Skip to content

Add staged connection diagnosis for opaque dial failures#1114

Draft
rossnelson wants to merge 4 commits into
mainfrom
connection-error-diagnosis
Draft

Add staged connection diagnosis for opaque dial failures#1114
rossnelson wants to merge 4 commits into
mainfrom
connection-error-diagnosis

Conversation

@rossnelson

@rossnelson rossnelson commented Jul 8, 2026

Copy link
Copy Markdown

Related issues

Related to #224 and #851.

What changed?

This PR diagnoses opaque Temporal server dial failures in stages. Users see where a connection failed and get a concrete next step without changing the original command error.

After a dial fails, the CLI probes DNS, TCP, and TLS. These probes use the remaining command context with a separate three-second cap. TEMPORAL_CLI_DISABLE_CONNECT_DIAGNOSIS disables them.

The diagnostic error carries allowlisted semantic facts instead of raw arguments or construction-time color state. It preserves native errors through unwrapping.

A single parent terminal boundary builds controlled reports and redacts exact secret values known to the runtime. It performs one checked stderr write. Existing stdout, exit-status, and extension ownership remain intact.

Suggested commands use long flags with POSIX or PowerShell-safe quoting. Standalone Activity NotFound handling proves a second structured error path.

The scope stays internal. This PR does not add a JSON error schema, a public status taxonomy, or public connection provenance in cliext.

connection-error-diagnosis

Checklist

Stability

  • Breaking changes are marked with 💥 in the PR title and release notes
  • Changes to JSON output (-o json / -o jsonl) are treated as breaking changes

Design

  • This feature does not depend on Cloud-only APIs or behavior (it works against an OSS server)
  • New commands follow temporal <noun> <verb> structure (e.g. temporal workflow start)
  • New flags are named after the API concept, not the implementation mechanism (good: --search-attribute, bad: --index-field)
  • New flags don't duplicate an existing flag that serves the same purpose
  • New flags do not have short aliases without strong justification
  • Experimental features are marked with (Experimental) in commands.yaml

Help text (see style guide at the top of commands.yaml)

  • All flags shown in help text and examples are implemented and functional
  • Summaries use sentence case and have no trailing period
  • Long descriptions end with a period and include at least one example invocation
  • Examples use long flags (--namespace, not -n), one flag per line
  • Placeholder values use YourXxx form (YourWorkflowId, YourNamespace)

Behavior

  • Results go to stdout; errors and warnings go to stderr
  • Error messages are lowercase with no trailing punctuation

Tests

  • Added functional test(s) (SharedServerSuite)
  • Added unit test(s) (func TestXxx) where applicable

Manual tests

Setup

No manual setup was used.

Happy path

Not rerun manually. Automated verification passed:

go test ./... -count=1 -timeout=10m

Error case

Not rerun manually. Targeted connection and terminal tests passed.

The standalone cliext mismatch predates this branch. It is outside the full-suite command above.

Composition

Not rerun manually.

What to look at first

  • The terminal boundary separates original command errors from presentation failures while preserving output and status ownership.
  • The probe policy runs only after a failed dial, shares command cancellation, has a three-second cap, and has a kill switch.
  • The report boundary admits semantic facts, applies exact-known-secret redaction, and renders typed suggestions for the active shell.
  • The public surface intentionally excludes JSON error schemas, status taxonomies, and cliext provenance.

Connection failures now render a classified error with an inline
DNS/TCP/TLS diagnosis and one suggested fix, instead of a bare
'context deadline exceeded' or an empty message.

Fixes #224
Fixes #851
@CLAassistant

CLAassistant commented Jul 8, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Covers classifyGRPCError, connectSummary's grep-compatibility contract,
and an end-to-end case where the failing address comes from a config
profile (exercising the new cliext builder metadata).
- errors.Is(err, syscall.ECONNREFUSED) doesn't match Windows'
  WSAECONNREFUSED; fall back to matching the error message.
- The plaintext test server closed with the client's ClientHello unread,
  sending an RST that on Windows discards the buffered HTTP response
  before the probe reads it; drain before closing.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants