@tiledesk/tiledesk-tybot-connector 2.1.2 → 2.1.5

package/AnalyticsClient.js

@@ -2,6 +2,7 @@
 
 const axios = require('axios');
 const { v4: uuidv4 } = require('uuid');
+const winston = require('./utils/winston');
 
 class AnalyticsClient {
 
@@ -17,7 +18,10 @@ class AnalyticsClient {
   static track(eventType, projectId, payload) {
     // Read env vars at call time so tests (and runtime reconfig) can override them.
     const ingestUrl = process.env.ANALYTICS_INGEST_URL;
-    if (!ingestUrl) return;
+    if (!ingestUrl) {
+      winston.debug("(AnalyticsClient) ANALYTICS_INGEST_URL not set; skipping event_type=" + eventType);
+      return;
+    }
 
     const event = {
       event_id:       uuidv4(),
@@ -35,12 +39,26 @@ class AnalyticsClient {
       headers['X-Api-Key'] = apiKey;
     }
 
+    // [analytics-debug] Log the POST and its outcome so dropped/rejected events
+    // (e.g. ingest 422 validation failures, 503 broker-down) are visible in the
+    // chatbot logs instead of being silently swallowed.
+    winston.debug("(AnalyticsClient) POST /events event_type=" + eventType + " event_id=" + event.event_id, payload);
+
     axios.post(
       ingestUrl + '/events',
       event,
       { headers, timeout: 3000 }
-    ).catch(() => {
-      // fire-and-forget: swallow all errors, never propagate to chatbot
+    ).then((res) => {
+      winston.debug("(AnalyticsClient) event accepted event_type=" + eventType + " event_id=" + event.event_id + " status=" + res.status);
+    }).catch((err) => {
+      // fire-and-forget: never propagate to chatbot, but log so drops are visible.
+      const status = err.response ? err.response.status : undefined;
+      const body = err.response ? err.response.data : undefined;
+      winston.warn("(AnalyticsClient) event REJECTED/FAILED event_type=" + eventType +
+        " event_id=" + event.event_id +
+        " status=" + status +
+        " error=" + (err.message || err) +
+        " response=" + (body ? JSON.stringify(body) : '<none>'));
     });
   }
 }

package/CHANGELOG.md

@@ -5,6 +5,9 @@
 available on:
  ▶️ https://www.npmjs.com/package/@tiledesk/tiledesk-tybot-connector
 
+# this branch
+- added: JSON Condition V2 runtime — new `jsoncondition2` type routed to `DirJSONConditionV2` (evaluates the `when` expression via `TiledeskWhenExpression`, no eval/vm2); V1 `jsoncondition` dispatch left unchanged (`DirJSONCondition`) for full backward-compatibility
+
 # 2.1.0
 - added: support to analytics
 

package/TiledeskWhenExpression.js

@@ -0,0 +1,541 @@
+/**
+ * TiledeskWhenExpression
+ *
+ * Safe evaluator for the new `when` field of JSON conditions.
+ *
+ * Design goals (see security review of TiledeskExpression.evaluateJavascriptExpression):
+ *  - NO `eval`, NO `Function`, NO `vm`/`vm2`. The expression is parsed into an AST
+ *    and interpreted by walking the tree. Code is never generated from data.
+ *  - Whitelisted operators and whitelisted functions only.
+ *  - Property access is blocked on dangerous keys (__proto__, prototype, constructor).
+ *  - Function calls are allowed ONLY for plain identifiers present in the function
+ *    whitelist (no method calls on arbitrary objects -> blocks `x.constructor(...)`).
+ *  - Identifiers resolve exclusively against the provided variables map (own props only),
+ *    so there is no access to host globals.
+ *  - Hard limits on input length and recursion depth.
+ *
+ * This file lives ALONGSIDE the legacy TiledeskExpression.js, which is left untouched.
+ *
+ * Public API:
+ *   const { TiledeskWhenExpression } = require('./TiledeskWhenExpression');
+ *   const value = new TiledeskWhenExpression().evaluate(whenString, variables);
+ *   // throws WhenSyntaxError / WhenEvalError on failure (callers decide how to route)
+ */
+
+class WhenSyntaxError extends Error {
+  constructor(message) { super(message); this.name = 'WhenSyntaxError'; }
+}
+class WhenEvalError extends Error {
+  constructor(message) { super(message); this.name = 'WhenEvalError'; }
+}
+
+const TOKEN = { NUM: 'num', STR: 'str', IDENT: 'ident', OP: 'op', PUNC: 'punc', EOF: 'eof' };
+
+// Binary operator precedence (higher binds tighter). Unary operators handled separately.
+const BIN_PRECEDENCE = {
+  '||': 1,
+  '&&': 2,
+  '==': 3, '!=': 3, '===': 3, '!==': 3,
+  '<': 4, '<=': 4, '>': 4, '>=': 4,
+  '+': 5, '-': 5,
+  '*': 6, '/': 6, '%': 6,
+};
+
+const FORBIDDEN_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+
+const MAX_EXPRESSION_LENGTH = 10000;
+const MAX_DEPTH = 100;
+
+// ---------------------------------------------------------------------------
+// Tokenizer
+// ---------------------------------------------------------------------------
+
+function isIdentStart(c) { return /[A-Za-z_$]/.test(c); }
+function isIdentPart(c) { return /[A-Za-z0-9_$]/.test(c); }
+function isDigit(c) { return c >= '0' && c <= '9'; }
+
+function tokenize(src) {
+  const tokens = [];
+  let i = 0;
+  const n = src.length;
+
+  while (i < n) {
+    const c = src[i];
+
+    // whitespace
+    if (c === ' ' || c === '\t' || c === '\n' || c === '\r') { i++; continue; }
+
+    // string literal
+    if (c === '"' || c === "'") {
+      const quote = c;
+      i++;
+      let s = '';
+      while (i < n && src[i] !== quote) {
+        if (src[i] === '\\') {
+          i++;
+          const e = src[i];
+          if (e === 'n') s += '\n';
+          else if (e === 't') s += '\t';
+          else if (e === 'r') s += '\r';
+          else if (e === '\\') s += '\\';
+          else if (e === '"') s += '"';
+          else if (e === "'") s += "'";
+          else s += (e === undefined ? '' : e);
+          i++;
+        } else {
+          s += src[i];
+          i++;
+        }
+      }
+      if (i >= n) throw new WhenSyntaxError('Unterminated string literal');
+      i++; // consume closing quote
+      tokens.push({ type: TOKEN.STR, value: s });
+      continue;
+    }
+
+    // number literal
+    if (isDigit(c) || (c === '.' && isDigit(src[i + 1]))) {
+      const start = i;
+      while (i < n && isDigit(src[i])) i++;
+      if (src[i] === '.') { i++; while (i < n && isDigit(src[i])) i++; }
+      if (src[i] === 'e' || src[i] === 'E') {
+        i++;
+        if (src[i] === '+' || src[i] === '-') i++;
+        while (i < n && isDigit(src[i])) i++;
+      }
+      tokens.push({ type: TOKEN.NUM, value: Number(src.slice(start, i)) });
+      continue;
+    }
+
+    // identifier / keyword
+    if (isIdentStart(c)) {
+      const start = i;
+      i++;
+      while (i < n && isIdentPart(src[i])) i++;
+      tokens.push({ type: TOKEN.IDENT, value: src.slice(start, i) });
+      continue;
+    }
+
+    // multi-char operators (longest match first)
+    const three = src.slice(i, i + 3);
+    if (three === '===' || three === '!==') { tokens.push({ type: TOKEN.OP, value: three }); i += 3; continue; }
+
+    const two = src.slice(i, i + 2);
+    if (two === '?.') { tokens.push({ type: TOKEN.PUNC, value: '?.' }); i += 2; continue; }
+    if (two === '==' || two === '!=' || two === '<=' || two === '>=' || two === '&&' || two === '||') {
+      tokens.push({ type: TOKEN.OP, value: two }); i += 2; continue;
+    }
+
+    // single-char operators
+    if ('+-*/%<>!'.includes(c)) { tokens.push({ type: TOKEN.OP, value: c }); i++; continue; }
+
+    // punctuators
+    if ('()[],.'.includes(c)) { tokens.push({ type: TOKEN.PUNC, value: c }); i++; continue; }
+
+    throw new WhenSyntaxError("Unexpected character '" + c + "' at position " + i);
+  }
+
+  tokens.push({ type: TOKEN.EOF, value: null });
+  return tokens;
+}
+
+// ---------------------------------------------------------------------------
+// Parser (recursive descent + precedence climbing)
+// ---------------------------------------------------------------------------
+
+class Parser {
+  constructor(tokens) { this.tokens = tokens; this.pos = 0; }
+
+  peek() { return this.tokens[this.pos]; }
+  next() { return this.tokens[this.pos++]; }
+
+  expectPunc(value) {
+    const t = this.next();
+    if (!(t.type === TOKEN.PUNC && t.value === value)) {
+      throw new WhenSyntaxError("Expected '" + value + "' but found '" + t.value + "'");
+    }
+  }
+
+  parse() {
+    const node = this.parseExpression();
+    if (this.peek().type !== TOKEN.EOF) {
+      throw new WhenSyntaxError("Unexpected token '" + this.peek().value + "'");
+    }
+    return node;
+  }
+
+  parseExpression() { return this.parseBinary(0); }
+
+  parseBinary(minPrec) {
+    let left = this.parseUnary();
+    while (true) {
+      const t = this.peek();
+      if (t.type !== TOKEN.OP) break;
+      const prec = BIN_PRECEDENCE[t.value];
+      if (prec === undefined || prec < minPrec) break;
+      this.next();
+      const right = this.parseBinary(prec + 1); // left-associative
+      if (t.value === '&&' || t.value === '||') {
+        left = { type: 'Logical', op: t.value, left, right };
+      } else {
+        left = { type: 'Binary', op: t.value, left, right };
+      }
+    }
+    return left;
+  }
+
+  parseUnary() {
+    const t = this.peek();
+    if (t.type === TOKEN.OP && (t.value === '!' || t.value === '-' || t.value === '+')) {
+      this.next();
+      return { type: 'Unary', op: t.value, arg: this.parseUnary() };
+    }
+    return this.parsePostfix();
+  }
+
+  parsePostfix() {
+    let node = this.parsePrimary();
+    while (true) {
+      const t = this.peek();
+      if (t.type === TOKEN.PUNC && t.value === '.') {
+        this.next();
+        const id = this.next();
+        if (id.type !== TOKEN.IDENT) throw new WhenSyntaxError("Expected property name after '.'");
+        node = { type: 'Member', object: node, property: id.value, computed: false, optional: false };
+      } else if (t.type === TOKEN.PUNC && t.value === '?.') {
+        this.next();
+        if (this.peek().type === TOKEN.PUNC && this.peek().value === '[') {
+          this.next();
+          const expr = this.parseExpression();
+          this.expectPunc(']');
+          node = { type: 'Member', object: node, property: expr, computed: true, optional: true };
+        } else {
+          const id = this.next();
+          if (id.type !== TOKEN.IDENT) throw new WhenSyntaxError("Expected property name after '?.'");
+          node = { type: 'Member', object: node, property: id.value, computed: false, optional: true };
+        }
+      } else if (t.type === TOKEN.PUNC && t.value === '[') {
+        this.next();
+        const expr = this.parseExpression();
+        this.expectPunc(']');
+        node = { type: 'Member', object: node, property: expr, computed: true, optional: false };
+      } else if (t.type === TOKEN.PUNC && t.value === '(') {
+        this.next();
+        const args = [];
+        if (!(this.peek().type === TOKEN.PUNC && this.peek().value === ')')) {
+          args.push(this.parseExpression());
+          while (this.peek().type === TOKEN.PUNC && this.peek().value === ',') {
+            this.next();
+            args.push(this.parseExpression());
+          }
+        }
+        this.expectPunc(')');
+        node = { type: 'Call', callee: node, args };
+      } else {
+        break;
+      }
+    }
+    return node;
+  }
+
+  parsePrimary() {
+    const t = this.next();
+    if (t.type === TOKEN.NUM) return { type: 'Literal', value: t.value };
+    if (t.type === TOKEN.STR) return { type: 'Literal', value: t.value };
+    if (t.type === TOKEN.IDENT) {
+      if (t.value === 'true') return { type: 'Literal', value: true };
+      if (t.value === 'false') return { type: 'Literal', value: false };
+      if (t.value === 'null') return { type: 'Literal', value: null };
+      if (t.value === 'undefined') return { type: 'Literal', value: undefined };
+      return { type: 'Identifier', name: t.value };
+    }
+    if (t.type === TOKEN.PUNC && t.value === '(') {
+      const node = this.parseExpression();
+      this.expectPunc(')');
+      return node;
+    }
+    throw new WhenSyntaxError("Unexpected token '" + (t.value === null ? 'EOF' : t.value) + "'");
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Evaluator helpers (type coercion mirrors the intent of the legacy operators)
+// ---------------------------------------------------------------------------
+
+function isNumeric(v) {
+  if (typeof v === 'number') return Number.isFinite(v);
+  if (typeof v === 'string' && v.trim() !== '') return Number.isFinite(Number(v));
+  return false;
+}
+
+// Boolean coercion per the `when` grammar (§3): only true / "true" coerce to
+// true, only false / "false" to false; anything else coerces to false.
+function coerceBoolean(v) {
+  if (v === true) return true;
+  if (v === false) return false;
+  if (typeof v === 'string') {
+    const s = v.trim().toLowerCase();
+    if (s === 'true') return true;
+    if (s === 'false') return false;
+  }
+  return false;
+}
+
+// Parse a value into a Date (ISO-8601 strings, epoch numbers, Date instances).
+// Returns null when the value is missing or not a valid date.
+function parseDate(v) {
+  if (v === null || v === undefined || v === '') return null;
+  const d = (v instanceof Date) ? v : new Date(v);
+  return Number.isNaN(d.getTime()) ? null : d;
+}
+
+// Structural (deep) equality for arrays / plain objects coming from JSON
+// variables. Used when both sides of == / != resolve to objects.
+function deepEqual(a, b, depth) {
+  if (depth > MAX_DEPTH) return false;
+  if (a === b) return true;
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
+  if (Array.isArray(a) !== Array.isArray(b)) return false;
+  const ak = Object.keys(a), bk = Object.keys(b);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    if (FORBIDDEN_KEYS.has(k)) continue;
+    if (!Object.prototype.hasOwnProperty.call(b, k)) return false;
+    if (!deepEqual(a[k], b[k], depth + 1)) return false;
+  }
+  return true;
+}
+
+// Equality whose semantics follow the RIGHT operand's type, mirroring the
+// grammar's disambiguation of the single `==` token:
+//   x == "y"   -> text    (case-sensitive String comparison)
+//   x == N     -> number  (numeric coercion; non-numeric left -> not equal)
+//   x == true  -> boolean (coerceBoolean on the left)
+//   x == otherVar -> compare by the resolved value (deep equality for objects)
+function looseEq(l, r) {
+  if (typeof r === 'boolean') return coerceBoolean(l) === r;
+  if (typeof r === 'number') {
+    // Only real numbers / numeric strings compare numerically; arrays, objects,
+    // booleans and empty/non-numeric strings are NOT a number -> not equal.
+    return isNumeric(l) && Number(l) === r;
+  }
+  if (r !== null && typeof r === 'object') return deepEqual(l, r, 0);
+  // string / null / undefined right operand -> case-sensitive text comparison
+  return String(l) === String(r);
+}
+
+// Relational operators (<, <=, >, >=) are numeric-only per the grammar (§3).
+// Anything that is not a number / numeric string (arrays, objects, booleans,
+// empty strings, missing values) yields false instead of a coerced comparison.
+function numericCompare(op, l, r) {
+  if (!isNumeric(l) || !isNumeric(r)) return false;
+  const a = Number(l), b = Number(r);
+  switch (op) {
+    case '<': return a < b;
+    case '<=': return a <= b;
+    case '>': return a > b;
+    case '>=': return a >= b;
+    default: return false;
+  }
+}
+
+function applyBinary(op, l, r) {
+  switch (op) {
+    case '+':
+      if (isNumeric(l) && isNumeric(r)) return Number(l) + Number(r);
+      return String(l) + String(r);
+    case '-': return Number(l) - Number(r);
+    case '*': return Number(l) * Number(r);
+    case '/': return Number(l) / Number(r);
+    case '%': return Number(l) % Number(r);
+    case '==': return looseEq(l, r);
+    case '!=': return !looseEq(l, r);
+    case '===': return l === r;
+    case '!==': return l !== r;
+    case '<':
+    case '<=':
+    case '>':
+    case '>=': return numericCompare(op, l, r);
+    default: throw new WhenEvalError('Unknown binary operator: ' + op);
+  }
+}
+
+// Whitelisted functions callable from a `when` expression. This table covers
+// the full JSON-condition grammar (see docs/json-condition-when-grammar.md) and
+// is the ONLY way an expression can invoke code. No function ever throws: on bad
+// input it returns false (predicates) or a neutral value, so a condition that
+// cannot be evaluated simply resolves falsy.
+const DEFAULT_FUNCTIONS = {
+  // --- Text (case-sensitive; grammar §3) ---------------------------------
+  startsWith: (a, b) => String(a).startsWith(String(b)),
+  notStartsWith: (a, b) => !String(a).startsWith(String(b)),
+  endsWith: (a, b) => String(a).endsWith(String(b)),
+  contains: (a, b) => String(a).includes(String(b)),
+  matches: (a, b) => { try { return new RegExp(String(b)).test(String(a)); } catch (e) { return false; } },
+  // Legacy *IgnoreCase operators were removed by the grammar (§5); if they
+  // surface in old data, evaluate them as their case-sensitive equivalent.
+  startsWithIgnoreCase: (a, b) => String(a).startsWith(String(b)),
+  containsIgnoreCase: (a, b) => String(a).includes(String(b)),
+
+  // --- Existence / emptiness ---------------------------------------------
+  // isEmpty: null/undefined, "", [], or {} are empty; scalars are never empty.
+  isEmpty: (a) => {
+    if (a === null || a === undefined) return true;
+    if (typeof a === 'string') return a === '';
+    if (Array.isArray(a)) return a.length === 0;
+    if (typeof a === 'object') return Object.keys(a).length === 0;
+    return false;
+  },
+  isNull: (a) => a === null,
+  isUndefined: (a) => a === undefined,
+
+  // --- Date / time (ISO-8601; any invalid/missing date -> false) ---------
+  dateEqual: (a, b) => { const x = parseDate(a), y = parseDate(b); return !!(x && y) && x.getTime() === y.getTime(); },
+  isAfter: (a, b) => { const x = parseDate(a), y = parseDate(b); return !!(x && y) && x.getTime() > y.getTime(); },
+  isBefore: (a, b) => { const x = parseDate(a), y = parseDate(b); return !!(x && y) && x.getTime() < y.getTime(); },
+  isAfterOrEqual: (a, b) => { const x = parseDate(a), y = parseDate(b); return !!(x && y) && x.getTime() >= y.getTime(); },
+  isBeforeOrEqual: (a, b) => { const x = parseDate(a), y = parseDate(b); return !!(x && y) && x.getTime() <= y.getTime(); },
+
+  // --- Array -------------------------------------------------------------
+  // arrayContains: coerce the left side to an array (parse JSON strings), then
+  // membership-test comparing elements as strings (no substring false positive).
+  arrayContains: (a, b) => {
+    let arr = a;
+    if (typeof a === 'string') {
+      try { const parsed = JSON.parse(a); if (Array.isArray(parsed)) arr = parsed; } catch (e) { /* not a JSON array */ }
+    }
+    if (!Array.isArray(arr)) return false;
+    return arr.some((el) => String(el) === String(b));
+  },
+  // length: array element count, or string character length, otherwise 0.
+  length: (a) => {
+    if (Array.isArray(a)) return a.length;
+    if (typeof a === 'string') return a.length;
+    return 0;
+  },
+
+  // --- Scalar transforms (not condition operators, kept for expression use)
+  upperCase: (a) => String(a).toUpperCase(),
+  lowerCase: (a) => String(a).toLowerCase(),
+  capitalize: (a) => { const s = String(a); return s.charAt(0).toUpperCase() + s.slice(1); },
+  abs: (a) => Math.abs(Number(a)),
+  ceil: (a) => Math.ceil(Number(a)),
+  floor: (a) => Math.floor(Number(a)),
+  round: (a) => Math.round(Number(a)),
+  cos: (a) => Math.cos(Number(a)),
+  sin: (a) => Math.sin(Number(a)),
+  tan: (a) => Math.tan(Number(a)),
+  convertToNumber: (a) => Number(a),
+};
+
+// ---------------------------------------------------------------------------
+// Evaluator
+// ---------------------------------------------------------------------------
+
+function evalNode(node, scope, fns, depth) {
+  if (depth > MAX_DEPTH) throw new WhenEvalError('Expression nesting too deep');
+
+  switch (node.type) {
+    case 'Literal':
+      return node.value;
+
+    case 'Identifier': {
+      const name = node.name;
+      if (FORBIDDEN_KEYS.has(name)) return undefined;
+      return Object.prototype.hasOwnProperty.call(scope, name) ? scope[name] : undefined;
+    }
+
+    case 'Unary': {
+      const v = evalNode(node.arg, scope, fns, depth + 1);
+      if (node.op === '!') return !v;
+      if (node.op === '-') return -Number(v);
+      if (node.op === '+') return +Number(v);
+      throw new WhenEvalError('Unknown unary operator: ' + node.op);
+    }
+
+    case 'Logical': {
+      const l = evalNode(node.left, scope, fns, depth + 1);
+      if (node.op === '&&') return l ? evalNode(node.right, scope, fns, depth + 1) : l;
+      if (node.op === '||') return l ? l : evalNode(node.right, scope, fns, depth + 1);
+      throw new WhenEvalError('Unknown logical operator: ' + node.op);
+    }
+
+    case 'Binary': {
+      const l = evalNode(node.left, scope, fns, depth + 1);
+      const r = evalNode(node.right, scope, fns, depth + 1);
+      return applyBinary(node.op, l, r);
+    }
+
+    case 'Member': {
+      const obj = evalNode(node.object, scope, fns, depth + 1);
+      if (obj === null || obj === undefined) return undefined; // safe + handles optional chaining
+      let key = node.computed ? evalNode(node.property, scope, fns, depth + 1) : node.property;
+      key = String(key);
+      if (FORBIDDEN_KEYS.has(key)) return undefined;
+      return obj[key];
+    }
+
+    case 'Call': {
+      // Only plain whitelisted identifiers may be called. This blocks any method
+      // call on arbitrary objects (e.g. x.constructor(...), [].map(...)).
+      if (node.callee.type !== 'Identifier') {
+        throw new WhenEvalError('Only whitelisted function calls are allowed');
+      }
+      const fname = node.callee.name;
+      const fn = fns[fname];
+      if (typeof fn !== 'function') throw new WhenEvalError('Function not allowed: ' + fname);
+      const args = node.args.map((a) => evalNode(a, scope, fns, depth + 1));
+      return fn(...args);
+    }
+
+    default:
+      throw new WhenEvalError('Unknown node type: ' + node.type);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Public class
+// ---------------------------------------------------------------------------
+
+class TiledeskWhenExpression {
+  /**
+   * @param {object} [options]
+   * @param {object} [options.functions] extra/override whitelisted functions
+   * @param {number} [options.maxLength] max expression length
+   */
+  constructor(options) {
+    this.functions = Object.assign({}, DEFAULT_FUNCTIONS, options && options.functions);
+    this.maxLength = (options && options.maxLength) || MAX_EXPRESSION_LENGTH;
+  }
+
+  /** Parse only (useful for validation/tests). Throws WhenSyntaxError on failure. */
+  parse(expression) {
+    if (typeof expression !== 'string') throw new WhenSyntaxError('expression must be a string');
+    if (expression.length > this.maxLength) throw new WhenSyntaxError('expression too long');
+    return new Parser(tokenize(expression)).parse();
+  }
+
+  /**
+   * Evaluate a `when` expression against a variables map.
+   * @returns the evaluated value (commonly a boolean).
+   * @throws WhenSyntaxError on parse errors, WhenEvalError on evaluation errors.
+   */
+  evaluate(expression, variables) {
+    const ast = this.parse(expression);
+    const scope = (variables && typeof variables === 'object') ? variables : {};
+    return evalNode(ast, scope, this.functions, 0);
+  }
+
+  /** Convenience: evaluate and coerce to boolean; returns null on any error. */
+  evaluateAsBoolean(expression, variables) {
+    try {
+      const v = this.evaluate(expression, variables);
+      if (v === null || v === undefined) return null;
+      return Boolean(v);
+    } catch (e) {
+      return null;
+    }
+  }
+}
+
+module.exports = { TiledeskWhenExpression, WhenSyntaxError, WhenEvalError };

package/engine/TiledeskChatbot.js

@@ -391,15 +391,18 @@ class TiledeskChatbot {
     // Store intent tracking data for downstream completion/block analytics
     this._lastIntentId = answerObj.intent_id || answerObj._id?.toString() || '';
 
-    AnalyticsClient.track('agent.intent_matched', this.projectId, {
-      agent_id:    this.bot.root_id || this.botId,
-      intent_id:   answerObj.intent_id || answerObj._id?.toString() || '',
-      intent_name: intent_name,
-      match_type:  matchContext.match_type || 'explicit',
-      confidence:  (answerObj.score != null) ? answerObj.score : null,
-      step_count:  _step,
-      request_id:  this.requestId || null
-    });
+    // Only track published (production) runs (root/draft copy has no root_id).
+    if (this.bot.root_id) {
+      AnalyticsClient.track('agent.intent_matched', this.projectId, {
+        agent_id:    this.bot.root_id,
+        intent_id:   answerObj.intent_id || answerObj._id?.toString() || '',
+        intent_name: intent_name,
+        match_type:  matchContext.match_type || 'explicit',
+        confidence:  (answerObj.score != null) ? answerObj.score : null,
+        step_count:  _step,
+        request_id:  this.requestId || null
+      });
+    }
 
     const context = {
       payload: {

package/index.js

@@ -187,10 +187,12 @@ router.post('/ext/:botid', async (req, res) => {
       winston.error("(tybotRoute) Error while processing actions:", error);
     }
 
-    if (chatbot._intentStartTime) {
+    // Only track published (production) runs: the root/draft copy has no root_id,
+    // so draft/test executions are intentionally excluded from analytics.
+    if (chatbot._intentStartTime && bot.root_id) {
       const intentDuration = Date.now() - chatbot._intentStartTime;
       AnalyticsClient.track('agent.intent_completed', projectId, {
-        agent_id:    bot.root_id || botId,
+        agent_id:    bot.root_id,
         intent_id:   chatbot._lastIntentId || '',
         intent_name: reply.attributes?.intent_info?.intent_name || 'unknown',
         duration_ms: intentDuration,
@@ -217,7 +219,9 @@ router.post('/ext/:botid', async (req, res) => {
       winston.verbose("(tybotRoute) sendSupportMessageExt reply sent: ", reply)
     });
 
-    if (chatbot._intentStartTime) {
+    // Only track published (production) runs: the root/draft copy has no root_id,
+    // so draft/test executions are intentionally excluded from analytics.
+    if (chatbot._intentStartTime && bot.root_id) {
       const intentDuration = Date.now() - chatbot._intentStartTime;
       AnalyticsClient.track('agent.intent_completed', projectId, {
         agent_id:    bot.root_id,
@@ -593,12 +597,10 @@ router.post('/block/:project_id/:bot_id/:block_id', async (req, res) => {
     const execution_id = uuidv4().replace(/-/g, '');
     request_id = "automation-request-" + project_id + "-" + execution_id;
   }
-  AnalyticsClient.track('webhook.triggered', project_id, {
-    agent_id:   bot_id,
-    block_id:   block_id,
-    async:      async === true,
-    request_id: request_id
-  });
+  // webhook.triggered is emitted by tiledesk-server (routes/webhook.js) — the
+  // single source for production webhook automations (it carries webhook_id and
+  // excludes dev/draft runs). Not emitted here to avoid double-counting; the
+  // block execution itself is already recorded via agent.block_executed.
 
   const command = "/#" + block_id;
   let message = {