@lizard-build/cli 4.0.45 → 4.0.46

package/src/commands/sandbox.ts

@@ -9,7 +9,7 @@ import open from "open";
 import { api, APIError, getBaseURL, getRawBytes, apiErrorFrom, clientHeaders, getRequestToken, withQuery, withScope, type ResourceScope } from "../lib/api.js";
 import { getToken } from "../lib/auth.js";
 import { resolveProjectScope } from "../lib/resolve.js";
-import { getProjectLink, resolveProjectId } from "../lib/config.js";
+import { getProjectLink, resolveProjectId, looksLikeId } from "../lib/config.js";
 import { resolveVolume } from "../lib/volume.js";
 import { sandboxShell } from "./sandbox-ssh.js";
 import { startVncTunnel, vncTarget } from "./sandbox-vnc.js";
@@ -21,7 +21,7 @@ import { success, info, error, isJSONMode, printJSON, table, statusColor, timeAg
 // still rejected before a request was ever sent — codex and interpreter both were. The
 // server validates against the region's actual list and answers with what IS available,
 // so let it.
-const TEMPLATE_HINT = "base, codex, interpreter, desktop";
+const TEMPLATE_HINT = "base, interpreter, codex, claude, opencode, pi, prime, desktop";
 
 // The three machines a sandbox can be, each priced per hour, billed per second by the server. The
 // platform rejects anything else, so the CLI offers exactly these.
@@ -130,7 +130,7 @@ export function registerSandbox(program: Command) {
     .option("--region <code>", "Region to create the sandbox in")
     .option("--snapshot <id>", "Create from a private saved snapshot (runs on the machine it was captured on)")
     .option("--volume <name-or-id>", "Attach a persistent volume")
-    .option("--with-token [key]", "Install this liz_ key inside the sandbox so `lizard` works there (defaults to the key you are using)")
+    .option("--with-token [key]", "Sign in `lizard` inside the sandbox with a new key limited to the sandbox's project and deleted with it (this liz_ key, or the one you use, only authorizes the request)")
     .option("-p, --project <id>", "Project to create the sandbox in (name, slug, or ID). Defaults to the linked project.")
     .action(async (opts) => {
       // A snapshot restores onto the machine it was captured on, so the server ignores a
@@ -170,7 +170,7 @@ export function registerSandbox(program: Command) {
       let volumeId: string | undefined;
       let volumeName: string | undefined;
       if (opts.volume) {
-        if (/^[A-Za-z0-9_-]{21}$/.test(opts.volume)) volumeId = opts.volume;
+        if (looksLikeId(opts.volume)) volumeId = opts.volume;
         else volumeName = opts.volume;
       }
 
@@ -543,7 +543,7 @@ Examples:
         api.get<SnapshotRecord>(`/api/sandbox-snapshots/${snapshotId}`),
         opts.project ? resolveProjectId(opts.project) : Promise.resolve(undefined),
       ]);
-      const volume = opts.volume ? (/^fcv-|^[A-Za-z0-9_-]{21}$/.test(opts.volume) ? { volumeId: opts.volume } : { volumeName: opts.volume }) : {};
+      const volume = opts.volume ? ((/^fcv-/.test(opts.volume) || looksLikeId(opts.volume)) ? { volumeId: opts.volume } : { volumeName: opts.volume }) : {};
       // A volume picks its own project when none is named; a name needs one to be found in.
       const project = projectId ?? (volume.volumeId ? undefined : snapshot.projectId);
       const sandbox = await api.post<SandboxRecord>("/api/sandboxes", { snapshotId, projectId: project, region: snapshot.region, timeoutMs: opts.timeout, ...volume });
@@ -748,6 +748,16 @@ export function execStream(
           if (currentEvent === "exit") {
             try {
               const code: unknown = JSON.parse(data).exitCode;
+              // -1: the platform stopped waiting (150 s). Say so; the bare "invalid event"
+              // left agents guessing and retrying the same long command.
+              if (code === -1) {
+                reject(new APIError(408,
+                  "The command was still running after 150 seconds, so exec stopped waiting (it may still be running in the sandbox). " +
+                  `Start long jobs in the background and read a log: lizard sandbox exec ${sandboxId} -- sh -c 'nohup <cmd> > /tmp/job.log 2>&1 &', ` +
+                  `then lizard sandbox exec ${sandboxId} -- tail -n 50 /tmp/job.log`,
+                  "EXEC_TIMEOUT"));
+                return;
+              }
               if (!Number.isInteger(code) || (code as number) < 0 || (code as number) > 255) {
                 throw new Error("Invalid exec exit code");
               }

package/src/commands/up.ts

@@ -6,7 +6,7 @@ import { createTarball } from "../lib/archive.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as readline from "node:readline";
-import { api, streamSSE, getBaseURL, clientHeaders, APIError, apiErrorFrom, isPaymentRequired, type ResourceScope } from "../lib/api.js";
+import { api, streamSSE, getBaseURL, clientHeaders, APIError, apiErrorFrom, isPaymentRequired, withScope, type ResourceScope } from "../lib/api.js";
 import { updateProjectLink, DEFAULT_REGION } from "../lib/config.js";
 import { resolveContext, getScope } from "../lib/resolve.js";
 import { ensureLinked } from "./init.js";
@@ -62,11 +62,25 @@ export function registerUp(program: Command) {
       // An unlinked folder goes to the default project (or --project, or init's questions)
       await ensureLinked({ projectName: projectFlag, useDefault: true });
 
-      // Resolve target service: --service flag → linked → first-in-project → prompt-or-fail
-      const ctx = await resolveContext({
-        projectFlag,
-        serviceFlag,
-      });
+      // Resolve target service: --service flag → linked → first-in-project → prompt-or-fail.
+      // `--service <name>` that doesn't exist yet names the new service instead of failing:
+      // agents (and people) reach for it to choose the name of a first deploy.
+      let ctx: Awaited<ReturnType<typeof resolveContext>>;
+      try {
+        ctx = await resolveContext({ projectFlag, serviceFlag });
+      } catch (e: any) {
+        if (!serviceFlag || !/not found in project/.test(String(e?.message))) throw e;
+        ctx = { ...(await resolveContext({ projectFlag })), service: undefined };
+        info(chalk.dim(`Service ${serviceFlag} doesn't exist yet: creating it.`));
+      }
+      // A folder linked to an addon (`lizard add postgres` links it) must not send code there.
+      if (ctx.service) {
+        const services = await api.get<{ addons?: { id: string }[] }>(withScope(`/api/projects/${ctx.projectId}/services`, getScope(ctx)));
+        if (services.addons?.some((a) => a.id === ctx.service!.id)) {
+          if (serviceFlag) throw new Error(`${ctx.service.name} is a managed addon, not a service you deploy code to. Pass the app's --service.`);
+          ctx = { ...ctx, service: undefined };
+        }
+      }
       const projectId = ctx.projectId;
       const scope = getScope(ctx);
 

package/src/commands/upgrade.ts

@@ -1,5 +1,6 @@
 import chalk from "chalk";
 import { Command } from "commander";
+import { spawnSync } from "node:child_process";
 import { info, success, isJSONMode, printJSON } from "../lib/format.js";
 import {
   CURRENT_VERSION,
@@ -75,8 +76,17 @@ export function registerUpgrade(program: Command) {
       }
 
       // npm install — self-replacing process.execPath would overwrite the
-      // user's node binary. Point at npm instead.
+      // user's node binary, so let npm do it. Agents on an old copy (sandbox templates
+      // ship one) need the upgrade to happen, not a hint they may not follow.
       if (!isStandaloneBinary()) {
+        const spec = `@lizard-build/cli@${latest}`;
+        if (!isJSONMode()) info(`Upgrading v${CURRENT_VERSION} → ${chalk.green("v" + latest)} with npm...`);
+        const r = spawnSync("npm", ["install", "-g", spec], { encoding: "utf8", shell: process.platform === "win32" });
+        if (r.status === 0) {
+          if (isJSONMode()) printJSON({ previousVersion: CURRENT_VERSION, latestVersion: latest, upgraded: true, method: "npm" });
+          else success(`Upgraded to v${latest}`);
+          return;
+        }
         if (isJSONMode()) {
           printJSON({
             currentVersion: CURRENT_VERSION,
@@ -85,11 +95,12 @@ export function registerUpgrade(program: Command) {
             upgraded: false,
             method: "npm",
             hint: "npm install -g @lizard-build/cli@latest",
+            error: ((r.stderr || "") + (r.error?.message ?? "")).trim().split("\n").slice(-3).join(" ") || null,
           });
           return;
         }
-        info(`Update available: v${CURRENT_VERSION} → ${chalk.green("v" + latest)}`);
-        info(`This copy was installed via npm. Upgrade with:`);
+        info(`npm could not upgrade this copy (${(r.stderr || r.error?.message || "").trim().split("\n").pop()}).`);
+        info(`Upgrade it yourself, with the rights npm needs:`);
         info(`  ${chalk.cyan("npm install -g @lizard-build/cli@latest")}`);
         return;
       }

package/src/commands/volume.ts

@@ -3,7 +3,7 @@ import * as p from "@clack/prompts";
 import { Command } from "commander";
 import { api, withScope, type ResourceScope } from "../lib/api.js";
 import { assertValidVolumeName, resolveVolume, type VolumeRecord } from "../lib/volume.js";
-import { resolveProjectScope } from "../lib/resolve.js";
+import { resolveProjectScope, resolveService } from "../lib/resolve.js";
 import { success, info, warn, isJSONMode, printJSON, table, isTTY } from "../lib/format.js";
 
 function parseIntOption(v: string): number {
@@ -19,19 +19,37 @@ function parseSizeGbOption(v: string): number {
   return parseIntOption(v);
 }
 
+interface ServiceVolume { id: string; name: string; sizeGb: number; mountPath?: string | null; status: string }
+
+/** The app a --service flag names; volumes attach to apps, not addons. */
+async function serviceApp(projectId: string, nameOrId: string) {
+  const svc = await resolveService(projectId, nameOrId);
+  if (svc.kind !== "app") throw new Error(`${svc.name} is a managed addon; its storage is managed for you.`);
+  return svc;
+}
+
 export function registerVolume(program: Command) {
   const vol = program
     .command("volume")
     .alias("vol")
-    .description("Manage persistent volumes for sandboxes");
+    .description("Manage persistent volumes for sandboxes and services");
 
   vol
     .command("list")
     .alias("ls")
-    .description("List volumes in a project")
+    .description("List volumes in a project (sandbox volumes), or a service's volume with --service")
+    .option("-s, --service <name>", "List the volume attached to this service")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .action(async (opts) => {
       const { projectId, scope } = await resolveProjectScope(opts.project);
+      if (opts.service) {
+        const app = await serviceApp(projectId, opts.service);
+        const attached = await api.get<ServiceVolume[]>(`/api/apps/${app.id}/volumes`);
+        if (isJSONMode()) return printJSON(attached);
+        if (!attached.length) return console.log(`${app.name} has no volume. Add one: lizard volume create data --service ${app.name}`);
+        table(["Name", "Size", "Mounted at", "Status"], attached.map((v) => [v.name, `${v.sizeGb} GB`, v.mountPath ?? "—", v.status]));
+        return;
+      }
       const volumes = await api.get<VolumeRecord[]>(
         withScope(`/api/projects/${projectId}/volumes`, scope),
       );
@@ -62,13 +80,26 @@ export function registerVolume(program: Command) {
   vol
     .command("create")
     .argument("<name>", "Volume name")
-    .description("Create a persistent volume")
+    .description("Create a persistent volume for sandboxes, or create one and attach it to a service with --service")
     .option("--size <gb>", "Size in GB (server limits apply; default 5)", parseIntOption)
     .option("--region <code>", "Region to place the volume in (must match the sandbox that will attach it)")
+    .option("-s, --service <name>", "Attach it to this service instead (one volume per service; files there survive restarts and redeploys)")
+    .option("--mount-path <path>", "With --service: where the service sees it (default /data)")
     .option("-p, --project <id>", "Project name, slug, or ID")
     .action(async (name: string, opts) => {
       assertValidVolumeName(name);
       const { projectId, scope } = await resolveProjectScope(opts.project);
+      if (opts.service) {
+        const app = await serviceApp(projectId, opts.service);
+        const mountPath: string = opts.mountPath ?? "/data";
+        if (!mountPath.startsWith("/")) throw new Error(`--mount-path must be an absolute path (got ${mountPath}).`);
+        if (!isJSONMode()) info(`Creating volume ${chalk.cyan(name)} on ${chalk.cyan(app.name)} at ${mountPath}...`);
+        const created = await api.post<ServiceVolume>(`/api/apps/${app.id}/volumes`, { name, sizeGb: opts.size ?? 5, mountPath });
+        if (isJSONMode()) return printJSON(created);
+        success(`Volume ${chalk.bold(created.name)} (${created.sizeGb} GB) attached to ${app.name} at ${created.mountPath ?? mountPath}`);
+        info(chalk.dim("  The service restarts with it mounted. Keep files you must not lose under that path."));
+        return;
+      }
       const limits = await api.get<{ minSizeGb: number; maxSizeGb: number; defaultSizeGb: number }>(
         withScope(`/api/projects/${projectId}/volume-limits`, scope),
       );

package/src/commands/workspace.ts

@@ -75,15 +75,10 @@ export function registerWorkspace(program: Command) {
       if (workspace.role !== "owner") {
         throw new Error("Only the workspace owner can delete it.");
       }
-      // Empty workspaces only. Check here for a clear message; the backend
-      // enforces the same via ?requireEmpty=true and also refuses if any
-      // sandbox remains (which the CLI can't count on its own).
-      const projectCount = workspace.projectCount ?? 0;
-      if (projectCount > 0) {
-        throw new Error(
-          `Workspace "${workspace.name}" has ${projectCount} project(s). Delete them first, or use the dashboard to remove everything.`,
-        );
-      }
+      // Empty workspaces only: the backend checks that with ?requireEmpty=true (live
+      // projects, sandboxes and volumes) and says what is left. The list's projectCount
+      // also counts projects in the 3-day trash, so a client-side check here refused a
+      // workspace whose projects had all just been deleted.
 
       if (!opts.yes && isTTY() && !isJSONMode()) {
         const ok = await p.confirm({ message: `Delete workspace ${chalk.bold(workspace.name)}?` });

package/src/lib/api.ts

@@ -187,6 +187,24 @@ export function isProjectDeletedError(err: unknown): err is APIError {
   return body?.error === "Project is being deleted";
 }
 
+const DROPPED = new Set(["UND_ERR_SOCKET", "UND_ERR_CLOSED", "ECONNRESET", "EPIPE", "ECONNREFUSED"]);
+
+/**
+ * fetch for reads: a connection the network dropped before any response is retried
+ * twice. Reads change nothing, so a retry is safe; writes are never retried here.
+ */
+async function fetchWithRetry(url: string, init: RequestInit): Promise<Response> {
+  for (let attempt = 1; ; attempt++) {
+    try {
+      return await fetch(url, init);
+    } catch (e: any) {
+      const code = e?.cause?.code ?? e?.code;
+      if (attempt >= 3 || !DROPPED.has(code)) throw e;
+      await new Promise((r) => setTimeout(r, 300 * attempt));
+    }
+  }
+}
+
 async function request<T = any>(
   method: string,
   path: string,
@@ -207,11 +225,8 @@ async function request<T = any>(
     headers["Content-Type"] = "application/json";
   }
 
-  const res = await fetch(url, {
-    method,
-    headers,
-    body: body !== undefined ? JSON.stringify(body) : undefined,
-  });
+  const init = { method, headers, body: body !== undefined ? JSON.stringify(body) : undefined };
+  const res = method === "GET" ? await fetchWithRetry(url, init) : await fetch(url, init);
 
   if (!res.ok) {
     let body: unknown = null;
@@ -233,7 +248,7 @@ export async function getRawBytes(path: string): Promise<Buffer> {
   const headers: Record<string, string> = clientHeaders();
   if (token) headers["Authorization"] = `Bearer ${token}`;
 
-  const res = await fetch(url, { method: "GET", headers });
+  const res = await fetchWithRetry(url, { method: "GET", headers });
   if (!res.ok) {
     let body: unknown = null;
     try {

package/src/lib/config.ts

@@ -148,10 +148,20 @@ export async function resolveProjectId(flagValue?: string): Promise<string> {
   //
   // A 21-character slug would be misread as an id here, so a caller that gets "project
   // not found" from the server should retry through resolveProjectIdSlow.
-  if (/^[A-Za-z0-9_-]{21}$/.test(flagValue)) return flagValue;
+  if (looksLikeId(flagValue)) return flagValue;
   return resolveProjectIdSlow(flagValue);
 }
 
+/**
+ * A 21-character nanoid. Names and slugs use the same characters, and a 21-character
+ * name ("ev-r1-deploy-monorepo") was sent as an id and came back "Project not found".
+ * Ids almost always hold an uppercase letter (all-lowercase is about a 1-in-55,000 draw);
+ * names and slugs rarely do, so require one.
+ */
+export function looksLikeId(value: string): boolean {
+  return /^[A-Za-z0-9_-]{21}$/.test(value) && /[A-Z]/.test(value);
+}
+
 /** List projects and match on id, slug or name — for anything not shaped like an id. */
 export async function resolveProjectIdSlow(flagValue: string): Promise<string> {
   const { api } = await import("./api.js");

package/src/lib/default-project.ts

@@ -1,6 +1,6 @@
 import chalk from "chalk";
 import { api, APIError } from "./api.js";
-import { info } from "./format.js";
+import { info, isJSONMode } from "./format.js";
 
 // The project a command uses when the folder is not linked and no --project is
 // given: the platform's default for this account (GET /api/projects/default),
@@ -37,7 +37,10 @@ let noted = false;
 export function noteDefaultProject(name: string): void {
   if (noted) return;
   noted = true;
-  info(chalk.dim(`Project: ${name} (your default). Pass --project for another, or run \`lizard init\` to link this folder.`));
+  const note = `Project: ${name} (your default). Pass --project for another, or run \`lizard init\` to link this folder.`;
+  // stderr, so stdout stays pure JSON; agents read both and need to know where the command landed.
+  if (isJSONMode()) process.stderr.write(note + "\n");
+  else info(chalk.dim(note));
 }
 
 /** For tests: forget the cached answer. */

package/src/lib/updater.ts

@@ -5,7 +5,7 @@ import { join, dirname } from "node:path";
 import os from "node:os";
 import { spawn } from "node:child_process";
 
-export const CURRENT_VERSION = "4.0.45";
+export const CURRENT_VERSION = "4.0.46";
 const RELEASES_API = "https://api.github.com/repos/lizard-build/lizard-cli/releases/latest";
 const RELEASE_BASE = "https://github.com/lizard-build/lizard-cli/releases/latest/download";
 

package/test/unit/default-project.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { resolveProjectId, getProjectLink, setProjectLink } from "../../src/lib/config.js";
+import { resolveProjectId, getProjectLink, setProjectLink, looksLikeId } from "../../src/lib/config.js";
 import { resetDefaultProject } from "../../src/lib/default-project.js";
 import { ensureLinked } from "../../src/commands/init.js";
 import { resolveProject as resolveAddProject } from "../../src/commands/add.js";
@@ -65,10 +65,16 @@ describe("resolveProjectId in an unlinked folder", () => {
   test("a linked folder or --project never asks for it", async () => {
     setProjectLink({ projectId: "p-linked" });
     expect(await resolveProjectId()).toBe("p-linked");
-    expect(await resolveProjectId("abcdefghijklmnopqrstu")).toBe("abcdefghijklmnopqrstu");
+    expect(await resolveProjectId("abcdefghijKlmnopqrstu")).toBe("abcdefghijKlmnopqrstu");
     expect(requested()).toEqual([]);
   });
 
+  test("a 21-character lowercase name is looked up, not sent as an id", async () => {
+    expect(looksLikeId("ev-r1-deploy-monorepo")).toBe(false);
+    expect(looksLikeId("EmKpChcrzdgwf0EV1WZaD")).toBe(true);
+    expect(looksLikeId("short")).toBe(false);
+  });
+
   test("no default project, or a platform without the route: the old error", async () => {
     routes({ "GET /api/projects/default": () => reply(404, { error: "none", code: "NO_DEFAULT_PROJECT" }) });
     await expect(resolveProjectId()).rejects.toThrow("No project linked. Run `lizard init` or pass --project <id>.");

package/test/unit/s3-presign.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "vitest";
+import { presignGet } from "../../src/commands/s3.js";
+
+describe("lizard s3 url", () => {
+  const base = {
+    endpoint: "https://s3-us-east-1.onlizard.com/addon123",
+    accessKeyId: "AKIDEXAMPLE",
+    secretKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+    region: "us-east-1",
+    bucket: "default",
+    expiresIn: 3600,
+    now: new Date("2026-10-13T10:00:00.000Z"),
+  };
+
+  test("signs a path-style GET under the addon's endpoint path", () => {
+    const url = new URL(presignGet({ ...base, key: "reports/q3 report.txt" }));
+    expect(url.host).toBe("s3-us-east-1.onlizard.com");
+    expect(url.pathname).toBe("/addon123/default/reports/q3%20report.txt");
+    expect(url.searchParams.get("X-Amz-Credential")).toBe("AKIDEXAMPLE/20261013/us-east-1/s3/aws4_request");
+    expect(url.searchParams.get("X-Amz-Date")).toBe("20261013T100000Z");
+    expect(url.searchParams.get("X-Amz-Expires")).toBe("3600");
+    expect(url.searchParams.get("X-Amz-SignedHeaders")).toBe("host");
+    expect(url.searchParams.get("X-Amz-Signature")).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  test("the signature changes with the key and the expiry, and is stable otherwise", () => {
+    const a = presignGet({ ...base, key: "a.txt" });
+    expect(presignGet({ ...base, key: "a.txt" })).toBe(a);
+    expect(presignGet({ ...base, key: "b.txt" })).not.toBe(a);
+    expect(presignGet({ ...base, key: "a.txt", expiresIn: 60 })).not.toBe(a);
+  });
+});

package/test/unit/sandbox-transport.test.ts

@@ -48,10 +48,14 @@ describe("sandbox exec stream", () => {
     respond = (_req, res) => res.end(body);
     await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ code: "EXEC_STREAM_INCOMPLETE" });
   });
-  it.each([null, -1, 256, 1.5, "0"])("rejects invalid exit code %s", async exitCode => {
+  it.each([null, -2, 256, 1.5, "0"])("rejects invalid exit code %s", async exitCode => {
     respond = (_req, res) => res.end(`event: exit\ndata: ${JSON.stringify({ exitCode })}\n\n`);
     await expect(execStream("sb", "test", () => {})).rejects.toThrow("Invalid exec exit event");
   });
+  it("reports exit code -1 as the platform's 150-second limit, with status 408", async () => {
+    respond = (_req, res) => res.end(`event: exit\ndata: {"exitCode":-1}\n\n`);
+    await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ status: 408, code: "EXEC_TIMEOUT" });
+  });
   it.each([401, 403, 404, 408, 504])("preserves HTTP %i as an APIError", async status => {
     respond = (_req, res) => { res.writeHead(status); res.end(JSON.stringify({ error: "test failure", code: "TEST" })); };
     await expect(execStream("sb", "test", () => {})).rejects.toMatchObject({ status, message: "test failure", code: "TEST" });

package/test/unit/sandbox.test.ts

@@ -15,6 +15,7 @@ vi.mock("open", () => ({ default: vi.fn().mockResolvedValue(undefined) }));
 vi.mock("../../src/lib/config.js", () => ({
   resolveProjectId: vi.fn().mockResolvedValue("project-test"),
   getProjectLink: vi.fn(() => ({ projectId: "project-test" })),
+  looksLikeId: (v: string) => /^[A-Za-z0-9_-]{21}$/.test(v) && /[A-Z]/.test(v),
 }));
 vi.mock("../../src/lib/format.js", () => ({ isJSONMode: () => true, printJSON: vi.fn() }));