{"record":{"id":"9dc370b80947c315","repo":"different-ai/openwork","slug":"http-status","errorCode":"http_${status}","errorMessage":"The diagnostic request returned unexpected HTTP ${status}.","messagePattern":"The diagnostic request returned unexpected HTTP (.+?)\\.","errorType":"error_code","errorClass":"DiagnosticFailure","httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/egress-diagnostics.ts","lineNumber":292,"sourceCode":"  runId: string\n  step: string\n  timeoutMs: number\n  url: string\n}): Promise<Response> {\n  let response: Response\n  try {\n    response = await input.fetchImpl(input.url, {\n      ...input.init,\n      headers: requestHeaders(input.runId, input.step, input.init?.headers),\n      signal: input.init?.signal ?? AbortSignal.timeout(input.timeoutMs),\n    })\n  } catch (error) {\n    throw networkFailure(error)\n  }\n  input.evidence.httpStatuses.push(response.status)\n  const diagnosticId = response.headers.get(EGRESS_DIAGNOSTIC_ID_HEADER) ?? \"\"\n  if (diagnosticIdPattern.test(diagnosticId)) input.evidence.diagnosticIds.push(diagnosticId)\n  if (!input.expectedStatuses.includes(response.status)) throw httpFailure(response.status, input.category)\n  if (!diagnosticIdPattern.test(diagnosticId)) {\n    throw new DiagnosticFailure({\n      action: \"Ask the network administrator to inspect whether a proxy, gateway, or service mesh replaced the response or removed x-openwork-diagnostic-id.\",\n      category: input.category,\n      code: \"diagnostic_reference_missing\",\n      message: \"A response arrived, but it did not contain proof that it came from the Diagnostics application.\",\n      owner: \"network-administrator\",\n    })\n  }\n  return response\n}\n\nfunction protocolFailure(category: EgressDiagnosticCategory, code: string, message: string): DiagnosticFailure {\n  return new DiagnosticFailure({\n    action: \"Give OpenWork support the run ID and diagnostic reference so the response contract can be compared with the remote trace.\",\n    category,\n    code,\n    message,","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/egress-diagnostics.ts#L274-L310","documentation":"sendRequest in egress-diagnostics.ts records the HTTP status and checks it against input.expectedStatuses; if the status is unexpected, httpFailure produces a DiagnosticFailure with code http_${status} and a message embedding that status. This means the connection succeeded but the Diagnostics endpoint (or an intermediary) answered with an HTTP status the diagnostic flow did not anticipate.","triggerScenarios":"An egress diagnostic request where the response status is not in expectedStatuses — e.g. Diagnostics answers 401/403 because the synthetic token mismatches, 407 from an authenticating proxy, 404/502 from a wrong or broken endpoint, or 5xx from a crashed Diagnostics deployment.","commonSituations":"Den and Diagnostics deployed with different synthetic diagnostic tokens; a corporate proxy stripping the Authorization header or demanding proxy auth (407); ingress routing the diagnostic path to the wrong service; Diagnostics pod crashing under load.","solutions":["For http_401/403: verify Den and the Diagnostics deployment share the same synthetic diagnostic token and that the proxy forwards Authorization headers.","For http_407: configure proxy credentials for the Den runtime and confirm Node outbound requests use the approved proxy path.","For 404/502/5xx: check the Diagnostics deployment health, its ingress/routing, and that the diagnostic URL matches the deployed service.","Compare the recorded status in evidence.httpStatuses with expectedStatuses to identify what answered."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify token parity before sending\nif (denDiagnosticToken !== diagnosticsDeploymentToken) {\n  throw new Error('synthetic diagnostic token mismatch between Den and Diagnostics')\n}","typeGuard":"function isHttpDiagnosticFailure(e: unknown): e is { code: `http_${number}`; status: number } {\n  return typeof e === 'object' && e !== null && /^http_\\d+$/.test(String((e as { code?: string }).code ?? ''))\n}","tryCatchPattern":"try {\n  result = await sendRequest(input)\n} catch (error) {\n  if (isHttpDiagnosticFailure(error)) {\n    if (error.status === 401 || error.status === 403) checkSyntheticToken()\n    else if (error.status === 407) configureProxyCredentials()\n    else checkDiagnosticsDeploymentHealth()\n  } else throw error\n}","preventionTips":["Deploy Den and Diagnostics with the same synthetic diagnostic token.","Ensure proxies forward the Authorization header untouched.","Pre-authenticate the Den runtime with the corporate proxy (avoid 407).","Monitor Diagnostics deployment health and ingress routing."],"tags":["network","http","egress","diagnostics"],"backgroundTag":"unexpected-http-status","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}