fix(salesforce): correct the depth off-by-one and the LIMIT ceiling

Salesforce counts relationship levels, not dotted segments -- its own
example is 'Contact.Account.Owner.FirstName (three levels)', four segments.
The check compared segment count, so a legal five-level path was rejected,
and the test asserted that rejection as correct.

2000 is the synchronous batch size, not a LIMIT maximum. Capping there
removed the paging workflow these tools ship query_more for: a larger LIMIT
returns the first batch with done:false and a locator.

Also allows the documented FIELDS()/toLabel()/FORMAT()/convertCurrency()
wrappers, recursing into the same field-path check so only a validated API
name reaches the statement; seven new vectors attack the wrapper syntax.

Author: waleedlatif1

apps/sim/blocks/blocks/qdrant.test.ts

@@ -0,0 +1,30 @@
+/**
+ * @vitest-environment node
+ *
+ * The block's skill `content` is prompt text an LLM reads and acts on, so it is
+ * held to the same contract as `outputs`: it may only promise fields the tool
+ * actually returns. Qdrant's upsert endpoint returns an `UpdateResult`
+ * (`operation_id`, `status`) and no count of the points written.
+ */
+import { describe, expect, it } from 'vitest'
+import { QdrantBlockMeta } from '@/blocks/blocks/qdrant'
+import { UPSERT_RESULT_OUTPUT_PROPERTIES } from '@/tools/qdrant/types'
+
+const upsertSkill = QdrantBlockMeta.skills.find((skill) => skill.name === 'upsert-points')
+
+describe('QdrantBlockMeta upsert-points skill', () => {
+  it('is registered', () => {
+    expect(upsertSkill).toBeDefined()
+  })
+
+  it('does not instruct the model to read an upserted count the API never returns', () => {
+    expect(Object.keys(UPSERT_RESULT_OUTPUT_PROPERTIES)).toEqual(['operation_id', 'status'])
+    expect(upsertSkill?.content).not.toMatch(/upserted count/i)
+    expect(upsertSkill?.content).not.toMatch(/how many points were upserted/i)
+  })
+
+  it('points the model at the fields the upsert response does carry', () => {
+    expect(upsertSkill?.content).toMatch(/operation_id/)
+    expect(upsertSkill?.content).toMatch(/status/)
+  })
+})

apps/sim/blocks/blocks/qdrant.ts

@@ -303,7 +303,7 @@ export const QdrantBlockMeta = {
       name: 'upsert-points',
       description: 'Insert or update vector points with payload metadata into a Qdrant collection.',
       content:
-        '# Upsert Points\n\nLoad vectors into a Qdrant collection.\n\n## Steps\n1. Use the Upsert operation with the Qdrant URL, Collection name, and API Key.\n2. Provide Points as a JSON array, each with an id, a vector matching the collection dimension, and an optional payload of metadata for later filtering.\n3. Confirm the upserted count from the response.\n\n## Output\nReport how many points were upserted into which collection and surface any payload validation issues.',
+        '# Upsert Points\n\nLoad vectors into a Qdrant collection.\n\n## Steps\n1. Use the Upsert operation with the Qdrant URL, Collection name, and API Key.\n2. Provide Points as a JSON array, each with an id, a vector matching the collection dimension, and an optional payload of metadata for later filtering.\n3. Confirm the response status (`acknowledged` or `completed`) and keep the `operation_id` if you need to track an async write.\n\n## Output\nReport the upsert status and operation_id, which collection was targeted, and surface any payload validation issues. Qdrant does not return a count of points written \u2014 if you cite a number, cite the number of points you sent.',
     },
     {
       name: 'search-vectors',

apps/sim/tools/salesforce/get_accounts.ts

@@ -55,19 +55,19 @@ export const salesforceGetAccountsTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results (default: 100, max: 2000)',
+      description: 'Maximum number of results (default: 100)',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated field API names (e.g., "Id,Name,Industry,Phone")',
+      description: 'Comma-separated field API names (e.g., "Id,Name,Industry,Phone") Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., "Name ASC" or "CreatedDate DESC")',
+      description: 'Field and direction for sorting (e.g., "Name ASC" or "CreatedDate DESC") Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/get_cases.ts

@@ -46,19 +46,19 @@ export const salesforceGetCasesTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results to return (default: 100, max: 2000)',
+      description: 'Maximum number of results to return (default: 100)',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated list of field API names to return',
+      description: 'Comma-separated list of field API names to return Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., CreatedDate DESC)',
+      description: 'Field and direction for sorting (e.g., CreatedDate DESC) Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/get_contacts.ts

@@ -52,19 +52,19 @@ export const salesforceGetContactsTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results (default: 100, max: 2000). Only for list query.',
+      description: 'Maximum number of results (default: 100). Only for list query.',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated field API names (e.g., "Id,FirstName,LastName,Email,Phone")',
+      description: 'Comma-separated field API names (e.g., "Id,FirstName,LastName,Email,Phone") Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., "LastName ASC"). Only for list query.',
+      description: 'Field and direction for sorting (e.g., "LastName ASC"). Only for list query. Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/get_leads.ts

@@ -46,19 +46,19 @@ export const salesforceGetLeadsTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results to return (default: 100, max: 2000)',
+      description: 'Maximum number of results to return (default: 100)',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated list of field API names to return',
+      description: 'Comma-separated list of field API names to return Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., LastName ASC)',
+      description: 'Field and direction for sorting (e.g., LastName ASC) Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/get_opportunities.ts

@@ -52,19 +52,19 @@ export const salesforceGetOpportunitiesTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results to return (default: 100, max: 2000)',
+      description: 'Maximum number of results to return (default: 100)',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated list of field API names to return',
+      description: 'Comma-separated list of field API names to return Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., CloseDate DESC)',
+      description: 'Field and direction for sorting (e.g., CloseDate DESC) Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/get_tasks.ts

@@ -58,19 +58,19 @@ export const salesforceGetTasksTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Maximum number of results to return (default: 100, max: 2000)',
+      description: 'Maximum number of results to return (default: 100)',
     },
     fields: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Comma-separated list of field API names to return',
+      description: 'Comma-separated list of field API names to return Also accepts FIELDS(STANDARD|CUSTOM|ALL) and toLabel()/FORMAT()/convertCurrency() around a single field.',
     },
     orderBy: {
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Field and direction for sorting (e.g., ActivityDate DESC)',
+      description: 'Field and direction for sorting (e.g., ActivityDate DESC) Bare field API names only, optionally with ASC/DESC and NULLS FIRST/LAST; SOQL functions such as DISTANCE() are not accepted here — use the Salesforce Query tool for those.',
     },
   },
 

apps/sim/tools/salesforce/soql_safety.test.ts

@@ -59,8 +59,14 @@ const INJECTIONS = [
   "Id WHERE Name != ''",
   'Id LIMIT 2000',
   'Id) UNION (SELECT Id',
-  'Id,toLabel(Status)',
   'Id,COUNT(Id)',
+  'toLabel(Id) UNION (SELECT Id)',
+  'FIELDS(ALL) FROM User',
+  'FORMAT(Id) FROM User',
+  'toLabel(Name) LIMIT 1',
+  'toLabel(Id),(SELECT Id FROM Contacts)',
+  'toLabel(Id;DROP)',
+  'FIELDS(EVERYTHING)',
   "Id,'literal'",
   'Id;DROP',
   'Id\nFROM User',
@@ -76,6 +82,14 @@ const LEGITIMATE_FIELDS = [
   'Custom_Field__c',
   'Account__r.Region__c',
   'A.B.C.D.E',
+  'A.B.C.D.E.FieldName',
+  'FIELDS(STANDARD)',
+  'FIELDS(ALL)',
+  'Id,FIELDS(CUSTOM)',
+  'toLabel(Status)',
+  'FORMAT(Amount)',
+  'convertCurrency(Amount)',
+  'FORMAT(convertCurrency(Amount))',
 ] as const
 
 const LEGITIMATE_ORDER_BY = [
@@ -146,7 +160,7 @@ describe.each(LIST_TOOLS)('$name SOQL safety', ({ tool, object }) => {
     )
   })
 
-  it.each(['abc', '', ' ', '10; DROP', '-1', '0', '2001', '1.5', 'NaN'] as const)(
+  it.each(['abc', '', ' ', '10; DROP', '-1', '0', '1.5', 'NaN'] as const)(
     'rejects %j as a limit rather than emitting LIMIT NaN',
     (value) => {
       // An unset limit legitimately falls back to the default; only junk throws.
@@ -158,8 +172,9 @@ describe.each(LIST_TOOLS)('$name SOQL safety', ({ tool, object }) => {
     }
   )
 
-  it('accepts the documented 2000-row ceiling', () => {
+  it('accepts a LIMIT above the 2000-row REST batch size so query_more can page', () => {
     expect(buildQuery(tool, { limit: '2000' })).toContain('LIMIT 2000')
+    expect(buildQuery(tool, { limit: '5000' })).toContain('LIMIT 5000')
   })
 })
 
@@ -169,10 +184,51 @@ describe('sanitizeSoqlFieldList', () => {
     expect(sanitizeSoqlFieldList('   ', 'Id,Name')).toBe('Id, Name')
   })
 
+  it('accepts the five relationship levels SOQL allows (six dotted segments)', () => {
+    expect(sanitizeSoqlFieldList('A.B.C.D.E.F', 'Id')).toBe('A.B.C.D.E.F')
+  })
+
   it('rejects a path deeper than the five relationship levels SOQL allows', () => {
-    expect(() => sanitizeSoqlFieldList('A.B.C.D.E.F', 'Id')).toThrow(
-      /at most 5|relationship levels/
+    expect(() => sanitizeSoqlFieldList('A.B.C.D.E.F.G', 'Id')).toThrow(
+      /6 relationship levels; SOQL allows at most 5/
+    )
+  })
+
+  it('accepts the documented field-group selectors, normalized to upper case', () => {
+    expect(sanitizeSoqlFieldList('fields(standard)', 'Id')).toBe('FIELDS(STANDARD)')
+    expect(sanitizeSoqlFieldList('Id,FIELDS(custom)', 'Id')).toBe('Id, FIELDS(CUSTOM)')
+  })
+
+  it('accepts the documented single-field SELECT functions, normalized to documented casing', () => {
+    expect(sanitizeSoqlFieldList('tolabel(Status)', 'Id')).toBe('toLabel(Status)')
+    expect(sanitizeSoqlFieldList('format(Amount)', 'Id')).toBe('FORMAT(Amount)')
+    expect(sanitizeSoqlFieldList('CONVERTCURRENCY(Amount)', 'Id')).toBe('convertCurrency(Amount)')
+    expect(sanitizeSoqlFieldList('FORMAT(convertCurrency(Amount))', 'Id')).toBe(
+      'FORMAT(convertCurrency(Amount))'
+    )
+  })
+
+  it('still validates the inner argument of an allowed wrapper as a field path', () => {
+    expect(() => sanitizeSoqlFieldList("toLabel(Id WHERE Name != '')", 'Id')).toThrow(
+      SoqlValidationError
     )
+    expect(() => sanitizeSoqlFieldList('FORMAT(A.B.C.D.E.F.G)', 'Id')).toThrow(SoqlValidationError)
+  })
+
+  it('rejects wrapper nesting deeper than the documented FORMAT(convertCurrency(field)) form', () => {
+    expect(() => sanitizeSoqlFieldList('FORMAT(FORMAT(convertCurrency(Amount)))', 'Id')).toThrow(
+      SoqlValidationError
+    )
+  })
+
+  it('still rejects COUNT(), which cannot be combined with the ORDER BY these tools always emit', () => {
+    expect(() => sanitizeSoqlFieldList('COUNT()', 'Id')).toThrow(SoqlValidationError)
+    expect(() => sanitizeSoqlFieldList('COUNT(Id)', 'Id')).toThrow(SoqlValidationError)
+  })
+
+  it('rejects SELECT-only functions in ORDER BY, which SOQL forbids there', () => {
+    expect(() => sanitizeSoqlOrderBy('toLabel(Status) ASC', 'Id ASC')).toThrow(SoqlValidationError)
+    expect(() => sanitizeSoqlOrderBy('FIELDS(STANDARD)', 'Id ASC')).toThrow(SoqlValidationError)
   })
 
   it('rejects a list that is only separators', () => {
@@ -211,4 +267,14 @@ describe('sanitizeSoqlLimit', () => {
     expect(() => sanitizeSoqlLimit('abc')).toThrow(SoqlValidationError)
     expect(() => sanitizeSoqlLimit('abc')).toThrow(/not a whole number/)
   })
+
+  it('allows a LIMIT past the 2000-row REST batch size, which query_more pages through', () => {
+    expect(sanitizeSoqlLimit('2001')).toBe(2001)
+    expect(sanitizeSoqlLimit(5000)).toBe(5000)
+    expect(sanitizeSoqlLimit('50000')).toBe(50000)
+  })
+
+  it('still rejects a value past the sanity ceiling', () => {
+    expect(() => sanitizeSoqlLimit('50001')).toThrow(SoqlValidationError)
+  })
 })