[Prashansa-K]

Maps the Management API permissions for the inspect commands: the 25 inspect db subcommands and inspect report.

All 25 inspect db subcommands run one shared query runner, so they share one declaration: the database-config block (dbConfig) with linked as the default database target. inspect report declares the same block plus --output-dir, which makes no API call. On --local and --db-url neither command calls the Management API. On the linked project they fetch the pooler config (with --project-ref) and create a temporary login role unless a database password is already available. Neither command fills the linked-project cache or prompts for a project.

Tests run the real database-config resolver, record the requests it makes and check them against the declarations. One linked db-stats run is checked against all 25 inspect db declarations, taken from the real command tree; --linked=false, an empty --project-ref and the --local/--db-url no-request cases are covered separately, as is inspect report.

Shared pieces: no block or model change, no oneOf/is conditions of its own, no new operations, no change to OPERATIONS_WITHOUT_FGA. The 26 commands leave the pending list.

Docs: inspect db's SIDE_EFFECTS.md had the wrong login-role and network-ban routes and no concrete pooler route; inspect report's claimed a linked-project cache write that nothing performs.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Review

Both independent reviews completed and reported no findings. Static verification of the checked-out code, permission declarations, resolver paths, tests, and documentation found no additional actionable issues or fundamental conflicts with pending next-branch work. Tests were not executed.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[avallete]

Approving: all 25 inspect db leaves and inspect report route API work through the db-config resolver, and the shared map covers it. --local and --db-url make no calls. Tests, typecheck and lint pass. On staging, db-stats, locks --linked and report only made the declared login-role call.

Non-blocking:

• apps/cli/src/commands/inspect/db/inspect-query.integration.test.ts:519: the --linked=false case can't catch anything the default-path test misses, because inspect already defaults to linked. It's useful for db lint but redundant here; consider deleting it.
• apps/cli/src/commands/inspect/db/SIDE_EFFECTS.md:13 (older than this PR): the Files Read row still says --linked reads the ref from config.toml and misses .temp/project-ref / .temp/pooler-url. The report doc in this PR already has the right rows.