fix(ci): stop flaky shard reds and cut wasted runner minutes

cli/src/bundle/auto-bump-ai.ts

@@ -1,6 +1,6 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
-import type { Database } from '../types/supabase.types.ts'
-import type { AutoBumpLevel } from '../versionHelpers.ts'
+import type { Database } from '../types/supabase.types'
+import type { AutoBumpLevel } from '../versionHelpers'
 import { log } from '@clack/prompts'
 import { generateManifest, invokeCapgoCliApi } from '../utils'
 

cli/test/prescan/request-gate.test.ts

@@ -218,7 +218,7 @@ describe('permission backstop fires before the POST on the prescan-skipped and -
       true,
     )
     expect(result.success).toBe(false)
-    expect(result.error).toMatch(/insufficient permissions to request a native build/i)
+    expect(result.error).toMatch(/missing app\.build_native permission/i)
     expect(probe.postedBuildRequest).toBe(false)
   })
 
@@ -233,7 +233,7 @@ describe('permission backstop fires before the POST on the prescan-skipped and -
       true,
     )
     expect(result.success).toBe(false)
-    expect(result.error).toMatch(/insufficient permissions to request a native build/i)
+    expect(result.error).toMatch(/missing app\.build_native permission/i)
     expect(probe.postedBuildRequest).toBe(false)
   })
 })

package.json

@@ -92,14 +92,14 @@
     "test:all:local": "bun run test:all",
     "test:backend": "bun run supabase:with-env -- bunx vitest run --exclude=tests/cli*",
     "test:plugin": "bun run supabase:with-env -- bunx vitest run tests/updates*.test.ts tests/stats*.test.ts tests/channel_self*.test.ts",
-    "test:api": "bun run supabase:with-env -- bunx vitest run --exclude=tests/cli* --exclude=tests/updates* --exclude=tests/stats* --exclude=tests/channel_self*",
+    "test:api": "bun run supabase:with-env -- bunx vitest run --exclude=tests/cli* --exclude=tests/updates* --exclude=tests/stats* --exclude=tests/channel_self* --exclude=tests/channel-rate-limit.test.ts",
     "test:channel_devices": "bun run supabase:with-env -- bunx vitest run tests/channel_devices/*.test.ts",
     "test:cli": "bun run cli:build && bun run supabase:with-env -- bunx vitest run tests/cli*",
     "test:cli:local": "bun run test:cli",
     "test:cloudflare:all": "vitest run tests/* --config vitest.config.cloudflare.ts",
     "test:cloudflare:backend": "vitest run --exclude=tests/cli* --config vitest.config.cloudflare.ts",
-    "test:cloudflare:plugin": "USE_CLOUDFLARE_WORKERS=true vitest run tests/updates*.test.ts tests/stats*.test.ts tests/channel_self*.test.ts --config vitest.config.cloudflare-plugin.ts",
-    "test:cloudflare:api": "vitest run --exclude=tests/cli* --exclude=tests/updates* --exclude=tests/stats* --exclude=tests/channel_self* --config vitest.config.cloudflare.ts",
+    "test:cloudflare:plugin": "USE_CLOUDFLARE_WORKERS=true vitest run tests/updates*.test.ts tests/stats*.test.ts tests/channel_self*.test.ts tests/channel-rate-limit.test.ts --exclude=tests/*.unit.test.ts --exclude=tests/stats-export-cors.test.ts --config vitest.config.cloudflare-plugin.ts",
+    "test:cloudflare:api": "vitest run --exclude=tests/cli* --exclude=tests/updates* --exclude=tests/stats* --exclude=tests/channel_self* --exclude=tests/channel-rate-limit.test.ts --config vitest.config.cloudflare.ts",
     "test:cloudflare:updates": "vitest run tests/updates* --config vitest.config.cloudflare.ts",
     "bench": "vitest bench --config vitest.config.bench.ts --run",
     "bench:plugin-worker-runtime": "bun scripts/bench_plugin_worker_runtime.ts --compare scripts/bench/plugin_worker_runtime_baseline.json --save scripts/bench/plugin_worker_runtime_results.json",

playwright/e2e/observe-tabs.spec.ts

@@ -22,15 +22,15 @@ test.describe('Observe sections', () => {
     await expect(updaterTab).toHaveAttribute('aria-current', 'page')
 
     await logsTab.click()
-    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/logs$/)
+    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/logs(?:\?|$)/)
     await expect(logsTab).toHaveAttribute('aria-current', 'page')
 
     await compatibilityTab.click()
-    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/compatibility$/)
+    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/compatibility(?:\?|$)/)
     await expect(compatibilityTab).toHaveAttribute('aria-current', 'page')
 
     await pluginsTab.click()
-    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/plugins$/)
+    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/plugins(?:\?|$)/)
     await expect(pluginsTab).toHaveAttribute('aria-current', 'page')
     await expect(page.locator('[data-test="observe-plugin-insights"]')).toBeVisible()
     await expect(page.locator('[data-test="observe-plugin-insights"] table').getByText('4.15.3', { exact: true })).toBeVisible()
@@ -45,7 +45,7 @@ test.describe('Observe sections', () => {
     expect((pluginsBox?.x ?? 0) + (pluginsBox?.width ?? 0)).toBeLessThanOrEqual(375)
 
     await nativeTab.click()
-    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/native$/)
+    await expect(page).toHaveURL(/\/app\/com\.demo\.app\/observe\/native(?:\?|$)/)
     await expect(page.getByRole('heading', { name: 'All versions summary', exact: true })).toBeVisible()
   })
 })

scripts/supabase-worktree.ts

@@ -19,10 +19,12 @@ function hasSupabaseCli(): boolean {
 function getLocalSupabaseCli(repoRoot: string): string | null {
   const binName = process.platform === 'win32' ? 'supabase.exe' : 'supabase'
   // Prefer the package shim Bun/npm expose on PATH (.bin), then legacy bin/ layouts.
+  // Do NOT use dist/supabase.js — that is the installer stub and throws
+  // "No matching Supabase CLI binary package" when the platform binary is not
+  // extracted yet (common while `bun install` still runs in parallel with start).
   const candidates = [
     resolve(repoRoot, 'node_modules', '.bin', binName),
     resolve(repoRoot, 'node_modules', 'supabase', 'bin', binName),
-    resolve(repoRoot, 'node_modules', 'supabase', 'dist', 'supabase.js'),
   ]
   return candidates.find(candidate => existsSync(candidate)) ?? null
 }
@@ -322,6 +324,28 @@ function isTransientDockerPortBindFailure(output: string): boolean {
     || /failed to bind host port/i.test(output)
 }
 
+function getCloudflareWorkerPorts(): number[] {
+  const raw = process.env.CLOUDFLARE_WORKER_PORT_OFFSET
+  if (!raw || !/^\d+$/.test(raw))
+    return []
+
+  const offset = Number(raw)
+  // Match scripts/start-cloudflare-workers.sh / cloudflare-test-config.ts so we never
+  // freeHostPorts() derived ports from an invalid offset before the launcher rejects it.
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > 50_000)
+    return []
+
+  // wrangler worker ports + inspector ports from scripts/start-cloudflare-workers.sh
+  return [
+    8787 + offset,
+    8788 + offset,
+    8789 + offset,
+    9230 + offset,
+    9231 + offset,
+    9232 + offset,
+  ]
+}
+
 /**
  * Keep worktree host ports out of the kernel ephemeral pool.
  *
@@ -336,11 +360,14 @@ function reserveWorktreePortsFromEphemeralPool(repoRoot: string): void {
     return
 
   const { cfg } = ensureWorktreeSupabaseDir(repoRoot)
-  const ports = Object.values(cfg.ports).filter(port => Number.isFinite(port)).sort((a, b) => a - b)
+  const ports = [
+    ...Object.values(cfg.ports).filter(port => Number.isFinite(port)),
+    ...getCloudflareWorkerPorts(),
+  ].sort((a, b) => a - b)
   if (ports.length === 0)
     return
 
-  const reserved = ports.join(',')
+  const reserved = [...new Set(ports)].join(',')
   const result = spawnSync('sudo', ['sysctl', '-w', `net.ipv4.ip_local_reserved_ports=${reserved}`], {
     encoding: 'utf8',
   })
@@ -356,24 +383,92 @@ function reserveWorktreePortsFromEphemeralPool(repoRoot: string): void {
   console.error(`Reserved Supabase worktree ports from ephemeral pool: ${reserved}`)
 }
 
+/**
+ * Drop whatever still holds worktree host ports after a partial Docker start.
+ *
+ * `fuser` alone is not enough on GitHub runners: docker-proxy / leftover
+ * containers from a failed bind can keep the port until removed explicitly.
+ */
 function freeHostPorts(ports: number[]): void {
   if (process.platform === 'win32' || ports.length === 0)
     return
 
-  for (const port of ports) {
+  const uniquePorts = [...new Set(ports.filter(port => Number.isFinite(port)))]
+  const holders = new Set<string>()
+
+  for (const port of uniquePorts) {
+    const byPublish = spawnSync('docker', ['ps', '-aq', '--filter', `publish=${port}`], {
+      encoding: 'utf8',
+    })
+    for (const id of (byPublish.stdout ?? '').split(/\s+/).filter(Boolean))
+      holders.add(id)
+  }
+
+  // Match host-port publish strings docker prints (0.0.0.0:58722->5432/tcp).
+  const listed = spawnSync('docker', ['ps', '-a', '--format', '{{.ID}} {{.Ports}}'], {
+    encoding: 'utf8',
+  })
+  if ((listed.status ?? 1) === 0) {
+    for (const line of (listed.stdout ?? '').split('\n')) {
+      const trimmed = line.trim()
+      if (!trimmed)
+        continue
+      const spaceIdx = trimmed.indexOf(' ')
+      const id = spaceIdx >= 0 ? trimmed.slice(0, spaceIdx) : trimmed
+      const published = spaceIdx >= 0 ? trimmed.slice(spaceIdx + 1) : ''
+      if (uniquePorts.some(port => published.includes(`:${port}->`) || published.includes(`:${port}/`)))
+        holders.add(id)
+    }
+  }
+
+  if (holders.size > 0) {
+    console.error(`Removing Docker containers still publishing worktree ports: ${[...holders].join(', ')}`)
+    spawnSync('docker', ['rm', '-f', ...holders], { stdio: 'inherit' })
+  }
+
+  for (const port of uniquePorts) {
     spawnSync('fuser', ['-k', `${port}/tcp`], { stdio: 'ignore' })
+    // Close lingering sockets that still occupy the port after docker-proxy dies.
+    spawnSync('ss', ['-K', 'sport', '=', `:${port}`], { stdio: 'ignore' })
   }
 }
 
+/**
+ * Cancelled CI jobs can leave named Supabase containers that still hold host
+ * ports after `supabase stop`. Force-remove anything matching this worktree.
+ */
+function removeLeftoverWorktreeContainers(projectId: string): void {
+  if (process.platform === 'win32')
+    return
+
+  const listed = spawnSync('docker', ['ps', '-aq', '--filter', `name=${projectId}`], {
+    encoding: 'utf8',
+  })
+  if ((listed.status ?? 1) !== 0)
+    return
+
+  const ids = (listed.stdout ?? '').split(/\s+/).filter(Boolean)
+  if (ids.length === 0)
+    return
+
+  console.error(`Removing leftover Docker containers for ${projectId}: ${ids.join(', ')}`)
+  spawnSync('docker', ['rm', '-f', ...ids], { stdio: 'inherit' })
+}
+
 /**
  * `supabase start` can fail on GitHub runners with a transient Docker port bind
  * (`address already in use`) after a partial start/stop. Retry only that class of
  * failure so permanent start errors fail fast.
  */
 function runSupabaseStartWithRetry(args: string[], repoRoot: string): number {
   const { cfg } = ensureWorktreeSupabaseDir(repoRoot)
-  const ports = Object.values(cfg.ports).filter(port => Number.isFinite(port))
+  const ports = [
+    ...Object.values(cfg.ports).filter(port => Number.isFinite(port)),
+    ...getCloudflareWorkerPorts(),
+  ]
   reserveWorktreePortsFromEphemeralPool(repoRoot)
+  removeLeftoverWorktreeContainers(cfg.projectId)
+  freeHostPorts(ports)
 
   const maxAttempts = 5
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -385,8 +480,14 @@ function runSupabaseStartWithRetry(args: string[], repoRoot: string): number {
       return status
     console.error(`Supabase start hit a transient Docker port bind (attempt ${attempt}/${maxAttempts}); stopping and retrying...`)
     runSupabase(['stop', '--no-backup'], repoRoot)
+    removeLeftoverWorktreeContainers(cfg.projectId)
     freeHostPorts(ports)
-    spawnSync(process.platform === 'win32' ? 'timeout' : 'sleep', process.platform === 'win32' ? ['/T', '2', '/NOBREAK'] : ['2'])
+    // Back off so docker-proxy / TIME_WAIT can release before the next bind.
+    const sleepSeconds = String(Math.min(2 ** attempt, 8))
+    spawnSync(
+      process.platform === 'win32' ? 'timeout' : 'sleep',
+      process.platform === 'win32' ? ['/T', sleepSeconds, '/NOBREAK'] : [sleepSeconds],
+    )
   }
   return 1
 }

src/components/admin/AdminFilterBar.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import type { LocationQueryRaw } from 'vue-router'
 import type { DateRangeMode } from '~/stores/adminDashboard'
 import { useMutationObserver } from '@vueuse/core'
 import { onMounted, onUnmounted, ref, watch } from 'vue'
@@ -102,7 +103,7 @@ function syncStoreToQuery() {
     return
   }
 
-  const nextQuery: Record<string, string | string[] | null | undefined> = { ...route.query }
+  const nextQuery: LocationQueryRaw = { ...route.query }
   nextQuery.range = serialized.range
   if (serialized.start && serialized.end) {
     nextQuery.start = serialized.start

tests/admin-stats.test.ts

@@ -1356,6 +1356,8 @@ describe('/private/admin_stats', () => {
     expect(payload.success).toBe(true)
     expect(payload.data.trend).toHaveLength(1)
     expect(payload.data.trend[0]?.date).toBe('2026-02-01')
+    // Counts all trial orgs created that day: ONBOARDING_ORG, ONBOARDING_NO_BUNDLE_ORG,
+    // ONBOARDING_LATE_SUBSCRIPTION_ORG, and ONBOARDING_INVITE_ORG (invite orgs are included).
     expect(payload.data.trend[0]?.total).toBe(4)
     expect(payload.data.trend[0]?.plans[soloPlan?.name ?? 'Solo']).toBe(4)
     expect(payload.data.totals.find(plan => plan.plan_name === (soloPlan?.name ?? 'Solo'))?.total).toBe(4)

tests/cli-app-permission-helper.test.ts

@@ -4,6 +4,7 @@ const hasCliPermissionMock = vi.hoisted(() => vi.fn())
 
 vi.mock('../cli/src/utils', () => ({
   getPMAndCommand: () => ({ runner: 'bunx' }),
+  appAddHintMessage: (appId: string) => `App ${appId} does not exist, run first \`bunx @capgo/cli app add ${appId}\` to create it`,
   hasCliPermission: hasCliPermissionMock,
   show2FADeniedError: vi.fn(() => {
     throw new Error('2FA required')

tests/cron_stat_app.test.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
-import { BASE_URL, ORG_ID_CRON_APP, STRIPE_CUSTOMER_ID_CRON_APP, getSupabaseClient, resetAndSeedAppData, resetAndSeedAppDataStats, resetAppData, resetAppDataStats } from './test-utils.ts'
+import { BASE_URL, ORG_ID_CRON_APP, STRIPE_CUSTOMER_ID_CRON_APP, getSupabaseClient, resetAndSeedAppData, resetAndSeedAppDataStats, resetAppData, resetAppDataStats, warmEdgeEndpoint } from './test-utils.ts'
 
 const appId = `com.cron.${randomUUID().slice(0, 8)}`
 
@@ -24,6 +24,12 @@ describe('[POST] /triggers/cron_stat_app', () => {
       .eq('id', ORG_ID_CRON_APP)
     if (error)
       throw error
+
+    await warmEdgeEndpoint('/triggers/cron_stat_app', {
+      method: 'POST',
+      headers: triggerHeaders,
+      body: JSON.stringify({ appId, orgId: ORG_ID_CRON_APP }),
+    })
   })
 
   afterAll(async () => {

tests/cron_stat_org.test.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto'
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
-import { BASE_URL, fetchTestRequest, getBaseData, getSupabaseClient, PRODUCT_ID, postUpdate, TEST_EMAIL, USER_ID } from './test-utils.ts'
+import { BASE_URL, fetchTestRequest, getBaseData, getSupabaseClient, PRODUCT_ID, postUpdate, TEST_EMAIL, USER_ID, warmEdgeEndpoint } from './test-utils.ts'
 
 // Create unique IDs for this test file to avoid parallel test interference
 const id = randomUUID()
@@ -55,6 +55,9 @@ beforeAll(async () => {
   })
   if (appError)
     throw appError
+
+  // Cold first POST to cron_stat_org can 502 under Deno load; warm before assertions.
+  await warmEdgeEndpoint('/triggers/cron_stat_org')
 })
 
 // Reset state before each test