fix(cli): keep TLS under --debug

[7ttp]

TL;DR

--debug silently disabled TLS on every database connection

Problem

debug.SetupPGX nulled config.TLSConfig so
its wirelogging proxy could read plaintext frames. It runs after sslmode resolution, so --debug overrode an explicit ?sslmode=require with no warning, sent the session unencrypted, and failed with no pg_hba.conf entry ... no encryption on SSL-enforcing projects that worked fine without the flag.

Still live on the TS shell:
which forwards --debug to the Go binary for migration squash, db test, db remote commit|changes and bootstrap's push step.

Sol:

The proxy now does libpq's SSLRequest handshake itself with the tls.Config pgx resolved,
then hands pgx an in-memory pipe. It has to own TLS because DialFunc sits below it, which is why the original just nulled it.

Frames decrypt in process, the socket stays encrypted, verification is unchanged, and a refusal fails the dial instead of continuing in plaintext....

Also drops the now false SSL connection is not supported with --debug flag hint from both shells.
It was never true in TS, where --debug has never disabled TLS.

Ref

• Fixes--debug silently disables TLS on database connections (SetupPGX sets TLSConfig = nil), overriding sslmode=require and PGSSLMODE #5872
• Related sslmode from --db-url is dropped when the connection config is round-tripped through ToPostgresURL() #5873 via fix(cli): honor --db-url sslmode #5980

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:34b6f68883

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:e0ba327500

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:99bbeea957

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Coly010]

From Claude:
🔴 Real bug this PR leaves behind: gen types still suppresses the CA bundle under --debug

apps/cli/src/legacy/commands/gen/types/types.handler.ts:429:
const useTls = yield* sslProbe.requireSslForHost(target.probeHost, target.probePort);
if (useTls && !debug) {
env.push(PG_META_DB_SSL_ROOT_CERT=${legacyRootCaBundle()});
}
Go's GetRootCA (apps/cli-go/internal/gen/types/types.go:93-97) calls isRequireSSL, which this PR changes to no longer special-case --debug (require := true unconditionally on a successful probe). So post-fix, Go's gen types --debug now does inject PG_META_DB_SSL_ROOT_CERT when the server requires TLS. The TS mirror still has the old && !debug guard, which the PR forgot to remove — a stale assumption from the very behavior this PR fixes. The result: supabase gen types --debug --linked (or any SSL-requiring target) now diverges from Go, and the accompanying pgmeta subprocess loses its CA bundle in TS. This is even locked in by a test: types.integration.test.ts:2886, "omits the CA bundle env var in --debug mode even when TLS is supported", which needs to be inverted.

Fix is small: drop the && !debug on line 429, and since debug (types.handler.ts:195, const debug = yield* LegacyDebugFlag;) is used nowhere else in the file, remove that binding and the now-unused LegacyDebugFlag import too.

Worth double checking the validity of this claim