[BUG][code-analyzer] flow:TriggerCallout causes Flow engine error and CLI hang on Flow with External Service actions

Start by reproducing the sf code-analyzer run command with the flow:TriggerCallout rule against the affected Flow, then inspect the supplied Code Analyzer and Flow Scanner debug logs around the engine error after step 2323. Done means the rule either completes and returns applicable violations or terminates cleanly with a useful error instead of hanging.

Have you tried to resolve this issue yourself first?

• I confirm I have gone through the above steps and still have an issue to report.

Bug Description

When Salesforce Code Analyzer analyzes a specific Salesforce Flow using the flow:TriggerCallout rule, the Flow engine emits an error and the sf code-analyzer run command hangs indefinitely instead of returning a result or error.

The issue has been isolated specifically to TriggerCallout. The same Flow successfully completes analysis with each of the other 14 Flow rules individually. Additionally, all other 64 Flows in the project successfully complete analysis.

The affected Flow contains three External Service actions and a relatively complex execution graph involving branching and loops. The Flow Scanner debug log reaches step 2323 of 2323 before the engine fails, suggesting that traversal completes but the failure occurs during or after TriggerCallout processing.

The issue has also been independently reproduced on a second Windows machine/VM using the same Flow and flow:TriggerCallout rule.

Output / Logs

The CLI reaches the following point and then hangs indefinitely:
Selecting rules... done.
Executing rules... done. Executed rules from flow.

Violation file paths relative to ''.

The main Code Analyzer debug log confirms that only TriggerCallout was selected and that the Flow engine emitted an error:

Running engine 'flow' with the following rules: ["TriggerCallout"]

Since the engine 'flow' emitted an error, the following temporary working folder will not be removed:

The corresponding Flow Scanner debug log traverses the entire execution graph and reaches:

step: 2323
total steps: 2323
elem name: Retrieve_CalEnviroScreen_DAC_Data

Steps To Reproduce

1. Using Salesforce Code Analyzer 5.16.0, run the TriggerCallout rule against the affected Flow:
   sf code-analyzer run --rule-selector "flow:TriggerCallout"
   --target ".\force-app\main\default\flows\Complaint_Management_Master_Flow_Geocode_Complaint_On_Create.flow-meta.xml"
2. Code Analyzer selects and executes the Flow rule, then reaches:
   Selecting rules... done.
   Executing rules... done. Executed rules from flow.

Violation file paths relative to ''.
3. The command does not complete or return to the command prompt and must be manually terminated.
4. The Code Analyzer debug log reports that the Flow engine emitted an error. The Flow Scanner debug log reaches step 2323 of 2323 before ending without a useful exception.
5. As an isolation test, run each of the other 14 Flow rules individually against the same Flow. All 14 complete successfully. Only TriggerCallout reproduces the failure.
6. As an additional isolation test, run the Flow rules against the other 64 Flows in the project. They complete successfully.
7. Repeat the TriggerCallout command against the same Flow on a second Windows machine/VM. The hang is reproduced there as well.

Expected Behavior

flow:TriggerCallout should complete analysis of the Flow and return any applicable violations.

If the Flow cannot be analyzed, Code Analyzer should terminate cleanly and return a useful error explaining the failure rather than leaving the CLI process hanging indefinitely.

Operating System

Windows 11 Pro

Salesforce CLI Version

@salesforce/cli/2.151.6 win32-x64 node-v22.17.1

Code Analyzer Plugin (code-analyzer) Version

code-analyzer 5.16.0

Node Version

v22.17.1

Java Version

openjdk version "17.0.20.1" 2026-08-18 OpenJDK Runtime Environment Temurin-17.0.20.1+1 (build 17.0.20.1+1) OpenJDK 64-Bit Server VM Temurin-17.0.20.1+1 (build 17.0.20.1+1, mixed mode, sharing)

Python Version

Python 3.13.15

Additional Context (Screenshots, Files, etc)

The issue was independently reproduced on a second Windows machine/VM using the same Flow and flow:TriggerCallout rule.

The affected Flow contains three Salesforce External Service actions and a complex execution graph involving branching and loops.

Full Code Analyzer and Flow Scanner debug logs are available. GitHub does not allow .log attachments through this issue form, so the relevant portions have been included in the Output / Logs section above. I can provide the complete logs in another supported format if needed.

I have not attached the affected Flow because it contains environment-specific configuration and implementation details. A sanitized reproduction Flow can be provided if necessary.

sfca-2026_09_16_06_34_47_314.txt

sfca-flow-2026_09_16_06_34_50_258.txt

Workaround

Exclude the affected Flow from flow:TriggerCallout analysis. The other 14 Flow rules can successfully analyze this Flow, and the full Flow ruleset successfully analyzes the other 64 Flows in the project.

No workaround has been identified that allows TriggerCallout itself to successfully analyze the affected Flow.

Urgency

Moderate