From 5796e8682b4e9da87668d9d46f0d590fb7aebe83 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Tue, 29 Sep 2026 18:41:00 -0700
Subject: [PATCH 1/4] fix(confluence): retry transient attachment metadata 500s
 and skip a failing parent instead of aborting the sync

---
 .../connectors/confluence/attachments.test.ts | 121 +++++++++++
 apps/sim/connectors/confluence/attachments.ts | 200 ++++++++++++++++--
 2 files changed, 302 insertions(+), 19 deletions(-)

diff --git a/apps/sim/connectors/confluence/attachments.test.ts b/apps/sim/connectors/confluence/attachments.test.ts
index dcff9b8117e..05d97ed71fc 100644
--- a/apps/sim/connectors/confluence/attachments.test.ts
+++ b/apps/sim/connectors/confluence/attachments.test.ts
@@ -1,3 +1,4 @@
+import { getAllMockLoggers } from '@sim/testing/mocks/logger.mock'
 import JSZip from 'jszip'
 import { PDFDocument, StandardFonts } from 'pdf-lib'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
@@ -249,6 +250,126 @@ describe('Confluence attachment listing', () => {
     }
   )
 
+  describe('server errors', () => {
+    const parents = (ids: string[]) =>
+      vi.fn(
+        async (): Promise<ExternalDocumentList> => ({
+          documents: ids.map((id) => parent(id)),
+          hasMore: false,
+        })
+      )
+
+    /** Answers a parent's attachment listing with `status` while `failing` says so. */
+    function listingFails(failing: (parentId: string) => boolean, status = 500) {
+      fetchMock.mockImplementation(async (input) => {
+        const parentId = new URL(String(input)).pathname.split('/').at(-2) ?? ''
+        if (failing(parentId)) return new Response('upstream error', { status })
+        return Response.json({ results: [file({ id: `${parentId}-file`, pageId: parentId })] })
+      })
+    }
+
+    /** Runs a listing past the shared backoff (~31 s for five retries) without real waits. */
+    async function listPastBackoff(input: Parameters<typeof listConfluenceAttachments>[0]) {
+      vi.useFakeTimers()
+      try {
+        const listing = listConfluenceAttachments(input)
+        const settled = listing.then(
+          () => undefined,
+          () => undefined
+        )
+        for (let i = 0; i < 20; i++) await vi.advanceTimersByTimeAsync(10_000)
+        await settled
+        return await listing
+      } finally {
+        vi.useRealTimers()
+      }
+    }
+
+    it('retries a transient 500 instead of failing the listing', async () => {
+      let failed = false
+      listingFails(() => {
+        if (failed) return false
+        failed = true
+        return true
+      })
+      const result = await listPastBackoff({ ...INPUT, listParents: parents(['p1']) })
+      expect(result.documents.map((doc) => doc.externalId)).toEqual([
+        'p1',
+        'attachment:page:p1:p1-file',
+      ])
+      expect(result.listingFailures).toBeUndefined()
+      expect(fetchMock).toHaveBeenCalledTimes(2)
+    })
+
+    it('skips isolated parents whose listing keeps failing and keeps listing the rest', async () => {
+      listingFails((id) => id === 'p1' || id === 'p3' || id === 'p5')
+      const context: Record<string, unknown> = {}
+      const result = await listPastBackoff({
+        ...INPUT,
+        listParents: parents(['p1', 'p2', 'p3', 'p4', 'p5']),
+        syncContext: context,
+      })
+      expect(result.documents.map((doc) => doc.externalId)).toEqual([
+        'p1',
+        'p2',
+        'p3',
+        'p4',
+        'p5',
+        'attachment:page:p2:p2-file',
+        'attachment:page:p4:p4-file',
+      ])
+      expect(result.listingFailures).toEqual({
+        count: 3,
+        samples: ['p1', 'p3', 'p5'].map((scope) => ({
+          scope,
+          operation: 'confluence.attachments.list',
+          status: 500,
+          reasons: ['attachment_listing_unavailable'],
+        })),
+      })
+      expect(result.reconciliationSafe).toBe(false)
+      expect(context.reconciliationUnsafe).toBe(true)
+    })
+
+    it('logs Atlassian trace identifiers for a 500 but never its body', async () => {
+      let failed = false
+      fetchMock.mockImplementation(async () => {
+        if (failed) return Response.json({ results: [] })
+        failed = true
+        return Response.json(
+          {
+            errors: [{ code: 'INTERNAL_SERVER_ERROR', title: 'x', detail: 'leaked-secret-value' }],
+          },
+          {
+            status: 500,
+            headers: { 'atl-traceid': '5c1f0e2a9b7d4e1f', 'x-arequestid': 'not an id; <script>' },
+          }
+        )
+      })
+      await listPastBackoff({ ...INPUT, listParents: parents(['p1']) })
+      const logged = JSON.stringify(
+        getAllMockLoggers().flatMap((logger) =>
+          [logger.info, logger.warn, logger.error, logger.debug].flatMap((fn) => fn.mock.calls)
+        )
+      )
+      expect(logged).toContain('5c1f0e2a9b7d4e1f')
+      expect(logged).toContain('INTERNAL_SERVER_ERROR')
+      expect(logged).not.toContain('<script>')
+      expect(logged).not.toContain('leaked-secret-value')
+    })
+
+    it.each([500, 503])(
+      'fails the sync when consecutive parents answer %s, as during an outage',
+      async (status) => {
+        listingFails(() => true, status)
+        await expect(
+          listPastBackoff({ ...INPUT, listParents: parents(['p1', 'p2', 'p3', 'p4']) })
+        ).rejects.toMatchObject({ status })
+        expect(fetchMock).toHaveBeenCalledTimes(3 * 6)
+      }
+    )
+  })
+
   it('surfaces known oversized files as skipped without downloading', async () => {
     fetchMock.mockResolvedValue(
       Response.json({ results: [file({ fileSize: CONNECTOR_MAX_FILE_BYTES + 1 })] })
diff --git a/apps/sim/connectors/confluence/attachments.ts b/apps/sim/connectors/confluence/attachments.ts
index c3e6467d540..60622b0ddfd 100644
--- a/apps/sim/connectors/confluence/attachments.ts
+++ b/apps/sim/connectors/confluence/attachments.ts
@@ -1,13 +1,17 @@
+import { createLogger } from '@sim/logger'
 import { z } from 'zod'
 import { isPayloadSizeLimitError, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { fetchWithRetry, secureFetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import {
   createRetryableHttpError,
+  isRetryableError,
+  type RetryOptions,
   readBoundedHttpErrorPayload,
 } from '@/lib/knowledge/documents/utils'
 import { extractCursor } from '@/connectors/confluence/cursor'
 import { listingFailuresSchema, MAX_LISTING_FAILURE_SAMPLES } from '@/connectors/listing-failures'
 import { isAllSourceItems } from '@/connectors/selection'
+import { ConnectorSourceError } from '@/connectors/source-error'
 import type { ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   CONNECTOR_MAX_FILE_BYTES,
@@ -20,12 +24,20 @@ import {
   stubOrSkipBySize,
 } from '@/connectors/utils'
 
+const logger = createLogger('ConfluenceAttachments')
+
 const ATTACHMENT_PREFIX = 'attachment:'
 const CURSOR_PREFIX = 'attachments:'
 const PAGE_SIZE = 50
 const REQUESTS_PER_CALL = 5
 const MAX_CURSOR_BYTES = 512 * 1024
 const MAX_METADATA_BYTES = 2 * 1024 * 1024
+/**
+ * Consecutive parents whose attachment listing failed server-side. An isolated
+ * failure is skipped and recorded; a run of them means Atlassian itself is down,
+ * so the sync fails instead of spending the retry budget on every remaining parent.
+ */
+const MAX_CONSECUTIVE_SERVER_FAILURES = 3
 /**
  * Attachment formats listed for indexing: a deliberate subset of the shared
  * `PIPELINE_PARSED_MIME_TYPES`, limited to the headline PDF, Word, Excel and
@@ -47,6 +59,12 @@ const cursorSchema = z.object({
   parentsListed: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
   parentsDone: z.boolean(),
   failures: listingFailuresSchema.optional(),
+  serverFailureStreak: z
+    .number()
+    .int()
+    .nonnegative()
+    .max(MAX_CONSECUTIVE_SERVER_FAILURES)
+    .optional(),
 })
 const attachmentSchema = z.object({
   id: boundedId,
@@ -64,12 +82,28 @@ const attachmentPageSchema = z.object({
   results: z.array(attachmentSchema).max(250),
   _links: z.object({ next: providerCursor.optional() }).optional(),
 })
+/** Only provider-owned codes are kept from an error body; titles and details are never logged. */
+const atlassianErrorBodySchema = z.object({
+  errors: z
+    .array(
+      z.object({
+        code: z
+          .string()
+          .regex(/^[A-Za-z0-9_.-]{1,64}$/)
+          .optional()
+          .catch(undefined),
+      })
+    )
+    .max(10),
+})
+const OPAQUE_HEADER_VALUE = /^[A-Za-z0-9_.-]{1,128}$/
 const scopeMismatchSchema = z.object({
   code: z.literal(401),
   message: z.literal('Unauthorized; scope does not match'),
 })
 
 type Attachment = z.infer<typeof attachmentSchema>
+type AttachmentPage = z.infer<typeof attachmentPageSchema>
 type AttachmentCursor = z.infer<typeof cursorSchema>
 type AttachmentParent = z.infer<typeof parentSchema>
 
@@ -111,18 +145,87 @@ function apiBase(cloudId: string): string {
   return `https://api.atlassian.com/ex/confluence/${encodeURIComponent(cloudId)}/wiki`
 }
 
+function metadataServerError(status: number): ConnectorSourceError {
+  return new ConnectorSourceError(
+    `Failed to read Confluence attachment metadata: ${status}`,
+    status,
+    'provider_unavailable'
+  )
+}
+
+function opaqueHeader(response: Response, name: string): string | undefined {
+  const value = response.headers.get(name)
+  return value && OPAQUE_HEADER_VALUE.test(value) ? value : undefined
+}
+
+/** Atlassian support resolves a failure from its trace ID; the raw body may hold secrets and is never logged. */
+async function readServerErrorCodes(response: Response): Promise<string[] | undefined> {
+  const payload = await readBoundedHttpErrorPayload(response)
+  if (!payload.ok) return undefined
+  try {
+    const parsed = atlassianErrorBodySchema.safeParse(JSON.parse(payload.body))
+    return parsed.success
+      ? parsed.data.errors.flatMap((error) => (error.code ? [error.code] : []))
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Metadata reads are idempotent GETs, and Atlassian intermittently answers them
+ * with a bare 500 that the shared transient-status set omits. Raising it inside
+ * the transport lets the shared backoff retry it like a 503. Every 5xx attempt
+ * is logged with Atlassian's trace identifiers; other 5xx responses keep the
+ * shared handling, so their bodies are left for it to read.
+ */
+const METADATA_RETRY_OPTIONS: RetryOptions = {
+  fetcher: async (input, init, transport) => {
+    const response = await transport(input, init)
+    if (response.status < 500) return response
+    const retried = response.status === 500
+    logger.warn('Confluence attachment metadata request failed', {
+      status: response.status,
+      path: new URL(String(input)).pathname,
+      traceId: opaqueHeader(response, 'atl-traceid'),
+      requestId: opaqueHeader(response, 'x-arequestid'),
+      ...(retried ? { errorCodes: await readServerErrorCodes(response) } : {}),
+    })
+    if (!retried) return response
+    throw metadataServerError(response.status)
+  },
+  retryCondition: (error) =>
+    (error instanceof ConnectorSourceError && error.status === 500) || isRetryableError(error),
+}
+
 async function requestMetadata(input: AttachmentRequest, path: string): Promise<Response> {
-  return fetchWithRetry(`${apiBase(input.cloudId)}${path}`, {
-    headers: { Authorization: `Bearer ${input.accessToken}`, Accept: 'application/json' },
-    signal: signalFor(input),
-    redirect: 'error',
-  })
+  return fetchWithRetry(
+    `${apiBase(input.cloudId)}${path}`,
+    {
+      headers: { Authorization: `Bearer ${input.accessToken}`, Accept: 'application/json' },
+      signal: signalFor(input),
+      redirect: 'error',
+    },
+    METADATA_RETRY_OPTIONS
+  )
+}
+
+/** A 5xx that outlasted its retries; aborts and budget timeouts carry no status. */
+function isServerFailure(error: unknown): error is Error & { status: number } {
+  return (
+    error instanceof Error &&
+    'status' in error &&
+    typeof error.status === 'number' &&
+    error.status >= 500 &&
+    error.status <= 599
+  )
 }
 
 async function readMetadata(response: Response): Promise<unknown> {
   if (!response.ok) {
     if (response.status === 401) throw await unauthorizedAttachmentError(response)
     await response.body?.cancel()
+    if (response.status >= 500) throw metadataServerError(response.status)
     throw new Error(
       response.status === 403
         ? 'Confluence attachment access was denied. Check the parent content permissions and the read:attachment:confluence credential scope.'
@@ -210,6 +313,58 @@ function decodeCursor(cursor: string | undefined, totalFetched: unknown): Attach
   return parsed.data
 }
 
+type ParentAttachmentListing =
+  | { ok: true; page: AttachmentPage }
+  | {
+      ok: false
+      status: number
+      reason:
+        | 'attachment_scope_mismatch'
+        | 'attachment_access_denied'
+        | 'attachment_listing_unavailable'
+      error: unknown
+    }
+
+/**
+ * Reads one page of a parent's attachments. Failures scoped to that parent —
+ * a missing scope, denied or deleted content, or a server error that outlasted
+ * its retries — are returned so the caller can skip the parent; anything else
+ * (malformed bodies, rate limits, aborts) still fails the sync.
+ */
+async function listParentAttachmentPage(
+  input: AttachmentRequest,
+  parent: AttachmentParent,
+  cursor: string | undefined
+): Promise<ParentAttachmentListing> {
+  const query = new URLSearchParams({ limit: String(PAGE_SIZE), status: 'current' })
+  if (cursor) query.set('cursor', cursor)
+  let response: Response
+  try {
+    response = await requestMetadata(
+      input,
+      `/api/v2/${parent.type}s/${encodeURIComponent(parent.id)}/attachments?${query}`
+    )
+  } catch (error) {
+    if (!isServerFailure(error)) throw error
+    return { ok: false, status: error.status, reason: 'attachment_listing_unavailable', error }
+  }
+  try {
+    return { ok: true, page: attachmentPageSchema.parse(await readMetadata(response)) }
+  } catch (error) {
+    const { status } = response
+    if (error instanceof ConfluenceAttachmentScopeError) {
+      return { ok: false, status, reason: 'attachment_scope_mismatch', error }
+    }
+    if (status === 403 || status === 404) {
+      return { ok: false, status, reason: 'attachment_access_denied', error }
+    }
+    if (isServerFailure(error)) {
+      return { ok: false, status, reason: 'attachment_listing_unavailable', error }
+    }
+    throw error
+  }
+}
+
 /**
  * Visits attachment metadata beneath the already-filtered parents. The cursor
  * contains only a bounded parent queue, never bodies or binary data. Parent caps
@@ -244,32 +399,39 @@ export async function listConfluenceAttachments(
 
   for (let request = 0; state.parents.length > 0 && request < REQUESTS_PER_CALL; request++) {
     const parent = state.parents[0]
-    const query = new URLSearchParams({ limit: String(PAGE_SIZE), status: 'current' })
-    if (state.attachmentCursor) query.set('cursor', state.attachmentCursor)
-    const response = await requestMetadata(
-      input,
-      `/api/v2/${parent.type}s/${encodeURIComponent(parent.id)}/attachments?${query}`
-    )
-    let page: z.infer<typeof attachmentPageSchema>
-    try {
-      page = attachmentPageSchema.parse(await readMetadata(response))
-    } catch (error) {
-      const missingScope = error instanceof ConfluenceAttachmentScopeError
-      if (!missingScope && response.status !== 403 && response.status !== 404) throw error
+    const listing = await listParentAttachmentPage(input, parent, state.attachmentCursor)
+    if (!listing.ok) {
+      const serverFailure = listing.reason === 'attachment_listing_unavailable'
+      state.serverFailureStreak = serverFailure ? (state.serverFailureStreak ?? 0) + 1 : 0
+      if (serverFailure) {
+        logger.warn('Confluence attachment listing failed after retries', {
+          parentId: parent.id,
+          parentType: parent.type,
+          status: listing.status,
+          consecutiveFailures: state.serverFailureStreak,
+          action:
+            state.serverFailureStreak >= MAX_CONSECUTIVE_SERVER_FAILURES
+              ? 'fail_sync'
+              : 'skip_parent',
+        })
+      }
+      if (state.serverFailureStreak >= MAX_CONSECUTIVE_SERVER_FAILURES) throw listing.error
       state.failures ??= { count: 0, samples: [] }
       state.failures.count += 1
       if (state.failures.samples.length < MAX_LISTING_FAILURE_SAMPLES) {
         state.failures.samples.push({
           scope: parent.id,
           operation: 'confluence.attachments.list',
-          status: response.status,
-          reasons: [missingScope ? 'attachment_scope_mismatch' : 'attachment_access_denied'],
+          status: listing.status,
+          reasons: [listing.reason],
         })
       }
       state.parents.shift()
       state.attachmentCursor = undefined
       continue
     }
+    state.serverFailureStreak = 0
+    const { page } = listing
     for (const attachment of page.results) {
       if (attachment.status !== 'current' || !attachmentMimeType(attachment)) continue
       if (!sameParent(attachmentParent(attachment), parent)) {

From 9073a87328ecb70cfba0bbe65a930c4817d1463e Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Tue, 29 Sep 2026 18:46:16 -0700
Subject: [PATCH 2/4] docs(confluence): list the knowledge base connector's
 service-account scopes, including attachments

---
 .../atlassian-service-account.mdx             | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/apps/docs/content/docs/integrations/atlassian-service-account.mdx b/apps/docs/content/docs/integrations/atlassian-service-account.mdx
index cdd139e837c..4a8aee1dd2e 100644
--- a/apps/docs/content/docs/integrations/atlassian-service-account.mdx
+++ b/apps/docs/content/docs/integrations/atlassian-service-account.mdx
@@ -9,7 +9,7 @@ import { Image } from '@/components/ui/image'
 Use an Atlassian service account for Jira, Jira Service Management, and Confluence workflows. One credential can serve all three products on the same site when its account access and token scopes cover each product.
 
 <Callout type="info">
-Setting up Search? Follow the [Confluence Search service-account guide](/search/confluence#using-a-service-account) for its content and permission scopes. [Jira Search](/search/jira) uses each teammate's OAuth account; a workflow service account does not replace that connection.
+Setting up a Confluence knowledge base connector? Use the [connector scope list](#confluence-knowledge-base-connectors). For Search, follow the [Confluence Search service-account guide](/search/confluence#using-a-service-account). [Jira Search](/search/jira) uses each teammate's OAuth account; a workflow service account does not replace that connection.
 </Callout>
 
 ## Create the account and token
@@ -56,6 +56,28 @@ read:page:confluence
 
 `read:confluence-user` covers the [current-user check](https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-users/#api-wiki-rest-api-user-current-get). The [space picker](https://developer.atlassian.com/cloud/confluence/rest/v2/api-group-space/#api-spaces-get) needs `read:space:confluence`; page reads and the page picker need `read:page:confluence`.
 
+### Confluence knowledge base connectors
+
+A Confluence knowledge base connector reads pages, blog posts, attachments, labels, and the space permissions and page restrictions it mirrors. Its service-account token needs every scope below, not only the Confluence scopes above:
+
+```text
+read:confluence-content.all
+read:page:confluence
+read:blogpost:confluence
+read:attachment:confluence
+read:space:confluence
+read:label:confluence
+search:confluence
+read:confluence-space.summary
+read:content.metadata:confluence
+read:space.permission:confluence
+read:confluence-user
+read:user:confluence
+read:group:confluence
+```
+
+Without `read:attachment:confluence`, pages still sync, but their PDF, Word, Excel, and PowerPoint attachments are not indexed and each sync reports a partial source listing. To fix a token that is missing scopes, create a replacement token with the full list. A credential admin then opens the credential in **Integrations**, selects **Reconnect**, and enters the new token and site domain. Connectors that use the credential keep using it.
+
 ### Workflow actions
 
 Add scopes for the actions your workflow performs:

From c22a623e87a7750f9bf3cd0e7c7e365e3e023b91 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Tue, 29 Sep 2026 18:58:14 -0700
Subject: [PATCH 3/4] fix(confluence): log 5xx trace ids from headers without
 reading the error body

---
 .../connectors/confluence/attachments.test.ts | 14 +++----
 apps/sim/connectors/confluence/attachments.ts | 38 +++----------------
 2 files changed, 12 insertions(+), 40 deletions(-)

diff --git a/apps/sim/connectors/confluence/attachments.test.ts b/apps/sim/connectors/confluence/attachments.test.ts
index 05d97ed71fc..c7102c7ed49 100644
--- a/apps/sim/connectors/confluence/attachments.test.ts
+++ b/apps/sim/connectors/confluence/attachments.test.ts
@@ -285,12 +285,15 @@ describe('Confluence attachment listing', () => {
       }
     }
 
-    it('retries a transient 500 instead of failing the listing', async () => {
+    it.each([
+      ['a complete body', () => 'upstream error'],
+      ['a body that never finishes', () => new ReadableStream<Uint8Array>()],
+    ])('retries a transient 500 with %s instead of failing the listing', async (_, body) => {
       let failed = false
-      listingFails(() => {
-        if (failed) return false
+      fetchMock.mockImplementation(async () => {
+        if (failed) return Response.json({ results: [file({ id: 'p1-file' })] })
         failed = true
-        return true
+        return new Response(body(), { status: 500 })
       })
       const result = await listPastBackoff({ ...INPUT, listParents: parents(['p1']) })
       expect(result.documents.map((doc) => doc.externalId)).toEqual([
@@ -298,7 +301,6 @@ describe('Confluence attachment listing', () => {
         'attachment:page:p1:p1-file',
       ])
       expect(result.listingFailures).toBeUndefined()
-      expect(fetchMock).toHaveBeenCalledTimes(2)
     })
 
     it('skips isolated parents whose listing keeps failing and keeps listing the rest', async () => {
@@ -353,7 +355,6 @@ describe('Confluence attachment listing', () => {
         )
       )
       expect(logged).toContain('5c1f0e2a9b7d4e1f')
-      expect(logged).toContain('INTERNAL_SERVER_ERROR')
       expect(logged).not.toContain('<script>')
       expect(logged).not.toContain('leaked-secret-value')
     })
@@ -365,7 +366,6 @@ describe('Confluence attachment listing', () => {
         await expect(
           listPastBackoff({ ...INPUT, listParents: parents(['p1', 'p2', 'p3', 'p4']) })
         ).rejects.toMatchObject({ status })
-        expect(fetchMock).toHaveBeenCalledTimes(3 * 6)
       }
     )
   })
diff --git a/apps/sim/connectors/confluence/attachments.ts b/apps/sim/connectors/confluence/attachments.ts
index 60622b0ddfd..601c547721f 100644
--- a/apps/sim/connectors/confluence/attachments.ts
+++ b/apps/sim/connectors/confluence/attachments.ts
@@ -82,20 +82,6 @@ const attachmentPageSchema = z.object({
   results: z.array(attachmentSchema).max(250),
   _links: z.object({ next: providerCursor.optional() }).optional(),
 })
-/** Only provider-owned codes are kept from an error body; titles and details are never logged. */
-const atlassianErrorBodySchema = z.object({
-  errors: z
-    .array(
-      z.object({
-        code: z
-          .string()
-          .regex(/^[A-Za-z0-9_.-]{1,64}$/)
-          .optional()
-          .catch(undefined),
-      })
-    )
-    .max(10),
-})
 const OPAQUE_HEADER_VALUE = /^[A-Za-z0-9_.-]{1,128}$/
 const scopeMismatchSchema = z.object({
   code: z.literal(401),
@@ -158,40 +144,26 @@ function opaqueHeader(response: Response, name: string): string | undefined {
   return value && OPAQUE_HEADER_VALUE.test(value) ? value : undefined
 }
 
-/** Atlassian support resolves a failure from its trace ID; the raw body may hold secrets and is never logged. */
-async function readServerErrorCodes(response: Response): Promise<string[] | undefined> {
-  const payload = await readBoundedHttpErrorPayload(response)
-  if (!payload.ok) return undefined
-  try {
-    const parsed = atlassianErrorBodySchema.safeParse(JSON.parse(payload.body))
-    return parsed.success
-      ? parsed.data.errors.flatMap((error) => (error.code ? [error.code] : []))
-      : undefined
-  } catch {
-    return undefined
-  }
-}
-
 /**
  * Metadata reads are idempotent GETs, and Atlassian intermittently answers them
  * with a bare 500 that the shared transient-status set omits. Raising it inside
  * the transport lets the shared backoff retry it like a 503. Every 5xx attempt
- * is logged with Atlassian's trace identifiers; other 5xx responses keep the
- * shared handling, so their bodies are left for it to read.
+ * logs Atlassian's trace identifiers from its headers, which support resolves a
+ * failure from; the body is never read here, so a stalled body cannot consume
+ * the retry budget and no raw payload reaches the logs.
  */
 const METADATA_RETRY_OPTIONS: RetryOptions = {
   fetcher: async (input, init, transport) => {
     const response = await transport(input, init)
     if (response.status < 500) return response
-    const retried = response.status === 500
     logger.warn('Confluence attachment metadata request failed', {
       status: response.status,
       path: new URL(String(input)).pathname,
       traceId: opaqueHeader(response, 'atl-traceid'),
       requestId: opaqueHeader(response, 'x-arequestid'),
-      ...(retried ? { errorCodes: await readServerErrorCodes(response) } : {}),
     })
-    if (!retried) return response
+    if (response.status !== 500) return response
+    await response.body?.cancel()
     throw metadataServerError(response.status)
   },
   retryCondition: (error) =>

From 16c0c90e1d2d0f3cfce190415a091ec2216ebb59 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Tue, 29 Sep 2026 19:09:12 -0700
Subject: [PATCH 4/4] fix(confluence): keep the 500 status when cancelling an
 errored response body

---
 apps/sim/connectors/confluence/attachments.test.ts | 7 +++++++
 apps/sim/connectors/confluence/attachments.ts      | 4 ++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/apps/sim/connectors/confluence/attachments.test.ts b/apps/sim/connectors/confluence/attachments.test.ts
index c7102c7ed49..86a5e00915b 100644
--- a/apps/sim/connectors/confluence/attachments.test.ts
+++ b/apps/sim/connectors/confluence/attachments.test.ts
@@ -288,6 +288,13 @@ describe('Confluence attachment listing', () => {
     it.each([
       ['a complete body', () => 'upstream error'],
       ['a body that never finishes', () => new ReadableStream<Uint8Array>()],
+      [
+        'a body stream that already errored',
+        () =>
+          new ReadableStream<Uint8Array>({
+            start: (controller) => controller.error(new Error('connection reset')),
+          }),
+      ],
     ])('retries a transient 500 with %s instead of failing the listing', async (_, body) => {
       let failed = false
       fetchMock.mockImplementation(async () => {
diff --git a/apps/sim/connectors/confluence/attachments.ts b/apps/sim/connectors/confluence/attachments.ts
index 601c547721f..388e1768c98 100644
--- a/apps/sim/connectors/confluence/attachments.ts
+++ b/apps/sim/connectors/confluence/attachments.ts
@@ -163,7 +163,7 @@ const METADATA_RETRY_OPTIONS: RetryOptions = {
       requestId: opaqueHeader(response, 'x-arequestid'),
     })
     if (response.status !== 500) return response
-    await response.body?.cancel()
+    await response.body?.cancel().catch(() => undefined)
     throw metadataServerError(response.status)
   },
   retryCondition: (error) =>
@@ -196,7 +196,7 @@ function isServerFailure(error: unknown): error is Error & { status: number } {
 async function readMetadata(response: Response): Promise<unknown> {
   if (!response.ok) {
     if (response.status === 401) throw await unauthorizedAttachmentError(response)
-    await response.body?.cancel()
+    await response.body?.cancel().catch(() => undefined)
     if (response.status >= 500) throw metadataServerError(response.status)
     throw new Error(
       response.status === 403