docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them (#955)

* docs(prompt): teach agents to recognize Caido proxy error pages

* docs(prompt): tighten Caido proxy error page section

---------

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
This commit is contained in:
devin-ai-integration[bot]
2026-08-02 02:01:34 +03:00
committed by GitHub
co-authored by Ahmed Allam
parent 5602bc23ca
commit dc7cc50f80
+13 -2
View File
@@ -446,8 +446,19 @@ PROXY & INTERCEPTION:
- Caido CLI - Modern web proxy (already running). Use the proxy tools
directly, or import `caido_api` from sandbox Python scripts.
- HTTPQL filters (for `list_requests`): quote string values, leave integers unquoted (`resp.code.eq:200`, not `"200"`); combine terms with `AND`/`OR` (there is no `NOT` — use the negated operator `ne`/`ncont`/`nregex`). Numeric fields (`resp.code`, `req.port`) use `eq`/`ne`/`gt`/`gte`/`lt`/`lte`; text fields (`req.host`, `req.path`, `req.method`, `req.raw`) use `cont`/`ncont`/`eq`/`regex`. Example: `resp.code.gte:200 AND resp.code.lt:300 AND req.host.cont:"api"`.
- NOTE: If you are seeing proxy errors when sending requests, it usually means you are not sending requests to a correct url/host/port.
- Ignore Caido proxy-generated 50x HTML error pages; these are proxy issues (might happen when requesting a wrong host or SSL/TLS issues, etc).
CAIDO PROXY ERROR PAGES — NOT RESPONSES FROM THE TARGET:
Everything is proxied through Caido, so an unreachable target makes the *proxy* answer: a ~9KB
`<title>Caido</title>` HTML page under 502/500, which curl/python/browser print as if it were the
target's content. The request never reached a server. It also appears in `list_requests` with no
response at all (`resp` null), unlike a real 502.
- Don't dump it; extract the cause with `curl -s ... | grep -A8 'c-title"'`.
- The `c-details` cause says what to fix: "Failed to query DNS" — host doesn't resolve, check
`dig +short <host>`, then correct or drop it; "Connection refused" — nothing on that port, check
`nc -z -v <host> <port>`; "TLS handshake"/"wrong version number" — scheme/port mismatch, flip
http/https; timeout — filtered or unreachable from the sandbox.
- NEVER treat these as target behavior: not a finding, not evidence, not a WAF, not a server
error. Fix the url/host/port/scheme and retry, or move on — do not keep re-requesting a dead host.
PROGRAMMING:
- Python 3, uv, Node.js/npm