[codex] Audit managed endpoint error context

[juliusmarminge]

Summary

• add structured operation, stage, user, environment, and provider resource context to managed endpoint errors
• preserve immediate database and Cloudflare causes so the full failure chain remains available
• represent malformed provider responses and unresolved allocation reservations structurally without manufacturing causes
• use tagged catch semantics for the managed endpoint client error union and remove the valueless persistence error constructor wrapper
• add focused allocation and provider regression tests

Why

The previous errors collapsed distinct managed endpoint failures into generic messages with only a cause. That made incidents difficult to correlate and, in two structural failure cases, encouraged artificial causes. The new schemas identify the exact failing operation and safe resource context while retaining real underlying failures.

Validation

• vp check (passes with 20 pre-existing warnings outside this scope)
• vp run typecheck
• vp test infra/relay/src/environments/ManagedEndpointProvider.test.ts infra/relay/src/environments/ManagedEndpointAllocations.test.ts (18 tests)

---

Note

Medium Risk
Changes error types and mapping across Cloudflare tunnel/DNS provisioning and DB allocation paths; behavior is mostly observability, but callers or logs that assumed the old minimal error shape could break.

Overview
Relay managed endpoint failures now carry structured fields (operation, pipeline stage, user/environment, and relevant hostname/tunnel/DNS IDs) instead of generic messages with only a wrapped cause.

Allocation persistence maps each DB action to ManagedEndpointAllocationPersistenceError with explicit operation/stage; unresolved reservations use resolve-reservation without inventing a cause, while real DB errors still attach the original failure.

Provisioning/deprovisioning threads the same pattern through ManagedEndpointProvisioningFailed / ManagedEndpointDeprovisioningFailed (per-step stages like ensure-dns-record, delete-tunnel), enriches config/origin/client errors, validates malformed Cloudflare tunnel payloads at validate-tunnel-response, and switches not-found swallowing on delete to tagged catchTags on tunnel/DNS client errors. Focused allocation and provider tests assert the new shapes and cause chaining.

^{Reviewed by Cursor Bugbot for commit ebd3365. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add structured error context to managed endpoint provisioning and allocation errors

• Expands all error classes in ManagedEndpointProvider.ts and ManagedEndpointAllocations.ts to carry operation, stage, and identity fields (userId, environmentId, plus optional resource identifiers).
• All service methods in ManagedEndpointAllocations now emit ManagedEndpointAllocationPersistenceError with explicit operation and stage: 'database-request'; the unresolved-reservation branch emits stage: 'resolve-reservation' without a synthetic cause.
• Provisioning and deprovisioning in ManagedEndpointProvider now wrap each phase with stage-specific errors; malformed tunnel responses are treated as stage: 'validate-tunnel-response' failures without a cause, skipping DNS operations.
• ignoreNotFound is narrowed to tagged client error types and now rethrows the original tagged error when the cause is not a NotFound condition.
• Behavioral Change: error messages now include operation, stage, and identity; cause may be absent on validation failures; isManagedEndpointAllocationPersistenceError helper is removed.

^{Macroscope summarized ebd3365.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 89e9b2c2-e4ea-43a3-8fdb-360fd56c2640

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/audit-managed-endpoint-errors

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[macroscopeapp]

Approvability

Verdict: Approved

This PR enriches error classes with additional context fields (operation, stage, userId, environmentId, etc.) for better debugging and observability. No runtime behavior changes - errors are thrown at the same points with the same causes, just with more diagnostic information attached.

^{You can customize Macroscope's approvability policy. Learn more.}