@pyric/cli 0.1.0-alpha.19 → 0.1.0-alpha.21

package/src/serve/namespace.ts

@@ -6,6 +6,8 @@
  *                            the injected init script + shared chunks)
  *   /__pyric/init.json       the page init payload (rules, bridge URL) —
  *                            fetched by the runtime chunk at module init
+ *   /__pyric/beacon          the handshake beacon a pyric-launched child
+ *                            POSTs once its interception is installed
  *
  * Bridge routes (`/__pyric/mcp`, `/__pyric/sandbox`) mount here in P2.
  */
@@ -18,10 +20,14 @@ import { collectBody } from '../bridge/server/peer.js';
 import { StateFileError, type StateSection, type StateStore } from './state-store.js';
 import { createWriterLock, type WriterLock } from './writer-lock.js';
 import { createStudioRoutes, type StudioRouteOptions } from './studio/index.js';
-import { pipeFileToResponse, type ServeLogger } from './server.js';
+import { pipeFileToResponse, getHeader, isAllowedHost, isAllowedOrigin, type ServeLogger } from './server.js';
 import type { InitPayload } from './init-payload.js';
 import { handleActivity } from './activity-route.js';
+import { handleAiProxy, AI_PROXY_ROUTE } from './ai-proxy.js';
+import { aiTerminalBlockFor, type AiDiagnosticPayload } from './ai-terminal-blocks.js';
 import { createSiteTreeHandler } from './site-tree.js';
+import { BEACON_PATH, type BeaconReport } from '../register/beacon.js';
+import { handleBeacon } from './beacon-route.js';
 export type { InitPayload } from './init-payload.js';
 
 /**
@@ -107,144 +113,34 @@ export interface NamespaceOptions {
    *  (disk-backed `WorkspaceStore`/`ProjectStore`, plus the SSE watch stream)
    *  that `@pyric/studio`'s `local` mode talks to. */
   studio?: StudioRouteOptions;
+  /** Per-boot session capability token required on workspace and project endpoints. */
+  sessionToken?: string;
+  /** Bound host for DNS rebinding guard. */
+  boundHost?: string;
+  /** Extra allowed hostnames. */
+  allowedHosts?: string[];
   /** The OpenAI-compatible upstream `/__pyric/ai-proxy` forwards to
    *  (pyric/ai — cdd-deltas #98.2). Falls back to the
    *  `PYRIC_AI_PROXY_UPSTREAM` env var, then `http://localhost:11434/v1`
    *  (local Ollama). Always mounted — the route only touches the network
    *  when a request arrives. */
   aiProxyUpstream?: string;
-  /** Where hot-reload/diagnostic lines print (rules reload, denial relay).
-   *  Absent ⇒ diagnostics are dropped (a caller that wires no logger opts out
-   *  silently rather than falling back to raw `console`). */
+  /** Receives one handshake beacon per pyric-launched child (`POST
+   *  /__pyric/beacon`, sent by `@pyric/cli/register` once its hooks and
+   *  net-guard are installed). Absent means the route still 204s; the child
+   *  must never be able to fail on its own proof-of-life. */
+  beacon?: (report: BeaconReport) => void;
+  /** The per-launch secret a beacon must present in `x-pyric-beacon-token`,
+   *  which the launcher puts in the child's `PYRIC_BEACON_TOKEN`. Absent means
+   *  one is generated that nobody holds, so the route accepts nothing. */
+  beaconToken?: string;
+  /** Where hot-reload/diagnostic lines print (rules reload, denial relay,
+   *  AI broker diagnostics, ai-proxy upstream failures). Absent ⇒ diagnostics
+   *  are dropped (a caller that wires no logger opts out silently rather than
+   *  falling back to raw `console`). */
   logger?: ServeLogger;
 }
 
-// ─── AI proxy (`/__pyric/ai-proxy` — pyric/ai, cdd-deltas #98.2) ───────────
-
-/** Default upstream: local Ollama's OpenAI-compatible endpoint. */
-export const AI_PROXY_DEFAULT_UPSTREAM = 'http://localhost:11434/v1';
-
-/**
- * Request headers that must NOT be forwarded upstream: origin-sensitive
- * browser context (`origin`/`referer`/`cookie` — the upstream is a different
- * origin and must never see the page's), hop-by-hop headers, and the two the
- * proxy re-derives (`host`, `content-length`). `accept-encoding` is dropped
- * so fetch negotiates its own compression and the streamed body needs no
- * length fixups.
- */
-const AI_PROXY_STRIPPED_HEADERS = new Set([
-  'host',
-  'origin',
-  'referer',
-  'cookie',
-  'connection',
-  'content-length',
-  'accept-encoding',
-  'keep-alive',
-  'proxy-authorization',
-  'te',
-  'trailer',
-  'transfer-encoding',
-  'upgrade',
-]);
-
-/**
- * Handle `POST /__pyric/ai-proxy/<suffix>` — a same-origin passthrough to the
- * configured OpenAI-compatible upstream, so the browser openai engine
- * (running in the served page or the SharedWorker host) reaches a localhost
- * upstream like Ollama with ZERO CORS setup (no `OLLAMA_ORIGINS`, ever).
- *
- * Behavior:
- *   - POST only (the OpenAI chat-completions surface is POST); 405 otherwise.
- *   - the path suffix + query ride through verbatim
- *     (`/__pyric/ai-proxy/chat/completions` → `<upstream>/chat/completions`).
- *   - the request body is forwarded verbatim; headers minus the
- *     origin-sensitive/hop-by-hop set above (`authorization` DOES forward —
- *     upstreams may require a key).
- *   - the response body is STREAMED through chunk-by-chunk — SSE passthrough
- *     must never buffer, or `stream: true` completions would arrive all at
- *     once at the end.
- *   - an unreachable upstream answers 502 with a plain-text explanation.
- */
-async function handleAiProxy(
-  configuredUpstream: string | undefined,
-  req: IncomingMessage,
-  res: ServerResponse,
-  url: URL,
-): Promise<void> {
-  if (req.method !== 'POST') {
-    res.writeHead(405, { allow: 'POST' }).end('method not allowed');
-    return;
-  }
-  const upstreamBase = (
-    configuredUpstream ??
-    process.env.PYRIC_AI_PROXY_UPSTREAM ??
-    AI_PROXY_DEFAULT_UPSTREAM
-  ).replace(/\/$/, '');
-  const suffix = url.pathname.slice('/__pyric/ai-proxy'.length);
-  const target = `${upstreamBase}${suffix}${url.search}`;
-
-  // Buffer the REQUEST body (small JSON payloads); the RESPONSE streams.
-  const raw = await new Promise<Buffer>((resolve, reject) => {
-    const chunks: Buffer[] = [];
-    req.on('data', (c: Buffer) => chunks.push(c));
-    req.on('end', () => resolve(Buffer.concat(chunks)));
-    req.on('error', reject);
-  });
-  // Copy into a plain-ArrayBuffer view — fetch's BodyInit typing rejects
-  // Buffer's ArrayBufferLike backing.
-  const body = new Uint8Array(raw.byteLength);
-  body.set(raw);
-
-  const headers: Record<string, string> = {};
-  for (const [key, value] of Object.entries(req.headers)) {
-    if (value === undefined) continue;
-    if (AI_PROXY_STRIPPED_HEADERS.has(key.toLowerCase())) continue;
-    headers[key] = Array.isArray(value) ? value.join(', ') : value;
-  }
-
-  let upstream: Response;
-  try {
-    upstream = await fetch(target, { method: 'POST', headers, body });
-  } catch (e) {
-    res.writeHead(502, { 'content-type': 'text/plain' });
-    res.end(
-      `pyric dev ai-proxy: upstream ${target} unreachable: ` +
-        `${e instanceof Error ? e.message : String(e)}\n` +
-        'Set PYRIC_AI_PROXY_UPSTREAM to an OpenAI-compatible base URL ' +
-        `(default ${AI_PROXY_DEFAULT_UPSTREAM}).`,
-    );
-    return;
-  }
-
-  const responseHeaders: Record<string, string> = { 'cache-control': 'no-store' };
-  const contentType = upstream.headers.get('content-type');
-  if (contentType) responseHeaders['content-type'] = contentType;
-  res.writeHead(upstream.status, responseHeaders);
-  if (!upstream.body) {
-    res.end();
-    return;
-  }
-  (res as ServerResponse & { flushHeaders?: () => void }).flushHeaders?.();
-
-  // Chunk-by-chunk passthrough. A dropped client cancels the upstream read
-  // so an abandoned SSE stream doesn't keep the upstream generating.
-  const reader = upstream.body.getReader();
-  res.on('close', () => {
-    void reader.cancel().catch(() => {});
-  });
-  try {
-    for (;;) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      res.write(value);
-    }
-  } catch {
-    // Upstream or client dropped mid-stream — nothing to salvage.
-  }
-  res.end();
-}
-
 /** The page's persistence backend speaks this route:
  *  GET    /__pyric/state                    → whole envelope (404 when absent)
  *  GET    /__pyric/state?section=firestore  → that section (404 when null)
@@ -384,6 +280,18 @@ async function handleCapture(
 // An agent driving `pyric dev` headlessly has no browser console to watch;
 // this is that visibility, printed to the terminal instead.
 //
+// The route carries the AI broker's diagnostics on the same channel, relayed
+// by `serve/ai-diagnostics-relay.ts` off the sandbox event stream:
+// `request_rejected` (a malformed request) and `response_blocked` (a safety
+// or recitation filter withheld the answer). Same category ("the sandbox
+// refused your operation"), same terminal treatment, same throttle, so they
+// ride here rather than opening parallel diagnostics channels.
+// `model_substituted` (an engine answered as a model the code never named)
+// rides along too: not a refusal, but the same "the sandbox quietly did
+// something else" category. The payload's `kind` discriminates the four, and
+// `ai-terminal-blocks.ts` holds one record per AI kind so this route
+// dispatches through a table instead of a cascade.
+//
 // A denied listener re-fires on every auth/rules change, so printing is
 // throttled per (path, message) pair — at most one line per window, and
 // silent (no output at all) on suppression rather than a "suppressed N more"
@@ -443,9 +351,21 @@ export function formatDenialBlock(payload: DenialRelayPayload): string {
   return lines.join('\n');
 }
 
-/** Handle `POST /__pyric/denials`. Always 204s (best-effort diagnostics —
- *  a malformed body or a caller with no logger wired must never fail the
- *  page that reported the denial). */
+/**
+ * The throttle key separator: a NUL byte, written as an escape so the file
+ * stays greppable. It cannot occur in a Firestore path, a model id, or a
+ * rejection reason, so no (target, reason) pair can be spelled two ways.
+ */
+const THROTTLE_KEY_SEPARATOR = '\x00';
+
+/** Handle `POST /__pyric/denials`: a rules denial, or (discriminated by
+ *  `kind`) an AI broker rejection, blocked response, or model substitution
+ *  relayed off the sandbox event stream. All four share the throttle map: an
+ *  agent retry loop re-sends the SAME malformed (or filter-tripping) AI
+ *  request exactly the way a denied listener re-fires, so one line per
+ *  (target, reason) per window is the right volume for every one of them.
+ *  Always 204s (best-effort diagnostics: a malformed body or a caller with no
+ *  logger wired must never fail the page that reported the refusal). */
 async function handleDenials(
   throttle: DenialThrottle,
   logger: ServeLogger | undefined,
@@ -457,22 +377,48 @@ async function handleDenials(
     return;
   }
   try {
-    const payload = (await collectBody(req)) as DenialRelayPayload;
-    const message = typeof payload.message === 'string' ? payload.message : 'permission denied';
-    const path = payload.denialContext?.request?.path ?? '';
-    const key = `${path}${message}`;
+    const payload = (await collectBody(req)) as DenialRelayPayload & AiDiagnosticPayload;
+    const aiBlock = aiTerminalBlockFor(payload.kind);
+    let target: string;
+    let reason: string;
+    let render: () => string;
+    if (aiBlock === null) {
+      target = payload.denialContext?.request?.path ?? '';
+      reason = typeof payload.message === 'string' ? payload.message : 'permission denied';
+      render = () => formatDenialBlock(payload);
+    } else {
+      target = aiBlock.throttleTarget(payload);
+      reason = aiBlock.throttleReason(payload);
+      render = () => aiBlock.format(payload);
+    }
+    const key = `${target}${THROTTLE_KEY_SEPARATOR}${reason}`;
     if (logger && throttle.shouldPrint(key, Date.now())) {
-      logger.note(formatDenialBlock(payload));
+      logger.note(render());
     }
   } catch {
-    /* malformed body — drop it; this is a diagnostics side channel */
+    /* malformed body: drop it; this is a diagnostics side channel */
   }
   res.writeHead(204).end();
 }
 
 export function createPyricNamespace(opts: NamespaceOptions) {
-  const writerLock = createWriterLock();
-  const studioRoutes = opts.studio ? createStudioRoutes(opts.studio) : null;
+  const stateWriterLock = createWriterLock();
+  const studioWriterLock = opts.studio?.writerLock ?? createWriterLock();
+  const sessionToken = opts.sessionToken ?? randomBytes(24).toString('base64url');
+  // Fail closed: with no launcher-supplied secret the generated one is held by
+  // nobody, so `/__pyric/beacon` accepts nothing rather than everything.
+  const beaconToken = opts.beaconToken ?? randomBytes(24).toString('base64url');
+  let studioRoutes: ((req: IncomingMessage, res: ServerResponse, url: URL) => Promise<boolean>) | null = null;
+  if (opts.studio) {
+    const studioOptions: StudioRouteOptions = {
+      ...opts.studio,
+      sessionToken,
+      writerLock: studioWriterLock,
+      boundHost: opts.boundHost,
+      allowedHosts: opts.allowedHosts,
+    };
+    studioRoutes = createStudioRoutes(studioOptions);
+  }
   const siteTree = opts.siteUiDir
     ? createSiteTreeHandler(opts.siteUiDir, opts.workerVersion)
     : null;
@@ -489,7 +435,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
       return studioRoutes(req, res, url);
     }
     if (opts.state && url.pathname === '/__pyric/state') {
-      return handleState(opts.state!, writerLock, req, res, url).then(() => true);
+      return handleState(opts.state!, stateWriterLock, req, res, url).then(() => true);
     }
     if (opts.capture && url.pathname === '/__pyric/capture') {
       return handleCapture(opts.capture, req, res).then(() => true);
@@ -498,18 +444,44 @@ export function createPyricNamespace(opts: NamespaceOptions) {
       return handleActivity(opts.activity, req, res, activityToken!).then(() => true);
     }
     if (opts.events && url.pathname === '/__pyric/events') {
+      const hostHeader = getHeader(req, 'host');
+      const originHeader = getHeader(req, 'origin');
+      if (!isAllowedHost(hostHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+        res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: host not allowed');
+        return true;
+      }
+      if (originHeader && !isAllowedOrigin(originHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+        res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: origin mismatch');
+        return true;
+      }
+      const reqToken = getHeader(req, 'x-pyric-session-token') ?? url.searchParams.get('token');
+      if (sessionToken && reqToken && reqToken !== sessionToken) {
+        res.writeHead(401, { 'content-type': 'text/plain' }).end('Unauthorized: invalid session capability token');
+        return true;
+      }
       opts.events.handle(req, res);
       return true;
     }
-    if (url.pathname === '/__pyric/ai-proxy' || url.pathname.startsWith('/__pyric/ai-proxy/')) {
-      return handleAiProxy(opts.aiProxyUpstream, req, res, url).then(() => true);
+    if (url.pathname === AI_PROXY_ROUTE || url.pathname.startsWith(`${AI_PROXY_ROUTE}/`)) {
+      return handleAiProxy(opts.aiProxyUpstream, denialThrottle, req, res, url, opts.logger).then(
+        () => true,
+      );
+    }
+    if (url.pathname === BEACON_PATH) {
+      return handleBeacon({ token: beaconToken, onBeacon: opts.beacon }, req, res).then(() => true);
     }
     if (url.pathname === '/__pyric/denials') {
       return handleDenials(denialThrottle, opts.logger, req, res).then(() => true);
     }
     if (url.pathname === '/__pyric/init.json') {
       res.writeHead(200, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
-      res.end(JSON.stringify({ ...opts.initPayload(), ...(activityToken ? { activityToken } : {}) }));
+      res.end(
+        JSON.stringify({
+          ...opts.initPayload(),
+          sessionToken,
+          ...(activityToken ? { activityToken } : {}),
+        }),
+      );
       return true;
     }
     if (url.pathname.startsWith('/__pyric/sdk/')) {

package/src/serve/rules.ts

@@ -56,7 +56,7 @@ export function prepareRulesSource(raw: string, sourcePath: string): string {
     const resolved = resolveModulesBrowser(raw);
     if (!resolved.success) {
       throw new Error(
-        `pyric dev: ${sourcePath} uses 2+modules but module resolution failed: ${resolved.error.message}`,
+        `pyric sandbox: ${sourcePath} uses 2+modules but module resolution failed: ${resolved.error.message}`,
       );
     }
     source = resolved.data.resolved;
@@ -65,13 +65,13 @@ export function prepareRulesSource(raw: string, sourcePath: string): string {
   if (lint.parseError) {
     const { line, column } = lint.parseError;
     throw new Error(
-      `pyric dev: ${sourcePath} failed to parse (line ${line}, col ${column}) — fix the rules before serving.`,
+      `pyric sandbox: ${sourcePath} failed to parse (line ${line}, col ${column}). Fix the rules before serving.`,
     );
   }
   const errors = lint.warnings.filter((w) => w.severity === 'error');
   if (errors.length > 0) {
     throw new Error(
-      `pyric dev: ${sourcePath} has ${errors.length} rules error(s):\n` +
+      `pyric sandbox: ${sourcePath} has ${errors.length} rules error(s):\n` +
         errors.map((e) => `  - ${e.message}`).join('\n'),
     );
   }
@@ -98,7 +98,7 @@ export async function loadProjectRules(
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
       if (configured) {
-        throw new Error(`pyric dev: firebase.json points firestore.rules at ${path}, but it does not exist.`);
+        throw new Error(`pyric sandbox: firebase.json points firestore.rules at ${path}, but it does not exist.`);
       }
       return { rules: null, rulesHash: null, sourcePath: null };
     }
@@ -119,7 +119,7 @@ export function prepareStorageRulesSource(raw: string, sourcePath: string): stri
     const resolved = resolveModulesBrowser(raw, { sourceFile: sourcePath });
     if (!resolved.success) {
       throw new Error(
-        `pyric dev: ${sourcePath} uses 2+modules but module resolution failed: ${resolved.error.message}`,
+        `pyric sandbox: ${sourcePath} uses 2+modules but module resolution failed: ${resolved.error.message}`,
       );
     }
     source = resolved.data.resolved;
@@ -128,7 +128,7 @@ export function prepareStorageRulesSource(raw: string, sourcePath: string): stri
     parseStorageRules(source);
   } catch (e) {
     throw new Error(
-      `pyric dev: ${sourcePath} failed to parse: ${e instanceof Error ? e.message : String(e)} — fix the rules before serving.`,
+      `pyric sandbox: ${sourcePath} failed to parse: ${e instanceof Error ? e.message : String(e)}. Fix the rules before serving.`,
     );
   }
   return source;
@@ -159,7 +159,7 @@ export async function loadProjectStorageRules(
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
       if (configured) {
-        throw new Error(`pyric dev: firebase.json points storage.rules at ${path}, but it does not exist.`);
+        throw new Error(`pyric sandbox: firebase.json points storage.rules at ${path}, but it does not exist.`);
       }
       return { rules: null, rulesHash: null, sourcePath: null };
     }
@@ -169,27 +169,52 @@ export async function loadProjectStorageRules(
   return { rules, rulesHash: rulesHashOf(rules), sourcePath: path };
 }
 
+function normalizeDatabaseEntries(block: unknown): Array<Record<string, unknown>> {
+  if (!block) {
+    return [];
+  }
+  if (Array.isArray(block)) {
+    return block.filter((item): item is Record<string, unknown> => typeof item === 'object' && item !== null);
+  }
+  if (typeof block === 'object' && block !== null) {
+    return [block as Record<string, unknown>];
+  }
+  return [];
+}
+
+function hasConfiguredRules(entry: Record<string, unknown>): entry is Record<string, unknown> & { rules: string } {
+  return typeof entry.rules === 'string';
+}
+
+function hasConfiguredUrl(entry: Record<string, unknown>): entry is Record<string, unknown> & { url: string } {
+  return typeof entry.url === 'string';
+}
+
 export async function loadProjectDatabaseRules(
   cwd: string,
   config: FirebaseJson | null,
 ): Promise<LoadedDatabaseRules> {
-  const configured = config?.database?.rules;
-  if (!configured) {
-    return {
-      rules: null,
-      rulesHash: null,
-      sourcePath: null,
-      databaseUrl: config?.database?.url ?? null,
-    };
-  }
-
-  const path = isAbsolute(configured) ? configured : join(cwd, configured);
+  const entries = normalizeDatabaseEntries(config?.database);
+  const configuredEntry = entries.find(hasConfiguredRules);
+  const configured = configuredEntry?.rules;
+  const rel = configured ?? 'database.rules.json';
+  const path = isAbsolute(rel) ? rel : join(cwd, rel);
+  const urlEntry = entries.find(hasConfiguredUrl);
+  const databaseUrl = urlEntry?.url ?? null;
   let raw: string;
   try {
     raw = await readFile(path, 'utf8');
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === 'ENOENT') {
-      throw new Error(`pyric dev: firebase.json points database.rules at ${path}, but it does not exist.`);
+      if (configured) {
+        throw new Error(`pyric sandbox: firebase.json points database.rules at ${path}, but it does not exist.`);
+      }
+      return {
+        rules: null,
+        rulesHash: null,
+        sourcePath: null,
+        databaseUrl,
+      };
     }
     throw e;
   }
@@ -198,18 +223,18 @@ export async function loadProjectDatabaseRules(
   try {
     parsed = JSON.parse(stripJsonComments(raw));
   } catch (e) {
-    throw new Error(`pyric dev: ${path} failed to parse as RTDB rules JSON: ${e instanceof Error ? e.message : String(e)}`);
+    throw new Error(`pyric sandbox: ${path} failed to parse as RTDB rules JSON: ${e instanceof Error ? e.message : String(e)}`);
   }
   const rules = parseRtdbRulesJson(
     parsed,
-    () => new Error(`pyric dev: ${path} must contain a top-level "rules" object.`),
+    () => new Error(`pyric sandbox: ${path} must contain a top-level "rules" object.`),
   );
 
   return {
     rules,
     rulesHash: rulesHashOf(raw),
     sourcePath: path,
-    databaseUrl: config?.database?.url ?? null,
+    databaseUrl,
   };
 }
 

package/src/serve/runtime/chip-config.ts

@@ -17,8 +17,22 @@ interface RuntimeChipDocument {
   querySelector(selector: string): { getAttribute(name: string): string | null } | null;
 }
 
+/** Read the browser-inlined chip value, preferring the `NEXT_PUBLIC_`-prefixed
+ * name (the only one Next.js is guaranteed to expose to client bundles) and
+ * falling back to the unprefixed name for other bundlers/back-compat. */
+function bundlerRuntimeChipValue(): string | undefined {
+  if (typeof process === 'undefined' || typeof process.env === 'undefined') return undefined;
+  if (typeof process.env.NEXT_PUBLIC_PYRIC_RUNTIME_CHIP === 'string') {
+    return process.env.NEXT_PUBLIC_PYRIC_RUNTIME_CHIP;
+  }
+  if (typeof process.env.PYRIC_RUNTIME_CHIP === 'string') {
+    return process.env.PYRIC_RUNTIME_CHIP;
+  }
+  return undefined;
+}
+
 function hasBundlerRuntimeChipConfig(): boolean {
-  return typeof process !== 'undefined' && typeof process.env !== 'undefined' && typeof process.env.PYRIC_RUNTIME_CHIP === 'string';
+  return bundlerRuntimeChipValue() !== undefined;
 }
 
 /** Read plugin-authored values from DOM metadata or bundler environment variables, defaulting to collapsed UI when omitted. */
@@ -31,7 +45,7 @@ export function readPyricRuntimeChipConfig(
 
   const shouldFallbackToEnv = !hasMetaTag && hasBundlerRuntimeChipConfig();
   if (shouldFallbackToEnv) {
-    value = process.env.PYRIC_RUNTIME_CHIP as string;
+    value = bundlerRuntimeChipValue() as string;
   }
   if (value === 'off') {
     return null;