firebase-cli

# Firebase CLI Safety-first wrapper for `firebase` (firebase-tools). Every command is classified by risk tier BEFORE execution — full Firebase control, w/ anything irreversible, live-traffic-affecting, or cost-incurring gated behind explicit `AskUserQuestion`. Blast radius: a project's entire data (Firestore/RTDB wipes have NO undo), live sites, prod app config served to every user, & real money (Blaze). ## When to Use - Deploy hosting/functions/rules/indexes; preview channels; rollbacks - Inspect or mutate Firestore, Realtime DB, Auth users, Remote Config, secrets - Manage projects, apps, sites, backends, extensions, testers - Local dev: Emulator Suite, `serve`, functions shell - NOT for single-doc conversational data edits — Firebase MCP server fits better; see [references/mcp.md](references/mcp.md) (CLI vs MCP) ## Prerequisites (run once per session) ```bash bash scripts/firebase_preflight.sh [target-project-id] ``` Reports CLI/Node version, **account**, **active project**, & verifies the target project exists. NEVER run a write op w/o knowing which account+project you're pointed at. Not logged in → user runs `firebase login` themselves (browser). CI → `GOOGLE_APPLICATION_CREDENTIALS` service account; `--token`/`FIREBASE_TOKEN` are deprecated — refuse. ## Safety Model | Tier | Action Required | Examples | |------|----------------|----------| | **Safe** | Execute immediately | `*:list`, `*:get`, `database:get`, `functions:log`, `remoteconfig:get`, `deploy --dry-run`...