fix(agiloft): resolve the instance once so pre-send failures stay pre-flight

Review finding. The create route resolves the instance URL itself to keep a
rejected host on the pre-flight side of the line, but executeEwRequest then
resolved it a second time before sending. A DNS failure on that second lookup
never sent the create, yet every throw out of the executor was reported as an
unconfirmed write that must not be retried - telling the caller a record might
exist when nothing had been transmitted.

The resolved IP is now handed down, so there is exactly one resolution and
everything after it is genuinely post-transmit. It also drops the duplicate
DNS lookup the two-resolve arrangement was paying for.

Author: mzxchandra

apps/sim/app/api/tools/agiloft/create_record/route.test.ts

@@ -269,6 +269,36 @@ describe('EWCreate', () => {
     expect(data.output.id).toBeNull()
   })
 
+  /**
+   * A rejected instance URL is decided before anything is sent, so it must not
+   * come back wearing the do-not-retry warning. The route resolves the instance
+   * itself and hands the result down, so there is exactly one resolution and
+   * everything after it is genuinely post-transmit.
+   */
+  it('reports a rejected instance URL as a pre-flight failure, not an unconfirmed write', async () => {
+    inputValidationMockFns.mockValidateUrlWithDNS.mockResolvedValueOnce({
+      isValid: false,
+      error: 'URL resolves to a private IP address',
+    })
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(response.status).toBe(400)
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('private IP')
+    expect(data.error).not.toContain('may exist')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+
+  it('resolves the instance once, so a DNS failure cannot land on the wrong side of the line', async () => {
+    arrangeCreate(res({ text: "EWREST_id='353';" }))
+
+    await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+
+    expect(inputValidationMockFns.mockValidateUrlWithDNS).toHaveBeenCalledTimes(1)
+  })
+
   /**
    * The request was already on the wire, so the write may have committed. A 500
    * here is what would have the caller retry and duplicate the record.

apps/sim/app/api/tools/agiloft/create_record/route.ts

@@ -103,8 +103,9 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      * URL stays a pre-flight failure. Everything thrown after this point has to
      * be treated as "the request may have been transmitted".
      */
+    let resolvedIP: string
     try {
-      await resolveAgiloftInstance(params.instanceUrl)
+      resolvedIP = await resolveAgiloftInstance(params.instanceUrl)
     } catch (error) {
       logger.warn(`[${requestId}] Rejected Agiloft instance URL`, { error })
       return NextResponse.json(
@@ -207,7 +208,8 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
           }
 
           return { success: true, output: { id, fields } }
-        }
+        },
+        resolvedIP
       )
     } catch (error) {
       /**

apps/sim/tools/agiloft/utils.server.ts

@@ -331,9 +331,16 @@ export async function executeAlrestRequest<R extends ToolResponse>(
 export async function executeEwRequest<R extends ToolResponse>(
   params: AgiloftCredentials,
   buildRequest: (base: string) => AgiloftRequestConfig,
-  transformResponse: (response: SecureFetchResponse) => Promise<R>
+  transformResponse: (response: SecureFetchResponse) => Promise<R>,
+  preResolvedIP?: string
 ): Promise<R> {
-  const resolvedIP = await resolveAgiloftInstance(params.instanceUrl)
+  /**
+   * A write caller resolves the instance itself so it can tell a rejected host
+   * (nothing sent) from a failure after the request went out (the write may
+   * have landed). Resolving a second time here would put a DNS failure on the
+   * wrong side of that line, so the caller's already-validated IP is reused.
+   */
+  const resolvedIP = preResolvedIP ?? (await resolveAgiloftInstance(params.instanceUrl))
   const req = buildRequest(params.instanceUrl.replace(/\/$/, ''))
   const response = await secureFetchWithPinnedIP(req.url, resolvedIP, {
     method: req.method,