@pyric/cli 0.1.0-alpha.19 → 0.1.0-alpha.21

package/src/serve/studio/routes.ts

@@ -33,12 +33,22 @@ import type {
   WorkspaceChange,
   WorkspaceStore,
 } from './store-types.js';
+import { isAllowedHost, isAllowedOrigin, getHeader } from '../server.js';
+import type { WriterLock } from '../writer-lock.js';
 
 export interface StudioRouteOptions {
   /** The single-project file tree served at `/__pyric/workspace`. */
   workspace?: WorkspaceStore;
   /** The project list served at `/__pyric/projects`. */
   projects?: ProjectStore;
+  /** Per-boot session capability token required on workspace & project endpoints. */
+  sessionToken?: string;
+  /** Single-writer lock validator for file mutation & deletion endpoints. */
+  writerLock?: WriterLock;
+  /** Bound host for DNS rebinding guard. */
+  boundHost?: string;
+  /** Extra hostnames allowed for DNS rebinding/origin guard. */
+  allowedHosts?: string[];
 }
 
 /** Collect the raw request body as a UTF-8 string. */
@@ -207,6 +217,10 @@ async function handleProjects(
     .end('method not allowed');
 }
 
+function isWorkspaceMutation(method?: string): boolean {
+  return method === 'PUT' || method === 'POST' || method === 'PATCH' || method === 'DELETE';
+}
+
 /**
  * Build a namespace fragment for the Studio storage routes. Returns a handler
  * shaped like the other `/__pyric/*` fragments: it resolves `true` when it
@@ -219,13 +233,55 @@ export function createStudioRoutes(opts: StudioRouteOptions) {
     url: URL,
   ): Promise<boolean> => {
     try {
-      if (opts.workspace && url.pathname.startsWith('/__pyric/workspace')) {
-        await handleWorkspace(opts.workspace, req, res, url);
-        return true;
-      }
-      if (opts.projects && url.pathname.startsWith('/__pyric/projects')) {
-        await handleProjects(opts.projects, req, res, url);
-        return true;
+      const isWorkspaceRoute = opts.workspace && url.pathname.startsWith('/__pyric/workspace');
+      const isProjectsRoute = opts.projects && url.pathname.startsWith('/__pyric/projects');
+
+      if (isWorkspaceRoute || isProjectsRoute) {
+        const hostHeader = getHeader(req, 'host');
+        const originHeader = getHeader(req, 'origin');
+
+        // 1. Host and Origin guard (Requirement 1)
+        if (!isAllowedHost(hostHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+          res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: host not allowed');
+          return true;
+        }
+        if (originHeader && !isAllowedOrigin(originHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
+          res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: origin mismatch');
+          return true;
+        }
+
+        // 2. Per-boot session capability token guard (Requirement 2)
+        if (opts.sessionToken) {
+          const reqToken =
+            getHeader(req, 'x-pyric-session-token') ??
+            url.searchParams.get('token');
+          if (!reqToken || reqToken !== opts.sessionToken) {
+            res.writeHead(401, { 'content-type': 'text/plain' }).end('Unauthorized: invalid session capability token');
+            return true;
+          }
+        }
+
+        // 3. Single-writer lock guard for mutation endpoints (Requirement 4)
+        if (opts.writerLock && isWorkspaceMutation(req.method)) {
+          const writerId = getHeader(req, 'x-pyric-writer');
+          if (!writerId) {
+            res.writeHead(423, { 'content-type': 'text/plain' }).end('Locked: missing active writer lock header');
+            return true;
+          }
+          if (!opts.writerLock.claim(writerId, Date.now())) {
+            res.writeHead(423, { 'content-type': 'text/plain' }).end('Locked: another tab holds the writer lock');
+            return true;
+          }
+        }
+
+        if (isWorkspaceRoute) {
+          await handleWorkspace(opts.workspace!, req, res, url);
+          return true;
+        }
+        if (isProjectsRoute) {
+          await handleProjects(opts.projects!, req, res, url);
+          return true;
+        }
       }
     } catch (e) {
       if (!res.headersSent) sendError(res, e);

package/src/serve/vite-ai-config.ts

@@ -44,7 +44,18 @@ export function loadViteAiEnv(
   const resolvedEnvDir = envDir === undefined
     ? resolvedRoot
     : path.resolve(resolvedRoot, envDir);
-  return loadEnv(mode, resolvedEnvDir, '');
+  const loaded = loadEnv(mode, resolvedEnvDir, '');
+  for (const [key, val] of Object.entries(loaded)) {
+    const isAuthKey =
+      key === 'GEMINI_API_KEY' ||
+      key === 'GOOGLE_GENAI_API_KEY' ||
+      key === 'VITE_GEMINI_API_KEY' ||
+      key === 'PYRIC_API_KEY';
+    if (isAuthKey && process.env[key] === undefined) {
+      process.env[key] = val;
+    }
+  }
+  return loaded;
 }
 
 /** Convert a public declarative engine into the JSON-safe worker wire shape. */
@@ -65,6 +76,21 @@ export function engineConfigToWire(engine: PyricAiEngineConfig): AiEngineConfigW
     }
     return result as AiEngineConfigWire;
   }
+  const isGeminiEngine = engine.kind === 'gemini';
+  if (isGeminiEngine) {
+    const result: Record<string, unknown> = {
+      kind: 'gemini',
+    };
+    const hasBaseUrl = engine.baseUrl !== undefined;
+    if (hasBaseUrl) {
+      result.baseUrl = engine.baseUrl;
+    }
+    const hasApiKey = engine.apiKey !== undefined;
+    if (hasApiKey) {
+      result.apiKey = engine.apiKey;
+    }
+    return result as AiEngineConfigWire;
+  }
   const result: Record<string, unknown> = {
     kind: 'scripted',
   };
@@ -123,12 +149,16 @@ export function resolveViteAiConfig(
   }
 
   let engineWire: AiEngineConfigWire | undefined = undefined;
-  if (!isProductionMode) {
-    if (explicitEngine !== undefined) {
-      engineWire = engineConfigToWire(explicitEngine);
-    } else if (model !== undefined) {
-      engineWire = engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model });
-    }
+  if (isProductionMode) {
+    const apiKey = env.GEMINI_API_KEY ?? env.GOOGLE_GENAI_API_KEY ?? env.VITE_GEMINI_API_KEY;
+    engineWire = {
+      kind: 'gemini',
+      ...(apiKey !== undefined && apiKey.trim() !== '' ? { apiKey: apiKey.trim() } : {}),
+    };
+  } else if (explicitEngine !== undefined) {
+    engineWire = engineConfigToWire(explicitEngine);
+  } else if (model !== undefined) {
+    engineWire = engineConfigToWire({ kind: 'openai', baseUrl: AI_PROXY_PATH, model });
   }
 
   let proxyUpstream: string | undefined = undefined;

package/src/serve/vite-module-swap.ts

@@ -86,20 +86,6 @@ export function createViteModuleSwap(
 
         const match = FIREBASE_SPECIFIER.exec(args.path);
         const subpath = match !== null && match[1] !== undefined ? match[1] : '';
-        const isProductionAiMode = aiMode() === 'production';
-        if (isProductionAiMode) {
-          const isAiSubpath = subpath === 'ai';
-          if (isAiSubpath) {
-            return null;
-          }
-          const isAppSubpath = subpath === 'app';
-          const passthroughEntry = entries['app-ai-passthrough'];
-          const hasPassthroughEntry = passthroughEntry !== undefined;
-          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
-          if (shouldUsePassthroughBridge) {
-            return { path: passthroughEntry };
-          }
-        }
 
         const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
         if (isServedSubpath) {
@@ -173,20 +159,6 @@ export function createViteModuleSwap(
       const isFirebaseSpecifier = firebaseMatch !== null;
       if (isFirebaseSpecifier) {
         const subpath = firebaseMatch[1] !== undefined ? firebaseMatch[1] : '';
-        const isProductionAiMode = aiMode() === 'production';
-        if (isProductionAiMode) {
-          const isAiSubpath = subpath === 'ai';
-          if (isAiSubpath) {
-            return null;
-          }
-          const isAppSubpath = subpath === 'app';
-          const passthroughEntry = entries['app-ai-passthrough'];
-          const hasPassthroughEntry = passthroughEntry !== undefined;
-          const shouldUsePassthroughBridge = isAppSubpath && hasPassthroughEntry;
-          if (shouldUsePassthroughBridge) {
-            return passthroughEntry;
-          }
-        }
         const isServedSubpath = SERVED_FIREBASE_SUBPATHS.has(subpath);
         if (isServedSubpath) {
           const key = entryKey(subpath);

package/src/serve/vite-plugin.ts

@@ -1,18 +1,18 @@
 /**
  * `@pyric/cli/vite` — the firebase→pyric-sandbox swap as a Vite plugin.
  *
- * The serve analog for SOURCE-driven apps: instead of `vite build && pyric dev
+ * The serve analog for SOURCE-driven apps: instead of `vite build && pyric sandbox
  * dist`, a team keeps `vite dev` (HMR, source maps) with the in-process sandbox
  * standing in for Firebase. The app's `firebase/*` imports are UNCHANGED — the
  * plugin swaps them at the module-resolution layer (`resolveId`), the same way
- * `pyric dev` swaps via a runtime import map. (Design: `plans/pyric-vite-plugin.md`.)
+ * `pyric sandbox` swaps via a runtime import map. (Design: `plans/pyric-vite-plugin.md`.)
  *
  * Two flavors, one `apply` function. Under `vite dev` the swap is ALWAYS on.
  * For `vite build` the swap is MODE-gated: a plain `vite build` (mode
  * `production`) ships the real `firebase` package — the swap never reaches the
  * prod artifact — while `vite build --mode development` (any NON-production
  * mode) produces a SANDBOX build that bundles pyric's in-page adapters instead
- * of the real SDK: self-contained, meant to be previewed under `pyric dev`, and
+ * of the real SDK: self-contained, meant to be previewed under `pyric sandbox`, and
  * stamped with the sandbox-build marker so it can never be deployed (`pyric
  * deploy hosting` refuses it). `pyric({ swapInBuild })` forces the build
  * behavior on/off regardless of mode. See `sandbox-marker.ts`.
@@ -24,11 +24,11 @@
  *   - the host-neutral sandbox session — rules, fixtures, stores, live payload,
  *     Studio routes, `/__pyric/*` namespace, and owned cleanup;
  *   - the SharedWorker host — `bundleWorker` served at `/__pyric/sdk/worker.js`;
- *   - the bridge mount shared with `pyric dev --bridge`.
+ *   - the bridge mount shared with `pyric sandbox --bridge`.
  *
  * Scope = M1 (swap + rules) + M2 (SharedWorker multi-tab + persist/capture/seed)
  * + M3 (the MCP bridge fold — `{ bridge }`). M3 reuses `createBridgeMount` (the
- * proven serve-flavored bridge behind `pyric dev --bridge`), composing it into
+ * proven serve-flavored bridge behind `pyric sandbox --bridge`), composing it into
  * the same `/__pyric` middleware; on the worker path the bridge peer routes
  * agent tool-calls THROUGH the SharedWorker (`connectBridgePeer`), so the agent
  * and the app share one backend without forcing the page in-page.
@@ -82,7 +82,7 @@ export interface PyricOptions {
    *  only when the worker bundle itself fails, bridge or not. */
   bridge?: boolean | { project?: string; disableAuditLog?: boolean };
   /** Serve the **Pyric Studio** app at `/__pyric/ui/` on Vite's dev origin (the
-   *  `pyric dev --ui` equivalent). Mounts the disk-backed workspace/project
+   *  `pyric sandbox --ui` equivalent). Mounts the disk-backed workspace/project
    *  routes Studio's `local` mode talks to AND serves the unified Astro site
    *  (vendored in this package at `dist/serve/site-ui`). **On by default**,
    *  including under `bridge` (the bridge peer routes through the SharedWorker,
@@ -93,7 +93,7 @@ export interface PyricOptions {
    *  dev/builds. On by default. Pass `false` to hide it, or
    *  `{ initiallyOpen: true }` when actively debugging runtime errors. */
   runtimeChip?: PyricRuntimeChipOption;
-  /** RTDB-triggered Cloud Functions under this dev server (the `pyric dev`
+  /** RTDB-triggered Cloud Functions under this dev server (the `pyric sandbox`
    *  parity fold). By default a `functions` block in `firebase.json` is
    *  discovered automatically: its `onValueCreated` triggers run in an isolated
    *  node child against the shared sandbox (other trigger kinds warn and are
@@ -216,7 +216,7 @@ export function pyric(options: PyricOptions = {}): Plugin {
     // `vite build` keeps the real firebase package — the swap never reaches
     // production output. A sandbox build applies the same swap so the output
     // bundles pyric's in-page adapters (self-contained; preview it under
-    // `pyric dev`, never deploy it).
+    // `pyric sandbox`, never deploy it).
     apply(config, env) {
       void config;
       return pageRuntime.applies(env);

package/src/serve/vite-sandbox-generation.ts

@@ -1,12 +1,13 @@
 import { existsSync } from 'node:fs';
 import type { ViteDevServer } from 'vite';
 import { readFirebaseJson, readFirebaseRc, type FirebaseJson } from '../cli/firebase-json.js';
-import { registerModuleUrl } from '../cli/dev-runner.js';
+import { registerModuleUrl } from '../cli/sandbox-runner.js';
 import {
   discoverFunctionsRtdbProject,
   type FunctionsRtdbProject,
 } from '../functions-rtdb/project.js';
 import { formatActivityWarning } from './activity-warning.js';
+import { formatAiStatusNote } from './ai-status.js';
 import {
   createBridgeMount,
   type BridgeHostAttachment,
@@ -217,6 +218,20 @@ export async function createViteSandboxGeneration(
       server.config.logger.info('  ⓘ [pyric] fresh: discarded the existing state file; re-seeding');
     }
 
+    // Say what AI resolved to. This is the one front door where the engine and
+    // its model binding ARE known at boot (`ai.engine` / `ai.model` reduced to
+    // the wire shape above); the broker itself is still built lazily, in the
+    // page or the worker, on the first `ai.*` op. Every generation prints it,
+    // so a Vite restart on an `.env`/config edit re-announces the new binding
+    // through the same formatter instead of swapping engines in silence.
+    server.config.logger.info(
+      formatAiStatusNote({
+        engine: ai.engineWire,
+        mode: ai.mode,
+        proxyUpstream: ai.proxyUpstream,
+      }),
+    );
+
     const middlewareInput = { server, bridge, session };
     const disposeMiddleware = attachViteGenerationMiddleware(middlewareInput);
     listenerDisposers.push(disposeMiddleware);

package/src/serve/worker/client/auth.ts

@@ -312,7 +312,7 @@ export async function restorePortSession(
     t: 'op', id: nextId(), method: 'auth.restorePortSession', uid,
   })) as SerializedUser | null;
   const user = toClientUser(auth.port, raw);
-  if (user) auth.currentUser = user;
+  auth.currentUser = user;
   return user;
 }
 

package/src/serve/worker/client/core.ts

@@ -259,26 +259,103 @@ export function wirePort(port: ClientPort): void {
 // ops (`auth.*`) and `getVersion` are NEVER lensed — they operate the worker's
 // session, not data — so the lens is stamped only on the data-op path.
 
+export const AUTH_LENS_STORAGE_KEY = 'pyric:auth-lens';
+
+type PersistedAuthLens =
+  | Extract<AuthLens, { mode: 'admin' }>
+  | Extract<AuthLens, { mode: 'as' }>;
+
+export function isPersistedAuthLens(value: unknown): value is PersistedAuthLens {
+  if (!value || typeof value !== 'object') return false;
+  const candidate = value as { mode?: unknown; uid?: unknown };
+  if (candidate.mode === 'admin') return true;
+  return candidate.mode === 'as' && typeof candidate.uid === 'string';
+}
+
+function normalizePersistedAuthLens(value: unknown): PersistedAuthLens | undefined {
+  if (isPersistedAuthLens(value)) return value;
+  return undefined;
+}
+
+/** Read persisted auth lens from sessionStorage safely. */
+export function hydrateLensFromStorage(): AuthLens | undefined {
+  if (typeof sessionStorage === 'undefined') return undefined;
+  try {
+    const raw = sessionStorage.getItem(AUTH_LENS_STORAGE_KEY);
+    if (!raw) return undefined;
+    const parsed: unknown = JSON.parse(raw);
+    const persistedLens = normalizePersistedAuthLens(parsed);
+    if (persistedLens) return persistedLens;
+    sessionStorage.removeItem(AUTH_LENS_STORAGE_KEY);
+    return undefined;
+  } catch {
+    try {
+      sessionStorage.removeItem(AUTH_LENS_STORAGE_KEY);
+    } catch {
+      // Ignore storage restrictions
+    }
+    return undefined;
+  }
+}
+
 /** Module-level default lens. `undefined` ⇒ the worker treats the op as the
  *  app's session (the additive default — existing senders omit `actAs`).
  *
  *  Exported as a LIVE binding: family modules read it to stamp the lens onto
  *  subscriptions (`onSnapshot`, `rtdbOnValue`), and see `setLens(...)` updates
  *  through this one singleton. */
-export let _defaultLens: AuthLens | undefined;
+export let _defaultLens: AuthLens | undefined = hydrateLensFromStorage();
+
+const lensListeners = new Set<(lens: AuthLens | undefined) => void>();
+
+/**
+ * Register a listener for auth lens mutations.
+ * Returns an unsubscribe function that removes the listener.
+ */
+export function subscribeLens(listener: (lens: AuthLens | undefined) => void): () => void {
+  lensListeners.add(listener);
+  return () => {
+    lensListeners.delete(listener);
+  };
+}
 
 /**
  * Set the default auth lens applied to subsequent Firestore DATA ops from this
- * client (Pyric Studio). Pass `{ mode: 'as', uid }` to read/write AS a user
+ * client (Pyric Studio & Runtime Chip). Pass `{ mode: 'as', uid }` to read/write AS a user
  * (rules apply), `{ mode: 'admin' }` for the admin lens, or
  * `{ mode: 'app-session' }` / `undefined` to revert to the app's own session.
  *
  * The lens is process-wide for this client module (one served page = one
  * worker port), mirroring how Studio drives a single active identity at a time.
  * Auth ops are unaffected — they always operate the real session.
+ *
+ * Persists active admin and impersonation lenses to sessionStorage under
+ * AUTH_LENS_STORAGE_KEY, and removes the key when cleared or reverted to the
+ * app session.
+ * Notifies all registered subscribeLens listeners.
  */
 export function setLens(lens: AuthLens | undefined): void {
-  _defaultLens = lens && lens.mode === 'app-session' ? undefined : lens;
+  _defaultLens = normalizePersistedAuthLens(lens);
+
+  if (typeof sessionStorage !== 'undefined') {
+    try {
+      if (_defaultLens) {
+        sessionStorage.setItem(AUTH_LENS_STORAGE_KEY, JSON.stringify(_defaultLens));
+      } else {
+        sessionStorage.removeItem(AUTH_LENS_STORAGE_KEY);
+      }
+    } catch {
+      // Ignore quota or disabled storage restrictions
+    }
+  }
+
+  for (const listener of [...lensListeners]) {
+    try {
+      listener(_defaultLens);
+    } catch (err) {
+      console.error('Error in subscribeLens listener:', err);
+    }
+  }
 }
 
 /** The active default lens (read-only view), for Studio UI to reflect state. */

package/src/serve/worker/client/disconnect.ts

@@ -15,7 +15,7 @@ function deleteTimeoutError(): Error & { code: string } {
   return Object.assign(
     new Error(
       'Timed out waiting for SharedWorker app cleanup acknowledgment. ' +
-      'Close all tabs using this pyric dev origin so the worker can restart.',
+      'Close all tabs using this pyric sandbox origin so the worker can restart.',
     ),
     { code: 'app/delete-timeout' },
   );

package/src/serve/worker/client/presence.ts

@@ -25,9 +25,29 @@ import type { ClientDb, Unsubscribe } from './handles.js';
 export type { PresenceClientKind, PresenceSnapshot, PresenceVisibility };
 export { PRESENCE_HEARTBEAT_INTERVAL_MS, PRESENCE_STALE_MS };
 
+function supportsRandomUUID(): boolean {
+  return typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function';
+}
+
+function supportsDocumentEventListeners(): boolean {
+  return (
+    typeof document !== 'undefined' &&
+    typeof document.addEventListener === 'function' &&
+    typeof document.removeEventListener === 'function'
+  );
+}
+
+function supportsWindowEventListeners(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    typeof window.addEventListener === 'function' &&
+    typeof window.removeEventListener === 'function'
+  );
+}
+
 /** Mint a random client id (page-lifetime). */
 export function mintPresenceClientId(): string {
-  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
+  if (supportsRandomUUID()) {
     return crypto.randomUUID();
   }
   return `page-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
@@ -114,10 +134,10 @@ export function startPresence(opts: StartPresenceOptions): PresenceSession {
 
   register();
 
-  if (typeof document !== 'undefined') {
+  if (supportsDocumentEventListeners()) {
     document.addEventListener('visibilitychange', update);
   }
-  if (typeof window !== 'undefined') {
+  if (supportsWindowEventListeners()) {
     window.addEventListener('popstate', update);
     window.addEventListener('hashchange', update);
     // Best-effort clean disconnect; lease expiry covers unclean shutdown.
@@ -139,10 +159,10 @@ export function startPresence(opts: StartPresenceOptions): PresenceSession {
       clearInterval(timer);
       timer = null;
     }
-    if (typeof document !== 'undefined') {
+    if (supportsDocumentEventListeners()) {
       document.removeEventListener('visibilitychange', update);
     }
-    if (typeof window !== 'undefined') {
+    if (supportsWindowEventListeners()) {
       window.removeEventListener('popstate', update);
       window.removeEventListener('hashchange', update);
       window.removeEventListener('pagehide', onPageHide);

package/src/serve/worker/client.ts

@@ -26,7 +26,7 @@
  */
 
 // Shared core: lens/issuer controls + the handle and snapshot types.
-export { setLens, getLens, setOpIssuer } from './client/core.js';
+export { setLens, getLens, subscribeLens, AUTH_LENS_STORAGE_KEY, hydrateLensFromStorage, setOpIssuer } from './client/core.js';
 export type {
   ClientDb,
   ClientRtdb,

package/src/serve/worker/context-resolver.ts

@@ -0,0 +1,60 @@
+/**
+ * SharedWorker context resolver.
+ *
+ * Coordinates asynchronous initialization of a singleton resource across
+ * concurrent inbound connection requests or burst messages.
+ *
+ * Invariants:
+ * 1. Single In-Flight Attempt: When multiple callers request the context
+ *    concurrently while initialization is in flight, all callers share the
+ *    single in-flight promise rather than starting parallel initializations.
+ * 2. Unpoisoned on Rejection: If initialization rejects, the memoized promise
+ *    is cleared immediately, allowing subsequent requests to retry initialization
+ *    rather than permanently caching the rejection.
+ * 3. Synchronous Retrieval: Once successfully resolved, the resource is
+ *    available synchronously for shutdown and cleanup handlers.
+ */
+
+export interface ContextResolver<T> {
+  /**
+   * Return the resolved resource or the in-flight initialization promise.
+   * If a previous attempt rejected, starts a new attempt.
+   */
+  get(): Promise<T>;
+
+  /**
+   * Return the successfully resolved resource, or null if not yet resolved
+   * or currently in-flight.
+   */
+  current(): T | null;
+}
+
+export function createContextResolver<T>(factory: () => Promise<T>): ContextResolver<T> {
+  let value: T | null = null;
+  let inFlight: Promise<T> | null = null;
+
+  return {
+    async get(): Promise<T> {
+      if (value !== null) {
+        return value;
+      }
+      if (inFlight === null) {
+        inFlight = factory()
+          .then((resolved) => {
+            value = resolved;
+            return resolved;
+          })
+          .catch((error: unknown) => {
+            inFlight = null;
+            value = null;
+            throw error;
+          });
+      }
+      return inFlight;
+    },
+
+    current(): T | null {
+      return value;
+    },
+  };
+}

package/src/serve/worker/entry.ts

@@ -67,36 +67,33 @@ import {
 } from './service-worker-channel.js';
 import { createServiceWorkerRelay } from './service-worker-relay.js';
 import { createWorkerRetirement } from './retirement.js';
+import { createContextResolver } from './context-resolver.js';
+import { createPortLifecycleManager } from './port-lifecycle.js';
 
 declare const __PYRIC_WORKER_VERSION__: string;
 const workerEpoch = typeof __PYRIC_WORKER_VERSION__ !== 'undefined'
   ? __PYRIC_WORKER_VERSION__
   : 'dev';
 const workerScope = self as unknown as SharedWorkerGlobalScope;
+const contextResolver = createContextResolver(buildCtx);
+const portLifecycle = createPortLifecycleManager();
 const retirement = createWorkerRetirement({
   closeWorker: () => workerScope.close(),
-  beforeAnnounce: async () => { await _ctx?.captureFlush?.(); },
+  beforeAnnounce: async () => { await contextResolver.current()?.captureFlush?.(); },
 });
 
 // ─── Singleton context ────────────────────────────────────────────────────
 
-// `_ctx` is the RESOLVED context, kept for the synchronous `close` handler.
-// The build is memoized as a PROMISE (`_ctxPromise`) — NOT as the resolved
-// value — because init is async (it awaits `/__pyric/init.json` + persistence
-// restore). The first messages arrive in a BURST (the authState sub, the first
-// firestore sub, an op — possibly across two tabs at once); if each re-checked
-// only the resolved `_ctx` they would every one start a fresh init and build a
-// SEPARATE sandbox, so a listener and a write could bind to different
-// instances and never see each other. The promise memo guarantees ONE init.
-let _ctx: HostCtx | null = null;
-let _ctxPromise: Promise<HostCtx> | null = null;
-
 /**
  * Return the shared context, memoizing the in-flight init promise so
- * concurrent first messages await ONE build (see `_ctxPromise` above).
+ * concurrent first messages await ONE build. If initialization rejects,
+ * the rejection is cleared so subsequent connection attempts can retry.
+ * Any ports that closed while initialization was in flight are drained immediately.
  */
-function getCtx(): Promise<HostCtx> {
-  return (_ctxPromise ??= buildCtx());
+async function getCtx(): Promise<HostCtx> {
+  const ctx = await contextResolver.get();
+  portLifecycle.drainClosedPorts(ctx);
+  return ctx;
 }
 
 /**
@@ -125,7 +122,6 @@ async function buildCtx(): Promise<HostCtx> {
         ? (url) => new EventSource(url) as unknown as EventSourceLike
         : null,
   });
-  _ctx = ctx; // publish the resolved ctx for the synchronous close handler
   return ctx;
 }
 
@@ -141,6 +137,7 @@ workerScope.onconnect = (e: MessageEvent) => {
   const port = e.ports[0];
   port.start();
   retirement.connect(port);
+  void getCtx().catch(() => undefined);
 
   let messageQueue = Promise.resolve();
   port.onmessage = (ev: MessageEvent<InboundMessage>) => {
@@ -172,9 +169,16 @@ workerScope.onconnect = (e: MessageEvent) => {
     // cannot overtake an already-posted mutation, and later frames see the
     // disconnected-port tombstone instead of touching the shared backend.
     messageQueue = messageQueue.then(async () => {
+      const portLike = port as unknown as PortLike;
+      if (portLifecycle.isPortClosed(portLike)) {
+        return;
+      }
       try {
         const ctx = await getCtx();
-        await handleMessage(ctx, port as unknown as PortLike, ev.data);
+        if (portLifecycle.isPortClosed(portLike)) {
+          return;
+        }
+        await handleMessage(ctx, portLike, ev.data);
       } catch (e) {
         // eslint-disable-next-line no-console
         console.error('[pyric worker] message handler error:', (e as Error)?.stack ?? e, 'msg:', ev.data);
@@ -188,7 +192,7 @@ workerScope.onconnect = (e: MessageEvent) => {
   // best-effort; subscriptions also GC when the worker itself dies.
   port.addEventListener('close', () => {
     retirement.disconnect(port);
-    if (_ctx) void cleanupPortWithDisconnect(_ctx, port as unknown as PortLike).catch(() => undefined);
+    portLifecycle.onPortClosed(port as unknown as PortLike, contextResolver.current());
   });
 };