fix(flow): validate and coerce Execute JavaScript step values against custom field types (#997)

* fix(flow): validate and coerce Execute JavaScript step values against custom field types

Execute JavaScript's output is now validated against the target output
custom field's declared type before being persisted, instead of always
writing the raw returned value as text. Input custom fields passed into
the sandbox are coerced to match their declared type (number/boolean)
so JS arithmetic and comparisons behave numerically instead of as
string concatenation. Shared normalizer logic is extracted into
@chatbotx.io/business/javascript-execution and re-exported for the CSV
import validator that used the same rules.

* chore(worker): remove redundant custom-field-value re-export shim

The import handler now imports validateCustomFieldValue directly from
@chatbotx.io/business/javascript-execution instead of hopping through a
one-line re-export left behind by the prior Execute JavaScript refactor.

Author: realcodesiman

apps/worker/__tests__/custom-field-value.test.ts

@@ -1,5 +1,5 @@
+import { validateCustomFieldValue } from "@chatbotx.io/business/javascript-execution"
 import { describe, expect, it } from "vitest"
-import { validateCustomFieldValue } from "../src/default/handlers/imports/validations/custom-field-value"
 
 describe("validateCustomFieldValue", () => {
   describe("shortText / longText", () => {

apps/worker/__tests__/execute-javascript-handler.test.ts

@@ -9,16 +9,38 @@ const mocks = vi.hoisted(() => ({
     workspace: null,
   })),
   getSystemFieldValue: vi.fn(async () => null as string | null),
-  resolveJavascriptInput: vi.fn(async () => new Map<string, string | null>()),
+  resolveJavascriptInput: vi.fn(
+    async () => new Map<string, string | number | boolean | null>(),
+  ),
   interpolateIntoJavascript: vi.fn((code: string) => code),
   executeAndMap: vi.fn(async () => ({ value: null })),
 }))
 
+// Mirrors packages/variables/src/javascript-interpolation.ts's real
+// implementation exactly (a pure number/boolean coercion, no DB
+// dependency), since `@chatbotx.io/variables`'s barrel can't be imported
+// actual here without resurrecting the Snowflake-collision problem
+// documented at the bottom of this file.
+const coerceCustomFieldValueForJavascript = (
+  value: string,
+  type: string,
+): string | number | boolean | null => {
+  if (type === "number") {
+    const numberValue = Number(value)
+    return Number.isFinite(numberValue) ? numberValue : null
+  }
+  if (type === "boolean") {
+    return value === "true"
+  }
+  return value
+}
+
 vi.mock("@chatbotx.io/variables", () => ({
   contactVariableService: { getAll: mocks.getAll },
   getSystemFieldValue: mocks.getSystemFieldValue,
   resolveJavascriptInput: mocks.resolveJavascriptInput,
   interpolateIntoJavascript: mocks.interpolateIntoJavascript,
+  coerceCustomFieldValueForJavascript,
 }))
 
 vi.mock("@chatbotx.io/business/javascript-execution", () => ({
@@ -138,6 +160,54 @@ describe("handleExecuteJavascript", () => {
       result: null,
     })
   })
+
+  test("routes an output type mismatch to the error result with its actionable message", async () => {
+    // executeAndMap throws a ChatbotXException (which extends Error) when
+    // the sandbox's result doesn't fit the output field's declared type —
+    // this proves that failure reaches the step's error branch instead of
+    // being swallowed or reported as a generic success.
+    mocks.executeAndMap.mockRejectedValue(
+      new Error(
+        'JavaScript returned "Abcd 123", which is not a valid number value for the output field "Age".',
+      ),
+    )
+
+    await expect(handleExecuteJavascript(createProps())).resolves.toEqual({
+      status: "error",
+      errorMessage:
+        'JavaScript returned "Abcd 123", which is not a valid number value for the output field "Age".',
+      result: null,
+    })
+  })
+
+  test("coerces every custom field seeded into input, not only ones referenced via {{...}}", async () => {
+    // A field read directly as input.age (never as {{age}}) must still be
+    // typed consistently with one read via {{age}} — both come from the
+    // same customFieldsMap, so both must go through the same coercion.
+    mocks.getAll.mockResolvedValue({
+      contact: { id: "contact-1", email: "a@example.com" },
+      contactInbox: null,
+      conversation: null,
+      customFieldsMap: new Map([
+        ["age", { key: "age", type: "number", value: "30", description: "" }],
+        [
+          "is_vip",
+          { key: "is_vip", type: "boolean", value: "true", description: "" },
+        ],
+      ]),
+      workspace: null,
+    })
+
+    const props = createProps()
+    props.step.code = "return input.age + 1"
+    await handleExecuteJavascript(props)
+
+    const call = mocks.executeAndMap.mock.calls[0]?.[0] as {
+      input: Record<string, unknown>
+    }
+    expect(call.input.age).toBe(30)
+    expect(call.input.is_vip).toBe(true)
+  })
 })
 
 // The suite above mocks @chatbotx.io/variables entirely, so it only pins the

apps/worker/src/default/handlers/imports/handler/contacts/handler.ts

@@ -6,6 +6,7 @@ import {
   workspaceService,
   workspaceUsageService,
 } from "@chatbotx.io/business"
+import { validateCustomFieldValue } from "@chatbotx.io/business/javascript-execution"
 import { db, inArray } from "@chatbotx.io/database/client"
 import {
   type ContactImportMeta,
@@ -28,7 +29,6 @@ import type {
   ImportRow,
   ImportTypeHandler,
 } from "../../base-import"
-import { validateCustomFieldValue } from "../../validations/custom-field-value"
 import { type ContactRow, extractRowData } from "./extractor"
 
 type ContactDeps = {

apps/worker/src/integration/handlers/tool-handler.ts

@@ -26,6 +26,7 @@ import {
   SourceTimezoneStrategy,
 } from "@chatbotx.io/utils/datetime"
 import {
+  coerceCustomFieldValueForJavascript,
   contactVariableService,
   extractVariables,
   getSystemFieldValue,
@@ -344,10 +345,14 @@ export async function handleExecuteJavascript({
       contactInbox,
       conversation,
     })
+    // Coerced the same way resolveJavascriptInput coerces `{{name}}`
+    // lookups below, so a custom field is typed consistently in `input`
+    // regardless of whether the code reaches it via `input["name"]` or via
+    // a `{{name}}` placeholder rewritten to that same property access.
     const input: Record<string, unknown> = Object.fromEntries(
       [...variables.customFieldsMap.entries()].map(([name, field]) => [
         name,
-        field.value,
+        coerceCustomFieldValueForJavascript(field.value, field.type),
       ]),
     )
 

packages/business/__tests__/javascript-execution-output-value.test.ts

@@ -0,0 +1,205 @@
+import { describe, expect, test } from "vitest"
+import type { ChatbotXException } from "../src/errors"
+import { toValidatedCustomFieldValue } from "../src/javascript-execution/output-value"
+
+const validate = (props: Parameters<typeof toValidatedCustomFieldValue>[0]) =>
+  toValidatedCustomFieldValue(props)
+
+describe("toValidatedCustomFieldValue", () => {
+  test("skips the write for null or undefined", () => {
+    expect(
+      validate({ value: null, type: "number", fieldName: "Age" }),
+    ).toBeNull()
+    expect(
+      validate({ value: undefined, type: "number", fieldName: "Age" }),
+    ).toBeNull()
+  })
+
+  describe("number", () => {
+    test("accepts a finite JS number", () => {
+      expect(validate({ value: 42, type: "number", fieldName: "Age" })).toBe(
+        "42",
+      )
+    })
+
+    test("accepts a numeric string", () => {
+      expect(validate({ value: "42", type: "number", fieldName: "Age" })).toBe(
+        "42",
+      )
+    })
+
+    test("rejects a non-numeric string", () => {
+      expect(() =>
+        validate({ value: "Abcd 123", type: "number", fieldName: "Age" }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+
+    test("rejects NaN and Infinity instead of persisting the JSON.stringify null", () => {
+      expect(() =>
+        validate({
+          value: Number.NaN,
+          type: "number",
+          fieldName: "Age",
+        }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+      expect(() =>
+        validate({
+          value: Number.POSITIVE_INFINITY,
+          type: "number",
+          fieldName: "Age",
+        }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+
+    test("rejects an object", () => {
+      expect(() =>
+        validate({ value: { a: 1 }, type: "number", fieldName: "Age" }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+  })
+
+  describe("boolean", () => {
+    test("accepts a JS boolean", () => {
+      expect(
+        validate({ value: true, type: "boolean", fieldName: "Active" }),
+      ).toBe("true")
+    })
+
+    test("accepts canonical string forms", () => {
+      expect(
+        validate({ value: "1", type: "boolean", fieldName: "Active" }),
+      ).toBe("true")
+      expect(
+        validate({ value: "0", type: "boolean", fieldName: "Active" }),
+      ).toBe("false")
+    })
+
+    test("rejects a non-boolean-like string", () => {
+      expect(() =>
+        validate({ value: "garbage", type: "boolean", fieldName: "Active" }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+  })
+
+  describe("email", () => {
+    test("lowercases a valid email", () => {
+      expect(
+        validate({
+          value: "Foo@Bar.COM",
+          type: "email",
+          fieldName: "Email",
+        }),
+      ).toBe("foo@bar.com")
+    })
+
+    test("rejects a non-string value", () => {
+      expect(() =>
+        validate({ value: 42, type: "email", fieldName: "Email" }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+  })
+
+  describe("phoneNumber", () => {
+    test("strips formatting, preserves +", () => {
+      expect(
+        validate({
+          value: "+1 (555) 123-4567",
+          type: "phoneNumber",
+          fieldName: "Phone",
+        }),
+      ).toBe("+15551234567")
+    })
+  })
+
+  describe("date / datetime", () => {
+    test("hands a parseable value through raw", () => {
+      expect(
+        validate({
+          value: "2026-07-22T10:00:00Z",
+          type: "datetime",
+          fieldName: "Signed up",
+        }),
+      ).toBe("2026-07-22T10:00:00Z")
+    })
+
+    test("rejects an unparseable value", () => {
+      expect(() =>
+        validate({
+          value: "not a date",
+          type: "datetime",
+          fieldName: "Signed up",
+        }),
+      ).toThrowError(
+        expect.objectContaining<Partial<ChatbotXException>>({
+          code: "javascriptOutputTypeMismatch",
+        }),
+      )
+    })
+  })
+
+  describe("shortText / longText", () => {
+    test("stringifies objects and arrays unchanged", () => {
+      expect(
+        validate({
+          value: { a: 1 },
+          type: "shortText",
+          fieldName: "Note",
+        }),
+      ).toBe(JSON.stringify({ a: 1 }))
+    })
+
+    test("accepts an empty string", () => {
+      expect(
+        validate({ value: "", type: "shortText", fieldName: "Note" }),
+      ).toBe("")
+    })
+  })
+
+  test("throws for an empty string into a non-text field", () => {
+    expect(() =>
+      validate({ value: "", type: "number", fieldName: "Age" }),
+    ).toThrowError(
+      expect.objectContaining<Partial<ChatbotXException>>({
+        code: "javascriptOutputTypeMismatch",
+      }),
+    )
+  })
+
+  test("throws javascriptOutputValueTooLarge before the type check", () => {
+    expect(() =>
+      validate({
+        value: "a".repeat(64 * 1024 + 1),
+        type: "number",
+        fieldName: "Age",
+      }),
+    ).toThrowError(
+      expect.objectContaining<Partial<ChatbotXException>>({
+        code: "javascriptOutputValueTooLarge",
+      }),
+    )
+  })
+})