fix(zoho-desk): overwrite operation-scoped params instead of omitting them

The block mapper scoped params by destructuring them out of the spread, on the
assumption that a key left out of the return value never reaches the tool. It
does: both call sites merge the mapper's output on top of the original inputs
(`{ ...inputs, ...transformedParams }`), so an omitted key is restored.

The serializer is what actually held this together, and it has a gap — an
advanced subBlock with a retained value is emitted for every operation while the
block's advanced toggle is off, because that branch returns on isNonEmptyValue
without evaluating the subBlock's condition. So a Sort By set on List Tickets
reached List Comments, and a ticket Include reached Get Contact, each rejected
by Zoho. Out-of-range from/limit reached the wire for the same reason.

Every scoped param is now assigned unconditionally, undefined included, so the
merge cannot resurrect a stale value.

Also fixes a crash this branch introduced: clearing the Departments multi-select
stores [], which reached the comma-list normalizer and threw on .split. The
helper now takes arrays, which is what that subBlock actually stores.

The block-to-tool tests now model the real merge rather than the mapper's return
value alone — the previous version passed while production threw on the same
input. Corrects two comments that misstated where Zoho documents customFields
and errorMessage, and splits the shared include subBlock, since Get Ticket
accepts contract and skills and List Tickets does not.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/zoho_desk.mdx

@@ -54,12 +54,12 @@ List tickets from a Zoho Desk organization with optional filters. Returns a list
 | `apiDomain` | string | No | Zoho Desk data-center REST base URL |
 | `orgId` | string | Yes | Zoho Desk organization ID |
 | `from` | number | No | Pagination start index \(0-based\) |
-| `limit` | number | No | Number of tickets to return \(1-100, default 10\) |
+| `limit` | number | No | Number of tickets to return \(1-100\) |
 | `departmentIds` | string | No | Filter by department ID \(comma-separated for multiple\) |
 | `status` | string | No | Filter by status, including custom statuses. Comma-separate to match multiple \(e.g. "Open,On Hold"\) |
 | `priority` | string | No | Filter by priority. Comma-separate to match multiple \(e.g. "High,Urgent"\) |
 | `assignee` | string | No | Filter by assignee: an agent ID, or "Unassigned". Comma-separate to match multiple. |
-| `channel` | string | No | Filter by origin channel \(e.g. Email, Web, Phone\). Comma-separate to match multiple. |
+| `channel` | string | No | Filter by origin channel, spelled as your portal spells it. Comma-separate to match multiple. |
 | `receivedInDays` | number | No | Only tickets whose last customer response was within the last 15, 30, or 90 days \(Zoho filters on customerResponseTime, despite the name\) |
 | `sortBy` | string | No | Sort field: createdTime, customerResponseTime, or responseDueDate. Prefix with - for descending. |
 | `include` | string | No | Comma-separated related data to embed. Allowed: contacts, products, departments, team, isRead, assignee |

apps/sim/blocks/blocks/zoho-desk.ts

@@ -18,6 +18,32 @@ const OPERATIONS_NEEDING_ORG = [
   'get_attachment',
 ]
 
+/**
+ * Collapse the three "not supplied" shapes to `undefined`. The workflow
+ * serializer initializes untouched subBlocks to `null`, and a cleared field
+ * arrives as `''`; both mean the same thing as absent.
+ */
+function orUndefined(value: unknown): unknown {
+  if (value === undefined || value === null || value === '') return undefined
+  if (typeof value === 'string') {
+    const trimmed = value.trim()
+    return trimmed || undefined
+  }
+  return value
+}
+
+/**
+ * Coerce a pagination input to an integer at or above `min`, or `undefined`.
+ * Anything out of range is discarded rather than forwarded: Zoho answers a
+ * negative or fractional index with an opaque provider error.
+ */
+function toPaginationValue(value: unknown, min: number): number | undefined {
+  const resolved = orUndefined(value)
+  if (resolved === undefined) return undefined
+  const parsed = Number(resolved)
+  return Number.isInteger(parsed) && parsed >= min ? parsed : undefined
+}
+
 export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
   type: 'zoho_desk',
   name: 'Zoho Desk',
@@ -397,7 +423,20 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
       title: 'Include',
       type: 'short-input',
       placeholder: 'e.g. contacts,assignee',
-      condition: { field: 'operation', value: ['list_tickets', 'get_ticket'] },
+      condition: { field: 'operation', value: 'list_tickets' },
+      mode: 'advanced',
+    },
+    // Split from the list_tickets `include` above rather than shared: Get Ticket
+    // additionally accepts `contract` and `skills`, which List Tickets does not
+    // document. A shared subBlock keeps its value across an operation change, so
+    // `skills` set here would follow the user to List Tickets and put an
+    // undocumented token on the wire.
+    {
+      id: 'ticketInclude',
+      title: 'Include',
+      type: 'short-input',
+      placeholder: 'e.g. contacts,contract,skills',
+      condition: { field: 'operation', value: 'get_ticket' },
       mode: 'advanced',
     },
     {
@@ -485,9 +524,19 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
     config: {
       tool: (params) => `zoho_desk_${params.operation}`,
       params: (params) => {
-        // Pull raw pagination out of the spread so invalid values never reach the
-        // tool; only re-add them when Number() yields a finite value (a non-numeric
-        // typo would otherwise become NaN and produce an invalid Zoho query param).
+        // IMPORTANT: destructuring a key out of `rest` does NOT keep it from the
+        // tool. Both call sites merge this function's return value on top of the
+        // original inputs (`{ ...inputs, ...transformedParams }` in
+        // executor/handlers/generic/generic-handler.ts, and the same shape in
+        // providers/utils.ts), so a key left out of `result` is simply restored
+        // from `inputs`. The only way to scope a param to an operation is to
+        // OVERWRITE it with `undefined`, which every tool then treats as unset.
+        //
+        // This matters because a `mode: 'advanced'` subBlock with a retained
+        // value is serialized for every operation when the block's advanced
+        // toggle is off - serializer/index.ts returns on `isNonEmptyValue`
+        // without evaluating the subBlock's `condition` - so stale advanced
+        // values genuinely do arrive here under an unrelated operation.
         const {
           oauthCredential,
           from: rawFrom,
@@ -504,6 +553,7 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
           commentSortBy: rawCommentSortBy,
           threadSortBy: rawThreadSortBy,
           include: rawInclude,
+          ticketInclude: rawTicketInclude,
           contactInclude: rawContactInclude,
           threadInclude: rawThreadInclude,
           assigneeFilter: rawAssigneeFilter,
@@ -525,37 +575,36 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
           : typeof rawDepartmentIds === 'string'
             ? rawDepartmentIds.trim()
             : ''
-        if (departmentIds) result.departmentIds = departmentIds
+        // Always assigned, never conditionally: an emptied multi-select stores
+        // `[]`, and leaving the key unset would let that array through to the
+        // tool, where the comma-list normalizer would throw on `.split`.
+        result.departmentIds = departmentIds || undefined
 
         // contentType is the comment's content type; its default would otherwise
         // serialize for every operation (e.g. get_attachment, which has no such
         // param). Only forward it for add_comment so the UI can't imply an option
         // that has no effect elsewhere.
-        if (params.operation === 'add_comment' && typeof contentType === 'string' && contentType) {
-          result.contentType = contentType
-        }
+        result.contentType =
+          params.operation === 'add_comment' && typeof contentType === 'string' && contentType
+            ? contentType
+            : undefined
 
         // Zoho documents from >= 0 and limit >= 1 as integers; a negative or
         // fractional value reaches the API as an opaque provider error, so drop
         // anything outside those bounds here rather than round-tripping it.
         // `null` is checked explicitly: the serializer initializes untouched
         // subBlocks to null, and Number(null) is 0 — which would otherwise inject
         // from=0 on every operation instead of leaving the param unset.
-        if (rawFrom !== undefined && rawFrom !== null && rawFrom !== '') {
-          const from = Number(rawFrom)
-          if (Number.isInteger(from) && from >= 0) result.from = from
-        }
-        if (rawLimit !== undefined && rawLimit !== null && rawLimit !== '') {
-          const limit = Number(rawLimit)
-          if (Number.isInteger(limit) && limit >= 1) result.limit = limit
-        }
+        result.from = toPaginationValue(rawFrom, 0)
+        result.limit = toPaginationValue(rawLimit, 1)
         // Gated for the same reason as contentType above: isPublic carries a
         // defaultValue, so forwarding it unconditionally would serialize a
         // comment-only field onto every other operation's params. Destructured
         // out of `rest` so the default never reaches non-comment operations.
-        if (params.operation === 'add_comment' && isPublic !== undefined) {
-          result.isPublic = isPublic === true || isPublic === 'true'
-        }
+        result.isPublic =
+          params.operation === 'add_comment' && isPublic !== undefined
+            ? isPublic === true || isPublic === 'true'
+            : undefined
         // Gated to update_ticket for the same reason as contentType and isPublic
         // above: the subBlock keeps its value when the operation changes, so
         // stale (or half-typed) JSON left behind after switching away from
@@ -576,12 +625,8 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
             : params.operation === 'update_ticket'
               ? rawPriority
               : undefined
-        if (activeStatus !== undefined && activeStatus !== null && activeStatus !== '') {
-          result.status = activeStatus
-        }
-        if (activePriority !== undefined && activePriority !== null && activePriority !== '') {
-          result.priority = activePriority
-        }
+        result.status = orUndefined(activeStatus)
+        result.priority = orUndefined(activePriority)
 
         // sortBy and include are per-operation for the same reason: three list
         // endpoints accept three different sort fields, and get_contact accepts a
@@ -596,44 +641,32 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
               : params.operation === 'list_threads'
                 ? rawThreadSortBy
                 : undefined
-        if (activeSortBy !== undefined && activeSortBy !== null && activeSortBy !== '') {
-          result.sortBy = activeSortBy
-        }
+        result.sortBy = orUndefined(activeSortBy)
 
         const activeInclude =
-          params.operation === 'list_tickets' || params.operation === 'get_ticket'
+          params.operation === 'list_tickets'
             ? rawInclude
-            : params.operation === 'get_contact'
-              ? rawContactInclude
-              : params.operation === 'get_thread'
-                ? rawThreadInclude
-                : undefined
-        if (activeInclude !== undefined && activeInclude !== null && activeInclude !== '') {
-          result.include = activeInclude
-        }
+            : params.operation === 'get_ticket'
+              ? rawTicketInclude
+              : params.operation === 'get_contact'
+                ? rawContactInclude
+                : params.operation === 'get_thread'
+                  ? rawThreadInclude
+                  : undefined
+        result.include = orUndefined(activeInclude)
 
         // Gated for the same stale-value reason as the filters above: these three
         // are list_tickets-only query params, and no other operation declares them.
-        if (params.operation === 'list_tickets') {
-          if (typeof rawAssigneeFilter === 'string' && rawAssigneeFilter.trim()) {
-            result.assignee = rawAssigneeFilter.trim()
-          }
-          if (typeof rawChannelFilter === 'string' && rawChannelFilter.trim()) {
-            result.channel = rawChannelFilter.trim()
-          }
-          // Forward whatever was supplied and let the tool judge it. Filtering
-          // here on shape would swallow 30.5 or a non-numeric value, and the
-          // tool would then run without the filter and return the entire queue
-          // as though the requested window had applied. Only the empty
-          // "Any time" option is dropped, because that genuinely means no filter.
-          if (
-            rawReceivedInDays !== undefined &&
-            rawReceivedInDays !== null &&
-            rawReceivedInDays !== ''
-          ) {
-            result.receivedInDays = Number(rawReceivedInDays)
-          }
-        }
+        const isListTickets = params.operation === 'list_tickets'
+        result.assignee = isListTickets ? orUndefined(rawAssigneeFilter) : undefined
+        result.channel = isListTickets ? orUndefined(rawChannelFilter) : undefined
+        // Forward whatever was supplied and let the tool judge it. Filtering here
+        // on shape would swallow 30.5 or a non-numeric value, and the tool would
+        // then run without the filter and return the entire queue as though the
+        // requested window had applied. Only the empty "Any time" option is
+        // dropped, because that genuinely means no filter.
+        const receivedInDays = isListTickets ? orUndefined(rawReceivedInDays) : undefined
+        result.receivedInDays = receivedInDays === undefined ? undefined : Number(receivedInDays)
 
         if (params.operation === 'update_ticket' && rawCustomFields !== undefined) {
           if (typeof rawCustomFields === 'string') {
@@ -686,7 +719,8 @@ export const ZohoDeskBlock: BlockConfig<ZohoDeskResponse> = {
     customFields: { type: 'json', description: 'Custom field values' },
     href: { type: 'string', description: 'Attachment download href' },
     fileName: { type: 'string', description: 'Downloaded file name' },
-    include: { type: 'string', description: 'Related data to include on ticket operations' },
+    include: { type: 'string', description: 'Related data to include when listing tickets' },
+    ticketInclude: { type: 'string', description: 'Related data to include on a single ticket' },
     contactInclude: { type: 'string', description: 'Related data to include on a contact' },
     threadInclude: { type: 'string', description: 'Related data to include on a thread' },
     sortBy: { type: 'string', description: 'Sort field for listing tickets' },

apps/sim/tools/generated/tool-metadata.ts

@@ -53,22 +53,25 @@ describe('zohoDeskListTicketsTool request url', () => {
 })
 
 /**
- * The block maps subBlock values onto tool params, so a value the mapper drops
- * never reaches the tool's validation and the request silently runs unfiltered.
- * These cover the seam rather than either side of it.
+ * Models the real block-to-tool seam. The executor merges the mapper's output
+ * ON TOP of the serialized inputs (`{ ...inputs, ...transformedParams }` in
+ * executor/handlers/generic/generic-handler.ts), so the mapper can overwrite a
+ * key but never remove one. A test that passes only the mapper's return value
+ * would miss every stale input the merge restores — which is precisely the
+ * class of bug these cover.
  */
-describe('ZohoDeskBlock receivedInDays reaches the tool intact', () => {
+function throughSeam(inputs: Record<string, unknown>): string {
   const buildParams = ZohoDeskBlock.tools.config?.params
+  if (!buildParams) throw new Error('ZohoDeskBlock is missing tools.config.params')
   const buildUrl = zohoDeskListTicketsTool.request.url as (p: Record<string, unknown>) => string
+  const withCreds = { accessToken: 'tok', orgId: '700', ...inputs }
+  const transformed = buildParams(withCreds) as Record<string, unknown>
+  return buildUrl({ ...withCreds, ...transformed })
+}
 
-  const throughBlock = (receivedInDays: unknown) => {
-    if (!buildParams) throw new Error('ZohoDeskBlock is missing tools.config.params')
-    const mapped = buildParams({ operation: 'list_tickets', receivedInDays }) as Record<
-      string,
-      unknown
-    >
-    return buildUrl({ accessToken: 'tok', orgId: '700', ...mapped })
-  }
+describe('ZohoDeskBlock receivedInDays reaches the tool intact', () => {
+  const throughBlock = (receivedInDays: unknown) =>
+    throughSeam({ operation: 'list_tickets', receivedInDays })
 
   it('carries a supported window through to the query', () => {
     expect(new URL(throughBlock('30')).searchParams.get('receivedInDays')).toBe('30')
@@ -84,3 +87,96 @@ describe('ZohoDeskBlock receivedInDays reaches the tool intact', () => {
     expect(new URL(throughBlock('')).searchParams.has('receivedInDays')).toBe(false)
   })
 })
+
+/**
+ * Get Ticket accepts `contract` and `skills`; List Tickets does not document
+ * either. A shared subBlock would carry them across an operation switch and put
+ * an undocumented token on the wire, so each endpoint owns its own field.
+ */
+describe('ZohoDeskBlock keeps the two include vocabularies apart', () => {
+  const buildParams = ZohoDeskBlock.tools.config?.params
+
+  const merged = (operation: string) => {
+    if (!buildParams) throw new Error('ZohoDeskBlock is missing tools.config.params')
+    const inputs = {
+      operation,
+      include: 'contacts,assignee',
+      ticketInclude: 'contacts,skills',
+    }
+    return { ...inputs, ...(buildParams(inputs) as Record<string, unknown>) }
+  }
+
+  it('sends the list vocabulary to list_tickets', () => {
+    expect(merged('list_tickets').include).toBe('contacts,assignee')
+  })
+
+  it('sends the single-ticket vocabulary to get_ticket', () => {
+    expect(merged('get_ticket').include).toBe('contacts,skills')
+  })
+
+  it('never leaks skills onto the list endpoint', () => {
+    expect(merged('list_tickets').include).not.toContain('skills')
+  })
+})
+
+/**
+ * A `mode: 'advanced'` subBlock keeps its value when the operation changes, and
+ * the serializer emits it for ANY operation while the block's advanced toggle is
+ * off — it returns on `isNonEmptyValue` without evaluating the subBlock's
+ * `condition`. So these stale values genuinely arrive under the wrong operation,
+ * and the mapper has to overwrite them rather than merely decline to set them.
+ */
+describe('ZohoDeskBlock overwrites stale advanced values from another operation', () => {
+  const buildParams = ZohoDeskBlock.tools.config?.params
+
+  const merged = (inputs: Record<string, unknown>) => {
+    if (!buildParams) throw new Error('ZohoDeskBlock is missing tools.config.params')
+    return { ...inputs, ...(buildParams(inputs) as Record<string, unknown>) }
+  }
+
+  it('does not carry a List Tickets sort field onto List Comments', () => {
+    const result = merged({ operation: 'list_comments', ticketId: '1', sortBy: 'createdTime' })
+    expect(result.sortBy).toBeUndefined()
+  })
+
+  it('does not carry a ticket include onto Get Contact or Get Thread', () => {
+    expect(
+      merged({ operation: 'get_contact', contactId: '9', include: 'contacts,assignee' }).include
+    ).toBeUndefined()
+    expect(
+      merged({ operation: 'get_thread', ticketId: '1', threadId: '2', include: 'contacts' }).include
+    ).toBeUndefined()
+  })
+
+  it('does not carry list-only filters onto another operation', () => {
+    const result = merged({
+      operation: 'get_ticket',
+      ticketId: '1',
+      assigneeFilter: 'Unassigned',
+      channelFilter: 'Email',
+      receivedInDays: '30',
+    })
+    expect(result.assignee).toBeUndefined()
+    expect(result.channel).toBeUndefined()
+    expect(result.receivedInDays).toBeUndefined()
+  })
+
+  it('discards an out-of-range pagination value instead of forwarding it', () => {
+    const result = merged({ operation: 'list_tickets', from: '-5', limit: '0' })
+    expect(result.from).toBeUndefined()
+    expect(result.limit).toBeUndefined()
+  })
+
+  it('survives an emptied department multi-select without throwing', () => {
+    expect(() => throughSeam({ operation: 'list_tickets', departmentIds: [] })).not.toThrow()
+    expect(
+      new URL(throughSeam({ operation: 'list_tickets', departmentIds: [] })).searchParams.has(
+        'departmentIds'
+      )
+    ).toBe(false)
+  })
+
+  it('does not throw on the "Any time" option the dropdown seeds', () => {
+    expect(() => throughSeam({ operation: 'list_tickets', receivedInDays: '' })).not.toThrow()
+  })
+})

apps/sim/tools/zoho_desk/list_tickets.test.ts

@@ -49,7 +49,7 @@ export const zohoDeskListTicketsTool: ToolConfig<ZohoDeskListTicketsParams, Zoho
       type: 'number',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Number of tickets to return (1-100, default 10)',
+      description: 'Number of tickets to return (1-100)',
     },
     departmentIds: {
       type: 'string',
@@ -82,7 +82,7 @@ export const zohoDeskListTicketsTool: ToolConfig<ZohoDeskListTicketsParams, Zoho
       required: false,
       visibility: 'user-or-llm',
       description:
-        'Filter by origin channel (e.g. Email, Web, Phone). Comma-separate to match multiple.',
+        'Filter by origin channel, spelled as your portal spells it. Comma-separate to match multiple.',
     },
     receivedInDays: {
       type: 'number',