Skip to content

feat(cli): add supabase workers new - #6261

Merged
kanadgupta merged 17 commits into
developfrom
FUNC-753/workers-new
Aug 26, 2026
Merged

feat(cli): add supabase workers new#6261
kanadgupta merged 17 commits into
developfrom
FUNC-753/workers-new

Conversation

@johnstonmatt

@johnstonmattjohnstonmatt commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds supabase workers new, plus the project layout and config.toml editing the
whole command family builds on:

  • shared/workers/ — worker path resolution, config.toml section reading and
    patching (toml-section.ts preserves surrounding formatting), the runtime/size
    envelope, and the starter files.
  • Starter files live as ordinary files under shared/workers/stacks/<runtime>/
    rather than string literals, and are embedded into the compiled binary through a
    Bun macro — the directory is expanded at transpile time and inlined.
    A completeness check inside the macro fails the build if WORKER_RUNTIMES and
    the directory drift apart.

Stack 2 of 4, on top of the config schema (#6260).

Reviewer note: the third commit is where the embedding mechanism is explained; the
starters are deliberately kept out of the type program (a deno starter is not
valid under this workspace's Bun types), which is why tsconfig.json excludes the
directory and nothing imports the files.

Linked issue

FUNC-753 (Linear). Supabase maintainer, exempt from the open-for-contribution flow.

Checklist

@johnstonmattjohnstonmatt changed the title FUNC 753/workers newfeat(cli): add supabase workers newAug 19, 2026
@johnstonmatt
johnstonmattforce-pushed the FUNC-753/workers-new branch 2 times, most recently from 3b8b0c0 to ed12377CompareAugust 20, 2026 13:13
@johnstonmatt
johnstonmatt marked this pull request as ready for review August 20, 2026 13:27
@johnstonmatt
johnstonmatt requested a review from a team as a code ownerAugust 20, 2026 13:27

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:ed12377e3d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/workers.format.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/shared/workers/worker-config.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-runtimes.ts Outdated
@github-actions

github-actionsBot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@39ae31b4f427916ae2fbbea7f0bea6216d4d9adc

Preview package for commit 39ae31b.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:673cf2bfc1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/shared/workers/toml-section.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.command.ts
Comment threadapps/cli/docs/go-cli-divergences.md Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-config.ts Outdated
Comment threadapps/cli/src/shared/workers/toml-section.ts Outdated
johnstonmatt added a commit that referenced this pull request Aug 21, 2026
…tput
Addresses the eighteen review findings on #6261.
Path confinement was string-deep only. `isAtOrUnder` compared resolved paths
lexically, so `--source` through an in-project symlink pointing outside it
passed, and `--force` deleted the external target. The reserved-directory check
was case-sensitive, so `[workers] root = "Functions"` aliased `supabase/functions`
on Windows and default macOS filesystems — enough to delete an Edge Function.
And `./.` or `services/..` were only rejected before `normalize` reduced them
to `.`, which made `supabase/` itself the workers root.
There is now one guard, `confineWorkerPath`, that answers containment on the
filesystem's terms: it canonicalizes the longest existing prefix of the target
(`realPath` fails outright on a path that isn't there yet) and the project root
with it, so a project living under a symlink still compares like for like. Both
`--source` and the `source` recorded in `config.toml` go through it — the latter
previously had no confinement at all, which is a `push` exfiltration path.
`workers new --force` could destroy a worker and leave nothing in its place.
Every way the `config.toml` edit can fail is deterministic and knowable up
front, but it was attempted after the previous directory had been removed and
the replacement starter files written. `writeWorkerEntry` is now
`planWorkerEntry` + `commitWorkerEntry`, and the handler plans before it touches
anything. A regular file at the destination is also handled: it used to read as
an empty directory, skip the removal, and fail `EEXIST`.
The textual TOML writer missed literal-quoted keys (`'runtime' = 'node'`),
appending a duplicate and invalidating the file; wrote control characters
verbatim, which a Unix path may legally contain; and could mistake a
`[workers.api]` line inside a multiline string for the table itself. The first
two are fixed, the third now refuses rather than guessing.
Also: `--source` resolves against the invocation directory rather than the
project root, matching what a shell prompt implies and the resolver's own tests;
persisted paths are normalized to forward slashes so a Windows-written
`config.toml` still works elsewhere; the auto-name and config-reuse notices moved
to stderr, since `-o json` leaves `output.format` as `text` and they were
corrupting the payload; `as` casts in `worker-config.ts` and `worker-runtimes.ts`
replaced with a record guard and predicate narrowing; decoded worker entries read
into a null-prototype record so a worker named `constructor` is not reported as
already configured; the formatter exports carry the mandatory `legacy` prefix;
and the `workers` row is out of the frozen `go-cli-divergences.md`, with the
Go-parity framing removed from the new comments, docs and helper name.
`parseWorkerRuntime`'s claim to make `--runtime Dockerfile` work was simply
false — `Flag.choice` validates before any handler runs. The comment is
corrected rather than the flag loosened; the case-insensitivity is real and
serves hand-written config values.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:66e459abca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/shared/workers/toml-section.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/shared/workers/toml-section.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
johnstonmatt added a commit that referenced this pull request Aug 21, 2026
…OML fixes
Six follow-ups on #6261, most of them incomplete corners of the previous round.
`.temp` was missing from the reserved roots. It holds CLI state — the
linked-project reference among it — and `workers new <name> --force` resolves its
destination *inside* the root, so `[workers] root = ".temp"` with a worker named
after one of those files deleted it. `--source supabase/.temp/...` reached the
same place. Both refused now.
A committed `[workers] root` written on Windows meant a different directory on
POSIX: `normalize` keeps backslashes as separators on Windows and treats them as
ordinary filename characters elsewhere, so one config targeted
`supabase/services/workers` on one machine and `supabase/services\workers` on
another. Backslashes are read as separators wherever the value was written. This
is the same class as the `--source` normalization already fixed, from the
reading side rather than the writing side.
The multiline-string guard only covered finding the header. The scan for the
table's *end* still treated any bracketed line as the next table, so a bracketed
line inside one of the table's own multiline strings truncated it early and the
new keys landed inside the user's string — the same corruption, reached from the
other end. Both ends refuse now.
`findHeader` matched only the canonical `[workers.api]`. TOML calls
`[workers."api"]`, `[workers.'api']`, `[workers . api]` and `[ workers.api ]` the
same table, and the parser that produced the decoded config agreed — so
`planWorkerEntry` decided an entry it could plainly see was dotted or inline
configuration, and refused every update to it including a safe forced
re-scaffold. Quoted dots are handled too: `workers."my.worker"` is two keys.
`--source` no longer trims whitespace. A directory name may legally end in a
space on Unix, and the shell only delivers one as a single argv entry if the user
quoted it, so trimming pointed `--force` at a neighbouring directory instead of
the one named. Only the trailing separator, which is syntax, still comes off; an
all-whitespace argument is refused rather than trimmed into something else.
`SIDE_EFFECTS.md` also now lists the profile files every invocation reads. Worth
noting this is a repo-wide gap rather than a workers one — no other command's
Files Read table mentions them either, including the canonical `backups/list` —
so a sweep across the other 99 documents would be a reasonable follow-up.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:87768d36de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/shared/workers/worker-runtimes.ts Outdated
johnstonmatt added a commit that referenced this pull request Aug 21, 2026
…machine stdout
Two more from the re-review of #6261, both gaps in the previous round rather than
new ground.
`--source supabase/config.toml --force` was authorized. Refusing `supabase/`
itself and the reserved subdirectories left the files sitting directly in
`supabase/` reachable: the path was inside the project, was not the supabase
directory, and was in no reserved subdirectory — so `--force` removed the
project's configuration and put a starter directory where it had been.
`config.toml` and `config.json` are refused explicitly now.
The prompts were still writing to stdout under `-o json`. Last round moved the
auto-name and config-reuse notices to stderr but left `promptSelect`, which goes
through Clack — and Clack writes its terminal UI to stdout with no stream
override, while `-o` leaves `output.format` as `text`. So an interactive
`workers new api -o json` with no `--runtime` rendered a selection UI in front of
the payload. With a machine format requested there is nowhere to ask, so the
defaults stand; the integration test supplies prompt answers that would be
accepted, then asserts no prompt happened and stdout parses.
Comment threadapps/cli/src/shared/workers/worker-paths.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:2de742ab4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:9e7af6c2d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/shared/workers/toml-section.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:8121432f02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/shared/workers/worker-paths.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/legacy/commands/workers/workers.output.ts
Comment threadapps/cli/src/shared/workers/worker-paths.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:26bde1bc1f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/src/shared/workers/worker-config.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:aaf882552c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.command.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
johnstonmatt added a commit that referenced this pull request Aug 21, 2026
…tput
Addresses the eighteen review findings on #6261.
Path confinement was string-deep only. `isAtOrUnder` compared resolved paths
lexically, so `--source` through an in-project symlink pointing outside it
passed, and `--force` deleted the external target. The reserved-directory check
was case-sensitive, so `[workers] root = "Functions"` aliased `supabase/functions`
on Windows and default macOS filesystems — enough to delete an Edge Function.
And `./.` or `services/..` were only rejected before `normalize` reduced them
to `.`, which made `supabase/` itself the workers root.
There is now one guard, `confineWorkerPath`, that answers containment on the
filesystem's terms: it canonicalizes the longest existing prefix of the target
(`realPath` fails outright on a path that isn't there yet) and the project root
with it, so a project living under a symlink still compares like for like. Both
`--source` and the `source` recorded in `config.toml` go through it — the latter
previously had no confinement at all, which is a `push` exfiltration path.
`workers new --force` could destroy a worker and leave nothing in its place.
Every way the `config.toml` edit can fail is deterministic and knowable up
front, but it was attempted after the previous directory had been removed and
the replacement starter files written. `writeWorkerEntry` is now
`planWorkerEntry` + `commitWorkerEntry`, and the handler plans before it touches
anything. A regular file at the destination is also handled: it used to read as
an empty directory, skip the removal, and fail `EEXIST`.
The textual TOML writer missed literal-quoted keys (`'runtime' = 'node'`),
appending a duplicate and invalidating the file; wrote control characters
verbatim, which a Unix path may legally contain; and could mistake a
`[workers.api]` line inside a multiline string for the table itself. The first
two are fixed, the third now refuses rather than guessing.
Also: `--source` resolves against the invocation directory rather than the
project root, matching what a shell prompt implies and the resolver's own tests;
persisted paths are normalized to forward slashes so a Windows-written
`config.toml` still works elsewhere; the auto-name and config-reuse notices moved
to stderr, since `-o json` leaves `output.format` as `text` and they were
corrupting the payload; `as` casts in `worker-config.ts` and `worker-runtimes.ts`
replaced with a record guard and predicate narrowing; decoded worker entries read
into a null-prototype record so a worker named `constructor` is not reported as
already configured; the formatter exports carry the mandatory `legacy` prefix;
and the `workers` row is out of the frozen `go-cli-divergences.md`, with the
Go-parity framing removed from the new comments, docs and helper name.
`parseWorkerRuntime`'s claim to make `--runtime Dockerfile` work was simply
false — `Flag.choice` validates before any handler runs. The comment is
corrected rather than the flag loosened; the case-insensitivity is real and
serves hand-written config values.
The Go baseConfig is decoded with UnmarshalExact, so any top-level key it
does not model is a hard parse error. Once the published JSON schema
advertises [workers], a hand-written section breaks every Go-delegated
path that calls flags.LoadConfig. Add an ignored Workers field so the
delegated child accepts what the TS schema accepts.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:0b1b9b3376

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts
Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts Outdated
Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/src/shared/workers/worker-paths.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:66a83831d6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/tests/helpers/legacy-workers.ts
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md Outdated
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md
The bare @supabase/config entrypoint is the pure, browser-safe surface
after CLI-2231; loadProjectConfig now lives on ./effect. Importing it
from the bare specifier broke the bun bundle and the docs-spec script.
`real._tag === "Some"` and `info._tag === "None"` couple production code to
Effect's runtime representation, which the repo guidance rules out: "Do not
inspect Effect runtime representations through fields such as `._tag` ... use
`Option.isSome`, `Option.isNone`".
Three call sites, all introduced by this command family rather than inherited:
the canonicalize walk in `worker-paths.ts`, the destination-is-free check in
`new.handler.ts`, and the scaffolded-directory scan in `workers.shared.ts`.
`isSome`/`isNone` are declared as type guards, so the narrowing that followed
each check still holds and nothing else moves.
`supabase workers new` cannot run: `name` is a required `Argument.string`, so
the parser rejects the invocation before the runtime and size prompts the
description advertises ever fire. Anyone copying the first example gets a
missing-argument error.
Left over from the generated-name design, which made the argument optional and
assigned a name when it was omitted; that was removed in "drop [workers] root,
generated names, and three other one-liners" but the example was not.
`[workers] root` was removed in "drop [workers] root, generated names, and
three other one-liners" — `[workers.<name>] source` already puts a worker
anywhere in the repo — but four references to it survived, two of them in
suggestion strings a user actually sees.
The two suggestions told users to point a config key at a directory when that
key does not exist and is not the problem. The default directory is
`supabase/workers/<name>` with an already-validated name, so it cannot be the
project root, `supabase/`, or a directory the CLI owns; a symlink escaping the
project is the only way it fails confinement. Both now name that, and offer the
escape hatch each caller actually has — `--source` when scaffolding, a recorded
`source` when resolving.
The two docblocks: `resolveWorkerSource` explained the `functions/`/`migrations/`
refusal by analogy to a key that is gone, and now gives the reason directly;
`workerSourceDir` referred to a symlinked `[workers] root` where it means
`supabase/workers`.
Also updates the `new.handler.ts` module docblock, which still described
scaffolding into `supabase/<root>/<name>/` and a name "only generated once both
questions have been answered" — the removed generated-name design.
…_EFFECTS
The checklist still described three designs that were removed and one
capability the command never had. It is the compatibility contract and the
primary input to the e2e suite, so it has to match what ships.
- Title: `[name]` was optional-bracket notation from the generated-name design.
`name` is a required argument.
- Files Written: "appends/updates `[workers.<name>]` in place" — writes are
append-only, and a worker already recorded is refused outright, before the
prompts and before anything reaches disk. Says so, and drops "always" from
the three rows that only happen on success.
- Files Read: `config.toml` is decoded to answer the already-recorded question
and then re-read as text to append to, which is two reads worth naming.
- Exit codes: "unknown runtime/size" cannot happen — `--runtime` and `--size`
are `Flag.choice`, so the parser rejects anything outside the catalog and the
recorded values are never read back. "Reserved worker name" went with
`RESERVED_WORKER_NAMES`; `validateWorkerNameMessage` is one pattern test.
"Records a worker in a form that cannot be edited safely" is now simply a
worker that is already recorded, in any form.
- `SUPABASE_ACCESS_TOKEN`: the row advertised a keyring → `~/.supabase/access-token`
fallback. This command's runtime layer is the CLI config, telemetry state and
command runtime — no credentials service, no API client, and nothing that
reads the token. Row removed rather than reworded.
- Telemetry: `cli_command_executed` is emitted by the `Command.withHandler`
wrapper, so a failure the parser catches — a missing name, a `--runtime`
outside the choice list — never reaches it, and `telemetry.json` is not
written either.
`legacyLoadWorkersProject` called `loadProjectConfig(projectRoot)` with no
options, and the loader prefers `supabase/config.json` when one exists. In a
JSON project `configPath` was therefore the JSON file, and `commitWorkerEntry`
appended a `[workers.<name>]` TOML table to it — after the scaffold was already
written, leaving the project config unparseable.
Two layers, per the review:
`tomlOnly: true` at the call site. The entry writer is a TOML text editor, so
the loader has to resolve the file that editor can actually edit. `functions
new` avoids the same trap by joining `supabase/config.toml` directly; this is
that, through the loader.
`planWorkerEntry` now parses what it rendered before returning it, and checks
the new table reads back out. Appending text to a file this code did not write
is a syntactic operation, and the only honest check is to read the result. That
also closes the sealed-inline-table case: `workers = {}` cannot be extended by
appending `[workers.api]`, and the name is absent from the decoded section, so
the already-configured check never fired. Both refusals land before the
scaffold, like every other refusal in this handler.
A JSON project now gets its worker recorded in `config.toml`, which the default
loader lists in `ignoredPaths`, and its `config.json` left byte-for-byte alone.
That gap is documented rather than fixed here: writing JSON means either losing
the comment preservation `appendTomlSection` exists for, or a second surgical
editor, and a holistic overhaul of config writing is planned.
Also drops the last `[workers] root` reference, in `worker-config.ts`'s
module docblock.
Base automatically changed from FUNC-753/workers-config to developAugust 25, 2026 20:54
# Conflicts:
#	packages/config/src/io.unit.test.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:72ec632d1f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/shared/workers/worker-paths.ts
@kanadgupta
kanadgupta self-requested a review August 25, 2026 21:44
pullBot pushed a commit to oogalieboogalie/cli that referenced this pull request Aug 25, 2026
…upabase#6260)
## Summary
Adds the `[workers]` section to the project config schema: a
`Schema.Record` of
worker name to `{ runtime, size, instances, source }`, mirroring the
`[functions.<slug>]` convention in the same file. The same schema is
used for the
project config and for `[remotes.*]`, so a remote can carry its own
worker
overrides.
Two constraints live at the schema level:
- **Worker names are DNS labels**, matching what the Management API
validates its
`:name` path parameter against, since they end up in hostnames.
- **`instances` is a non-negative integer**, matching `spec.instances`
in the API's
own input schema. A value that gets past the schema is dropped rather
than sent,
so leaving it unbounded means a `push` silently deploys a different
count than
the config asked for.
There is no project-wide scalar in the table — an earlier revision had a
`[workers] root` for relocating the grouping directory, and it was
dropped because
`[workers.<name>] source` already puts a worker anywhere in the repo.
That keeps
`workers` a plain record with nothing for the index signature to collide
with,
rather than a `StructWithRest` needing a key-pattern exclusion that
vanished under
the `disableChecks: true` `io.ts` uses for unselected remotes.
No CLI surface consumes this yet — it lands first so the schema and its
generated
types are reviewable on their own.
**Stack 1 of 4.** Followed by `workers new` (supabase#6261), `workers push`
(supabase#6262), and
`workers list`/`status`/`delete` (supabase#6263).
## Linked issue
FUNC-753 (Linear). Supabase maintainer, exempt from the
`open-for-contribution` flow.
## Checklist
- [x] The PR title follows [Conventional
Commits](https://www.conventionalcommits.org/)
---------
Co-authored-by: Kanad Gupta <git@kanad.dev>

@kanadguptakanadgupta left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

two non-blocking comments, happy to merge afterwards!

Comment threadapps/cli/src/shared/workers/stacks/node/index.mjs
Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:81e864ec9e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/shared/workers/worker-paths.ts
Comment threadapps/cli/src/legacy/commands/workers/new/new.handler.ts
Comment threadapps/cli/src/legacy/commands/workers/new/SIDE_EFFECTS.md
Comment threadapps/cli/src/legacy/commands/workers/workers.shared.ts

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:39ae31b4f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadapps/cli/src/shared/workers/worker-paths.ts
@kanadgupta
kanadgupta added this pull request to the merge queueAug 26, 2026
Merged via the queue into develop with commit b4a9199Aug 26, 2026
26 checks passed
@kanadgupta
kanadgupta deleted the FUNC-753/workers-new branch August 26, 2026 20:27
pullBot pushed a commit to chizee/cli that referenced this pull request Aug 27, 2026
## Summary
Adds `supabase workers push` (aliased `deploy`) and the machinery it
needs:
- `workers-api.ts` — the typed Workers Management API client.
- `tar.ts` / `worker-package.ts` — packaging a worker directory into the
build
context that gets uploaded.
- `worker-classify.ts` — best-effort runtime detection from marker
files, so a
directory with no `[workers.<name>] runtime` can still deploy. The guess
is
always reported with a nudge to pin it down, never applied silently.
**Stack 3 of 4**, on top of `workers new` (supabase#6261).
## Linked issue
FUNC-753 (Linear). Supabase maintainer, exempt from the
`open-for-contribution` flow.
## Checklist
- [x] The PR title follows [Conventional
Commits](https://www.conventionalcommits.org/)
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@johnstonmatt@kanadgupta