feat: schema auto-apply falls back to DATABASE_URL when no access token

Previously auto-schema required SUPABASE_ACCESS_TOKEN (from npx supabase
login). Now it tries three methods in order:

1. Management API (SUPABASE_ACCESS_TOKEN) — no extra credentials
2. Direct Postgres connection (DATABASE_URL) — user copies from Connect panel
3. Interactive prompt for DATABASE_URL (TTY only)
4. Manual SQL paste instructions (last resort)

This eliminates the hidden fourth dependency. Users only need:
- Supabase URL + service role key (for the MCP server)
- DATABASE_URL (for schema setup — same dashboard, Connect panel)
- OpenRouter API key (for embeddings)

Uses the pg package (already a dependency) for direct DDL execution.

Resolves GIT-45 concern #1 (SUPABASE_ACCESS_TOKEN hidden dependency).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: 2 people

docs/pro-setup-guide.md

@@ -9,28 +9,22 @@
 
 ## Setup
 
-### 1. Log in to Supabase CLI
-
-```bash
-npx supabase login
-```
-
-This stores an access token locally that gitmem uses to set up your database schema automatically.
-
-### 2. Set environment variables
+### 1. Set environment variables
 
 Set these in your shell profile (`.bashrc`, `.zshrc`) or `.env` file:
 
 ```bash
 export SUPABASE_URL="https://yourproject.supabase.co"
 export SUPABASE_SERVICE_ROLE_KEY="eyJ..."
 export OPENROUTER_API_KEY="sk-or-v1-..."
+export DATABASE_URL="postgresql://postgres.yourref:yourpassword@aws-0-region.pooler.supabase.com:5432/postgres"
 ```
 
 **Where to find these:**
 - **SUPABASE_URL**: Supabase Dashboard → Settings → API → Project URL
 - **SUPABASE_SERVICE_ROLE_KEY**: Supabase Dashboard → Settings → API → `service_role` key (under "Project API keys")
 - **OPENROUTER_API_KEY**: [openrouter.ai/keys](https://openrouter.ai/keys) → Create Key
+- **DATABASE_URL**: Supabase Dashboard → Connect → Connection string (Session pooler or Direct)
 
 ### 3. Activate
 
@@ -197,22 +191,23 @@ This removes the device from the license server (freeing a device slot), clears
 
 ### Schema not applied automatically
 
-If you see "Missing tables" after activation, the auto-schema needs a Supabase access token:
+Auto-schema uses either `DATABASE_URL` (direct Postgres connection) or `SUPABASE_ACCESS_TOKEN` (Management API). If neither is available, apply manually:
 
 ```bash
-npx supabase login        # stores token locally
-npx gitmem-mcp activate   # re-run, schema will auto-apply
-```
+# Option 1: Set DATABASE_URL and re-run
+export DATABASE_URL="postgresql://postgres.ref:password@pooler.supabase.com:5432/postgres"
+npx gitmem-mcp activate
 
-Or apply manually:
+# Option 2: Set SUPABASE_ACCESS_TOKEN and re-run
+npx supabase login
+npx gitmem-mcp activate
 
-```bash
+# Option 3: Apply manually
 npx gitmem-mcp setup | pbcopy    # macOS — copies SQL to clipboard
 npx gitmem-mcp setup             # prints SQL
+# Then paste into Supabase Dashboard → SQL Editor → Run
 ```
 
-Then paste into Supabase Dashboard → SQL Editor → Run.
-
 ### Device limit reached
 
 Each license allows 3 concurrent devices. Deactivate unused devices:

src/commands/activate.ts

@@ -180,6 +180,34 @@ function loadSetupSql(): string | null {
   }
 }
 
+/**
+ * Apply schema SQL via direct Postgres connection (pg client)
+ * Uses DATABASE_URL connection string from env/config/prompt
+ */
+async function applySchemaViaPg(
+  databaseUrl: string,
+  sql: string
+): Promise<{ success: boolean; error?: string }> {
+  try {
+    const pg = await import("pg");
+    const client = new pg.default.Client({
+      connectionString: databaseUrl,
+      ssl: { rejectUnauthorized: false },
+      connectionTimeoutMillis: 15_000,
+      statement_timeout: 30_000,
+    });
+    await client.connect();
+    await client.query(sql);
+    // Reload PostgREST schema cache
+    await client.query("NOTIFY pgrst, 'reload schema'");
+    await client.end();
+    return { success: true };
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    return { success: false, error: message };
+  }
+}
+
 /**
  * Apply schema SQL to user's Supabase via Management API
  */
@@ -397,17 +425,51 @@ export async function main(args: string[]): Promise<void> {
         } else if (!setupSql) {
           console.log("  ⚠ Could not load schema SQL file");
         } else {
-          // No access token — give clear instructions
-          console.log("  ⚠ Missing tables: " + missingTables.join(", "));
-          console.log("");
-          console.log("  To apply automatically, set SUPABASE_ACCESS_TOKEN:");
-          console.log("    npx supabase login");
-          console.log("    Then re-run: npx gitmem-mcp activate");
-          console.log("");
-          console.log("  Or apply manually:");
-          console.log("    npx gitmem-mcp setup | pbcopy   (macOS — copies SQL to clipboard)");
-          console.log("    npx gitmem-mcp setup            (prints SQL to paste manually)");
-          console.log("    Then: Supabase Dashboard → SQL Editor → Paste → Run");
+          // No access token — try DATABASE_URL as fallback
+          const dbUrlResult = await resolveCredential({
+            envVar: "DATABASE_URL",
+            configValue: config.database_url as string | undefined,
+            promptLabel: "Database URL (from Supabase Connect panel)",
+            required: false,
+            rl,
+          });
+
+          if (dbUrlResult.value) {
+            console.log("  Applying schema via direct connection...");
+            const pgResult = await applySchemaViaPg(dbUrlResult.value, setupSql);
+            if (pgResult.success) {
+              // Save DATABASE_URL to config for future use
+              config.database_url = dbUrlResult.value;
+              // Wait for PostgREST cache reload
+              await new Promise((r) => setTimeout(r, 2000));
+              const stillMissing = await checkSchemaExists(supabaseUrl, supabaseKey);
+              if (stillMissing.length === 0) {
+                console.log("  ✓ Schema applied via direct connection");
+                missingTables = [];
+              } else {
+                console.log("  ⚠ Schema applied but PostgREST cache may be stale");
+                console.log("    Try: npx gitmem-mcp check");
+                missingTables = stillMissing;
+              }
+            } else {
+              console.log("  ⚠ Direct connection failed: " + pgResult.error);
+              console.log("  Apply manually:");
+              console.log("    npx gitmem-mcp setup | pbcopy   (macOS)");
+              console.log("    Then: Supabase Dashboard → SQL Editor → Paste → Run");
+            }
+          } else {
+            // No access token AND no DATABASE_URL
+            console.log("  ⚠ Missing tables: " + missingTables.join(", "));
+            console.log("");
+            console.log("  To apply automatically, provide one of:");
+            console.log("    - DATABASE_URL (from Supabase Dashboard → Connect)");
+            console.log("    - SUPABASE_ACCESS_TOKEN (from: npx supabase login)");
+            console.log("  Then re-run: npx gitmem-mcp activate");
+            console.log("");
+            console.log("  Or apply manually:");
+            console.log("    npx gitmem-mcp setup | pbcopy   (macOS)");
+            console.log("    Then: Supabase Dashboard → SQL Editor → Paste → Run");
+          }
         }
       } else {
         console.log("  ✓ Schema verified (all tables present)");