[7ttp]

TL;DR

supabase bootstrap on macOS asked for the keychain password up to 4 times, now it asks once

what broke?

every part of the cli that needs your access token read it from the keychain again instead of reusing the first read
one bootstrap run does that 4-7 times, and secrets list, projects api-keys, projects list and orgs list 2 to 3 times

macOS counts each read as a new access, so anyone who clicks Allow instead of Always Allow gets a password prompt for every one of them

now fixed by:

reading the keychain once and sharing that token with every caller in the same run

login, logout and the credentials sweep clear it so a new or removed token is picked up right away, and --debug output stays the same

ref:

• missed in: feat(cli): port backups list and restore to native TypeScript #5331
• closes CLI-3135

[github-actions]

CLI benchmark (Lightweight Commands): no changes found

Commit 1da6ff4 against develop at d8f66a0 · 10 runs each · report only, never blocks merging

Command	Workload	Before	After	Change
supabase --version	version	161 ms	164 ms	no real change
supabase --help	help	155 ms	155 ms	no real change
supabase init	init	155 ms	157 ms	no real change
supabase migration new bench	migration-new	169 ms	177 ms	no real change
supabase config convert	config-convert	225 ms	220 ms	no real change
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	262 ms	246 ms	no real change (-6%, within normal variation)
supabase projects list	projects-list	217 ms	205 ms	no real change (-6%, within normal variation)
supabase functions list --project-ref replayfixtureprojref	functions-list	217 ms	219 ms	no real change

API calls: unchanged for all 8 commands.

Binary size: 134.8 MB, up 4.0 KB from 134.8 MB.

Details: timing ranges, API calls per command, slowest phases

Timing ranges

Command	Workload	Before range	After range	Change	Verdict
supabase --version	version	152-228 ms	149-202 ms	+2 ms (+1%)	within noise
supabase --help	help	151-187 ms	150-190 ms	+0 ms (+0%)	within noise
supabase init	init	153-161 ms	151-161 ms	+2 ms (+1%)	within noise
supabase migration new bench	migration-new	163-180 ms	166-222 ms	+8 ms (+5%)	within noise
supabase config convert	config-convert	184-306 ms	186-273 ms	-5 ms (-2%)	within noise
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	233-311 ms	222-292 ms	-16 ms (-6%)	within noise
supabase projects list	projects-list	199-230 ms	194-220 ms	-13 ms (-6%)	within noise
supabase functions list --project-ref replayfixtureprojref	functions-list	205-232 ms	201-230 ms	+2 ms (+1%)	within noise

API calls per command

Command	Workload	Before	After	Endpoint changes
supabase --version	version	0	0
supabase --help	help	0	0
supabase init	init	0	0
supabase migration new bench	migration-new	0	0
supabase config convert	config-convert	0	0
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	2	2
supabase projects list	projects-list	1	1
supabase functions list --project-ref replayfixtureprojref	functions-list	2	2

Slowest phases

No command moved beyond noise, so there are no phase deltas.

Workflow run

Comment /bench to run the lightweight benchmark (this comment) again on the latest commit, or /bench full to also run the integration-heavy benchmark, which posts in its own comment.

[github-actions]

🤖 AI Review

Verified both reviews against the checked-out code. Claude’s sole finding is a confirmed style nit; Codex reported no findings. Static review identified no functional defects.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	apps/cli/src/auth/command-credentials.layer.ts:463	style	claude	The new explanatory comment uses /* ... */, whereas the file’s other non-JSDoc comments use //.

Stats

Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.