fix(integrations): surface corrupt Splunk bodies and partial CrowdStrike deletes

Narrows readSplunkJson's non-JSON tolerance to XML. The dispatching and
job-control endpoints answer in XML, but a body that is neither empty nor XML
was meant to be JSON, so swallowing its parse failure handed get_search_results
an empty envelope and reported a lost result set as a search with zero events.

Annotates a batched CrowdStrike delete that fails partway with the IDs its
earlier batches already removed. Falcon cannot roll those back, so a bare
failure left the caller unable to tell what was gone and a blind retry
re-targeted IDs that no longer existed.

Registers the Cloudflare subblock-ID migration the registry-stability check
requires. The suffixed read-filter IDs never shipped in a release and every
block already materializes the restored IDs, so they are dropped rather than
renamed onto values the collision guard would discard anyway.

Author: waleedlatif1

apps/sim/app/api/tools/crowdstrike/query/operations.test.ts

@@ -1036,6 +1036,58 @@ describe('CrowdStrike extended operations', () => {
       expect(data.error).toBe('Rate limit exceeded')
     })
 
+    /**
+     * A batched delete has no rollback: every batch that answered `ok` really removed
+     * its indicators. Reporting only the failing batch's message would leave the
+     * caller unable to tell what is already gone, and a blind retry would re-target
+     * IDs that no longer exist.
+     */
+    it('names the indicators earlier batches already deleted when a later batch fails', async () => {
+      const indicatorIds = longIds(300, 'ioc')
+      let deleteCall = 0
+      const deletedByFirstBatch: string[] = []
+
+      fetchMock.mockImplementation((rawUrl: string) => {
+        deleteCall += 1
+        if (deleteCall === 2) {
+          return Promise.resolve(
+            jsonResponse({ errors: [{ code: 429, message: 'Rate limit exceeded' }] }, 429)
+          )
+        }
+        const ids = idsFromUrl(rawUrl)
+        deletedByFirstBatch.push(...ids)
+        return Promise.resolve(jsonResponse({ resources: ids }))
+      })
+
+      const response = await POST(
+        requestFor({ operation: 'crowdstrike_delete_indicators', indicatorIds })
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(429)
+      expect(data.success).toBe(false)
+      expect(deletedByFirstBatch.length).toBeGreaterThan(0)
+      expect(data.error).toContain('Rate limit exceeded')
+      expect(data.error).toContain(`${deletedByFirstBatch.length} ID(s) were already deleted`)
+      expect(data.error).toContain(deletedByFirstBatch[0])
+    })
+
+    it('leaves a first-batch delete failure unannotated — nothing was committed', async () => {
+      const indicatorIds = longIds(300, 'ioc')
+
+      fetchMock.mockImplementation(() =>
+        Promise.resolve(jsonResponse({ errors: [{ code: 403, message: 'Access denied' }] }, 403))
+      )
+
+      const response = await POST(
+        requestFor({ operation: 'crowdstrike_delete_indicators', indicatorIds })
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(403)
+      expect(data.error).toBe('Access denied')
+    })
+
     it('splits an oversized vulnerability lookup at the Spotlight cap', async () => {
       const vulnerabilityIds = longIds(400, 'vuln')
 

apps/sim/app/api/tools/crowdstrike/query/operations.ts

@@ -1,4 +1,5 @@
 import { isRecordLike } from '@sim/utils/object'
+import { truncate } from '@sim/utils/string'
 import type { CrowdstrikeQueryBody } from '@/lib/api/contracts/tools/crowdstrike'
 import {
   buildUrl,
@@ -125,6 +126,45 @@ export function chunkIdsByUrlBudget(ids: string[], budget: number): string[][] {
   return chunks
 }
 
+/**
+ * Caps how much of the already-committed ID list is spelled out in a partial-failure
+ * message. A by-ids delete can carry 1000 IDs at ~68 bytes each, so the full list
+ * would bury the actual failure under ~68 KB of text.
+ */
+const MAX_COMMITTED_IDS_IN_MESSAGE = 400
+
+/**
+ * Rewrites a failed batch's envelope so the reported error names the deletions the
+ * earlier batches already committed.
+ *
+ * Batches run sequentially and each one that answered `ok` really did delete its
+ * indicators — Falcon has no way to roll them back. Short-circuiting on a later
+ * batch would therefore report a bare failure over work that already happened, and
+ * a blind retry would target IDs that no longer exist. Only the message survives to
+ * the caller ({@link fail} keeps `status` and the message, not `data`), so the
+ * committed prefix is written onto `errors[0].message`, which is the first thing
+ * {@link getFalconErrorMessage} reads.
+ */
+function withCommittedIds(
+  result: CrowdStrikeCallResult,
+  committed: string[]
+): CrowdStrikeCallResult {
+  if (committed.length === 0) return result
+
+  const envelope = isRecordLike(result.data) ? result.data : {}
+  const existing = getRecordArray(envelope.errors)
+  const reason = getFalconErrorMessage(result.data, 'CrowdStrike rejected a later batch.')
+  const message =
+    `${reason} This request was split into batches and ${committed.length} ID(s) were already deleted ` +
+    `before the failing batch; they were not rolled back, so retry only the remainder. ` +
+    `Deleted: ${truncate(committed.join(', '), MAX_COMMITTED_IDS_IN_MESSAGE)}`
+
+  return {
+    ...result,
+    data: { ...envelope, errors: [{ ...(existing[0] ?? {}), message }, ...existing.slice(1)] },
+  }
+}
+
 interface ByIdsRequestOptions {
   method: 'GET' | 'DELETE'
   path: string
@@ -139,7 +179,9 @@ interface ByIdsRequestOptions {
  *
  * Batches run sequentially: resource order matches the caller's ID order, the
  * endpoint's rate limit only ever sees one request at a time, and a failing batch
- * short-circuits with its own status instead of being merged away. `meta` comes
+ * short-circuits with its own status instead of being merged away. A `DELETE` that
+ * fails partway also carries the IDs its earlier batches already removed — see
+ * {@link withCommittedIds}. `meta` comes
  * from the first batch — pagination is meaningless for a lookup that names every
  * ID it wants, and no by-ids operation here reads it.
  */
@@ -169,6 +211,7 @@ async function callCrowdStrikeByIds(
 
   const resources: unknown[] = []
   const errors: unknown[] = []
+  const committed: string[] = []
   let meta: unknown
   let status = 200
 
@@ -181,9 +224,11 @@ async function callCrowdStrikeByIds(
     })
 
     if (!result.ok) {
-      return result
+      return options.method === 'DELETE' ? withCommittedIds(result, committed) : result
     }
 
+    committed.push(...chunk)
+
     if (index === 0) {
       status = result.status
       meta = isRecordLike(result.data) ? result.data.meta : undefined

apps/sim/lib/workflows/migrations/subblock-migrations.test.ts

@@ -423,6 +423,71 @@ describe('migrateSubblockIds', () => {
     expect(blocks.b3.subBlocks.code).toBeDefined()
   })
 
+  /**
+   * The suffixed Cloudflare read-filter ids existed only between #6740 and the
+   * restore, and never shipped in a release. They are dropped rather than renamed
+   * onto `name`/`type`/`content`/`proxied`/`tags`, which every Cloudflare block
+   * already materializes — a rename would hit the collision guard and discard the
+   * value regardless, while leaving the stale key parked in state.
+   */
+  describe('cloudflare block', () => {
+    it('drops the staging-only read-filter ids without disturbing the restored ids', () => {
+      const input: Record<string, BlockState> = {
+        b1: makeBlock({
+          type: 'cloudflare',
+          subBlocks: {
+            operation: { id: 'operation', type: 'dropdown', value: 'list_dns_records' },
+            zoneNameFilter: { id: 'zoneNameFilter', type: 'short-input', value: 'example.com' },
+            dnsNameFilter: { id: 'dnsNameFilter', type: 'short-input', value: 'www' },
+            dnsTypeFilter: { id: 'dnsTypeFilter', type: 'dropdown', value: 'A' },
+            dnsContentFilter: { id: 'dnsContentFilter', type: 'short-input', value: '1.2.3.4' },
+            dnsProxiedFilter: { id: 'dnsProxiedFilter', type: 'dropdown', value: 'true' },
+            purgeTags: { id: 'purgeTags', type: 'short-input', value: 'tag-a' },
+            cursor: { id: 'cursor', type: 'short-input', value: 'abc' },
+            name: { id: 'name', type: 'short-input', value: '' },
+          },
+        }),
+      }
+
+      const { blocks, migrated } = migrateSubblockIds(input)
+
+      expect(migrated).toBe(true)
+      for (const legacyId of [
+        'zoneNameFilter',
+        'dnsNameFilter',
+        'dnsTypeFilter',
+        'dnsContentFilter',
+        'dnsProxiedFilter',
+        'purgeTags',
+        'cursor',
+      ]) {
+        expect(blocks.b1.subBlocks[legacyId]).toBeUndefined()
+        expect(blocks.b1.subBlocks[`_removed_${legacyId}`]).toBeUndefined()
+      }
+      expect(blocks.b1.subBlocks.operation.value).toBe('list_dns_records')
+      expect(blocks.b1.subBlocks.name.value).toBe('')
+    })
+
+    it('leaves a workflow saved on the restored ids untouched', () => {
+      const input: Record<string, BlockState> = {
+        b1: makeBlock({
+          type: 'cloudflare',
+          subBlocks: {
+            operation: { id: 'operation', type: 'dropdown', value: 'list_dns_records' },
+            name: { id: 'name', type: 'short-input', value: 'www' },
+            type: { id: 'type', type: 'dropdown', value: 'A' },
+          },
+        }),
+      }
+
+      const { blocks, migrated } = migrateSubblockIds(input)
+
+      expect(migrated).toBe(false)
+      expect(blocks.b1.subBlocks.name.value).toBe('www')
+      expect(blocks.b1.subBlocks.type.value).toBe('A')
+    })
+  })
+
   it('should handle blocks with empty subBlocks', () => {
     const input: Record<string, BlockState> = {
       b1: makeBlock({ type: 'knowledge', subBlocks: {} }),

apps/sim/lib/workflows/migrations/subblock-migrations.ts

@@ -114,6 +114,35 @@ export const SUBBLOCK_ID_MIGRATIONS: Record<string, Record<string, string>> = {
     host: '_removed_host',
     apiKey: '_removed_apiKey',
   },
+  /**
+   * The Cloudflare block briefly gave its DNS/zone read filters and its cache-purge
+   * tag list operation-suffixed IDs, and added a single shared `cursor`. This PR
+   * restores the shipped IDs (`name`, `type`, `content`, `proxied`, `tags`) so saved
+   * workflows keep filtering, and splits the cursor per endpoint.
+   *
+   * The suffixed IDs are dropped rather than renamed onto their shipped
+   * counterparts. They existed only between #6740 and this change and never
+   * appeared in a release, so no deployed workflow carries them — and a rename
+   * could not restore a value even for a workflow edited in that window. Block
+   * state materializes an entry for every subblock the config declares, not just
+   * the active operation's, so `name`/`type`/`content`/`proxied`/`tags` are always
+   * already present; {@link migrateBlockSubblockIds} would hit its collision guard
+   * and discard the source value anyway. Mapping them as renames would therefore
+   * claim a recovery that never happens, while leaving the stale value parked in
+   * state and riding along in exports.
+   *
+   * `cursor` split into `r2Cursor` and `rulesetCursor`, so there is no single
+   * replacement to name.
+   */
+  cloudflare: {
+    zoneNameFilter: '_removed_zoneNameFilter',
+    dnsNameFilter: '_removed_dnsNameFilter',
+    dnsTypeFilter: '_removed_dnsTypeFilter',
+    dnsContentFilter: '_removed_dnsContentFilter',
+    dnsProxiedFilter: '_removed_dnsProxiedFilter',
+    purgeTags: '_removed_purgeTags',
+    cursor: '_removed_cursor',
+  },
   rippling: {
     action: '_removed_action',
     candidateDepartment: '_removed_candidateDepartment',

apps/sim/tools/splunk/utils.test.ts

@@ -96,6 +96,20 @@ describe('readSplunkJson', () => {
       readSplunkJson(new Response('<response><sid>1457683115.100</sid></response>'))
     ).resolves.toEqual({})
   })
+
+  /**
+   * The XML tolerance must not extend to a body that was meant to be JSON.
+   * Swallowing a truncated result payload would hand `get_search_results` an empty
+   * envelope, reporting a lost result set as a search that legitimately matched
+   * nothing.
+   */
+  it('throws on a truncated JSON body rather than reporting an empty result set', async () => {
+    await expect(readSplunkJson(new Response('{"results":[{"_raw":"partial'))).rejects.toThrow()
+  })
+
+  it('throws on a non-JSON, non-XML body', async () => {
+    await expect(readSplunkJson(new Response('upstream connect error'))).rejects.toThrow()
+  })
 })
 
 describe('getSplunkPaging', () => {

apps/sim/tools/splunk/utils.ts

@@ -160,25 +160,28 @@ export function buildSplunkFormBody(
  * still-running job would surface `Unexpected end of JSON input` instead of an
  * empty result set.
  *
- * A non-JSON body is tolerated the same way because `output_mode` does not appear
- * in the documented parameter table for the dispatching and job-control endpoints,
+ * An XML body is tolerated the same way because `output_mode` does not appear in
+ * the documented parameter table for the dispatching and job-control endpoints,
  * and the only response the reference documents for them is the XML
  * `<response><sid>...</sid></response>`. Throwing on that XML would report a
  * request that succeeded server-side as a failure — cancelling a job really does
  * cancel it — and would pre-empt the specific error the caller raises when the
  * envelope carries no usable value. Returning `{}` lets that error surface
  * instead, and a JSON body (which these endpoints do return in practice when
  * `output_mode=json` is honored) still parses normally.
+ *
+ * The tolerance stops at XML. A body that is neither empty nor XML is meant to be
+ * JSON, so a parse failure there means the payload is corrupt or truncated —
+ * swallowing it would hand `get_search_results` an empty envelope and report a
+ * lost result set as a successful search with zero events.
  */
 export async function readSplunkJson(response: Response): Promise<unknown> {
   if (response.status === 204) return {}
   const text = await response.text()
-  if (!text.trim()) return {}
-  try {
-    return JSON.parse(text)
-  } catch {
-    return {}
-  }
+  const body = text.trim()
+  if (!body) return {}
+  if (body.startsWith('<')) return {}
+  return JSON.parse(body)
 }
 
 /**