fix(cli): expand env(VAR) in test db config.toml port/password fields

Go decodes config.toml through mapstructure with LoadEnvHook
(pkg/config/decode_hooks.go), so any string field of the form env(VAR) resolves
to the named environment variable when it is set and non-empty. The test db
toml reader passed [db].port/shadow_port/password through literally, so an
env-backed local stack config connected to 54322/postgres instead of the
configured values. Expand env(VAR) for these fields, preserving the literal
when the variable is unset to match LoadEnvHook.

Author: Coly010

apps/cli/src/legacy/shared/legacy-db-config.toml-read.ts

@@ -42,8 +42,38 @@ function asRecord(value: unknown): RawDoc | undefined {
     : undefined;
 }
 
+const ENV_PATTERN = /^env\((.*)\)$/;
+
+/**
+ * Expand Go's `env(VAR)` config form. Mirrors `LoadEnvHook`
+ * (`apps/cli-go/pkg/config/decode_hooks.go`): a string matching `^env\((.*)\)$`
+ * resolves to the named environment variable, but only when that variable is set
+ * and non-empty; otherwise the literal value is preserved unchanged (Go's hook
+ * keeps `value` when `len(os.Getenv(name)) == 0`).
+ */
+function expandEnv(value: string): string {
+  const matches = ENV_PATTERN.exec(value);
+  if (matches !== null) {
+    const env = process.env[matches[1] ?? ""];
+    if (env !== undefined && env.length > 0) return env;
+  }
+  return value;
+}
+
+/**
+ * Resolve a `[db]` port field. Go decodes the TOML string/number into a `uint`
+ * with `mapstructure`'s weakly-typed input *after* `LoadEnvHook` runs, so an
+ * `env(VAR)` reference (written as a quoted string) is expanded and then parsed
+ * as the port. A plain number is used directly; anything that does not resolve
+ * to a non-negative integer falls back to the default.
+ */
 function numberOr(value: unknown, fallback: number): number {
-  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    const expanded = expandEnv(value);
+    if (/^\d+$/.test(expanded)) return Number(expanded);
+  }
+  return fallback;
 }
 
 function nonEmptyString(value: unknown): Option.Option<string> {
@@ -111,7 +141,7 @@ export const legacyReadDbToml = Effect.fnUntraced(function* (
   const values: LegacyDbTomlValues = {
     port: numberOr(db?.["port"], DEFAULT_PORT),
     shadowPort: numberOr(db?.["shadow_port"], DEFAULT_SHADOW_PORT),
-    password: typeof db?.["password"] === "string" ? db["password"] : DEFAULT_PASSWORD,
+    password: typeof db?.["password"] === "string" ? expandEnv(db["password"]) : DEFAULT_PASSWORD,
     poolerConnectionString,
     projectId,
   };

apps/cli/src/legacy/shared/legacy-db-config.toml-read.unit.test.ts

@@ -123,6 +123,44 @@ describe("legacyReadDbToml", () => {
     );
   });
 
+  it.effect("expands env(VAR) for password and port like Go's LoadEnvHook", () => {
+    process.env["LEGACY_DB_PW"] = "from-env";
+    process.env["LEGACY_DB_PORT"] = "6000";
+    const dir = withConfig(
+      ["[db]", 'port = "env(LEGACY_DB_PORT)"', 'password = "env(LEGACY_DB_PW)"', ""].join("\n"),
+    );
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.port).toBe(6000);
+          expect(v.password).toBe("from-env");
+          delete process.env["LEGACY_DB_PW"];
+          delete process.env["LEGACY_DB_PORT"];
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
+  it.effect("keeps the literal value and default port when the env var is unset/empty", () => {
+    // Go's LoadEnvHook only substitutes when len(os.Getenv(name)) > 0; otherwise it
+    // preserves the literal string, so a quoted env() port that cannot resolve falls
+    // back to the schema default rather than parsing the literal.
+    delete process.env["LEGACY_DB_UNSET"];
+    const dir = withConfig(
+      ["[db]", 'port = "env(LEGACY_DB_UNSET)"', 'password = "env(LEGACY_DB_UNSET)"', ""].join("\n"),
+    );
+    return read(dir).pipe(
+      Effect.tap((v) =>
+        Effect.sync(() => {
+          expect(v.port).toBe(54322);
+          expect(v.password).toBe("env(LEGACY_DB_UNSET)");
+          rmSync(dir, { recursive: true, force: true });
+        }),
+      ),
+    );
+  });
+
   it.effect("ignores a [db.pooler] connection_string in config.toml (Go reads .temp only)", () => {
     // The Go config field is tagged `toml:"-"`, so a connection_string in config.toml
     // is never honored; only supabase/.temp/pooler-url counts.