#3150 fix(cli): upload via CF workers instead of Supabase edge

Summary (AI generated)

• CLI src/ no longer calls supabase.rpc. Remaining RPC helpers now go through Capgo HTTP /private/cli wrappers (orgs, check-plan, check-2fa-org, org-member-compliance, channel-current-bundle) plus the existing upload helpers.
• Upload hot path still uses Capgo HTTP / Cloudflare workers via invokeCapgoCliApi (bundle/prepare, bundle/lookup, finish_tus_upload).
• Added cli/test/test-no-rpc.mjs so CI fails if cli/src grows a new .rpc( call.
• GET organization HTTP payload now includes security fields (enforcing_2fa, password and API-key policy flags).
• CLI 2FA preflight HTTP gates now accept the app/org permissions real commands use, plus a live role_bindings row on that app with scope_type app or channel (covers channel-scoped keys without a channel id; bundle-only bindings stay out).
• Identity, permission, org-list, and init org-selection helpers thread explicit supaHost / supaAnon (no protected SupabaseClient field reads in permission gates).
• prepare_upload validates request basics and checks app.upload_bundle before loading an existing version row; r2 finalize rules run after auth.
• Merged origin/main (2026-09-09) to restore mergeability; kept append-only migration timestamps and combined test script entries from both branches.

Motivation (AI generated)

CLI supabase-js RPC calls crash in production. The CLI needs real HTTP APIs and must verify those APIs instead of calling PostgREST RPCs from the client. After the HTTP migration, review found self-host host threading gaps, prepare_upload oracle risk on unauthorized keys, and merge drift with main.

Business Impact (AI generated)

Stops CLI RPC crashes for org list, plan checks, 2FA, and channel current-bundle, keeps bundle upload on the stable Capgo HTTP path, and keeps self-host / scoped API keys working after the RPC-to-HTTP cutover.

Test Plan (AI generated)

• cli/src has zero .rpc( (enforced by test:no-rpc)
• Local CLI tests: no-rpc, permission helper, upload-http-path, 2FA network, plan validation, create-supabase-client host options
• tests/cli-app-permission-helper.test.ts spreads real cli/src/utils and mocks hasCliPermissionViaHttp path (local vitest)
• bun run typecheck in cli/ passes
• Backend tests in tests/cli-upload-http.test.ts and tests/bundle.test.ts for prepare/invalid storage_provider and staged r2-direct SQL locks
• Private TUI suite green (appflow p8 provide journey pin)
• GitHub CI green on HEAD f9b20c475 (in progress after main merge)
• 0 unresolved review threads on HEAD

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features

  • CLI operations now use HTTP services for permissions, organization management, channel access, bundle uploads, versioning, and upload completion.
  • Added bundle lookup and upload preparation with version validation and secure storage handling.
  • Added private authorization and upload-completion service routes.
  • Added support for custom service hosts and API-key-based access checks.

• Bug Fixes

  • Improved iOS onboarding credential handling and resume behavior.
  • Fixed pasted text submission in filtered inputs.
  • Improved transient network-error handling and compliance reporting.
  • Strengthened app ID conflict suggestions and upload security validation.