fix(apollo): classify proxy_execute caller/upstream errors correctly (400/502 instead of 500)

@zen-agentchecks n/achecks…zen/proxy-error-classify-to06ck → master2 files · +142 −15review: @rohanprabhureview: @sarthakreview: @acsrujanreview: @lingalarahul7review: @anshugarg15updated 3w ago

GitHub

▸Description· 1 comment · 6 noise

Description

handleProxyRequestError in apps/apollo/src/lib/connected_accounts/executeProxy/utils.ts falls through to 500 for several classes of error that should be 400 or 502. The bad classifications pollute Apollo's error dashboards (false 5xx alerts) and return misleading status codes to agent clients, who infer retry strategy from the response code.

Three patterns recur in production on /api/v3/tool_router/internal/proxy_execute (samples from Datadog apollo-logs, last 7 days):

Symptom	Today	Should be
`TypeError: Request cannot be constructed from a URL that includes credentials: …` (caller pasted `user:pass@host`)	500 `ExternalProxy_InternalServerError`	400 `ExternalProxy_InvalidProxyURL`
`Error: SSRF protection: too many redirects (max 10)` / `invalid redirect URL` / `redirect blocked` (thrown from `ssrfSafeFetch`)	500	400 `ExternalProxy_SSRFBlocked` (parity with sibling SSRF errors)
`TypeError: init["status"] must be in the range of 200 to 599, inclusive.` (upstream returned status outside the WHATWG range, undici rejects when constructing the Response)	500	502 `ExternalProxy_ConnectionError`

Also walks the error.cause chain so wrapped undici TypeErrors classify on the underlying reason. Undici surfaces low-level failures as TypeError: fetch failed with the real cause (ENOTFOUND, cert mismatch, etc.) on .cause — the existing error.message.includes('ENOTFOUND') check never matches in production because the surface message is just "fetch failed". After this change, wrapped ENOTFOUND classifies as 400 (matching the existing test expectations); cert-mismatch errors still classify as 502 (they're network-level, not URL-input).

Sample production request_ids the fix addresses:

credentialed URL: 77bb45b1-4a7b-4b6f-ba34-11b46ce88b31
too many redirects: 96f45d12-7cfd-4dd8-901f-77605d1361fc (heyreach), mcp_9fe71fe6-f3e (odoo)
init["status"]: 42d23754-3834-4abb-b26f-3ca4fb5daaf9 (linkedin), 9ca463fb-b732-41a3-9b2d-43b40a0b1e41 (linkedin)

How did I test this PR

Reproduced both fetch-throwing shapes against Node's native fetch to confirm the actual error.message / error.cause.message / error.cause.code undici emits (so the new branches match real production traces, not invented ones).
Extended apps/apollo/src/lib/connected_accounts/executeProxy/utils.test.ts with 7 new unit cases covering: URL-with-credentials → 400, SSRF too-many-redirects / invalid-redirect / blocked-redirect → 400, init["status"] out-of-range → 502, ENOTFOUND wrapped in TypeError("fetch failed") via .cause → 400, cert-mismatch wrapped via .cause → still 502 (unchanged). All 30 tests pass — no existing assertions changed.
```
cd apps/apollo && doppler run -- pnpm with-env vitest run src/lib/connected_accounts/executeProxy/utils.test.ts
Test Files  1 passed (1)
Tests       30 passed (30)
```
pnpm lint and pnpm check-types clean on the changed files.
End-to-end against local Apollo: created a tool-router session, posted to /api/v3/tool_router/session/{id}/proxy_execute with endpoint: https://user:pass@api.github.com/user. Before fix: 500 ExternalProxy_InternalServerError. After fix: 400 ExternalProxy_InvalidProxyURL with the new helpful message (URLs must not include embedded credentials. Pass the token via the Authorization header or connected account instead.).

Origin: cron-421b7142b719 / zen-cron-2bbf04796e4f Triggered by: dhawal@composio.dev | Source: unknown Session: https://zen-api-production-4c98.up.railway.app/dashboard/#/chat/zen-cron-2bbf04796e4f

@zen-agent3w ago

Status — post-PR pipeline complete

Build checks (/build-checks, apollo profile): ✅
- pnpm lint: pass (one pre-existing unrelated warning in composio_actions/utils/schemas.ts:1178, not in this diff)
- pnpm format:check: pass
- pnpm check-types: pass
Codex review (/codex-review-loop): ✅ no high or medium-confidence findings. Reviewer specifically validated message-match precision, order of checks, cause-chain walk soundness (Set cycle guard), and behavior-change risk (only reclassification is wrapped ENOTFOUND → 400; cert mismatches and EAI_AGAIN stay 502).
CI (ci_status.py): ✅ all 30 checks passed in 130s — full Apollo core platform suite (action-recipe-trigger, slack-webhook-trigger, connected-accounts, platform-mcp, version-resolution, webhook-trigger, polling-trigger), Thermos unit + integration tests, vitest unit / e2e / self-hosted, lint, type checks, CodeQL.
Tests: unit (30 passing, 7 new), E2E (credentialed-URL path returns 400 instead of 500 against local Apollo). Codecov: all modified/coverable lines covered.
Review comments: none (only bot-generated comments — Vercel, codecov, reviewer-suggester, test-result summaries).

Ready for merge.

▸ 6 bot/status comments hidden

@vercel[bot]3w ago

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
apollo	Ready	Preview, Comment	May 20, 2026 12:19am

Project	Deployment	Actions	Updated (UTC)
debby	Skipped		May 20, 2026 12:19am

@github-actions[bot]3w ago

🔍 Suggested Reviewers

Based on git blame analysis of 2 file(s):

Contributor	Contribution	Files
Zen	66%	2
Himanshu Dixit	34%

loading diff…

Description

Three patterns recur in production on /api/v3/tool_router/internal/proxy_execute (samples from Datadog apollo-logs, last 7 days):

Symptom

Today

Should be

TypeError: Request cannot be constructed from a URL that includes credentials: … (caller pasted user:pass@host)

500 ExternalProxy_InternalServerError

400 ExternalProxy_InvalidProxyURL

Error: SSRF protection: too many redirects (max 10) / invalid redirect URL / redirect blocked (thrown from ssrfSafeFetch)

500

400 ExternalProxy_SSRFBlocked (parity with sibling SSRF errors)

TypeError: init["status"] must be in the range of 200 to 599, inclusive. (upstream returned status outside the WHATWG range, undici rejects when constructing the Response)

500

502 ExternalProxy_ConnectionError

Sample production request_ids the fix addresses:

credentialed URL: 77bb45b1-4a7b-4b6f-ba34-11b46ce88b31

too many redirects: 96f45d12-7cfd-4dd8-901f-77605d1361fc (heyreach), mcp_9fe71fe6-f3e (odoo)

init["status"]: 42d23754-3834-4abb-b26f-3ca4fb5daaf9 (linkedin), 9ca463fb-b732-41a3-9b2d-43b40a0b1e41 (linkedin)

How did I test this PR

Reproduced both fetch-throwing shapes against Node's native fetch to confirm the actual error.message / error.cause.message / error.cause.code undici emits (so the new branches match real production traces, not invented ones).

Extended apps/apollo/src/lib/connected_accounts/executeProxy/utils.test.ts with 7 new unit cases covering: URL-with-credentials → 400, SSRF too-many-redirects / invalid-redirect / blocked-redirect → 400, init["status"] out-of-range → 502, ENOTFOUND wrapped in TypeError("fetch failed") via .cause → 400, cert-mismatch wrapped via .cause → still 502 (unchanged). All 30 tests pass — no existing assertions changed.

cd apps/apollo && doppler run -- pnpm with-env vitest run src/lib/connected_accounts/executeProxy/utils.test.ts
Test Files  1 passed (1)
Tests       30 passed (30)

pnpm lint and pnpm check-types clean on the changed files.

End-to-end against local Apollo: created a tool-router session, posted to /api/v3/tool_router/session/{id}/proxy_execute with endpoint: https://user:pass@api.github.com/user. Before fix: 500 ExternalProxy_InternalServerError. After fix: 400 ExternalProxy_InvalidProxyURL with the new helpful message (URLs must not include embedded credentials. Pass the token via the Authorization header or connected account instead.).

Status — post-PR pipeline complete

Build checks (/build-checks, apollo profile): ✅

pnpm lint: pass (one pre-existing unrelated warning in composio_actions/utils/schemas.ts:1178, not in this diff)
pnpm format:check: pass
pnpm check-types: pass

Codex review (/codex-review-loop): ✅ no high or medium-confidence findings. Reviewer specifically validated message-match precision, order of checks, cause-chain walk soundness (Set cycle guard), and behavior-change risk (only reclassification is wrapped ENOTFOUND → 400; cert mismatches and EAI_AGAIN stay 502).

CI (ci_status.py): ✅ all 30 checks passed in 130s — full Apollo core platform suite (action-recipe-trigger, slack-webhook-trigger, connected-accounts, platform-mcp, version-resolution, webhook-trigger, polling-trigger), Thermos unit + integration tests, vitest unit / e2e / self-hosted, lint, type checks, CodeQL.

Tests: unit (30 passing, 7 new), E2E (credentialed-URL path returns 400 instead of 500 against local Apollo). Codecov: all modified/coverable lines covered.

Review comments: none (only bot-generated comments — Vercel, codecov, reviewer-suggester, test-result summaries).

Ready for merge.

Project

Deployment

Actions

Updated (UTC)

apollo

Ready

Preview, Comment

May 20, 2026 12:19am

Project

Deployment

Actions

Updated (UTC)

debby

Skipped

May 20, 2026 12:19am

Contributor

Contribution

Files

Zen

66%

Himanshu Dixit

34%

Flag	Coverage Δ
e2e-tests	`6.04% <0.00%> (-0.01%)`	:arrow_down:
self-hosted-tests	`5.58% <0.00%> (-0.01%)`	:arrow_down:
thermos-unit-tests	`?`
unit-tests	`58.94% <100.00%> (+0.01%)`	:arrow_up:

fix(apollo): classify proxy_execute caller/upstream errors correctly (400/502 instead of 500)

Description

How did I test this PR

Status — post-PR pipeline complete

🔍 Suggested Reviewers

Description

How did I test this PR

Status — post-PR pipeline complete

🔍 Suggested Reviewers

💡 Recommendation

🧪 Test Results Summary (Self-Hosted Tests)

Codecov Report

🧪 Test Results Summary (Unit Tests)

🧪 Test Results Summary (E2E Tests)