fix(cli): accept sbp_v0 tokens (CLI-2262)

[7ttp]

TL;DR

fixes the CLI rejecting dashboard issued sbp_v0_ access tokens with LegacyInvalidAccessTokenError which was caused by the access token regex pattern only

matching the sbp_ and sbp_oauth_ prefixes and
is now fixed by widening the legacy validator to also accept the sbp_v0_ prefix...

ref:

• closes: CLI rejects new sbp_v0_... personal access token format (LegacyInvalidAccessTokenError) #6348

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c53f24eee

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@34fa973977091cf3c5b330b1874279fef748bb86

Preview package for commit 34fa973.

[7ttp]

/ai-review

[github-actions]

Superseded by a newer AI review

🤖 AI Review

The stable legacy and Go validators correctly add sbp_v0_ support. Four deduplicated findings were adjudicated: one test-quality concern is confirmed, two purported omissions are refuted by the trusted frozen-next-shell convention and ADR context, and future-version handling remains uncertain because no authoritative versioning contract exists.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli-go/internal/utils/access_token.go:16	maintainability	claude	Enumerating only v0_ will require another CLI change if a future valid token prefix such as v1_ is introduced.
🟡 MINOR	apps/cli/src/legacy/auth/legacy-credentials.layer.unit.test.ts:319	test-quality	codex	The new rejection tests inspect serialized Effect Cause data rather than asserting the typed failure.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/legacy/auth/legacy-access-token.ts:6 (correctness): The change is incomplete because the next shell's login validator still rejects sbp_v0_ tokens.
  Refuted: The behavior exists, but trusted/apps/cli/CLAUDE.md explicitly defines legacy as the stable authoritative shell and next as a frozen experimental shell where features must not be added. ADR 0011 also limits next distribution to the opt-in alpha channel, so omitting next is the repository's documented scope rather than an incomplete stable fix.
• docs/adr/0008-authentication-and-token-management.md:16 (documentation): ADR 0008 is stale because it still contains the pre-change token pattern.
  Refuted: The ADR is marked proposed and presents the pattern as an unresolved question for the new/next CLI, not as documentation of the stable legacy validator. Its pattern still matches apps/cli/src/next/auth/token.ts:4, while trusted/apps/cli/CLAUDE.md distinguishes that frozen experimental shell from stable legacy.

Stats

Claude findings: 3 · Codex findings: 2 · Confirmed: 1 · Refuted: 2 · Uncertain: 1

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.