CLI and the deploy matrix - PolicyCodex Support

Source of truth: docs/CLI.md in the repository. The failure mode this page prevents is real and has happened: the worker once ran stale code for days because nobody deployed it.

Daily commands

pnpm install          # install the whole workspace
pnpm dev              # web app (Vite, http://localhost:5173)
pnpm dev:website      # marketing site (5174)
pnpm dev:growth       # growth app (5175)
pnpm dev:demo         # demo console (5177)
pnpm dev:mcp          # worker locally (wrangler dev)
pnpm test             # vitest across packages/ and apps/
pnpm lint             # eslint + tsc --noEmit in every package
pnpm verify:audit     # independently verify an audit-log export's hash chain

Demo estate: pnpm demo:provision | demo:seed | demo:reset | demo:github … (see Demo scripts). Email pipeline: pnpm test:emails (see Growth data flows). Compliance eval: pnpm eval:compliance (see Smoke tests).

The deploy matrix

Six separately deployed artifacts. After any change, find the row you touched:

You changed…	You must run…	Notes
`apps/web/`, `apps/website/`, `apps/growth/`, `apps/demo/`	nothing — `git push origin main`	Git-connected Cloudflare Pages projects; a push rebuilds all of them
`apps/docs/`, `apps/support/`	nothing — `git push origin main`	Deployed by GitHub Actions workflow (Mintlify must `export` first), not git-connected Pages
`apps/mcp/**` (worker)	nothing — `git push origin main`	Workers Builds. `cd apps/mcp && npx wrangler deploy` works as a hotfix but the next main build overwrites it
`supabase/migrations/**`	`supabase db push --db-url "$SUPABASE_DB_URL"`	Cloud project; additive migrations only; no local Docker
`supabase/functions/<name>/**`	`supabase functions deploy <name>`	Deploys one function — deploy each one you changed. Does not touch the worker
`apps/action/**`	`pnpm --filter @policycodex/action build` + commit `dist/index.cjs`	Consumers run the committed bundle; an uncommitted rebuild ships nothing
`packages/core/**`	redeploy every consumer	Core is bundled into web, worker, functions and action — each embeds its own copy. The sneakiest row in the table

Worker operations

cd apps/mcp
npx wrangler tail             # live logs — first stop for webhook/check issues
npx wrangler secret list      # MUST show 8 secrets:
                              #   SUPABASE_URL, SUPABASE_SECRET_KEY,
                              #   OPENAI_BASE_URL, OPENAI_API_KEY, MODEL,
                              #   GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY,
                              #   GITHUB_WEBHOOK_SECRET
npx wrangler secret put NAME  # set/rotate one
npx wrangler deploy           # hotfix deploy (next main build overwrites)

The GitHub trio has vanished once after dashboard/Workers-Builds changes; a missing MODEL silently degrades /v1/check. Re-check the count after any deploy.

Supabase operations

supabase db push --db-url "$SUPABASE_DB_URL"    # apply new migrations
psql "$SUPABASE_DB_URL" -f supabase/seed.sql    # dev fixture data only
supabase functions deploy <name>                # one Edge Function
supabase secrets list                           # names + digests only
supabase secrets set NAME=value

GitHub App private keys must be PKCS#8: openssl pkcs8 -topk8 -inform PEM -in key.pem -nocrypt.

Deploy verification

# which commit is live on a Pages project, and did the build succeed?
npx wrangler pages deployment list --project-name policycodex-application

# did the bundle actually reach the custom domain? (can lag a few seconds)
curl -s https://app.policycodex.cloud/ | grep -o 'assets/index-[A-Za-z0-9_-]*\.js'

Never wrangler pages deploy a locally built SPA — the production VITE_* values live in the Pages project’s build environment, and a local build ships localhost URLs that break silently (Environments).

​Daily commands

​The deploy matrix

​Worker operations

​Supabase operations

​Deploy verification

Daily commands

The deploy matrix

Worker operations

Supabase operations

Deploy verification