@lizard-build/cli 4.0.44 → 4.0.46

package/src/commands/volume.ts

@@ -3,7 +3,7 @@ import * as p from "@clack/prompts";
 import { Command } from "commander";
 import { api, withScope, type ResourceScope } from "../lib/api.js";
 import { assertValidVolumeName, resolveVolume, type VolumeRecord } from "../lib/volume.js";
-import { resolveProjectScope } from "../lib/resolve.js";
+import { resolveProjectScope, resolveService } from "../lib/resolve.js";
 import { success, info, warn, isJSONMode, printJSON, table, isTTY } from "../lib/format.js";
 
 function parseIntOption(v: string): number {
@@ -19,19 +19,37 @@ function parseSizeGbOption(v: string): number {
   return parseIntOption(v);
 }
 
+interface ServiceVolume { id: string; name: string; sizeGb: number; mountPath?: string | null; status: string }
+
+/** The app a --service flag names; volumes attach to apps, not addons. */
+async function serviceApp(projectId: string, nameOrId: string) {
+  const svc = await resolveService(projectId, nameOrId);
+  if (svc.kind !== "app") throw new Error(`${svc.name} is a managed addon; its storage is managed for you.`);
+  return svc;
+}
+
 export function registerVolume(program: Command) {
   const vol = program
     .command("volume")
     .alias("vol")
-    .description("Manage persistent volumes for sandboxes");
+    .description("Manage persistent volumes for sandboxes and services");
 
   vol
     .command("list")
     .alias("ls")
-    .description("List volumes in a project")
+    .description("List volumes in a project (sandbox volumes), or a service's volume with --service")
+    .option("-s, --service <name>", "List the volume attached to this service")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .action(async (opts) => {
       const { projectId, scope } = await resolveProjectScope(opts.project);
+      if (opts.service) {
+        const app = await serviceApp(projectId, opts.service);
+        const attached = await api.get<ServiceVolume[]>(`/api/apps/${app.id}/volumes`);
+        if (isJSONMode()) return printJSON(attached);
+        if (!attached.length) return console.log(`${app.name} has no volume. Add one: lizard volume create data --service ${app.name}`);
+        table(["Name", "Size", "Mounted at", "Status"], attached.map((v) => [v.name, `${v.sizeGb} GB`, v.mountPath ?? "—", v.status]));
+        return;
+      }
       const volumes = await api.get<VolumeRecord[]>(
         withScope(`/api/projects/${projectId}/volumes`, scope),
       );
@@ -62,13 +80,26 @@ export function registerVolume(program: Command) {
   vol
     .command("create")
     .argument("<name>", "Volume name")
-    .description("Create a persistent volume")
+    .description("Create a persistent volume for sandboxes, or create one and attach it to a service with --service")
     .option("--size <gb>", "Size in GB (server limits apply; default 5)", parseIntOption)
     .option("--region <code>", "Region to place the volume in (must match the sandbox that will attach it)")
+    .option("-s, --service <name>", "Attach it to this service instead (one volume per service; files there survive restarts and redeploys)")
+    .option("--mount-path <path>", "With --service: where the service sees it (default /data)")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .action(async (name: string, opts) => {
       assertValidVolumeName(name);
       const { projectId, scope } = await resolveProjectScope(opts.project);
+      if (opts.service) {
+        const app = await serviceApp(projectId, opts.service);
+        const mountPath: string = opts.mountPath ?? "/data";
+        if (!mountPath.startsWith("/")) throw new Error(`--mount-path must be an absolute path (got ${mountPath}).`);
+        if (!isJSONMode()) info(`Creating volume ${chalk.cyan(name)} on ${chalk.cyan(app.name)} at ${mountPath}...`);
+        const created = await api.post<ServiceVolume>(`/api/apps/${app.id}/volumes`, { name, sizeGb: opts.size ?? 5, mountPath });
+        if (isJSONMode()) return printJSON(created);
+        success(`Volume ${chalk.bold(created.name)} (${created.sizeGb} GB) attached to ${app.name} at ${created.mountPath ?? mountPath}`);
+        info(chalk.dim("  The service restarts with it mounted. Keep files you must not lose under that path."));
+        return;
+      }
       const limits = await api.get<{ minSizeGb: number; maxSizeGb: number; defaultSizeGb: number }>(
         withScope(`/api/projects/${projectId}/volume-limits`, scope),
       );

package/src/commands/workspace.ts

@@ -75,15 +75,10 @@ export function registerWorkspace(program: Command) {
       if (workspace.role !== "owner") {
         throw new Error("Only the workspace owner can delete it.");
       }
-      // Empty workspaces only. Check here for a clear message; the backend
-      // enforces the same via ?requireEmpty=true and also refuses if any
-      // sandbox remains (which the CLI can't count on its own).
-      const projectCount = workspace.projectCount ?? 0;
-      if (projectCount > 0) {
-        throw new Error(
-          `Workspace "${workspace.name}" has ${projectCount} project(s). Delete them first, or use the dashboard to remove everything.`,
-        );
-      }
+      // Empty workspaces only: the backend checks that with ?requireEmpty=true (live
+      // projects, sandboxes and volumes) and says what is left. The list's projectCount
+      // also counts projects in the 3-day trash, so a client-side check here refused a
+      // workspace whose projects had all just been deleted.
 
       if (!opts.yes && isTTY() && !isJSONMode()) {
         const ok = await p.confirm({ message: `Delete workspace ${chalk.bold(workspace.name)}?` });

package/src/index.ts

@@ -38,6 +38,9 @@ const AGENTS_HELP = [
   chalk.dim(
     "  copy-paste examples. Prefer this over guessing commands from flag docs alone.",
   ),
+  chalk.dim(
+    "  For more depth: lizard skills get core --ref sandboxes | deploys | sdk",
+  ),
 ].join("\n");
 
 // Compact form of the same pointer, shown on every subcommand's `--help` so the
@@ -387,7 +390,7 @@ async function main() {
       version: CURRENT_VERSION,
       agents: {
         start: "lizard skills get core",
-        note: "Skills ship with this CLI version and cover sandboxes and the full app lifecycle (deploy, link, addons, logs, scaling, secrets, domains) with copy-paste examples. Prefer this over guessing commands from flag docs alone.",
+        note: "Skills ship with this CLI version and cover sandboxes and the full app lifecycle (deploy, link, addons, logs, scaling, secrets, domains) with copy-paste examples. Prefer this over guessing commands from flag docs alone. For more depth: `lizard skills get core --ref sandboxes|deploys|sdk`.",
       },
       command: dumpCommand(target),
       globalOptions: isRoot

package/src/lib/api.ts

@@ -187,6 +187,24 @@ export function isProjectDeletedError(err: unknown): err is APIError {
   return body?.error === "Project is being deleted";
 }
 
+const DROPPED = new Set(["UND_ERR_SOCKET", "UND_ERR_CLOSED", "ECONNRESET", "EPIPE", "ECONNREFUSED"]);
+
+/**
+ * fetch for reads: a connection the network dropped before any response is retried
+ * twice. Reads change nothing, so a retry is safe; writes are never retried here.
+ */
+async function fetchWithRetry(url: string, init: RequestInit): Promise<Response> {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await fetch(url, init);
+    } catch (e: any) {
+      const code = e?.cause?.code ?? e?.code;
+      if (attempt >= 3 || !DROPPED.has(code)) throw e;
+      await new Promise((r) => setTimeout(r, 300 * attempt));
+    }
+  }
+}
+
 async function request<T = any>(
   method: string,
   path: string,
@@ -207,11 +225,8 @@ async function request<T = any>(
     headers["Content-Type"] = "application/json";
   }
 
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
+  const init = { method, headers, body: body !== undefined ? JSON.stringify(body) : undefined };
+  const res = method === "GET" ? await fetchWithRetry(url, init) : await fetch(url, init);
 
   if (!res.ok) {
     let body: unknown = null;
@@ -233,7 +248,7 @@ export async function getRawBytes(path: string): Promise<Buffer> {
   const headers: Record<string, string> = clientHeaders();
   if (token) headers["Authorization"] = `Bearer ${token}`;
 
-  const res = await fetch(url, { method: "GET", headers });
+  const res = await fetchWithRetry(url, { method: "GET", headers });
   if (!res.ok) {
     let body: unknown = null;
     try {

package/src/lib/config.ts

@@ -148,10 +148,20 @@ export async function resolveProjectId(flagValue?: string): Promise<string> {
   //
   // A 21-character slug would be misread as an id here, so a caller that gets "project
   // not found" from the server should retry through resolveProjectIdSlow.
-  if (/^[A-Za-z0-9_-]{21}$/.test(flagValue)) return flagValue;
+  if (looksLikeId(flagValue)) return flagValue;
   return resolveProjectIdSlow(flagValue);
 }
 
+/**
+ * A 21-character nanoid. Names and slugs use the same characters, and a 21-character
+ * name ("ev-r1-deploy-monorepo") was sent as an id and came back "Project not found".
+ * Ids almost always hold an uppercase letter (all-lowercase is about a 1-in-55,000 draw);
+ * names and slugs rarely do, so require one.
+ */
+export function looksLikeId(value: string): boolean {
+  return /^[A-Za-z0-9_-]{21}$/.test(value) && /[A-Z]/.test(value);
+}
+
 /** List projects and match on id, slug or name — for anything not shaped like an id. */
 export async function resolveProjectIdSlow(flagValue: string): Promise<string> {
   const { api } = await import("./api.js");

package/src/lib/default-project.ts

@@ -1,6 +1,6 @@
 import chalk from "chalk";
 import { api, APIError } from "./api.js";
-import { info } from "./format.js";
+import { info, isJSONMode } from "./format.js";
 
 // The project a command uses when the folder is not linked and no --project is
 // given: the platform's default for this account (GET /api/projects/default),
@@ -37,7 +37,10 @@ let noted = false;
 export function noteDefaultProject(name: string): void {
   if (noted) return;
   noted = true;
-  info(chalk.dim(`Project: ${name} (your default). Pass --project for another, or run \`lizard init\` to link this folder.`));
+  const note = `Project: ${name} (your default). Pass --project for another, or run \`lizard init\` to link this folder.`;
+  // stderr, so stdout stays pure JSON; agents read both and need to know where the command landed.
+  if (isJSONMode()) process.stderr.write(note + "\n");
+  else info(chalk.dim(note));
 }
 
 /** For tests: forget the cached answer. */

package/src/lib/updater.ts

@@ -5,7 +5,7 @@ import { join, dirname } from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "4.0.44";
+export const CURRENT_VERSION = "4.0.46";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
 

package/test/unit/default-project.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { resolveProjectId, getProjectLink, setProjectLink } from "../../src/lib/config.js";
+import { resolveProjectId, getProjectLink, setProjectLink, looksLikeId } from "../../src/lib/config.js";
 import { resetDefaultProject } from "../../src/lib/default-project.js";
 import { ensureLinked } from "../../src/commands/init.js";
 import { resolveProject as resolveAddProject } from "../../src/commands/add.js";
@@ -65,10 +65,16 @@ describe("resolveProjectId in an unlinked folder", () => {
   test("a linked folder or --project never asks for it", async () => {
     setProjectLink({ projectId: "p-linked" });
     expect(await resolveProjectId()).toBe("p-linked");
-    expect(await resolveProjectId("abcdefghijklmnopqrstu")).toBe("abcdefghijklmnopqrstu");
+    expect(await resolveProjectId("abcdefghijKlmnopqrstu")).toBe("abcdefghijKlmnopqrstu");
     expect(requested()).toEqual([]);
   });
 
+  test("a 21-character lowercase name is looked up, not sent as an id", async () => {
+    expect(looksLikeId("ev-r1-deploy-monorepo")).toBe(false);
+    expect(looksLikeId("EmKpChcrzdgwf0EV1WZaD")).toBe(true);
+    expect(looksLikeId("short")).toBe(false);
+  });
+
   test("no default project, or a platform without the route: the old error", async () => {
     routes({ "GET /api/projects/default": () => reply(404, { error: "none", code: "NO_DEFAULT_PROJECT" }) });
     await expect(resolveProjectId()).rejects.toThrow("No project linked. Run `lizard init` or pass --project <id>.");

package/test/unit/s3-presign.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "vitest";
+import { presignGet } from "../../src/commands/s3.js";
+
+describe("lizard s3 url", () => {
+  const base = {
+    endpoint: "https://s3-us-east-1.onlizard.com/addon123",
+    accessKeyId: "AKIDEXAMPLE",
+    secretKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+    region: "us-east-1",
+    bucket: "default",
+    expiresIn: 3600,
+    now: new Date("2026-10-13T10:00:00.000Z"),
+  };
+
+  test("signs a path-style GET under the addon's endpoint path", () => {
+    const url = new URL(presignGet({ ...base, key: "reports/q3 report.txt" }));
+    expect(url.host).toBe("s3-us-east-1.onlizard.com");
+    expect(url.pathname).toBe("/addon123/default/reports/q3%20report.txt");
+    expect(url.searchParams.get("X-Amz-Credential")).toBe("AKIDEXAMPLE/20261013/us-east-1/s3/aws4_request");
+    expect(url.searchParams.get("X-Amz-Date")).toBe("20261013T100000Z");
+    expect(url.searchParams.get("X-Amz-Expires")).toBe("3600");
+    expect(url.searchParams.get("X-Amz-SignedHeaders")).toBe("host");
+    expect(url.searchParams.get("X-Amz-Signature")).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("the signature changes with the key and the expiry, and is stable otherwise", () => {
+    const a = presignGet({ ...base, key: "a.txt" });
+    expect(presignGet({ ...base, key: "a.txt" })).toBe(a);
+    expect(presignGet({ ...base, key: "b.txt" })).not.toBe(a);
+    expect(presignGet({ ...base, key: "a.txt", expiresIn: 60 })).not.toBe(a);
+  });
+});

package/test/unit/sandbox-transport.test.ts

@@ -48,10 +48,14 @@ describe("sandbox exec stream", () => {
     respond = (_req, res) => res.end(body);
     await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ code: "EXEC_STREAM_INCOMPLETE" });
   });
-  it.each([null, -1, 256, 1.5, "0"])("rejects invalid exit code %s", async exitCode => {
+  it.each([null, -2, 256, 1.5, "0"])("rejects invalid exit code %s", async exitCode => {
     respond = (_req, res) => res.end(`event: exit\ndata: ${JSON.stringify({ exitCode })}\n\n`);
     await expect(execStream("sb", "test", () => {})).rejects.toThrow("Invalid exec exit event");
   });
+  it("reports exit code -1 as the platform's 150-second limit, with status 408", async () => {
+    respond = (_req, res) => res.end(`event: exit\ndata: {"exitCode":-1}\n\n`);
+    await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ status: 408, code: "EXEC_TIMEOUT" });
+  });
   it.each([401, 403, 404, 408, 504])("preserves HTTP %i as an APIError", async status => {
     respond = (_req, res) => { res.writeHead(status); res.end(JSON.stringify({ error: "test failure", code: "TEST" })); };
     await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ status, message: "test failure", code: "TEST" });

package/test/unit/sandbox.test.ts

@@ -15,6 +15,7 @@ vi.mock("open", () => ({ default: vi.fn().mockResolvedValue(undefined) }));
 vi.mock("../../src/lib/config.js", () => ({
   resolveProjectId: vi.fn().mockResolvedValue("project-test"),
   getProjectLink: vi.fn(() => ({ projectId: "project-test" })),
+  looksLikeId: (v: string) => /^[A-Za-z0-9_-]{21}$/.test(v) && /[A-Z]/.test(v),
 }));
 vi.mock("../../src/lib/format.js", () => ({ isJSONMode: () => true, printJSON: vi.fn() }));
 

package/test/unit/skills.test.ts

@@ -1,7 +1,11 @@
 import { describe, expect, test } from "vitest";
 import { EMBEDDED_SKILLS } from "../../src/lib/skills-data.generated.js";
 
-const core = EMBEDDED_SKILLS.core.content;
+const core = EMBEDDED_SKILLS.core;
+const files: Record<string, string> = {
+  "SKILL.md": core.content,
+  ...Object.fromEntries(Object.entries(core.references).map(([ref, md]) => [`references/${ref}.md`, md])),
+};
 
 /** GitHub-style heading slug, which the skill's own links use. */
 const slug = (h: string) => h.toLowerCase().replace(/[^\w\s-]/g, "").trim().replace(/\s+/g, "-");
@@ -11,25 +15,40 @@ describe("the core skill", () => {
     expect(Object.keys(EMBEDDED_SKILLS)).toEqual(["core"]);
   });
 
-  test("covers sandboxes as well as deploys", () => {
-    expect(core).toContain("\n## Sandboxes\n");
-    for (const h of ["Quickstart", "Templates", "Running commands", "Files", "Ports", "Lifetime", "Snapshots and pause/resume", "From code: Lizard SDK"]) {
-      expect(core).toContain(`\n### ${h}\n`);
+  test("ships the sandboxes, deploys and sdk references, and names each one", () => {
+    expect(Object.keys(core.references).sort()).toEqual(["deploys", "sandboxes", "sdk"]);
+    for (const ref of Object.keys(core.references)) {
+      expect(core.content).toContain(`--ref ${ref}`);
     }
-    for (const h of ["Deploying", "Secrets", "Managed addons", "Sign-in", "Exit codes", "Default project", "Billing"]) {
-      expect(core).toContain(`\n## ${h}\n`);
+  });
+
+  test("covers the whole platform in SKILL.md", () => {
+    for (const h of ["Sign-in", "Exit codes", "Default project", "Sandboxes", "Deploys", "Databases and storage", "Secrets and config", "Domains", "Billing"]) {
+      expect(core.content).toContain(`\n## ${h}\n`);
     }
-    expect(core).not.toContain("lizard skills get sandbox");
+    expect(core.content).not.toContain("lizard skills get sandbox ");
+  });
+
+  test("keeps SKILL.md under 500 lines", () => {
+    const body = core.content.replace(/^---\n[\s\S]*?\n---\n/, "");
+    expect(body.split("\n").length).toBeLessThan(500);
   });
 
-  test("every #link points at a heading in the skill", () => {
-    const headings = new Set([...core.matchAll(/^#{2,4} (.+)$/gm)].map((m) => slug(m[1])));
-    const links = [...core.matchAll(/\]\(#([\w-]+)\)/g)].map((m) => m[1]);
+  test.each(Object.keys(files))("every #link in %s points at a heading in the same file", (file) => {
+    const md = files[file];
+    const headings = new Set([...md.matchAll(/^#{1,4} (.+)$/gm)].map((m) => slug(m[1])));
+    const links = [...md.matchAll(/\]\(#([\w-]+)\)/g)].map((m) => m[1]);
     expect(links.filter((l) => !headings.has(l))).toEqual([]);
   });
 
+  test("references never link to other files", () => {
+    for (const md of Object.values(core.references)) {
+      expect(md).not.toMatch(/\]\((?!https?:|#)[^)]+\)/);
+    }
+  });
+
   test("its description fits the 1024-character limit", () => {
-    const description = core.match(/^description: "(.*)"$/m)![1];
+    const description = core.content.match(/^description: "(.*)"$/m)![1];
     expect(description.length).toBeLessThanOrEqual(1024);
     expect(description).toMatch(/^Creates cloud sandboxes and deploys apps/);
   });