Repository navigation
fix(release): host_not_allowed for refused hosts, internal-JWT-only secret release, and final release-audit cleanups - #9870
Merged
Conversation
user.banned is nullable, so a real owner with banned = NULL had every personal key refused as orphaned. Select the joined user id and test that instead; the ban and suspension checks are unchanged.
- egress validation names its refusal (dns or policy) instead of callers inferring it from a missing cause; an empty DNS answer is ENOTFOUND - the token check judges every DNS record when an environment proxy will carry the request, so a mixed public/private host is refused up front rather than failing in the transport as a retryable 502; the transport's own refusal is a typed EgressRefusedError and maps the same way - new host_not_allowed code (400) with its own connect-modal message - Flow and GitLab personal-token verification classify a refused or missing host the same way - the typed-URL scheme guard is shared and ignores the tabs and newlines the URL parser drops
An oversized 2xx token reply carried status 200 into provider_unavailable and its logs. A refusal keeps its own status.
run.version, async and waitTimeoutSeconds refuse read-only keys; the meta example lists search:read with the full-access scopes.
Every listed tool is an internal operation, so the probed-request fallback no longer builds or consults it.
The unauthenticated CLI poll route and the settings routes returned the raw error message for an internal failure. Return a fixed message and keep the cause in the server log; a conflict still names the existing key. The CLI's comment now says a 400 can also be a refused key creation.
… rollback The route-cache clear stays non-fatal but warns when it fails for any reason other than a missing build id or cache. The api-key-read-only flag says to revoke or replace read-only keys before rolling back.
The token route refused only session callers; any other auth type would have been handed a saved secret. Allow internal JWT and refuse the rest. Tools never execute in the browser (the registry boundary keeps the tool registry out of every workspace client graph, and nothing else imports the executor), so the browser-only token fetch through the route is deleted.
A cleared field arrived as '' and was sent as 0, a crawl of the start page only. It now follows the blank maxDepth handling.
…of credential display The JWKS route still answers 404 when the signing key is broken, but warns with the error. The GitLab personal-token display reads its block type from the catalog entry instead of importing the generated successor map into a client-imported module.
- delegation: the read-only replacement case decided its filter by scanning bound params in a fake DB; no real-boundary check exists, so it is dropped with the fake's filter - Twilio: assert how many recordings requests were sent, so an empty loop cannot pass - Pi: the removed-model case restated the absent-from-catalog case
10.0.0.0/8/junk parsed as /8. An entry with extra segments is dropped like any other unparseable entry, and the TSDoc says IP entries match within their address family.
… the mutability guard - the execution-status paused-row read filters by workflowId as well - delete-workflow uses requireMutableWorkflow instead of an inline copy - polling webhook logs carry the webhook id in metadata
…fusal The caller may not be able to see the credential that holds or blocks the subject, so both refusals name only the workspace or organization. The uniqueness check documents its limits.
…un variables TSDoc
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Contributor
 [High impact] The PR appears safe to merge; no new actionable issues remain. SummaryThis PR tightens credential release and improves errors for refused hosts.
The previous AWS-secret logging finding is fixed: the current pattern masks Reviews (3) · Last reviewed commit: "fix(release): keep bare secretKey redact..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…cal's bare secretKey visible
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 53 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
…ress rule to the transport, and report unknown GitLab hosts as input errors
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The single round-2 cleanup for the staging→main release, agreed across every session working the release audit (it absorbs the separate lists from each audit pass and closed #9867). Low-severity items only; none change product behavior beyond the fixes listed.
Credentials and egress
host_not_allowed400 ("Sim can't connect to that address…") instead of blaming the token. Under an environment proxy the pre-check now requires every resolved address to pass, so a mixed public/private answer is refused up front; the transport's proxy refusal maps to the same code as a backstop.EgressValidationFailurecarries an explicitdns/policyreason; an empty DNS answer issite_not_found; the shared scheme guard strips embedded\t\n\r; Flow and GitLab token checks classify refused hosts the same way. Real transport failures stay 502fetchCredentialTokenFromRouteis removed (nothing in the browser executes tools)API and docs
user.idnull) apart from an owner whosebannedis NULL, so the latter is no longer refusedapi:writeis required (read-only keys are refused);/api/v2/metaexample listssearch:read; OpenAPI, CLI types, and MCP ops regeneratedapi-key-read-onlyflag note: revoke or replace read-only keys before rolling back below this releasesecretKeypattern masked secret names in run logs);deployKeystays redactedNO_PROXYthe way curl does (removes the contradiction with the NO_PROXY section); Helm README andresolveDeployedRunVariablesTSDoc correctedSmall fixes and cleanups
maxDiscoveryDepthis treated as unset10.0.0.0/8/junk) is ignored rather than read as/8delete-workflowuses the sharedrequireMutableWorkflow; polling log ids moved to metadata; saved-credential contract builds its payload allowlist onceType of Change
Testing
packages/security(211), root scripts (742), sim-cli (528)tscon apps/sim;check:openapi,cli-api,mcp-operations,v2-route-table,cli-docs,tool-metadata,schema-mock,boundaries,egress-boundary,client-boundary,realtime-prune,tool-registry-boundary,permission-group-enforcement,principal-kind-parity,api-validation:strict,test-patterns,source-conventions; block registry check; biomeChecklist
test-auditauthoring gate)