KnoxIQ CLI Changes by Phonx38 · Pull Request #69 · appknox/appknox-go

Phonx38 · 2026-08-17T05:24:18Z

Title	Value
Type	Feature / Bugfix
Ticket/Issue	PD-2353
Migrations	No
Migration Scripts	No
ENV vars change	Yes — `APPKNOX_KNOXIQ_TIMEOUT` (KnoxIQ triage timeout), `APPKNOX_INCLUDE_NEEDS_REVIEW` (needs-review inclusion)
Frontend	No
Local testing	Done
Staging testing	Done — verified end-to-end against `sherlock-knoxiq-uat`
On premise notes	Falls back to plain SAST behavior on 403/404 from `knoxiq_scan/status`, so older/non-KnoxIQ backends are unaffected
Documentation	None
Release notes	None
Version upgrade	Minor

Changelog

Add --knoxiq flag to upload to request KnoxIQ triage for a specific CI/CD build
```
appknox upload app.apk --knoxiq
```
Add KnoxIQ awareness to cicheck: intermediary → triage status → final triaged results, with AEIS score and exploit likelihood columns
Add --exploit-likelihood-threshold low|medium|high to cicheck to gate builds on KnoxIQ exploit likelihood
Add --include-needs-review flag and config get/set include-needs-review to control whether KnoxIQ needs-review vulnerabilities count toward the build decision (default: excluded)
Add shared --knoxiq-timeout (default 30 min), combined with the static-scan timeout into one budget so unused SAST time carries over to KnoxIQ; shared consistently across cicheck, sarif, and reports knoxiq
Add reports knoxiq <file_id> to generate and download the KnoxIQ PDF report in one step; fails explicitly if the file has no KnoxIQ results instead of falling back to a standard report
Bring sarif to parity with cicheck: shares the same timeout budget and availability check, excludes needs-review by default, adds aeisScore/exploitLikelihood result properties
Fix: likelihood-only gating on a file with no KnoxIQ triage used to silently pass with zero active gates; now falls back to the default risk gate and prints an explicit "Active gates:" line
Fix: reports knoxiq printed its fail-fast error but exited 0 instead of 1
Fix: config file path resolution on Windows — viper's $HOME expansion silently broke on Windows path separators, causing config set/init to fail with "Config File Not Found"
Remove File.IsKnoxIQAutomated/KnoxIQStatus fields and GetByIDV3 (superseded by the new knoxiq_scan/status and cicd/analyses endpoints)

Dependent PRs

mycroft PD-2352 — backend endpoints/fields this CLI work depends on (cicd/analyses, per-build knoxiq_requested, is_knoxiq on reports)

…command

…rediction

…ive gate

…eeding

utkarshpandey12 · 2026-08-23T13:22:09Z

+	if err != nil {
+		if strings.Contains(err.Error(), "404") {
+			fileId := strconv.Itoa(fileID)
+			return nil, nil, errors.New("KnoxIQ CI/CD analyses for fileID " + fileId + " not found (404)")


use fmt.Errorf

utkarshpandey12 · 2026-08-23T13:26:37Z

+Supported keys:
+  include-needs-review   Include KnoxIQ "needs review" vulnerabilities in the
+                         CI check results and build decision (default: false).`,
+}


update README.md for all changes done

…HOME expansion

sonarqubecloud · 2026-08-25T06:08:49Z

Quality Gate passed

Issues
6 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud

utkarshpandey12 · 2026-08-25T08:26:51Z

+	var drfResponse DRFResponseKnoxIQCICDAnalysis
+	_, err = s.client.Do(ctx, req, &drfResponse)
+	if err != nil {
+		if strings.Contains(err.Error(), "404") {


read the response code (StatusCodeOf

utkarshpandey12 · 2026-08-25T08:30:45Z

+) (enums.KnoxIQScanStatusType, bool) {
+	scanStatus, _, err := client.KnoxIQ.GetScanStatus(ctx, fileID)
+	if err != nil {
+		switch appknox.StatusCodeOf(err) {


-switch statusCode { -case 403, 404: -default: - PrintError(err) -} -return disabled, false +if statusCode == 403 || statusCode == 404 { + return disabled, false +} +PrintError(err)

utkarshpandey12 · 2026-08-25T09:26:44Z


 func init() {
 	RootCmd.AddCommand(sarifCmd)
 	sarifCmd.Flags().StringP(


can we add something like --no-knoxiq to skips the KnoxIQ wait entirely and produces the plain report immediately

utkarshpandey12 · 2026-08-25T18:11:21Z

-		os.Create(file)
+		return
+	}
+


consider adding below to provide more context about read failures , if it makes sense

+if _, statErr := os.Stat(configFile); statErr == nil { + fmt.Println("Warning: config file exists but could not be read; recreating it.") +}

utkarshpandey12 · 2026-08-25T18:23:33Z

+			os.Exit(1)
+		}
+		viper.Set(key, value)
+		if err := viper.WriteConfig(); err != nil {


consider below

-viper.Set(key, value) -if err := viper.WriteConfig(); err != nil { +if err := setOnlyThisKey(key, value); err != nil { // patches just `key` in the file on disk

utkarshpandey12 · 2026-08-25T18:31:00Z

+	Short: "Print the current value of a configuration key.",
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		fmt.Println(viper.GetString(args[0]))


+ key := args[0] + if !isKnownConfigKey(key) { + helper.PrintError(fmt.Errorf( + "unknown config key %q. Supported keys: %s", + key, strings.Join(knownConfigKeys, ", "), + )) + os.Exit(1) + } - fmt.Println(viper.GetString(args[0])) + fmt.Println(viper.GetString(key)) }, }

consider adding restrictions for get cmd as well

utkarshpandey12 · 2026-08-25T18:43:44Z

+			))
+			os.Exit(1)
+		}
+		viper.Set(key, value)


config set saves a value without validating it so a include-needs-review Yes is accepted but checks strictly compares like if settings["include_needs_review"] == "true":

utkarshpandey12 · 2026-08-25T18:51:16Z

+		PrintError("exploit-likelihood gating requires KnoxIQ triage — skipping (no KnoxIQ results for this file)")
+		return 0
+	}
+	if !waitForKnoxIQ(ctx, client, fileID, policy.Budget.KnoxIQDeadline()) {


the above check can be used as a short circuit for next wait call , less probability but still can be helpful if ci is run for some file where it already exists or has been evaluated at the first call itself

-func countLikelihoodOffenders(ctx context.Context, client *appknox.Client, fileID int, policy CiPolicy) int { - if _, available := knoxIQAvailable(ctx, client, fileID); !available { +func countLikelihoodOffenders(ctx context.Context, client *appknox.Client, fileID int, policy CiPolicy) int { + status, available := knoxIQAvailable(ctx, client, fileID) + if !available { ... - if !waitForKnoxIQ(ctx, client, fileID, policy.Budget.KnoxIQDeadline()) { + if status != enums.KnoxIQStatusCompleted && !waitForKnoxIQ(ctx, client, fileID, policy.Budget.KnoxIQDeadline()) {

utkarshpandey12 · 2026-08-25T19:02:49Z

+	t.Print()
+}
+
+func reportKnoxIQGate(fileID int, policy CiPolicy, triaged []*appknox.KnoxIQCICDAnalysis) {


write a test that calls the existing reportKnoxIQGate with one made-up finding that has: highest risk level (Critical), highest likelihood level (High), and NeedsReview = true — set the risk and likelihood thresholds so that a normal finding with this severity would fail the build — and checks that the build does not fail (no offending count, no exit) precisely because that one finding is marked "needs review."

utkarshpandey12 · 2026-08-25T19:12:07Z

+// 403 (org without the KnoxIQ feature) and 404 (backend without the KnoxIQ
+// endpoints) both mean "not available", so the CLI silently falls back to the
+// plain SAST flow. Anything else is surfaced before falling back.
+func knoxIQAvailable(


consider adding tests
func TestKnoxIQAvailable_404IsQuiet(t testing.T) { / 404 -> false, nothing printed */ }
func TestKnoxIQAvailable_ServerErrorIsLoud(t testing.T) { / 500 -> false, error printed */ }
func TestKnoxIQAvailable_TrueWhenInProgressOrDone(t testing.T) { / pending/running/completed -> true */ }

utkarshpandey12 · 2026-08-25T19:15:33Z

+			enums.KnoxIQStatusLegacy:
+			return false
+		}
+		if time.Now().After(deadline) {


consider adding test case
TestWaitForKnoxIQ_DeadlinePassed

utkarshpandey12

requested changes

Phonx38 added 9 commits July 20, 2026 21:19

feat: add KnoxIQ-aware cicheck flow and config command

4b17173

feat: add exploit-likelihood gate, KnoxIQ timeout, and knoxiq report …

6e7c202

…command

feat: share one timeout budget between static scan and KnoxIQ waits

92903dc

feat: gate KnoxIQ CI/CD flow on triage availability, not automation p…

599bdf4

…rediction

fix: prevent likelihood-only gating from silently passing with no act…

b5900d9

…ive gate

feat: add --knoxiq flag to upload for per-build KnoxIQ triage

2837053

feat: bring SARIF to parity with cicheck's KnoxIQ triage handling

29df5ee

fix: mark likelihood gate inactive in active-gates line when unevaluated

61f789d

fix: exit non-zero when reports knoxiq fails instead of silently succ…

1b17c3a

…eeding

Phonx38 requested a review from utkarshpandey12 August 17, 2026 05:24

utkarshpandey12 reviewed Aug 23, 2026

View reviewed changes

fix: resolve config file path via os.UserHomeDir instead of viper's $…

b80bd1a

…HOME expansion

utkarshpandey12 reviewed Aug 25, 2026

View reviewed changes

utkarshpandey12 requested changes Aug 25, 2026

View reviewed changes

Uh oh!

Conversation

Phonx38 commented Aug 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changelog

Dependent PRs

Uh oh!

Choose a reason for hiding this comment

Uh oh!

utkarshpandey12 Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud Bot commented Aug 25, 2026

Quality Gate passed

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

utkarshpandey12 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Phonx38 commented Aug 17, 2026 •

edited

Loading

utkarshpandey12 Aug 23, 2026 •

edited

Loading