安装 supabase

本地 README 摘录

Automic Vault Fork Notes

This repository is the Automic Vault fork of Supabase CLI.

Automic Vault is a macOS-first secret and execution control system that keeps sensitive credentials behind explicit human approval in the Automic Vault GUI app instead of exposing them directly to terminal tools.

This fork currently adds the following behavior on top of upstream supabase/cli:

• An protected tool:supabase package recipe that builds and signs both the

Bun/TypeScript supabase launcher and the Go supabase-go helper.

• Direct macOS Keychain access from the signed supabase-go binary instead

of github.com/zalando/go-keyring shelling out to /usr/bin/security, so Keychain trust is attached to the Supabase executable.

• A macOS-only automicvault Go build tag for the secure credential backend,

while default upstream builds continue to use go-keyring.

• A hazard detector for insecure Supabase CLI installs, including the

plaintext fallback token at ~/.supabase/access-token and Keychain ACLs that allow /usr/bin/security to read Supabase secrets.

• A hidden supabase-go av-migrate command used by the Automic Vault protected tool

migration hook to rewrite insecure Keychain items and move fallback access tokens into the signed Supabase credential backend.

• Test seams that keep the credential tests deterministic without touching the

user's real Keychain.

来源: local coverage notes