fix(upload): make outdated-CLI bundle upload failure actionable

[posthog-eu]

Summary

Outdated @capgo/cli (older than MIN_CLI_VERSION) cannot finish a bundle upload, and the user sees only a raw Postgres P0001 error that names an internal endpoint — with no hint to upgrade.

• Who it hurts: anyone on a pre-floor CLI. The upload dies after the files already reached R2, so the release is blocked with no usable next step. It recurred across several separate people over roughly two weeks.
• Root cause: old CLIs finalize by writing app_versions.manifest jsonb directly via PostgREST. The check_encrypted_bundle_on_insert trigger (correctly) blocks that write and raises r2_direct_manifest_jsonb: Use POST /private/set_manifest .... The guard is right; the response is the bug — that text is meaningless to a CLI user.
• Why the existing floor did not help: MIN_CLI_VERSION is published only via GET /private/config and enforced inside the CLI, so a CLI too old to read it never checks it.

Changes

• Make the trigger message actionable. The migration rewrites only the raised r2_direct_manifest_jsonb message to tell the user to run npx @capgo/cli@latest. The direct-PostgREST finalize passes through no edge function, so the DB trigger is the one chokepoint every upload path reaches — guard logic and the pg_log reason are unchanged.
• Enforce the floor server-side. A new assertUploadCliVersionSupported helper reads x-cli-version and rejects a below-floor CLI on the presigned upload-link request, before any files transfer. Requests without a parseable version header are left alone (non-CLI and self-hosted clients).
• Scope note: TUS uploads skip the presigned link and are not gated early; they still fail at the trigger, which now carries the same upgrade message. Gating the shared key middleware was rejected — it would block unrelated commands for old CLIs.

Test plan

• supabase/tests/73_test_block_r2_direct_manifest_jsonb.sql — pgTAP assertions updated to the new message (INSERT, UPDATE, finalize).
• tests/manifest-poison-guard.test.ts — direct PostgREST poison PATCH now asserts the upgrade hint in the response.
• tests/private-error-cases.test.ts — new cases: below-floor x-cli-version is rejected with cli_version_too_old; an unparseable header falls through the gate.
• oxlint passes on the changed backend files. The full bun run lint:backend && bun run lint and the integration suites need the project toolchain (bun/deno/supabase), which was not available in this environment, so they were not run here.

Screenshots

N/A — backend and DB-trigger change only.

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: c75292c8-99a0-4de9-9db4-e82a45bb2f56

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixcli-explain-r2_direct_manifest_jsonb-9ac755 (24d1bc8) with main (279a715)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud