Custom API tool sends `true` for boolean request-body properties given the string "false"

从 api/core/tools/custom_tool/tool.py 中的 _convert_body_property_type 开始，将其对布尔值的处理与 _convert_body_property_any_of 进行比较。通过 api/tests/unit_tests/core/tools/test_custom_tool.py 使用 _build_tool 重现该情况，然后验证字符串形式的布尔值会生成预期的请求体值，同时无法识别的字符串仍可用于远程验证。

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.17.1 (main, 38f9d85)

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

ApiTool._convert_body_property_type (api/core/tools/custom_tool/tool.py:359) converts a request-body property declared as type: boolean with return bool(value). In Python bool("false") is True, so when the value arrives as the string "false" (or "0") the tool serializes true into the JSON body. The sibling _convert_body_property_any_of (tool.py:326-332) already parses boolean strings correctly, so the plain type: boolean path behaves differently from an anyOf schema for the same property.

Reachable path: ApiToolManageService.test_api_tool_preview → ApiTool.validate_credentials → do_http_request, where the parameters arrive as raw strings and are never cast to the declared types.

1. Create a custom (OpenAPI) tool whose request body has "enabled": {"type": "boolean"}.
2. Test the tool in the console with enabled set to false.
3. Inspect the request body the target API receives.

Minimal unit reproduction:

tool = _build_tool()  # helper from api/tests/unit_tests/core/tools/test_custom_tool.py
assert tool._convert_body_property_type({"type": "boolean"}, "false") is False  # fails: returns True

tool.do_http_request(url, "POST", headers={}, parameters={"enabled": "false"})
# outgoing JSON body is {"enabled": true}

✔️ Expected Behavior

"false" / "0" are sent as false, "true" / "1" as true, exactly as the anyOf branch in the same file already does; unrecognized strings are passed through for the remote API to validate.

❌ Actual Behavior

The request body contains "enabled": true — the opposite of what was submitted. A flag meant to disable something is sent as enabled.