@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/src/cli/serve.ts

@@ -14,7 +14,7 @@ import { randomBytes } from 'node:crypto';
 import { join, relative, resolve } from 'node:path';
 import { existsSync } from 'node:fs';
 import type { ParsedArgs } from './parse-args.js';
-import { readFirebaseJson, readFirebaseRc, type FirebaseJson } from './firebase-json.js';
+import { readFirebaseJson, readFirebaseRc, withDefaultFirestoreRules, type FirebaseJson } from './firebase-json.js';
 import { resolveFirebaseProject, type FirebaseProjectResolution } from './firebase-project.js';
 import { bundleSdk, bundleWorker, defaultSdkEntries, planProjectFirebase, resolveSiteUiDir } from '../serve/bundler.js';
 import {
@@ -38,6 +38,7 @@ import { resolveAiMode } from '../serve/firebase-module-swap.js';
 import { formatActivityWarning } from '../serve/activity-warning.js';
 import { consoleServeLogger, startStaticServer, stderrServeLogger, type ServeHandle } from '../serve/server.js';
 import { createBridgeMount } from '../serve/bridge-mount.js';
+import { createAppPorts } from '../serve/app-ports.js';
 import { openBrowser, shouldAutoOpen } from '../serve/open-browser.js';
 import { readPyricConfig, type PyricConfig } from './pyric-config.js';
 import {
@@ -60,11 +61,11 @@ import {
   createHttpFunctionsPeerReadiness,
   type FunctionsDevelopmentEvent,
   type FunctionsDevelopmentRuntime,
-} from '../functions-rtdb/development-runtime.js';
+} from '../functions/development-runtime.js';
 import {
-  discoverFunctionsRtdbProject,
-  type FunctionsRtdbProject,
-} from '../functions-rtdb/project.js';
+  discoverFunctionsProject,
+  type FunctionsProject,
+} from '../functions/project.js';
 import {
   createSandboxSession,
   SandboxSeedError,
@@ -72,6 +73,7 @@ import {
 } from '../serve/sandbox-session.js';
 import { resolveAvatarsConfig } from '../serve/avatars-config.js';
 import { createVerifyHint } from '../serve/verify-hint.js';
+import { missingPublicDirHint } from './public-dir-hint.js';
 
 interface HostingConfig {
   public?: string;
@@ -252,11 +254,12 @@ async function startServeRuntime(opts: {
     config ??= {};
     const isFirestorePath = typeof ruleOverrides === 'string';
     if (isFirestorePath) {
-      config.firestore = { ...config.firestore, rules: ruleOverrides };
+      config.firestore = withDefaultFirestoreRules(config.firestore, ruleOverrides);
     } else {
-      const hasFirestoreOverride = Boolean(ruleOverrides.firestore);
+      const firestoreOverride = ruleOverrides.firestore;
+      const hasFirestoreOverride = firestoreOverride !== undefined && firestoreOverride !== '';
       if (hasFirestoreOverride) {
-        config.firestore = { ...config.firestore, rules: ruleOverrides.firestore };
+        config.firestore = withDefaultFirestoreRules(config.firestore, firestoreOverride);
       }
       const hasDatabaseOverride = Boolean(ruleOverrides.database);
       if (hasDatabaseOverride) {
@@ -283,14 +286,7 @@ async function startServeRuntime(opts: {
   const publicDir = resolve(opts.cwd, hosting?.public ?? '.');
   const isPublicDirectoryMissing = !existsSync(publicDir);
   if (isPublicDirectoryMissing) {
-    // A missing `dist/` almost always means "no build yet" — the web scaffold's
-    // hosting.public is the Vite output. Point at the dev/build loop instead of
-    // a bare path error (serve previews a build; `vite dev` is the dev server).
-    const looksLikeBuildOutput = /(^|[\\/])(dist|build|out)$/.test(publicDir);
-    const hint = looksLikeBuildOutput
-      ? `\n  No build yet? Run \`bun run dev\` for the live sandbox dev server, ` +
-        `or \`bun run build\` then \`pyric sandbox\` to preview the production build.`
-      : '';
+    const hint = missingPublicDirHint(publicDir, { cwd: opts.cwd, hosted: opts.hosted === true });
     throw new Error(`pyric sandbox: hosting.public directory does not exist: ${publicDir}${hint}`);
   }
 
@@ -370,6 +366,9 @@ async function startServeRuntime(opts: {
   }
   const bundleMs = Math.round(performance.now() - t0);
 
+  // `pyric sandbox -- next dev` serves the page from Next's port, so the
+  // bridge and the guarded `/__pyric/*` routes accept the port they learn.
+  const appPorts = createAppPorts(opts.host ?? 'localhost');
   const needsBridge = Boolean(opts.bridge || opts.hosted);
   let bridgeMount: ReturnType<typeof createBridgeMount> | null = null;
   if (needsBridge) {
@@ -379,6 +378,8 @@ async function startServeRuntime(opts: {
         projectKey: opts.cwd,
         disableAuditLog: opts.disableAuditLog,
         upgradeGuard: { boundHost: opts.host ?? 'localhost', allowedHosts: opts.allowedHosts },
+        learnsProxyPorts: true,
+        appPorts,
     });
   }
   const mount = bridgeMount;
@@ -417,6 +418,7 @@ async function startServeRuntime(opts: {
   try {
     session = await createSandboxSession({
       projectDir: opts.cwd,
+      appPorts,
       firebaseConfig: config,
       sdk: { dir: bundle.outDir, workerVersion },
       seedFile: opts.seed,
@@ -472,14 +474,13 @@ async function startServeRuntime(opts: {
   }
   const payload = session.payload;
   const hosted = usesHostedSandbox ? { projectKey: opts.cwd } : undefined;
-  let namespaceHandler: SandboxSession['handle'] = session.handle;
-  if (hasBridge) {
-    namespaceHandler = async (req, res, url) => {
-      const handledByBridge = await mount.handler(req, res, url);
-      if (handledByBridge) return true;
-      return session.handle(req, res, url);
-    };
-  }
+  // Learn before any guard runs: a page's first request may be a guarded write.
+  const namespaceHandler: SandboxSession['handle'] = async (req, res, url) => {
+    appPorts.learn(req);
+    const handledByBridge = hasBridge && await mount.handler(req, res, url);
+    if (handledByBridge) return true;
+    return session.handle(req, res, url);
+  };
   let handle: Awaited<ReturnType<typeof startStaticServer>>;
   try {
     handle = await startStaticServer({
@@ -934,10 +935,10 @@ export async function runServe(parsed: ParsedArgs): Promise<number> {
   // the bridge (see bridgeEnabledFor) — the child's injected PYRIC_SANDBOX
   // is useless without the /__pyric/sandbox WS mount.
   // One project for the database rules, deploy targets and functions child.
-  let discoveredFunctionsProject: FunctionsRtdbProject | null;
+  let discoveredFunctionsProject: FunctionsProject | null;
   let firebaseProject: FirebaseProjectResolution;
   try {
-    discoveredFunctionsProject = discoverFunctionsRtdbProject(cwd);
+    discoveredFunctionsProject = discoverFunctionsProject(cwd);
     const flagProject = parsed.flags.get('project');
     firebaseProject = resolveFirebaseProject({
       projectDir: cwd,

package/src/cli/service-commands.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from 'bun:test';
 
+import { COMMANDS_BEFORE_SERVICES } from './index.js';
 import { parseArgs } from './parse-args.js';
+import { SERVICE_COMMANDS } from './service-commands.generated.js';
 import {
   createServiceCommandRegistry,
   dispatchServiceCommand,
@@ -25,6 +27,11 @@ describe('service command dispatcher', () => {
     expect(await dispatchServiceCommand(parseArgs(['sandbox', 'npm', 'run', 'dev']))).toBeNull();
   });
 
+  it('starts no route with a command the top-level dispatcher runs before loading the routes', () => {
+    const shadowed = SERVICE_COMMANDS.filter(({ path }) => COMMANDS_BEFORE_SERVICES.has(path[0]));
+    expect(shadowed.map(({ path }) => path.join(' '))).toEqual([]);
+  });
+
   it('rejects duplicate route paths when constructing a registry', () => {
     const run = async (): Promise<number> => 0;
 

package/src/cli/snapshot.ts

@@ -20,6 +20,7 @@ import { copyFileSync, createWriteStream, existsSync, mkdirSync, renameSync, rmS
 import { pipeline } from 'node:stream/promises';
 import { Readable } from 'node:stream';
 import { dirname, join, resolve } from 'node:path';
+import { boundedFetch } from '../bounded-request.js';
 import { hashFile } from '../serve/hosted/persistence/blob-store.js';
 import { hostedStateDirectory, loadHostedSnapshot } from '../serve/hosted/persistence.js';
 import { isStorageReference, objectFileIn, type StorageObjectReference, type StorageStateEntry } from '../serve/state-file.js';
@@ -27,6 +28,13 @@ import { firestoreDocCount } from '../serve/state-summary.js';
 import type { ParsedArgs } from './parse-args.js';
 import { createStateStore, type PyricStateFile } from '../serve/state-store.js';
 
+/**
+ * Milliseconds each live probe (init.json, then state) has, connect included.
+ * A bounded request, so a port whose connect never completes cannot hold the
+ * process open past it (#1167).
+ */
+const LIVE_PROBE_DEADLINE_MS = 750;
+
 /** Ports probed when --port is absent — serve's default + scan window. */
 const SCAN_PORTS = [3473, 3474, 3475, 3476, 3477];
 
@@ -53,9 +61,7 @@ async function fetchLive(port: number): Promise<LiveState | null> {
   try {
     let headers: Record<string, string> | undefined;
     try {
-      const initRes = await fetch(`http://localhost:${port}/__pyric/init.json`, {
-        signal: AbortSignal.timeout(750),
-      });
+      const initRes = await boundedFetch(`http://localhost:${port}/__pyric/init.json`, { deadlineMs: LIVE_PROBE_DEADLINE_MS });
       if (initRes.status === 200) {
         const initData = (await initRes.json()) as { sessionToken?: string };
         if (initData.sessionToken) {
@@ -65,10 +71,13 @@ async function fetchLive(port: number): Promise<LiveState | null> {
     } catch {
       // If init.json probe fails, attempt state fetch directly
     }
-    const requestHeaders: HeadersInit = headers ?? {};
-    const res = await fetch(`http://localhost:${port}/__pyric/state`, {
+    const requestHeaders: Record<string, string> = headers ?? {};
+    // The whole state document is read within the deadline, as fetch's
+    // abort covered the body too, so it has no size cap of its own.
+    const res = await boundedFetch(`http://localhost:${port}/__pyric/state`, {
       headers: requestHeaders,
-      signal: AbortSignal.timeout(750),
+      deadlineMs: LIVE_PROBE_DEADLINE_MS,
+      maxBytes: Number.POSITIVE_INFINITY,
     });
     if (res.status !== 200) return null;
     const body = (await res.json()) as PyricStateFile;

package/src/cli/surface-method-runner.ts

@@ -134,7 +134,7 @@ export async function runSurfaceMethod(
     const sandbox = initializeSandbox();
     const storage = openPersistedServices(sandbox, cwd);
     loadSandboxSnapshot(sandbox, cwd);
-    const projectRules = loadProjectRules(sandbox, cwd);
+    const projectRules = loadProjectRules(sandbox, cwd, (warning) => stderr.write(`pyric: ${warning}\n`));
     if (projectRules?.refused) {
       stderr.write(`pyric: rules not loaded from ${projectRules.path}: ${projectRules.refused}\n`);
     }

package/src/cli/verify.ts

@@ -24,6 +24,8 @@ import { assertNotAppInstance, stagingTargetFrom, stagingToken, type StagingTarg
 import type { FlagValue, ParsedArgs } from './parse-args.js';
 import { resolveScope } from '../credentials/node/scope.js';
 import { CAPTURE_RELATIVE_PATH } from '../serve/capture-store.js';
+import { firestoreDatabases } from '../serve/rules.js';
+import { defaultFirestoreDatabase } from 'pyric/sandbox/internal';
 import {
   isRtdbInstanceRulesKey,
   resolveRtdbCandidateRules,
@@ -551,7 +553,7 @@ async function resolveCandidateRules(
   const rules: VerifyRulesInput = {};
   const paths: Record<string, string> = {};
   if (services.includes('firestore')) {
-    const rel = overrides.firestore ?? (await readConfig())?.firestore?.rules;
+    const rel = overrides.firestore ?? configuredFirestoreRules(cwd, await readConfig(), input.project);
     if (!rel) {
       throw new Error('missing candidate firestore rules. Pass --rules firestore=<path> or configure firebase.json.');
     }
@@ -593,6 +595,14 @@ async function resolveCandidateRules(
   return { rules, paths };
 }
 
+/** The rules file `firebase.json` names for the `(default)` Firestore database, from either `firestore` form. */
+function configuredFirestoreRules(cwd: string, config: FirebaseJson | null, project: string | undefined): string | undefined {
+  const projectId = project ?? readFirebaseRcSync(cwd)?.projects?.default;
+  const databases = firestoreDatabases(cwd, config, projectId === undefined ? {} : { projectId });
+  const entry = defaultFirestoreDatabase(databases);
+  return entry?.configured === true ? entry.rulesFile : undefined;
+}
+
 function configuredStorageRules(config: FirebaseJson | null): string | undefined {
   const block = config?.storage;
   const entries = block ? (Array.isArray(block) ? block : [block]) : [];