reflex-hosting-cli 0.1.63__tar.gz → 0.1.65a1__tar.gz

{reflex_hosting_cli-0.1.63 → reflex_hosting_cli-0.1.65a1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: reflex-hosting-cli
-Version: 0.1.63
+Version: 0.1.65a1
 Summary: Reflex Hosting CLI
 Author-email: Nikhil Rao <nikhil@reflex.dev>, Alek Petuskey <alek@reflex.dev>
 Maintainer-email: Simon Young <simon@reflex.dev>, Khaleel Al-Adhami <khaleel@reflex.dev>

{reflex_hosting_cli-0.1.63 → reflex_hosting_cli-0.1.65a1}/src/reflex_cli/utils/hosting.py

@@ -216,16 +216,15 @@ class ScaleParams:
             dict: The object as a dictionary.
 
         """
-        if self.type is None:
-            self.type = ScaleType.REGION
+        effective_type = self.type or ScaleType.REGION
         return (
             {
-                "type": str(self.type.value),
+                "type": str(effective_type.value),
                 "size": self.vm_type,
             }
-            if self.type == ScaleType.SIZE
+            if effective_type == ScaleType.SIZE
             else {
-                "type": str(self.type.value),
+                "type": str(effective_type.value),
                 "regions": {
                     region["name"]: region["number_of_machines"]
                     for region in self.regions
@@ -1079,6 +1078,20 @@ def select_project(project: str, token: str | None = None) -> str:
     return f"{project} is now selected."
 
 
+def normalize_project_id(value: Any) -> str | None:
+    """Normalize a project ID value, treating empty/whitespace strings and non-strings as None.
+
+    Args:
+        value: The raw project ID value from config, CLI args, or hosting.json.
+
+    Returns:
+        The stripped project ID, or None if the value is missing or blank.
+    """
+    if isinstance(value, str) and value.strip():
+        return value.strip()
+    return None
+
+
 def get_selected_project() -> str | None:
     """Retrieve the currently selected project ID.
 
@@ -1089,10 +1102,10 @@ def get_selected_project() -> str | None:
     try:
         with constants.Hosting.HOSTING_JSON.open() as config_file:
             hosting_config = json.load(config_file)
-            return hosting_config.get("project")
+            return normalize_project_id(hosting_config.get("project"))
     except Exception as ex:
         console.debug(
-            f"Unable to fetch token from {constants.Hosting.HOSTING_JSON} due to: {ex}"
+            f"Unable to read selected project from {constants.Hosting.HOSTING_JSON} due to: {ex}"
         )
     return None
 
@@ -1971,14 +1984,18 @@ def authenticate_on_browser() -> tuple[str, dict[str, Any]]:
         constants.Hosting.HOSTING_SERVICE_UI, f"/cli/login?request_id={request_id}"
     )
 
-    console.print(f"Opening {auth_url} ...")
-
     if not is_valid_url(constants.Hosting.HOSTING_SERVICE_UI):
         console.error(
             f"Invalid hosting URL: {constants.Hosting.HOSTING_SERVICE_UI}. Ensure the URL is in the correct format and includes a valid scheme"
         )
         raise click.exceptions.Exit(1)
 
+    console.print(
+        f"Opening {auth_url} ... By connecting your account, you agree to "
+        "Reflex Cloud [Terms of Service] and [Privacy Policy].",
+        markup=False,
+    )
+
     if not webbrowser.open(auth_url):
         console.warn(
             f"Unable to automatically open the browser. Please go to {auth_url} to authenticate."

{reflex_hosting_cli-0.1.63 → reflex_hosting_cli-0.1.65a1}/src/reflex_cli/v2/cli.py

@@ -28,7 +28,8 @@ def login(
         loglevel: The log level to use.
 
     Returns:
-        Information about the logged in user.
+        Information about the newly logged in user or empty dict if already
+        logged in.
 
     Raises:
         SystemExit: If the command fails.
@@ -42,7 +43,7 @@ def login(
     access_token, validated_info = hosting.authenticated_token()
     if access_token:
         console.print("You already logged in.")
-        return validated_info
+        return {}
 
     # If not already logged in, open a browser window/tab to the login page.
     access_token, validated_info = hosting.authenticate_on_browser()
@@ -179,19 +180,24 @@ def deploy(
         if not description:
             description = config.get("description", None)
 
-    # resolve the project id from the project name.
+    project_id = hosting.normalize_project_id(project_id)
+
     if project_name and not project_id:
         result = hosting.search_project(
             project_name, client=authenticated_client, interactive=interactive
         )
-        project_id = result.get("id") if result else None
+        project_id = hosting.normalize_project_id(result.get("id")) if result else None
+
+    selected_project_id = hosting.get_selected_project()
 
+    validated_project: dict[str, Any] | None = None
     try:
-        # check if provided project exists.
+        if not project_id:
+            project_id = selected_project_id
         if project_id:
-            hosting.get_project(project_id, client=authenticated_client)
-        else:
-            project_id = hosting.get_selected_project()
+            validated_project = hosting.get_project(
+                project_id, client=authenticated_client
+            )
     except httpx.HTTPStatusError as ex:
         try:
             console.error(ex.response.json().get("detail"))
@@ -209,9 +215,7 @@ def deploy(
     try:
         if app_name and not app_id:
             search_project_id = project_id
-            if not interactive and not project and not search_project_id:
-                search_project_id = hosting.get_selected_project()
-            elif interactive and not project:
+            if interactive and not project:
                 search_project_id = None
 
             app = hosting.search_app(
@@ -230,16 +234,13 @@ def deploy(
         raise click.exceptions.Exit(1) from ex
 
     if app and interactive and not project and not app_id:
-        default_project_id = hosting.get_selected_project()
+        default_project_id = selected_project_id
         app_project_id = app.get("project_id")
 
         if app_project_id and (
             not default_project_id or app_project_id != default_project_id
         ):
-            app_project = hosting.get_project(
-                app_project_id, client=authenticated_client
-            )
-            app_project_name = app_project.get("name", "Unknown")
+            app_project_name = (app.get("project") or {}).get("name") or app_project_id
             if (
                 console.ask(
                     f"Deploy to app '{app['name']}' in project '{app_project_name}'?",
@@ -262,55 +263,40 @@ def deploy(
             )
             == "y"
         ):
-            # Check if we need confirmation for deploying to non-default project
             if not project:
-                default_project_id = hosting.get_selected_project()
-                if not default_project_id:
-                    try:
-                        if project_id:
-                            target_project = hosting.get_project(
-                                project_id, client=authenticated_client
-                            )
-                            project_name = target_project.get("name", "Unknown")
-                        else:
-                            token = hosting.get_existing_access_token()
-                            default_project_id = hosting.get_default_project(
-                                authenticated_client
+                needs_confirmation = not selected_project_id or (
+                    project_id and project_id != selected_project_id
+                )
+                if needs_confirmation:
+                    if project_id:
+                        project_display_name = (
+                            (
+                                validated_project.get("name")
+                                if validated_project
+                                else None
                             )
-                            if default_project_id:
-                                default_project = hosting.get_project(
-                                    default_project_id, client=authenticated_client
-                                )
-                                project_name = default_project.get(
-                                    "name", "Default Project"
-                                )
-                            else:
-                                project_name = "Default Project"
-                    except Exception:
-                        project_name = "Unknown"
-
-                    if (
-                        console.ask(
-                            f"Create and deploy app '{app_name}' in project '{project_name}'?",
-                            choices=["y", "n"],
-                            default="y",
+                            or project_name
+                            or project_id
                         )
-                        != "y"
-                    ):
-                        console.info("Deployment cancelled.")
-                        raise click.exceptions.Exit(0)
-                elif project_id and project_id != default_project_id:
-                    try:
-                        target_project = hosting.get_project(
-                            project_id, client=authenticated_client
+                    else:
+                        project_display_name = "your default project"
+                        fallback_project_id = hosting.get_default_project(
+                            authenticated_client
                         )
-                        project_name = target_project.get("name", "Unknown")
-                    except Exception:
-                        project_name = "Unknown"
+                        if fallback_project_id:
+                            try:
+                                fallback_project = hosting.get_project(
+                                    fallback_project_id, client=authenticated_client
+                                )
+                                project_display_name = (
+                                    fallback_project.get("name") or project_display_name
+                                )
+                            except Exception:
+                                pass
 
                     if (
                         console.ask(
-                            f"Create and deploy app '{app_name}' in project '{project_name}'?",
+                            f"Create and deploy app '{app_name}' in project '{project_display_name}'?",
                             choices=["y", "n"],
                             default="y",
                         )
@@ -386,6 +372,7 @@ def deploy(
             console.error(
                 """The `python-dotenv` package is required to load environment variables from a file. Run `pip install "python-dotenv>=1.0.1"`."""
             )
+            raise click.exceptions.Exit(1) from None
 
     # Compile the app in production mode: backend first then frontend.
     temporary_dir = tempfile.TemporaryDirectory()

{reflex_hosting_cli-0.1.63 → reflex_hosting_cli-0.1.65a1}/src/reflex_cli/v2/deployments.py

@@ -12,6 +12,7 @@ from packaging import version
 from reflex_cli import constants
 from reflex_cli.utils import console
 from reflex_cli.v2.apps import apps_cli
+from reflex_cli.v2.gcp import deploy_command as gcp_deploy_command
 from reflex_cli.v2.project import project_cli
 from reflex_cli.v2.secrets import secrets_cli
 from reflex_cli.v2.vmtypes_regions import vm_types_regions_cli
@@ -64,6 +65,10 @@ hosting_cli.add_command(
     secrets_cli,
     name="secrets",
 )
+hosting_cli.add_command(
+    gcp_deploy_command,
+    name="deploy",
+)
 for name, command in vm_types_regions_cli.commands.items():
     # Add the command to the hosting CLI
     hosting_cli.add_command(command, name=name)

reflex_hosting_cli-0.1.65a1/src/reflex_cli/v2/gcp.py

@@ -0,0 +1,576 @@
+"""GCP Cloud Run deploy commands for the Reflex Cloud CLI.
+
+Fetches a Dockerfile + bash deploy script from Reflex and runs the script
+against the user's source directory. The Dockerfile is materialized inside
+a Cloud Build job (via a ``cloudbuild.yaml`` written to a tempfile and
+referenced with ``gcloud builds submit --config=...``) — the user's project
+tree is never modified. The script reads its parameters from environment
+variables (GCP_PROJECT, GCP_REGION, SERVICE_NAME, AR_REPO, VERSION,
+REFLEX_CLOUDBUILD_YAML).
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+from datetime import datetime, timezone
+from pathlib import Path
+from urllib.parse import urljoin
+
+import click
+
+from reflex_cli import constants
+from reflex_cli.utils import console
+
+GCP_MANIFEST_ENDPOINT = "/api/v1/cli/gcp-cloud-run-manifest"
+
+DOCKERFILE_NAME = "Dockerfile"
+
+# Environment variables passed to the deploy script.
+ENV_GCP_PROJECT = "GCP_PROJECT"
+ENV_GCP_REGION = "GCP_REGION"
+ENV_SERVICE_NAME = "SERVICE_NAME"
+ENV_AR_REPO = "AR_REPO"
+ENV_VERSION = "VERSION"
+# Path to the Cloud Build config file written by the CLI. The rewritten
+# deploy script references it as ``--config="${REFLEX_CLOUDBUILD_YAML}"``.
+ENV_REFLEX_CLOUDBUILD_YAML = "REFLEX_CLOUDBUILD_YAML"
+
+# Pattern for the start of the `gcloud builds submit` invocation in the
+# Reflex deploy script. We rewrite that whole multi-line command to use
+# `--config=` so the Dockerfile lives inside a cloudbuild.yaml instead of
+# being staged on disk next to the user's source.
+_BUILDS_SUBMIT_PATTERN = re.compile(
+    r"(?P<indent>^[ \t]*)gcloud[ \t]+builds[ \t]+submit\b",
+    re.MULTILINE,
+)
+
+# Manifest response field names from Reflex.
+FIELD_DOCKERFILE = "dockerfile"
+FIELD_DEPLOY_COMMAND = "deploy_command"
+
+# Allowlist of host environment variables forwarded to the deploy script.
+# We deliberately exclude things like AWS_*/GITHUB_TOKEN/SSH agent sockets so a
+# compromised or tampered manifest cannot exfiltrate unrelated credentials.
+DEPLOY_ENV_ALLOWLIST = frozenset({
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "TERM",
+    "LANG",
+    "LC_ALL",
+    "LC_CTYPE",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "XDG_CONFIG_HOME",
+    # gcloud configuration
+    "CLOUDSDK_CONFIG",
+    "CLOUDSDK_ACTIVE_CONFIG_NAME",
+    "CLOUDSDK_CORE_PROJECT",
+    "CLOUDSDK_CORE_ACCOUNT",
+    "CLOUDSDK_AUTH_ACCESS_TOKEN_FILE",
+    "GOOGLE_APPLICATION_CREDENTIALS",
+    # docker configuration
+    "DOCKER_HOST",
+    "DOCKER_TLS_VERIFY",
+    "DOCKER_CERT_PATH",
+    "DOCKER_CONFIG",
+    "DOCKER_BUILDKIT",
+    # corporate proxy / TLS trust
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "SSL_CERT_FILE",
+    "SSL_CERT_DIR",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+})
+
+
+@click.command(name="deploy")
+@click.option(
+    "--gcp",
+    "use_gcp",
+    is_flag=True,
+    default=False,
+    help="Deploy to GCP Cloud Run. Required (the only supported target today).",
+)
+@click.option(
+    "--gcp-project",
+    "gcp_project",
+    default=None,
+    help="The GCP project ID to deploy into (sets GCP_PROJECT). Required with --gcp.",
+)
+@click.option(
+    "--region",
+    default="us-central1",
+    show_default=True,
+    help="The GCP region for Cloud Run (sets GCP_REGION).",
+)
+@click.option(
+    "--service-name",
+    default="reflex-app",
+    show_default=True,
+    help="The Cloud Run service name (sets SERVICE_NAME).",
+)
+@click.option(
+    "--ar-repo",
+    default="reflex",
+    show_default=True,
+    help="The Artifact Registry repository name (sets AR_REPO).",
+)
+@click.option(
+    "--version",
+    "version_tag",
+    default=None,
+    help="The image version tag (sets VERSION). Defaults to a UTC timestamp.",
+)
+@click.option(
+    "--source",
+    "source_dir",
+    default=".",
+    show_default=True,
+    type=click.Path(file_okay=False, dir_okay=True),
+    help="The directory containing the Reflex app. Uploaded to Cloud Build as the build context; the source tree itself is not modified.",
+)
+@click.option("--token", help="The Reflex authentication token.")
+@click.option(
+    "--interactive/--no-interactive",
+    is_flag=True,
+    default=True,
+    help="Whether to prompt before running the deploy script.",
+)
+@click.option(
+    "--dry-run",
+    is_flag=True,
+    default=False,
+    help="Print the manifest and generated cloudbuild.yaml without writing the tempfile or running the script.",
+)
+@click.option(
+    "--loglevel",
+    type=click.Choice([level.value for level in constants.LogLevel]),
+    default=constants.LogLevel.INFO.value,
+    help="The log level to use.",
+)
+def deploy_command(
+    use_gcp: bool,
+    gcp_project: str | None,
+    region: str,
+    service_name: str,
+    ar_repo: str,
+    version_tag: str | None,
+    source_dir: str,
+    token: str | None,
+    interactive: bool,
+    dry_run: bool,
+    loglevel: str,
+):
+    """Deploy a Reflex app to a cloud target.
+
+    Currently the only supported target is GCP Cloud Run via --gcp. The
+    command fetches a Dockerfile and bash deploy script from Reflex, embeds
+    the Dockerfile inside a generated ``cloudbuild.yaml`` (written to a
+    tempfile), rewrites the script's ``gcloud builds submit`` invocation to
+    reference that config, then runs the script with cwd= your source dir.
+    Your project tree is never modified.
+    """
+    from reflex_cli.utils import hosting
+
+    console.set_log_level(loglevel)
+
+    if not use_gcp:
+        console.error(
+            "Specify a deploy target. Currently supported: --gcp (GCP Cloud Run)."
+        )
+        raise click.exceptions.Exit(2)
+    if not gcp_project:
+        console.error("--gcp-project is required when using --gcp.")
+        raise click.exceptions.Exit(2)
+
+    authenticated_client = hosting.get_authenticated_client(
+        token=token, interactive=interactive
+    )
+
+    bash_path = shutil.which("bash")
+    if not bash_path:
+        console.error(
+            "`bash` was not found on PATH; required to run the deploy script."
+        )
+        raise click.exceptions.Exit(1)
+
+    gcloud_path = shutil.which("gcloud")
+    if not gcloud_path:
+        console.error(
+            "The `gcloud` CLI was not found on PATH. Install it from "
+            "https://cloud.google.com/sdk/docs/install and run `gcloud auth login` "
+            "and `gcloud auth application-default login` before retrying."
+        )
+        raise click.exceptions.Exit(1)
+
+    if not shutil.which("docker"):
+        console.error(
+            "The `docker` CLI was not found on PATH; required to build the image."
+        )
+        raise click.exceptions.Exit(1)
+
+    if not _get_active_gcp_account(gcloud_path):
+        console.error(
+            "No active GCP account found. Run `gcloud auth login` and "
+            "`gcloud auth application-default login`, then retry."
+        )
+        raise click.exceptions.Exit(1)
+
+    dockerfile, deploy_script = _request_manifest(authenticated_client.token)
+
+    source_path = Path(source_dir).resolve()
+    if not source_path.is_dir():
+        console.error(f"Source directory does not exist: {source_path}")
+        raise click.exceptions.Exit(1)
+
+    cloudbuild_yaml = _build_cloudbuild_yaml(dockerfile)
+    try:
+        deploy_script = _rewrite_builds_submit(deploy_script)
+    except ValueError as ex:
+        console.error(str(ex))
+        raise click.exceptions.Exit(1) from ex
+
+    version_value = version_tag or datetime.now(timezone.utc).strftime("%Y%m%d-%H%M%S")
+    deploy_env = {
+        ENV_GCP_PROJECT: gcp_project,
+        ENV_GCP_REGION: region,
+        ENV_SERVICE_NAME: service_name,
+        ENV_AR_REPO: ar_repo,
+        ENV_VERSION: version_value,
+    }
+
+    console.info("Received deploy manifest from Reflex.")
+    console.print("")
+    console.print(f"Source: {source_path}")
+    console.print("Deploy environment:")
+    for key, value in deploy_env.items():
+        console.print(f"  {key}={value}")
+    console.print("")
+    console.print("Deploy script (rewritten to use cloudbuild.yaml):")
+    console.print("─" * 60)
+    console.print(deploy_script)
+    console.print("─" * 60)
+    console.info(
+        f"The script runs with a restricted env (only {len(DEPLOY_ENV_ALLOWLIST)} "
+        "allowlisted host variables forwarded plus the deploy variables above)."
+    )
+    console.info(
+        "The Dockerfile is embedded in a Cloud Build config written to a "
+        "tempfile; your source directory is not modified."
+    )
+
+    if dry_run:
+        console.print("")
+        console.print("cloudbuild.yaml contents:")
+        console.print("─" * 60)
+        console.print(cloudbuild_yaml)
+        console.print("─" * 60)
+        console.print("")
+        console.print("Dockerfile contents (embedded in the build step):")
+        console.print("─" * 60)
+        console.print(dockerfile)
+        console.print("─" * 60)
+        console.info("Dry run — nothing staged or executed.")
+        return
+
+    if interactive:
+        answer = console.ask(
+            "Run the deploy script now?", choices=["y", "n"], default="y"
+        )
+        if answer != "y":
+            console.warn("Aborted by user.")
+            raise click.exceptions.Exit(1)
+
+    with _temp_cloudbuild_yaml(cloudbuild_yaml) as cloudbuild_path:
+        exit_code = _run_deploy_script(
+            bash_path=bash_path,
+            script=deploy_script,
+            cwd=source_path,
+            env_overrides={
+                **deploy_env,
+                ENV_REFLEX_CLOUDBUILD_YAML: str(cloudbuild_path),
+            },
+        )
+    if exit_code != 0:
+        console.error(f"Deploy script exited with status {exit_code}.")
+        raise click.exceptions.Exit(exit_code)
+    console.success("Deployment finished.")
+
+
+def _get_active_gcp_account(gcloud_path: str) -> str | None:
+    """Return the email of the active gcloud account, or None.
+
+    Args:
+        gcloud_path: Resolved path to the gcloud executable.
+
+    Returns:
+        The active account email or None if not logged in.
+
+    """
+    try:
+        result = subprocess.run(
+            [
+                gcloud_path,
+                "auth",
+                "list",
+                "--filter=status:ACTIVE",
+                "--format=value(account)",
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except (OSError, subprocess.SubprocessError) as ex:
+        console.debug(f"Failed to query gcloud auth list: {ex}")
+        return None
+    account = result.stdout.strip().splitlines()
+    return account[0] if account else None
+
+
+def _request_manifest(token: str) -> tuple[str, str]:
+    """Fetch the Dockerfile + deploy script from Reflex.
+
+    Args:
+        token: The Reflex API token to authenticate with.
+
+    Returns:
+        A `(dockerfile, deploy_command)` tuple.
+
+    Raises:
+        Exit: If the request fails or the response shape is invalid.
+
+    """
+    import httpx
+
+    from reflex_cli.utils import hosting
+
+    url = urljoin(constants.Hosting.HOSTING_SERVICE, GCP_MANIFEST_ENDPOINT)
+    try:
+        response = httpx.get(
+            url,
+            headers=hosting.authorization_header(token),
+            timeout=constants.Hosting.TIMEOUT,
+        )
+        response.raise_for_status()
+    except httpx.HTTPStatusError as ex:
+        detail = ex.response.text
+        with contextlib.suppress(ValueError):
+            detail = ex.response.json().get("detail", detail)
+        if ex.response.status_code == 403:
+            console.error(
+                "Reflex denied the request (403). GCP Cloud Run deploys require an "
+                "Enterprise tier subscription."
+            )
+        else:
+            console.error(f"Reflex rejected the manifest request: {detail}")
+        raise click.exceptions.Exit(1) from ex
+    except httpx.HTTPError as ex:
+        console.error(f"Failed to reach Reflex at {url}: {ex}")
+        raise click.exceptions.Exit(1) from ex
+
+    try:
+        body = response.json()
+    except ValueError as ex:
+        console.error("Reflex returned a non-JSON response.")
+        raise click.exceptions.Exit(1) from ex
+
+    if not isinstance(body, dict):
+        console.error("Reflex returned an unexpected response shape.")
+        raise click.exceptions.Exit(1)
+
+    dockerfile = body.get(FIELD_DOCKERFILE)
+    deploy_command = body.get(FIELD_DEPLOY_COMMAND)
+    if not isinstance(dockerfile, str) or not dockerfile.strip():
+        console.error(
+            f"Reflex response is missing a non-empty {FIELD_DOCKERFILE!r} field."
+        )
+        raise click.exceptions.Exit(1)
+    if not isinstance(deploy_command, str) or not deploy_command.strip():
+        console.error(
+            f"Reflex response is missing a non-empty {FIELD_DEPLOY_COMMAND!r} field."
+        )
+        raise click.exceptions.Exit(1)
+
+    return dockerfile, deploy_command
+
+
+def _build_cloudbuild_yaml(dockerfile_contents: str) -> str:
+    r"""Generate a Cloud Build config that materializes the Dockerfile inline.
+
+    The Dockerfile body is dropped into a bash heredoc (``cat <<'MARKER' >
+    Dockerfile``) inside the build step. The marker is single-quoted so bash
+    treats the body literally — no shell-meta expansion of ``$``, `` ` ``, or
+    ``\``. YAML literal-block indentation gets stripped uniformly so the
+    closing marker line ends up at column 0 where bash expects it.
+
+    Args:
+        dockerfile_contents: The Dockerfile body from Reflex.
+
+    Returns:
+        A complete ``cloudbuild.yaml`` body, ready to write to disk.
+
+    Raises:
+        ValueError: If the Dockerfile contains a line that exactly matches the
+            heredoc marker (would terminate the heredoc early).
+
+    """
+    marker = "REFLEX_DOCKERFILE_EOF"
+    if any(line.rstrip() == marker for line in dockerfile_contents.splitlines()):
+        raise ValueError(
+            f"Dockerfile content contains the reserved heredoc marker {marker!r}."
+        )
+    # Cloud Build runs its own substitution pass over `args`, so any `$NAME` or
+    # `${NAME}` in the Dockerfile (e.g. `ENV PATH="${UV_PROJECT_ENVIRONMENT}/bin"`)
+    # would be treated as a Cloud Build variable and fail with
+    # "not a valid built-in substitution". Escape literal `$` to `$$` so the
+    # parser restores `$` before bash runs.
+    escaped = dockerfile_contents.replace("$", "$$")
+    # 6 spaces to fit inside the YAML literal block under `args:\n  - -c\n  - |`.
+    indent = "      "
+    body = "".join(f"{indent}{line}\n" for line in escaped.splitlines())
+    return (
+        "steps:\n"
+        "- name: gcr.io/cloud-builders/docker\n"
+        "  entrypoint: bash\n"
+        "  args:\n"
+        "    - -c\n"
+        "    - |\n"
+        f"{indent}cat > Dockerfile <<'{marker}'\n"
+        f"{body}"
+        f"{indent}{marker}\n"
+        f'{indent}docker build -t "$_IMAGE" .\n'
+        f'{indent}docker push "$_IMAGE"\n'
+        "images:\n"
+        "  - $_IMAGE\n"
+    )
+
+
+def _rewrite_builds_submit(script: str) -> str:
+    """Rewrite the Reflex script's `gcloud builds submit` invocation to use --config=.
+
+    Replaces the (possibly multi-line) ``gcloud builds submit --tag X .``
+    command with one that references our generated cloudbuild.yaml via the
+    ``REFLEX_CLOUDBUILD_YAML`` environment variable and passes the image tag
+    through ``--substitutions=_IMAGE=...``.
+
+    Args:
+        script: The Reflex deploy script body.
+
+    Returns:
+        The script with the build-submit step rewritten.
+
+    Raises:
+        ValueError: If `gcloud builds submit` cannot be located in the script.
+
+    """
+    match = _BUILDS_SUBMIT_PATTERN.search(script)
+    if not match:
+        raise ValueError(
+            "Couldn't find `gcloud builds submit` in the deploy script. The "
+            "manifest format may have changed; Contact support@reflex.dev"
+        )
+    indent = match.group("indent")
+    line_start = script.rfind("\n", 0, match.start()) + 1
+    # Consume continuation lines (trailing backslash) until we hit a final line.
+    cursor = match.end()
+    while True:
+        nl = script.find("\n", cursor)
+        if nl == -1:
+            cmd_end = len(script)
+            break
+        if not script[cursor:nl].rstrip().endswith("\\"):
+            cmd_end = nl
+            break
+        cursor = nl + 1
+
+    replacement = (
+        f"{indent}gcloud builds submit \\\n"
+        f'{indent}    --config="${{{ENV_REFLEX_CLOUDBUILD_YAML}}}" \\\n'
+        f'{indent}    --substitutions=_IMAGE="${{IMAGE}}" \\\n'
+        f'{indent}    --project "${{GCP_PROJECT}}" \\\n'
+        f"{indent}    ."
+    )
+    return script[:line_start] + replacement + script[cmd_end:]
+
+
+@contextlib.contextmanager
+def _temp_cloudbuild_yaml(contents: str):
+    """Write a cloudbuild.yaml to a tempfile and yield its path; always clean up.
+
+    Args:
+        contents: The cloudbuild.yaml body to write.
+
+    Yields:
+        The path to the written tempfile.
+
+    """
+    fd, path_str = tempfile.mkstemp(prefix="reflex-cloudbuild-", suffix=".yaml")
+    path = Path(path_str)
+    try:
+        with os.fdopen(fd, "w") as fh:
+            fh.write(contents)
+        yield path
+    finally:
+        with contextlib.suppress(FileNotFoundError):
+            path.unlink()
+
+
+def _run_deploy_script(
+    bash_path: str,
+    script: str,
+    cwd: Path,
+    env_overrides: dict[str, str],
+) -> int:
+    """Run the bash deploy script, streaming output to the user's terminal.
+
+    The script's environment is restricted to ``DEPLOY_ENV_ALLOWLIST`` (plus the
+    explicit ``env_overrides``) so unrelated host secrets like ``AWS_*`` or
+    ``GITHUB_TOKEN`` cannot be exfiltrated by a tampered or compromised manifest.
+
+    Args:
+        bash_path: Resolved path to the bash executable.
+        script: The bash script body received from Reflex.
+        cwd: Working directory to run the script in.
+        env_overrides: Environment variables required by the deploy script.
+
+    Returns:
+        The exit code of the bash process.
+
+    """
+    env = {
+        name: value
+        for name, value in os.environ.items()
+        if name in DEPLOY_ENV_ALLOWLIST
+    }
+    env.update(env_overrides)
+    try:
+        result = subprocess.run(
+            [bash_path, "-s"],
+            input=script,
+            text=True,
+            cwd=cwd,
+            env=env,
+            check=False,
+            stdout=sys.stdout,
+            stderr=sys.stderr,
+        )
+    except OSError as ex:
+        console.error(f"Failed to launch bash: {ex}")
+        return 1
+    return result.returncode