fix(chat): preserve link contrast and bound preview retries

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/source-link.ts

@@ -24,7 +24,7 @@ export function linkSiteName(url: string, siteName?: string | null): string {
  * A prose link shares the platform blue and retains a visible keyboard focus outline.
  */
 export const PROSE_LINK_CLASS =
-  'not-prose [&_strong]:text-inherit [&_em]:text-inherit [&_code]:text-inherit [&_del]:text-inherit text-[var(--brand-blue)] no-underline hover-hover:text-[var(--brand-secondary)] focus-visible:outline focus-visible:outline-2 focus-visible:outline-[var(--text-primary)]'
+  'not-prose [&_strong]:text-inherit [&_em]:text-inherit [&_code]:text-inherit [&_del]:text-inherit text-[var(--brand-blue)] no-underline focus-visible:outline focus-visible:outline-2 focus-visible:outline-[var(--text-primary)]'
 
 /**
  * In the desktop app, a plain click diverts into the embedded Sim browser

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/source-preview.tsx

@@ -119,7 +119,7 @@ function SourcePreviewContent({ source }: Pick<SourcePreviewProps, 'source'>) {
     source.snippet?.trim() || (!source.connectorType && preview?.description?.trim())
   return (
     <div className='flex flex-col gap-3 p-1.5'>
-      <div className='flex min-w-0 items-center justify-between gap-3 text-[var(--text-muted)] text-caption'>
+      <div className='flex min-w-0 items-center justify-between gap-3 text-[var(--text-tertiary)] text-caption'>
         <span className='flex min-w-0 items-center gap-2'>
           <SourceIcon source={source} />
           <OverflowText label={siteName} tooltipEnabled={false} />

apps/sim/lib/core/errors/retryable-infrastructure.test.ts

@@ -41,6 +41,17 @@ describe('isRetryableInfrastructureError', () => {
     })
   })
 
+  it.each(['DNS_TIMEOUT', 'EAI_AGAIN'])('recognizes transient DNS errors: %s', (code) => {
+    expect(
+      isRetryableInfrastructureError(new Error('DNS lookup failed', { cause: errorWithCode(code) }))
+    ).toBe(true)
+  })
+
+  it('does not retry permanent DNS or destination-policy failures', () => {
+    expect(isRetryableInfrastructureError(errorWithCode('ENOTFOUND'))).toBe(false)
+    expect(isRetryableInfrastructureError(new Error('Destination blocked'))).toBe(false)
+  })
+
   it('does not classify semantic SQL errors as retryable', () => {
     expect(isRetryableInfrastructureError(errorWithCode('42703'))).toBe(false)
     expect(isRetryableInfrastructureError(new Error('workflow not found'))).toBe(false)

apps/sim/lib/core/errors/retryable-infrastructure.ts

@@ -16,6 +16,8 @@ const RETRYABLE_DB_ERROR_CODES = new Set([
 ])
 
 const RETRYABLE_NETWORK_ERROR_CODES = new Set([
+  'DNS_TIMEOUT',
+  'EAI_AGAIN',
   'ETIMEDOUT',
   'ECONNRESET',
   'ECONNREFUSED',

apps/sim/lib/core/security/egress/validate.ts

@@ -38,6 +38,8 @@ export interface EgressValidationSuccess {
 export interface EgressValidationFailure {
   readonly isValid: false
   readonly error: string
+  /** Retains resolver failure codes so callers can distinguish an outage from a policy denial. */
+  readonly cause?: unknown
 }
 
 export type EgressValidationResult = EgressValidationSuccess | EgressValidationFailure
@@ -125,7 +127,7 @@ export async function validateEgressUrl(
         ? { profile, paramName }
         : { profile, paramName, host, error: toError(error).message }
     )
-    return { isValid: false, error: `${paramName} hostname could not be resolved` }
+    return { isValid: false, error: `${paramName} hostname could not be resolved`, cause: error }
   }
 
   // Refused records are filtered rather than failing the whole host: pinning to a

apps/sim/lib/core/security/input-validation.server.test.ts

@@ -128,6 +128,16 @@ describe('validateUrlWithDNS address classification', () => {
     ).toBe(false)
   })
 
+  it('retains resolver causes for retry classification without admitting the request', async () => {
+    const cause = Object.assign(new Error('Temporary DNS failure'), { code: 'EAI_AGAIN' })
+    mockResolve.mockRejectedValue(cause)
+    await expect(
+      secureFetchWithValidation('https://example.com/preview', {
+        profile: 'contentFetch',
+      })
+    ).rejects.toMatchObject({ message: 'url hostname could not be resolved', cause })
+  })
+
   it('can conceal credential-derived host details in validation logs', async () => {
     mockResolve.mockRejectedValue(new Error('DNS failure with credential-host-canary'))
 

apps/sim/lib/core/security/input-validation.server.ts

@@ -41,7 +41,13 @@ const logger = createLogger('InputValidation')
  */
 export type AsyncValidationResult =
   | { isValid: true; resolvedIP: string; originalHostname: string; error?: undefined }
-  | { isValid: false; error: string; resolvedIP?: undefined; originalHostname?: undefined }
+  | {
+      isValid: false
+      error: string
+      cause?: unknown
+      resolvedIP?: undefined
+      originalHostname?: undefined
+    }
 
 /**
  * Validates a URL, resolves its DNS, and returns the address to pin.
@@ -65,7 +71,7 @@ export async function validateUrlWithDNS(
   const result = await validateEgressUrl(url, paramName, profile, options)
   return result.isValid
     ? { isValid: true, resolvedIP: result.resolvedIP, originalHostname: result.originalHostname }
-    : { isValid: false, error: result.error }
+    : { isValid: false, error: result.error, cause: result.cause }
 }
 
 /**
@@ -1215,7 +1221,9 @@ export async function secureFetchWithPinnedIP(
         })
           .then((validation) => {
             if (!validation.isValid) {
-              settledReject(new Error(`Redirect blocked: ${validation.error}`))
+              settledReject(
+                new Error(`Redirect blocked: ${validation.error}`, { cause: validation.cause })
+              )
               return
             }
             const redirectPolicy = options.redirectPolicy
@@ -1516,7 +1524,11 @@ export async function secureFetchWithPinnedIP(
       req.on('error', settledReject)
       req.on('timeout', () => {
         destroyRequest()
-        settledReject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
+        settledReject(
+          Object.assign(new Error(`Request timed out after ${requestOptions.timeout}ms`), {
+            code: 'ETIMEDOUT',
+          })
+        )
       })
       send = () => {
         req.end(options.body)
@@ -1560,7 +1572,7 @@ export async function secureFetchWithValidation(
     signal: options.signal,
   })
   if (!validation.isValid) {
-    throw new Error(validation.error)
+    throw new Error(validation.error, { cause: validation.cause })
   }
   return secureFetchWithPinnedIP(url, validation.resolvedIP, options)
 }

apps/sim/lib/core/security/pinned-redirect-replay.server.test.ts

@@ -6,6 +6,7 @@
  */
 import http from 'node:http'
 import type { AddressInfo } from 'node:net'
+import { resolveHostAddresses } from '@sim/security/dns'
 import { afterEach, describe, expect, it, vi } from 'vitest'
 
 vi.mock('@sim/security/dns', () => ({
@@ -58,6 +59,20 @@ async function startRecordingServer(hops: RecordedHop[]): Promise<string> {
 }
 
 describe('secureFetchWithPinnedIP redirect replay', () => {
+  it('preserves transient DNS failure causes on redirects', async () => {
+    const cause = Object.assign(new Error('Temporary DNS failure'), { code: 'EAI_AGAIN' })
+    vi.mocked(resolveHostAddresses).mockRejectedValueOnce(cause)
+    const origin = await startServer((_req, res) => {
+      res.writeHead(302, { location: 'https://example.com/next' })
+      res.end()
+    })
+    await expect(
+      secureFetchWithPinnedIP(origin, '127.0.0.1', {
+        profile: 'contentFetch',
+      })
+    ).rejects.toMatchObject({ cause })
+  })
+
   it('rejects a redirect target before following it', async () => {
     const hops: RecordedHop[] = []
     const target = await startRecordingServer(hops)

apps/sim/lib/core/security/secure-fetch-request-framing.server.test.ts

@@ -194,6 +194,16 @@ describe('secureFetchWithPinnedIP request framing', () => {
     expect(receivedHost).toBe(url.host)
   })
 
+  it('exposes a retryable code when the request times out before headers', async () => {
+    const origin = await startServer((req) => req.resume())
+    await expect(
+      secureFetchWithPinnedIP(origin, '127.0.0.1', {
+        timeout: 20,
+        profile: 'configuredEndpoint',
+      })
+    ).rejects.toMatchObject({ code: 'ETIMEDOUT' })
+  })
+
   it('cancels a framed request while waiting for response headers', async () => {
     const controller = new AbortController()
     const origin = await startServer((req) => {

apps/sim/lib/link-preview/fetch-preview.test.ts

@@ -7,6 +7,7 @@ vi.mock('@/lib/core/security/input-validation.server', () => ({
   secureFetchWithValidation: fetchMock,
 }))
 
+import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import { fetchLinkPreview } from '@/lib/link-preview/fetch-preview'
 
 const PAGE = 'https://example.com/docs/guide'
@@ -79,14 +80,92 @@ describe('public link preview images', () => {
     expect(fetchMock.mock.calls[1][0]).toBe('https://example.com/card.png')
   })
 
-  it('retains text metadata when the image is blocked by the network guard', async () => {
-    fetchMock.mockResolvedValueOnce(page()).mockRejectedValueOnce(new Error('Private IP blocked'))
-    expect(await fetchLinkPreview(PAGE)).toMatchObject({
+  it.each([
+    new Error('Private IP blocked'),
+    new Error('Redirect blocked'),
+    new PayloadSizeLimitError({ label: 'response body', maxBytes: 2 * 1024 * 1024 }),
+  ])('does not retry permanent image failures: %s', async (error) => {
+    fetchMock.mockResolvedValueOnce(page()).mockRejectedValueOnce(error)
+    expect(await fetchLinkPreview(PAGE)).toEqual({
       title: 'Guide',
       description: 'A useful guide',
+      siteName: null,
     })
   })
 
+  it.each(['ECONNRESET', 'ETIMEDOUT', 'EAI_AGAIN', 'DNS_TIMEOUT'])(
+    'retries transient fetch failures through their cause chain: %s',
+    async (code) => {
+      const cause = Object.assign(new Error('Upstream unavailable'), { code })
+      fetchMock
+        .mockResolvedValueOnce(page())
+        .mockRejectedValueOnce(new Error('Fetch failed', { cause }))
+      expect(await fetchLinkPreview(PAGE)).toMatchObject({ title: 'Guide', imageRetryable: true })
+    }
+  )
+
+  it('does not retry a malformed image reference', async () => {
+    fetchMock.mockResolvedValueOnce(page('https://['))
+    expect(await fetchLinkPreview(PAGE)).toEqual({
+      title: 'Guide',
+      description: 'A useful guide',
+      siteName: null,
+    })
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+
+  it('does not retry malformed raster data', async () => {
+    fetchMock
+      .mockResolvedValueOnce(page())
+      .mockResolvedValueOnce(
+        new Response('not a PNG', { headers: { 'content-type': 'image/png' } })
+      )
+    expect(await fetchLinkPreview(PAGE)).toEqual({
+      title: 'Guide',
+      description: 'A useful guide',
+      siteName: null,
+    })
+  })
+
+  it.each([
+    { status: 404, contentType: 'image/png', retryable: undefined },
+    { status: 429, contentType: 'image/png', retryable: true },
+    { status: 503, contentType: 'image/png', retryable: true },
+    { status: 200, contentType: 'image/svg+xml', retryable: undefined },
+  ])(
+    'cancels rejected image bodies: $status $contentType',
+    async ({ status, contentType, retryable }) => {
+      const cancel = vi.fn()
+      const response = new Response(new ReadableStream({ cancel }), {
+        status,
+        headers: { 'content-type': contentType },
+      })
+      const read = vi.spyOn(response, 'arrayBuffer')
+      fetchMock.mockResolvedValueOnce(page()).mockResolvedValueOnce(response)
+      const result = await fetchLinkPreview(PAGE)
+      expect(result?.imageRetryable).toBe(retryable)
+      expect(cancel).toHaveBeenCalledOnce()
+      expect(read).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each([
+    { status: 404, contentType: 'text/html' },
+    { status: 503, contentType: 'text/html' },
+    { status: 200, contentType: 'application/octet-stream' },
+  ])('cancels rejected page bodies: $status $contentType', async ({ status, contentType }) => {
+    const cancel = vi.fn()
+    const response = new Response(new ReadableStream({ cancel }), {
+      status,
+      headers: { 'content-type': contentType },
+    })
+    const read = vi.spyOn(response, 'text')
+    fetchMock.mockResolvedValueOnce(response)
+    expect(await fetchLinkPreview(PAGE)).toBeNull()
+    expect(cancel).toHaveBeenCalledOnce()
+    expect(read).not.toHaveBeenCalled()
+  })
+
   it('rejects SVG even when served with a raster content type', async () => {
     fetchMock
       .mockResolvedValueOnce(page())