@pyric/cli 0.1.0-alpha.30.1 → 0.1.0-alpha.31

package/src/serve/entries/worker-runtime.ts

@@ -13,9 +13,10 @@ import type { HostedConnectionState } from '../worker/client/websocket-connectio
 import { getServiceWorkerFirestore } from '../worker/client/service-worker-connection.js';
 import { getDeferredFirestore } from '../worker/client/deferred-connection.js';
 import { getHostedFirestore } from '../worker/client/websocket-connection.js';
-import { currentHostInstanceId, currentSessionToken, forgetSessionToken, initPayload } from './init-payload.js';
+import { currentHostInstanceId, currentHostPayload, currentSessionToken, forgetSessionToken, initPayload } from './init-payload.js';
 import type { WorkerInitPayload } from '../init-payload.js';
 import { toPageOriginWsUrl } from './bridge-url.js';
+import { movedSocketUrl, type AttachedHost } from './moved-host.js';
 import { hostLocation, nodeRuntimeOrigin, type NodeRuntimeOrigin } from './runtime-origin.js';
 import { isServiceWorkerRealm } from '../worker/service-worker-channel.js';
 import {
@@ -61,7 +62,10 @@ function hostedTarget(node?: { host: string; origin: NodeRuntimeOrigin }): Param
       runtimeStatus.setHostedConnection(state);
       // A host that returns may be a new boot with its own session token.
       const lostHost = state === 'interrupted';
-      if (lostHost) forgetSessionToken();
+      if (!lostHost) return;
+      forgetSessionToken();
+      // A Node process finds the host again: it may have come back on another port.
+      node?.origin.forgetHost?.();
     },
     onError: error => runtimeStatus.reportError(error, 'worker'),
     // The worker selection stamped into the page carries no session token; init.json does.
@@ -74,9 +78,18 @@ function hostedTarget(node?: { host: string; origin: NodeRuntimeOrigin }): Param
       : payload?.instanceId,
     // After a host restart, a Node process reads the new boot's id before it reattaches.
     currentHostInstanceId: node === undefined ? undefined : currentHostInstanceId,
+    // A Node process redials the host where it runs now, which `.pyric/serve.json` names.
+    // Its socket path comes from the moved host's own init.json, read for this reattach.
+    currentUrl: node === undefined ? undefined : () => currentSocketUrl(node.origin, { projectKey, bridgeUrl }),
   };
 }
 
+/** Where a Node process's socket goes on the host serving now, from that host's own `init.json`. */
+async function currentSocketUrl(origin: NodeRuntimeOrigin, attached: AttachedHost): Promise<string> {
+  const current = await currentHostPayload();
+  return movedSocketUrl(current, await origin.host(), attached);
+}
+
 export const WORKER_URL = PYRIC_WORKER_URL;
 let epochStorage: Storage | undefined;
 try {
@@ -232,13 +245,13 @@ function initialize(configuration: WorkerInitPayload | null): void {
           const pageSuffix = hasOneOtherPage ? '' : 's';
           othersHint = ` ${otherPages} other page${pageSuffix} must disconnect before the worker can restart.`;
         } else if (isOnlyPage) {
-          othersHint = ' This is the only connected page — reload it to pick up the new worker.';
+          othersHint = ' This is the only connected page, so reloading it picks up the new worker.';
         }
         console.warn(
           `[pyric sandbox] the SharedWorker is running older code (build ${runningVersion}) than what is now `
-            + `served (build ${servedVersion}). A SharedWorker can't hot-update — CLOSE ALL TABS of this origin `
-            + 'and reopen to load the new worker. (All tabs share one worker, so a partial reload leaves '
-            + `the old code running for everyone.)${othersHint}`,
+            + `served (build ${servedVersion}). A SharedWorker can't update while it runs. Close every tab of this `
+            + 'origin, then reopen one to load the new worker. All tabs share one worker, so reloading only some '
+            + `of them leaves the old code running for all of them.${othersHint}`,
         );
       })
       .catch((error) => runtimeStatus.reportError(error, 'worker'));

package/src/serve/firebase-module-swap.ts

@@ -92,6 +92,77 @@ export const REAL_SDK_ENTRIES: ReadonlyMap<ServedFirebaseSpecifier, string> = ne
   ['firebase/app-check', 'firebase-sdk-app-check'],
 ]);
 
+/**
+ * The `@firebase/*` packages the real AI SDK and the passthrough's
+ * `firebase/app` and `firebase/app-check` import, which a server runner can
+ * reach by file URL (Vite's module runner does).
+ */
+const PRODUCTION_AI_SDK_PACKAGES: ReadonlySet<string> = new Set([
+  '@firebase/ai',
+  '@firebase/app',
+  '@firebase/app-check',
+  '@firebase/app-check-interop-types',
+  '@firebase/component',
+  '@firebase/logger',
+  '@firebase/util',
+]);
+
+/**
+ * The firebase-admin files the App Check verifier bridge's
+ * `firebase-admin/app` and `firebase-admin/app-check` load, by path inside the
+ * package. Traced from a `verifyToken` run of the built bridge against
+ * firebase-admin 13.10.0: the ESM wrappers, `lib/app/`, `lib/app-check/`,
+ * `lib/utils/` and the manifest `lib/utils/index.js` reads for the version.
+ * A firebase-admin release that reaches further fails closed: the stop fires
+ * and the `ai-production-app-check` scenario shows it.
+ */
+const ADMIN_BRIDGE_FILES: readonly string[] = [
+  'package.json',
+  'lib/esm/app/',
+  'lib/esm/app-check/',
+  'lib/app/',
+  'lib/app-check/',
+  'lib/utils/',
+];
+
+/** Whether a path inside a package is `entry`, or lies under it when `entry` is a folder (ends in `/`). */
+function isUnderEntry(pathInPackage: string, entry: string): boolean {
+  const isFolder = entry.endsWith('/');
+  if (isFolder) return pathInPackage.startsWith(entry);
+  return pathInPackage === entry;
+}
+
+/** Whether a firebase-admin file, by its path inside the package, is one the verifier bridge's pair loads. */
+export function isAdminBridgeFile(pathInPackage: string | null): boolean {
+  if (pathInPackage === null) return false;
+  return ADMIN_BRIDGE_FILES.some((entry) => isUnderEntry(pathInPackage, entry));
+}
+
+/** Whether a client SDK package is one that `firebase/ai`, `firebase/app` and `firebase/app-check` import. */
+export function isProductionAiSdkPackage(packageName: string): boolean {
+  return PRODUCTION_AI_SDK_PACKAGES.has(packageName);
+}
+
+/** The `firebase` package's own folders for the {@link REAL_SDK_ENTRIES}: `ai`, `app` and `app-check`. */
+const PRODUCTION_AI_FIREBASE_FOLDERS: ReadonlySet<string> = new Set(
+  [...REAL_SDK_ENTRIES.keys()].map((specifier) => specifier.slice('firebase/'.length)),
+);
+
+/**
+ * Whether production AI mode lets a file of the real Firebase SDK load, from
+ * any importer: a `firebase` file under `ai/`, `app/` or `app-check/` (the
+ * {@link REAL_SDK_ENTRIES}), or a file of the `@firebase/*` packages those
+ * import. Every other file of the client SDK is swapped or stopped, as in
+ * sandbox mode. `pathInPackage` is the file's path inside its package, read
+ * only for `firebase`.
+ */
+export function isProductionAiSdkFile(packageName: string, pathInPackage: () => string | null): boolean {
+  if (isProductionAiSdkPackage(packageName)) return true;
+  if (packageName !== 'firebase') return false;
+  const folder = pathInPackage()?.split('/')[0];
+  return folder !== undefined && PRODUCTION_AI_FIREBASE_FOLDERS.has(folder);
+}
+
 /**
  * The import-map plane's specifier to entry key table: the swap, plus, in
  * production AI mode, the unswapped `firebase/ai` sent to the Firebase SDK
@@ -121,12 +192,22 @@ const PACKAGE_ROOTS: readonly string[] = (() => {
 /** The shadow-app wrappers, relative to the package root. */
 const SHADOW_MODULE = /^(?:dist|src)\/(?:register\/(?:client\/)?app-bridge[^/]*|serve\/entries\/app-ai-passthrough[^/]*)$/;
 
+/** The register's App Check verifier for production AI mode, relative to the package root. */
+const ADMIN_BRIDGE_MODULE = /^(?:dist|src)\/register\/app-bridge-admin-app-check\.(?:js|ts)$/;
+
 function importerFile(importer: string): string {
   const withoutQuery = importer.replace(/[?#].*$/, '');
   const path = withoutQuery.startsWith('file://') ? fileURLToPath(withoutQuery) : withoutQuery;
   return path.replaceAll('\\', '/');
 }
 
+/** Whether an importer is one of this package's own modules whose path, relative to the package root, matches `module`. */
+function isPackageModule(importer: string | undefined, module: RegExp): boolean {
+  if (importer === undefined) return false;
+  const file = importerFile(importer);
+  return PACKAGE_ROOTS.some((root) => file.startsWith(root) && module.test(file.slice(root.length)));
+}
+
 /**
  * Whether an importer is one of this package's own modules that wrap the
  * Firebase SDK's `firebase/app` or `firebase/app-check`. Those imports must
@@ -134,26 +215,28 @@ function importerFile(importer: string): string {
  * happens to be named `app-bridge.js` is still swapped.
  */
 export function isShadowAppImporter(importer: string | undefined): boolean {
-  if (importer === undefined) return false;
-  const file = importerFile(importer);
-  return PACKAGE_ROOTS.some((root) => file.startsWith(root) && SHADOW_MODULE.test(file.slice(root.length)));
+  return isPackageModule(importer, SHADOW_MODULE);
 }
 
+/** The client SDK modules every shadow-app wrapper imports for itself. */
+const BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set(['firebase/app', 'firebase/app-check']);
+
 /**
- * The SDK modules a shadow-app wrapper imports for itself. The firebase-admin
- * pair is the register's App Check verifier for production AI mode
- * (`register/app-bridge-admin-app-check.ts`); no browser plane serves them.
+ * The firebase-admin pair that only the register's App Check verifier imports
+ * (`register/app-bridge-admin-app-check.ts`), and only in production AI mode,
+ * where the register loads it. No browser plane serves them.
  */
-const BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set([
-  'firebase/app',
-  'firebase/app-check',
-  'firebase-admin/app',
-  'firebase-admin/app-check',
-]);
+const ADMIN_BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set(['firebase-admin/app', 'firebase-admin/app-check']);
 
-/** Whether this import is a shadow-app wrapper reaching the Firebase SDK it wraps. */
-export function isBypassedBridgeImport(specifier: string, importer: string | undefined): boolean {
-  return BRIDGED_SPECIFIERS.has(specifier) && isShadowAppImporter(importer);
+/**
+ * Whether this import is a shadow-app wrapper reaching the Firebase SDK it
+ * wraps. The firebase-admin pair counts only when `aiMode` is `production`,
+ * so a plane that passes no mode never bypasses it.
+ */
+export function isBypassedBridgeImport(specifier: string, importer: string | undefined, aiMode?: AiMode): boolean {
+  if (BRIDGED_SPECIFIERS.has(specifier)) return isShadowAppImporter(importer);
+  const isAdminBridgeImport = ADMIN_BRIDGED_SPECIFIERS.has(specifier) && aiMode === 'production';
+  return isAdminBridgeImport && isPackageModule(importer, ADMIN_BRIDGE_MODULE);
 }
 
 /**

package/src/serve/gemini-proxy.ts

@@ -0,0 +1,140 @@
+/**
+ * `/__pyric/ai-proxy/gemini`: where a browser gemini engine sends (#1584).
+ *
+ * A page or SharedWorker has no server environment, and the Gemini API key
+ * must never reach it. The browser engine sends each request here with no
+ * credentials. The dev server sends it on with the gemini engine's own
+ * request code (`GeminiUpstream` from `pyric/ai/internal`): the key from the
+ * server's environment or ADC, to the server's configured base URL. A
+ * successful answer streams back unchanged. An error comes back with its
+ * status and with any credential it quotes masked, so the browser engine
+ * reads Gemini's own error and never the key. The body is bounded as the
+ * openai route's is.
+ *
+ * The browser chooses only the model and the call. The target and the
+ * credentials are the server's, so no page can send the key anywhere else.
+ * The App Check gate runs before any of this, in the broker that owns the
+ * browser engine.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { GeminiUpstream, type GeminiUpstreamOptions } from 'pyric/ai/internal';
+import { redactUpstreamError } from 'pyric/ai/internal';
+import type { ServeLogger } from './server.js';
+import { fetchAiUpstream, readAiProxyBody, relayAiUpstream, type AiDiagnosticThrottle } from './ai-proxy.js';
+import { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+import { serializeError, type AiEngineConfigWire } from './worker/protocol.js';
+
+export { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
+
+/** The server's gemini engine config: the Vite plugin's `ai.engine`, when it is gemini. */
+export interface GeminiProxyConfig {
+  baseUrl?: string;
+  apiKey?: string;
+}
+
+/** The gemini proxy's config from a configured engine, when that engine is gemini. */
+export function geminiProxyConfig(engine: AiEngineConfigWire | undefined): GeminiProxyConfig | undefined {
+  const isGemini = engine?.kind === 'gemini';
+  if (!isGemini) return undefined;
+  return {
+    ...(engine.baseUrl !== undefined ? { baseUrl: engine.baseUrl } : {}),
+    ...(engine.apiKey !== undefined ? { apiKey: engine.apiKey } : {}),
+  };
+}
+
+/** `/v1beta/models/<model>:<call>`, for the three calls the browser engine makes. */
+const GEMINI_CALL_PATH = /^\/v1beta\/(models\/[A-Za-z0-9._-]+):(generateContent|streamGenerateContent|countTokens)$/;
+
+/** The query each call may carry: only the stream asks for server-sent events. */
+const CALL_QUERY: Record<string, string> = {
+  generateContent: '',
+  countTokens: '',
+  streamGenerateContent: '?alt=sse',
+};
+
+/** Is this request for the gemini proxy (and not the OpenAI-compatible one)? */
+export function isGeminiProxyPath(pathname: string): boolean {
+  return pathname.startsWith(`${GEMINI_PROXY_PATH}/`);
+}
+
+/** The resource and the action `GeminiUpstream.send` takes, or null for anything else. */
+function geminiCall(url: URL): { resource: string; action: string } | null {
+  const match = url.pathname.slice(GEMINI_PROXY_PATH.length).match(GEMINI_CALL_PATH);
+  if (match === null) return null;
+  const [, resource, call] = match as unknown as [string, string, string];
+  const isExpectedQuery = url.search === CALL_QUERY[call];
+  if (!isExpectedQuery) return null;
+  return { resource, action: `${call}${url.search}` };
+}
+
+/** Answer with a Gemini error envelope, as the upstream would. */
+function sendEnvelope(res: ServerResponse, code: number, message: string, status: string): void {
+  res.writeHead(code, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+  res.end(JSON.stringify({ error: { code, message, status } }));
+}
+
+/**
+ * Send a non-2xx upstream answer with the credentials the request carried
+ * removed, in whatever form the upstream quotes them, and a JSON envelope
+ * kept parseable (`redactUpstreamError`, shared with the gemini engine).
+ */
+async function relayRedactedError(upstream: Response, credentials: readonly string[], res: ServerResponse): Promise<void> {
+  const text = redactUpstreamError(await upstream.text().catch(() => ''), credentials);
+  const headers: Record<string, string> = { 'cache-control': 'no-store' };
+  const contentType = upstream.headers.get('content-type');
+  if (contentType) headers['content-type'] = contentType;
+  res.writeHead(upstream.status, headers);
+  res.end(text);
+}
+
+/**
+ * The gemini proxy handler. One `GeminiUpstream` serves every request, so an
+ * ADC token is looked up once and reused, as the engine itself does.
+ * `seams` replaces the ADC lookup in tests.
+ */
+export function createGeminiProxy(
+  config: GeminiProxyConfig | undefined,
+  throttle: AiDiagnosticThrottle,
+  logger?: ServeLogger,
+  seams: Pick<GeminiUpstreamOptions, 'printAdcToken'> = {},
+): (req: IncomingMessage, res: ServerResponse, url: URL) => Promise<void> {
+  const upstream = new GeminiUpstream({
+    ...seams,
+    ...(config?.baseUrl !== undefined ? { baseUrl: config.baseUrl } : {}),
+    ...(config?.apiKey !== undefined ? { apiKey: config.apiKey } : {}),
+    fetch: Object.assign(
+      (input: Parameters<typeof fetch>[0], init?: RequestInit) => fetchAiUpstream(input, init, throttle, logger),
+      { preconnect: fetch.preconnect },
+    ),
+  });
+  return async (req, res, url) => {
+    if (req.method !== 'POST') {
+      res.writeHead(405, { allow: 'POST' }).end('method not allowed');
+      return;
+    }
+    const call = geminiCall(url);
+    if (call === null) {
+      sendEnvelope(res, 404, `pyric dev ai-proxy: ${url.pathname} is not a Gemini call the proxy sends.`, 'NOT_FOUND');
+      return;
+    }
+    const body = await readAiProxyBody(req, res);
+    if (body === null) return;
+    let response: Response;
+    let credentials: string[];
+    try {
+      ({ response, credentials } = await upstream.sendWithCredentials(call.resource, call.action, body));
+    } catch (error) {
+      // Missing credentials (401) and an unreachable upstream (502) come as
+      // the engine's own envelopes, already redacted.
+      const envelope = serializeError(error).aiEnvelope;
+      if (envelope === undefined) throw error;
+      sendEnvelope(res, envelope.error.code, envelope.error.message, envelope.error.status);
+      return;
+    }
+    if (response.ok) {
+      await relayAiUpstream(response, res);
+      return;
+    }
+    await relayRedactedError(response, credentials, res);
+  };
+}

package/src/serve/hosted/runtime.ts

@@ -16,6 +16,7 @@ import { fetchAiUpstream, resolveAiProxyUpstream } from '../ai-proxy.js';
 import {
   databaseInstanceRulesHost,
   deployFirestoreRulesToHost,
+  enforcedFirestoreRulesState,
   resetHostSandbox,
   normalizeDatabaseRules,
   setDatabaseRules,
@@ -243,7 +244,13 @@ export async function createHostedRuntime(
   });
   const surfaceContext = createSurfaceContext(sandbox, ownedProjectDir, undefined, persistence.checkpoints);
   // A `database` method's `instance` resolves as a client's does on this host.
-  surfaceContext.databaseInstances = hostDatabaseInstances(ctx);
+  const hostInstances = hostDatabaseInstances(ctx);
+  surfaceContext.databaseInstances = async () => hostInstances;
+  // Storage rules simulation binds the default bucket under the app's name for it.
+  surfaceContext.storageBucketName = () => {
+    const named = ctx.appOptions?.storageBucket;
+    return typeof named === 'string' ? named : undefined;
+  };
   const ports = new Map<string, HostedPort>();
   const uploadPartCounts = new Map<string, number>();
   const recordedUploadFiles = new Map<string, string>();
@@ -295,10 +302,11 @@ export async function createHostedRuntime(
     }
   }
 
+  /** The Firestore status from the rules the sandbox enforces, never `active` for a source production would not load. */
   function syncFirestoreActiveRulesFromSandbox(): void {
     const source = getInternalEnv(ctx.sandbox).getRules();
     ctx.activeRules ??= {};
-    ctx.activeRules.firestore = { status: 'active', source, lastKnownGood: source, updatedAt: Date.now(), messages: [] };
+    ctx.activeRules.firestore = enforcedFirestoreRulesState(source, ctx.activeRules.firestore);
   }
 
   async function handleToolCall(message: ToolCallRequest): Promise<void> {