test(cli): cover network-restrictions get and update (CLI-2288)

[7ttp]

TL;DR

adds live e2e coverage for network-restrictions get and update, covering the command family

whats introduced?

• network-restrictions get: reads the target project's restrictions and proves the json payload carries entitlement, config and status
• network-restrictions update: captures the current allowlist, replaces it with documentation ranges, proves the replacement in its own output and through get, then restore
  s...

ref:

• closes: CLI-2288

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@9cd12b703926ac150e07d4d0562ab3bf9066d02c

Preview package for commit 9cd12b7.

[github-actions]

🤖 AI Review

Four concerns are confirmed: the 300-second path has no margin before cleanup, mixed-family baselines can be widened during restoration, restoration is attempted only once, and the get test loses diagnostics on malformed JSON. The entitlement and CIDR-order findings are refuted by trusted live-test and configuration conventions. No production code changed.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/legacy/commands/network-restrictions/update/update.live.test.ts:18	test-reliability	claude+codex	The timeout budget can expire before the shared project's allowlist is restored.
🟡 MINOR	apps/cli/src/legacy/commands/network-restrictions/update/update.live.test.ts:124	test-isolation	claude	Restoration widens an originally empty address family to allow-all when the other family had a captured allowlist.
🟡 MINOR	apps/cli/src/legacy/commands/network-restrictions/update/update.live.test.ts:150	test-isolation	claude	The restore command has no retry, so a transient restore failure can leave the serial live project's allowlist restricted for later tests.
⚪ NIT	apps/cli/src/legacy/commands/network-restrictions/get/get.live.test.ts:15	test-diagnostics	claude	Malformed JSON output produces a bare parse error without stderr or useful command context.

Refuted findings (kept for transparency, not posted as review comments)

• apps/cli/src/legacy/commands/network-restrictions/update/update.live.test.ts:131 (test-coverage): The update live test should skip when get reports entitlement "disallowed" instead of requiring a successful mutation.
  Refuted: The two tests exercise different command contracts: get validly reports either contract enum, while update is a golden-path mutation test. trusted/docs/adr/0013-live-e2e-bypasses-replay-server.md explicitly rules out capability-specific skipping, so a target lacking the required capability is expected to fail this live check.
• apps/cli/src/legacy/commands/network-restrictions/update/update.live.test.ts:105 (test-reliability): The restore proof should ignore CIDR ordering because reordered allowlists could otherwise fail equality.
  Refuted: Trusted default-branch configuration explicitly treats both CIDR arrays as ordered sequences. Exact ordered equality therefore follows the repository's documented convention rather than introducing an accidental flaky comparison.

Stats

Claude findings: 6 · Codex findings: 1 · Confirmed: 4 · Refuted: 2 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.