[pamelachia]

branches create, vanity-subdomains activate, and vanity-subdomains check-availability ran an entitlements lookup (get project, then get organization entitlements) after any 4xx without the entitlement_required envelope. The Management API already returns that envelope on all three gates, so the lookup only ran for errors unrelated to the plan: two extra requests, and on an org without the feature, an upgrade hint and a plan_limit classification for an unrelated error such as a validation failure.

I removed the lookup and its permission declarations at those three commands. The CLI still prints the upgrade hint from the envelope on gated denials and fires cli_upgrade_suggested for branches create and vanity-subdomains activate (check-availability still suppresses the event), unchanged since #7271.

Note: I left branches update and the sso commands on the lookup for now: the SAML routes return no envelope yet, and I haven't confirmed that the persistent-branch gate on branches update returns one.

Linear

• part of GROWTH-1050

[pamelachia]

I ran these from source against a Free-plan project (<ref>) with --agent no --debug:

• supabase branches create <name> --project-ref <ref>: one POST /v1/projects/<ref>/branches (402), the upgrade hint printed once, no /organizations/<slug>/entitlements request.
• supabase vanity-subdomains check-availability --desired-subdomain <name> --project-ref <ref> --experimental: one POST (400), the upgrade hint once, no entitlements request.
• supabase vanity-subdomains activate --desired-subdomain <name> --project-ref <ref> --experimental: one POST (400), the upgrade hint once, no entitlements request.
• The same three with --output-format json: error.entitlement carried feature branching_limit / vanity_subdomain and the org billing upgrade_url.

All three gates return the envelope, which skipped the lookup before this change too, so these runs cover the hint and the JSON field. The integration tests cover the lookup removal itself (a 4xx without the envelope makes one request and prints no hint).

[github-actions]

🤖 AI Review

Both independent reviews completed with no findings. Code inspection found no additional defects: the three commands consistently remove fallback entitlement lookups while preserving envelope-based upgrade suggestions and their intended analytics behavior. Permission declarations, documentation, and test coverage match the change.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[github-actions]

CLI benchmark (Lightweight Commands): no changes found

Commit be4a68a against develop at c4ffa9c · 10 runs each · report only, never blocks merging

Command	Workload	Before	After	Change
supabase --version	version	450 ms	419 ms	no real change (-7%, within normal variation)
supabase --help	help	546 ms	616 ms	no real change (+13%, within normal variation)
supabase init	init	428 ms	419 ms	no real change
supabase migration new bench	migration-new	395 ms	398 ms	no real change
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	493 ms	522 ms	no real change (+6%, within normal variation)
supabase projects list	projects-list	379 ms	419 ms	no real change (+10%, within normal variation)
supabase functions list --project-ref replayfixtureprojref	functions-list	433 ms	447 ms	no real change

API calls: unchanged for all 7 commands.

Binary size: 134.0 MB, unchanged.

Details: timing ranges, API calls per command, slowest phases

Timing ranges

Command	Workload	Before range	After range	Change	Verdict
supabase --version	version	305-690 ms	308-650 ms	-31 ms (-7%)	within noise
supabase --help	help	459-763 ms	501-710 ms	+70 ms (+13%)	within noise
supabase init	init	266-613 ms	348-691 ms	-9 ms (-2%)	within noise
supabase migration new bench	migration-new	266-510 ms	264-450 ms	+3 ms (+1%)	within noise
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	385-647 ms	408-724 ms	+29 ms (+6%)	within noise
supabase projects list	projects-list	299-670 ms	317-499 ms	+39 ms (+10%)	within noise
supabase functions list --project-ref replayfixtureprojref	functions-list	344-505 ms	348-563 ms	+14 ms (+3%)	within noise

API calls per command

Command	Workload	Before	After	Endpoint changes
supabase --version	version	0	0
supabase --help	help	0	0
supabase init	init	0	0
supabase migration new bench	migration-new	0	0
supabase gen types --lang typescript --project-id replayfixtureprojref	gen-types	2	2
supabase projects list	projects-list	1	1
supabase functions list --project-ref replayfixtureprojref	functions-list	2	2

Slowest phases

No command moved beyond noise, so there are no phase deltas.

Workflow run

Comment /bench to run the lightweight benchmark (this comment) again on the latest commit, or /bench full to also run the integration-heavy benchmark, which posts in its own comment.

[avallete]

Dogfooded on staging against a free-plan org: branches create (402) and both vanity-subdomains commands (400) return the entitlement_required envelope, print the upgrade hint, and send no project/entitlements follow-up requests. An unrelated 404 now prints no hint and skips the extra project GET that develop makes. Affected integration tests pass.

Non-blocking: the v1 OpenAPI spec doesn't document a 402 body for branch create, so it'd be worth confirming with the API side that every branch plan gate sends the envelope, since a bare 402 would now lose its hint.

[pamelachia]

Dogfooded on staging against a free-plan org: branches create (402) and both vanity-subdomains commands (400) return the entitlement_required envelope, print the upgrade hint, and send no project/entitlements follow-up requests. An unrelated 404 now prints no hint and skips the extra project GET that develop makes. Affected integration tests pass.

Non-blocking: the v1 OpenAPI spec doesn't document a 402 body for branch create, so it'd be worth confirming with the API side that every branch plan gate sends the envelope, since a bare 402 would now lose its hint.

good point i will look and see if we can add a decorator specifically for 402s and payment required stuff so it gets added to the spec. but yes i added the envelope to the branch gates before adding this