chore(repo): sync develop into next by supabase-cli-releaser[bot] · Pull Request #7128 · supabase/cli

supabase-cli-releaser · 2026-10-13T14:52:37Z

Merging develop into next conflicts. This branch starts at the tip of develop (6baa653); next is at 3a16e2b.

Conflicting files:

apps/cli/src/command-internal/db-pull-run.ts
apps/cli/src/commands/db/pull/SIDE_EFFECTS.md
apps/cli/src/commands/db/pull/pull.integration.test.ts
apps/cli/src/commands/domains/SIDE_EFFECTS.md
apps/cli/src/commands/domains/activate/activate.integration.test.ts
apps/cli/src/commands/domains/create/create.integration.test.ts
apps/cli/src/commands/domains/delete/delete.integration.test.ts
apps/cli/src/commands/domains/get/get.integration.test.ts
apps/cli/src/commands/domains/reverify/reverify.integration.test.ts
apps/cli/src/telemetry/linked-project-cache.integration.test.ts

To resolve:

git fetch origin
git switch sync/develop-into-next
git merge origin/next
# resolve the conflicts, then commit
git push origin sync/develop-into-next

Approve to fast-forward next; do not use the merge button.

Adds `.github/ai-models.json`, which holds model ids keyed by family and tier (`claude.opus`, `claude.sonnet`, `claude.haiku`, `codex.sol`). Bumping a tier there upgrades every consumer of that tier. - `ai-review.yml` drops the hardcoded `CLAUDE_MODEL` / `CODEX_MODEL` workflow env. The `resolve` job reads both from the trusted default-branch copy and passes them to the other jobs as outputs, so a PR can't change the model that reviews it and every job in a run uses the same models. - `sync-branches.yml` and `sync-repair.yml` read `claude.opus` from the file instead of pinning it. - `propose-release-notes.ts` imports the file and defaults `--model` to `claude.haiku`. The file is listed as release infrastructure in `release-process.md`, so a model change there may need porting to active `v*.x` lines. A model bump can still need the Claude Code or Codex CLI version pinned in these workflows bumped too; the file's `$comment` says so. The review reads the file from `develop`, so the AI review on this PR fails at `resolve` until it merges. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Sync repair filtered AI Review completions with `workflow_run.name == 'AI Review'`, but `ai-review.yml` sets `run-name: AI Review #<pr>`, so `workflow_run.name` never matched. When the AI review finished after CI, repair skipped and only the hourly cron could restart it (seen on #7112). The filter now matches on the workflow file path. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Summary **TL;DR** When the new local stack fails because a container engine command failed, telemetry now says which step failed (create, start, inspect, engine target lookup, remove, or wait) instead of one shared `engine_command` fingerprint. Recent prereleases surface `engine_command` as the main cause of Docker `start` failures on Linux, but not which Docker call breaks, so the failure couldn't be narrowed down further. ### Before ```mermaid flowchart LR A["docker create / start / rm / ..."] -->|fails| B["ContainerError<br/>operation"] B --> C["kind engine-command"] C --> D["…:engine_command"] ``` ### After ```mermaid flowchart LR A["docker create / start / rm / ..."] -->|fails| B["ContainerError<br/>operation"] B --> C["kind engine-create,<br/>engine-start, …"] C --> D["…:engine_command_create,<br/>…:engine_command_start, …"] ``` ### What changed - `@supabase/stack` classifies a `ContainerError` with no finer cause by its engine operation: - `engine-create` ← `create` - `engine-start` ← `start` - `engine-inspect` ← `inspect`, `image`, `ps` - `engine-target` ← `info`, `system`, `context`, identity and connection checks - `engine-remove` ← `rm`, `stop`, `kill`, cleanup - `engine-wait` ← `wait` Any other operation stays `engine-command`. - The CLI maps each new kind to an `engine_command_<step>` fingerprint suffix. The category stays `runtime_crash`, so category-level grouping is unchanged. - The kind already travels as an open string on every owner/client boundary, so there is no wire or schema change. A client that doesn't know a new kind reports it as unclassified, as it does today for any unknown kind. ## Linked issue None. Telemetry follow-up to the stack failure classification in #7044. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Summary Scoped personal access tokens let a user pick exactly which permissions a token gets, so the CLI needs to say which permissions each command requires. This continues the mapping work from the command permission model; see [CLI-2474](https://linear.app/supabase/issue/CLI-2474/proposal-derive-and-document-the-management-api-scopes-each-cli). ## What's in this PR - Reusable permission building blocks for the Management API calls made by shared modules rather than command handlers: the DB config resolver, project ref picker, linked-project cache, link services, storage credentials, project API keys, upgrade suggestion, branch ref and target lookups, the login profile lookup, and linked service versions. Many commands reach these modules, so each is mapped once and included by the commands that use it instead of being repeated in every declaration. Each block lives next to the module whose calls it describes. - An integration test per block that runs the real module and checks the requests it makes against the block, so the mapping can't drift from the code. Command tests replace these modules with fakes, so they wouldn't catch it. Each best-effort call also has a 403 case showing the module's result survives, and the drift check verifies `request.query` qualifiers against the recorded requests. - Model additions the blocks needed: - `{ flag, is }` tests a switch by its effective value, so `--skip-pooler=false` is distinguished from omitting it. A flag given an empty value counts as absent. - `{ dbTarget }` conditions with `withDbTarget` select on the database a run targets: `--db-url`, then `--local`, then `--linked`, then the command's default. The DB config block applies only on the linked target. - `withKind` lets a command override a block's required or best-effort label. - `request.query` records request details such as `reveal=true` as data. The blocks live in shipped modules and run `block()` when those modules load, which adds a small amount of declaration data to the bundle and changes nothing else at runtime. No command includes them yet; later PRs map the commands that do. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

…og tail (#7120) ## Summary The sync repair agent only received the last 150 lines of each failed CI job. Turbo interleaves package output, so on #7112 the failing CLI integration test landed mid-log, behind the `@supabase/stack` output, and the agent reported it could not see the failure. `failureExcerpt` now keeps 40 lines after every `##[error]` annotation and vitest `FAIL` header, plus the existing tail, with ANSI codes and timestamps stripped. Gaps are marked with `[...]`. ## Linked issue - [x] I'm a Supabase maintainer. ## Checklist - [x] The PR title follows Conventional Commits. - [x] Tests added or updated for the change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Summary Approving a sync PR required its branch to contain the latest source tip (`develop` for `sync/develop-into-next`). A sync PR stays open while `develop` keeps moving, so any new conflict sent it back to a human, as on #7112 (comment). - When only the source moved, the fast-forward job now lands the approved head that CI tested. - When the target moved, it merges only the latest target into the approved head. A conflict there still asks for re-approval. - Newer source commits arrive with the next `Sync branches` run, on the next push to the source. The release-process doc is updated to match. ### Before ```mermaid flowchart LR A[sync PR approved] --> T{next moved?} T -- no --> S{develop moved?} S -- no --> F[fast-forward next] S -- yes --> M T -- yes --> M{merge latest next + develop cleanly?} M -- yes --> L[land merged head] M -- no --> H[human resolves conflict, re-approves] ``` ### After ```mermaid flowchart LR A[sync PR approved] --> T{next moved?} T -- no --> F[fast-forward next to approved head] T -- yes --> M{merge latest next cleanly?} M -- yes --> L[land merged head] M -- no --> H[human resolves conflict, re-approves] F --> D[next develop push: Sync branches brings the rest] L --> D ``` ## Linked issue - [x] I'm a Supabase maintainer. ## Checklist - [x] The PR title follows Conventional Commits. - [x] Tests added or updated for the change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

The macOS native-scenarios job is the longest job in the Test workflow, about twice any other. Most of it is `native: parallel stack isolation`, which starts two full native stacks at once and is starved on the standard `macos-latest` runner: it takes roughly 2x longer there than on the 8 vCPU Linux native job running the same test. Sharding the scenario files did not help (#7121), since Vitest already ran both files concurrently. This moves the job to the 6 vCPU Blacksmith macOS runner (`blacksmith-6vcpu-macos-latest`) so the two stacks get enough CPU and memory, keeping full macOS coverage. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…LI-2599) (#7115) ## Summary Stable now warns on stderr for every flag that CLI-2596 removes in v3. Each warning names the replacement and says the flag goes away in v3. | Flag | Warning | | -- | -- | | `domains create\|get\|reverify\|activate\|delete --include-raw-output` | `Flag --include-raw-output is deprecated and will be removed in v3, use -o json instead.` (new, previously help text only) | | `db pull --use-pg-delta` | `Flag --use-pg-delta is deprecated and will be removed in v3, use --declarative with [experimental.pgdelta] enabled = true in your config.toml instead.` (reworded) | | `db pull --experimental` (structured dump) | ``The --experimental structured-dump mode for `db pull` is deprecated and will be removed in v3. Use --declarative instead to pull the remote schema as per-object files.`` (reworded) | - The domains warning fires only when the flag is set. It goes to stderr, so `-o json` / stream-json stdout is unchanged. - There are no other behaviour changes. `--include-raw-output` still forces JSON output, and it is still inert on `delete`. - Flag-level usage over the last 30 days is low: `--include-raw-output` 2 runs from 1 person, `--use-pg-delta` 47/30, `--experimental` 17/9. The numbers are on CLI-2596. The removal itself is in a separate PR against `next`. ## Linked issue Closes CLI-2599 ## Checklist - [x] The PR title follows Conventional Commits. - [x] Tests added or updated: each domains command's integration test covers the warning with and without the flag, and the db pull tests assert the new wording. - [x] `pnpm check:all` passes. The apps/cli unit and integration suites pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

…7106) ## Summary Scoped personal access tokens let a user pick exactly which permissions a token gets, so the CLI needs to say which permissions each command requires. This maps the first commands onto the permission model; see [CLI-2474](https://linear.app/supabase/issue/CLI-2474/proposal-derive-and-document-the-management-api-scopes-each-cli). ## What's in this PR - Permission declarations for `secrets list`, `snippets list` and `db query`, built from the shared building blocks (project ref picker, linked-project cache, DB config). `db query` selects its Management API call by database target, defaulting to local. These three work as the worked example for mapping the remaining commands. - Each command's integration test checks the requests it records against its declaration, so the mapping can't drift from the code. The tests also run the commands through the real linked-project cache layer, and `secrets list` through the project picker, so a block dropped from a declaration fails a test. - `assertBlockDrift`, a drift check for building blocks that takes its label from the block instead of a made-up command name. The existing block tests use it, and `permission-drift.ts` has callers now, so its `knip` entry is gone. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

# Conflicts: # apps/cli/src/command-internal/db-pull-run.ts # apps/cli/src/commands/db/pull/SIDE_EFFECTS.md # apps/cli/src/commands/db/pull/pull.integration.test.ts # apps/cli/src/commands/domains/SIDE_EFFECTS.md # apps/cli/src/commands/domains/activate/activate.integration.test.ts # apps/cli/src/commands/domains/create/create.integration.test.ts # apps/cli/src/commands/domains/delete/delete.integration.test.ts # apps/cli/src/commands/domains/get/get.integration.test.ts # apps/cli/src/commands/domains/reverify/reverify.integration.test.ts # apps/cli/src/telemetry/linked-project-cache.integration.test.ts

depthfirst-app · 2026-10-13T14:56:40Z

+    // Turbo prefixes each line with its task name when it streams several packages.
+    if (windows < MAX_ERROR_WINDOWS && /^(\S+:\s)?\s*(##\[error\]|FAIL\s)/.test(line)) {
+      windows += 1;
+      for (let at = index; at < Math.min(index + ERROR_CONTEXT_LINES, lines.length); at += 1) {


⚪ Severity: LOW

A failing check can print attacker-controlled text after FAIL or ##[error]; this copies 40 following log lines into the repair agent's context. An injected directive can make the model mark an unresolved AI finding fixed, and Publish uses that result to resolve the GitHub thread, suppressing a security-review signal.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Treat the CI failure excerpt as untrusted data, not as instructions. Where ci-failures.md is built or interpolated into the repair agent's prompt, wrap the excerpt in a clearly delimited block, such as a fenced block with a random nonce. Tell the model to ignore any directives inside it. Strip or neutralize control sequences and any text that imitates prompt structure. Do not let model output alone decide whether a finding is resolved. Before Publish resolves a GitHub review thread, check independently that the originating check now passes or that the code changed as expected. Keep the log excerpt limited to what the model needs to diagnose the failure. Most of these changes belong where the prompt is assembled and where Publish resolves threads, not at line 623.

supabase-cli-releaser · 2026-10-13T14:59:07Z

Claude resolved the merge of `next`

I resolved all 10 conflicted files and no conflict markers remain. Develop's runtime deprecation warnings for --include-raw-output and its permission-drift assertion survive. Next's reworded --use-pg-delta message, its removal of db remote commit, and its renames (goOutput → outputFlag, no more "Go" wording) also survive. No commands were run; the job's check:all and unit tests have not happened yet.

File	Resolution
`apps/cli/src/command-internal/db-pull-run.ts`	Kept next's shorter `--use-pg-delta` deprecation text ("has been deprecated, use --declarative instead."). The rest of the file merged cleanly.
`apps/cli/src/commands/db/pull/SIDE_EFFECTS.md`	Took next's `--use-pg-delta` note. Because that line no longer mentions v3, I changed "(both name v3)" to "(which names v3)" so it refers only to the `--experimental` line.
`apps/cli/src/commands/db/pull/pull.integration.test.ts`	Dropped the `db remote commit` describe block because next removed that command. Updated develop's `--use-pg-delta` test to expect next's deprecation text.
`apps/cli/src/commands/domains/SIDE_EFFECTS.md`	Kept develop's bullet about the `--include-raw-output` deprecation warning and used next's "Notes" wording without Go references. Removed next's claim that the flag prints no warning, since develop added one.
`apps/cli/src/commands/domains/activate/activate.integration.test.ts`	Kept develop's deprecation tests: the warning appears on stderr, stdout stays parseable JSON, and `--include-raw-output=false` still warns.
`apps/cli/src/commands/domains/create/create.integration.test.ts`	Kept develop's deprecation tests (same set as activate).
`apps/cli/src/commands/domains/reverify/reverify.integration.test.ts`	Kept develop's deprecation tests (same set as activate).
`apps/cli/src/commands/domains/delete/delete.integration.test.ts`	Kept develop's tests that the flag is inert on `delete` apart from the warning. Switched the `goOutput` setup option to next's `outputFlag` name.
`apps/cli/src/commands/domains/get/get.integration.test.ts`	Kept develop's deprecation tests. Used next's version of the explicit `-o pretty` test (`outputFlag`, no "Go" in the name), changed to pass `includeRawOutput: Option.some(true)` to match develop's Option-typed flag.
`apps/cli/src/telemetry/linked-project-cache.integration.test.ts`	Used next's un-nested test layout and added develop's request-count and `assertBlockDrift` checks into it.

Decisions for @supabase/cli. Confirm them, or push a change to this branch:

Which --use-pg-delta deprecation text should db pull print: develop's ("will be removed in v3, use --declarative with [experimental.pgdelta] enabled = true…") or next's ("has been deprecated, use --declarative instead.")? Chose: Next's text. It is the next-major wording, and saying "will be removed in v3" inside v3 would be wrong. I updated the doc and the integration test to match.
Should develop's --include-raw-output runtime deprecation warning be kept, even though next's docs say the flag prints no warning? Chose: Kept develop's warning and its exact text from domains.deprecation.ts, including "will be removed in v3". A maintainer may want to reword it for the next major the same way --use-pg-delta was.

Quick checks. pnpm run check:all --continue (exit 1) failed on the merged tree.

Claude's fix. I fixed the two merge-related failures in knip and types:check. permission-real-layers.ts now imports DebugLogger from its new home in src/shared/output/. storage-credentials.integration.test.ts no longer passes the removed config argument and now provides cliConfigValuesTestLayer, which resolveStorageCredentials requires because it now loads the config itself.

Approve to fast-forward next once checks pass (workflow run).

github-actions

🤖 AI Review

Both independent reviews completed; Codex reported no findings. Code inspection confirms Claude’s minor merge-resolution finding: the sync replaces version-neutral deprecation wording with “removed in v3” on the v3 release train while retaining both deprecated paths. Tests were not executed.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	`apps/cli/src/command-internal/db-pull-run.ts:108`	`merge-resolution`	claude	The sync regresses next’s version-neutral deprecation warning to “will be removed in v3” and introduces the same wording for domains --include-raw-output. This gives misleading removal guidance on the v3 release train, where both deprecated paths remain supported.

Stats

Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

supabase-cli-releaser · 2026-10-13T15:07:26Z

Claude repair round

I fixed two semantic conflicts. next's DB config resolver now needs CliConfigValues, but develop's new realDbConfigResolver test helper didn't provide it, which broke the type check and the db query integration test; the helper now provides it. next's flag binding drops an empty --password, so the resolver now treats an explicitly empty --password as a request for a temporary login role again, which is the behaviour develop intended.

1 findings fixed, 0 declined (workflow run).

avallete and others added 9 commits October 13, 2026 10:37

supabase-cli-releaser Bot requested a review from a team as a code owner October 13, 2026 14:52

supabase-cli-releaser Bot added the do not merge Approve to apply; do not merge. label Oct 13, 2026

supabase-cli-releaser Bot requested a review from supabase-oss as a code owner October 13, 2026 14:52

supabase-cli-releaser Bot added the do not merge Approve to apply; do not merge. label Oct 13, 2026

depthfirst-app Bot reviewed Oct 13, 2026

View reviewed changes

chore(repo): fix the develop-into-next merge

7954e73

github-advanced-security Bot found potential problems Oct 13, 2026

View reviewed changes

Comment thread apps/cli/src/command-internal/link-services-core.integration.test.ts Dismissed

github-actions Bot reviewed Oct 13, 2026

View reviewed changes

Comment thread apps/cli/src/command-internal/db-pull-run.ts Resolved

chore(repo): repair the develop-into-next sync

66f816a

avallete approved these changes Oct 13, 2026

View reviewed changes

supabase-cli-releaser Bot merged commit 66f816a into next Oct 13, 2026
34 of 35 checks passed

supabase-cli-releaser Bot deleted the sync/develop-into-next branch October 13, 2026 15:14

Navigation Menu

Repository navigation

chore(repo): sync develop into next - #7128

chore(repo): sync develop into next#7128
supabase-cli-releaser[bot] merged 12 commits into
nextfrom
sync/develop-into-next

supabase-cli-releaser Bot commented Oct 13, 2026

Uh oh!

depthfirst-app Bot Oct 13, 2026

Uh oh!

supabase-cli-releaser Bot commented Oct 13, 2026

Uh oh!

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

supabase-cli-releaser Bot commented Oct 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

supabase-cli-releaser Bot commented Oct 13, 2026

Uh oh!

depthfirst-app Bot Oct 13, 2026

Choose a reason for hiding this comment

Uh oh!

supabase-cli-releaser Bot commented Oct 13, 2026

Claude resolved the merge of next

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🤖 AI Review

Findings

Stats

Uh oh!

Uh oh!

supabase-cli-releaser Bot commented Oct 13, 2026

Claude repair round

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Claude resolved the merge of `next`