fix(agiloft): fail loudly on non-EWREST bodies and keep the retired tool resolvable

- EWSearch and EWSelect report an empty result set as `EWREST_id_length = '0';`,
  so a body with no assignments at all is a refusal Agiloft returned with HTTP
  200, not an empty result. Both routes now surface it as an error instead of a
  successful empty list.
- Re-register agiloft_saved_search as a retired tool. Removing it outright left
  workflows saved with operation='saved_search' deriving a tool id the registry
  no longer provided, which throws "Tool not found" at execution. It now fails
  through directExecution with a message pointing at the Search Records
  operation's Saved Search field, without issuing an undocumented request. It
  stays out of the operation dropdown so it cannot be chosen for new blocks.
- Guard EWCreate and EWUpdate against oversized record data. Those operations
  carry field values in the query string, so a large payload hits the request
  line limit; the tool now explains that rather than surfacing an opaque 414.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/agiloft.mdx

@@ -280,6 +280,30 @@ Run an action button on an Agiloft record, such as an approval or send-for-signa
 | `recordId` | string | ID of the record the action button was run on |
 | `callbackId` | string | Callback identifier for the asynchronous run, which Agiloft returns as EWCALLBACK_ID |
 
+### saved_search
+
+
+### Agiloft Saved Search (retired)
+
+Retired. Agiloft does not document an endpoint for listing saved searches — use the Search Records operation and set its Saved Search field instead.
+
+#### Input
+
+| Parameter | Type | Required | Description |
+| --------- | ---- | -------- | ----------- |
+| `instanceUrl` | string | No | Agiloft instance URL |
+| `knowledgeBase` | string | No | Knowledge base name |
+| `login` | string | No | Agiloft username |
+| `password` | string | No | Agiloft password |
+| `table` | string | No | Table name |
+| `output` | string | No | No description |
+
+#### Output
+
+| Parameter | Type | Description |
+| --------- | ---- | ----------- |
+| `searches` | array | Always empty; this operation is retired |
+
 ### Agiloft Search Records
 
 Search for records in an Agiloft table using a query.

apps/sim/app/api/tools/agiloft/create_record/route.test.ts

@@ -12,6 +12,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
 
 import { POST } from '@/app/api/tools/agiloft/create_record/route'
+import { POST as SEARCH } from '@/app/api/tools/agiloft/search_records/route'
+import { POST as SELECT } from '@/app/api/tools/agiloft/select_records/route'
 
 const PINNED_IP = '93.184.216.34'
 
@@ -99,3 +101,76 @@ describe('POST /api/tools/agiloft/create_record', () => {
     expect(inputValidationMockFns.mockSecureFetchWithPinnedIP).not.toHaveBeenCalled()
   })
 })
+
+describe('empty EWREST bodies on search and select', () => {
+  const listBase = {
+    instanceUrl: 'https://example.agiloft.com',
+    knowledgeBase: 'Demo',
+    login: 'admin',
+    password: 'secret',
+    table: 'helpdesk_case',
+  }
+
+  function arrange(text: string) {
+    inputValidationMockFns.mockSecureFetchWithPinnedIP
+      .mockResolvedValueOnce(mockSecureFetchResponse({ json: { access_token: 'tok' } }))
+      .mockResolvedValueOnce(mockSecureFetchResponse({ text }))
+      .mockResolvedValueOnce(mockSecureFetchResponse({}))
+  }
+
+  it('treats a plain-text refusal from EWSearch as a failure, not an empty result', async () => {
+    arrange('Error executing query, please consult logs')
+
+    const response = await SEARCH(
+      createMockRequest('POST', { ...listBase, query: "priority='High'" })
+    )
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('did not return search results')
+  })
+
+  it('still reports a genuinely empty EWSearch result as a success', async () => {
+    arrange("EWREST_id_length = '0';")
+
+    const response = await SEARCH(
+      createMockRequest('POST', { ...listBase, query: "priority='High'" })
+    )
+    const data = (await response.json()) as {
+      success: boolean
+      output: { records: unknown[]; totalCount: number }
+    }
+
+    expect(data.success).toBe(true)
+    expect(data.output.records).toEqual([])
+    expect(data.output.totalCount).toBe(0)
+  })
+
+  it('treats a plain-text refusal from EWSelect as a failure, not an empty result', async () => {
+    arrange('Error executing query, please consult logs')
+
+    const response = await SELECT(
+      createMockRequest('POST', { ...listBase, where: "summary like '%new%'" })
+    )
+    const data = (await response.json()) as { success: boolean; error?: string }
+
+    expect(data.success).toBe(false)
+    expect(data.error).toContain('did not return a result set')
+  })
+
+  it('still reports a genuinely empty EWSelect result as a success', async () => {
+    arrange("EWREST_id_length = '0';")
+
+    const response = await SELECT(
+      createMockRequest('POST', { ...listBase, where: "summary like '%new%'" })
+    )
+    const data = (await response.json()) as {
+      success: boolean
+      output: { recordIds: string[]; totalCount: number }
+    }
+
+    expect(data.success).toBe(true)
+    expect(data.output.recordIds).toEqual([])
+    expect(data.output.totalCount).toBe(0)
+  })
+})

apps/sim/app/api/tools/agiloft/create_record/route.ts

@@ -8,7 +8,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseEwRest, toRecord } from '@/tools/agiloft/ewrest'
 import type { AgiloftRecordResponse } from '@/tools/agiloft/types'
-import { buildCreateRecordUrl } from '@/tools/agiloft/utils'
+import { buildCreateRecordUrl, recordUrlLengthError } from '@/tools/agiloft/utils'
 import { executeAgiloftRequest } from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
@@ -65,6 +65,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       })
     }
 
+    const oversized = recordUrlLengthError(params.instanceUrl, (base) =>
+      buildCreateRecordUrl(base, params, fieldValues)
+    )
+    if (oversized) {
+      return NextResponse.json({
+        success: false,
+        output: { id: null, fields: {} },
+        error: oversized,
+      })
+    }
+
     const result = await executeAgiloftRequest<AgiloftRecordResponse>(
       params,
       (base) => ({

apps/sim/app/api/tools/agiloft/search_records/route.ts

@@ -71,10 +71,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
         /**
          * EWSearch answers with EWREST_length plus one EWREST_<field>_<index>
-         * assignment per field per row. An empty result set is reported as
-         * EWREST_id_length = '0'.
+         * assignment per field per row, and reports an empty result set as
+         * EWREST_id_length = '0'. A body with no assignments at all is therefore
+         * never a legitimate empty search — it is a refusal Agiloft returned
+         * with HTTP 200, such as an invalid query or an unknown saved search.
          */
-        const { records, count } = toSearchRecords(parseEwRest(body))
+        const values = parseEwRest(body)
+        if (values.size === 0) {
+          return {
+            success: false,
+            output: { records: [], totalCount: 0, page, limit },
+            error: `Agiloft did not return search results: ${body.trim() || '(empty response)'}`,
+          }
+        }
+
+        const { records, count } = toSearchRecords(values)
 
         return {
           success: true,

apps/sim/app/api/tools/agiloft/select_records/route.ts

@@ -69,9 +69,21 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
         /**
          * EWSelect answers with EWREST_id_length followed by one EWREST_id_<n>
-         * assignment per match. Zero matches yields the length line alone.
+         * assignment per match, and zero matches still yields the length line.
+         * A body with no assignments at all is therefore never a legitimate
+         * empty result — it is a refusal Agiloft returned with HTTP 200, most
+         * often invalid WHERE-clause SQL.
          */
-        const { recordIds, count } = toRecordIds(parseEwRest(body))
+        const values = parseEwRest(body)
+        if (values.size === 0) {
+          return {
+            success: false,
+            output: { recordIds: [], totalCount: 0 },
+            error: `Agiloft did not return a result set: ${body.trim() || '(empty response)'}`,
+          }
+        }
+
+        const { recordIds, count } = toRecordIds(values)
 
         return { success: true, output: { recordIds, totalCount: count } }
       }

apps/sim/app/api/tools/agiloft/update_record/route.ts

@@ -8,7 +8,7 @@ import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseEwRest, toRecord } from '@/tools/agiloft/ewrest'
 import type { AgiloftRecordResponse } from '@/tools/agiloft/types'
-import { buildUpdateRecordUrl } from '@/tools/agiloft/utils'
+import { buildUpdateRecordUrl, recordUrlLengthError } from '@/tools/agiloft/utils'
 import { executeAgiloftRequest } from '@/tools/agiloft/utils.server'
 
 export const dynamic = 'force-dynamic'
@@ -65,6 +65,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       })
     }
 
+    const oversized = recordUrlLengthError(params.instanceUrl, (base) =>
+      buildUpdateRecordUrl(base, params, fieldValues)
+    )
+    if (oversized) {
+      return NextResponse.json({
+        success: false,
+        output: { id: null, fields: {} },
+        error: oversized,
+      })
+    }
+
     const result = await executeAgiloftRequest<AgiloftRecordResponse>(
       params,
       (base) => ({

apps/sim/blocks/blocks/agiloft.ts

@@ -409,6 +409,8 @@ export const AgiloftBlock: BlockConfig = {
       'agiloft_remove_attachment',
       'agiloft_retrieve_attachment',
       'agiloft_run_action_button',
+      // Retired, but retained so blocks saved with operation='saved_search' still resolve.
+      'agiloft_saved_search',
       'agiloft_search_records',
       'agiloft_select_records',
       'agiloft_update_record',
@@ -525,7 +527,7 @@ export const AgiloftBlock: BlockConfig = {
     },
     recordId: {
       type: 'string',
-      description: 'ID of the record the file operation was performed on',
+      description: 'ID of the record the operation was performed on',
       condition: {
         field: 'operation',
         value: ['attach_file', 'remove_attachment', 'run_action_button'],

apps/sim/tools/agiloft/index.ts

@@ -8,6 +8,7 @@ export { agiloftReadRecordTool } from '@/tools/agiloft/read_record'
 export { agiloftRemoveAttachmentTool } from '@/tools/agiloft/remove_attachment'
 export { agiloftRetrieveAttachmentTool } from '@/tools/agiloft/retrieve_attachment'
 export { agiloftRunActionButtonTool } from '@/tools/agiloft/run_action_button'
+export { agiloftSavedSearchTool } from '@/tools/agiloft/saved_search'
 export { agiloftSearchRecordsTool } from '@/tools/agiloft/search_records'
 export { agiloftSelectRecordsTool } from '@/tools/agiloft/select_records'
 export * from '@/tools/agiloft/types'

apps/sim/tools/agiloft/saved_search.test.ts

@@ -0,0 +1,20 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { agiloftSavedSearchTool } from '@/tools/agiloft/saved_search'
+import toolIds from '@/tools/generated/tool-ids'
+
+describe('retired agiloft_saved_search', () => {
+  it('keeps its id registered so workflows saved with that operation still resolve a tool', () => {
+    expect(toolIds).toContain('agiloft_saved_search')
+    expect(agiloftSavedSearchTool.id).toBe('agiloft_saved_search')
+  })
+
+  it('fails with a migration hint instead of calling an undocumented endpoint', async () => {
+    const result = await agiloftSavedSearchTool.directExecution?.({})
+
+    expect(result?.success).toBe(false)
+    expect(result?.error).toContain('Search Records')
+  })
+})

apps/sim/tools/agiloft/saved_search.ts

@@ -0,0 +1,88 @@
+import type { AgiloftSavedSearchParams, AgiloftSavedSearchResponse } from '@/tools/agiloft/types'
+import type { ToolConfig } from '@/tools/types'
+
+/**
+ * Retired operation, kept registered so workflows saved while it was offered
+ * still resolve a tool instead of failing with "Tool not found".
+ *
+ * `EWSavedSearch` appears in Agiloft's Scope Parameter operation list, so the
+ * endpoint exists, but it has no documentation page — neither its URL
+ * parameters nor its response shape can be verified. The previous
+ * implementation guessed both and could only ever report an empty list, which
+ * reads as "this table has no saved searches". Running a saved search is now
+ * supported for real through the Search Records operation's Saved Search
+ * field, so this fails fast and points there rather than issuing a request
+ * whose behavior nobody can predict.
+ */
+export const agiloftSavedSearchTool: ToolConfig<
+  AgiloftSavedSearchParams,
+  AgiloftSavedSearchResponse
+> = {
+  id: 'agiloft_saved_search',
+  name: 'Agiloft Saved Search (retired)',
+  description:
+    'Retired. Agiloft does not document an endpoint for listing saved searches — use the Search Records operation and set its Saved Search field instead.',
+  version: '1.0.0',
+
+  params: {
+    instanceUrl: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description: 'Agiloft instance URL',
+    },
+    knowledgeBase: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description: 'Knowledge base name',
+    },
+    login: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description: 'Agiloft username',
+    },
+    password: {
+      type: 'string',
+      required: false,
+      visibility: 'user-only',
+      description: 'Agiloft password',
+    },
+    table: {
+      type: 'string',
+      required: false,
+      visibility: 'user-or-llm',
+      description: 'Table name',
+    },
+  },
+
+  /** Fails without a network call — there is no endpoint we can correctly call. */
+  directExecution: async () => ({
+    success: false,
+    output: { searches: [] },
+    error:
+      'The Agiloft "Saved Search" operation has been retired because Agiloft does not document an endpoint for listing saved searches. Switch this block to the "Search Records" operation and enter the saved search name in its Saved Search field.',
+  }),
+
+  request: {
+    url: () => '/api/tools/agiloft/search_records',
+    method: 'POST',
+    headers: () => ({ 'Content-Type': 'application/json' }),
+    body: () => ({}),
+  },
+
+  transformResponse: async () => ({
+    success: false,
+    output: { searches: [] },
+    error: 'The Agiloft "Saved Search" operation has been retired.',
+  }),
+
+  outputs: {
+    searches: {
+      type: 'array',
+      description: 'Always empty; this operation is retired',
+      items: { type: 'object' },
+    },
+  },
+}