feat: supabase cost tracking

[barryroodt]

Summary

Adds opt-in persistence of per-review token + USD cost to a self-hosted Supabase project. Reviews still work without it enabled — purely additive.

Wired up:

• claude CLI now invoked with --output-format=stream-json --verbose; final result event parsed into AgentTokenUsage (was null before).
• New src/persist/ module with recordReviewRun (retry-then-fail-soft) + queryCosts. No new runtime deps — plain fetch against PostgREST.
• persistUsageStep appended to the review workflow, no-op when env vars absent.
• Two SQL migrations: review_runs + review_subagent_runs tables, spend_by_repo_30d + spend_by_model_30d views.
• New ./wrily persistence {init,migrate,status} subcommands wrap the official supabase CLI to create a project, write .env, and apply migrations.
• New ./wrily costs [--since 30d] [--by repo|model|day] [--repo X] [--json] for spend rollups.
• Local CLI runs tagged trigger_source=local_cli; GitHub App runs collapse to github_app.

Spec + plan:

• docs/superpowers/specs/2026-05-18-supabase-cost-tracking-design.md
• docs/superpowers/plans/2026-05-18-supabase-cost-tracking.md

Test Plan

• pnpm test — 243 passing, 1 integration test skipped (opt-in via WRILY_INT_SUPABASE_URL)
• pnpm typecheck — clean
• pnpm build — clean
• ./wrily --help shows the new subcommands
• ./wrily persistence status reports disabled when env unset
• Manual: ./wrily persistence init against a throwaway Supabase project — verify tables + views land
• Manual: trigger a review with SUPABASE_URL set — verify a row appears in review_runs
• Manual: ./wrily costs --since 7d against a project with rows

🤖 Generated with Claude Code

[barryroodt]

test review via script

[barryroodt]

test review with comments

[barryroodt]

test 422 reproduction

[barryroodt]

Wrily Review: PR #20

Overall Verdict: With fixes

Summary

0 critical, 2 important. Supabase cost tracking is well-tested and architecturally sound (best-effort persist, redacted argv, success/failure-path dedupe). Two gaps: bash wrapper skips .env sourcing when shell auth is set so persistence creds silently drop, and the new .env written by persistence init lands with default umask perms while holding the service_role_key. 5 minor findings hidden — set sensitivity: minor in .wrily.yml to see.

Confidence rating skipped — declare an application criticality tier in CLAUDE.md or AGENTS.md to enable.

Critical

None.

Important

• L137: wrily — .env only sourced when ANTHROPIC_API_KEY/CLAUDE_CODE_OAUTH_TOKEN are both unset, but SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY live in the same file. A user with auth in shell env gets persistence silently disabled (empty -e SUPABASE_URL= at lines 224-225). Move the .env source above the auth gate, or add a second guard: if { [[ -z "${SUPABASE_URL:-}" ]] || [[ -z "${SUPABASE_SERVICE_ROLE_KEY:-}" ]]; } && [[ -f "${SCRIPT_DIR}/.env" ]]; then source "${SCRIPT_DIR}/.env"; fi.
• L32: src/cli/persistence/dotenv.ts — New .env written via writeFileSync/appendFileSync inherits umask (typically 0644 — world-readable). The file holds SUPABASE_SERVICE_ROLE_KEY, which bypasses RLS = full DB admin. On shared/multi-user hosts any local user can exfiltrate it. After writing, chmodSync(path, 0o600) (and when appending, ensure the existing file is already 0600 or tighten it).

Minor

None.

Strengths

• Retry-then-fail-soft + markUsagePersisted dedupe between success and failure paths keeps observability from ever blocking a review.
• redactFlags and SUPABASE_DB_PASSWORD env-var path keep the generated DB password out of argv and error messages.
• Strong unit + integration test coverage (env, retry, aggregateRuns, supabase stub binary, stream-json reassembly).

Suppressions

None.

[barryroodt]