fix(cli): tolerate denied endpoint experiment access

[cursor]

Summary

• keep tg beta endpoints retrieve working when access proxies allow the endpoint but deny optional A/B and shadow experiment subresources
• return empty ab and shadows collections in JSON output when those optional requests are forbidden
• add regression coverage for the observed 403 response

Tests

• pytest tests/cli/test_beta_endpoints_retrieve.py tests/cli/test_beta_endpoints_rm.py tests/cli/test_beta_endpoints_ab.py tests/cli/test_beta_endpoints_shadow.py -q -n 0 (41 passed)
• ruff check and ruff format --check on changed files
• pyright on changed files

  

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · GH Actions (zizmor) · Containers · SBOM · Powered by Together AI

[blainekasten]

@cursoragent what prompted this change? I'm not sure I understand the error that this is fixing

[cursor]

Short answer: Amplitude cli_command_failed telemetry, not a hand-filed bug.

Your Ingest CLI Errors automation picked up ~8 failures of endpoints retrieve (CLI 2.27.1) with:

403 - Endpoint access requires a canonical endpoint API path
blocked_by: eval_proxy_endpoint_path_guard
path: .../endpoints/.../abExperiments

retrieve fan-outs 3 GETs: endpoint + abExperiments + shadowExperiments. The proxy allows the canonical endpoint path but 403s the experiment subpaths, so optional enrichment killed the whole command.

Fix: swallow PermissionDeniedError on those optional lists → return ab: [] / shadows: [] and still print the endpoint.

Replied on the PR with the same detail.

  

[cursor]

Prompted by the Ingest CLI Errors and attempt to fix them automation (cli_command_failed Amplitude events), not a hand-filed bug.

What was failing

tg beta endpoints retrieve <ep_...> --json (CLI 2.27.1) was dying with:

Error code: 403 - {
  'error': 'Endpoint access requires a canonical endpoint API path',
  'blocked_by': 'eval_proxy_endpoint_path_guard',
  'method': 'GET',
  'path': '/v2/projects/.../endpoints/.../abExperiments'
}

Seen ~8 times in the last-day export.

Why retrieve blew up

endpoints retrieve fan-outs 3 calls in parallel:

1. GET .../endpoints/{id} (the actual retrieve)
2. GET .../endpoints/{id}/abExperiments (optional enrichment)
3. GET .../endpoints/{id}/shadowExperiments (optional enrichment)

eval_proxy_endpoint_path_guard allows the canonical endpoint path, but 403s the experiment subpaths. Because those optional calls weren’t tolerated, the whole command failed even when the endpoint itself was readable.

Fix

Catch PermissionDeniedError on the ab/shadow list calls and return [], so retrieve still succeeds with empty ab / shadows.

Original agent run: https://cursor.com/agents/bc-4f07af68-1eb6-46e4-9a25-a3a5c555e1e6