fix: avoid firewall blocked false positives (#1223)

Author: massif-01

src/services/system_config_service.py

@@ -2593,6 +2593,13 @@ def _classify_llm_http_error(status_code: int, error_text: str) -> _LLMDiagnosti
                 "LLM request was rejected by quota or rate limiting",
                 "rate_limit",
             )
+        if SystemConfigService._has_transport_blocked_signal(error_text or ""):
+            return _LLMDiagnostic(
+                "network_error",
+                True,
+                "LLM request failed before a valid response was returned",
+                "network_error",
+            )
         if SystemConfigService._has_request_blocked_signal(error_text or ""):
             return _LLMDiagnostic(
                 "request_blocked",
@@ -2666,6 +2673,8 @@ def _has_model_access_denied_signal(text: str) -> bool:
     @staticmethod
     def _has_request_blocked_signal(text: str) -> bool:
         lowered = text.lower()
+        if SystemConfigService._has_transport_blocked_signal(lowered):
+            return False
         blocked_tokens = (
             "your request was blocked",
             "the request was blocked",
@@ -2678,6 +2687,19 @@ def _has_request_blocked_signal(text: str) -> bool:
         )
         return any(token in lowered for token in blocked_tokens)
 
+    @staticmethod
+    def _has_transport_blocked_signal(text: str) -> bool:
+        lowered = text.lower()
+        transport_tokens = (
+            "connection blocked",
+            "connection request was blocked",
+            "network blocked",
+            "blocked by network policy",
+            "blocked by firewall",
+            "firewall blocked",
+        )
+        return any(token in lowered for token in transport_tokens)
+
     @staticmethod
     def _has_provider_prefix_mismatch_signal(text: str) -> bool:
         lowered = text.lower()
@@ -2756,7 +2778,9 @@ def _classify_llm_exception(exc: Exception) -> _LLMDiagnostic:
             return _LLMDiagnostic("network_error", True, "LLM request failed before a valid response was returned", "connection_refused")
         if "ssl" in text or "tls" in text or "certificate" in text:
             return _LLMDiagnostic("network_error", True, "LLM request failed before a valid response was returned", "tls_error")
-        if any(token in exc_name for token in ("connection", "network")) or any(token in text for token in ("connection", "network")):
+        if any(token in exc_name for token in ("connection", "network")) or any(
+            token in text for token in ("connection", "network", "firewall")
+        ):
             return _LLMDiagnostic("network_error", True, "LLM request failed before a valid response was returned", "network_error")
         return _LLMDiagnostic("network_error", False, "LLM channel test failed", "unknown_error")
 

tests/test_system_config_service.py

@@ -1411,6 +1411,8 @@ class RateLimitError(Exception):
             (Exception("TLS certificate verify failed"), "network_error", "tls_error"),
             (Exception("Connection refused"), "network_error", "connection_refused"),
             (Exception("connection request was blocked by firewall"), "network_error", "network_error"),
+            (Exception("connection blocked by policy"), "network_error", "network_error"),
+            (Exception("request blocked by firewall"), "network_error", "network_error"),
             (Exception("blocked"), "network_error", "unknown_error"),
             (Exception("model gpt-4o is not authorized for this account"), "model_not_found", "model_access_denied"),
             (Exception("litellm.APIError: APIError: OpenAIException - Model disabled."), "model_not_found", "model_access_denied"),
@@ -1512,6 +1514,8 @@ def test_discover_llm_channel_models_classifies_error_scenarios(self, mock_get)
         rate_limit_response.json.return_value = {"error": {"message": "too many requests"}}
         blocked_response = Mock(ok=False, status_code=403, text="Forbidden: your request was blocked by content policy")
         blocked_response.json.return_value = {"error": {"message": "Forbidden: your request was blocked by content policy"}}
+        connection_blocked_response = Mock(ok=False, status_code=403, text="connection blocked by policy")
+        connection_blocked_response.json.return_value = {"error": {"message": "connection blocked by policy"}}
         invalid_json_response = Mock(ok=True, status_code=200, text="<html>bad gateway</html>")
         invalid_json_response.json.side_effect = ValueError("invalid json")
 
@@ -1524,6 +1528,7 @@ def test_discover_llm_channel_models_classifies_error_scenarios(self, mock_get)
             (quota_blocked_response, "quota", "model_discovery", True, "insufficient_balance"),
             (rate_limit_response, "quota", "model_discovery", True, "rate_limit"),
             (blocked_response, "request_blocked", "model_discovery", False, "provider_blocked"),
+            (connection_blocked_response, "network_error", "model_discovery", True, "network_error"),
             (invalid_json_response, "format_error", "response_parse", False, "non_json"),
         ]:
             with self.subTest(error_code=error_code):