fix: CLI rack status, trusted device TTL, approval denial reasons, admin alerts, dead CLI commands

[ndbroadbent]

Summary

• rack-gateway rack ignores --rack and RACK_GATEWAY_RACK #133 rack-gateway rack shows the rack that commands would use: --rack, then RACK_GATEWAY_RACK, then the current rack. Before this, it always showed the config's current rack. RACK_GATEWAY_URL with an API token still takes precedence.
• The web UI always says "30 days" for trusted devices #134 The MFA status response now includes trusted_device_ttl_days. The web UI's "Trust this device/browser" labels show it instead of a hardcoded 30 days, and leave the duration out until it's known.
• A deploy without a valid approval gets a 403 that doesn't say why #136 An API token refused by deploy_with_approval gets a 403 that says why. The reason comes from its own newest request for the app: it has none, or that request is pending, rejected, already deployed, expired, or approved but not for this upload, build, release or command. The token can already read its own requests, so the message reveals nothing new.
• Rate limit alerts only go to the admins who existed at startup #137 Security alerts go to the current unlocked admins, looked up at send time, not to the admins at startup. A failed lookup is logged, and the admin alert is skipped when there are no admins.
• The CLI offers commands the gateway refuses #138 Removes CLI commands the gateway always refuses: resources, certs, registries, instances keyroll, instances terminate and apps cancel. The dead RBAC entries for them are tracked in Remove unused code and a finished migration path #141.

The docs are updated for each change.

Fixes #133, fixes #134, fixes #136, fixes #137, fixes #138

Test plan

• task go:lint, task go:test:unit
• task web:test, task web:lint:typecheck
• docs build (link check)
• CI

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 29 billable files and costs up to $7.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 1 minute for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 61 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f00ee843-73d7-49f2-9e0d-64e7adbc715e

📥 Commits

Reviewing files that changed from the base of the PR and between 7614e42 and d70da8d.

⛔ Files ignored due to path filters (2)

• internal/gateway/openapi/generated/swagger.json is excluded by !**/generated/**
• web/src/api/types.generated.ts is excluded by !**/*.generated.*

📒 Files selected for processing (29)

• docs/src/content/docs/integrations/deploy-approvals/workflow.mdx
• docs/src/content/docs/integrations/email.mdx
• docs/src/content/docs/security/rbac/permissions.mdx
• docs/src/content/docs/user-guide/cli/commands.mdx
• docs/src/content/docs/user-guide/cli/multi-rack.mdx
• docs/src/content/docs/user-guide/mfa/trusted-devices.mdx
• internal/cli/cli_rack.go
• internal/cli/cli_test.go
• internal/cli/convox_apps.go
• internal/cli/convox_logs.go
• internal/cli/convox_resources.go
• internal/cli/rack.go
• internal/cli/root.go
• internal/gateway/app/setup.go
• internal/gateway/handlers/auth_mfa_management.go
• internal/gateway/handlers/dto.go
• internal/gateway/proxy/approval_denial.go
• internal/gateway/proxy/approval_denial_test.go
• internal/gateway/proxy/token_permissions.go
• internal/gateway/security/notifier.go
• internal/gateway/security/notifier_test.go
• web/src/api/openapi.json
• web/src/api/schemas/handlersMFAStatusResponse.ts
• web/src/components/account-security/enrollment-dialog.tsx
• web/src/components/mfa-verification-form.test.tsx
• web/src/components/mfa-verification-form.tsx
• web/src/components/mfa-verification-form/form-sections.tsx
• web/src/lib/time.test.ts
• web/src/lib/time.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 7614e42...d70da8d on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 13, 2026 2:08a.m.	Review ↗
Go		Oct 13, 2026 2:08a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.