50 /tmp/job.log`,
+                  "EXEC_TIMEOUT"));
+                return;
+              }
               if (!Number.isInteger(code) || (code as number) < 0 || (code as number) > 255) {
                 throw new Error("Invalid exec exit code");
               }

package/src/commands/skill.ts

@@ -11,11 +11,16 @@ import { EMBEDDED_SKILLS } from "../lib/skills-data.generated.js";
 //
 // LIZARD_SKILLS_DIR overrides the embedded source with a real directory — useful
 // for authoring new skills locally without a rebuild.
+//
+// A skill is SKILL.md plus optional references/<ref>.md files that go deeper on
+// one part of the platform; `lizard skills get <name> --ref <ref>` prints one.
 
 interface Source {
   list(): string[];
   read(name: string): string | null;
-  pathOf(name?: string): string;
+  refs(name: string): string[];
+  readRef(name: string, ref: string): string | null;
+  pathOf(name?: string, ref?: string): string;
 }
 
 function fsSource(dir: string): Source {
@@ -42,7 +47,29 @@ function fsSource(dir: string): Source {
         return null;
       }
     },
-    pathOf: (name) => (name ? path.join(dir, name, "SKILL.md") : dir),
+    refs: (name) => {
+      try {
+        return readdirSync(path.join(dir, name, "references"))
+          .filter((f) => f.endsWith(".md"))
+          .map((f) => f.slice(0, -3))
+          .sort();
+      } catch {
+        return [];
+      }
+    },
+    readRef: (name, ref) => {
+      try {
+        return readFileSync(path.join(dir, name, "references", `${ref}.md`), "utf8");
+      } catch {
+        return null;
+      }
+    },
+    pathOf: (name, ref) => {
+      if (!name) return dir;
+      return ref
+        ? path.join(dir, name, "references", `${ref}.md`)
+        : path.join(dir, name, "SKILL.md");
+    },
   };
 }
 
@@ -50,8 +77,14 @@ function embeddedSource(): Source {
   return {
     list: () => Object.keys(EMBEDDED_SKILLS).sort(),
     read: (name) => EMBEDDED_SKILLS[name]?.content ?? null,
-    pathOf: (name) =>
-      name ? `embedded://skills/${name}/SKILL.md` : "embedded://skills",
+    refs: (name) => Object.keys(EMBEDDED_SKILLS[name]?.references ?? {}).sort(),
+    readRef: (name, ref) => EMBEDDED_SKILLS[name]?.references[ref] ?? null,
+    pathOf: (name, ref) => {
+      if (!name) return "embedded://skills";
+      return ref
+        ? `embedded://skills/${name}/references/${ref}.md`
+        : `embedded://skills/${name}/SKILL.md`;
+    },
   };
 }
 
@@ -97,6 +130,29 @@ function readSkill(
   return { md, meta: parseFrontmatter(md) };
 }
 
+function readRef(src: Source, name: string, ref: string): string {
+  readSkill(src, name);
+  const md = src.readRef(name, ref);
+  if (md == null) {
+    const refs = src.refs(name);
+    throw new Error(
+      `Reference '${ref}' not found in skill '${name}'. ` +
+        (refs.length
+          ? `Available: ${refs.join(", ")}.`
+          : `This skill has no references.`),
+    );
+  }
+  return md;
+}
+
+function refEntries(src: Source, name: string) {
+  return src.refs(name).map((ref) => ({
+    name: ref,
+    path: src.pathOf(name, ref),
+    command: `lizard skills get ${name} --ref ${ref}`,
+  }));
+}
+
 function shortDesc(desc: string, max = 100): string {
   const oneLine = desc.replace(/\s+/g, " ").trim();
   return oneLine.length > max ? oneLine.slice(0, max - 1) + "…" : oneLine;
@@ -118,12 +174,13 @@ export function registerSkill(program: Command) {
         printJSON({
           dir: src.pathOf(),
           skills: names.map((n) => {
+            let description = "";
             try {
-              const { meta } = readSkill(src, n);
-              return { name: n, description: meta.description || "" };
+              description = readSkill(src, n).meta.description || "";
             } catch {
-              return { name: n, description: "" };
+              // unreadable SKILL.md: list it without a description
             }
+            return { name: n, description, references: src.refs(n) };
           }),
         });
         return;
@@ -133,38 +190,54 @@ export function registerSkill(program: Command) {
         return;
       }
       const rows = names.map((n) => {
+        let description = "";
         try {
-          const { meta } = readSkill(src, n);
-          return [n, shortDesc(meta.description || "")];
+          description = shortDesc(readSkill(src, n).meta.description || "");
         } catch {
-          return [n, ""];
+          // unreadable SKILL.md: list it without a description
         }
+        return [n, description, src.refs(n).join(", ")];
       });
-      table(["name", "description"], rows);
+      table(["name", "description", "references"], rows);
     });
 
   skill
     .command("get")
-    .description("Print a skill's full content (markdown)")
+    .description("Print a skill's content (markdown), or one of its references")
     .argument("<name>", "skill name (e.g. core)")
-    .option(
-      "--full",
-      "Include reference files (reserved; currently equivalent to default)",
-    )
-    .action((name: string, _opts: { full?: boolean }) => {
+    .option("--ref <ref>", "print one reference instead (e.g. sandboxes, deploys, sdk)")
+    .option("--full", "append every reference after the skill")
+    .action((name: string, opts: { ref?: string; full?: boolean }) => {
       const src = getSource();
       try {
+        if (opts.ref) {
+          const md = readRef(src, name, opts.ref);
+          if (isJSONMode()) {
+            printJSON({ name, ref: opts.ref, path: src.pathOf(name, opts.ref), content: md });
+            return;
+          }
+          process.stdout.write(md.endsWith("\n") ? md : md + "\n");
+          return;
+        }
         const { md, meta } = readSkill(src, name);
+        let content = md;
+        if (opts.full) {
+          for (const ref of src.refs(name)) {
+            const body = src.readRef(name, ref) ?? "";
+            content = `${content.trimEnd()}\n\n---\n<!-- references/${ref}.md -->\n\n${body}`;
+          }
+        }
         if (isJSONMode()) {
           printJSON({
             name,
             path: src.pathOf(name),
             frontmatter: meta,
-            content: md,
+            content,
+            references: refEntries(src, name),
           });
           return;
         }
-        process.stdout.write(md.endsWith("\n") ? md : md + "\n");
+        process.stdout.write(content.endsWith("\n") ? content : content + "\n");
       } catch (e: any) {
         fail(e.message, 3);
       }
@@ -174,9 +247,10 @@ export function registerSkill(program: Command) {
     .command("path")
     .description("Print the filesystem path of a skill (or the skills root)")
     .argument("[name]", "skill name; omit to print the skills directory")
-    .action((name?: string) => {
+    .option("--ref <ref>", "print the path of one reference instead")
+    .action((name: string | undefined, opts: { ref?: string }) => {
       const src = getSource();
-      const target = src.pathOf(name);
+      const target = src.pathOf(name, name ? opts.ref : undefined);
       if (isJSONMode()) {
         printJSON({ path: target });
         return;

package/src/commands/up.ts

@@ -6,7 +6,7 @@ import { createTarball } from "../lib/archive.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as readline from "node:readline";
-import { api, streamSSE, getBaseURL, clientHeaders, APIError, apiErrorFrom, isPaymentRequired, type ResourceScope } from "../lib/api.js";
+import { api, streamSSE, getBaseURL, clientHeaders, APIError, apiErrorFrom, isPaymentRequired, withScope, type ResourceScope } from "../lib/api.js";
 import { updateProjectLink, DEFAULT_REGION } from "../lib/config.js";
 import { resolveContext, getScope } from "../lib/resolve.js";
 import { ensureLinked } from "./init.js";
@@ -62,11 +62,25 @@ export function registerUp(program: Command) {
       // An unlinked folder goes to the default project (or --project, or init's questions)
       await ensureLinked({ projectName: projectFlag, useDefault: true });
 
-      // Resolve target service: --service flag → linked → first-in-project → prompt-or-fail
-      const ctx = await resolveContext({
-        projectFlag,
-        serviceFlag,
-      });
+      // Resolve target service: --service flag → linked → first-in-project → prompt-or-fail.
+      // `--service <name>` that doesn't exist yet names the new service instead of failing:
+      // agents (and people) reach for it to choose the name of a first deploy.
+      let ctx: Awaited<ReturnType<typeof resolveContext>>;
+      try {
+        ctx = await resolveContext({ projectFlag, serviceFlag });
+      } catch (e: any) {
+        if (!serviceFlag || !/not found in project/.test(String(e?.message))) throw e;
+        ctx = { ...(await resolveContext({ projectFlag })), service: undefined };
+        info(chalk.dim(`Service ${serviceFlag} doesn't exist yet: creating it.`));
+      }
+      // A folder linked to an addon (`lizard add postgres` links it) must not send code there.
+      if (ctx.service) {
+        const services = await api.get<{ addons?: { id: string }[] }>(withScope(`/api/projects/${ctx.projectId}/services`, getScope(ctx)));
+        if (services.addons?.some((a) => a.id === ctx.service!.id)) {
+          if (serviceFlag) throw new Error(`${ctx.service.name} is a managed addon, not a service you deploy code to. Pass the app's --service.`);
+          ctx = { ...ctx, service: undefined };
+        }
+      }
       const projectId = ctx.projectId;
       const scope = getScope(ctx);
 

package/src/commands/upgrade.ts

@@ -1,5 +1,6 @@
 import chalk from "chalk";
 import { Command } from "commander";
+import { spawnSync } from "node:child_process";
 import { info, success, isJSONMode, printJSON } from "../lib/format.js";
 import {
   CURRENT_VERSION,
@@ -75,8 +76,17 @@ export function registerUpgrade(program: Command) {
       }
 
       // npm install — self-replacing process.execPath would overwrite the
-      // user's node binary. Point at npm instead.
+      // user's node binary, so let npm do it. Agents on an old copy (sandbox templates
+      // ship one) need the upgrade to happen, not a hint they may not follow.
       if (!isStandaloneBinary()) {
+        const spec = `@lizard-build/cli@${latest}`;
+        if (!isJSONMode()) info(`Upgrading v${CURRENT_VERSION} → ${chalk.green("v" + latest)} with npm...`);
+        const r = spawnSync("npm", ["install", "-g", spec], { encoding: "utf8", shell: process.platform === "win32" });
+        if (r.status === 0) {
+          if (isJSONMode()) printJSON({ previousVersion: CURRENT_VERSION, latestVersion: latest, upgraded: true, method: "npm" });
+          else success(`Upgraded to v${latest}`);
+          return;
+        }
         if (isJSONMode()) {
           printJSON({
             currentVersion: CURRENT_VERSION,
@@ -85,11 +95,12 @@ export function registerUpgrade(program: Command) {
             upgraded: false,
             method: "npm",
             hint: "npm install -g @lizard-build/cli@latest",
+            error: ((r.stderr || "") + (r.error?.message ?? "")).trim().split("\n").slice(-3).join(" ") || null,
           });
           return;
         }
-        info(`Update available: v${CURRENT_VERSION} → ${chalk.green("v" + latest)}`);
-        info(`This copy was installed via npm. Upgrade with:`);
+        info(`npm could not upgrade this copy (${(r.stderr || r.error?.message || "").trim().split("\n").pop()}).`);
+        info(`Upgrade it yourself, with the rights npm needs:`);
         info(`  ${chalk.cyan("npm install -g @lizard-build/cli@latest")}`);
         return;
       }