{"record":{"id":"86ef9805edb10c67","repo":"different-ai/openwork","slug":"the-den-container-could-not-complete-the-outbound","errorCode":null,"errorMessage":"The Den container could not complete the outbound connection.","messagePattern":"The Den container could not complete the outbound connection\\.","errorType":"error_code","errorClass":"DiagnosticFailure","httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/egress-diagnostics.ts","lineNumber":287,"sourceCode":"  category: EgressDiagnosticCategory\n  evidence: StepEvidence\n  expectedStatuses: readonly number[]\n  fetchImpl: DiagnosticFetch\n  init?: RequestInit\n  runId: string\n  step: string\n  timeoutMs: number\n  url: string\n}): Promise<Response> {\n  let response: Response\n  try {\n    response = await input.fetchImpl(input.url, {\n      ...input.init,\n      headers: requestHeaders(input.runId, input.step, input.init?.headers),\n      signal: input.init?.signal ?? AbortSignal.timeout(input.timeoutMs),\n    })\n  } catch (error) {\n    throw networkFailure(error)\n  }\n  input.evidence.httpStatuses.push(response.status)\n  const diagnosticId = response.headers.get(EGRESS_DIAGNOSTIC_ID_HEADER) ?? \"\"\n  if (diagnosticIdPattern.test(diagnosticId)) input.evidence.diagnosticIds.push(diagnosticId)\n  if (!input.expectedStatuses.includes(response.status)) throw httpFailure(response.status, input.category)\n  if (!diagnosticIdPattern.test(diagnosticId)) {\n    throw new DiagnosticFailure({\n      action: \"Ask the network administrator to inspect whether a proxy, gateway, or service mesh replaced the response or removed x-openwork-diagnostic-id.\",\n      category: input.category,\n      code: \"diagnostic_reference_missing\",\n      message: \"A response arrived, but it did not contain proof that it came from the Diagnostics application.\",\n      owner: \"network-administrator\",\n    })\n  }\n  return response\n}\n\nfunction protocolFailure(category: EgressDiagnosticCategory, code: string, message: string): DiagnosticFailure {","sourceCodeStart":269,"sourceCodeEnd":305,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/egress-diagnostics.ts#L269-L305","documentation":"sendRequest in egress-diagnostics.ts issues the synthetic outbound diagnostic request from the Den container via fetchImpl. If fetch throws (connection refused/reset, DNS failure, TLS error, timeout), networkFailure maps the underlying cause code (ENOTFOUND, CERT/SSL, ABORT_ERR, ETIMEDOUT, etc.) to a DiagnosticFailure; the generic fallback message 'The Den container could not complete the outbound connection.' is used when no known cause code is found. This is a connectivity-category failure owned by the network administrator.","triggerScenarios":"Running an egress diagnostic (runEgressDiagnostic and its first/second/protectedResponse/tasks variants) when the outbound fetch itself throws before an HTTP status is received — connection refused, reset, TLS handshake failure, timeout, or unresolvable hostname with no recognized cause code.","commonSituations":"Den container with no egress route; NetworkPolicy or service mesh blocking outbound traffic; misconfigured proxy env vars; connection reset by an inspection firewall that doesn't map to a standard errno; wrong diagnostic endpoint URL.","solutions":["Ask the network administrator to inspect Den container egress rules, proxy configuration, service-mesh policy, and connection resets (per the error's action).","Verify the diagnostic endpoint hostname/URL configured for the egress diagnostic is correct.","Check proxy env vars (HTTP_PROXY/HTTPS_PROXY/NO_PROXY) are set correctly for the Den runtime.","Retry the diagnostic — transient resets may pass; persistent failure indicates a real network block.","Run the specific typed diagnostics (DNS/TLS variants) to narrow whether it is name resolution, TLS, or routing."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: resolve and TCP-connect before running the diagnostic\nconst addr = await dns.promises.lookup(diagnosticHost).catch(() => null)\nif (!addr) throw new Error('diagnostic hostname unresolvable from Den container')","typeGuard":"function isEgressDiagnosticFailure(e: unknown): e is { category: 'connectivity'; code: string } {\n  return typeof e === 'object' && e !== null && (e as { category?: string }).category === 'connectivity'\n}","tryCatchPattern":"try {\n  result = await sendRequest(input)\n} catch (error) {\n  if (isEgressDiagnosticFailure(error)) {\n    const code = error.code // fetch_failed | ENOTFOUND | ABORT_ERR | CERT_* ...\n    if (code === 'ABORT_ERR' || code === 'ETIMEDOUT') retryWithBackoff()\n    else escalateToNetworkAdmin(code)\n  } else throw error\n}","preventionTips":["Verify container egress rules and proxy env vars before deploying Den.","Point diagnostics at a stable, correctly spelled hostname.","Set sane timeouts so failures map to typed codes (ABORT_ERR/ETIMEDOUT).","Run DNS/TLS-typed diagnostics first to narrow the failure layer."],"tags":["network","egress","connectivity","diagnostics"],"backgroundTag":"outbound-connection-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}