[power-automate][Bug] edit_flow/update_flow apply step crashes with TypeError on Compose actions with string `inputs

[andrewkuan]

Plugin

power-automate

Plugin Version

2.3.1

Skill / Command

edit_flow, update_flow (flowagent MCP tools)

Bug Description

The apply step of both edit_flow (re-submitting operations + previewToken from a prior dryRun) and update_flow (submitting a full definition + previewToken from preview_update) throws a TypeError when the target flow contains a Compose action whose inputs value is a plain string expression (e.g. "inputs": "@union(body('A'), body('B'))") rather than an object. This is a normal, common Logic Apps definition shape — Compose actions routinely have a string inputs — so any flow containing one cannot be edited via either tool's apply step, even when the change being applied doesn't touch that action at all. The preview/dryRun step itself works fine and correctly reports the offending action as unchanged in its diff.

Steps to Reproduce

1. Have a flow whose definition contains at least one Compose action with a string inputs value, e.g.:

   "SomeCompose": { "type": "Compose", "inputs": "@union(body('X'), body('Y'))" }

2. Call edit_flow with dryRun: true and operations targeting other, unrelated actions. This succeeds, returning a diff (correctly showing the Compose action as unchanged) and a previewToken.
3. Re-call edit_flow with the same operations + previewToken (dryRun omitted/false) to apply. Alternatively, call preview_update with a full definition, then update_flow with that definition + the returned token.
4. Apply throws immediately.

Expected Behavior

The apply step should perform the same diff that was just previewed and validated, since the previewed diff explicitly reported the string-valued Compose action as unchanged.

Actual Behavior

Apply throws: TypeError: Cannot use 'in' operator to search for 'authentication' in <the Compose action's string inputs value>. This reproduced identically 3 times in a row (once via edit_flow, twice via update_flow) against the same flow, with different operation sets/tokens each time. No partial write occurs — the flow's live definition was confirmed unchanged via get_flow after each crash. Both code paths (surgical edit and whole-definition replace) appear to share an internal step that iterates every action's inputs checking for an authentication key via the in operator, without guarding for inputs being a non-object (string) value.

Relevant Logs / Screenshots

Error surfaced identically from both tools:

{
  "code": "tool-error",
  "message": "Cannot use 'in' operator to search for 'authentication' in @union(body('Non_Empty_IDs'), body('Non_Empty_IDs'))",
  "errorName": "TypeError"
}

(Action names above — Non_Empty_IDs — are generic, not sensitive.)

Environment

OS: macOS 26.5.2 (Build 25F84)
Claude Code: 2.1.222
PAC CLI: not installed in this environment (session used the flowagent MCP server directly, not the pac CLI)

---

🤖 This issue was created using the /report-issue skill.

[radioblazer]

Fixed in v3.0.1 — resolved in PR #393, merged 2026-08-12.

Please update to v3.0.1 and let us know if you're still seeing this.