@jhizzard/termdeck 0.6.5 → 0.6.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Browser-based terminal multiplexer with metadata overlays, panel flashback memory recall, and AI-aware session management",
   "bin": {
     "termdeck": "./packages/cli/src/index.js"

package/packages/cli/src/init-mnestra.js

@@ -385,12 +385,24 @@ async function verifyStatus(client) {
 // on disk first; config.yaml only flips to rag.enabled=true once the
 // schema is actually in place.
 function writeSecretsFile(inputs, dryRun) {
+  // Normalize transaction-pooler URLs by appending pgbouncer=true&
+  // connection_limit=1 when missing. Brad's Rumen logs (2026-04-26)
+  // surfaced the warning Supabase recommends: transaction-mode pooling
+  // (port 6543) needs those params or PgBouncer can return prepared-
+  // statement errors under load. Direct connections and session-mode
+  // pooler URLs are returned unchanged. See setup/supabase-url.js.
+  const normalized = urlHelper.normalizeDatabaseUrl(inputs.databaseUrl);
+  if (normalized.modified) {
+    step('Detected transaction pooler URL — appending ?pgbouncer=true&connection_limit=1...');
+    ok();
+  }
+
   step('Writing ~/.termdeck/secrets.env...');
   if (dryRun) { ok('(dry-run)'); return; }
   dotenv.writeSecrets({
     SUPABASE_URL: inputs.projectUrl.url,
     SUPABASE_SERVICE_ROLE_KEY: inputs.serviceRoleKey,
-    DATABASE_URL: inputs.databaseUrl,
+    DATABASE_URL: normalized.url,
     OPENAI_API_KEY: inputs.openaiKey,
     ...(inputs.anthropicKey ? { ANTHROPIC_API_KEY: inputs.anthropicKey } : {})
   });

package/packages/cli/src/init-rumen.js

@@ -166,6 +166,20 @@ function preflight() {
   }
   ok();
 
+  // Normalize DATABASE_URL for transaction-pooler usage (v0.6.6+). Users
+  // whose ~/.termdeck/secrets.env was written by an earlier wizard version
+  // may have a Shared Pooler URL without ?pgbouncer=true. The Edge Function
+  // logs a warning when that's the case (Brad's 2026-04-26 report). Fix it
+  // here in-memory before forwarding to `supabase secrets set` so the
+  // Function gets a clean URL even on partial-upgrade installs. Direct
+  // connections and session-mode pooler URLs are returned unchanged.
+  const normalized = urlHelper.normalizeDatabaseUrl(secrets.DATABASE_URL);
+  if (normalized.modified) {
+    step('Detected transaction pooler URL — appending ?pgbouncer=true&connection_limit=1 for the Edge Function...');
+    secrets.DATABASE_URL = normalized.url;
+    ok();
+  }
+
   // OPENAI_API_KEY is optional: when present, Rumen's Relate phase generates
   // real embeddings for semantic+keyword hybrid search. When absent, Rumen
   // falls back to keyword-only matching (still works, but loses cross-project
@@ -455,6 +469,78 @@ async function applySchedule(projectRef, secrets, dryRun) {
   }
 }
 
+// Backfill SUPABASE_ACCESS_TOKEN into ~/.claude/mcp.json's Supabase MCP
+// server entry. Background: the meta-installer (`@jhizzard/termdeck-stack`)
+// writes `SUPABASE_ACCESS_TOKEN: 'SUPABASE_PAT_HERE'` as a literal
+// placeholder when it wires the Supabase MCP entry. The user is expected
+// to replace it after install. v0.6.4 unblocked the Rumen install path by
+// telling users to `export SUPABASE_ACCESS_TOKEN=sbp_...` in their shell —
+// but that token only got used for `supabase link`, never propagated into
+// `~/.claude/mcp.json`. So Brad's Claude Code was talking to a Supabase
+// MCP server with a placeholder token. He had to update the JSON file
+// manually. Reported 2026-04-26 — Brad's quote: "the token hadn't been
+// written to the Json file which we updated manually, but you may want
+// to put that in the patch at some point."
+//
+// This helper closes the loop. Idempotent and conservative:
+//   - Only runs if process.env.SUPABASE_ACCESS_TOKEN is set
+//   - Only updates when the existing value is the literal placeholder
+//     'SUPABASE_PAT_HERE' — preserves any real token the user already set
+//   - No-op when ~/.claude/mcp.json doesn't exist (user never ran the
+//     meta-installer's Tier 4) or when there's no `supabase` MCP entry
+//   - No-op (with a soft warning) when the JSON is malformed
+//   - Atomic write via tmp-and-rename; mode 0600 to match the file's
+//     existing permissions (it already holds the placeholder)
+//   - All other mcpServers entries preserved verbatim
+//
+// Returns one of: { status: 'updated', path }, { status: 'already-set', path },
+//   { status: 'no-file' }, { status: 'no-supabase-entry', path },
+//   { status: 'no-token-in-env' }, { status: 'malformed', path, error }.
+function wireAccessTokenInMcpJson({ token, mcpJsonPath, _testFs } = {}) {
+  const fsImpl = _testFs || fs;
+  const tokenValue = token || process.env.SUPABASE_ACCESS_TOKEN;
+  if (!tokenValue) return { status: 'no-token-in-env' };
+
+  const targetPath = mcpJsonPath || path.join(os.homedir(), '.claude', 'mcp.json');
+  if (!fsImpl.existsSync(targetPath)) return { status: 'no-file' };
+
+  let raw;
+  try {
+    raw = fsImpl.readFileSync(targetPath, 'utf-8');
+  } catch (err) {
+    return { status: 'malformed', path: targetPath, error: err.message };
+  }
+
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch (err) {
+    return { status: 'malformed', path: targetPath, error: err.message };
+  }
+
+  const supabaseEntry = cfg && cfg.mcpServers && cfg.mcpServers.supabase;
+  if (!supabaseEntry || typeof supabaseEntry !== 'object') {
+    return { status: 'no-supabase-entry', path: targetPath };
+  }
+
+  supabaseEntry.env = supabaseEntry.env || {};
+  const current = supabaseEntry.env.SUPABASE_ACCESS_TOKEN;
+  if (current === tokenValue) return { status: 'already-set', path: targetPath };
+  if (current && current !== 'SUPABASE_PAT_HERE') {
+    // User has set a real token already — don't touch it.
+    return { status: 'already-set', path: targetPath };
+  }
+
+  supabaseEntry.env.SUPABASE_ACCESS_TOKEN = tokenValue;
+
+  const tmpPath = `${targetPath}.tmp.${process.pid}`;
+  fsImpl.writeFileSync(tmpPath, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
+  fsImpl.renameSync(tmpPath, targetPath);
+  try { fsImpl.chmodSync(targetPath, 0o600); } catch (_e) { /* best-effort */ }
+
+  return { status: 'updated', path: targetPath };
+}
+
 function printNextSteps(projectRef) {
   const functionUrl = `https://${projectRef}.supabase.co/functions/v1/rumen-tick`;
   const now = new Date();
@@ -508,6 +594,26 @@ async function main(argv) {
   }
 
   if (!(await link(projectRef, flags.dryRun))) return 4;
+
+  // Backfill SUPABASE_ACCESS_TOKEN into ~/.claude/mcp.json now that
+  // `supabase link` succeeded (the token is verified-real). The
+  // meta-installer wrote a literal 'SUPABASE_PAT_HERE' placeholder
+  // there during Tier 4 install — this closes that loop.
+  if (!flags.dryRun) {
+    const r = wireAccessTokenInMcpJson();
+    if (r.status === 'updated') {
+      step('Backfilled SUPABASE_ACCESS_TOKEN into ~/.claude/mcp.json...');
+      ok();
+    } else if (r.status === 'malformed') {
+      process.stderr.write(
+        `\n  ! ${r.path} is not valid JSON — skipping token backfill (${r.error}).\n` +
+        `    Update the supabase mcpServers entry manually if Claude Code's Supabase MCP is misbehaving.\n\n`
+      );
+    }
+    // Other statuses (no-file, no-supabase-entry, no-token-in-env,
+    // already-set) are silent — they're all expected paths.
+  }
+
   if (!(await applyRumenTables(secrets, flags.dryRun))) return 5;
 
   step('Resolving @jhizzard/rumen version from npm registry...');
@@ -545,3 +651,4 @@ module.exports = main;
 // Test surface — kept on the same export object so the regression suite can
 // pin the access-token detection without spawning a real `supabase` binary.
 module.exports._looksLikeMissingAccessToken = looksLikeMissingAccessToken;
+module.exports._wireAccessTokenInMcpJson = wireAccessTokenInMcpJson;

package/packages/server/src/setup/supabase-url.js

@@ -97,6 +97,65 @@ function looksLikePostgresUrl(url) {
   return null;
 }
 
+// Detect a Supabase Shared Pooler URL in TRANSACTION mode. Pattern:
+//   postgres://postgres.<ref>:<pw>@aws-0-<region>.pooler.supabase.com:6543/postgres
+// Session mode (port 5432 on the pooler) and direct connections
+// (db.<ref>.supabase.co:5432) do NOT need pgbouncer params and must be
+// left alone. Returns true only for the transaction-pooler shape.
+function isTransactionPoolerUrl(parsedUrl) {
+  if (!parsedUrl) return false;
+  const host = (parsedUrl.hostname || '').toLowerCase();
+  // pooler hosts end in `.pooler.supabase.com`. Be lenient on the regional
+  // prefix — Supabase has used `aws-0-` historically and may add others.
+  if (!host.endsWith('.pooler.supabase.com')) return false;
+  // Transaction mode is port 6543. Session mode on the same host is 5432
+  // and doesn't want pgbouncer flags.
+  return parsedUrl.port === '6543';
+}
+
+// Normalize a DATABASE_URL by appending the pgbouncer transaction-mode
+// params Supabase requires when connecting through a transaction pooler.
+//
+// Brad's Rumen logs (2026-04-26) warned:
+//   "DATABASE_URL is a Shared Pooler URL but does not have ?pgbouncer=true.
+//    Append ?pgbouncer=true&connection_limit=1 for transaction-mode
+//    compatibility."
+//
+// The warning is harmless on its own — Rumen's runtime didn't fail because
+// of it — but missing the params can manifest as prepared-statement errors
+// or stuck connections under load with PgBouncer in transaction mode. The
+// safest path is for the wizard to add them on the user's behalf when the
+// URL shape clearly indicates they're needed.
+//
+// Returns `{ url, modified }`. `modified` is true when params were added.
+// Idempotent: a URL that already has pgbouncer=true is returned unchanged.
+// Only touches transaction-pooler URLs (port 6543 on *.pooler.supabase.com).
+// Direct connections (port 5432, db.* hostname) and session-pooler URLs
+// (port 5432 on pooler hostname) are returned unchanged.
+//
+// Errors are swallowed — a malformed URL returns `{ url: original, modified: false }`
+// because validation is the caller's job (looksLikePostgresUrl handles that).
+function normalizeDatabaseUrl(url) {
+  if (!url || typeof url !== 'string') return { url, modified: false };
+  let u;
+  try {
+    u = new URL(url);
+  } catch (_err) {
+    return { url, modified: false };
+  }
+  if (!isTransactionPoolerUrl(u)) return { url, modified: false };
+
+  // Already has pgbouncer set? Don't touch.
+  if (u.searchParams.has('pgbouncer')) return { url, modified: false };
+
+  u.searchParams.set('pgbouncer', 'true');
+  // Set connection_limit only if not already set — preserve user intent.
+  if (!u.searchParams.has('connection_limit')) {
+    u.searchParams.set('connection_limit', '1');
+  }
+  return { url: u.toString(), modified: true };
+}
+
 // Mask all but the last 4 chars of a secret for logging.
 function maskSecret(value) {
   if (!value || typeof value !== 'string') return '';
@@ -110,5 +169,7 @@ module.exports = {
   looksLikeOpenAiKey,
   looksLikeAnthropicKey,
   looksLikePostgresUrl,
+  isTransactionPoolerUrl,
+  normalizeDatabaseUrl,
   maskSecret
 };