[pull] master from supabase:master - #1183
Merged
Merged
Conversation
## Summary - Update `apps/studio` to `@supabase/mcp-server-supabase` `^0.11.0` and add its required `@modelcontextprotocol/server` `^2.0.0` peer. - Keep `@modelcontextprotocol/sdk` `^1.29.0` for Studio's existing transports. `@supabase/mcp-utils` resolves transitively to `0.7.0`, so it remains indirect. [AI-1107](https://linear.app/supabase/issue/AI-1107/2b-update-self-hosted-remote-mcp-server) ## Testing - Five focused MCP test files passed, 47 tests total. - Studio production build passed with `SKIP_ASSET_UPLOAD=1`. - A real `POST` initialize request to the built self-hosted `/api/mcp` endpoint returned HTTP 200 with `serverInfo.version` `0.11.0`. - Studio typecheck still reports one pre-existing error in unchanged `packages/ui-patterns/src/McpUrlBuilder/components/InstructionBlocks.tsx:20`: `string` is not assignable to `StaticImageData`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Improvements** - Improved compatibility with the latest MCP server capabilities. - Refreshed the Supabase MCP integration for a more up-to-date experience. - Verified that the available MCP tools remain consistent after the update. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary - Add `update_notebook` eval cases (insert/replace/delete/move, a combined delete+insert, and guard/safety cases) mirroring the existing `create_notebook` cases, targeting the notebooks already seeded in the mock tool harness. - Fix two behavior gaps in `NOTEBOOKS_PROMPT`/`LIMITATIONS_PROMPT` that these cases surfaced when run live: the assistant asking the user for a notebook id instead of resolving it via `list_notebooks`, and the destructive-operations warning rule not being connected to SQL written into notebook cells. - Soften the destructive-SQL case's `correctAnswer` to match `update_notebook`'s real approval-gated behavior — a warning accompanying the reported change is acceptable, not only one strictly preceding the tool call. ## Test plan - [x] `pnpm run typecheck` (apps/studio) — clean - [x] `pnpm exec prettier --check` on both changed files — clean - [x] `evals/scorer.test.ts`, `evals/transcript.test.ts`, `evals/trace-utils.test.ts` — 21/21 pass - [x] Ran the new eval cases live against OpenAI (bypassing the Braintrust proxy) via Braintrust MCP; confirmed via trace inspection that the prompt fix resolved the id-resolution gap (Tool Usage 0% → 100% across 3 trials) and that the assistant now includes an explicit irreversibility warning when destructive SQL is written into a notebook cell <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved notebook creation and editing support across SQL, query, chart, and time-range cells. - Added clearer handling for saved notebooks, recurring requests, and one-time SQL execution. - Enhanced validation for database cells and notebook configuration. - **Bug Fixes** - Improved safeguards and warnings for destructive queries, including saved notebook queries. - Better handling of missing tables and notebooks. - More precise notebook cell updates and tool usage validation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds a `list_databases` tool to the notebook AI tools
(`getNotebookTools`), returning `{ identifier, is_primary, region,
status }` for the project's primary and any read replicas, via
`getReadReplicas`.
- Registers `list_databases` in `tool-filter.ts` (opt-in validation
schema + SCHEMA category), and adds a mock fixture in `mock-tools.ts`
for evals.
Part 2/6 of the stack for FE-4225 (expose valid database identifiers to
the notebook AI agent). Stacked on #49327. A later PR in the stack
reinstates `database_identifier` on the agent-facing notebook schema and
requires the agent to call this tool first.
## Test plan
- [x] New test coverage in `notebook-tools.test.ts` for
`list_databases`, including `is_primary` computation
- [x] Existing exact-tool-set assertion updated
- [x] `pnpm --filter studio exec tsc --noEmit` passes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an AI notebook tool for listing a project’s databases.
* Results include each database’s identifier, region, status, and
whether it is the primary database.
* Supports projects with read replicas.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The support form was exempted from the highest AAL check (since the original MFA rollout in #16813) so that users stuck on the MFA challenge could still file a ticket. The platform API now rejects AAL1 sessions with `403 Insufficient AAL: MFA required`, so for those users the form is simply broken — it renders an error toast and the submit would fail too. This requires AAL2 on `/support/new`, so an AAL1 session gets redirected to the MFA challenge and returns to the form afterwards, and removes the links to the support form from the MFA screen. A dedicated flow for users who can't get past MFA to reach us is being worked on separately and should be out soon! Fixes FE-4218 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added an “Email support” action for multi-factor authentication issues, with a prefilled subject line. - Provided clearer guidance when authentication factors cannot be retrieved. - **Bug Fixes** - Improved authentication error handling based on the session’s assurance level. - Reduced confusing permission and error messages for lower-assurance sessions. - Updated support page access to use standard authentication behavior for a more consistent sign-in experience. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…49331) ## Summary - Automatically deny notebook tool proposals with specific error reasons when client-side diff validation fails (e.g., unknown cell ID) - Enables the AI Assistant to see the actual failure reason and retry automatically instead of requiring manual user intervention - Exposes the same `describeNotebookOperationError` helper used server-side for consistent error messaging - Adds `denyWithReason()` to manual tool approval handlers for flexible denial messaging ## Test plan - Run `pnpm --filter studio exec vitest run apps/studio/components/ui/AIAssistantPanel/Confirm.utils.test.ts` to verify denyWithReason tests - Run `pnpm --filter studio exec vitest run apps/studio/components/ui/AIAssistantPanel/NotebookProposalRenderer.test.tsx` to verify auto-deny behavior, Skip fallback, and no re-fire after approval is already handled - Confirm no regressions in existing notebook tool approval flows ## Manual testing - Get assistant to create a notebook. - Open the notebook and manually delete a cell yourself. - Ask the assistant to delete the cell you just deleted. - Assistant should automatically recover from the error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Notebook proposals now display clear success, error, and denial outcomes. * Tool errors for SQL, Edge Functions, and notebooks now appear in their respective result views. * Output links are supported in notebook proposal results. * Approval panels remain visible after completed actions with standardized status messages. * **Bug Fixes** * Specific denial reasons are preserved instead of showing a generic skipped message. * Unapplyable notebook updates are automatically denied with an explanation. * Prevented duplicate denial responses after approval decisions. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…chema (#49332) ## Summary - Reverts #49326's temporary mitigation, which stripped `database_identifier` from the agent-facing notebook cell schema (`agentCellSchema`) because the assistant had no legitimate source of truth for valid read-replica identifiers. - The previous PR in this stack (#49328) added the `list_databases` tool, so that source of truth now exists — `database_cell`s can carry `database_identifier` again. Part 3/6 of the stack for FE-4225 (expose valid database identifiers to the notebook AI agent). Stacked on #49328. ## Test plan - [x] Existing schema/preview tests (reverted alongside the mitigation) pass - [x] `pnpm --filter studio exec tsc --noEmit` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * AI-generated notebook database cells now support database identifiers. * Notebook previews display the associated database source, including transitions between primary and replica databases. * **Bug Fixes** * Improved database metadata handling to preserve identifiers when updating notebook cells. * Database information is now shown only when available, preventing inaccurate or missing metadata displays. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
…book (#49333) ## Summary - `create_notebook`/`update_notebook` now validate every `database_cell`'s `database_identifier` against the project's real database list (`getReadReplicas`) before writing, throwing an assistant-actionable `NotebookToolError` (same pattern as the existing `expected_updated_at` mismatch check) when it doesn't match. - Only fetches the database list when a cell actually sets `database_identifier` — no added cost for the common case. - `update_notebook` validates only the cells its own operations introduce (`insert_cell`/`replace_cell`), not the whole resulting notebook — otherwise an unrelated, untouched pre-existing cell whose replica was removed after the fact would block updates that never touch it. Part 4/6 of the stack for FE-4225 (expose valid database identifiers to the notebook AI agent). Stacked on #49332. This closes the gap that PR 3 reopened: a model can no longer invent an identifier that silently breaks a cell — it now gets a retryable error naming `list_databases` (added in #49328) as the way to find a real one. ## Test plan - [x] `create_notebook`/`update_notebook` reject an unknown `database_identifier` with `NotebookToolError` + `exposeToAssistant: true` - [x] Both succeed when the identifier matches a real database - [x] `create_notebook` never calls the databases endpoint when no cell sets `database_identifier` - [x] `update_notebook` succeeds without validating or fetching databases when no operation introduces a database_cell, even if an untouched existing cell carries a now-invalid identifier - [x] `pnpm --filter studio exec tsc --noEmit` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a database-listing tool that provides database identifiers and metadata, including primary-database status. * Database results now return only the relevant fields. * **Bug Fixes** * Added validation to prevent notebooks from referencing unknown databases. * Create and update actions now provide clear errors for invalid database identifiers. * Updates validate newly added or replaced cells while preserving existing, untouched cells. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
) Closes DOCS-1281 ## Problem Two defects in the "Related error codes" list, both from the page diverging from what `Troubleshooting.utils.ts` already does. * **Empty pills.** `formatError` returns an empty string when an error has neither an HTTP status code nor a code. The page renders the pill anyway, giving a link with no text whose `href` ends in `errorCodes=` with no value. So it is both an unnamed link and a pill filtering on nothing. * **Duplicate pills.** The same formatted code renders once per underlying error object, so one entry shows seven identical "500 unexpected_failure" pills. Measured on production, across the 59 entries that render the section: | | Count | | -- | -- | | Entries with an empty pill | 23 | | Empty pills | 33 | | Entries with duplicate pills | 4 | | Redundant pills | 9 | The guard also evaluated to `0` rather than `false` for an empty array, which React renders as a literal "0". ## Solution * Derive the formatted codes once, drop the empties, and dedupe. An entry whose every code formats empty no longer renders a heading and rule with nothing under them. * Call `formatError` once per code instead of twice per pill, and key on the code now that codes are unique. * Fix the same `0`-rendering guard on the keywords section. `Troubleshooting.utils.ts` already filters on `error?.http_status_code || error?.code` at lines 69 and 150, and already dedupes by formatted code at lines 72 to 79. This brings the page in line with the sidebar and filter list rather than introducing a new pattern. `formatError` itself is unchanged. It also produces grouping and sort keys in `Troubleshooting.utils.ts` and `Troubleshooting.ui.tsx`, so changing its return contract would reach well beyond this fix. ## Manual testing Compare each page against production, which still shows both defects. 1. Open [dashboard-errors-when-managing-users on production](https://supabase.com/docs/guides/troubleshooting/dashboard-errors-when-managing-users-N1ls4A). It shows 8 pills: seven identical "500 unexpected_failure" and one empty. 2. Open [the same page on the preview](https://docs-git-docs-troubleshooting-empty-error-pills-supabase.vercel.app/docs/guides/troubleshooting/dashboard-errors-when-managing-users-N1ls4A). One "500 unexpected_failure" pill remains. 3. Open [prisma-error-management on production](https://supabase.com/docs/guides/troubleshooting/prisma-error-management-Cm5P_o). It shows 6 empty pills. 4. Open [the same page on the preview](https://docs-git-docs-troubleshooting-empty-error-pills-supabase.vercel.app/docs/guides/troubleshooting/prisma-error-management-Cm5P_o). The section is gone, because every code on that entry formats empty. 5. Run axe on either preview page. `link-name` reports zero elements. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved troubleshooting displays by formatting and deduplicating error values. * Removed empty or invalid error entries from the rendered results. * Related error-code links now appear only when valid error codes are available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Closes FE-4097 https://github.com/user-attachments/assets/bc7cad1a-763e-469f-8a3b-e4d23bed94d9 _See bottom left of screen for screen reader captions._ ## Problem Two controls in the shared `/features/[slug]` template have no accessible name. Both live in the template, so both fire on all 79 feature pages. * The feature list dropdown trigger contains only a `List` icon. `button-name`, critical. * The breadcrumb back chevron wraps only a `ChevronLeft`. `link-name`, serious. ## Solution * Name both with `sr-only` text, matching the sibling prev and next controls in the same component and the theme switcher in the site header. * Label the product pill with its destination. It announced only "vector", with no indication it filters the catalog. Not an axe finding, since the product name already supplies a name. The label keeps the visible word so it satisfies WCAG 2.5.3 Label in Name. * Fix a stray `className="` inside the `iconClassName` string literal, which dropped the icons' width class. * Add `cursor-pointer` to `buttonClassName`. Tailwind 4 no longer sets a pointer cursor on buttons, so the middle control behaved differently from its two anchor siblings. This line belongs to FE-4227 and sits here only to keep two open PRs off adjacent lines of the same file. ## Manual testing 1. Open [/features/ai-integrations](https://zone-www-dot-com-git-www-features-chrome-access-1aef01-supabase.vercel.app/features/ai-integrations) using a Screenreader. 2. Tab through the three round controls at top right. They announce "Previous feature", "Browse all features", "Next feature". **Note:** The order of the elements is strange; captured in a separate ticket. 3. Tab to the round back control at top left. It announces "Back to all features". 4. Tab to the product pill beside it. It announces "All vector features", and the visible word "vector" is unchanged. 5. Hover each of the three round controls. All show a pointer cursor. 6. Run axe on the page. `button-name` and `link-name` report zero elements. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
## Summary - Adds a bullet to `NOTEBOOKS_PROMPT` instructing the assistant to call `list_databases` before setting a `database_cell`'s `database_identifier`, mirroring the existing `list_tables` schema-validation instruction immediately above it. Part 5/6 of the stack for FE-4225 (expose valid database identifiers to the notebook AI agent). Stacked on #49333. This is the last piece that makes the assistant actually *use* the tool and schema field wired up earlier in the stack, rather than just having them available. ## Test plan - [x] `pnpm --filter studio exec tsc --noEmit` passes - [x] `prettier --check` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved notebook database configuration by ensuring database identifiers are selected from available databases. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
#49393) ## Problem Some users have more than 100 projects and our current UI has the following issues: 1. The project selector only loads the first 100 making it impossible to see more 2. The review step and the token permissions view only loads the first 100 so we may display invalid warnings about missing projects However, we currently don't have an API route to fetch many projects by their refs in a single call. ## Solution 1. Make sure we load more projects when scrolling down in the project selector 2. When below 100 project, show the admonition for missing resources. Anyone above for the time being won't see these message and we display the project refs instead of their names <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved scoped access-token setup with paginated project loading and an easier scrolling project selector. - Organization and project access are now displayed as separate, clearer access indicators. - Access details show project information when available, with a fallback reference when details cannot be loaded. - **Bug Fixes** - Updated resource warnings to better reflect deleted resources and large project lists. - Improved multi-select list handling for more reliable interactions. - Preserved the name of inaccessible organizations when displaying lost access. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Fixes false-negative "This update can't be applied" warning for
completed notebook updates (FE-4243)
- When `state='output-available'` (tool completed), skips notebook fetch
and diff derivation
- Renders compact "Notebook updated: {name}" instead of a phantom/failed
diff
- `UnapplyableNotebookUpdateNotice` now accepts and forwards
`footerAction` prop, preserving "Open notebook" link
- Different warning copy for terminal confirm states
(success/error/denied): "Preview unavailable / notebook has changed"
instead of "can't be applied"
- Preserves diff derivation for non-completed states
(output-denied/error)
This is PR 1 of a 3-PR stack; PRs 2-3 restore the full diff preview for
completed updates (requires server snapshot).
Towards FE-4243
## Test plan
- [x] All 15 tests in NotebookProposalRenderer.test.tsx pass
- [x] Typecheck clean
- [x] ESLint clean
- [x] Regression tests added: completed updates with missing target
cells (auto & manual approval)
- [x] Confirms denied/error states still derive against live content
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added clearer status handling for AI-generated notebook updates.
- Completed updates now show a confirmation with the notebook name when
available.
- Update actions and footer controls now adapt to the proposal’s current
state.
- **Bug Fixes**
- Improved messaging when notebook changes prevent an update preview
from being reconstructed.
- Preserved accurate previews for denied or failed updates using the
notebook’s latest content.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
…ion (#49398) ## Summary - Adds three eval cases exercising the behavior this stack wires up: a happy path where the model calls `list_databases` before targeting a named read replica, a guard against fabricating an identifier when the user names a region/replica `list_databases` doesn't actually return, and a guard against targeting a non-primary database when the user never asked for one. Part 6/6 (final) of the stack for FE-4225 (expose valid database identifiers to the notebook AI agent). Stacked on #49334. ## Test plan - [x] Ran all three cases against the real model; inspected transcripts directly - [x] Re-verified reworded `correctAnswer` text against real outputs via the correctness evaluator - [x] `pnpm --filter studio exec tsc --noEmit` passes - [x] `prettier --check` passes <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added evaluation coverage for selecting the correct database replica when creating notebooks. * Verified primary-database defaults when no database is specified. * Added checks to prevent fabricated database identifiers when a requested replica is unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )