fix(atlassian): share one cached, retrying cloudId resolver across Jira, Confluence, and JSM

[waleedlatif1]

Summary

• Every Jira, Confluence, and JSM tool re-resolved its site cloudId from accessible-resources on each invocation. Four hand-rolled copies of that lookup now read through one memoized resolver in lib/atlassian/discovery.ts
• A transient Atlassian 500 was never retried: the shared predicate covers 429/502/503/504 but not 500, so a single blip failed a whole run. Discovery is an idempotent GET, so it now replays 5xx — scoped to this path rather than widened into the shared predicate, which also guards non-idempotent writes
• The cache stores the promise, not the value, so concurrent blocks join one in-flight lookup and a rejection is evicted instead of pinned for the TTL. Only an exact domain match is retained — a single-site fallback is a property of the calling token, not the domain
• Retry budget is tighter than the shared ~31s default (four attempts across ~3.5s), honors Retry-After, and the request carries a timeout so a wedged fetch can't strand joined callers
• Fixes two defects found on the way: getConfluenceCloudId never checked the response status, so a 500 surfaced as No Confluence resources found (pointing at site permissions rather than the real fault); getAssetsWorkspaceId used a bare fetch with no retry and no cache

Type of Change

• Bug fix

Testing

19 unit tests covering caching, in-flight dedup, reject-eviction, the bounded retry budget, 5xx replay, and the non-retained fallback. Verified each can fail by reverting the behavior it covers. Full apps/sim suite green (22,760), plus type-check, lint, and the boundary/api-validation gates.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 5:09pm

[cursor]

PR Summary

Medium Risk
Touches OAuth-backed discovery for all Atlassian integrations; caching and per-token keys reduce duplicate calls but incorrect keying could leak wrong cloud IDs across tokens—mitigated by tests and hashed credential scoping.

Overview
Introduces lib/atlassian/discovery.ts as the single path for Atlassian site discovery: Jira, Confluence, and JSM no longer each call accessible-resources with duplicated matching logic.

resolveAtlassianCloudId memoizes answers per domain + token (hashed key), dedupes in-flight lookups via promise caching, and evicts failures so errors are not pinned for the TTL. Discovery GETs use a dedicated fetchAtlassianDiscoveryJson path with a tighter retry budget, 5xx + timeout replay (without widening the shared write-safe retry predicate), 5s request timeout, and product-labeled HTTP errors—fixing Confluence’s prior behavior where a 500 could look like “no resources.”

Jira bulk read reuses the dispatcher’s successful discovery response via selectAtlassianCloudId instead of a second fetch. JSM Assets workspace resolution now uses the same discovery fetch/retry/cache pattern instead of a bare fetch.

Adds 19 unit tests for normalization, caching, concurrency, retries, and credential isolation.

^{Reviewed by Cursor Bugbot for commit 15e1008. Configure here.}

[greptile-apps]

Greptile Summary

The PR consolidates Atlassian resource discovery into a credential-scoped, promise-caching resolver with bounded retries and timeout handling.

• Shares cloud-ID resolution across Jira, Confluence, and JSM while isolating cached entries by credential.
• Reuses Jira bulk read’s existing discovery payload instead of issuing a redundant request.
• Adds cached, retrying Assets workspace discovery and comprehensive resolver tests.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/atlassian/discovery.ts	Introduces credential-scoped promise caching, canonical site selection, bounded discovery retries, and explicit timeout retry handling; the prior cache-isolation and timeout issues are addressed.
apps/sim/lib/atlassian/discovery.test.ts	Covers cache reuse, concurrent deduplication, credential isolation, rejection eviction, timeout and 5xx retries, bounded attempts, and site selection.
apps/sim/tools/jira/bulk_read.ts	Selects the cloud ID from the dispatcher’s existing successful accessible-resources payload, removing the previously reported redundant lookup.
apps/sim/tools/jsm/utils.ts	Moves Assets workspace discovery onto the shared retrying JSON helper and a credential-scoped promise cache.
apps/sim/tools/jira/utils.ts	Delegates Jira cloud-ID discovery to the shared resolver without changing the public helper contract.
apps/sim/tools/confluence/utils.ts	Delegates Confluence discovery and domain normalization to shared helpers while correctly surfacing non-OK discovery responses.

Sequence Diagram

sequenceDiagram
participant Tool as Jira / Confluence / JSM Tool
participant Cache as Credential-scoped Discovery Cache
participant Resolver as Atlassian Discovery Resolver
participant API as Atlassian API
Tool->>Cache: Resolve resource + token digest
alt Cached or in flight
Cache-->>Tool: Shared promise result
else Cache miss
Cache->>Resolver: Start discovery
Resolver->>API: GET accessible resources
alt Timeout or transient 5xx
Resolver->>API: Retry within bounded budget
end
API-->>Resolver: Resource list
Resolver-->>Cache: Selected cloud ID
Cache-->>Tool: Result
end

Loading

_{Reviews (3): Last reviewed commit: "fix(jira): treat an empty bulk-read clou..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 9173ccb. Configure here.}