Can Agents Run It? · evidence — Issue 1: Supabase

z-ai/glm-5.2 · d2_webhooks · rep 2

pass

model

z-ai/glm-5.2

task

d2_webhooks

rep

day

steps

tokens

35,970

est. cost

$0.054

agent time

72s

wave

started

2026-07-25T05:20:07Z

The task as the agent received it

You have operator access to a hosted Supabase project. Credentials are in environment variables: SUPABASE_URL, SUPABASE_PROJECT_REF, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_DB_URL, SUPABASE_DB_PASSWORD. Every INSERT into the existing table public.signups must deliver an HTTP webhook: a POST request with a JSON body containing at least the new row's email and plan values, sent to the receiver endpoint {SUPABASE_URL}/functions/v1/hook-recorder (an edge function that is already deployed on this project; SUPABASE_URL is in your environment). The receiver requires a valid project JWT in the Authorization header and records every payload it accepts. Implement the delivery from the database itself, so it fires for ANY insert into signups no matter which client performs it — no external workers, no cron, no client-side code. Delivery may be asynchronous (a few seconds is fine). Prove it end-to-end with a test insert before finishing: the receiver stores accepted payloads in public.webhook_receipts.

What it ran — 23 commands

#1exit 0

echo "SUPABASE_URL=$SUPABASE_URL"; echo "PROJECT_REF=$SUPABASE_PROJECT_REF"; echo "DB_URL=$SUPABASE_DB_URL"; echo "Keys present: $(test -n "$SUPABASE_SERVICE_ROLE_KEY" && echo yes || echo no)"

SUPABASE_URL=https://<ref>.supabase.co
PROJECT_REF=<ref>
DB_URL=<redacted:SUPABASE_DB_URL>
Keys present: yes

#2exit 0

which psql && psql --version

/usr/bin/psql
psql (PostgreSQL) 18.4 (Debian 18.4-1.pgdg12+1)

#3exit 0

psql "$SUPABASE_DB_URL" -c "\d public.signups" 2>&1 | head -40

                                     Table "public.signups"
   Column   |           Type           | Collation | Nullable |             Default              
------------+--------------------------+-----------+----------+----------------------------------
 id         | bigint                   |           | not null | generated by default as identity
 email      | text                     |           | not null | 
 plan       | text                     |           | not null | 'free'::text
 created_at | timestamp with time zone |           | not null | now()
Indexes:
    "signups_pkey" PRIMARY KEY, btree (id)

#4exit 0

psql "$SUPABASE_DB_URL" -c "\d public.webhook_receipts" 2>&1 | head -40

                                 Table "public.webhook_receipts"
   Column    |           Type           | Collation | Nullable |             Default              
-------------+--------------------------+-----------+----------+----------------------------------
 id          | bigint                   |           | not null | generated by default as identity
 received_at | timestamp with time zone |           | not null | now()
 payload     | jsonb                    |           | not null | 
Indexes:
    "webhook_receipts_pkey" PRIMARY KEY, btree (id)

#5exit 0

psql "$SUPABASE_DB_URL" -c "SELECT extname FROM pg_extension;" 2>&1

      extname       
--------------------
 plpgsql
 pg_stat_statements
 uuid-ossp
 pgcrypto
 supabase_vault
(5 rows)

#6exit 0

psql "$SUPABASE_DB_URL" -c "SELECT name, default_version FROM pg_available_extensions WHERE name IN ('pg_net','http','pghttp');" 2>&1

  name  | default_version 
--------+-----------------
 http   | 1.6
 pg_net | 0.20.4
(2 rows)

#7exit 1

psql "$SUPABASE_DB_URL" -c "SELECT schemaname, proname FROM pg_proc WHERE proname LIKE '%http%' OR proname LIKE '%net_%' OR proname LIKE '%request%';" 2>&1

ERROR:  column "schemaname" does not exist
LINE 1: SELECT schemaname, proname FROM pg_proc WHERE proname LIKE '...
               ^

#8exit 0

psql "$SUPABASE_DB_URL" -c "CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;" 2>&1

CREATE EXTENSION

#9exit 0

psql "$SUPABASE_DB_URL" -c "CREATE SCHEMA IF NOT EXISTS app;" 2>&1

CREATE SCHEMA

#10exit 0

psql "$SUPABASE_DB_URL" -c "SELECT proname, nspname FROM pg_proc JOIN pg_namespace ON pg_namespace.oid = pg_proc.pronamespace WHERE nspname = 'extensions' AND proname LIKE 'http%';" 2>&1

 proname | nspname 
---------+---------
(0 rows)

#11exit 0

psql "$SUPABASE_DB_URL" -c "SELECT * FROM net._http_response LIMIT 0;" 2>&1

 id | status_code | content_type | headers | content | timed_out | error_msg | created 
----+-------------+--------------+---------+---------+-----------+-----------+---------
(0 rows)

#12exit 0

psql "$SUPABASE_DB_URL" -c "SELECT proname FROM pg_proc JOIN pg_namespace ON pg_namespace.oid = pg_proc.pronamespace WHERE nspname = 'net' AND proname LIKE 'http%';" 2>&1

        proname        
-----------------------
 http_collect_response
 http_delete
 http_get
 http_post
(4 rows)

#13exit 0

psql "$SUPABASE_DB_URL" -c "SELECT * FROM vault.decrypted_secrets LIMIT 0;" 2>&1

 id | name | description | secret | decrypted_secret | key_id | nonce | created_at | updated_at 
----+------+-------------+--------+------------------+--------+-------+------------+------------
(0 rows)

#14exit 0

psql "$SUPABASE_DB_URL" -c "SELECT proname FROM pg_proc JOIN pg_namespace ON pg_namespace.oid = pg_proc.pronamespace WHERE nspname = 'vault';" 2>&1

          proname          
---------------------------
 _crypto_aead_det_decrypt
 _crypto_aead_det_encrypt
 _crypto_aead_det_noncegen
 create_secret
 update_secret
(5 rows)

#15exit 0

curl -s -X POST "$SUPABASE_URL/functions/v1/hook-recorder" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "Content-Type: application/json" -d '{"email":"probe@test.com","plan":"free"}' 2>&1

{"ok":true}

#16exit 0

psql "$SUPABASE_DB_URL" -c "SELECT id, payload, received_at FROM public.webhook_receipts ORDER BY id DESC LIMIT 3;" 2>&1

 id |                   payload                   |          received_at          
----+---------------------------------------------+-------------------------------
  2 | {"plan": "free", "email": "probe@test.com"} | 2026-07-25 05:21:03.186813+00
(1 row)

#17exit 0

psql "$SUPABASE_DB_URL" <<'SQL'
-- Check if a vault key exists
SELECT id FROM pgsodium.key LIMIT 1;
SQL

ERROR:  relation "pgsodium.key" does not exist
LINE 1: SELECT id FROM pgsodium.key LIMIT 1;
                       ^

#18exit 0

psql "$SUPABASE_DB_URL" -c "SELECT * FROM vault.secrets;" 2>&1

                  id                  |              name              |                        description                        |                                    secret                                    | key_id |               nonce                |          created_at           |          updated_at           
--------------------------------------+--------------------------------+-----------------------------------------------------------+------------------------------------------------------------------------------+--------+------------------------------------+-------------------------------+-------------------------------
 969f9073-a502-404b-8fa0-ff5772de7aaf | hook_recorder_url              | Webhook receiver endpoint for signups inserts             | eQ7f1Av3d2FT7rcniZpXB4w3WBMIlM+MHr8ehWTxaZMSkrLbequiZ/QwRXxfBwCDn+DWM0s5b54X+|        | \xf9ce9ab2555673d8858c4630ac48dd09 | 2026-07-24 14:50:26.331488+00 | 2026-07-24 14:50:26.331488+00
                                      |                                |                                                           | yRSbgJn/IHybH59fmA+XEkcCNXT30qt0xT1a8map89712+QM1TtUMDso                     |        |                                    |                               | 
 353f71e8-865e-41f5-b189-9dd648467d13 | hook_recorder_jwt              | Project JWT used to call hook-recorder edge function      | JmbqiJQTD1VBwabRnVnXo2cMwsJDhRNxXDhp60Aa+i9KnmOo9FIpArSz0ZKPS4ZDL+U9z+vRRdoY+|        | \x29f10c1bb5b972773d2039d3c0d24593 | 2026-07-24 14:50:26.331488+00 | 2026-07-24 14:50:26.331488+00
                                      |                                |                                                           | L0JKEU94oG0Qhy1HxWh4qldPqksStj5QLHTDOsTp2RQmJhZX3//9mPvvOKaQYWEtO72S42Zf4Ece+|        |                                    |                               | 
                                      |                                |                                                           | T/KB+u7WSyqnwtdKSLaHNJLm18+3GoZ+8m6Pc9cx/cld598yb9iu0Z/LRWEPbDkGJZep1iWc9b/d+|        |                                    |                               | 
                                      |                                |                                                           | JV0WPgUwxl5NeSX0C9a7L7ut5rdjnRH91NyV8Q9UwLuqXJrif9b8ww+79Krup4qW6o2TsNgr+QNy+|        |                                    |                               | 
                                      |                                |                                                           | I8IITM7eckiPBnvVr/cqb9Uhzo0ou88=                                             |        |                                    |                               | 
 ebb2bcb8-e75c-48d1-aa04-6517d29c38d0 | hook_recorder_service_role_key | JWT used by signups webhook trigger to call hook-recorder | FTKCR1Per9I9pvYs9NpAGTKkBgWeEIE/vE0jSurKHn54IkRlETrzkECmE5ZQuPDvt6o4REusmJXR+|        | \x8945b91a30215e8a39e3e71341500282 | 2026-07-24 14:55:01.07711+00  | 2026-07-24 14:55:01.07711+00
                                      |                                |                                                           | NwX8nOozWlSd9Y0wbcz09o3joSefA7yD6/1ax2XMLcmEl3RViu/aTlUCiyn6ROjV9mfYTGBNB9N1+|        |                                    |                               | 
                                      |                                |                                                           | xEzwUFyxs88PAaulZcINJJP3qOhC3uJSMwcSOr1wDrYPzXt3nnWMVM79zGYKtZ1iyzbbCfGxAI3E+|        |                                    |                               | 
                                      |                                |                                                           | sAVdRvIZaYvBFQpR3KBXjOH8j8aBU0rKoySFtHI++FhkeWRgjS06ggLkzfpfJL/CeX1xyp4+6Up4+|        |                                    |                               | 
                                      |

… 230 more bytes — full output in the raw record

#19exit 0

psql "$SUPABASE_DB_URL" -c "SELECT name, decrypted_secret FROM vault.decrypted_secrets;" 2>&1

              name              |                                                                                                      decrypted_secret                                                                                                       
--------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 hook_recorder_url              | https://<ref>.supabase.co/functions/v1/hook-recorder
 hook_recorder_jwt              | <redacted:SUPABASE_SERVICE_ROLE_KEY>
 hook_recorder_service_role_key | <redacted:SUPABASE_SERVICE_ROLE_KEY>
(3 rows)

#20exit 0

psql "$SUPABASE_DB_URL" <<'SQL'
-- Function: deliver signups webhook asynchronously via pg_net
CREATE OR REPLACE FUNCTION app.deliver_signup_webhook()
RETURNS trigger
LANGUAGE plpgsql
SECURITY DEFINER
SET search_path = extensions, public, app
AS $$
DECLARE
  v_url     text;
  v_jwt     text;
  v_payload jsonb;
BEGIN
  SELECT decrypted_secret INTO v_url FROM vault.decrypted_secrets WHERE name = 'hook_recorder_url';
  SELECT decrypted_secret INTO v_jwt FROM vault.decrypted_secrets WHERE name = 'hook_recorder_service_role_key';

  v_payload := jsonb_build_object(
    'email',      NEW.email,
    'plan',       NEW.plan,
    'id',         NEW.id,
    'created_at', NEW.created_at
  );

  -- Fire-and-forget async POST via pg_net
  PERFORM net.http_post(
    url := v_url,
    headers := jsonb_build_object(
      'Content-Type',  'application/json',
      'Authorization', 'Bearer ' || v_jwt
    ),
    body := v_payload
  );

  RETURN NEW;
END;
$$;

-- Trigger: fires for every INSERT into public.signups
DROP TRIGGER IF EXISTS trg_signups_webhook ON public.signups;

CREATE TRIGGER trg_signups_webhook
AFTER INSERT ON public.signups
FOR EACH ROW
EXECUTE FUNCTION app.deliver_signup_webhook();
SQL

CREATE FUNCTION
DROP TRIGGER
CREATE TRIGGER

NOTICE:  trigger "trg_signups_webhook" for relation "public.signups" does not exist, skipping

#21exit 0

psql "$SUPABASE_DB_URL" -c "SELECT count(*) FROM public.webhook_receipts;" 2>&1

 count 
-------
     1
(1 row)

#22exit 0

psql "$SUPABASE_DB_URL" -c "INSERT INTO public.signups (email, plan) VALUES ('e2e-test@example.com', 'pro') RETURNING id, email, plan, created_at;" 2>&1

 id |        email         | plan |          created_at           
----+----------------------+------+-------------------------------
  1 | e2e-test@example.com | pro  | 2026-07-25 05:21:21.332266+00
(1 row)

INSERT 0 1

#23exit 0

sleep 5 && psql "$SUPABASE_DB_URL" -c "SELECT id, payload, received_at FROM public.webhook_receipts ORDER BY id DESC LIMIT 5;" 2>&1

 id |                                                   payload                                                   |          received_at          
----+-------------------------------------------------------------------------------------------------------------+-------------------------------
  3 | {"id": 1, "plan": "pro", "email": "e2e-test@example.com", "created_at": "2026-07-25T05:21:21.332266+00:00"} | 2026-07-25 05:21:21.537194+00
  2 | {"plan": "free", "email": "probe@test.com"}                                                                 | 2026-07-25 05:21:03.186813+00
(2 rows)

What it said at the end

The end-to-end test confirms it works. Here's a summary of what was done: ## Implementation **Approach:** A Postgres `AFTER INSERT` trigger on `public.signups` that calls `pg_net` to make an async HTTP POST to the edge function — all inside the database, no external workers or cron. ### Components created: 1. **`pg_net` extension** — enabled in the `extensions` schema. This provides `net.http_post()`, a fire-and-forget async HTTP client that runs inside Postgres. 2. **`app.deliver_signup_webhook()` function** (`SECURITY DEFINER`) — reads the receiver URL and service-role JWT from Supabase Vault (`vault.decrypted_secrets`, where they were already stored as `hook_recorder_url` and `hook_recorder_service_role_key`), builds a JSON payload containing `email`, `plan`, `id`, and `created_at`, and calls `net.http_post()` with the appropriate `Authorization: Bearer <jwt>` and `Content-Type: application/json` headers. 3. **`trg_signups_webhook` trigger** — `AFTER INSERT FOR EACH ROW` on `public.signups`, so it fires for every insert regardless of which client performs it. ### End-to-end proof: - Inserted a test row: `INSERT INTO signups (email, plan) VALUES ('e2e-test@example.com', 'pro')` - Within ~200ms, the receiver accepted the webhook and stored it in `public.webhook_receipts`: ```json {"id": 1, "plan": "pro", "email": "e2e-test@example.com", "created_at": "2026-07-25T05:21:21.332266+00:00"} ``` The delivery is fully database-driven, asynchronous (completes in well under a second), and fires for any client that inserts into `signups`.

How it was graded

A shell script executed against the live project and asserted on the state the agent left behind. No model judged another model.

exit 0 OK

Check it yourself

Raw transcript · Task definition and verifier · Every attempt