[power-automate][Bug] run_flow routes body to an unauthenticated callback (inverted branch) — cannot invoke PowerApps-V2 / Direct-API triggers

[ammulshergill]

Plugin

power-automate

Plugin Version

2.5.0

Skill / Command

MCP tool: run_flow

Bug Description

run_flow's branch logic appears inverted with respect to authentication. Verified by reading the bundled plugins/power-automate/server/mcp.mjs:

• Supplying a body routes to runFlowViaCallback() — a bare fetch() POST to the SAS callback URL with no Authorization header. For a PowerApps-V2 / Direct-API trigger this fails with DirectApiAuthorizationRequired (the claims check cannot be satisfied by an unauthenticated call).
• Omitting the body routes to runFlow() — the authenticated PPAPI management path (/triggers/{name}/run), which also accepts a body (ppapiRequestWithFallback(envId, path, "POST", triggerBody ?? {})).

So the two capabilities ("supply a body" and "use the authenticated path") both exist in the client class but are not reachable together through the exposed tool — and the branch selects the unauthenticated path precisely when a body (the thing that needs the authenticated path) is provided.

Suggested fix

Prefer the authenticated runFlow() when a body is supplied; fall back to runFlowViaCallback() only if runFlow() fails for a reason indicating the trigger kind is unsupported.

Related

Adjacent to #280 (closed — "run_flow with body fails for Button/manual triggers"); this report is the source-level root cause and also covers PowerApps-V2 / Direct-API triggers.