fix(settings): re-land orphaned auto-mode supabase soft-deny from #2195

[BigSimmo]

Summary

• Re-land the auto-mode Supabase fix from PR chore(claude): scope auto-mode environment rules to this project #2195, which was orphaned by the auto-merge race and never reached main. The commit is cherry-picked unchanged (a1259e5e9 → 3151c1e4e), authorship preserved.
• Moves Bash(supabase migration list:*) and other read-only supabase inspection subcommands out of autoMode.allow and into autoMode.soft_deny, and adds the guard test that pins it there.

Why this PR exists. PR #2195 had squash auto-merge armed. GitHub merged it the moment the required checks went green, at head a96f5307. The Codex auto-resolve workflow pushed its P1 fix to the branch roughly five minutes later, at a1259e5e9 — after the PR was already merged and closed. GitHub resolved the review thread, so the finding reads as fixed, but main at 2abbe006 still carries the original rule in autoMode.allow and does not contain the guard test. Verified with git merge-base --is-ancestor a1259e5e9 origin/main (false) and by reading .claude/settings.json at origin/main.

Why the finding is correct (verified independently rather than taken on the reviewer's word): npx supabase migration list --linked is the repository's own documented flow (README.md:64, docs/supabase-migration-reconciliation.md:14) and it reads the live linked project, while AGENTS.md:512 requires explicit confirmation for any Supabase interaction, "including indirect tooling". Allowing it in auto mode was a real, if narrow, hole: an autonomous read against the live Clinical KB Database project with no prompt.

Verification

• npx vitest run tests/claude-code-settings.test.ts tests/session-start-hook.test.ts:

 Test Files  2 passed (2)
      Tests  101 passed (101)

• Mutation-checked the new guard rather than trusting a green run. With the rule deliberately moved back into autoMode.allow, the new test fails as it should:

 × soft-denies live supabase inspection in auto mode
AssertionError: expected true to be false
 Tests  1 failed | 89 passed (90)

The working tree was restored to HEAD afterwards. A check that cannot fail is not a check.

• npx prettier --check .claude/settings.json tests/claude-code-settings.test.ts → All matched files use Prettier code style!
• Confirmed post-change state: autoMode.allow contains no supabase rule; autoMode.soft_deny contains the inspection rule.

Verification not run: the full npm run verify:pr-local. The diff is one relocated configuration string plus a seven-line test, in the same file scope as #2195, which classifyPullRequestFiles returns as clinicalRisk: false, operationalRisk: false, ragRanking: false, ui: false. The committed tests that parse this file are the smallest checks capable of detecting a regression here, and the new one is proven able to fail. CI's pr-required aggregate remains the backstop.

Risk and rollout

• Risk: Low, and in the safe direction — this narrows what auto mode may do without asking. The realistic cost is one extra confirmation prompt when running supabase migration list --linked, which is the documented intent.
• Rollback: git revert this commit; behaviour returns to today's main.
• Provider or production effects: None. No Supabase, OpenAI, Railway, or hosted-CI call was made.
• RAG impact: none

Follow-up worth considering (not in this PR)

The auto-merge race that stranded this fix is not specific to it: any PR with auto-merge armed can have a late review-bot fix land after the merge, with the review thread still auto-resolved so nothing looks wrong. docs/outstanding-issues.md may be the right home for that.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in: 6 minutes

Limit details: You’ve used the included review currently available. Your 84 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 22070126-8bc4-4fa4-bb4a-71ad174c2010

📥 Commits

Reviewing files that changed from the base of the PR and between 1cc0d29 and 41aefe6.

📒 Files selected for processing (2)

• .claude/settings.json
• tests/claude-code-settings.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.