chore: production deploy

[supabase-cli-releaser]

• fix(cli): start secrets selinux (fix(cli): start secrets selinux #6000)
• fix(cli): reload kong after db reset (fix(cli): reload kong after db reset #6017)
• chore(deps): bump github.com/docker/go-connections from 0.7.0 to 0.8.0 in /apps/cli-go in the go-minor group across 1 directory (chore(deps): bump github.com/docker/go-connections from 0.7.0 to 0.8.0 in /apps/cli-go in the go-minor group across 1 directory #6023)
• chore(ci): bump the actions-major group with 3 updates (chore(ci): bump the actions-major group with 3 updates #6033)
• chore: sync API types from infrastructure (chore: sync API types from infrastructure #6039)
• fix(cli): use cobra mutual-exclusivity template in sso add (fix(cli): use cobra mutual-exclusivity template in sso add #5974)
• fix(cli): edge and cosmetic parity sweep from the 2026-07-24 audit (CLI-1990) (fix(cli): edge and cosmetic parity sweep from the 2026-07-24 audit (CLI-1990) #5978)
• fix(cli): match Go bundler env and deploy path anchoring (CLI-1985) (fix(cli): match Go bundler env and deploy path anchoring (CLI-1985) #6005)
• docs(cli): record intentional start --ignore-health-check divergence from Go (CLI-1987) (docs(cli): record intentional start --ignore-health-check divergence from Go (CLI-1987) #6007)
• chore(cli): apply CLI-1989 parity ruling for db push pipeline-incompatible statements (chore(cli): apply CLI-1989 parity ruling for db push pipeline-incompatible statements #6009)
• fix(stack): stage binary downloads and extract via atomic rename to avoid cross-process cache races (fix(stack): stage binary downloads and extract via atomic rename to avoid cross-process cache races #6003)
• fix(cli): reuse existing volumes (fix(cli): reuse existing volumes #6037)
• test(stack): verify postgres data survives native to docker mode transition (test(stack): verify postgres data survives native to docker mode transition #6004)
• fix(cli): order migrations by version (fix(cli): order migrations by version #6038)
• test(cli): deflake e2e image pulls (test(cli): deflake e2e image pulls #6030)
• fix(cli): restore Go gen types flag guards, bless pg-meta permissiveness (CLI-1988) (fix(cli): restore Go gen types flag guards, bless pg-meta permissiveness (CLI-1988) #6008)
• fix(cli): match Go machine-format encoder output for -o toml/yaml/json (CLI-1975) (fix(cli): match Go machine-format encoder output for -o toml/yaml/json (CLI-1975) #6002)
• fix(cli): migrate remaining StringSlice flags onto legacyStringSliceFlag builder (CLI-2005) (fix(cli): migrate remaining StringSlice flags onto legacyStringSliceFlag builder (CLI-2005) #6010)
• refactor(cli): hoist sso pflag/profile reconciliation into shared layer (CLI-1982) (refactor(cli): hoist sso pflag/profile reconciliation into shared layer (CLI-1982) #6040)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97d6a66ecd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Fall back to markerless cache when downloads fail

When a user already has a cache entry written by any earlier CLI release, that directory is non-empty but lacks the new .supabase-cache-complete marker, so this check skips it and immediately enters the download path. If the user is offline or GitHub is unavailable, resolveWithMetadata now fails even though the previously working binary is still present on disk; keep markerless legacy entries as a fallback when replacement cannot be downloaded/published.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Do not swallow conflicting existing volumes

When volume create returns the spec-conflict message this helper explicitly calls out (volume with name <name> already exists ... but was not created for the current specification), the leading “already exists” text still satisfies this regex. legacyEnsureStartVolume then treats that non-zero exit as success and continues start against a volume whose requested options/labels were rejected; tighten the match so only the idempotent already-exists case is swallowed.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b6dd487a10

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Stop the dev daemon when metadata setup fails

When functions dev auto-starts a stack, this forks and registers the daemon before the subsequent state read/metadata write completes. If those filesystem steps fail (for example a permission or disk error under the project state dir), the command returns an error without disposing the stackLayer or calling stopDaemon, leaving an idle daemon process, live state file, and reserved ports behind; wrap the post-fork metadata setup in cleanup just like the normal start path needs.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Carry the reconciled profile into upgrade URLs

When opts.apiUrl is supplied for an SSO pflag-reconciled profile, the fallback project/entitlement GETs now hit the reconciled host, but the fallback billing link still uses legacyBillingUrl(cliConfig.profile, orgSlug) later in this branch. For argv where pflag consumed --profile supabase-local (or a YAML profile with its own dashboard) but the Effect config layer parsed it, Go uses the reconciled CurrentProfile for both API requests and the dashboard URL, while this can print a localhost/stale-profile upgrade URL after confirming the gate on the reconciled API host.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b3d9ea223b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Release reserved ports when dependencies fail

With the stack's serviceStartOptions, beforeStart reserves the service's configured ports and beforeSpawn releases them only once spawning is imminent. This new call runs before dependency readiness is known; if a dependency fails or times out, the service is marked failed and the later early-return path exits without beforeSpawn or any release, leaving ports for services that never started bound until the whole stack is disposed. Reserve after dependencies succeed or release the reservation on the dependency-failure/early-return path.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject activation of disabled root services

When the requested service itself is disabled in the stack config, this guard returns an empty target list. The callers then treat that empty list as success (states.every([]) is true in the fast path, and beginStartTargets has nothing to start), so startService("auth") or a lazy proxy activation on an auth-disabled stack reports success and then proxies to port 0 instead of rejecting the disabled service. Distinguish a disabled root service from disabled optional companions before returning success.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/shared/cli/cobra-flag-groups.ts

Lines 20 to 24 in c765afc

	const token = rawArgs[index];
	if (token === undefined || token === "--") {
	return false;
	}
	if (token === `--${flagName}` || token.startsWith(`--${flagName}=`)) {

Skip consumed values when scanning deploy flags

When a value-taking deploy flag is followed by a flag-shaped token, this scan still treats that token as an explicit boolean flag instead of as the previous flag's value. For example, functions deploy hello --import-map --use-docker is parsed by pflag as --import-map having the value --use-docker (pflag documents non-boolean flags as accepting --flag x and only an unconsumed -- terminates parsing), so Go does not set use-docker; here explicitUseDocker becomes true and can switch deploy mode or override options such as --no-verify-jwt rather than matching the Go CLI request/side-effect shape. Use the pflag-aware scanner/value-flag registry for these explicit flag checks.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Treat -- as a consumed profile value

When --profile is followed by --, pflag treats that terminator token as the string flag value, but this guard ignores the occurrence as if the flag were missing. For invocations that route with a consumed terminator, Go tries to load the explicit profile token -- and fails before using env/default credentials, while this falls through to SUPABASE_PROFILE, the profile file, or supabase, so legacy commands can target the wrong API host or persist the wrong profile instead of matching the Go side-effect shape.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Treat -- as a consumed profile value

When --profile is followed by --, pflag treats that terminator token as the string flag value, but this guard ignores the occurrence as if the flag were missing. For invocations that route with a consumed terminator, Go tries to load the explicit profile token -- and fails before using env/default credentials, while this falls through to SUPABASE_PROFILE, the profile file, or supabase, so legacy commands can target the wrong API host or persist the wrong profile instead of matching the Go side-effect shape.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve int64 config values in update payloads

When a postgres-config update --config key=<digits> value is between Number.MAX_SAFE_INTEGER and Go's int64 limit, this branch still converts it to a JS Number, and putPostgresConfig later serializes that rounded value with JSON.stringify. Go's strconv.Atoi preserves the exact int64 token in the request body, so inputs such as --config max_slot_wal_keep_size=9007199254740993 now PUT 9007199254740992 instead of the user's value; keep these values as an exact/raw JSON integer or leave them out of the numeric branch.

Useful? React with 👍 / 👎.

[depthfirst-app]

🟡 Severity: MEDIUM

path.resolve() is a lexical normalization — it does not resolve symlinks. The subsequent Deno.mkdir and Deno.writeTextFile calls (in write()) DO follow symlinks. A symlink pre-planted inside destPath or rootPath could redirect writes outside the containment boundary, bypassing this check.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: This requires three coordinated changes to fully close the symlink-bypass attack surface, mirroring the patterns already implemented in the Go extractor at apps/cli-go/internal/functions/download/download.go:

1. Add a realPathSafe helper (above extractEszip) that mirrors Go's resolveExistingPath: walk up the path to the deepest existing ancestor, resolve symlinks via Deno.realPath() on that ancestor, then re-join the still-nonexistent suffix. A non-existing path component cannot itself be a symlink, so only the existing portion needs symlink resolution:

async function realPathSafe(p: string): Promise<string> {
  let existing = p;
  const suffix: string[] = [];
  while (true) {
    try {
      await Deno.stat(existing);
      break;
    } catch (e) {
      if (!(e instanceof Deno.errors.NotFound)) throw e;
    }
    const parent = path.dirname(existing);
    if (parent === existing) return path.join(existing, ...suffix);
    suffix.unshift(path.basename(existing));
    existing = parent;
  }
  return path.join(await Deno.realPath(existing), ...suffix);
}

2. Line 31: Replace const resolvedRoot = path.resolve(rootPath); with const resolvedRoot = await Deno.realPath(rootPath); — rootPath always exists at call time, so Deno.realPath works directly and fully resolves any symlinks in the root anchor.

3. Line 43: Replace const resolvedDest = path.resolve(dest); with const resolvedDest = await realPathSafe(dest); — this uses the helper above to resolve symlinks in the existing portion of dest's path.

4. Lines 5-7 (write()): Harden the write sink itself by mirroring Go's writeFileNoFollowSymlink pattern — write to a randomly-named temp file with exclusive creation (O_EXCL via { createNew: true }), then atomically rename it onto the destination. Deno.rename replaces the directory entry (including a symlink) rather than dereferencing it, preventing a TOCTOU window between the containment check and the actual write:

async function write(p: string, content: string) {
  const dir = path.dirname(p);
  await Deno.mkdir(dir, { recursive: true });
  const tmp = path.join(dir, `.supabase-tmp-${crypto.randomUUID()}`);
  try {
    await Deno.writeTextFile(tmp, content, { createNew: true });
    await Deno.rename(tmp, p);
  } catch (e) {
    await Deno.remove(tmp).catch(() => {});
    throw e;
  }
}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1e4ea826cd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve large rate-limit uint overrides

When supabase start/db start receives a SUPABASE_AUTH_RATE_LIMIT_* override above Number.MAX_SAFE_INTEGER but within Go's uint64 range, for example SUPABASE_AUTH_RATE_LIMIT_SMS_SENT=18446744073709551615, this new resolver accepts it through legacyEnvOverrideUint and returns a JS Number; gotrue.service.ts later stringifies the rounded value into GOTRUE_RATE_LIMIT_*. The Go CLI keeps the exact uint token through config loading, so the port starts GoTrue with a different value (and for max uint64, an out-of-range one) instead of matching Go behavior; keep these overrides exact as strings/BigInts or reject unsafe values before emitting container env.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Restart owned companion services too

When restarting a service with owned companions, e.g. restartService("storage") or restartService("analytics"), this only restarts the public service and waits for that one target. The activation policy marks imgproxy/vector as exclusively owned by those services and stopService already stops lifecycleTargetsForService(...), so a restart leaves the companion process running with its old state/config while a stop+start cycle would replace it; restart the same lifecycle target set and wait on all targets.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54934f4ac8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Release restart reservations if backoff is interrupted

When a service enters the restart loop, beforeStart reserves its ports here before the backoff sleep, but beforeSpawn is the only per-service release (StackLifecycleCoordinator wires beforeStart to portLease.reserve(...) and beforeSpawn to portLease.release(...)). If the service is stopped or the stack API interrupts this fiber during the sleep, spawning never happens and the reservation stays bound until full stack disposal, so later lazy starts can fail with the port still unavailable; reserve at the spawn boundary or ensure this reservation is released on interruption.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Split database DDL out of migration batches

When a migration first contains a statement now run standalone, such as CREATE INDEX CONCURRENTLY, and then later runs CREATE DATABASE or DROP DATABASE, those database statements are still left in the following transaction batch. PostgreSQL documents that both CREATE DATABASE and DROP DATABASE cannot execute inside a transaction block, so db push/db reset can commit the earlier standalone work and then fail before the migration-history row is inserted; include these statements in the pipeline-incompatible split too.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/legacy/shared/legacy-seed-ops.ts

Lines 177 to 181 in 223fa14

	const childType = yield* fs
	.stat(path.isAbsolute(childRel) ? childRel : path.join(workdir, childRel))
	.pipe(
	Effect.map((info) => info.type),
	Effect.orElseSucceed(() => "Unknown" as const),

Skip symlinked seed SQL files

When db.seed.sql_paths matches a directory containing a symlinked .sql file or a symlinked subdirectory, this fs.stat follows the link and treats the target as a regular file/directory, so db push --include-seed can apply seed SQL that Go's Glob.SQLFiles skips (fs.WalkDir uses the non-followed DirEntry.Type().IsRegular() check). Use a non-following readLink/lstat-style guard like the shared legacyWalkSqlFiles helper before recursing or collecting .sql files, or directory seeds can mutate data differently from the Go CLI.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Skip value-consumed profile tokens

When a value-taking command flag precedes --profile, e.g. db pull --password --profile supabase-local, pflag consumes the raw --profile token as the password value, so the persistent profile flag is not changed and Go falls back to env/file/default. This scan has no knowledge of those consuming flags and still treats the following supabase-local as an explicit profile, so the config layer can load credentials and API URLs for a profile the Go CLI would never use for commands without later pflag reconciliation, such as db pull. Use the same pflag-aware argv scan/consumed-token handling here before resolving LegacyCliConfig.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reconcile network-id before db start

When db start is invoked with a bare value-taking flag before --network-id, for example db start --from-backup --network-id custom-net, pflag consumes the raw --network-id token as the --from-backup value and leaves the persistent network flag unset, so Go attempts the restore path and uses the generated/env network. The Effect parser does not consume flag-shaped values, so this parsed networkIdFlag becomes custom-net while fromBackup is unset, causing the native path to skip the restore and start containers on a network Go would not use; derive networkId from a pflag-aware argv scan (and likewise discard consumed occurrences) before calling legacyStartDatabase.

AGENTS.md reference: apps/cli/AGENTS.md:L247-L257

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/legacy/shared/legacy-test-db.handler.ts

Line 78 in 75c6535

dbUrl: flags.dbUrl,

Use pflag db-url values when testing

When test db / db test receives --db-url in pflag's space-separated form with a flag-shaped value, such as test db --db-url --local or test db --db-url --, the raw scan correctly marks db-url as the selected target but this call still passes the Effect-parsed flags.dbUrl. Effect does not consume those tokens as the string value, so the resolver skips the direct-URL branch and runs against the local database instead of matching Go's parse/error path; feed the pflag-effective db-url value into the resolver here.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve a WebSocket-capable Realtime endpoint

When callers use the advertised serviceEndpoints.realtime URL for subscriptions, it now points at the generic API proxy instead of the Realtime service port. The proxy only forwards normal HTTP requests and its Realtime route strips /realtime/v1 directly to the backend, so a client WebSocket path such as /realtime/v1/websocket is neither upgraded nor mapped to Realtime's /socket/websocket path; Realtime clients that previously used this endpoint will fail to subscribe. Keep advertising the direct Realtime port until the proxy handles the Kong-style WebSocket mapping.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Apply service activation budgets to lazy startup

When the next start path enables the default lazy stack with Studio/Analytics, stack.start() eagerly starts Studio's activation closure (Studio, Analytics, and Vector), but this outer wait still uses the generic 180s stack readiness policy. The service budgets added for lazy activation allow much longer cold starts (for example 554s for Analytics and 825s for Studio), so a slow but healthy Docker startup can hit this timeout, dispose the stack, and report failure before those services exhaust their own health budgets; pass a readiness budget based on the eager activation set instead of the default here.

Useful? React with 👍 / 👎.