Uh oh!
There was an error while loading. Please reload this page.
fix(cli): edge and cosmetic parity sweep from the 2026-07-24 audit (CLI-1990) - #5978
Conversation
…LI-1990) Batch of small confirmed Go-parity divergences, each verified against apps/cli-go before fixing: Output/colour - functions delete/deploy: Aqua slug/ref and Bold bundling slug + No-Functions dir, with stdout-gated colour where the line is stdout-bound (delete.go:20, deploy.go:35,70, bundle.go:30) - encryption update-root-key: Aqua'd Finished line; removed the comment inventing a render-Aqua-as-plain convention (update.go:26) - start rollback: print "Stopping containers..." to stderr (docker.go:97 via start.go:77) - --debug prune reports: Pruned containers/volumes/network lines on stderr from legacyDockerRemoveAll, threading LegacyDebugFlag through stop/start (docker.go:123-143; "network" singular) - per-retry image-pull banner: Retrying after 4s/8s: <image> (docker.go:312-314) - inspect db blocking: backtick-wrap blocking_statement (col 2) like Go's row format (blocking.go:56) - seed buckets: mutex group bracket keeps Go's registration order [local linked] (cmd/seed.go:32, cobra flag_groups.go:73) Input handling - snippets download: accept google/uuid Parse's 4 forms incl. the braced-form s[1:] quirk, canonical lowercase into the URL, Go's three error branches verbatim (download.go:15-19, uuid.go:68-117) - storage cp: reject negative --jobs with pflag's uint error template; keep the documented 0->1 clamp (cmd/storage.go:107) - postgres-config: strconv.ParseBool's exact case-sensitive set, int64-overflow falls back to the verbatim string, and the pretty table renders numbers with Go's %+v float64 formatting via the hoisted legacyGoFormatFloat (update.go:41-49, get.go:32-35) Filesystem modes (Go pins them; Node defaulted) - init templates 0644/0755, test new 0644/0755, inspect report 0755/0644, login fallback dir 0700 -> Go's 0755 (token stays 0600) Misc edges - migration new: print the Created line even when the stdin copy fails (Go's deferred Println, new.go:24-28), stdout-gated Bold - telemetry state: all-or-nothing decode like Go's decodeState -- a partially-corrupt file recreates everything fresh (state.go:87-115) - services: warn failed to load project ref on a ref-file read error and continue unlinked (services.go:18-20) - db dump: --file "" means stdout, no Dumped-schema line (dump.go:20-32, cmd/db.go:152-159) Fixes CLI-1990
Coly010
commented
Jul 28, 2026
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:e2fbd7309a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…ell stays plain (review: shared delete/deploy styling)
…o's pflag uint (review: cp.command.ts thread)
…ules, not Date.parse (review: telemetry state thread)
Coly010
commented
Jul 29, 2026
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c5f2e4ddec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…tead of an as cast (review: telemetry typing thread)
…eploy error (review: deploy.ts styling thread)
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@3ad0990131236d176260c5b708fee94f7283b3a2Preview package for commit |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:8bf2f29488
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…state (review: telemetry RFC3339 thread)
…eUint (review: --jobs unsigned thread)
…rse (review: UUID byte-length thread)
Coly010
commented
Jul 29, 2026
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:0d1aace4ea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…rconv (review: jobs %q thread)
…p parse (review: session rotation thread)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c2e22b9a1b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
…0-edgecosmetic-parity-sweep-from-the-2026-07-24-audit
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c2afec1f10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
…0-edgecosmetic-parity-sweep-from-the-2026-07-24-audit
…Go's single-shot unmarshal (review: codex)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c5890a9334
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…0-edgecosmetic-parity-sweep-from-the-2026-07-24-audit Resolves the semantic conflict with #5976: the new prune stdout helper now uses the renamed legacyContainerRuntimeNotFoundMessage constant (ci: Check code quality, Run unit and integration tests)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:33ddb2e80d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:54855da07a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:74a24b29c1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Coly010
commented
Jul 30, 2026
@codex review |
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…0-edgecosmetic-parity-sweep-from-the-2026-07-24-audit
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c41f37bd21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Coly010
commented
Jul 31, 2026
@codex review |
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
kanadgupta
left a comment
There was a problem hiding this comment.
One parity note + a DRY suggestion per Claude — LGTM otherwise!
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
…ent bug (CLI-1990) legacy-identity-stitch.ts maintained its own tolerant per-field telemetry.json parser instead of reusing readExistingState's identical decode, and its boolField(prior, "enabled") ?? true fallback treated a consent:"denied" file (no enabled key) as enabled:true. Export readExistingState/PriorState from legacy-telemetry-state.layer.ts and reuse it, deleting the duplicate scan and field pickers along with the now-unused legacyTelemetrySchemaVersionToken helper.
…LI-1990) Go's deploy.go:70 does strings.Join(slugs, ", ") over the raw CLI-arg slugs, so a duplicated slug argument prints twice. The TS port deduped before printing, dropping the duplicate. Join the raw slugs array for the printed line; the deduped uniqueSlugs set is still used for the actual deploy work.
Uh oh!
There was an error while loading. Please reload this page.
…audit (CLI-1967) (supabase#6074) ## What Doc/comment-accuracy sweep from `apps/cli/docs/go-parity-audit-2026-07-24.md` §6 (untracked locally, not part of this repo). No runtime behavior changes — every item below was independently re-verified against current Go (`apps/cli-go/`) and TS source before fixing, since the audit is 12 days old and several items had drifted further in that time (in both directions). ## Fixed - **`docs/go-cli-porting-status.md`** — `functions list` legacy-shell status `wrapped` → `ported` (verified: zero `LegacyGoProxy` refs). `functions download` status corrected the other way, `ported` → `wrapped` (its handler still delegates wholesale via `LegacyGoProxy` for the default `--use-docker` path; only `--use-api` is native — noted as a hybrid in the row). Added a `ported` definition to the legacy-status legend (it only defined `wrapped`/`missing`, despite `ported` being ~90% of rows) and retitled that section from "Legacy Shell Wrapping Status" to "Legacy Shell Command Status" to match. Fixed the adjacent `functions delete/deploy/list/new/serve` legacy-shell notes, which all still said "Wrapped in legacy shell" despite being natively ported. - **`legacy-pgdelta.seam.service.ts`** — fixed two stale doc comments (`execInherit`, `ensureLocalDatabaseStarted`) that referenced things as "not yet ported" when they now are (`db reset`, `start`/`db start`). Did **not** touch `exportCatalog`'s doc comment / `LegacyCatalogMode`, which the audit also flagged — that exact hunk is already being rewritten more completely by the in-flight CLI-1959 PR (supabase#6061, open); fixing it here would guarantee a conflict with a strictly better version. `legacy-db-bootstrap.seam.service.ts` (the audit's other named file) was checked and found already accurate — CLI-1954/1955 (native `db start`/`db reset --local`) are still unmerged, so its "not yet ported" claim is currently true. - **`network-restrictions/{get,update}/SIDE_EFFECTS.md`** — the `-o {json,yaml,toml,env}` sections previously implied Go itself produces distinct byte-identical output per format. Verified against Go source: `restrictions/get`/`update` never read `OutputFormat` at all — they always print the same 3-line `fmt.Printf` template regardless of `-o`. Corrected both docs to state this plainly, documented that TS's format-specific output here is a deliberate TS-only enhancement with no real Go behavior to match (including no Go casing convention, since TS uses the map-shaped encoders rather than CLI-1975's struct-spec ones), and trimmed the resulting repetition. - **`inspect/report/SIDE_EFFECTS.md`** — added the empty/no-file divergence on `COPY` failure: Go's `copyToCSV` opens the output file with `O_TRUNC` before running the query, so a failing query still leaves a file (empty or partial); TS buffers in memory and only writes on success, leaving no file on a fresh run — and leaving the *previous* run's stale CSV in place on a same-day re-run (the more consequential case). Cross-referenced from `legacy-db-connection.errors.ts`'s `LegacyDbCopyError` doc comment, which already covered the message-text angle of the same divergence. - **`domains.cname.ts`** — the comment describing Go's CNAME "failed to locate" error dump wrongly implied Go embeds readable JSON. Verified against Go source and empirically (compiled the equivalent locally): Go JSON-marshals the answers to a `[]byte`, then formats that `[]byte` with `%+v`, which Go's `fmt` renders as an uncapped decimal byte-value array, not the JSON text — a `%+v`-on-`[]byte` footgun, not an intended format. Fixed both the function's JSDoc and the inline comment (they'd contradicted each other after an earlier pass), and cross-referenced the divergence from `domains/SIDE_EFFECTS.md`. - **`branches/orgs/projects/secrets` SIDE_EFFECTS `-o toml`/`-o yaml` claims**, **`functions deploy`'s `NPM_AUTH_TOKEN` env table entry**, and **`update-root-key.handler.ts`'s color comment** — all already fixed by CLI-1975 (supabase#6002), CLI-1985 (supabase#6005), and CLI-1990 (supabase#5978) respectively, which merged after the audit ran. Verified current state matches; no changes needed. - **`start/SIDE_EFFECTS.md`'s `--ignore-health-check` ruling** — already fully handled by CLI-1987 (supabase#6007, merged), whose own description explicitly says CLI-1967 should not re-document it. Left untouched. ## Left as noted, not fixed (out of scope for a docs-only pass) - The `network-restrictions get`/`update` TS-only `-o` support is a real, pre-existing behavioral divergence from Go (Go has no such behavior at all for these two commands) — documented accurately here, but whether it should be *removed* to enforce strict parity is a ruling this PR doesn't make. - `docs/go-cli-porting-status.md`'s "Functions" section (next/-shell table) has a larger, pre-existing inaccuracy discovered while fixing the adjacent legacy-shell notes: it claims there's "still no dedicated `functions` CLI surface" in `next/`, but `next/commands/functions/` already exists (list/delete/deploy/download/new/dev, registered in `next/cli/root.ts`). Added command-path links and flagged the section as needing its own flag-by-flag parity audit rather than silently reclassifying rows without one. Fixes CLI-1967
Batch sweep of the small confirmed edge/cosmetic Go-parity divergences from the 2026-07-24 audit. Every item was re-verified against
apps/cli-goat current develop before changing anything (audit line numbers were stale); several items turned out to be already fixed or in-flight in other PRs and are listed as such.Fixes CLI-1990 — https://linear.app/supabase/issue/CLI-1990/edgecosmetic-parity-sweep-from-the-2026-07-24-audit-batchable-tail
Item-by-item
functions deleteline colourdelete.go:20)functions deploysuccess ref Aqua,Bundling Function:bold,No Functions specified…bolddeploy.go:70,35,bundle.go:30; stdout-gated where stdout-bound• <bold>c4b45874supabase start is not running.AquaassertLocalDbRunninghunk inshared/functions/serve.ts; one-liner to do after it mergesencryption update-root-keyFinished line + bogus commentStopping containers...DockerRemoveAllwriter on the start-failure path (start.go:77)--debugPruned …reportsPruned containers:/volumes:/network:(singular network)[a b c]on stderr; prune stdout now collected (also removes a latent unread-pipe hazard);LegacyDebugFlagthreaded through stop/start/rollbackRetrying after Ns: <image>banner4s/8sper Go's2<<(i+1)schedule (docker.go:314); the failed attempt's error line is played by the already-teeddocker pullstderrinspect db blockingbacktickblocking_statementblocked_statement) stays bare per Go's format string (blocking.go:56)seed bucketsmutex bracket[local linked]legacy-db-target-flags.ts(storage's[linked local]stays correct)snippets download4 UUID forms + lowercase URLuuid.Parseport incl. the braced-forms[1:]quirk; canonical lowercase interpolated into the URL; Go's three error branches verbatimstorage cp --jobsnegative rejectioninvalid argument "-1" for "-j, --jobs" flag: strconv.ParseUint: …), before mutex validation and without telemetry; the documented0 → 1clamp stays (Go's 0 deadlocks)postgres-configvalue coercion +%+vfloatsParseBoolcase set; int64-overflow → verbatim string; pretty table renders numbers with Go's float64%g(1000000→1e+06) via hoistedlegacyGoFormatFloat(also reused bydb query)access_token.go:91); the token file stays 0600, so no secret exposuretest new0644utils.WriteFileinspect report0755/0644resolveLegacyAccessTokendeliberately collapses invalid→Nonefor many callers (sso, snippets, postgres-config, …); distinguishing invalid-vs-missing needs a shared-semantics changemigration newCreated line on stdin-copy failurePrintln(new.go:24-28); also stdout-gates the Bold path (CLI-1546 class)decodeState; a corrupt file resetsenabledto true and rotates identity, exactly like Gofailed to load project ref: …on a read error and continues unlinked (TOCTOU NotFound stays silent, like Go'sErrNotLinkedbranch)domainsCNAME dump byte codes%+vis a runtime pointer address forValidationErrors, not byte codes; TS's deterministic rendering is already documented indomains.format.ts--domains=explicit-emptysso updatealready matches Go (len-check drops it); theaddfix touchessso/add/add.handler.ts, in-flight in open PR #5974db dump --file ""len > 0like Go: empty means stdout, no file open, noDumped schema to …linePersistentPreRunE; aligning overlaps open PR #5975 (incl. its integration test file). TheSIDE_EFFECTS.mdnote frames this as intended based on an incomplete Go reading — worth revisiting after #5975Known residuals (deliberate, documented in code)
postgres-configdigits in(2^53, 2^63)still lose precision on the way in (JSON.stringifycannot emit exact int64 tokens); Go sends exact integers there. Values beyond int64 now match Go (string fallback).legacy-colors.ts/CLI-1546 convention), whereas Go's lipgloss gates everything on stdout. Deliberate, pre-existing convention; only observable when exactly one of stdout/stderr is a TTY.util.styleTextcurrently ignoresvalidateStream/NO_COLOR(verified on Bun 1.3.x), so under Bun piped output still carries ANSI for all legacy colour sites — a pre-existing runtime gap that predates this PR and deserves its own issue.*PathErrorbytes — thefailed to load project ref:prefix is the parity-bearing part.--jobs abc/3.5still surface Effect CLI's parser error rather than pflag's; this PR scopes to negatives (the only caseFlag.integeraccepts that Go rejects).Review notes
Four-perspective review (architect / engineer / security / DX) run pre-PR; all approve. Engineer fuzz-verified
legacyGoFormatFloat(23k values) andlegacyParseSnippetUuid(~8k inputs) byte-identical to Go/google-uuid. Security signed off on the 0700→0755 fallback-dir change (token file unchanged at 0600, matches Go exactly). Remaining findings were the documented residuals above.