chore: enable Effect linting across monorepo

[jgoux]

Summary

• add the Effect TypeScript diagnostics integration to Oxlint using the recommended rule set
• expose linting consistently through inferred Nx targets across the TypeScript workspaces
• migrate existing runtime and test code so repository-wide Effect linting is clean
• retain two documented boundary suppressions for the public Node adapter and Promise-based end-to-end harness

Reviewer context

Enabling the recommended rules surfaced diagnostics across every TypeScript workspace, so this is intentionally a broad migration. It also replaces timing-sensitive subprocess and filesystem test coordination encountered while validating the Effect-native changes.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@cbd93af8a3236770cd361f7f132a1b393a6f61ff

Preview package for commit cbd93af.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edcae5572d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e49fe7db95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa1b421c7f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/shared/auth/jwks.ts

Lines 266 to 268 in 2aefb88

	const response = yield* client
	.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.acceptJson))
	.pipe(Effect.timeout(Duration.millis(remoteJwksTimeoutMs)), Effect.mapError(toRemoteJwksError));

Keep the JWKS timeout around body decoding

When an OIDC discovery or JWKS endpoint returns headers but stalls while sending its JSON body, the 10-second timeout has already completed because it wraps only client.execute; response.json can therefore wait indefinitely and hang commands that resolve third-party auth keys. The previous AbortSignal.timeout remained attached while the body was consumed, so wrap the complete execute-and-decode operation in the deadline.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/shared/functions/functions-docker.ts

Lines 327 to 329 in 2aefb88

	const bitbucketCloneDir = yield* Config.option(Config.string("BITBUCKET_CLONE_DIR"));
	if (Option.isSome(bitbucketCloneDir)) {
	return;

Preserve project dotenv Bitbucket detection

When BITBUCKET_CLONE_DIR is supplied only by a project .env, legacyLoadLocalProjectContext still places it in projectEnvValues but no longer copies it into process.env, while this lookup consults only the ambient Config provider. Consequently deploy, download, and serve try to create the named Deno-cache volume in Bitbucket Pipelines, where that operation is rejected; thread the resolved project environment into this decision instead.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/legacy/shared/legacy-db-dns.ts

Lines 92 to 93 in 2aefb88

	const payload = yield* Effect.tryPromise({
	try: () => response.json(),

Keep DNS body reads tied to the abort signal

When the DNS-over-HTTPS server or an intervening proxy returns status 200 and then stalls the response body, this second tryPromise is no longer associated with the signal passed to fetch. The outer timeout can fail the Effect, but it cannot abort the outstanding body read/socket, so a fallback database command may retain the request and fail to terminate cleanly; keep fetch and JSON consumption under one signal-owning boundary.

AGENTS.md reference: AGENTS.md:L68-L72

---

cli/apps/cli/src/shared/runtime/command-runtime.layer.ts

Lines 8 to 11 in 2aefb88

	const randomId = yield* Random.nextInt;
	return CommandRuntime.of({
	commandPath: [...commandPath],
	commandRunId: `cli-${randomId}`,

Retain UUID entropy for command run IDs

At fleet-scale CLI volume, replacing the UUID with one signed 32-bit Random.nextInt value makes unrelated invocations collide frequently enough to merge telemetry correlation (the same ID is also forwarded in command-run API headers). Preserve the prior UUID-sized identifier, preferably through the injected Effect Crypto service, rather than reducing the identifier space to roughly 4.3 billion values.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/legacy/shared/legacy-local-config-values.ts

Line 4403 in 2aefb88

Schema.decodeUnknownEffect(Schema.Array(LegacyJwkSchema))(remoteKeysUnknown).pipe(

Preserve extension fields on remote JWKs

When a third-party issuer publishes a valid JWK that relies on members outside this local signing-key schema, such as an RSA key represented through x5c, decoding the fetched keys as LegacyJwkSchema strips those members before the JWKS document is re-encoded. The local stack then publishes an unusable key and third-party JWT verification fails; remote JWK objects should retain their complete fetched representation rather than being normalized through the narrower local-key type.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/shared/telemetry/tracing.layer.ts

Line 112 in 2aefb88

Effect.runForkWith(context)(exportSpanToNdjson(span, telemetryRuntime.tracesDir));

Drain NDJSON exports before command shutdown

When a short-lived command ends immediately after its final span, onSpanEnd now launches the filesystem append as an unowned runtime fiber and neither retains nor awaits it. The previous synchronous append completed before span termination returned, whereas the process can now exit with the last telemetry record missing or partially unwritten; own these export fibers and drain them during tracing-layer teardown.

AGENTS.md reference: AGENTS.md:L115-L117

---

cli/packages/stack/src/platform-bun.ts

Line 103 in 2aefb88

.pipe(Effect.timeout("500 millis"));

Extend Bun's control timeout through JSON decoding

When a stale daemon or another listener on a deterministic control port returns 200 headers but never completes its owner-status body, this 500 ms timeout ends as soon as execute yields the response and the subsequent response.json waits forever. Managed discovery can therefore hang instead of rejecting the candidate and continuing recovery; keep the body decode inside the same timeout, as the previous signal-backed fetch did.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Automated review round 3 triage (final bounded pass):

Fixed in 435a2d3:

• preserve all ambient SUPABASE_* overrides without config.toml
• skip symlink entries before recursive function asset traversal
• restore the 30-second finite daemon-request timeout while preserving caller cancellation and long-lived streams

Confirmed but deferred from this PR after reaching the automated-review loop cap:

• interruption-window and stale-directory cleanup for temporary function runtime config artifacts (cleanup reliability; no normal successful-path corruption)
• custom Clock propagation when aging malformed port claims (production default clock behavior is unchanged)
• draining detached replay recording work during stop (the fire-and-forget lifetime predates this PR; the async write makes the record-mode durability risk more visible)

These deferrals are recorded here for human review rather than silently dropped. The selected fixes have focused regression coverage and the affected CLI/stack quality plus unit/integration gates pass locally. No further automated fix rounds are planned; this is ready for human review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 435a2d36f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Final automated-review pass, including #6304 (comment), is addressed by 8bb6933.\n\nI validated each report against the actual Effect execution path and the previous Go behavior before changing code. All seven items in that report were reproducible or represented concrete compatibility regressions:\n\n- JWKS timeout now covers request execution, status validation, and JSON body decoding.\n- Resolved project environment values, including BITBUCKET_CLONE_DIR, now reach both function volume creation and bind-mount decisions in deploy, download, serve, and start.\n- DNS fetch and body decoding share one cancellation signal.\n- Command correlation IDs use the injected Crypto service for UUIDv4 values.\n- Remote JWK JSON is preserved losslessly, matching the Go RawMessage behavior; local signing keys remain strictly validated.\n- NDJSON export fibers are scoped, owned, and drained before teardown.\n- Bun control-request timeout now covers JSON body decoding too.\n\nThe four newer inline findings are also addressed: empty SUPABASE_ENV defaults to development, known environment-override validation failures stay in the typed error channel, the duplicate JWKS timeout report is covered by the same fix, and Node/Bun config facades preserve explicit empty ambient values.\n\nI considered pushback explicitly. None was warranted after reproduction: the two initially ambiguous cases—remote JWK extension fields and empty ambient environment values—were confirmed by the Go source and a direct config-loader reproduction. The fixes remain narrow; no compatibility shim or speculative abstraction was added.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bb69332f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 757ca02d82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Final bounded automated-review pass is complete at cbd93af.

Accepted and fixed:

• use public Effect predicates for optional env-file NotFound recovery
• remove deleted-implementation framing from the stable TypeScript shell
• prefix the shared legacy SSO formatter export
• restore full libpq runtime resolution for interactive declarative custom targets, including service files, pgpass, OS defaults, and explicit URL/keyword-DSN file paths

Rejected after reproduction/architecture triage:

• propagating Path through the functions serve helper graph. The CLI is Bun-only at this boundary, BunPath is the pure Node path implementation, no alternate supplied Path is reachable, and no behavioral defect was demonstrated. The proposed change would add broad indirection for no runtime benefit.

The earlier top-level review at issuecomment-5386062423 was addressed separately in 8bb6933 and documented in issuecomment-5387281854. All review threads are resolved, the local no-cache quality/unit/integration matrix passes, and the fresh GitHub code-quality, unit/integration, e2e, and preview workflows are green.

We have reached the automated-review loop cap. Requesting human review; further automated findings should be triaged as signals rather than applied automatically.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbd93af8a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore a deadline for force-removal commands

When Docker or Podman accepts rm -f but its daemon is wedged, child.exitCode can wait indefinitely because the previous five-second execFile timeout was removed. This helper runs from uninterruptible startup rollback and LocalStack.dispose, as well as managed stop/delete paths, so one stuck daemon command can prevent cleanup or shutdown from ever completing; bound the wait and terminate the child on expiry.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Use public Exit helpers in the NDJSON exporter

Replace the direct status.exit._tag checks here and below with Exit.isFailure/Exit.isSuccess. This runtime exporter currently depends on Effect's internal representation even though repository guidance explicitly requires the public helpers for Exit, leaving telemetry behavior coupled to an unsupported implementation detail.

AGENTS.md reference: AGENTS.md:L169-L173

Useful? React with 👍 / 👎.