fix(executor): skip Response block formatting for internal JWT callers

[waleedlatif1]

Summary

• Root cause: When a child workflow has a Response block, createHttpResponseFromBlock() returns raw user-defined data (e.g. {issues: []}) instead of the standard {success, executionId, output, metadata} wrapper. The executor tool's transformResponse does data?.success ?? false, which evaluates to false for Response block payloads → all LLM providers interpret this as failure.
• Fix: Skip Response block formatting when auth.authType === AuthType.INTERNAL_JWT — Response blocks are designed for external API consumers, not internal workflow-to-workflow calls. The auth type check is placed first for short-circuit efficiency (cheap string comparison before expensive log iteration).
• Cleanup: Extract AuthType constants (SESSION, API_KEY, INTERNAL_JWT) from magic strings across all auth type comparisons in the codebase (11 files).

Test plan

• All 27 executor tool tests pass (bunx vitest run tools/workflow/executor.test.ts)
• TypeScript compiles cleanly (bunx tsc --noEmit)
• Lint/format passes (pre-commit hooks)
• Manual: Create a workflow with a Response block, call it from an Agent block — should succeed
• Manual: Call the same workflow via API key — should still return Response block format

[cursor]

PR Summary

Medium Risk
Changes the execution API response shaping based on auth type and refactors auth-type comparisons across many routes/tests to use new AuthType constants; mistakes here could alter authorization branches or response formats for API/session/JWT callers.

Overview
Fixes workflow execution for internal JWT callers by skipping Response block HTTP formatting in POST /api/workflows/[id]/execute, ensuring internal executions always return the standard { success, executionId, output, metadata } wrapper.

Introduces AuthType constants in lib/auth/hybrid and replaces string literal auth-type checks across several API routes (A2A, MCP serve, OAuth token, KB tag definitions, resume, usage limits, workflow routes) and associated tests; testing utilities now export AuthTypeMock, and new tests cover Response-block gating and workflow_executor tool response parsing.

^{Written by Cursor Bugbot for commit abf0881. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Mar 12, 2026 11:51pm

[greptile-apps]

Greptile Summary

This PR fixes a bug where child workflows containing a Response block would cause parent Agent block calls to misinterpret a successful execution as a failure. It also performs a codebase-wide cleanup replacing magic auth-type strings with a typed AuthType constant object.

• Root cause fixed: createHttpResponseFromBlock was being called for all callers, returning raw user-defined data instead of the {success, executionId, output, metadata} envelope that the executor tool's transformResponse expects. The new guard (auth.authType !== AuthType.INTERNAL_JWT) correctly bypasses Response block formatting for internal workflow-to-workflow calls.
• AuthType constants introduced in apps/sim/lib/auth/hybrid.ts as a const object with AuthTypeValue union type; all 11 affected files are updated to use them.
• New tests in response-block.test.ts validate workflowHasResponseBlock, createHttpResponseFromBlock, and the conditional logic mirroring route.ts for all three auth types.
• AuthTypeMock is added to packages/testing and injected into every existing vi.mock('@/lib/auth/hybrid', ...) factory so the constants are available inside mocked modules.
• One minor inconsistency: setAuthenticated in hybrid-auth.mock.ts still uses the hardcoded string 'session' for authType instead of AuthTypeMock.SESSION.

Confidence Score: 5/5

• Safe to merge — the fix is minimal, correctly scoped, and backward-compatible for all external callers.
• The core change is a single-line guard that only affects the code path taken for INTERNAL_JWT callers; all other callers (API key, session, public API) continue to receive Response block formatting unchanged. The AuthType constant refactor is purely mechanical with no behavioral change. The only finding is a trivial style inconsistency in a test helper.
• No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/lib/auth/hybrid.ts	Introduces the AuthType const-object and AuthTypeValue union type; replaces all internal magic string literals with the constants. Clean, type-safe refactor.
apps/sim/app/api/workflows/[id]/execute/route.ts	Core fix: gates createHttpResponseFromBlock behind auth.authType !== AuthType.INTERNAL_JWT so child workflow calls from the executor tool always receive the standard {success, executionId, output, metadata} envelope. Also migrates all remaining magic string comparisons to AuthType constants.
apps/sim/app/api/workflows/[id]/execute/response-block.test.ts	New test file verifying the Response block gating logic. Tests confirm the utility functions and the boolean condition that mirrors route.ts, covering INTERNAL_JWT, API_KEY, and SESSION auth types, plus status code passthrough.
packages/testing/src/mocks/hybrid-auth.mock.ts	Adds AuthTypeMock const-object (mirroring AuthType from hybrid.ts) and exports it so test mock factories can reference typed constants. The setAuthenticated helper still uses a hardcoded 'session' string instead of AuthTypeMock.SESSION.
apps/sim/lib/auth/credential-access.ts	Migrates three auth.authType === 'internal_jwt' comparisons to AuthType.INTERNAL_JWT; also strengthens the authType property type in CredentialAccessResult to use `typeof AuthType.SESSION
apps/sim/tools/workflow/executor.test.ts	Adds 7 new transformResponse unit tests covering standard success/failure payloads, missing fields, duration extraction, and workflowId/name passthrough.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[POST /api/workflows/id/execute] --> B[checkHybridAuth]
B --> C{auth.authType?}
C -->|INTERNAL_JWT| D[executeWorkflowCore]
C -->|API_KEY| E[executeWorkflowCore]
C -->|SESSION| F[executeWorkflowCore]
C -->|Public API| G[executeWorkflowCore]
D --> H{workflowHasResponseBlock?}
E --> I{workflowHasResponseBlock?}
F --> J{workflowHasResponseBlock?}
G --> K{workflowHasResponseBlock?}
H -->|true| L[SKIP — return standard wrapper\nsuccess + executionId + output + metadata]
H -->|false| L
I -->|true| M[createHttpResponseFromBlock\nraw user-defined data]
I -->|false| N[return standard wrapper]
J -->|true| M
J -->|false| O[return standard wrapper]
K -->|true| M
K -->|false| P[return standard wrapper]
style L fill:#90EE90
style M fill:#FFD700

Loading

Comments Outside Diff (1)

1. packages/testing/src/mocks/hybrid-auth.mock.ts, line 72 (link)

   Hardcoded magic string inconsistent with PR goal

   The setAuthenticated helper still uses a hardcoded 'session' string literal for authType, which is exactly the pattern this PR is eliminating everywhere else. It should reference AuthTypeMock.SESSION for consistency and to benefit from the same refactor-safety the constants provide.

_{Last reviewed commit: abf0881}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR