ninepm 0.24.1 → 0.27.0

package/README.md

@@ -6,22 +6,9 @@ This package contains only client-side deploy code. It does not include the 9pm.
 
 ## Install
 
-Installer:
-
-```sh
-curl -fsSL https://9pm.ai/install.sh | bash
-```
-
-Tarball:
-
-```sh
-npm install -g https://9pm.ai/downloads/9pm/latest.tgz
-```
-
-Local early access tarball:
-
 ```sh
-npm install -g ./ninepm-0.24.1.tgz
+npm i -g ninepm        # persistent `9pm` binary
+npx ninepm <args>      # run without installing
 ```
 
 ## Configure
@@ -57,10 +44,10 @@ Check installed vs published CLI version:
 9pm doctor          # surfaces the same drift line alongside credential/account health
 ```
 
-Upgrade by re-running the installer:
+Upgrade:
 
 ```sh
-curl -fsSL https://9pm.ai/install.sh | bash
+npm i -g ninepm@latest
 ```
 
 ## Deploy

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
-import type { AccessGrant, AccessGrantType, AccessProviderKey, AppAccessSettings, AppAccessServiceToken, AppAccessToken, AppDatabase, AppRuntime, ContainerRegion, Deployment, ManagedFileObject, ManagedFileShare, ManagedFileUsage, Project } from "./cli-types.js";
+import { Agent } from "undici";
+import type { AccessGrant, AccessGrantType, AccessProviderKey, AppAccessSettings, AppAccessServiceToken, AppAccessToken, AppDatabase, AppRuntime, ContainerImageUploadInstruction, ContainerRegion, Deployment, ManagedFileObject, ManagedFileShare, ManagedFileUsage, Project } from "./cli-types.js";
 export interface DeployOptions {
     directory: string;
     apiUrl: string;
@@ -109,7 +110,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.24.1";
+export declare const CLI_VERSION = "0.27.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface CredentialDiagnostics {
     platform: NodeJS.Platform;
@@ -264,6 +265,16 @@ export declare function getManagedFile(options: FileGetOptions): Promise<{
 }>;
 export declare function deleteManagedFile(options: FileDeleteOptions): Promise<ManagedFilePutResult>;
 export declare function shareManagedFile(options: FileShareOptions): Promise<ManagedFileShareResult>;
+export interface UploadRetryOptions {
+    attempts: number;
+    baseDelayMs: number;
+    retryNetworkErrors?: boolean;
+}
+type ContainerUploadInit = RequestInit & {
+    dispatcher?: Agent;
+};
+export declare function uploadRequestWithRetry(fetchFn: FetchLike, url: string, init: ContainerUploadInit, label: string, sizeBytes: number, options?: UploadRetryOptions): Promise<Response>;
+export declare function uploadContainerImage(fetchFn: FetchLike, imagePath: string, upload: ContainerImageUploadInstruction, retry?: UploadRetryOptions): Promise<void>;
 type CliCommand = {
     kind: "deploy";
     options: DeployOptions;

package/dist/index.js

@@ -5,13 +5,14 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
-import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, openAsBlob, readFileSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { Agent, fetch as undiciFetch } from "undici";
 import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./deploy-description.js";
 import { assetFileTooLargeMessage, oversizedAssets } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.24.1";
+export const CLI_VERSION = "0.27.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -220,7 +221,9 @@ export async function deployDirectory(initialOptions) {
 }
 async function runDeploy(initialOptions, slugHolder) {
     const options = prepareFrameworkDeploy(initialOptions);
-    const fetchFn = options.fetchFn ?? fetch;
+    // #374: enrich network-level fetch rejections (EPIPE, header timeouts, …)
+    // across every deploy call — create, upload, finalize, poll — with one wrap.
+    const fetchFn = withFetchDiagnostics(options.fetchFn ?? fetch);
     const apiUrl = normalizeApiUrl(options.apiUrl);
     const runtime = options.runtime ?? (options.entry ? "worker" : "static");
     if (!options.runtime && runtime === "static" && hasDockerfile(options.directory)) {
@@ -257,7 +260,10 @@ async function runDeploy(initialOptions, slugHolder) {
                     healthPath: options.healthPath ?? null,
                     region: options.region ?? "auto",
                     alwaysOn: options.alwaysOn ?? false,
-                    volumeGb: options.volumeGb ?? 0,
+                    // Only send volumeGb when the user specified a disk (--volume) or
+                    // explicitly none (--no-volume). Omitting it lets the server carry the
+                    // prior deployment's disk forward instead of dropping it.
+                    ...(options.volumeGb !== undefined ? { volumeGb: options.volumeGb } : {}),
                     ...(options.allowVolumeDestroy ? { allowVolumeDestroy: true } : {}),
                     ...(options.allowNamespaceReset ? { allowNamespaceReset: true } : {}),
                     ...(options.cpus !== undefined ? { cpus: options.cpus } : {}),
@@ -276,11 +282,31 @@ async function runDeploy(initialOptions, slugHolder) {
             if (!created.containerImageUpload) {
                 throw new Error("Container deployment did not return an image upload session.");
             }
-            await uploadContainerImage(fetchFn, image.path, created.containerImageUpload);
+            // Use undici's own fetch (not Node's built-in) so it pairs with the
+            // undici Agent dispatcher from the same package version. Handing an
+            // npm undici@7 Agent to Node's bundled fetch (undici 6.x on Node 20/22)
+            // crosses a major-version dispatch-handler boundary; keeping both on the
+            // installed undici avoids that mismatch. Tests still inject their own fetch.
+            await uploadContainerImage(options.fetchFn ?? undiciFetchLike, image.path, created.containerImageUpload);
             const queued = await finalizeDeployment(fetchFn, apiUrl, options.token, created.deployment.id);
             const finalized = await pollDeployment(fetchFn, apiUrl, options.token, queued.id, options.pollTimeoutMs ?? DEFAULT_CONTAINER_POLL_TIMEOUT_MS, queued);
             if (finalized.status === "failed") {
-                throw new Error(deploymentFailureMessage(finalized));
+                // #374: the deployment's own message is the neutral reason + support
+                // ref. Inline a bounded tail of the build/push log when we can fetch it
+                // (captured now, before any first-deploy rollback), so the output names
+                // the real cause without a separate command.
+                const parts = [deploymentFailureMessage(finalized)];
+                const detail = await containerFailureDetail({ apiUrl, token: options.token, fetchFn }, project.slug, finalized.id);
+                if (detail) {
+                    parts.push(`Container build/push log (tail):\n${detail}`);
+                }
+                // The `9pm logs` pointer only helps while the app still exists. A failed
+                // first deploy is rolled back (deleted) by deployDirectory's catch, so
+                // the command would 404 — only offer it for redeploys of a surviving app.
+                if (!slugHolder.created) {
+                    parts.push(`Run '9pm logs ${project.slug}' for the full container build/push log.`);
+                }
+                throw new Error(parts.join("\n\n"));
             }
             return {
                 project,
@@ -501,7 +527,7 @@ async function doctor(options) {
                 : "up to date";
         console.log(`CLI: ${versionCheck.current} (latest ${versionCheck.latest.version}, ${status})`);
         if (versionCheck.comparison === "behind") {
-            console.log(`Update: curl -fsSL ${normalizeApiUrl(options.apiUrl).replace(/\/$/, "").replace(/\/\/api\./, "//")}/install.sh | bash`);
+            console.log("Update: npm i -g ninepm@latest");
         }
     }
     else if (versionError) {
@@ -594,21 +620,16 @@ export async function fetchLatestCliVersion(options) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 5000);
     try {
-        const response = await fetchFn(`${apiUrl}/downloads/9pm/latest.json`, { signal: controller.signal });
+        void apiUrl; // updater now sources the public npm registry, not the platform host
+        const response = await fetchFn("https://registry.npmjs.org/ninepm/latest", { signal: controller.signal });
         if (!response.ok) {
-            throw new Error(`Latest version manifest returned ${response.status}.`);
+            throw new Error(`npm registry returned ${response.status} for ninepm.`);
         }
         const payload = (await response.json());
         if (typeof payload.version !== "string" || !payload.version.trim()) {
-            throw new Error("Latest version manifest is missing version.");
+            throw new Error("npm registry response is missing a version.");
         }
-        return {
-            version: payload.version.trim(),
-            ...(typeof payload.publishedAt === "string" ? { publishedAt: payload.publishedAt } : {}),
-            ...(typeof payload.tarballSha256 === "string" && /^[0-9a-f]{64}$/i.test(payload.tarballSha256.trim())
-                ? { tarballSha256: payload.tarballSha256.trim().toLowerCase() }
-                : {}),
-        };
+        return { version: payload.version.trim() };
     }
     finally {
         clearTimeout(timer);
@@ -825,48 +846,209 @@ function deploymentFailureMessage(deployment) {
     const error = deployment.metadata["error"];
     return typeof error === "string" && error.trim() ? error.trim() : "Deployment failed.";
 }
-async function uploadContainerImage(fetchFn, imagePath, upload) {
-    const bytes = readFileSync(imagePath);
-    if (bytes.byteLength > upload.maxBytes) {
-        throw new Error(`Container image is ${bytes.byteLength} bytes; upload session allows ${upload.maxBytes} bytes.`);
-    }
-    const partBytes = upload.partBytes && upload.partBytes > 0 ? upload.partBytes : 0;
-    if (!partBytes || !upload.completeUrl || bytes.byteLength <= partBytes) {
-        const response = await fetchFn(upload.uploadUrl, {
-            method: upload.method,
-            headers: upload.headers,
-            body: arrayBufferFromBytes(bytes),
-        });
-        await expectOk(response, "upload container image");
-        return;
+const CONTAINER_UPLOAD_RETRY = { attempts: 5, baseDelayMs: 1_000 };
+// undici's fetch is web-compatible at runtime but its types don't structurally
+// match the DOM-based FetchLike (it requires `duplex` on Request). We only ever
+// call it with string URLs, so the cast is safe.
+const undiciFetchLike = undiciFetch;
+function isRetryableStatus(status) {
+    return status === 408 || status === 429 || (status >= 500 && status <= 599);
+}
+function uploadBackoffDelayMs(baseDelayMs, attempt) {
+    return baseDelayMs * 2 ** (attempt - 1);
+}
+async function safeReadResponseText(response) {
+    try {
+        return (await response.text()).trim();
     }
-    // Large images go up in parts so no single request exceeds the platform's
-    // request-body limits.
-    const totalParts = Math.ceil(bytes.byteLength / partBytes);
-    let uploadId = "";
-    const parts = [];
-    for (let part = 1; part <= totalParts; part += 1) {
-        const chunk = bytes.subarray((part - 1) * partBytes, Math.min(part * partBytes, bytes.byteLength));
-        const query = uploadId ? `?part=${part}&uploadId=${encodeURIComponent(uploadId)}` : `?part=${part}`;
-        const response = await fetchFn(`${upload.uploadUrl}${query}`, {
-            method: upload.method,
-            headers: upload.headers,
-            body: arrayBufferFromBytes(chunk),
+    catch {
+        return "";
+    }
+}
+const CONTAINER_FAILURE_TAIL_LINES = 20;
+const CONTAINER_FAILURE_TAIL_CHARS = 2048;
+// Diagnostics must never delay the failure we already have: cap the best-effort
+// logs lookup so a slow or stalled /logs can't make the CLI appear hung (#374).
+const CONTAINER_LOGS_TIMEOUT_MS = 5000;
+// #374: a container publish failure records only the neutral message + support
+// ref on the deployment; the actionable build/push detail lives on the
+// container-logs endpoint (already scrubbed server-side). Best-effort fetch a
+// bounded tail so the deploy output carries the real reason inline. Any
+// failure — including the timeout — returns "" so it can never mask or delay
+// the original deploy failure.
+async function containerFailureDetail(options, slug, deploymentId) {
+    try {
+        const result = await apiRequest(options, `/v1/sites/${encodeURIComponent(slug)}/logs`, {
+            method: "GET",
+            signal: AbortSignal.timeout(CONTAINER_LOGS_TIMEOUT_MS),
         });
-        await expectOk(response, `upload container image part ${part}/${totalParts}`);
-        const payload = (await response.json());
-        if (!payload.uploadId || !payload.etag) {
-            throw new Error(`Container image part ${part} did not return an upload receipt.`);
+        // The logs route returns the app's *latest* container deployment; under a
+        // concurrent redeploy of the same slug that may be a different one, so only
+        // trust the tail when it's the deployment we just watched fail.
+        if (result.deployment?.id !== deploymentId) {
+            return "";
         }
-        uploadId = payload.uploadId;
-        parts.push({ part, etag: payload.etag });
+        const source = result.logs && result.logs.trim() ? result.logs : result.reason ?? "";
+        return tailText(source, CONTAINER_FAILURE_TAIL_LINES, CONTAINER_FAILURE_TAIL_CHARS);
     }
-    const completed = await fetchFn(upload.completeUrl, {
-        method: "POST",
-        headers: { ...upload.headers, "content-type": "application/json" },
-        body: JSON.stringify({ uploadId, parts }),
+    catch {
+        return "";
+    }
+}
+// Last `maxLines` lines, then clamped to `maxChars` (UTF-16 code units, so an
+// approximate size cap that may cut mid-line — fine for a display tail) from the
+// end. Returns "" for blank input.
+function tailText(text, maxLines, maxChars) {
+    let trimmed = text.trim();
+    if (!trimmed) {
+        return "";
+    }
+    const lines = trimmed.split("\n");
+    if (lines.length > maxLines) {
+        trimmed = lines.slice(-maxLines).join("\n");
+    }
+    if (trimmed.length > maxChars) {
+        trimmed = trimmed.slice(-maxChars);
+    }
+    return trimmed;
+}
+// Turn undici's opaque `fetch failed` into something actionable by surfacing the
+// underlying cause (e.g. EPIPE, UND_ERR_HEADERS_TIMEOUT).
+function describeFetchError(error) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const cause = error.cause;
+    let causeText = "";
+    if (cause instanceof Error) {
+        const code = cause.code;
+        causeText = typeof code === "string" && code ? `${code}: ${cause.message}` : cause.message;
+    }
+    else if (cause && typeof cause === "object" && "code" in cause) {
+        causeText = String(cause.code);
+    }
+    else if (cause !== undefined && cause !== null) {
+        causeText = String(cause);
+    }
+    return causeText ? `${error.message} (${causeText})` : error.message;
+}
+// Release a successful response we don't need to read. Undici pins the
+// connection until the body is consumed or cancelled, which would otherwise
+// stall `Agent.close()` when the caller ignores the payload.
+async function discardResponseBody(response) {
+    try {
+        await response.body?.cancel();
+    }
+    catch {
+        // Best effort: the socket is released regardless of a late cancel error.
+    }
+}
+// Send one upload request, retrying transient network failures and retryable
+// HTTP statuses (408/429/5xx) with exponential backoff. Non-retryable statuses
+// and exhausted retries throw with the cause, label, and byte size attached.
+// Idempotency is the caller's responsibility: send the uploadId-less part 1
+// with attempts=1 (a re-send starts a second multipart upload), and the
+// non-idempotent "complete" with retryNetworkErrors=false (a re-send after a
+// lost success 500s on the consumed uploadId).
+export async function uploadRequestWithRetry(fetchFn, url, init, label, sizeBytes, options = CONTAINER_UPLOAD_RETRY) {
+    const { attempts, baseDelayMs, retryNetworkErrors = true } = options;
+    let lastError = "unknown error";
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        let response;
+        try {
+            response = await fetchFn(url, init);
+        }
+        catch (error) {
+            lastError = describeFetchError(error);
+            if (!retryNetworkErrors) {
+                throw new Error(`Failed to ${label}: ${lastError}. The request may have completed on the server; ` +
+                    `check the deployment status before retrying rather than re-running blindly. ` +
+                    `(${formatBytesForCli(sizeBytes)})`);
+            }
+            if (attempt >= attempts) {
+                break;
+            }
+            await sleep(uploadBackoffDelayMs(baseDelayMs, attempt));
+            continue;
+        }
+        if (response.ok) {
+            return response;
+        }
+        const body = await safeReadResponseText(response);
+        lastError = `${response.status} ${body}`.trim();
+        if (attempt >= attempts || !isRetryableStatus(response.status)) {
+            throw new Error(`Failed to ${label}: ${lastError} (${formatBytesForCli(sizeBytes)}, attempt ${attempt}/${attempts})`);
+        }
+        await sleep(uploadBackoffDelayMs(baseDelayMs, attempt));
+    }
+    throw new Error(`Failed to ${label} after ${attempts} attempts (${formatBytesForCli(sizeBytes)}): ${lastError}`);
+}
+export async function uploadContainerImage(fetchFn, imagePath, upload, retry = CONTAINER_UPLOAD_RETRY) {
+    // Back the body with the file on disk instead of reading it all into memory:
+    // slices are lazy views, so peak memory stays flat regardless of image size,
+    // and a retried attempt just re-reads the same blob.
+    const image = await openAsBlob(imagePath);
+    const totalBytes = image.size;
+    if (totalBytes > upload.maxBytes) {
+        throw new Error(`Container image is ${totalBytes} bytes; upload session allows ${upload.maxBytes} bytes.`);
+    }
+    // Disable undici's headers/body timeouts for the upload: on a slow link the
+    // server sends no response headers until the whole body arrives, so the
+    // default 300s timeouts abort a slow-but-live transfer. Keep a bounded
+    // connect timeout so a dead host still fails fast. This Agent must be driven
+    // by a matching-version fetch (the caller passes undici's own fetch in
+    // production) — see the call site.
+    const dispatcher = new Agent({
+        headersTimeout: 0,
+        bodyTimeout: 0,
+        keepAliveTimeout: 60_000,
+        connect: { timeout: 30_000 },
     });
-    await expectOk(completed, "complete container image upload");
+    try {
+        const partBytes = upload.partBytes && upload.partBytes > 0 ? upload.partBytes : 0;
+        if (!partBytes || !upload.completeUrl || totalBytes <= partBytes) {
+            // A single PUT writes the whole object at a content-addressed key, so a
+            // re-send is idempotent and safe to retry.
+            const response = await uploadRequestWithRetry(fetchFn, upload.uploadUrl, { method: upload.method, headers: upload.headers, body: image, dispatcher }, "upload container image", totalBytes, retry);
+            await discardResponseBody(response);
+            return;
+        }
+        // Large images go up in parts so no single request exceeds the platform's
+        // request-body limits.
+        const totalParts = Math.ceil(totalBytes / partBytes);
+        let uploadId = "";
+        const parts = [];
+        for (let part = 1; part <= totalParts; part += 1) {
+            const chunk = image.slice((part - 1) * partBytes, Math.min(part * partBytes, totalBytes));
+            const query = uploadId ? `?part=${part}&uploadId=${encodeURIComponent(uploadId)}` : `?part=${part}`;
+            // Part 1 has no uploadId yet, so the server starts a fresh multipart
+            // upload for it — retrying a part 1 whose response was lost would orphan
+            // the first upload's parts. Send it once; parts 2..N carry the uploadId
+            // and are safe to retry.
+            const partRetry = uploadId ? retry : { ...retry, attempts: 1 };
+            const response = await uploadRequestWithRetry(fetchFn, `${upload.uploadUrl}${query}`, { method: upload.method, headers: upload.headers, body: chunk, dispatcher }, `upload container image part ${part}/${totalParts}`, chunk.size, partRetry);
+            const payload = (await response.json());
+            if (!payload.uploadId || !payload.etag) {
+                throw new Error(`Container image part ${part} did not return an upload receipt.`);
+            }
+            uploadId = payload.uploadId;
+            parts.push({ part, etag: payload.etag });
+        }
+        // Completing consumes the uploadId server-side, so it is not idempotent: if
+        // this succeeds but the response is lost, a blind re-send 500s on the gone
+        // uploadId. Retry only explicit retryable statuses (server says "not done"),
+        // never an ambiguous network error.
+        const completed = await uploadRequestWithRetry(fetchFn, upload.completeUrl, {
+            method: "POST",
+            headers: { ...upload.headers, "content-type": "application/json" },
+            body: JSON.stringify({ uploadId, parts }),
+            dispatcher,
+        }, "complete container image upload", totalBytes, { ...retry, retryNetworkErrors: false });
+        await discardResponseBody(completed);
+    }
+    finally {
+        await dispatcher.close().catch(() => { });
+    }
 }
 function buildContainerImage(directory) {
     const root = path.resolve(directory);
@@ -921,6 +1103,66 @@ async function expectOk(response, action) {
     const text = await response.text();
     throw new Error(`Failed to ${action}: ${response.status} ${text}`);
 }
+// #374: Node's fetch rejects network-level failures (no HTTP response at all)
+// as a generic "fetch failed" TypeError and stashes the real reason on
+// `error.cause` (e.g. { code: "EPIPE" }). That code never reaches the user.
+// Pull it out so a failed deploy explains itself. This is the fetch-*rejection*
+// path only — expectOk already handles non-2xx HTTP responses, which are
+// resolved fetches and never surface here.
+function describeFetchCause(error) {
+    if (!(error instanceof Error) || error.cause == null) {
+        return null;
+    }
+    const cause = error.cause;
+    if (typeof cause.code === "string" && cause.code) {
+        return cause.code;
+    }
+    if (typeof cause.message === "string" && cause.message) {
+        return cause.message;
+    }
+    return null;
+}
+// Short, platform-opaque hint for a network cause. Keyed on the Node/undici
+// error code; falls back to a generic connectivity nudge for anything else
+// (including bare cause messages).
+function fetchCauseHint(cause) {
+    switch (cause) {
+        case "EPIPE":
+        case "ECONNRESET":
+            return "connection reset — check your connection and retry; large images upload slowly";
+        case "UND_ERR_HEADERS_TIMEOUT":
+        case "UND_ERR_CONNECT_TIMEOUT":
+        case "UND_ERR_BODY_TIMEOUT":
+        case "ETIMEDOUT":
+            return "the connection timed out — check your connection and retry";
+        case "ENOTFOUND":
+        case "EAI_AGAIN":
+            return "could not resolve the host — check your connection and the API URL";
+        case "ECONNREFUSED":
+            return "the server refused the connection — check the API URL and retry";
+        default:
+            return "check your connection and retry";
+    }
+}
+// Wrap the deploy flow's fetch so a network-level rejection carries its cause
+// code + hint instead of a bare "fetch failed". Only rejections are enriched;
+// resolved responses (including non-2xx, handled by expectOk) pass straight
+// through, and any non-network error is rethrown verbatim with its cause
+// preserved for debugging.
+function withFetchDiagnostics(fetchFn) {
+    return async (input, init) => {
+        try {
+            return await fetchFn(input, init);
+        }
+        catch (error) {
+            const cause = describeFetchCause(error);
+            if (!cause) {
+                throw error;
+            }
+            throw new Error(`Network request failed: ${cause} — ${fetchCauseHint(cause)}`, { cause: error });
+        }
+    };
+}
 function normalizeApiUrl(value) {
     return value.replace(/\/+$/g, "");
 }
@@ -958,6 +1200,7 @@ const VALID_DEPLOY_FLAGS = new Set([
     "region",
     "always-on",
     "volume",
+    "no-volume",
     "allow-data-wipe",
     "allow-namespace-reset",
     "cpus",
@@ -1138,6 +1381,16 @@ export function parseArgs(argv) {
         }
         options.volumeGb = volumeGb;
     }
+    // --no-volume is the explicit "this app has no persistent disk" intent. Omitting
+    // both --volume and --no-volume leaves volumeGb unset, so a redeploy keeps the
+    // app's existing disk; --no-volume sends an explicit 0 to drop it (which the
+    // server refuses without --allow-data-wipe when a disk already exists).
+    if (flags.has("no-volume")) {
+        if (volumeGb !== undefined) {
+            throw new Error("--volume and --no-volume cannot be combined.");
+        }
+        options.volumeGb = 0;
+    }
     const cpus = readIntegerFlag(flags, "cpus");
     if (cpus !== undefined) {
         if (cpus < 1 || cpus > 64) {
@@ -2372,15 +2625,11 @@ async function runLatestCommand(command) {
         return;
     }
     console.log(`Installed: ${check.current}`);
-    console.log(`Latest:    ${check.latest.version}${check.latest.publishedAt ? ` (published ${check.latest.publishedAt})` : ""}`);
-    if (check.latest.tarballSha256) {
-        console.log(`SHA-256:   ${check.latest.tarballSha256}`);
-    }
+    console.log(`Latest:    ${check.latest.version}`);
     if (check.comparison === "behind") {
-        const installHost = normalizeApiUrl(command.apiUrl).replace(/\/$/, "").replace(/\/\/api\./, "//");
         console.log("");
         console.log("A newer 9pm CLI is available. Update with:");
-        console.log(`  curl -fsSL ${installHost}/install.sh | bash`);
+        console.log("  npm i -g ninepm@latest   (or run ad-hoc via: npx ninepm <args>)");
     }
     else if (check.comparison === "ahead") {
         console.log("Installed version is ahead of the published latest.");
@@ -2440,7 +2689,7 @@ function printUsage() {
   9pm --version
   9pm deploy [directory] --name <site-name> [--slug <slug>] [--description "<note>"] [--with-db] [--with-auth]
   9pm deploy [directory] --runtime worker --entry src/index.js [--with-db]
-  9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb>] [--cpus <n>] [--memory <size>]
+  9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb> | --no-volume] [--cpus <n>] [--memory <size>]
   9pm deploy [directory]                   framework projects (Next.js, Vite) are detected and built automatically; --no-build skips
   9pm deploy [directory] --bundle <dir>    deploy a pre-built Cloudflare framework bundle (e.g. .open-next)
   9pm deploy [directory] --description "<note>"   optional short note shown next to the version in the dashboard
@@ -2498,8 +2747,12 @@ Container deploys:
   disk is mounted and its path is provided via NINEPM_DATA_DIR. Declare what the app needs with
   --cpus <n> and --memory <size> (512m, 2048, 4g); the platform picks a placement that fits.
   All of these may require platform enablement.
-  --allow-data-wipe acknowledges that switching an app to a different container placement may
-  destroy its existing persistent state; without it such a switch is refused.
+  A redeploy KEEPS the app's existing disk automatically: omit --volume and the current disk is
+  carried forward. To remove the disk on purpose pass --no-volume (and --allow-data-wipe, since it
+  destroys the data). If a disk was previously detached by an old CLI, redeploy with --volume <same
+  gb> --region <same region> to reattach the existing disk (it is reused, not recreated empty).
+  --allow-data-wipe acknowledges that dropping a disk, or switching to a placement that can't keep
+  it, destroys the app's existing persistent state; without it such a deploy is refused.
   --allow-namespace-reset acknowledges that a redeploy may start the app from a fresh, empty
   persistent store when its recorded one can no longer be found; without it such a deploy is refused.
   Regions are provider-neutral: auto, us-east, us-west, europe, asia, south-america, middle-east, oceania, africa.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.24.1",
+  "version": "0.27.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE.md",
@@ -30,7 +30,10 @@
     "prepack": "npm run build"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.18.1"
+  },
+  "dependencies": {
+    "undici": "^7.10.0"
   },
   "devDependencies": {
     "@types/node": "^24.10.1",