{"record":{"id":"52dcac48a72a51e0","repo":"different-ai/openwork","slug":"den-returned-an-invalid-egress-diagnostic-result","errorCode":null,"errorMessage":"Den returned an invalid egress diagnostic result.","messagePattern":"Den returned an invalid egress diagnostic result\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ee/apps/den-web/app/(den)/dashboard/_components/egress-diagnostics-card.tsx","lineNumber":146,"sourceCode":"    return () => window.clearTimeout(timeout);\n  }, [copied]);\n\n  async function runDiagnostic() {\n    if (!canManage) {\n      setError(\"Only workspace owners and super-admins can run this diagnostic.\");\n      return;\n    }\n\n    setRunning(true);\n    setError(null);\n    setResult(null);\n    try {\n      const { response, payload } = await requestJson(\"/v1/diagnostics/egress\", { method: \"POST\" }, 90_000);\n      if (!response.ok) {\n        throw new Error(getErrorMessage(payload, `Egress diagnostic could not start (${response.status}).`));\n      }\n      const parsed = egressDiagnosticRunSchema.safeParse(payload);\n      if (!parsed.success) throw new Error(\"Den returned an invalid egress diagnostic result.\");\n      setResult(parsed.data);\n    } catch (runError) {\n      setError(runError instanceof Error ? runError.message : \"Egress diagnostic could not complete.\");\n    } finally {\n      setRunning(false);\n    }\n  }\n\n  async function saveBearerToken() {\n    if (!canManage) {\n      setError(\"Only workspace owners and super-admins can change the diagnostic token.\");\n      return;\n    }\n\n    const bearerToken = bearerTokenDraft.trim();\n    if (bearerToken.length < 24) {\n      setError(\"Enter a diagnostic token with at least 24 characters.\");\n      return;","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-web/app/(den)/dashboard/_components/egress-diagnostics-card.tsx#L128-L164","documentation":"When POST /v1/diagnostics/egress returns 2xx, runDiagnostic validates the body against egressDiagnosticRunSchema with safeParse. A 200 response whose body doesn't match the expected run-result shape throws \"Den returned an invalid egress diagnostic result.\" The catch shows the message via setError; this is a deliberate contract check against malformed server data.","triggerScenarios":"Server returns 200 but the run payload deviates from egressDiagnosticRunSchema: missing result fields, extra/renamed fields from a different Den version, an empty object, or a proxy injecting non-JSON content with a 200 status.","commonSituations":"Dashboard/Den version skew after a partial deploy; a diagnostics worker returning a legacy result format; reverse proxy or security middleware rewriting the response body.","solutions":["Capture the raw 200 payload and diff it against egressDiagnosticRunSchema to find the failing field.","Bring dashboard and Den server to the same version so the run-result schema matches.","Inspect any proxy/middleware between the browser and Den for response rewriting, and bypass it for /v1/* routes.","Re-run the diagnostic after fixing the server; confirm the worker emits the current result format."],"exampleFix":"// before (worker returns legacy shape without per-check results)\n// payload: { ok: true } -> safeParse fails\n\n// after: upgrade Den diagnostics worker to emit the full run schema\n// payload: { startedAt: ..., completedAt: ..., checks: [...] }","handlingStrategy":"type-guard","validationCode":"const plausibleRun = typeof payload === \"object\" && payload !== null;\nif (!plausibleRun) throw new Error(\"Diagnostics run returned an empty body; skipping schema parse.\");","typeGuard":"function looksLikeDiagnosticRun(p: unknown): p is Record<string, unknown> {\n  return typeof p === \"object\" && p !== null && !Array.isArray(p);\n}","tryCatchPattern":"try {\n  await runDiagnostic();\n} catch (e) {\n  if (e instanceof Error && e.message.includes(\"invalid egress diagnostic result\")) {\n    console.error(\"Run-result contract mismatch; capture payload and check Den version.\", e);\n    showError(\"Diagnostic result from Den is unreadable; verify server version.\");\n  } else throw e;\n}","preventionTips":["Log the raw 200 payload whenever safeParse fails to identify drifted fields.","Keep the diagnostics worker and dashboard schema definitions in one shared package.","Bypass/audit any middleware that rewrites response bodies on /v1/* routes.","Add a contract test asserting the worker's output parses with egressDiagnosticRunSchema."],"tags":["schema","zod","validation","api-contract"],"backgroundTag":"schema-validation-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}