fix(uipath-maestro-flow): run a script body against the real payload, not just a parser

[rockymadden]

Independent of #3091 and #3093 — different file, based on main.

Problem

skill-flow-slack-weather-pipeline faulted with [300501] Error invoking script task (element extractOfficeCity1):

const parts = description.split(',').map(p => p.trim());
const city  = parts[parts.length - 3];

Against "700 Bellevue Way NE, Suite 2000, Bellevue, WA 98004" that is "Suite 2000", not "Bellevue". The coordinate lookup it feeds found nothing and threw.

impl.md already told the agent to syntax-check with node -e "new Function(<script>)". Confirmed that passes this script unchanged — the bug is invisible to a parser, and flow validate does not read script bodies at all. Nothing between authoring and a live debug run says a word.

Fix

Rule 9 extends the existing check from parse to execute, against a payload the agent already has: the uip is resources run / registry get call that told it the field names returns the same shape $vars.<nodeId>.output carries at runtime.

# $vars is a global at runtime; supply it as the one parameter to test.
node -e '
  const payload = require("/tmp/upstream.json");                    # the real response, not a hand-written stub
  const body    = require("fs").readFileSync("/tmp/script.js", "utf8");
  console.log(new Function("$vars", body)({ myNode: { output: payload } }));
'

A hand-written stub is ruled out explicitly — it tests the script against what you assumed the field held, which is the thing under test.

Verified both directions

Against the real Slack payload:

shipped script  → Error: No Open-Meteo coordinate mapping for city: Suite 2000
                    at <anonymous>:9:25
parts.length-2  → { city: 'Bellevue', latitude: 47.6101, longitude: -122.2015 }

The check reproduces the exact runtime fault at author time, with a line number and the wrong value named — and it does not fire on the corrected script, so it discriminates rather than just failing loudly.

Also

The Debug table gains the row that routes there: [300501] with no Unexpected token is logic, not syntax. The existing entry only covers the Unexpected token case, so a logic fault currently sends you looking for an unbalanced paren.

Scope

One file, docs only. All maintenance checkers clean apart from the anchor pre-existing on main; both flavors compose.

🤖 Generated with Claude Code

[github-actions]

Claude finished @rockymadden's task in 1m 55s —— View job

---

Review of PR #3094

• Read review criteria and project conventions
• Read full diff and changed files
• Check skill-specific rules and cross-references
• Post review findings

---

Summary

Adds rule 9 to the Script Node implementation doc, instructing agents to execute script bodies against the real upstream payload (not just parse them) before shipping. Also adds a Debug table row that distinguishes logic faults ([300501] without Unexpected token) from syntax errors. The motivation — a split(',') off-by-one that flow validate and new Function() both pass silently — is well explained.

Change-by-Change Review

1. skills/uipath-maestro-flow/references/author/plugins/script/impl.md

Severity: Medium

The rule text and the new Debug table row are clear, well-motivated, and correctly integrated. One issue in the code block:

# is not a JavaScript comment character (line 48). The bash code block on lines 47–51 passes a multi-line string to node -e. Inside that string, line 48 uses # the real response, not a hand-written stub after a semicolon. Bash delivers the # literally to Node (it's inside single quotes), and JavaScript does not recognize # as a line comment — only // and /* */. An agent copy-pasting this block verbatim will get SyntaxError: Invalid or unexpected token.

Fix this →

What's Missing

Nothing identified beyond the comment-syntax fix above.

Area Ratings

Area	Status	Notes
Frontmatter	OK	Not changed
E2E Tests	OK	Docs-only change; extensive existing coverage
Skill Body	OK	Not changed
References & Assets	Medium	# comment in JS code block would error at runtime
Repo Hygiene	OK	Scoped change, no secrets, no cross-skill refs, all links valid

Issues for Manual Review

None found.

Conclusion

Solid fix — the rule is well-motivated by a real production fault, the debug-table row correctly discriminates the two [300501] cases, and the prose is clear. One medium issue: the # in the JavaScript code block (line 48) needs to be // so the example actually runs. With that fixed, this looks good to merge.

---