Engineers running global teams hit this wall often: Mercurial tries to move code, but Zscaler’s cloud-based web filter intercepts outbound traffic. This is not random. Zscaler acts as a proxy, scanning HTTP(S) requests, and Mercurial’s protocol is not friendly with some proxy settings. The handshake fails, authentication loops, or the connection drops outright.
The core conflict lives in how Mercurial handles network I/O. By default, it opens direct connections to the remote repository. Zscaler forces those connections through its secure proxy stack. SSL interception, custom certificates, and restricted ports create friction at every step. Common symptoms include hg clone stalling, hg pull timing out, and commits that push partial data before failing.
Solving this demands configuration, not guesswork. Check if Zscaler tunneling supports Mercurial’s native HTTP and HTTPS requests. Import Zscaler’s root certificate into Mercurial’s trusted store, or point Mercurial to an updated CA bundle. If you can, switch Mercurial to use HTTPS on standard ports (443) with fully qualified hostnames. When that’s impossible, consider SSH-based Mercurial over port 443, which can bypass protocol inspection.