fix: summarizeText Cloud SQL secrets + WS cold-start timeout

[equationalapplications]

Summary

Two production fixes found while investigating chat-screen errors (2026-07-13):

1. summarizeText 500s — missing Cloud SQL secret bindings

Every prod summarizeText call has been failing with
Missing required Cloud SQL environment variables: CLOUD_SQL_CONNECTION_NAME, CLOUD_SQL_DB_USER, CLOUD_SQL_DB_PASS, CLOUD_SQL_DB_NAME
since the July credit repricing added userRepository/creditService (Cloud SQL) to the handler without declaring secrets: [...CLOUD_SQL_SECRETS] in its onCall options — the deployed revision has zero CLOUD_SQL_* env vars. Client surfaces this as Failed to summarize conversation context: FirebaseError: INTERNAL.

• Adds the secrets binding (matching wikiLlm et al.)
• Regression test asserts the endpoint manifest carries all four secret bindings
• Audited all function files: only summarizeText had the gap

2. Chat WebSocket first-message timeouts

First message after idle hit the 5s WS connect timeout while the cloud-agent Cloud Run instance cold-started (~7.5s observed; server logs show the 101 upgrade succeeding after the client gave up). Every fresh session stalled 5s then fell back to HTTP.

• Connect timeout 5s → 10s (covers observed cold start)
• 60s circuit breaker after transport-level WS failures: WS-blocked networks pay the connect wait once per window, then go straight to HTTP
• Rejected racing WS+HTTP in parallel: both paths execute the agent, double credit spend

Test plan

• functions: 350/350 pass (incl. new secrets-binding regression test)
• client: cloudAgentService 24/24 (incl. new cooldown + fake-timer connect-timeout tests), useAIChat 26/26
• typecheck clean both packages
• post-deploy: verify prod summarizeText returns 200 and first chat message of a fresh session streams over WS

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: be77ed13-ff4d-4501-b506-6d8f9cf31019

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Production fixes to address (1) summarizeText callable failures in prod due to missing Cloud SQL secret bindings and (2) chat WebSocket cold-start/blocked-network first-message timeouts by increasing the connect timeout and adding a retry cooldown to avoid repeated slow WS attempts.

Changes:

• Bind CLOUD_SQL_SECRETS to the summarizeText callable’s onCall options and add a regression test verifying the secret bindings are present in the endpoint manifest.
• Increase WebSocket connect timeout to 10s to cover Cloud Run cold starts and add a 60s cooldown after transport-level WS failures to avoid paying the connect wait on every message.
• Add Jest coverage for the WS cooldown behavior and the new 10s connect-timeout fallback behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/services/cloudAgentService.ts	Increase WS connect timeout; add transport-failure cooldown to prefer HTTP after WS connect failures.
tests/cloudAgentService.test.ts	Add tests covering WS cooldown behavior and 10s connect-timeout fallback.
functions/src/summarizeText.ts	Add Cloud SQL secret bindings to the callable function configuration.
functions/src/summarizeText.test.ts	Add regression test asserting the callable endpoint declares all Cloud SQL secret bindings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[equationalapplications]

/fix-pr follow-up

Commit: 84e9e8af3c6a1dbf095716ec6fcbc8af53c73617

Review resolution

• Copilot: authTimeout var name confusing vs real auth-timeout path (src/services/cloudAgentService.ts:270) — Fixed: renamed timer to connectTimeout at all 5 sites (declaration + 3 clearTimeout calls + assignment). Real auth-timeout path ('WebSocket auth timeout' string on close code 4001) is unaffected — separate code path, no variable collision.

Verification

• typecheck — pass (tsc --noEmit -p . client, npm run typecheck functions)
• lint — pass (npx expo lint --fix, no changes)
• tests — pass: client 121/121 suites, 983/983 tests (npm test); functions 350/350 (npm test)