fix: record NODE_FAILED when child workflow throws

- Wrap child.result() Promise.race in try-catch to handle rejections
- Record NODE_FAILED trace event before rethrowing so UI shows node as
  failed instead of stuck running
- Fix child.cancel() to use getExternalWorkflowHandle (ChildWorkflowHandle
  doesn't have cancel method)
- Fix drizzle and() type error in listChildren by using array-based
  conditions pattern

Signed-off-by: betterclever <[email protected]>

Author: betterclever

backend/src/workflows/repository/workflow-run.repository.ts

@@ -1,5 +1,5 @@
 import { Inject, Injectable } from '@nestjs/common';
-import { and, desc, eq, sql } from 'drizzle-orm';
+import { and, desc, eq, sql, type SQL } from 'drizzle-orm';
 import { NodePgDatabase } from 'drizzle-orm/node-postgres';
 
 import { DRIZZLE_TOKEN } from '../../database/database.module';
@@ -141,15 +141,15 @@ export class WorkflowRunRepository {
     parentRunId: string,
     options: { organizationId?: string | null; limit?: number } = {},
   ): Promise<WorkflowRunRecord[]> {
-    let condition = eq(workflowRunsTable.parentRunId, parentRunId);
+    const conditions: SQL[] = [eq(workflowRunsTable.parentRunId, parentRunId)];
     if (options.organizationId) {
-      condition = and(condition, eq(workflowRunsTable.organizationId, options.organizationId));
+      conditions.push(eq(workflowRunsTable.organizationId, options.organizationId));
     }
 
     return this.db
       .select()
       .from(workflowRunsTable)
-      .where(condition)
+      .where(and(...conditions))
       .orderBy(desc(workflowRunsTable.createdAt))
       .limit(options.limit ?? 200);
   }

worker/src/temporal/workflows/index.ts

@@ -1,6 +1,7 @@
 import {
   ApplicationFailure,
   condition,
+  getExternalWorkflowHandle,
   proxyActivities,
   setHandler,
   startChild,
@@ -356,13 +357,40 @@ export async function shipsecWorkflowRun(
           })
 
           const timeoutMs = timeoutSeconds * 1000
-          const outcome = await Promise.race([
-            child.result().then((result) => ({ kind: 'result' as const, result })),
-            sleep(timeoutMs).then(() => ({ kind: 'timeout' as const })),
-          ])
+          let outcome: { kind: 'result'; result: Awaited<ReturnType<typeof child.result>> } | { kind: 'timeout' }
+          try {
+            outcome = await Promise.race([
+              child.result().then((result) => ({ kind: 'result' as const, result })),
+              sleep(timeoutMs).then(() => ({ kind: 'timeout' as const })),
+            ])
+          } catch (childError) {
+            // child.result() rejects when the child workflow throws (shipsecWorkflowRun
+            // always throws on failure rather than returning { success: false }).
+            // Record NODE_FAILED so the UI shows the node as failed instead of stuck running.
+            const message = childError instanceof Error ? childError.message : String(childError)
+            await recordTraceEventActivity({
+              type: 'NODE_FAILED',
+              runId: input.runId,
+              nodeRef: action.ref,
+              timestamp: new Date().toISOString(),
+              message,
+              level: 'error',
+              error: {
+                message,
+                type: 'SubWorkflowError',
+                details: { childRunId },
+              },
+              context: {
+                activityId: 'workflow-orchestration',
+                childRunId,
+              },
+            })
+            throw childError
+          }
 
           if (outcome.kind === 'timeout') {
-            child.cancel()
+            const externalHandle = getExternalWorkflowHandle(child.workflowId)
+            await externalHandle.cancel()
 
             await recordTraceEventActivity({
               type: 'NODE_FAILED',