@pyric/cli 0.1.0-alpha.30.2 → 0.1.0-alpha.31

package/src/serve/entries/runtime-origin.ts

@@ -26,6 +26,12 @@ export interface NodeRuntimeOrigin {
    * settles. Discovery starts at the first call, so importing an SDK opens nothing.
    */
   readonly host: () => Promise<string>;
+  /**
+   * The connection to the host was lost: the next `host()` resolves it again,
+   * as `pyric-admin`'s remote sandbox does at each connect, so a host that
+   * came back on another port is found there.
+   */
+  readonly forgetHost?: () => void;
   /** The socket and event-loop behavior of a hosted connection in Node. */
   readonly socketRealm: HostedSocketRealm;
   /** Raised for every call when the host is not a Node host. */

package/src/serve/entries/unsupported/firestore.ts

@@ -6,7 +6,6 @@ export const documentSnapshotFromJSON = unsupportedServedApi('firestore', 'docum
 export const enablePersistentCacheIndexAutoCreation = unsupportedServedApi('firestore', 'enablePersistentCacheIndexAutoCreation');
 export const ensureFirestoreConfigured = unsupportedServedApi('firestore', 'ensureFirestoreConfigured');
 export const executeWrite = unsupportedServedApi('firestore', 'executeWrite');
-export const getAggregateFromServer = unsupportedServedApi('firestore', 'getAggregateFromServer');
 export const getPersistentCacheIndexManager = unsupportedServedApi('firestore', 'getPersistentCacheIndexManager');
 export const loadBundle = unsupportedServedApi('firestore', 'loadBundle');
 export const namedQuery = unsupportedServedApi('firestore', 'namedQuery');

package/src/serve/entries/worker-runtime.ts

@@ -13,9 +13,10 @@ import type { HostedConnectionState } from '../worker/client/websocket-connectio
 import { getServiceWorkerFirestore } from '../worker/client/service-worker-connection.js';
 import { getDeferredFirestore } from '../worker/client/deferred-connection.js';
 import { getHostedFirestore } from '../worker/client/websocket-connection.js';
-import { currentHostInstanceId, currentSessionToken, forgetSessionToken, initPayload } from './init-payload.js';
+import { currentHostInstanceId, currentHostPayload, currentSessionToken, forgetSessionToken, initPayload } from './init-payload.js';
 import type { WorkerInitPayload } from '../init-payload.js';
 import { toPageOriginWsUrl } from './bridge-url.js';
+import { movedSocketUrl, type AttachedHost } from './moved-host.js';
 import { hostLocation, nodeRuntimeOrigin, type NodeRuntimeOrigin } from './runtime-origin.js';
 import { isServiceWorkerRealm } from '../worker/service-worker-channel.js';
 import {
@@ -61,7 +62,10 @@ function hostedTarget(node?: { host: string; origin: NodeRuntimeOrigin }): Param
       runtimeStatus.setHostedConnection(state);
       // A host that returns may be a new boot with its own session token.
       const lostHost = state === 'interrupted';
-      if (lostHost) forgetSessionToken();
+      if (!lostHost) return;
+      forgetSessionToken();
+      // A Node process finds the host again: it may have come back on another port.
+      node?.origin.forgetHost?.();
     },
     onError: error => runtimeStatus.reportError(error, 'worker'),
     // The worker selection stamped into the page carries no session token; init.json does.
@@ -74,9 +78,18 @@ function hostedTarget(node?: { host: string; origin: NodeRuntimeOrigin }): Param
       : payload?.instanceId,
     // After a host restart, a Node process reads the new boot's id before it reattaches.
     currentHostInstanceId: node === undefined ? undefined : currentHostInstanceId,
+    // A Node process redials the host where it runs now, which `.pyric/serve.json` names.
+    // Its socket path comes from the moved host's own init.json, read for this reattach.
+    currentUrl: node === undefined ? undefined : () => currentSocketUrl(node.origin, { projectKey, bridgeUrl }),
   };
 }
 
+/** Where a Node process's socket goes on the host serving now, from that host's own `init.json`. */
+async function currentSocketUrl(origin: NodeRuntimeOrigin, attached: AttachedHost): Promise<string> {
+  const current = await currentHostPayload();
+  return movedSocketUrl(current, await origin.host(), attached);
+}
+
 export const WORKER_URL = PYRIC_WORKER_URL;
 let epochStorage: Storage | undefined;
 try {
@@ -232,13 +245,13 @@ function initialize(configuration: WorkerInitPayload | null): void {
           const pageSuffix = hasOneOtherPage ? '' : 's';
           othersHint = ` ${otherPages} other page${pageSuffix} must disconnect before the worker can restart.`;
         } else if (isOnlyPage) {
-          othersHint = ' This is the only connected page — reload it to pick up the new worker.';
+          othersHint = ' This is the only connected page, so reloading it picks up the new worker.';
         }
         console.warn(
           `[pyric sandbox] the SharedWorker is running older code (build ${runningVersion}) than what is now `
-            + `served (build ${servedVersion}). A SharedWorker can't hot-update — CLOSE ALL TABS of this origin `
-            + 'and reopen to load the new worker. (All tabs share one worker, so a partial reload leaves '
-            + `the old code running for everyone.)${othersHint}`,
+            + `served (build ${servedVersion}). A SharedWorker can't update while it runs. Close every tab of this `
+            + 'origin, then reopen one to load the new worker. All tabs share one worker, so reloading only some '
+            + `of them leaves the old code running for all of them.${othersHint}`,
         );
       })
       .catch((error) => runtimeStatus.reportError(error, 'worker'));

package/src/serve/firebase-module-swap.ts

@@ -92,6 +92,77 @@ export const REAL_SDK_ENTRIES: ReadonlyMap<ServedFirebaseSpecifier, string> = ne
   ['firebase/app-check', 'firebase-sdk-app-check'],
 ]);
 
+/**
+ * The `@firebase/*` packages the real AI SDK and the passthrough's
+ * `firebase/app` and `firebase/app-check` import, which a server runner can
+ * reach by file URL (Vite's module runner does).
+ */
+const PRODUCTION_AI_SDK_PACKAGES: ReadonlySet<string> = new Set([
+  '@firebase/ai',
+  '@firebase/app',
+  '@firebase/app-check',
+  '@firebase/app-check-interop-types',
+  '@firebase/component',
+  '@firebase/logger',
+  '@firebase/util',
+]);
+
+/**
+ * The firebase-admin files the App Check verifier bridge's
+ * `firebase-admin/app` and `firebase-admin/app-check` load, by path inside the
+ * package. Traced from a `verifyToken` run of the built bridge against
+ * firebase-admin 13.10.0: the ESM wrappers, `lib/app/`, `lib/app-check/`,
+ * `lib/utils/` and the manifest `lib/utils/index.js` reads for the version.
+ * A firebase-admin release that reaches further fails closed: the stop fires
+ * and the `ai-production-app-check` scenario shows it.
+ */
+const ADMIN_BRIDGE_FILES: readonly string[] = [
+  'package.json',
+  'lib/esm/app/',
+  'lib/esm/app-check/',
+  'lib/app/',
+  'lib/app-check/',
+  'lib/utils/',
+];
+
+/** Whether a path inside a package is `entry`, or lies under it when `entry` is a folder (ends in `/`). */
+function isUnderEntry(pathInPackage: string, entry: string): boolean {
+  const isFolder = entry.endsWith('/');
+  if (isFolder) return pathInPackage.startsWith(entry);
+  return pathInPackage === entry;
+}
+
+/** Whether a firebase-admin file, by its path inside the package, is one the verifier bridge's pair loads. */
+export function isAdminBridgeFile(pathInPackage: string | null): boolean {
+  if (pathInPackage === null) return false;
+  return ADMIN_BRIDGE_FILES.some((entry) => isUnderEntry(pathInPackage, entry));
+}
+
+/** Whether a client SDK package is one that `firebase/ai`, `firebase/app` and `firebase/app-check` import. */
+export function isProductionAiSdkPackage(packageName: string): boolean {
+  return PRODUCTION_AI_SDK_PACKAGES.has(packageName);
+}
+
+/** The `firebase` package's own folders for the {@link REAL_SDK_ENTRIES}: `ai`, `app` and `app-check`. */
+const PRODUCTION_AI_FIREBASE_FOLDERS: ReadonlySet<string> = new Set(
+  [...REAL_SDK_ENTRIES.keys()].map((specifier) => specifier.slice('firebase/'.length)),
+);
+
+/**
+ * Whether production AI mode lets a file of the real Firebase SDK load, from
+ * any importer: a `firebase` file under `ai/`, `app/` or `app-check/` (the
+ * {@link REAL_SDK_ENTRIES}), or a file of the `@firebase/*` packages those
+ * import. Every other file of the client SDK is swapped or stopped, as in
+ * sandbox mode. `pathInPackage` is the file's path inside its package, read
+ * only for `firebase`.
+ */
+export function isProductionAiSdkFile(packageName: string, pathInPackage: () => string | null): boolean {
+  if (isProductionAiSdkPackage(packageName)) return true;
+  if (packageName !== 'firebase') return false;
+  const folder = pathInPackage()?.split('/')[0];
+  return folder !== undefined && PRODUCTION_AI_FIREBASE_FOLDERS.has(folder);
+}
+
 /**
  * The import-map plane's specifier to entry key table: the swap, plus, in
  * production AI mode, the unswapped `firebase/ai` sent to the Firebase SDK
@@ -121,12 +192,22 @@ const PACKAGE_ROOTS: readonly string[] = (() => {
 /** The shadow-app wrappers, relative to the package root. */
 const SHADOW_MODULE = /^(?:dist|src)\/(?:register\/(?:client\/)?app-bridge[^/]*|serve\/entries\/app-ai-passthrough[^/]*)$/;
 
+/** The register's App Check verifier for production AI mode, relative to the package root. */
+const ADMIN_BRIDGE_MODULE = /^(?:dist|src)\/register\/app-bridge-admin-app-check\.(?:js|ts)$/;
+
 function importerFile(importer: string): string {
   const withoutQuery = importer.replace(/[?#].*$/, '');
   const path = withoutQuery.startsWith('file://') ? fileURLToPath(withoutQuery) : withoutQuery;
   return path.replaceAll('\\', '/');
 }
 
+/** Whether an importer is one of this package's own modules whose path, relative to the package root, matches `module`. */
+function isPackageModule(importer: string | undefined, module: RegExp): boolean {
+  if (importer === undefined) return false;
+  const file = importerFile(importer);
+  return PACKAGE_ROOTS.some((root) => file.startsWith(root) && module.test(file.slice(root.length)));
+}
+
 /**
  * Whether an importer is one of this package's own modules that wrap the
  * Firebase SDK's `firebase/app` or `firebase/app-check`. Those imports must
@@ -134,26 +215,28 @@ function importerFile(importer: string): string {
  * happens to be named `app-bridge.js` is still swapped.
  */
 export function isShadowAppImporter(importer: string | undefined): boolean {
-  if (importer === undefined) return false;
-  const file = importerFile(importer);
-  return PACKAGE_ROOTS.some((root) => file.startsWith(root) && SHADOW_MODULE.test(file.slice(root.length)));
+  return isPackageModule(importer, SHADOW_MODULE);
 }
 
+/** The client SDK modules every shadow-app wrapper imports for itself. */
+const BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set(['firebase/app', 'firebase/app-check']);
+
 /**
- * The SDK modules a shadow-app wrapper imports for itself. The firebase-admin
- * pair is the register's App Check verifier for production AI mode
- * (`register/app-bridge-admin-app-check.ts`); no browser plane serves them.
+ * The firebase-admin pair that only the register's App Check verifier imports
+ * (`register/app-bridge-admin-app-check.ts`), and only in production AI mode,
+ * where the register loads it. No browser plane serves them.
  */
-const BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set([
-  'firebase/app',
-  'firebase/app-check',
-  'firebase-admin/app',
-  'firebase-admin/app-check',
-]);
+const ADMIN_BRIDGED_SPECIFIERS: ReadonlySet<string> = new Set(['firebase-admin/app', 'firebase-admin/app-check']);
 
-/** Whether this import is a shadow-app wrapper reaching the Firebase SDK it wraps. */
-export function isBypassedBridgeImport(specifier: string, importer: string | undefined): boolean {
-  return BRIDGED_SPECIFIERS.has(specifier) && isShadowAppImporter(importer);
+/**
+ * Whether this import is a shadow-app wrapper reaching the Firebase SDK it
+ * wraps. The firebase-admin pair counts only when `aiMode` is `production`,
+ * so a plane that passes no mode never bypasses it.
+ */
+export function isBypassedBridgeImport(specifier: string, importer: string | undefined, aiMode?: AiMode): boolean {
+  if (BRIDGED_SPECIFIERS.has(specifier)) return isShadowAppImporter(importer);
+  const isAdminBridgeImport = ADMIN_BRIDGED_SPECIFIERS.has(specifier) && aiMode === 'production';
+  return isAdminBridgeImport && isPackageModule(importer, ADMIN_BRIDGE_MODULE);
 }
 
 /**

package/src/serve/gemini-proxy.ts

@@ -18,7 +18,7 @@
  */
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import { GeminiUpstream, type GeminiUpstreamOptions } from 'pyric/ai/internal';
-import { redactUpstreamError } from './gemini-error-redaction.js';
+import { redactUpstreamError } from 'pyric/ai/internal';
 import type { ServeLogger } from './server.js';
 import { fetchAiUpstream, readAiProxyBody, relayAiUpstream, type AiDiagnosticThrottle } from './ai-proxy.js';
 import { GEMINI_PROXY_PATH } from './worker/ai-proxy-paths.js';
@@ -76,7 +76,7 @@ function sendEnvelope(res: ServerResponse, code: number, message: string, status
 /**
  * Send a non-2xx upstream answer with the credentials the request carried
  * removed, in whatever form the upstream quotes them, and a JSON envelope
- * kept parseable (`gemini-error-redaction.ts`).
+ * kept parseable (`redactUpstreamError`, shared with the gemini engine).
  */
 async function relayRedactedError(upstream: Response, credentials: readonly string[], res: ServerResponse): Promise<void> {
   const text = redactUpstreamError(await upstream.text().catch(() => ''), credentials);

package/src/serve/hosted/runtime.ts

@@ -16,6 +16,7 @@ import { fetchAiUpstream, resolveAiProxyUpstream } from '../ai-proxy.js';
 import {
   databaseInstanceRulesHost,
   deployFirestoreRulesToHost,
+  enforcedFirestoreRulesState,
   resetHostSandbox,
   normalizeDatabaseRules,
   setDatabaseRules,
@@ -243,7 +244,13 @@ export async function createHostedRuntime(
   });
   const surfaceContext = createSurfaceContext(sandbox, ownedProjectDir, undefined, persistence.checkpoints);
   // A `database` method's `instance` resolves as a client's does on this host.
-  surfaceContext.databaseInstances = hostDatabaseInstances(ctx);
+  const hostInstances = hostDatabaseInstances(ctx);
+  surfaceContext.databaseInstances = async () => hostInstances;
+  // Storage rules simulation binds the default bucket under the app's name for it.
+  surfaceContext.storageBucketName = () => {
+    const named = ctx.appOptions?.storageBucket;
+    return typeof named === 'string' ? named : undefined;
+  };
   const ports = new Map<string, HostedPort>();
   const uploadPartCounts = new Map<string, number>();
   const recordedUploadFiles = new Map<string, string>();
@@ -295,10 +302,11 @@ export async function createHostedRuntime(
     }
   }
 
+  /** The Firestore status from the rules the sandbox enforces, never `active` for a source production would not load. */
   function syncFirestoreActiveRulesFromSandbox(): void {
     const source = getInternalEnv(ctx.sandbox).getRules();
     ctx.activeRules ??= {};
-    ctx.activeRules.firestore = { status: 'active', source, lastKnownGood: source, updatedAt: Date.now(), messages: [] };
+    ctx.activeRules.firestore = enforcedFirestoreRulesState(source, ctx.activeRules.firestore);
   }
 
   async function handleToolCall(message: ToolCallRequest): Promise<void> {

package/src/serve/namespace.ts

@@ -23,13 +23,14 @@ import { createReadStream, existsSync, statSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ActivityIncident } from 'pyric/firestore/internal';
-import { BODY_TOO_LARGE_CODE, collectBody } from '../bridge/server/peer.js';
+import { BODY_TOO_LARGE_CODE, closingHeaders, collectBody } from '../bridge/server/peer.js';
 import { handleIndexConfig } from './index-config-route.js';
 import { StateFileError, type StateSection, type StateStore } from './state-store.js';
 import { createWriterLock, type WriterLock } from './writer-lock.js';
 import { createStudioRoutes, type StudioRouteOptions } from './studio/index.js';
 import { pipeFileToResponse, getHeader, isAllowedHost, isAllowedOrigin, isAllowedSessionToken, type ServeLogger } from './server.js';
 import type { InitPayload } from './init-payload.js';
+import type { AppPorts } from './app-ports.js';
 import { handleActivity } from './activity-route.js';
 import { handleAiProxy, AI_PROXY_ROUTE } from './ai-proxy.js';
 import { createGeminiProxy, isGeminiProxyPath, type GeminiProxyConfig } from './gemini-proxy.js';
@@ -143,6 +144,12 @@ export interface NamespaceOptions {
   boundHost?: string;
   /** Extra allowed hostnames. */
   allowedHosts?: string[];
+  /** Under `pyric sandbox`, the app's ports, including the port of a dev
+   *  server that proxies `/__pyric/*` here (`withPyric` under `next dev`).
+   *  The guarded routes accept a page's Origin on any of them. Absent, only
+   *  the connection's own port is accepted, as under the Vite plugin. The
+   *  caller that creates it teaches it from each request. */
+  appPorts?: AppPorts;
   /** The OpenAI-compatible upstream `/__pyric/ai-proxy` forwards to
    *  (pyric/ai — cdd-deltas #98.2). Falls back to the
    *  `PYRIC_AI_PROXY_UPSTREAM` env var, then `http://localhost:11434/v1`
@@ -526,10 +533,8 @@ export function noteAiDiagnostic(
  *  denied on two instances prints once for each.
  *  Answers 204 (best-effort diagnostics: a malformed body or a caller with no
  *  logger wired must never fail the page that reported the refusal), except
- *  413 for a body over {@link DENIAL_BODY_LIMIT_BYTES}. On the 0.1.0-alpha.30
- *  line the namespace runs no loopback guard before this route, so a page on
- *  any origin can reach here; the body limit and the terminal-text sanitizing
- *  still apply. */
+ *  413 for a body over {@link DENIAL_BODY_LIMIT_BYTES}. The namespace runs
+ *  the loopback guard first, so only this server's own pages reach here. */
 async function handleDenials(
   throttle: DenialThrottle,
   logger: ServeLogger | undefined,
@@ -558,7 +563,7 @@ async function handleDenials(
   } catch (error) {
     const tooLarge = (error as { code?: unknown } | null)?.code === BODY_TOO_LARGE_CODE;
     if (tooLarge) {
-      res.writeHead(413, { 'content-type': 'text/plain' }).end('Payload Too Large');
+      res.writeHead(413, closingHeaders({ 'content-type': 'text/plain' })).end('Payload Too Large');
       return;
     }
     /* malformed body: drop it; this is a diagnostics side channel */
@@ -566,20 +571,27 @@ async function handleDenials(
   res.writeHead(204).end();
 }
 
-function guardLoopback(
-  req: IncomingMessage,
-  res: ServerResponse,
-  boundHost: string,
-  allowedHosts?: string[],
-): boolean {
+/**
+ * A /__pyric request comes from a page of this app, so the Origin names one of
+ * its ports: this server's own, or under `pyric sandbox` the port of a dev
+ * server that proxies to it (see app-ports.ts).
+ */
+function isAppOrigin(req: IncomingMessage, originHeader: string, opts: GuardOptions): boolean {
+  const boundHost = opts.boundHost ?? 'localhost';
+  const ports = opts.appPorts?.forRequest(req) ?? [req.socket.localPort];
+  return ports.some((port) => isAllowedOrigin(originHeader, boundHost, opts.allowedHosts, port));
+}
+
+type GuardOptions = Pick<NamespaceOptions, 'boundHost' | 'allowedHosts' | 'appPorts'>;
+
+function guardLoopback(req: IncomingMessage, res: ServerResponse, opts: GuardOptions): boolean {
   const hostHeader = getHeader(req, 'host');
   const originHeader = getHeader(req, 'origin');
-  if (!isAllowedHost(hostHeader, boundHost, allowedHosts)) {
+  if (!isAllowedHost(hostHeader, opts.boundHost ?? 'localhost', opts.allowedHosts)) {
     res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: host not allowed');
     return false;
   }
-  // A /__pyric request comes from a page on this same server, so the Origin names this port.
-  if (originHeader && !isAllowedOrigin(originHeader, boundHost, allowedHosts, req.socket.localPort)) {
+  if (originHeader && !isAppOrigin(req, originHeader, opts)) {
     res.writeHead(403, { 'content-type': 'text/plain' }).end('Forbidden: origin mismatch');
     return false;
   }
@@ -625,14 +637,14 @@ export function createPyricNamespace(opts: NamespaceOptions) {
   return (req: IncomingMessage, res: ServerResponse, url: URL): boolean | Promise<boolean> => {
     const isDiagnostics = url.pathname === DIAGNOSTICS_PATH;
     if (isDiagnostics) {
-      const refused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const refused = !guardLoopback(req, res, opts);
       if (refused) return true;
       return diagnostics(req, res).then(() => true);
     }
     const thresholds = opts.thresholds;
     const isThresholdRequest = thresholds !== undefined && url.pathname === '/__pyric/thresholds';
     if (isThresholdRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -644,7 +656,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const indexes = opts.indexes;
     const isIndexRequest = indexes !== undefined && url.pathname === '/__pyric/indexes';
     if (isIndexRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -658,7 +670,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     if (hasStudioRoutes) {
       const isStudioRequest = url.pathname.startsWith('/__pyric/workspace') || url.pathname.startsWith('/__pyric/projects');
       if (isStudioRequest) {
-        const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+        const hostRefused = !guardLoopback(req, res, opts);
         if (hostRefused) return true;
         return routes(req, res, url);
       }
@@ -666,7 +678,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const state = opts.state;
     const isObjectRequest = state !== undefined && url.pathname.startsWith(STATE_OBJECTS_PREFIX);
     if (isObjectRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -678,7 +690,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     }
     const isStateRequest = state !== undefined && url.pathname === '/__pyric/state';
     if (isStateRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -698,7 +710,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const rateCaptures = opts.rateCaptures;
     const isRateCaptureRequest = rateCaptures !== undefined && url.pathname === '/__pyric/rate-captures';
     if (isRateCaptureRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -709,7 +721,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const capture = opts.capture;
     const isCaptureRequest = capture !== undefined && url.pathname === '/__pyric/capture';
     if (isCaptureRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       const sessionRefused = !isAllowedSessionToken(req, url, sessionToken);
       if (sessionRefused) {
@@ -725,7 +737,7 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const events = opts.events;
     const isEventsRequest = events !== undefined && url.pathname === '/__pyric/events';
     if (isEventsRequest) {
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       events.handle(req, res);
       return true;
@@ -733,14 +745,14 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     const isGeminiProxyRequest = isGeminiProxyPath(url.pathname);
     if (isGeminiProxyRequest) {
       // It spends the server's key, so only this app's pages may call it.
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       return geminiProxy(req, res, url).then(() => true);
     }
     const isAiProxyRequest = url.pathname === AI_PROXY_ROUTE || url.pathname.startsWith(`${AI_PROXY_ROUTE}/`);
     if (isAiProxyRequest) {
       // The upstream may carry the developer's key, so only this server's pages may spend it.
-      const hostRefused = !guardLoopback(req, res, opts.boundHost ?? 'localhost', opts.allowedHosts);
+      const hostRefused = !guardLoopback(req, res, opts);
       if (hostRefused) return true;
       return handleAiProxy(opts.aiProxyUpstream, denialThrottle, req, res, url, opts.logger).then(
         () => true,
@@ -752,9 +764,9 @@ export function createPyricNamespace(opts: NamespaceOptions) {
     }
     const isDenialRequest = url.pathname === '/__pyric/denials';
     if (isDenialRequest) {
-      // No origin guard on the 0.1.0-alpha.30 line: without the learned proxy
-      // ports from #1497, it would refuse the Next dev server's page under
-      // `pyric sandbox -- next dev`. The body limit still applies.
+      // A page on another origin must not be able to write to the developer's terminal.
+      const hostRefused = !guardLoopback(req, res, opts);
+      if (hostRefused) return true;
       return handleDenials(denialThrottle, opts.logger, req, res).then(() => true);
     }
     const isInitRequest = url.pathname === '/__pyric/init.json';

package/src/serve/repro/compare.ts

@@ -11,7 +11,8 @@
  *   replayed values back before comparing. A recorded id bound to two replayed
  *   ids is a divergence.
  * - Times compare equal to times: epoch milliseconds, `{ seconds, nanoseconds }`
- *   timestamps, ISO and HTTP dates, and the `iat`, `exp` and `auth_time` claims.
+ *   timestamps, ISO and HTTP dates, and the `iat`, `exp` and `auth_time` claims,
+ *   also inside a sandbox ID token string, which carries its claims as JSON.
  *
  * Everything else must be equal.
  */
@@ -21,6 +22,8 @@ const TOKEN_SPLIT = /([^A-Za-z0-9_-]+)/;
 const ISO_DATE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z$/;
 const HTTP_DATE = /^[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
 const TIME_CLAIMS = new Set(['iat', 'exp', 'auth_time']);
+/** A sandbox ID token: `sandbox-id-token-<uid>-<serial>:` and its claims as JSON. */
+const SANDBOX_ID_TOKEN = /^(sandbox-id-token-[^:]*):(\{.*\})$/s;
 export const TIME = '<time>';
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
@@ -45,6 +48,11 @@ export function normalize(value: unknown): unknown {
   if (typeof value === 'string') {
     const isTime = ISO_DATE.test(value) || HTTP_DATE.test(value) || (/^\d{13}$/.test(value));
     if (isTime) return TIME;
+    const sandboxIdToken = SANDBOX_ID_TOKEN.exec(value);
+    if (sandboxIdToken !== null) {
+      const claims = normalize(sandboxIdToken[2]);
+      return { sandboxIdToken: sandboxIdToken[1], claims };
+    }
     const mayBeJson = value.startsWith('{') || value.startsWith('[');
     if (mayBeJson) {
       try {

package/src/serve/rules-fixture-check.ts

@@ -3,6 +3,7 @@ import { basename, join } from 'node:path';
 import {
   SimulateFirestoreRulesHandler,
   TestCaseSchema,
+  caseShapeRefusal,
   type TestCase,
 } from 'pyric/rules/internal';
 import {
@@ -74,7 +75,18 @@ function discoverProjectFixtureFiles(projectDir: string): DiscoveredFixtureFile[
   return found;
 }
 
-function extractFirestoreTestCases(raw: unknown): TestCase[] | null {
+/**
+ * What a fixture file holds: no Firestore cases, Firestore cases, or cases
+ * one of which the case check refuses. A refused fixture is reported, not
+ * skipped silently, so a case written with a misspelled field or a create
+ * that names a resource is not quietly left out of the check.
+ */
+type ExtractedCases =
+  | { kind: 'none' }
+  | { kind: 'refused'; reason: string }
+  | { kind: 'cases'; cases: TestCase[] };
+
+function extractFirestoreTestCases(raw: unknown): ExtractedCases {
   let candidateList: unknown[] | null = null;
   if (Array.isArray(raw)) {
     candidateList = raw;
@@ -88,15 +100,21 @@ function extractFirestoreTestCases(raw: unknown): TestCase[] | null {
       candidateList = [record];
     }
   }
-  if (!candidateList || candidateList.length === 0) return null;
+  if (!candidateList || candidateList.length === 0) return { kind: 'none' };
+  // A list with no `method` anywhere is some other service's cases, such as
+  // Realtime Database cases, which name an `operation`.
+  const isFirestoreCaseList = candidateList.some(
+    (item) => typeof item === 'object' && item !== null && 'method' in item,
+  );
+  if (!isFirestoreCaseList) return { kind: 'none' };
 
   const parsedCases: TestCase[] = [];
-  for (const item of candidateList) {
-    const parsed = TestCaseSchema.safeParse(item);
-    if (!parsed.success) return null;
-    parsedCases.push(parsed.data);
+  for (const [i, item] of candidateList.entries()) {
+    const refusal = caseShapeRefusal(item);
+    if (refusal) return { kind: 'refused', reason: `case ${i}: ${refusal}` };
+    parsedCases.push(TestCaseSchema.parse(item));
   }
-  return parsedCases;
+  return { kind: 'cases', cases: parsedCases };
 }
 
 function formatDivergenceReason(div: VerifyDivergence): string {
@@ -127,6 +145,7 @@ export async function runProjectFixturesOnRulesReload(
   let failed = 0;
   let checks = 0;
   const failureLines: string[] = [];
+  const warningLines: string[] = [];
 
   for (const file of files) {
     let raw: unknown;
@@ -189,8 +208,13 @@ export async function runProjectFixturesOnRulesReload(
     }
 
     if (input.service === 'firestore' && input.firestoreRules) {
-      const testCases = extractFirestoreTestCases(raw);
-      if (!testCases) continue;
+      const extracted = extractFirestoreTestCases(raw);
+      if (extracted.kind === 'refused') {
+        warningLines.push(`  ⚠ [pyric] fixtures: [${file.name}] not checked, ${extracted.reason}`);
+        continue;
+      }
+      if (extracted.kind === 'none') continue;
+      const testCases = extracted.cases;
 
       const sim = new SimulateFirestoreRulesHandler().simulate(input.firestoreRules, testCases);
       if (!sim.success) continue;
@@ -234,6 +258,7 @@ export async function runProjectFixturesOnRulesReload(
       lines.push(...failureLines);
     }
   }
+  lines.push(...warningLines);
 
   return { ran, passed, failed, checks, ok, lines };
 }