fix(github): name the branch-protection parse failure without echoing the input

Author: waleedlatif1

apps/sim/tools/github/branch_protection_and_workflow_runs.test.ts

@@ -100,10 +100,23 @@ describe('github_update_branch_protection body builder', () => {
     expect(body.restrictions).toEqual(restrictions)
   })
 
-  it('rejects a non-object JSON value instead of shipping it to GitHub', () => {
+  it.each(['["octocat"]', '42', 'not json at all', '{"users":'])(
+    'rejects %p instead of shipping it to GitHub',
+    (restrictions) => {
+      expect(() => buildProtectionBody({ ...BASE_PROTECTION_PARAMS, restrictions })).toThrow(
+        /must be a JSON object/
+      )
+    }
+  )
+
+  it('does not echo the rejected value into the error message', () => {
     expect(() =>
-      buildProtectionBody({ ...BASE_PROTECTION_PARAMS, restrictions: '["octocat"]' })
-    ).toThrow(/JSON objects/)
+      buildProtectionBody({ ...BASE_PROTECTION_PARAMS, restrictions: 'ghp_secretlooking' })
+    ).toThrow(
+      expect.objectContaining({
+        message: expect.not.stringContaining('ghp_secretlooking'),
+      })
+    )
   })
 
   it("coerces the dropdown's 'true'/'false' strings to booleans", () => {

apps/sim/tools/github/update_branch_protection.ts

@@ -2,6 +2,14 @@ import type { BranchProtectionResponse, UpdateBranchProtectionParams } from '@/t
 import { BRANCH_PROTECTION_OUTPUT_PROPERTIES } from '@/tools/github/types'
 import type { ToolConfig } from '@/tools/types'
 
+/**
+ * Names the failure class without echoing the rejected text. `JSON.parse` quotes
+ * the input it rejected back into its own message, and these fields can carry
+ * values resolved from other blocks.
+ */
+const BRANCH_PROTECTION_SHAPE_ERROR =
+  'Branch protection fields must be a JSON object, or left empty to disable the rule'
+
 /**
  * GitHub documents `required_status_checks`, `enforce_admins`,
  * `required_pull_request_reviews` and `restrictions` as required body fields
@@ -16,15 +24,20 @@ function toNullableObject(value: unknown): Record<string, unknown> | null {
   if (typeof value === 'string') {
     const trimmed = value.trim()
     if (trimmed === '' || trimmed === 'null') return null
-    const parsed: unknown = JSON.parse(trimmed)
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(trimmed)
+    } catch {
+      throw new Error(BRANCH_PROTECTION_SHAPE_ERROR)
+    }
     if (parsed === null) return null
     if (typeof parsed !== 'object' || Array.isArray(parsed)) {
-      throw new Error('Branch protection fields must be JSON objects')
+      throw new Error(BRANCH_PROTECTION_SHAPE_ERROR)
     }
     return parsed as Record<string, unknown>
   }
   if (typeof value !== 'object' || Array.isArray(value)) {
-    throw new Error('Branch protection fields must be JSON objects')
+    throw new Error(BRANCH_PROTECTION_SHAPE_ERROR)
   }
   return value as Record<string, unknown>
 }