fix(connectors): retry transient DNS failures in secureFetchWithRetry

secureFetchWithValidation throws a validation error before the request when a hostname temporarily fails to resolve. Classify that transient DNS failure as retryable so secureFetchWithRetry mirrors the old fetchWithRetry network-retry behavior, while keeping the deterministic blocked-IP SSRF rejection non-retryable.

Author: waleedlatif1

apps/sim/lib/knowledge/documents/utils.test.ts

@@ -132,6 +132,10 @@ describe('isRetryableError', () => {
     it.concurrent('returns true for "service unavailable" in message', () => {
       expect(isRetryableError(new Error('The service unavailable right now'))).toBe(true)
     })
+
+    it.concurrent('returns true for a transient DNS resolution failure', () => {
+      expect(isRetryableError(new Error('url hostname could not be resolved'))).toBe(true)
+    })
   })
 
   describe('case insensitivity', () => {
@@ -178,6 +182,10 @@ describe('isRetryableError', () => {
     it.concurrent('returns false for plain object with non-retryable status and no message', () => {
       expect(isRetryableError({ status: 500 })).toBe(false)
     })
+
+    it.concurrent('returns false for the deterministic blocked-IP SSRF rejection', () => {
+      expect(isRetryableError(new Error('url resolves to a blocked IP address'))).toBe(false)
+    })
   })
 })
 

apps/sim/lib/knowledge/documents/utils.ts

@@ -67,6 +67,10 @@ export function isRetryableError(error: unknown): boolean {
     'enetunreach',
     'socket hang up',
     'network error',
+    // Transient DNS resolution failure surfaced by secureFetchWithValidation
+    // before the request is made. The deterministic "resolves to a blocked IP
+    // address" security rejection is a distinct message and stays non-retryable.
+    'could not be resolved',
   ]
 
   if (networkKeywords.some((keyword) => lowerMessage.includes(keyword))) {