chore: enable Effect linting across monorepo

[jgoux]

Summary

• add the Effect TypeScript diagnostics integration to Oxlint using the recommended rule set
• expose linting consistently through inferred Nx targets across the TypeScript workspaces
• migrate existing runtime and test code so repository-wide Effect linting is clean
• keep native Node, Bun, subprocess, test, and foreign-library boundaries explicit with narrow rule-specific suppressions
• preserve behavior uncovered during the migration, including environment propagation, subprocess cleanup, telemetry draining, config path handling, and generated output formatting

Reviewer context

This PR is stacked on #6303 and intentionally accepts its Effect RPC stack transport as the baseline. Merge #6303 first, then this PR. The stack changes here are lint remediation against that RPC design; they do not restore the prior transport implementation.

Enabling the recommended rules surfaced diagnostics across every TypeScript workspace, so this is intentionally a broad migration. Cleanup was limited to concrete ownership and lifecycle improvements; larger service-threading proposals without a demonstrated runtime benefit were rejected.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@d12a47a5f6244b808c628f8fb91e5b94a3533c25

Preview package for commit d12a47a.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: edcae5572d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e49fe7db95

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fa1b421c7f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/shared/auth/jwks.ts

Lines 266 to 268 in 2aefb88

	const response = yield* client
	.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.acceptJson))
	.pipe(Effect.timeout(Duration.millis(remoteJwksTimeoutMs)), Effect.mapError(toRemoteJwksError));

Keep the JWKS timeout around body decoding

When an OIDC discovery or JWKS endpoint returns headers but stalls while sending its JSON body, the 10-second timeout has already completed because it wraps only client.execute; response.json can therefore wait indefinitely and hang commands that resolve third-party auth keys. The previous AbortSignal.timeout remained attached while the body was consumed, so wrap the complete execute-and-decode operation in the deadline.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/shared/functions/functions-docker.ts

Lines 327 to 329 in 2aefb88

	const bitbucketCloneDir = yield* Config.option(Config.string("BITBUCKET_CLONE_DIR"));
	if (Option.isSome(bitbucketCloneDir)) {
	return;

Preserve project dotenv Bitbucket detection

When BITBUCKET_CLONE_DIR is supplied only by a project .env, legacyLoadLocalProjectContext still places it in projectEnvValues but no longer copies it into process.env, while this lookup consults only the ambient Config provider. Consequently deploy, download, and serve try to create the named Deno-cache volume in Bitbucket Pipelines, where that operation is rejected; thread the resolved project environment into this decision instead.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/legacy/shared/legacy-db-dns.ts

Lines 92 to 93 in 2aefb88

	const payload = yield* Effect.tryPromise({
	try: () => response.json(),

Keep DNS body reads tied to the abort signal

When the DNS-over-HTTPS server or an intervening proxy returns status 200 and then stalls the response body, this second tryPromise is no longer associated with the signal passed to fetch. The outer timeout can fail the Effect, but it cannot abort the outstanding body read/socket, so a fallback database command may retain the request and fail to terminate cleanly; keep fetch and JSON consumption under one signal-owning boundary.

AGENTS.md reference: AGENTS.md:L68-L72

---

cli/apps/cli/src/shared/runtime/command-runtime.layer.ts

Lines 8 to 11 in 2aefb88

	const randomId = yield* Random.nextInt;
	return CommandRuntime.of({
	commandPath: [...commandPath],
	commandRunId: `cli-${randomId}`,

Retain UUID entropy for command run IDs

At fleet-scale CLI volume, replacing the UUID with one signed 32-bit Random.nextInt value makes unrelated invocations collide frequently enough to merge telemetry correlation (the same ID is also forwarded in command-run API headers). Preserve the prior UUID-sized identifier, preferably through the injected Effect Crypto service, rather than reducing the identifier space to roughly 4.3 billion values.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/legacy/shared/legacy-local-config-values.ts

Line 4403 in 2aefb88

Schema.decodeUnknownEffect(Schema.Array(LegacyJwkSchema))(remoteKeysUnknown).pipe(

Preserve extension fields on remote JWKs

When a third-party issuer publishes a valid JWK that relies on members outside this local signing-key schema, such as an RSA key represented through x5c, decoding the fetched keys as LegacyJwkSchema strips those members before the JWKS document is re-encoded. The local stack then publishes an unusable key and third-party JWT verification fails; remote JWK objects should retain their complete fetched representation rather than being normalized through the narrower local-key type.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

---

cli/apps/cli/src/shared/telemetry/tracing.layer.ts

Line 112 in 2aefb88

Effect.runForkWith(context)(exportSpanToNdjson(span, telemetryRuntime.tracesDir));

Drain NDJSON exports before command shutdown

When a short-lived command ends immediately after its final span, onSpanEnd now launches the filesystem append as an unowned runtime fiber and neither retains nor awaits it. The previous synchronous append completed before span termination returned, whereas the process can now exit with the last telemetry record missing or partially unwritten; own these export fibers and drain them during tracing-layer teardown.

AGENTS.md reference: AGENTS.md:L115-L117

---

cli/packages/stack/src/platform-bun.ts

Line 103 in 2aefb88

.pipe(Effect.timeout("500 millis"));

Extend Bun's control timeout through JSON decoding

When a stale daemon or another listener on a deterministic control port returns 200 headers but never completes its owner-status body, this 500 ms timeout ends as soon as execute yields the response and the subsequent response.json waits forever. Managed discovery can therefore hang instead of rejecting the candidate and continuing recovery; keep the body decode inside the same timeout, as the previous signal-backed fetch did.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Automated review round 3 triage (final bounded pass):

Fixed in 435a2d3:

• preserve all ambient SUPABASE_* overrides without config.toml
• skip symlink entries before recursive function asset traversal
• restore the 30-second finite daemon-request timeout while preserving caller cancellation and long-lived streams

Confirmed but deferred from this PR after reaching the automated-review loop cap:

• interruption-window and stale-directory cleanup for temporary function runtime config artifacts (cleanup reliability; no normal successful-path corruption)
• custom Clock propagation when aging malformed port claims (production default clock behavior is unchanged)
• draining detached replay recording work during stop (the fire-and-forget lifetime predates this PR; the async write makes the record-mode durability risk more visible)

These deferrals are recorded here for human review rather than silently dropped. The selected fixes have focused regression coverage and the affected CLI/stack quality plus unit/integration gates pass locally. No further automated fix rounds are planned; this is ready for human review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 435a2d36f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Final automated-review pass, including #6304 (comment), is addressed by 8bb6933.\n\nI validated each report against the actual Effect execution path and the previous Go behavior before changing code. All seven items in that report were reproducible or represented concrete compatibility regressions:\n\n- JWKS timeout now covers request execution, status validation, and JSON body decoding.\n- Resolved project environment values, including BITBUCKET_CLONE_DIR, now reach both function volume creation and bind-mount decisions in deploy, download, serve, and start.\n- DNS fetch and body decoding share one cancellation signal.\n- Command correlation IDs use the injected Crypto service for UUIDv4 values.\n- Remote JWK JSON is preserved losslessly, matching the Go RawMessage behavior; local signing keys remain strictly validated.\n- NDJSON export fibers are scoped, owned, and drained before teardown.\n- Bun control-request timeout now covers JSON body decoding too.\n\nThe four newer inline findings are also addressed: empty SUPABASE_ENV defaults to development, known environment-override validation failures stay in the typed error channel, the duplicate JWKS timeout report is covered by the same fix, and Node/Bun config facades preserve explicit empty ambient values.\n\nI considered pushback explicitly. None was warranted after reproduction: the two initially ambiguous cases—remote JWK extension fields and empty ambient environment values—were confirmed by the Go source and a direct config-loader reproduction. The fixes remain narrow; no compatibility shim or speculative abstraction was added.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8bb69332f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 757ca02d82

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Final bounded automated-review pass is complete at cbd93af.

Accepted and fixed:

• use public Effect predicates for optional env-file NotFound recovery
• remove deleted-implementation framing from the stable TypeScript shell
• prefix the shared legacy SSO formatter export
• restore full libpq runtime resolution for interactive declarative custom targets, including service files, pgpass, OS defaults, and explicit URL/keyword-DSN file paths

Rejected after reproduction/architecture triage:

• propagating Path through the functions serve helper graph. The CLI is Bun-only at this boundary, BunPath is the pure Node path implementation, no alternate supplied Path is reachable, and no behavioral defect was demonstrated. The proposed change would add broad indirection for no runtime benefit.

The earlier top-level review at issuecomment-5386062423 was addressed separately in 8bb6933 and documented in issuecomment-5387281854. All review threads are resolved, the local no-cache quality/unit/integration matrix passes, and the fresh GitHub code-quality, unit/integration, e2e, and preview workflows are green.

We have reached the automated-review loop cap. Requesting human review; further automated findings should be triaged as signals rather than applied automatically.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cbd93af8a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

cli/apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts

Line 1074 in 214426e

error.reason._tag === "NotFound"

Narrow missing-file errors with Predicate.isTagged

Replace the direct error.reason._tag inspection with Predicate.isTagged(error.reason, "NotFound"). This recovery path runs whenever an optional project dotenv file is absent, and directly inspecting Effect's runtime representation violates the repository requirement to use supported narrowing helpers, coupling normal config loading to internal representation details.

AGENTS.md reference: AGENTS.md:L169-L175

---

cli/apps/cli/src/legacy/commands/unlink/unlink.handler.ts

Line 71 in 214426e

return yield* first._tag === "LegacyUnlinkTempRemovalError"

Narrow the combined unlink error with Predicate.isTagged

Replace the direct first._tag check with Predicate.isTagged(first, "LegacyUnlinkTempRemovalError"). When both unlink cleanup operations fail, this branch chooses the resulting domain error by inspecting its runtime representation, which repository guidance explicitly prohibits for narrowing tagged domain variants.

AGENTS.md reference: AGENTS.md:L169-L175

---

cli/apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts

Lines 588 to 589 in 214426e

	expect(exit._tag).toBe("Failure");
	if (exit._tag === "Failure") {

Assert Exit variants through Exit.isFailure

Use Exit.isFailure(exit) for both this assertion and the following narrowing instead of reading exit._tag. The repository explicitly requires tests to use public Effect helpers rather than inspecting runtime representations, so this newly added failure-path test should follow the supported Exit API.

AGENTS.md reference: AGENTS.md:L169-L176

---

cli/apps/cli/src/shared/functions/serve.ts

Lines 344 to 345 in 214426e

	type:
	event._tag === "Create" ? "create" : event._tag === "Remove" ? "delete" : "update",

Match filesystem watch events exhaustively

Replace these direct event._tag checks and the fallback-to-update ternary with an exhaustive Match over the filesystem watch-event variants. Besides inspecting Effect's runtime representation directly, the current fallback silently classifies any future event variant as an update instead of producing the required type error at this behaviorally relevant event handler.

AGENTS.md reference: AGENTS.md:L169-L178

---

cli/apps/cli/src/next/commands/start/ui/dashboard-state.ts

Lines 44 to 48 in 214426e

	Effect.catchCause((cause) =>
	Effect.all([
	SubscriptionRef.set(errorRef, Cause.pretty(cause)),
	SubscriptionRef.set(phaseRef, "failed"),
	]).pipe(Effect.asVoid),

Preserve interruption when the state stream shuts down

Handle only the expected stream failure here and return interruption or defects unchanged with Effect.failCause. During normal dashboard-layer teardown, forkScoped interrupts this stream, but this unrestricted catchCause converts that interruption into success after setting the dashboard phase to failed, so a clean shutdown can briefly publish a false failure and the fiber loses its interruption semantics.

AGENTS.md reference: AGENTS.md:L157-L165

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2edae15c6c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jgoux]

Automated P1 cleanup pass is complete in a7c282d. I accepted the five findings in issuecomment-5388858414 after checking their actual control-flow impact: both missing-file paths and combined unlink errors now use supported tagged predicates; the credentials tests use Exit helpers throughout; filesystem watch events are matched exhaustively; and dashboard state catches only typed stream failures so interruption and defects retain their semantics. The two newer inline regressions are also fixed: compiled builds restore their immutable build ID define, and injected project environment capture preserves the established unprefixed Kong and Vector overrides.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7c282d0b3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d12a47a5f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass ambient env into direct config loads

When an Effect-native caller invokes loadProjectConfig without options.projectEnv, shell-only variables are no longer included in interpolation. Direct callers such as inferFunctionsManifest and the next-shell start/status handlers still use that form, so a config containing a numeric value such as port = "env(SUPABASE_DB_PORT)" now fails decoding when the variable exists only in the shell, while string references remain unresolved. The Node/Bun loadProjectConfig facades compensate for this, but loadFunctionsManifest and these internal callers bypass that facade; materialize the injected environment at their composition boundary and pass the resulting projectEnv.

AGENTS.md reference: AGENTS.md:L101-L108

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Serialize all scenario fixture writes

When record mode handles concurrent requests for different normalized fixture keys, each request runs under a different key-specific semaphore but both mutate the same scenario.log and asynchronously overwrite the same interactions.json. Even without teardown, one writer can encode an older snapshot and finish after a newer writer, dropping the later interaction or interleaving file writes; the previous synchronous write could not yield between the append and overwrite. Use a scenario-wide semaphore or a single writer for the shared scenario log and file.

AGENTS.md reference: AGENTS.md:L118-L122

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Fall back to the OS home for Docker contexts

When HOME, USERPROFILE, and DOCKER_CONFIG are absent—for example under a minimal service or cron environment—this leaves home undefined even though the OS account still has a home directory. dockerConfigDir then skips ~/.docker/config.json and the context store entirely, so commands using a non-default Docker context fall back to 127.0.0.1 while Docker operates against the remote daemon; the previous node:os homedir() lookup retained the OS-account fallback. Obtain the home directory from the injected runtime/OS service when neither environment variable is usable.

AGENTS.md reference: apps/cli/AGENTS.md:L52-L53

Useful? React with 👍 / 👎.