Relocate the front-door router into agentrelay.com (Phase 2)

[willwashburn]

Moves the Cloudflare router that fronts agentrelay.com out of cloud's SST app
into this repo (full git history preserved), deployed via plain Wrangler as a
sibling to web/. Co-locates the front door with the web product and frees
router changes from cloud's gated full-SST production deploy.

Scope: prod only. Cloud keeps deploying the staging/dev routers; those retire
in Phase 3 (domain consolidation).

What's here

• router/ — index.ts + src/ + tests, lifted from cloud/packages/router.
  61 tests pass, typecheck clean, wrangler deploy --dry-run bundles it.
• router/wrangler.jsonc — binds the cloud-owned resources cross-repo by
  name/id: CLOUD_WEB_WORKER service (cloud-web-worker), ROUTER_CONFIG +
  RATE_LIMIT_COUNTERS KV, TRAFFIC_RECORDER R2, plus the CLOUD_APP_ORIGIN /
  FILE_OBSERVER_ORIGIN / WEBHOOK_WORKER_ORIGIN vars.
• .github/workflows/deploy-router.yml — wrangler deploy on router/ changes.
• router added as a workspace member.

⚠️ Before this can deploy — fill 3 cloud-owned values in router/wrangler.jsonc

All in the same Cloudflare account; look them up once:

• ROUTER_CONFIG KV id and RATE_LIMIT_COUNTERS KV id → wrangler kv namespace list (titles router-config, rate-limit-counters)
• WEBHOOK_WORKER_ORIGIN → the cloud webhook worker's *.workers.dev URL (dashboard / wrangler deployments)

Rollout (after the ids are filled)

1. Merge → deploy-router.yml deploys to router-next.agentrelay.com.
2. Verify parity vs the live apex (/, /cloud, /observer*, rate-limit, recorder, webhook flag).
3. Apex cutover (separate, low-traffic window): gate cloud's prod router off
   (cloud PR) → flip router/wrangler.jsonc route to agentrelay.com → wrangler deploy.

🤖 Generated with Claude Code

---

Summary by cubic

Relocates the Cloudflare front-door router for agentrelay.com into this repo under router/, deployed with wrangler for faster, independent releases. Also fixes webhook forward handling to avoid disturbing request streams and ensures 500 errors return JSON.

• New Features

  • Adds router/ Worker with rate limiting, traffic recorder, redirect rewrites; tests pass and typecheck is clean.
  • Adds router/wrangler.jsonc with bindings: CLOUD_WEB_WORKER, WEBHOOK_WORKER, ROUTER_CONFIG, RATE_LIMIT_COUNTERS, TRAFFIC_RECORDER; vars CLOUD_APP_ORIGIN, FILE_OBSERVER_ORIGIN; prod KV IDs are pinned.
  • Adds .github/workflows/deploy-router.yml to wrangler deploy on router/** changes; root scripts include deploy:router.
  • Routing: apex fallback proxies to https://origin-web.agentrelay.com; /observer routing remains unchanged; webhook requests build forwarded bodies per-branch to avoid stream errors and break the /webhooks/nango self-forward loop; 500s return application/json.
  • Docs: updates router/README.md diagram for the relocation and clarifies the agent name.

• Migration

  • Rollout:
    • Merge → auto-deploys to router-next.agentrelay.com
    • Verify parity with apex (/, /cloud, /observer*, rate-limit, recorder, webhook flag)
    • Cutover: disable cloud’s prod router, change route to agentrelay.com in router/wrangler.jsonc, then wrangler deploy

^{Written for commit 4b06f49. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@willwashburn, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 26 minutes and 40 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4605564a-4b12-4878-8df3-317eb958dcb7

📥 Commits

Reviewing files that changed from the base of the PR and between d760150 and 4b06f49.

📒 Files selected for processing (3)

• router/README.md
• router/index.ts
• router/wrangler.jsonc

📝 Walkthrough

Walkthrough

This PR adds a new Cloudflare-based router workspace, implements request routing with webhook handling, rate limiting, and sampled traffic recording, wires build and deployment configuration, adds tests for the new behavior, and documents route precedence and deployment paths.

Changes

Router worker rollout

Layer / File(s)	Summary
Workspace and deployment scaffold package.json, router/package.json, router/tsconfig.json, router/wrangler.jsonc, .github/workflows/deploy-router.yml	Adds the router workspace, router package scripts and TypeScript setup, Wrangler bindings and routes, and a GitHub Actions workflow that deploys the worker with Cloudflare credentials.
Rate limiting and recording primitives router/src/rate-limit.ts, router/src/redact.ts, router/src/recorder.ts, router/test/rate-limit.test.ts, router/test/recorder.test.ts, router/test/redact.test.ts	Implements configurable KV-backed rate limiting, header/body redaction, sampled R2 traffic recording, and tests for bypasses, key extraction, limits, redaction rules, sampling, and stored record contents.
Router request handling router/index.ts, router/test/webhook-routing.test.ts	Adds the worker entrypoint that rate-limits, optionally records, routes /cloud* and webhook requests to worker bindings or alternate origins, forwards other traffic upstream, rewrites redirect locations, and tests webhook routing decisions.
Route and deployment documentation router/README.md	Documents route precedence for cloud and observer paths, fallback behavior, RelayFile deployment wiring, and the deployed target mapping.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Router
  participant RateLimit
  participant WorkerBinding
  participant Upstream
  participant Recorder

  Client->>Router: HTTP request
  Router->>RateLimit: maybeRateLimit(request)
  alt /cloud or webhook worker route
    Router->>WorkerBinding: fetch(transformed request)
    WorkerBinding-->>Router: response
  else other routed path
    Router->>Upstream: fetch(resolved origin/path)
    Upstream-->>Router: response
  end
  Router->>Recorder: maybeRecord(request, response)
  Router-->>Client: final response

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~100 minutes

Possibly related issues

• AgentWorkforce/cloud#1967 — This PR implements the Cloudflare router worker, including edge routing, rate limiting, traffic recording, and deployment wiring described in that migration-related issue.

Poem

🐇 I hopped through routes of cloud and file,
With limits set in worker style.
I tucked redactions in each log,
And watched the traffic through the fog.
Now wrangler drums, deploys take flight—
The router hums into the night.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.46% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: relocating the front-door router into agentrelay.com as Phase 2 of a planned effort.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description comprehensively covers the changeset, explaining the relocation of the Cloudflare router to this repo, deliverables, configuration requirements, and rollout plan.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch relocate-router

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a new Cloudflare Worker router package to manage route precedence, edge-based per-key rate limiting via Cloudflare KV, and a traffic recorder with sensitive data redaction. The feedback highlights two important issues in router/index.ts: first, a potential TypeError caused by stream disturbance when pre-emptively constructing a Request with request.body before verifying environment bindings; second, a missing content-type: application/json header on the 500 error response.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Creating webhookWorkerRequest using request.body before checking if env.WEBHOOK_WORKER is defined can cause a TypeError due to stream disturbance if the code falls back to using env.WEBHOOK_WORKER_ORIGIN. In Cloudflare Workers, a ReadableStream (like request.body) can only be associated with a single Request or Response constructor. If env.WEBHOOK_WORKER is undefined, the stream is already disturbed/locked by the first Request constructor, causing the subsequent buildWebhookWorkerRequest call for workerOrigin to throw an error.

We should defer the creation of the Request objects to their respective conditional branches.

    if (await shouldUseWebhookWorker(url.pathname, request, env)) {
      if (env.WEBHOOK_WORKER) {
        const webhookWorkerRequest = buildWebhookWorkerRequest(request, url);
        const workerResponse = await env.WEBHOOK_WORKER.fetch(webhookWorkerRequest);
        if (recorderRequestClone && recorderEnv) {
          ctx.waitUntil(
            maybeRecord(recorderRequestClone, workerResponse.clone(), recorderEnv, ctx),
          );
        }
        return workerResponse;
      }

      const workerOrigin = env.WEBHOOK_WORKER_ORIGIN?.trim();
      if (workerOrigin) {
        const originResponse = await globalThis.fetch(
          buildWebhookWorkerRequest(request, url, workerOrigin),
        );
        if (recorderRequestClone && recorderEnv) {
          ctx.waitUntil(
            maybeRecord(recorderRequestClone, originResponse.clone(), recorderEnv, ctx),
          );
        }
        return originResponse;
      }
    }

[gemini-code-assist]

The 500 error response returned when globalThis.fetch fails does not specify a content-type header, even though the body is a JSON string. Adding "content-type": "application/json" ensures clients can parse the error response correctly.

    } catch (error) {
      return new Response(JSON.stringify({ error: (error as Error).message }), {
        status: 500,
        headers: { "content-type": "application/json" },
      });
    }

[github-actions]

Preview deployed!

Environment	URL
Web	https://a2a50a3c-agentrelay-web.agent-workforce.workers.dev

This is a Cloudflare Workers preview version of this PR's build.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d7ac214a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add /cloud to full-body redaction rules

Because the recorder passes the original public pathname into redactBody, a secrets request routed through the new front door arrives as /cloud/api/v1/workspaces/.../secrets, which this regex (and the following full-body redaction entries) do not match. Those requests then fall through to field-level JSON redaction and can persist secret/auth/connect-session payload values under non-denylisted keys in TRAFFIC_RECORDER; add the optional /cloud prefix as was done for transcripts.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Normalize JSON secret keys before matching

When a recorded JSON body uses conventional snake_case secret fields such as access_token, refresh_token, or client_secret, lowercasing alone leaves the underscores, so none of those names match the deny-list entries like accesstoken and clientsecret. On any route that is not fully redacted, those credentials are written verbatim to the traffic corpus; normalize separators or include the snake_case variants before enabling the recorder.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Exempt /cloud webhooks from rate limiting

maybeRateLimit runs before webhook routing strips the /cloud mount prefix, and the new public router receives webhook URLs as /cloud/api/v1/webhooks/.... This bypass only covers the unmounted path, so provider bursts through agentrelay.com are bucketed by IP and start returning 429 after the default 60/min, dropping legitimate webhook events; include the /cloud-mounted prefix too.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Replace placeholder KV IDs before auto-deploy

The new workflow deploys this worker on pushes to main that touch router/**, but the config still binds ROUTER_CONFIG and RATE_LIMIT_COUNTERS to literal placeholder IDs. Merging in this state makes the first wrangler deploy target non-existent KV namespaces, so router-next.agentrelay.com will not publish until the real production IDs are committed or injected at deploy time.

Useful? React with 👍 / 👎.

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (3)

router/README.md (1)

17-17: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Specify language identifier for the fenced code block.

Add a language identifier to the code fence to satisfy the markdown linter and improve editor syntax highlighting.

Suggested fix

-```
+```text
                                      ┌────────────────────────────────────┐
                                      │       `@agentworkforce/cloud`        │

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/README.md` at line 17, The fenced code block in router/README.md is
missing a language identifier on its opening fence, which violates the markdown
linter rules and prevents syntax highlighting. Add a language identifier (such
as `text`) immediately after the opening triple backticks (```) at the start of
the code block that contains the ASCII diagram showing the `@agentworkforce/cloud`
architecture.

Source: Linters/SAST tools

router/test/redact.test.ts (1)

22-40: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression tests for /cloud deny-list parity and malformed-JSON fail-closed behavior.

Please add cases for /cloud/api/... on the other full-body redaction routes (not just transcripts), plus a JSON content-type payload that is malformed and should still be redacted.

Also applies to: 42-78

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/test/redact.test.ts` around lines 22 - 40, Add additional regression
test cases to cover `/cloud` deny-list parity and malformed JSON behavior.
First, extend or create test cases similar to the transcript redaction test to
verify that other full-body redaction routes (such as the
`/api/v1/workspaces/ws_123/secrets` path tested in the "fully redacts bodies for
deny-listed paths" test) also properly redact when accessed with the `/cloud`
prefix (e.g., `/cloud/api/v1/workspaces/ws_123/secrets`). Second, add a new test
case that verifies the redactBody function handles malformed JSON payloads with
`application/json` content-type by still redacting them completely, ensuring
fail-closed behavior for invalid JSON input.

.github/workflows/deploy-router.yml (1)

25-29: 🔒 Security & Privacy | 🔵 Trivial

Consider pinning GitHub Actions to commit SHAs for stricter supply-chain control.

While using major version tags (@v4) is GitHub's recommended approach for official actions and ensures you receive security patches, pinning to specific commit SHAs provides explicit control and prevents unexpected behavior changes. This is optional but aligns with defense-in-depth practices if your organization requires stricter CI/CD hardening.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-router.yml around lines 25 - 29, The GitHub Actions
used in the workflow file are pinned to major version tags (`@v4`) rather than
specific commit SHAs. Replace the version tags in the `actions/checkout@v4` and
`actions/setup-node@v4` actions with their corresponding commit SHAs (for
example, `actions/checkout@<commit-sha>` and `actions/setup-node@<commit-sha>`)
to provide stricter supply-chain control and prevent unexpected behavior changes
from action updates.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/deploy-router.yml:
- Around line 33-41: The workflow is missing a validation step to prevent
deploying with unresolved configuration values. Add a new step between "Install
dependencies" and "Deploy router to Cloudflare" that checks the
router/wrangler.jsonc file for any remaining REPLACE_ME__ sentinel values using
a grep or similar validation command, and fails the job if any are found. This
guard should execute before the wrangler deploy command runs to catch
configuration issues early.
- Around line 24-25: The actions/checkout@v4 step in the deploy-router workflow
is missing the persist-credentials configuration which leaves a writable
authentication token in the workspace after checkout. Add the
persist-credentials input parameter set to false on the checkout action to
prevent this security risk, as the workflow performs no authenticated Git
operations after the initial checkout step.

In `@router/index.ts`:
- Around line 290-295: The code constructs a new URL object from the
workerOrigin config value without validation, which will throw an uncaught
exception if the environment variable is malformed. Wrap the URL construction
logic in a try-catch block to catch any exceptions thrown by new
URL(workerOrigin), and return a controlled error response instead of allowing
the exception to escape. Apply this validation fix to both code blocks where
this pattern occurs (the first at the location shown and the second at lines
366-370 as noted in the comment).

In `@router/src/redact.ts`:
- Around line 11-23: The FULL_BODY_REDACTION_PATHS array in redact.ts currently
only has one pattern that handles the optional /cloud prefix for sensitive
routes. Update all remaining regex patterns in this array to also match their
/cloud-prefixed equivalents by adding the optional (?:cloud\/)? prefix pattern
at the beginning of each route, similar to how it's already done for the
/api/v1/webhooks/transcripts pattern. This applies to all patterns that start
with /api/ such as those for workspaces/secrets, /api/auth, /api/v1/auth,
/api/v1/cli/auth, /api/v1/cli/login, /api/v1/integrations/nango/connect-link,
and workspaces integrations connect-session.
- Around line 123-127: The catch block in the JSON redaction logic currently
returns the original unredacted body when JSON parsing fails, which can leak
secrets into recorder storage. Instead of returning the raw body in the catch
block following the JSON.parse and redactJsonValue calls, return a safe default
value such as an empty string or a JSON object that indicates redaction failure,
ensuring that unparseable content does not expose sensitive information.

In `@router/wrangler.jsonc`:
- Around line 36-39: The WEBHOOK_WORKER_ORIGIN configuration value in
wrangler.jsonc contains a sentinel placeholder
"REPLACE_ME__webhook_worker_workers_dev_url" instead of the actual webhook
worker URL. Replace this placeholder value with the actual generated
*.workers.dev URL of your webhook worker by looking it up via the `wrangler
deployments list --name <webhook worker script>` command or checking the
Cloudflare dashboard, then update the WEBHOOK_WORKER_ORIGIN value with the
correct URL before merging.

---

Nitpick comments:
In @.github/workflows/deploy-router.yml:
- Around line 25-29: The GitHub Actions used in the workflow file are pinned to
major version tags (`@v4`) rather than specific commit SHAs. Replace the version
tags in the `actions/checkout@v4` and `actions/setup-node@v4` actions with their
corresponding commit SHAs (for example, `actions/checkout@<commit-sha>` and
`actions/setup-node@<commit-sha>`) to provide stricter supply-chain control and
prevent unexpected behavior changes from action updates.

In `@router/README.md`:
- Line 17: The fenced code block in router/README.md is missing a language
identifier on its opening fence, which violates the markdown linter rules and
prevents syntax highlighting. Add a language identifier (such as `text`)
immediately after the opening triple backticks (```) at the start of the code
block that contains the ASCII diagram showing the `@agentworkforce/cloud`
architecture.

In `@router/test/redact.test.ts`:
- Around line 22-40: Add additional regression test cases to cover `/cloud`
deny-list parity and malformed JSON behavior. First, extend or create test cases
similar to the transcript redaction test to verify that other full-body
redaction routes (such as the `/api/v1/workspaces/ws_123/secrets` path tested in
the "fully redacts bodies for deny-listed paths" test) also properly redact when
accessed with the `/cloud` prefix (e.g.,
`/cloud/api/v1/workspaces/ws_123/secrets`). Second, add a new test case that
verifies the redactBody function handles malformed JSON payloads with
`application/json` content-type by still redacting them completely, ensuring
fail-closed behavior for invalid JSON input.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 94d73fe8-3f84-4767-a964-f69f7b386e82

📥 Commits

Reviewing files that changed from the base of the PR and between c7b1ec2 and d760150.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (14)

• .github/workflows/deploy-router.yml
• package.json
• router/README.md
• router/index.ts
• router/package.json
• router/src/rate-limit.ts
• router/src/recorder.ts
• router/src/redact.ts
• router/test/rate-limit.test.ts
• router/test/recorder.test.ts
• router/test/redact.test.ts
• router/test/webhook-routing.test.ts
• router/tsconfig.json
• router/wrangler.jsonc

[coderabbitai]

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

git ls-files | grep -i "deploy-router"

Repository: AgentWorkforce/agentrelay.com

Length of output: 203

---

🏁 Script executed:

cat -n .github/workflows/deploy-router.yml | head -40

Repository: AgentWorkforce/agentrelay.com

Length of output: 1281

---

🌐 Web query:

actions/checkout v4 persist-credentials security best practice GitHub Actions

💡 Result:

Setting persist-credentials: false in the actions/checkout action is considered a security best practice for most GitHub Actions workflows [1][2][3]. By default (persist-credentials: true), the action configures the Git local configuration with the provided token or SSH key [4][5][6]. This allows subsequent steps in the same job to perform authenticated Git operations automatically, but it also creates a security risk: any process or action executed later in the job can access these credentials from the.git/config file [7][2]. If a workflow step is compromised, or if the working directory is inadvertently uploaded as an artifact, the credentials may be exposed to unauthorized parties [2][3]. Key security considerations: 1. Recommended Practice: Set persist-credentials: false unless your workflow explicitly requires authenticated Git operations (e.g., pushing commits back to the repository) after the checkout step [1][2][3]. 2. Risk Reduction: Disabling credential persistence ensures that credentials are not stored on disk in the runner's working directory, significantly reducing the potential blast radius if a workflow is compromised [1][2]. 3. Manual Credential Management: If you disable persistence but still need to perform authenticated Git operations, you must manually configure the required authentication (e.g., by using an environment variable or explicit configuration) in the steps that require it [2]. 4. Context Matters: While GITHUB_TOKEN has default permissions and is handled by the runner environment, persist-credentials specifically controls whether that token is written to the Git configuration on disk [4][7]. For high-value workflows, such as those performing releases or deployments, it is especially important to follow the principle of least privilege, limit the scope of tokens, and consider using more secure alternatives like OIDC (OpenID Connect) for authentication with cloud providers rather than relying on long-lived or persisted secrets [8][3].

Citations:

• 1: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
• 2: https://phpunit.expert/articles/hardening-github-actions-workflows.html
• 3: https://www.wiz.io/blog/github-actions-security-guide
• 4: https://github.com/actions/checkout
• 5: https://github.com/actions/checkout/blob/v4/README.md
• 6: https://github.com/actions/checkout/blob/v4/action.yml
• 7: Remove persist-credentials or change the default to false actions/checkout#485
• 8: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md

---

Disable checkout credential persistence.

Set persist-credentials: false on the checkout action to avoid leaving a writable token in the workspace for subsequent steps. This workflow performs no authenticated Git operations after checkout, so credential persistence is unnecessary and increases the attack surface.

Suggested change

      - name: Checkout code
        uses: actions/checkout@v4
+       with:
+         persist-credentials: false

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: Checkout code
	uses: actions/checkout@v4
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	persist-credentials: false

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-router.yml around lines 24 - 25, The
actions/checkout@v4 step in the deploy-router workflow is missing the
persist-credentials configuration which leaves a writable authentication token
in the workspace after checkout. Add the persist-credentials input parameter set
to false on the checkout action to prevent this security risk, as the workflow
performs no authenticated Git operations after the initial checkout step.

Source: Linters/SAST tools

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Add a pre-deploy guard for unresolved config sentinels.

A fast validation step should fail the job if REPLACE_ME__ values remain in router/wrangler.jsonc, preventing bad production deploys.

Suggested change

       - name: Install dependencies
         run: npm ci

+      - name: Validate router wrangler config
+        run: |
+          if grep -q "REPLACE_ME__" router/wrangler.jsonc; then
+            echo "Unresolved placeholder found in router/wrangler.jsonc"
+            exit 1
+          fi
+
       - name: Deploy router to Cloudflare
         working-directory: router
         env:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-router.yml around lines 33 - 41, The workflow is
missing a validation step to prevent deploying with unresolved configuration
values. Add a new step between "Install dependencies" and "Deploy router to
Cloudflare" that checks the router/wrangler.jsonc file for any remaining
REPLACE_ME__ sentinel values using a grep or similar validation command, and
fails the job if any are found. This guard should execute before the wrangler
deploy command runs to catch configuration issues early.

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Validate WEBHOOK_WORKER_ORIGIN before request construction.

Line 291 constructs new URL(workerOrigin) from config without validation. If this env value is malformed, the throw escapes this branch and webhook requests fail with an uncaught runtime error instead of a controlled response.

Suggested fix

   const workerOrigin = env.WEBHOOK_WORKER_ORIGIN?.trim();
   if (workerOrigin) {
-    const originResponse = await globalThis.fetch(
-      buildWebhookWorkerRequest(request, url, workerOrigin),
-    );
+    let forwardedRequest: Request;
+    try {
+      forwardedRequest = buildWebhookWorkerRequest(request, url, workerOrigin);
+    } catch {
+      return new Response(
+        JSON.stringify({ error: "invalid webhook worker origin configuration" }),
+        {
+          status: 503,
+          headers: { "content-type": "application/json" },
+        },
+      );
+    }
+    const originResponse = await globalThis.fetch(forwardedRequest);
     if (recorderRequestClone && recorderEnv) {
       ctx.waitUntil(
         maybeRecord(recorderRequestClone, originResponse.clone(), recorderEnv, ctx),
       );
     }

Also applies to: 366-370

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/index.ts` around lines 290 - 295, The code constructs a new URL object
from the workerOrigin config value without validation, which will throw an
uncaught exception if the environment variable is malformed. Wrap the URL
construction logic in a try-catch block to catch any exceptions thrown by new
URL(workerOrigin), and return a controlled error response instead of allowing
the exception to escape. Apply this validation fix to both code blocks where
this pattern occurs (the first at the location shown and the second at lines
366-370 as noted in the comment).

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Extend full-body redaction rules to /cloud-prefixed sensitive routes.

Most deny-listed patterns only match /api/.... Router-ingressed equivalents under /cloud/api/... can bypass full-body redaction and persist secrets.

Suggested change

 const FULL_BODY_REDACTION_PATHS = [
-  /^\/api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/secrets(?:\/.*)?$/,
-  /^\/api\/auth(?:\/.*)?$/,
-  /^\/api\/v1\/auth(?:\/.*)?$/,
-  /^\/api\/v1\/cli\/auth(?:\/.*)?$/,
-  /^\/api\/v1\/cli\/login(?:\/.*)?$/,
-  /^\/api\/v1\/integrations\/nango\/connect-link(?:\/.*)?$/,
-  /^\/api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/integrations\/connect-session(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/secrets(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/auth(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/auth(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/cli\/auth(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/cli\/login(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/integrations\/nango\/connect-link(?:\/.*)?$/,
+  /^\/(?:cloud\/)?api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/integrations\/connect-session(?:\/.*)?$/,

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	const FULL_BODY_REDACTION_PATHS = [
	/^\/api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/secrets(?:\/.*)?$/,
	/^\/api\/auth(?:\/.*)?$/,
	/^\/api\/v1\/auth(?:\/.*)?$/,
	/^\/api\/v1\/cli\/auth(?:\/.*)?$/,
	/^\/api\/v1\/cli\/login(?:\/.*)?$/,
	/^\/api\/v1\/integrations\/nango\/connect-link(?:\/.*)?$/,
	/^\/api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/integrations\/connect-session(?:\/.*)?$/,
	// Recorder transcript ingest carries full meeting transcript_text/summary_text;
	// never persist its body to the traffic corpus. Match with or without the
	// /cloud app prefix.
	/^\/(?:cloud\/)?api\/v1\/webhooks\/transcripts(?:\/.*)?$/,
	];
	const FULL_BODY_REDACTION_PATHS = [
	/^\/(?:cloud\/)?api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/secrets(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/auth(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/v1\/auth(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/v1\/cli\/auth(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/v1\/cli\/login(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/v1\/integrations\/nango\/connect-link(?:\/.*)?$/,
	/^\/(?:cloud\/)?api\/v1\/workspaces\/[a-zA-Z0-9_-]+\/integrations\/connect-session(?:\/.*)?$/,
	// Recorder transcript ingest carries full meeting transcript_text/summary_text;
	// never persist its body to the traffic corpus. Match with or without the
	// /cloud app prefix.
	/^\/(?:cloud\/)?api\/v1\/webhooks\/transcripts(?:\/.*)?$/,
	];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/src/redact.ts` around lines 11 - 23, The FULL_BODY_REDACTION_PATHS
array in redact.ts currently only has one pattern that handles the optional
/cloud prefix for sensitive routes. Update all remaining regex patterns in this
array to also match their /cloud-prefixed equivalents by adding the optional
(?:cloud\/)? prefix pattern at the beginning of each route, similar to how it's
already done for the /api/v1/webhooks/transcripts pattern. This applies to all
patterns that start with /api/ such as those for workspaces/secrets, /api/auth,
/api/v1/auth, /api/v1/cli/auth, /api/v1/cli/login,
/api/v1/integrations/nango/connect-link, and workspaces integrations
connect-session.

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Fail closed on JSON parse errors in redaction.

For JSON content types, parse failures currently return the original body unchanged. That can leak secrets into recorder storage.

Suggested change

   try {
     return JSON.stringify(redactJsonValue(JSON.parse(body)));
   } catch {
-    return body;
+    return redactValue(body);
   }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@router/src/redact.ts` around lines 123 - 127, The catch block in the JSON
redaction logic currently returns the original unredacted body when JSON parsing
fails, which can leak secrets into recorder storage. Instead of returning the
raw body in the catch block following the JSON.parse and redactJsonValue calls,
return a safe default value such as an empty string or a JSON object that
indicates redaction failure, ensuring that unparseable content does not expose
sensitive information.

[willwashburn]

Thanks for the reviews (Gemini / Codex / CodeRabbit). Triaged below.

✅ Fixed in this PR

• Webhook-request stream disturbance (Gemini HIGH, CodeRabbit index.ts): the forwarded Request is now built inside each branch, so request.body (a single-use ReadableStream) is never constructed before the WEBHOOK_WORKER vs WEBHOOK_WORKER_ORIGIN choice — the fallback path can no longer throw.
• Missing content-type on the 500 (Gemini MED): the catch-all error now sets content-type: application/json.

✅ Already resolved (reviews ran on the pre-fix commit 3d7ac21)

• Placeholder KV ids / WEBHOOK_WORKER_ORIGIN placeholder (Codex P1, CodeRabbit): the KV ids are now pinned to the real prod namespaces, and the webhook target was switched from the pinned *.workers.dev URL to a WEBHOOK_WORKER service binding (by stable script name) — so there's no placeholder left and one fewer cross-repo value to drift.

⏭️ Deferred — pre-existing cloud-router behavior, not a regression from the move

These are carried over verbatim from cloud/packages/router and exist in the live prod router today, so the relocation is behavior-neutral. They deserve a dedicated (security) follow-up in both repos rather than a behavior change mid-relocation:

• redact: extend full-body redaction to /cloud-prefixed sensitive routes (Codex/CodeRabbit P1)
• redact: normalize JSON secret keys before matching + fail-closed on JSON parse errors
• rate-limit: exempt /cloud webhook ingress from per-key rate limiting (Codex P2)

I'll file these as a follow-up so they get fixed in cloud's copy too.

Verification: 61 router tests pass, typecheck clean, wrangler deploy --dry-run bundles with all bindings resolved.