fix(cli): restore Go gen types flag guards, bless pg-meta permissiveness (CLI-1988) - #6008
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…8-parity-ruling-gen-types-permissiveness-beyond-go-pg-meta-for
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@8ce7c18a878935c860b999a8ae50eceaddf68c9bPreview package for commit |
kanadgupta
left a comment
kanadgupta
left a comment
There was a problem hiding this comment.
Claude flagged a minor inaccuracy in your docs but I'm unable to verify it myself — feel free to disregard! LGTM otherwise
…project-id (CLI-1988) The implicit linked fallback never sets the linked/project-id mutex keys, so --query-timeout/--swift-access-control clear every guard and are forwarded to pg-meta for --lang go/swift/python there; the defaults-only claim only holds for the explicit --linked/--project-id paths. Pins the corner with a regression test alongside the existing implicit-TypeScript-fallback test.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7278d32bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…8-parity-ruling-gen-types-permissiveness-beyond-go-pg-meta-for # Conflicts: # apps/cli/docs/go-cli-porting-status.md
…988) hasExplicitValueFlag was removed from cobra-flag-groups.ts (#5974), which broke gen types' mutex-flag detection after the develop merge. Migrate onto pflagArgvScan (the sso add/update pattern): a GEN_TYPES_SCAN_SPEC drives the scan, and its occurrences replace every flagChanged(...) call site. This also closes two gaps flagged on the PR: - The mutex scan is now short-flag aware (-s), and no longer ORs against the Effect-parsed boolean flags, which independently mark a flag changed even when pflag would have consumed its token as -s's value. - The postgrest-v9-compat PreRunE gate, the positional-lang guard, and the mutex-group checks now run inside the same Effect.ensuring(telemetryState.flush) block as the rest of the handler, matching Go's PersistentPreRunE-before-PreRunE ordering so a rejected invocation still flushes telemetry.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8ce7c18a87
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
2 participants
What kind of change does this PR introduce?
Go-parity fix for
supabase gen typesflag validation, implementing the CLI-1988 parity ruling.Fixes CLI-1988
⚖ Parity ruling applied
This issue was decision-gated; the ruling (Colum, 2026-07-30) was to take the issue's recommended option: bless the deliberate pg-meta permissiveness, restore every undocumented Go guard byte-exactly.
Blessed deviation (kept, sanctioned — do not "fix" back)
Non-TypeScript
--lang(go/swift/python) with--linked,--project-id, or the implicit linked ref runs pg-meta locally against the project database (project probe → preview-branch fallback → temporary login-role credentials). The Go CLI instead hard-errors withUnable to generate <lang> types for selected project. Try using --db-url flag instead.(apps/cli-go/internal/gen/types/types.go:44-46) and never runs pg-meta for a project ref.This permissiveness is intentional: it was already recorded in
gen/types/SIDE_EFFECTS.mdand it resolves the user-filed CLI-1623 complaint. This PR strengthens the SIDE_EFFECTS.md wording to explicitly mark it as a sanctioned intentional divergence (CLI-1988) and records it indocs/go-cli-porting-status.md.Restored Go guards (byte-exact, verified against the compiled Go binary)
These were TS divergences not documented as intentional, now restored to Go's exact strings, ordering, and exit code 1:
PreRunE gate (
cmd/gen.go:80-82):--postgrest-v9-compatwithout--db-url→--postgrest-v9-compat must used together with --db-url(Go's "must used" typo preserved). Previously TS allowed--local --postgrest-v9-compatand emitted a TS-only message for ref paths.All four cobra mutually-exclusive flag groups (
cmd/gen.go:153-162) — TS previously reproduced only the first:local/linked/project-id/db-urllinked/project-id/postgrest-v9-compatlinked/project-id/query-timeoutlinked/project-id/swift-access-controlErrors use cobra's exact format (
if any flags in the group [...] are set none of the others can be; [...] were all set, set-flags alphabetically sorted) via the existingshared/cli/cobra-flag-groups.tshelpers, and the groups are validated in cobra's lexicographically-sorted group-key order, so multi-violation invocations report the same group as Go (e.g.--db-url X --postgrest-v9-compat --project-id Yreports the postgrest group).Guard ordering matches cobra's pipeline: flag parse (invalid
--query-timeoutduration) → PreRunE (postgrest gate, positional-language guard) → mutex groups. E.g.--local --linked --postgrest-v9-compatnow yields the PreRunE error, as Go does.Mutex membership mirrors pflag
Changed: an explicitly negated boolean (--linked=false --project-id X) still trips the group, matching cobra.Removed TS-only messages absent from Go:
--swift-access-control can only be used with --lang swift,--postgrest-v9-compat can only be used with pg-meta type generation,--query-timeout can only be used with pg-meta type generation, and theWarning: --query-timeout is ignored for remote TypeScript type generation.stderr warning. Go also allows--swift-access-controlwith any--langon--local/--db-url(the value is always forwarded to pg-meta), which TS now does too.gen types --query-timeout 20son the implicit linked TypeScript path now silently ignores the flag, as Go does.Keep-vs-restore interaction (documented, not a conflict)
Restoring the
linked/project-idmutex groups means the pg-meta tuning knobs (--swift-access-control,--postgrest-v9-compat,--query-timeout) cannot be combined with the blessed project-ref pg-meta path — that path always runs with pg-meta defaults (internalaccess control, one-to-one detection on, 15s timeout). This does not break the blessed permissiveness itself (--linked --lang goetc. still reach pg-meta); it constrains only the add-on knobs, exactly as Go's flag surface does, and--db-urlremains the escape hatch Go's own error message recommends. No Go guard had to be left unrestored: none of them exists solely to enforce "never pg-meta on refs".One known residual precedence nuance: Go resolves the linked DB config in the root
PersistentPreRunEbefore flag validation, so in Go an unlinked workdir or unreachable network can surface a resolution error (e.g.Cannot find project ref…,IPv6 is not supported…) before a mutex error. The TS handler validates flags before any resolution (consistent with all prior TS mutex ports — sso, functions, db dump), so in those degraded environments TS reports the mutex error instead. The guard strings themselves are byte-identical.Note on CLI-1623
CLI-1623 is stale either way: the complaint it tracks (non-TypeScript typegen unusable for hosted projects) is resolved by the blessed permissiveness that this PR pins with regression tests, so the issue no longer reflects current behavior regardless of this ruling.
What is the new behavior?
Previously-working TS-only combos now error with Go's exact text (
--local --postgrest-v9-compat,--linked --lang swift --swift-access-control public,--linked --query-timeout 30s, …), the TS-only friendlier gate messages are gone, and the blessed--linked/--project-id --lang go|swift|pythonpg-meta path is unchanged and covered by regression tests (11 guard tests verified to fail against the previous handler, plus pins for the permissive path).