fix(agiloft): stop retrying refusals, and expose the outputs the new …

…operations return Five findings from review that had gone unanswered. An Agiloft refusal was surfacing as HTTP 500. readAlrestJson throws when the envelope reports success:false, the route catch mapped that to 500, and the tool runner retries 500s — so a create the server had already rejected could be retried and duplicate the record. Refusals now return a settled failure with the message intact; genuine faults still 500. list_tables could not run in its primary mode. EWTable is knowledge-base scoped, but some instances reject EWLogin without a $table, so whole-knowledge-base discovery failed at login with nothing to fall back to. It now says what the caller can do about it rather than surfacing the raw login error. Upsert corrupted structured values. Every field went through String(), so a multi-value field collapsed into one joined string instead of the documented repeated key/value pairs, and an object silently wrote "[object Object]" into the record. Arrays now encode as repeated pairs and objects are refused, since Agiloft documents no encoding for them. Two outputs were invisible in the editor. `records` was conditioned on search_records alone, so natural language search results could not be chained, and `callbackId` on run_action_button alone, so a queued upsert's callback could not be wired into Async Status even though both values exist at runtime.
waleedlatif1 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026 · Aug 11, 2026
commit 0aba13d76deed103db6ff4c6bd87ae2ccbb57736
diff --git a/apps/sim/app/api/tools/agiloft/create_record/route.test.ts b/apps/sim/app/api/tools/agiloft/create_record/route.test.ts
@@ -551,3 +551,81 @@ describe('review round 2 fixes', () => {
     expect(data.output.id).toBe('123')
   })
 })
+
+describe('review round 3 fixes', () => {
+  it('reports an Agiloft refusal as a non-retryable failure, not a 500', async () => {
+    arrange(
+      res({ json: { success: false, errors: [{ message: 'Field contract_title1 is required' }] } })
+    )
+
+    const response = await POST(createMockRequest('POST', { ...baseBody, data: '{"a":"b"}' }))
+
+    /**
+     * The tool runner retries 500s, and retrying a refused create can duplicate
+     * a record — a refusal must come back as a settled failure.
+     */
+    expect(response.status).toBe(200)
+    const data = (await response.json()) as { success: boolean; error?: string }
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('Field contract_title1 is required')
+  })
+
+  it('tells the user what to do when EWTable login needs a table', async () => {
+    const { POST: LIST } = await import('@/app/api/tools/agiloft/list_tables/route')
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+      res({
+        ok: false,
+        status: 400,
+        text: 'EWWrongDataException has occurred: One has to specify $table, $KB, $lang parameters',
+      })
+    )
+
+    const response = await LIST(
+      createMockRequest('POST', {
+        instanceUrl: baseBody.instanceUrl,
+        knowledgeBase: baseBody.knowledgeBase,
+        login: baseBody.login,
+        password: baseBody.password,
+      })
+    )
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('requires a table name to authenticate')
+  })
+
+  it('encodes a multi-value upsert field as repeated pairs, not a joined string', async () => {
+    const { POST: UPSERT } = await import('@/app/api/tools/agiloft/upsert_record/route')
+    inputValidationMockFns.mockSecureFetchWithPinnedIP.mockResolvedValueOnce(
+      res({ status: 200, text: "EWREST_id='353';" })
+    )
+
+    await UPSERT(
+      createMockRequest('POST', {
+        ...baseBody,
+        match: 'ext_id',
+        data: '{"contactMethod":["phone","email"]}',
+      })
+    )
+
+    const body = inputValidationMockFns.mockSecureFetchWithPinnedIP.mock.calls[0][2].body as string
+    expect(new URLSearchParams(body).getAll('contactMethod')).toEqual(['phone', 'email'])
+  })
+
+  it('refuses an object field value rather than writing [object Object]', async () => {
+    const { POST: UPSERT } = await import('@/app/api/tools/agiloft/upsert_record/route')
+
+    const response = await UPSERT(
+      createMockRequest('POST', {
+        ...baseBody,
+        match: 'ext_id',
+        data: '{"nested":{"a":1}}',
+      })
+    )
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('has no encoding for')
+    expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
+  })
+})
diff --git a/apps/sim/app/api/tools/agiloft/create_record/route.ts b/apps/sim/app/api/tools/agiloft/create_record/route.ts
@@ -8,7 +8,11 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftRecordResponse } from '@/tools/agiloft/types'
 import { alrestRecordCollectionUrl } from '@/tools/agiloft/utils'
-import { executeAlrestRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAlrestRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -98,6 +102,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { id: null, fields: {} },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error creating Agiloft record:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/delete_record/route.ts b/apps/sim/app/api/tools/agiloft/delete_record/route.ts
@@ -8,7 +8,11 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftDeleteResponse } from '@/tools/agiloft/types'
 import { alrestDeleteRecordUrl } from '@/tools/agiloft/utils'
-import { executeAlrestRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAlrestRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -73,6 +77,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { id: '', deleted: false },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error deleting Agiloft record:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/list_tables/route.ts b/apps/sim/app/api/tools/agiloft/list_tables/route.ts
@@ -6,9 +6,17 @@ import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import type { AgiloftListTablesResponse, AgiloftTableField } from '@/tools/agiloft/types'
+import type {
+  AgiloftListTablesParams,
+  AgiloftListTablesResponse,
+  AgiloftTableField,
+} from '@/tools/agiloft/types'
 import { buildListTablesUrl } from '@/tools/agiloft/utils'
-import { executeAgiloftRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAgiloftRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -34,6 +42,7 @@ interface EwTableResult {
 
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const requestId = generateRequestId()
+  let params: AgiloftListTablesParams | undefined
 
   try {
     const authResult = await checkInternalAuth(request, { requireWorkflowId: false })
@@ -65,13 +74,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
     )
     if (!parsed.success) return parsed.response
-    const params = parsed.data.body
+    const listParams = parsed.data.body
+    params = listParams
 
     /** EWTable must run under EWLogin or OAuth authorization. */
     const result = await executeAgiloftRequest<AgiloftListTablesResponse>(
-      params,
+      listParams,
       (base) => ({
-        url: buildListTablesUrl(base, params),
+        url: buildListTablesUrl(base, listParams),
         method: 'GET',
         headers: { Accept: 'application/json' },
       }),
@@ -108,6 +118,33 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    /**
+     * EWTable is knowledge-base scoped, but some instances reject EWLogin
+     * without a $table. When that happens there is nothing to fall back to, so
+     * say what the caller can actually do about it.
+     */
+    if (!params?.table && /\$table/.test(toError(error).message)) {
+      return NextResponse.json({
+        success: false,
+        output: { tables: [], totalCount: 0 },
+        error:
+          'This Agiloft instance requires a table name to authenticate. Put any known table in the Table field — it also narrows the result to that table.',
+      })
+    }
+
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { tables: [], totalCount: 0 },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error listing Agiloft tables:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/read_record/route.ts b/apps/sim/app/api/tools/agiloft/read_record/route.ts
@@ -11,6 +11,7 @@ import { alrestRecordUrl, alrestSearchUrl, parseFieldList } from '@/tools/agilof
 import {
   type AgiloftRequestConfig,
   executeAlrestRequest,
+  isAgiloftRefusal,
   readAlrestJson,
 } from '@/tools/agiloft/utils.server'
 
@@ -138,6 +139,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { id: null, fields: {} },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error reading Agiloft record:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/saved_search/route.ts b/apps/sim/app/api/tools/agiloft/saved_search/route.ts
@@ -8,7 +8,11 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftSavedSearchResponse } from '@/tools/agiloft/types'
 import { buildSavedSearchUrl } from '@/tools/agiloft/utils'
-import { executeAgiloftRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAgiloftRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -84,6 +88,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { searches: [], totalCount: 0 },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error listing Agiloft saved searches:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/search_records/route.ts b/apps/sim/app/api/tools/agiloft/search_records/route.ts
@@ -9,7 +9,11 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftSearchResponse } from '@/tools/agiloft/types'
 import { AGILOFT_MAX_SEARCH_RECORDS, alrestSearchUrl, parseFieldList } from '@/tools/agiloft/utils'
-import { executeAlrestRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAlrestRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -95,6 +99,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { records: [], totalCount: 0, page: 0, limit: 0, truncated: false },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error searching Agiloft records:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/update_record/route.ts b/apps/sim/app/api/tools/agiloft/update_record/route.ts
@@ -8,7 +8,11 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import type { AgiloftRecordResponse } from '@/tools/agiloft/types'
 import { alrestRecordUrl } from '@/tools/agiloft/utils'
-import { executeAlrestRequest, readAlrestJson } from '@/tools/agiloft/utils.server'
+import {
+  executeAlrestRequest,
+  isAgiloftRefusal,
+  readAlrestJson,
+} from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
 
@@ -85,6 +89,19 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     return NextResponse.json(result)
   } catch (error) {
+    /**
+     * A refusal Agiloft already decided on is a final answer, not a transient
+     * fault — returning 500 would make the tool runner retry it.
+     */
+    if (isAgiloftRefusal(error)) {
+      logger.warn(`[${requestId}] Agiloft refused the request`, { error: error.message })
+      return NextResponse.json({
+        success: false,
+        output: { id: null, fields: {} },
+        error: error.message,
+      })
+    }
+
     logger.error(`[${requestId}] Error updating Agiloft record:`, error)
 
     return NextResponse.json({ success: false, error: toError(error).message }, { status: 500 })

diff --git a/apps/sim/app/api/tools/agiloft/upsert_record/route.ts b/apps/sim/app/api/tools/agiloft/upsert_record/route.ts
@@ -69,13 +69,24 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       })
     }
 
+    let body: string
+    try {
+      body = buildUpsertRecordBody(params, fieldValues)
+    } catch (error) {
+      return NextResponse.json({
+        success: false,
+        output: { id: null, created: false, callbackId: null },
+        error: toError(error).message,
+      })
+    }
+
     const result = await executeEwRequest<AgiloftUpsertRecordResponse>(
       params,
       (base) => ({
         url: buildUpsertRecordUrl(base),
         method: 'POST',
         headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        body: buildUpsertRecordBody(params, fieldValues),
+        body,
       }),
       async (response) => {
         const body = await response.text()