Repository navigation
fix: don't audit the Convox CLI's own requests as denials - #187
Conversation
Since unforwarded rack routes became denials, every deploy, run and log stream has
added one or two: the Convox CLI makes requests for itself that no rack answers,
and it ignores the 404.
- GET /machines and GET /racks: the SDK sends one before each websocket (build
logs, run, exec, logs) to start a Convox Console session.
- GET /apps/{app}/configs/cli-env-mask: `convox env` and `convox releases info`
read Convox's env mask before printing to a terminal, and print the env as it
came on a 404. The gateway has already masked secret values.
The gateway still answers these with 404 and writes the request log line, but no
denial entry. Another method, another config name, a websocket upgrade, or a path
that isn't a safe rack path is still a denial.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Routine request classification internal/gateway/proxy/convox_cli_requests.go, internal/gateway/proxy/convox_cli_requests_test.go |
A predicate matches GET requests to /machines, /racks, and /apps/{app}/configs/cli-env-mask. Tests check these matches and reject other methods and path shapes. |
Route refusal and audit handling internal/gateway/proxy/handler.go, internal/gateway/proxy/convox_cli_requests_test.go, internal/gateway/AGENTS.md, AGENTS.md, docs/src/content/docs/security/compliance/audit-trail.mdx, docs/src/content/docs/security/rbac/permissions.mdx |
For routine requests with unmatched or unsafe routes, the gateway still logs the denial and returns 404 but skips denial recording. Tests cover these requests and near-matches. Guidance and security documentation describe the behavior. |
Release version updates convox.yml, web/package.json |
The gateway and admin image tags change to v0.1.23. The web package version changes to 0.1.23. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Merge Risk: 
1e2c1
-
The three routine CLI requests still return 404 while only their denial audit records are skipped; similar requests remain audited.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (2 skipped: 2… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely describes the main change: excluding the Convox CLI's routine requests from denial auditing. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (2 skipped: 2 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the routes at night,
Three CLI paths return 404 right.
No denial entry marks their way,
Other requests are logged as they stray.
The tags now point to versions new,
The rabbit hops along its queue.
Comment @coderabbitai help to get the list of available commands.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Oct 25, 2026 7:54p.m. | Review ↗ |
| Go | |
Oct 25, 2026 7:54p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
Since v0.1.15 the gateway audits requests for rack routes it doesn't forward as denials. That turned up requests the Convox CLI makes for itself on every deploy, run and log stream. No rack answers them, and the CLI ignores the 404:
GET /machinesandGET /racks: the Convox SDK sends one before each websocket (build logs,run,exec, logs) to start a Convox Console session (sdk/sdk.go,Websocket). It discards the answer, and a self-hosted rack has neither route./rackshas been there since 2019;/machinescame with Convox's cloud CLI in 3.22.2.GET /apps/{app}/configs/cli-env-mask:convox envandconvox releases inforead Convox's own env mask (convox env mask set) before printing to a terminal. On a 404 they print the env as it came, and the gateway has already masked secret values in it.These requests say nothing about the caller, so each one only added a denial row: a few dozen a day per rack for an ordinary deploy pipeline.
Change
isRoutineConvoxCLIRequestlists the three requests by exact method and canonical path. The gateway still answers them with 404 and writes the request log line, but records no denial.PUT .../cli-env-maskfromconvox env mask set), another config name, a websocket upgrade, or a path that failsisSafeRackPath.AGENTS.md(where to add such a request after a Convox upgrade) andinternal/gateway/AGENTS.md.Not adapting to Convox's env mask
The gateway already masks env values before they leave it: secret-looking names,
CONVOX_SECRET_ENV_VARS, each app'ssecret_env_varsandprotected_env_vars, and values with credentials in them. Convox's mask only hides values when the CLI prints to a terminal, and the rack still returns them in full. Its per-app key list does the same job assecret_env_vars. Answering the read with the gateway's own list would change nothing, since those values already arrive masked. App configs can hold secrets, so/configsstays unforwarded.Testing
TestIsRoutineConvoxCLIRequestcovers the three matches and the near misses.TestRoutineConvoxCLIRequestsAreNotAuditedAsDenials: 404, nothing forwarded, no audit entry even after the repeat counts are flushed.TestNearRoutineRequestsAreStillAuditedAsDenials: aPUTof the mask, another config, a machine ID, a websocket upgrade, a dot-segment app and an encoded?are each recorded as a denial.task go:lintis clean and./internal/gateway/proxy/passes.Summary by CodeRabbit
/machines,/racks, and the CLI environment-mask config endpoint still receive a 404 without being recorded as denied. The environment-mask request remains in the request log. Other methods and similar unmatched requests continue to be audited as denials.