[Bug] edit_flow/update_flow cannot save existing connector flows - injected 'authentication' rejected by Dataverse

[BilalHussain]

Plugin

power-automate

Plugin Version

2.0.0

Skill / Command

FlowAgent MCP server — edit_flow and update_flow tools

Bug Description

edit_flow / update_flow cannot save any pre-existing (designer-built) flow that uses connector (OpenApiConnection) actions. The write fails with:

WorkflowRunActionInputsInvalidProperty — The 'inputs' of workflow run action
'<connector-action>' of type 'OpenApiConnection' should not have the property 'authentication'.

Root cause — a read/write asymmetry on the injected authentication property:

• getFlow() (server/mcp.mjs, ~line 28481) reads via the Power Platform API (…/powerautomate/flows/{id}), which returns every OpenApiConnection action with the auto-injected token "authentication": "@parameters('$authentication')".
• editFlow() (~line 28609) does getFlow → apply edits → body = { properties: { definition } } → updateFlow, without stripping authentication.
• updateFlow() (~line 28538) PATCHes that definition back to the same endpoint, which persists to Dataverse clientdata, where authentication is illegal (the engine re-injects it on read). Dataverse rejects the save.

Notably, the server's own validator already knows this (server/mcp.mjs ~line 331, rule extra-authentication: "Do not include authentication in action inputs — the Flow API auto-injects it"), but that sanitation is never applied on the edit/update write path.

create_flow is unaffected because agent-authored definitions don't carry the per-action authentication property; only round-tripped existing flows do.

Steps to Reproduce

1. Pick any existing cloud flow that was built in the Power Automate designer and contains at least one OpenApiConnection (connector) action.
2. Call edit_flow with a valid surgical operation (e.g. change one Compose/expression), or update_flow with the flow's own definition.
3. dryRun / preview_update succeeds (no write).
4. Applying the change fails.

Expected Behavior

The surgical edit is saved. The injected authentication token should be stripped from action inputs before the PATCH (the platform re-injects it on read), exactly as the Power Automate designer does on save.

Actual Behavior

The PATCH is rejected by Dataverse with WorkflowRunActionInputsInvalidProperty ("… should not have the property 'authentication'"), so no edit to a pre-existing connector-based flow can be saved through the tool. dryRun misleads because it never writes.

Relevant Logs / Screenshots

Flow API 400 Bad Request: XrmApiRequestFailed
Flow save failed with code 'WorkflowRunActionInputsInvalidProperty' and message
'The 'inputs' of workflow run action '<connector-action>' of type 'OpenApiConnection'
should not have the property 'authentication'.'
Code: 0x80060467

Proposed fix — strip only the injected token (never user-configured HTTP auth) before the PATCH in updateFlow(), after the preview-token check so the hash still matches:

const stripInjectedAuth = (node) => {
  if (!node || typeof node !== "object") return;
  if (Array.isArray(node)) { for (const v of node) stripInjectedAuth(v); return; }
  if (node.inputs && node.inputs.authentication === "@parameters('$authentication')") {
    delete node.inputs.authentication;
  }
  for (const v of Object.values(node)) stripInjectedAuth(v);
};
if (body?.properties?.definition) stripInjectedAuth(body.properties.definition);

Environment

• OS: Windows 10 Pro (10.0.19045)
• power-automate plugin: 2.0.0
• Power Platform CLI (pac): 2.9.3