fix(connector): address CodeRabbit feedback on connector-batch-3

- azure/invoke_function: error on non-2xx responses; url.QueryEscape function key
- gcp/invoke_cloud_run: error on non-2xx responses
- github/dispatch_workflow: url.PathEscape workflowID in path
- drive/upload: use multipart.NewWriter for random boundary (prevents boundary collision)
- k8s: url.PathEscape namespace/name in resource paths and get_pod_status
- salesforce: url.PathEscape objectType in create_record path

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

packages/engine/internal/connector/azureblob.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 )
 
@@ -200,9 +201,9 @@ func (c *AzureInvokeFunctionConnector) Execute(ctx context.Context, params map[s
 	endpoint := functionURL
 	if functionKey != "" {
 		if strings.Contains(endpoint, "?") {
-			endpoint += "&code=" + functionKey
+			endpoint += "&code=" + url.QueryEscape(functionKey)
 		} else {
-			endpoint += "?code=" + functionKey
+			endpoint += "?code=" + url.QueryEscape(functionKey)
 		}
 	}
 
@@ -232,6 +233,9 @@ func (c *AzureInvokeFunctionConnector) Execute(ctx context.Context, params map[s
 	if err != nil {
 		return nil, fmt.Errorf("azure/invoke_function: reading response: %w", err)
 	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("azure/invoke_function: request failed with status %d: %s", resp.StatusCode, truncate(string(body), 500))
+	}
 
 	contentType := resp.Header.Get("Content-Type")
 	if strings.Contains(contentType, "application/json") && len(body) > 0 {

packages/engine/internal/connector/gcpconnector.go

@@ -139,6 +139,9 @@ func (c *GCPInvokeCloudRunConnector) Execute(ctx context.Context, params map[str
 	if err != nil {
 		return nil, fmt.Errorf("gcp/invoke_cloud_run: reading response: %w", err)
 	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("gcp/invoke_cloud_run: request failed with status %d: %s", resp.StatusCode, truncate(string(body), 500))
+	}
 
 	contentType := resp.Header.Get("Content-Type")
 	if strings.Contains(contentType, "application/json") && len(body) > 0 {

packages/engine/internal/connector/github.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"time"
 )
 
@@ -221,7 +222,7 @@ func (c *GitHubDispatchWorkflowConnector) Execute(ctx context.Context, params ma
 		return nil, fmt.Errorf("github/dispatch_workflow: marshaling request: %w", err)
 	}
 
-	path := fmt.Sprintf("/repos/%s/%s/actions/workflows/%s/dispatches", owner, repo, workflowID)
+	path := fmt.Sprintf("/repos/%s/%s/actions/workflows/%s/dispatches", owner, repo, url.PathEscape(workflowID))
 	req, err := http.NewRequestWithContext(ctx, "POST", c.apiURL(path), bytes.NewReader(reqJSON))
 	if err != nil {
 		return nil, fmt.Errorf("github/dispatch_workflow: creating request: %w", err)

packages/engine/internal/connector/googledrive.go

@@ -5,7 +5,9 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"mime/multipart"
 	"net/http"
+	"net/textproto"
 	"net/url"
 )
 
@@ -56,17 +58,32 @@ func (c *GoogleDriveUploadConnector) Execute(ctx context.Context, params map[str
 		metaBody = fmt.Sprintf(`{"name":%q}`, name)
 	}
 
-	boundary := "mantle_multipart_boundary"
 	var buf bytes.Buffer
-	// Part 1: metadata
-	buf.WriteString("--" + boundary + "\r\n")
-	buf.WriteString("Content-Type: application/json\r\n\r\n")
-	buf.WriteString(metaBody + "\r\n")
-	// Part 2: content
-	buf.WriteString("--" + boundary + "\r\n")
-	buf.WriteString("Content-Type: " + mimeType + "\r\n\r\n")
-	buf.WriteString(content + "\r\n")
-	buf.WriteString("--" + boundary + "--\r\n")
+	mw := multipart.NewWriter(&buf)
+
+	metaHeader := make(textproto.MIMEHeader)
+	metaHeader.Set("Content-Type", "application/json")
+	metaPart, err := mw.CreatePart(metaHeader)
+	if err != nil {
+		return nil, fmt.Errorf("drive/upload: creating metadata part: %w", err)
+	}
+	if _, err := io.WriteString(metaPart, metaBody); err != nil {
+		return nil, fmt.Errorf("drive/upload: writing metadata: %w", err)
+	}
+
+	contentHeader := make(textproto.MIMEHeader)
+	contentHeader.Set("Content-Type", mimeType)
+	contentPart, err := mw.CreatePart(contentHeader)
+	if err != nil {
+		return nil, fmt.Errorf("drive/upload: creating content part: %w", err)
+	}
+	if _, err := io.WriteString(contentPart, content); err != nil {
+		return nil, fmt.Errorf("drive/upload: writing content: %w", err)
+	}
+
+	if err := mw.Close(); err != nil {
+		return nil, fmt.Errorf("drive/upload: closing writer: %w", err)
+	}
 
 	endpoint := c.getUploadURL() + "?uploadType=multipart"
 
@@ -75,7 +92,7 @@ func (c *GoogleDriveUploadConnector) Execute(ctx context.Context, params map[str
 		return nil, fmt.Errorf("drive/upload: creating request: %w", err)
 	}
 	req.Header.Set("Authorization", "Bearer "+token)
-	req.Header.Set("Content-Type", "multipart/related; boundary="+boundary)
+	req.Header.Set("Content-Type", "multipart/related; boundary="+mw.Boundary())
 
 	resp, err := httpClient(c.Client).Do(req)
 	if err != nil {

packages/engine/internal/connector/kubernetes.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"strings"
 )
 
@@ -92,9 +93,9 @@ func k8sResourcePath(apiVersion, kind, namespace, name string) string {
 	}
 
 	if name != "" {
-		return fmt.Sprintf("%s/namespaces/%s/%s/%s", basePath, namespace, resourceType, name)
+		return fmt.Sprintf("%s/namespaces/%s/%s/%s", basePath, url.PathEscape(namespace), resourceType, url.PathEscape(name))
 	}
-	return fmt.Sprintf("%s/namespaces/%s/%s", basePath, namespace, resourceType)
+	return fmt.Sprintf("%s/namespaces/%s/%s", basePath, url.PathEscape(namespace), resourceType)
 }
 
 // k8sDoRequest executes an HTTP request against the Kubernetes API.
@@ -356,9 +357,9 @@ func (c *K8sGetPodStatusConnector) Execute(ctx context.Context, params map[strin
 	}
 
 	client := k8sInsecureClient(c.Client)
-	url := fmt.Sprintf("%s/api/v1/namespaces/%s/pods/%s", baseURL, namespace, podName)
+	podURL := fmt.Sprintf("%s/api/v1/namespaces/%s/pods/%s", baseURL, url.PathEscape(namespace), url.PathEscape(podName))
 
-	result, statusCode, err := k8sDoRequest(ctx, client, http.MethodGet, url, token, nil)
+	result, statusCode, err := k8sDoRequest(ctx, client, http.MethodGet, podURL, token, nil)
 	if err != nil {
 		return nil, fmt.Errorf("k8s/get_pod_status: %w", err)
 	}

packages/engine/internal/connector/salesforce.go

@@ -141,7 +141,7 @@ func (c *SalesforceCreateRecordConnector) Execute(ctx context.Context, params ma
 		return nil, fmt.Errorf("salesforce/create_record: marshaling request: %w", err)
 	}
 
-	path := fmt.Sprintf("/sobjects/%s", objectType)
+	path := fmt.Sprintf("/sobjects/%s", url.PathEscape(objectType))
 	req, err := http.NewRequestWithContext(ctx, "POST", c.dataURL(instanceURL, path), bytes.NewReader(reqJSON))
 	if err != nil {
 		return nil, fmt.Errorf("salesforce/create_record: creating request: %w", err)