fix(connectors): ado auth-failure deletion guard, jsm last-page slice flag, google-forms response cap in hash

Author: waleedlatif1

apps/sim/connectors/azure-devops/azure-devops.ts

@@ -287,7 +287,8 @@ async function listWikis(
   accessToken: string,
   organization: string,
   project: string,
-  retryOptions?: Parameters<typeof fetchWithRetry>[2]
+  retryOptions?: Parameters<typeof fetchWithRetry>[2],
+  syncContext?: Record<string, unknown>
 ): Promise<WikiV2[]> {
   const url = `${ADO_BASE_URL}/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/wiki/wikis?api-version=${WIKIS_LIST_API_VERSION}`
   const response = await fetchWithRetry(
@@ -300,6 +301,15 @@ async function listWikis(
   )
   if (!response.ok) {
     if (response.status === 401 || response.status === 403 || response.status === 404) {
+      /**
+       * 401/403 mean the wikis still exist but this PAT cannot read them right
+       * now — flag the listing as incomplete so reconciliation does not delete
+       * previously synced wiki pages. A 404 means the wiki feature/content is
+       * genuinely absent, so reconciliation stays enabled.
+       */
+      if ((response.status === 401 || response.status === 403) && syncContext) {
+        syncContext.listingCapped = true
+      }
       logger.warn('Azure DevOps wikis unavailable; skipping wiki listing', {
         organization,
         project,
@@ -327,7 +337,7 @@ async function resolveWikis(
 ): Promise<WikiV2[]> {
   const cached = syncContext?.wikis as WikiV2[] | undefined
   if (cached) return cached
-  const wikis = await listWikis(accessToken, organization, project)
+  const wikis = await listWikis(accessToken, organization, project, undefined, syncContext)
   if (syncContext) syncContext.wikis = wikis
   return wikis
 }
@@ -642,7 +652,8 @@ async function listRepositories(
   accessToken: string,
   organization: string,
   project: string,
-  retryOptions?: Parameters<typeof fetchWithRetry>[2]
+  retryOptions?: Parameters<typeof fetchWithRetry>[2],
+  syncContext?: Record<string, unknown>
 ): Promise<GitRepository[]> {
   const url = `${ADO_BASE_URL}/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/git/repositories?api-version=${GIT_API_VERSION}`
   const response = await fetchWithRetry(
@@ -655,6 +666,15 @@ async function listRepositories(
   )
   if (!response.ok) {
     if (response.status === 401 || response.status === 403 || response.status === 404) {
+      /**
+       * 401/403 mean repositories still exist but this PAT cannot read them
+       * right now — flag the listing as incomplete so reconciliation does not
+       * delete previously synced repository files. A 404 means the Git feature
+       * is genuinely absent, so reconciliation stays enabled.
+       */
+      if ((response.status === 401 || response.status === 403) && syncContext) {
+        syncContext.listingCapped = true
+      }
       logger.warn('Azure DevOps repositories unavailable; skipping file listing', {
         organization,
         project,
@@ -686,7 +706,8 @@ async function resolveRepositories(
   syncContext?: Record<string, unknown>
 ): Promise<GitRepository[]> {
   const cached = syncContext?.repositories as GitRepository[] | undefined
-  const all = cached ?? (await listRepositories(accessToken, organization, project))
+  const all =
+    cached ?? (await listRepositories(accessToken, organization, project, undefined, syncContext))
   if (syncContext && !cached) syncContext.repositories = all
 
   const needle = repositoryFilter.toLowerCase()
@@ -707,7 +728,8 @@ async function listRepositoryBlobs(
   organization: string,
   project: string,
   repoId: string,
-  branch: string
+  branch: string,
+  syncContext?: Record<string, unknown>
 ): Promise<GitItem[]> {
   const params = new URLSearchParams({
     recursionLevel: 'Full',
@@ -722,6 +744,16 @@ async function listRepositoryBlobs(
   })
   if (!response.ok) {
     if (response.status === 401 || response.status === 403 || response.status === 404) {
+      /**
+       * 401/403 mean the repository's files still exist but this PAT cannot
+       * read them right now — flag the listing as incomplete so reconciliation
+       * does not delete previously synced files. A 404 means the branch/repo
+       * content is genuinely absent (empty repo, deleted branch), so
+       * reconciliation stays enabled.
+       */
+      if ((response.status === 401 || response.status === 403) && syncContext) {
+        syncContext.listingCapped = true
+      }
       logger.warn('Azure DevOps repository items unavailable; skipping repository', {
         repoId,
         branch,
@@ -824,7 +856,14 @@ async function resolveRepoFiles(
       })
       continue
     }
-    const blobs = await listRepositoryBlobs(accessToken, organization, project, repo.id, branch)
+    const blobs = await listRepositoryBlobs(
+      accessToken,
+      organization,
+      project,
+      repo.id,
+      branch,
+      syncContext
+    )
     for (const item of blobs) {
       if (normalizedPrefix && !item.path.startsWith(normalizedPrefix)) continue
       if (!matchesExtension(item.path, filters.extensions)) continue

apps/sim/connectors/google-forms/google-forms.ts

@@ -143,6 +143,18 @@ interface FormStubInput {
   revisionId?: string
   latestResponseTime?: string
   contentScope: ContentScope
+  responseCap: number
+}
+
+/**
+ * Resolves the effective per-form response cap applied when rendering content:
+ * the user-configured `maxResponsesPerForm` clamped to the hard
+ * `MAX_RESPONSES_PER_FORM` ceiling. Part of the content hash so changing the
+ * cap re-syncs every form (the rendered content depends on it).
+ */
+function resolveResponseCap(sourceConfig: Record<string, unknown>): number {
+  const configured = parsePositiveInt(sourceConfig.maxResponsesPerForm)
+  return configured > 0 ? Math.min(configured, MAX_RESPONSES_PER_FORM) : MAX_RESPONSES_PER_FORM
 }
 
 /**
@@ -334,7 +346,10 @@ function latestResponseTime(responses: FormResponse[]): string | undefined {
  * forces a re-sync of every document.
  */
 function formContentHash(input: FormStubInput): string {
-  const responsePart = input.contentScope === 'both' ? (input.latestResponseTime ?? '') : 'none'
+  const responsePart =
+    input.contentScope === 'both'
+      ? `${input.latestResponseTime ?? ''}:${input.responseCap}`
+      : 'none'
   return `gforms:${input.file.id}:${input.contentScope}:${input.revisionId ?? ''}:${responsePart}`
 }
 
@@ -514,6 +529,7 @@ export const googleFormsConnector: ConnectorConfig = {
   ): Promise<ExternalDocumentList> => {
     const maxForms = parsePositiveInt(sourceConfig.maxForms)
     const contentScope = resolveContentScope(sourceConfig.contentScope)
+    const responseCap = resolveResponseCap(sourceConfig)
     const previouslyFetched = (syncContext?.totalDocsFetched as number) ?? 0
 
     if (maxForms > 0 && previouslyFetched >= maxForms) {
@@ -586,6 +602,7 @@ export const googleFormsConnector: ConnectorConfig = {
           revisionId: form.revisionId,
           latestResponseTime: latest,
           contentScope,
+          responseCap,
         })
       } catch (error) {
         skippedOnError = true
@@ -661,16 +678,14 @@ export const googleFormsConnector: ConnectorConfig = {
       const form = await fetchFormStructure(accessToken, file.id)
       if (!form) return null
 
-      const maxResponses = parsePositiveInt(sourceConfig.maxResponsesPerForm)
+      const responseCap = resolveResponseCap(sourceConfig)
       const fetched =
         contentScope === 'both'
           ? await fetchFormResponses(accessToken, file.id)
           : { responses: [], latestSubmittedTime: undefined }
       const responses = fetched.responses
       const cappedResponses =
-        maxResponses > 0 && responses.length > maxResponses
-          ? responses.slice(0, maxResponses)
-          : responses
+        responses.length > responseCap ? responses.slice(0, responseCap) : responses
 
       const content = renderFormDocument(form, cappedResponses)
       if (!content.trim()) return null
@@ -681,6 +696,7 @@ export const googleFormsConnector: ConnectorConfig = {
         revisionId: form.revisionId,
         latestResponseTime: fetched.latestSubmittedTime,
         contentScope,
+        responseCap,
       })
       return { ...stub, content, contentDeferred: false }
     } catch (error) {

apps/sim/connectors/jsm/jsm.ts

@@ -518,7 +518,9 @@ export const jsmConnector: ConnectorConfig = {
     const data = (await response.json()) as JsmPage<JsmRequest>
     let requests = data.values ?? []
 
+    let slicedSome = false
     if (maxRequests > 0 && requests.length > remaining) {
+      slicedSome = true
       requests = requests.slice(0, remaining)
     }
 
@@ -533,8 +535,12 @@ export const jsmConnector: ConnectorConfig = {
      * When `maxRequests` truncates the listing before the source is exhausted,
      * flag the run as capped so the sync engine skips deletion reconciliation —
      * otherwise unseen requests beyond the cap would be deleted on every sync.
+     * `slicedSome` covers truncation on the final page: requests dropped from
+     * this page still exist even when `isLastPage` is true. (The requested
+     * `limit` never exceeds the remaining budget, so a slice should be
+     * impossible — this is defense in depth against the API over-returning.)
      */
-    if (reachedCap && !data.isLastPage && syncContext) {
+    if (((reachedCap && !data.isLastPage) || slicedSome) && syncContext) {
       syncContext.listingCapped = true
     }