fix(cli): read piped stdin for gen signing-key's overwrite prompt (Go parity)#5794
Open
Coly010 wants to merge 4 commits into
Open
Conversation
… parity)
## Current Behavior
Go's overwrite-confirmation prompt for `gen signing-key` reads piped
stdin even in non-TTY mode (`internal/utils/console.go`'s
`PromptYesNo`/`ReadLine`, racing a 100ms timeout) and honors an
explicit y/n answer. The TS port's `signing-key.handler.ts` had its
own local `confirmOverwrite` that returned `true` unconditionally in
non-TTY mode without reading stdin at all, so `echo n | supabase gen
signing-key` silently overwrote the existing key file instead of
canceling — a data-loss risk for scripted/CI usage.
## Expected Behavior
- Deletes the local `confirmOverwrite` and switches the call site to
the shared `legacyPromptYesNo` helper (already used by `seed
buckets`, `config push`, `logout`, `storage rm`, `db pull`), which
already correctly implements Go's non-TTY read-with-timeout-and-parse
behavior.
- Swaps `LegacyYesFlag` for `legacyResolveYes` (matching those same
five callers), so `gen signing-key` now also honors `SUPABASE_YES`
and an explicit `--yes=false`, matching Go's `viper.GetBool("YES")`.
- Fails the overwrite closed (rather than silently defaulting to yes)
when a real interactive TTY requests a non-text `--output-format` —
this command has no structured json/stream-json payload
(SIDE_EFFECTS.md), and the shared helper's own default-on-non-text
short-circuit would otherwise silently overwrite irrecoverable key
material with no prompt at all. A non-TTY caller (piped or not) is
unaffected by this guard.
Fixes CLI-1865
Contributor
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5079b0c9b2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…Go parity) The runtime layer for `gen signing-key` never merged `stdinLayer`, unlike the other five `legacyPromptYesNo` callers (config push, seed buckets, storage rm, db pull, logout). A non-TTY overwrite prompt (e.g. `echo n | supabase gen signing-key`) reads `Stdin` via `legacyPromptYesNo`, so the missing layer crashed with "Service not found: supabase/runtime/Stdin" instead of honoring or defaulting the prompt (review: #5794).
… json/stream-json mode (Go parity) `legacyPromptYesNo` checks `output.format !== "text"` before it checks TTY, so a non-TTY invocation under `--output-format json`/`stream-json` (e.g. `printf 'n\n' | supabase gen signing-key --output-format json`) hit that check first and silently returned the default (true) without ever reading the piped answer. Go's `console.PromptYesNo` (apps/cli-go/internal/utils/console.go:64-82) has no concept of output format — it always reads piped stdin — so present a text-shaped view of `output` to `legacyPromptYesNo` whenever we're not already failing closed on a TTY, reaching its non-TTY read regardless of the declared format (review: #5794).
…5794) The Notes section already documented that the overwrite prompt honors SUPABASE_YES, but the Environment Variables table still said there were none.
Contributor
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@fb95891bb38ccffc51b8afdeff8f988e4036be2dPreview package for commit |
avallete
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Current Behavior
Go's overwrite-confirmation prompt for
gen signing-keyreads piped stdin even in non-TTY mode (internal/utils/console.go'sPromptYesNo/ReadLine, racing a 100ms timeout) and honors an explicit y/n answer. The TS port'ssigning-key.handler.tshad its own localconfirmOverwritethat returnedtrueunconditionally in non-TTY mode without reading stdin at all, soecho n | supabase gen signing-keysilently overwrote the existing key file instead of canceling — a data-loss risk for scripted/CI usage.Expected Behavior
confirmOverwriteand switches the call site to the sharedlegacyPromptYesNohelper (already used byseed buckets,config push,logout,storage rm,db pull), which already correctly implements Go's non-TTY read-with-timeout-and-parse behavior.LegacyYesFlagforlegacyResolveYes(matching those same five callers), sogen signing-keynow also honorsSUPABASE_YESand an explicit--yes=false, matching Go'sviper.GetBool("YES").--output-format— this command has no structured json/stream-json payload (SIDE_EFFECTS.md), and the shared helper's own default-on-non-text short-circuit would otherwise silently overwrite irrecoverable key material with no prompt at all. A non-TTY caller (piped or not) is unaffected by this guard.Fixes CLI-1865