feat(cli)!: remove the residual Go delegation

.github/workflows/test.yml

@@ -202,19 +202,6 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
-      - name: Cache Go CLI binary
-        id: cache-go-binary
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: apps/cli-go/supabase-go
-          key: go-cli-${{ runner.os }}-${{ hashFiles('apps/cli-go/**/*.go',
-            'apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
-
-      - name: Build Go CLI
-        if: steps.cache-go-binary.outputs.cache-hit != 'true'
-        run: go build -o supabase-go .
-        working-directory: apps/cli-go
-
       # The e2e harness invokes `node apps/cli/dist/supabase.js` with
       # `SUPABASE_CLI_BINARY_OVERRIDE` pointing at the compiled binary in
       # `apps/cli/dist/`. Build the CLI explicitly before invoking every
@@ -224,8 +211,6 @@ jobs:
 
       - name: Run end-to-end tests
         run: pnpm exec turbo run test:e2e:run --only --concurrency=1 --filter=supabase --filter=@supabase/cli-e2e -- --shard=${{ matrix.shard }}/3
-        env:
-          SUPABASE_GO_BINARY: ${{ github.workspace }}/apps/cli-go/supabase-go
 
   test-stack-e2e:
     if: |

apps/cli-e2e/.env.example

@@ -7,12 +7,6 @@ CLI_E2E_MODE=record
 # Staging Management API token. Required in record mode.
 SUPABASE_ACCESS_TOKEN=sbp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 
-# The CLI shells out to the bundled Go binary for the proxied commands
-# (db diff --use-pg-schema, db branch *, db remote changes, gen keys,
-# functions download --legacy-bundle). Point at a freshly built binary:
-#   cd apps/cli-go && go build -o /tmp/supabase-test-binary .
-SUPABASE_GO_BINARY=/tmp/supabase-test-binary
-
 # --- Optional record overrides (sensible defaults in src/tests/env.ts) ---
 # Management API base (also accepted as SUPABASE_STAGING_URL).
 # CLI_E2E_API_URL=https://api.supabase.green

apps/cli-e2e/AGENTS.md

@@ -180,32 +180,3 @@ per-process, so each shard still has deterministic intra-shard ordering.
 is a single-job operation; parallel shards would race on the shared
 `fixtures/recorded/` directory. The `record` script does not accept
 `--shard`.
-
-## Go binary version requirement
-
-The CLI proxies a fixed, small set of commands to a Go binary (`SUPABASE_GO_BINARY` → bundled package binary → system `supabase`) — as of CLI-1970, `apps/cli-go/` contains only that residual proxied subset, nothing else, and it is slated for cleanup and removal (the surface only shrinks; never add tests that grow it). If your system `supabase` binary predates a flag or subcommand change on one of these, `testBehaviour` tests for it will fail with "unknown command" or "unknown flag".
-
-Build the Go CLI from source and point `SUPABASE_GO_BINARY` at it:
-
-```sh
-(cd apps/cli-go && go build -o /tmp/supabase-test-binary .)
-
-# Replay
-SUPABASE_GO_BINARY=/tmp/supabase-test-binary \
-  pnpm exec turbo run @supabase/cli-e2e#test:e2e:run
-
-# Record
-SUPABASE_GO_BINARY=/tmp/supabase-test-binary \
-  SUPABASE_ACCESS_TOKEN=sbp_... SUPABASE_STAGING_URL=https://api.supabase.green \
-  pnpm run record
-```
-
-`SUPABASE_GO_BINARY` is inherited by the CLI subprocess via `exec()` in the harness, so you only need to set it once in the shell.
-
-Commands currently requiring this — the full proxied surface, nothing else needs a Go binary at all:
-
-- `db diff` (for `--use-pg-schema`)
-- `db branch create`, `db branch delete`, `db branch list`, `db branch switch`
-- `db remote changes`
-- `gen keys`
-- `functions download` (for the hidden `--legacy-bundle` flag)

apps/cli/AGENTS.md

@@ -99,15 +99,6 @@ compatibility decision in the PR. For the Compute transition, no local compatibi
 migrations are required. Compute error tags intentionally start new fingerprints; server-owned
 contracts remain unchanged. Update tests, generated schemas, and side-effect documentation.
 
-## Go delegation
-
-- TypeScript owns CLI behavior. Consult `apps/cli-go` only for existing delegated
-  operations listed in [the delegation document](docs/go-cli-porting-status.md); do not expand delegation.
-- Native replacements must preserve the public command, flags, output, side effects,
-  and exit behavior. Update the delegation document when removing a Go dependency.
-- Emit command telemetry exactly once: bare proxies rely on Go telemetry;
-  instrumented TypeScript handlers suppress child telemetry.
-
 ## Telemetry
 
 > The string passed to `Data.TaggedError("...")` is the PostHog `error_fingerprint` identity

apps/cli/README.md

@@ -16,7 +16,6 @@ This workspace contains the stable, shipped `supabase` CLI. Earlier revisions ca
 
 For current migration/parity status, see:
 
-- [`docs/go-cli-porting-status.md`](./docs/go-cli-porting-status.md) — the residual Go delegation surface
 - [`docs/go-cli-divergences.md`](./docs/go-cli-divergences.md) — TS-only flags and behavioral divergences from the old Go CLI
 
 For the generated command/reference docs, see:
@@ -42,29 +41,17 @@ Examples:
 pnpm dev -- hello
 ```
 
-### CLI and the Go binary
+### Running from source
 
-Phase 0 commands in the CLI proxy to the Go CLI binary. To run these commands from source you need `supabase` (the Go CLI) available on your PATH.
+No command in the CLI proxies to the Go CLI binary; `apps/cli-go/` builds and ships alongside
+`supabase` but nothing in `apps/cli/src` spawns it (CLI-2432).
 
 For convenience, create a shell alias instead of using `pnpm dev` directly. For example in `.zshrc`:
 
 ```sh
 alias supabase-dev="bun /absolute/path/to/dx-lab/apps/cli/src/main.ts"
 ```
 
-Then Phase 0 commands resolve the Go binary via PATH automatically:
-
-```sh
-supabase-dev orgs list   # proxied to supabase on PATH
-supabase-dev login       # native TypeScript
-```
-
-You can also point `SUPABASE_GO_BINARY` at a specific binary to skip the PATH lookup:
-
-```sh
-export SUPABASE_GO_BINARY=/path/to/supabase
-```
-
 ## Build
 
 There are two separate build paths depending on what you need.
@@ -168,7 +155,8 @@ Platform-specific packages live under:
 Each platform package ships two binaries for the stable channel:
 
 - `bin/supabase` — the compiled TypeScript SFE (Bun single-file executable)
-- `bin/supabase-go` — the compiled Go CLI binary, used by Phase 0 proxy commands
+- `bin/supabase-go` — the compiled Go CLI binary, unused by `bin/supabase` (see
+  [`docs/binary-distribution.md`](./docs/binary-distribution.md))
 
 The Go binary is compiled from `apps/cli-go/` at release time. Run `pnpm repos:install` after a fresh clone to make that source available.