refactor(logs): build failure log metadata lazily and attribute author failures by type

logFailureOnce takes its metadata as a thunk so a skipped boundary does no
secret projection, adds the execution id itself, and returns the attribution
it logged with. UserFailure attributes author-caused failures by type
(missing required fields, boundary-safe custom block refusals, no start
block) wherever they surface, replacing a try/catch at one serializer caller.
One inheritFailureMarks carries both marks across a boundary that drops
cause, the hosted-key check reuses classifyHostedKeyFailure, the Pi backends
share one toolResultError, and the sandbox and Function route no longer log
author code failures the tool boundary already logs.

Author: waleedlatif1

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -1616,13 +1616,11 @@ async function handleExecutePost(
           return payloadTooLargeResponse()
         }
 
-        logFailureOnce(
-          reqLogger,
-          'Non-SSE execution failed',
-          error,
-          loggingSession.projectDiagnosticError(error, { isTimeout: executionTimedOut }),
-          executionId
-        )
+        logFailureOnce(reqLogger, 'Non-SSE execution failed', error, {
+          metadata: () =>
+            loggingSession.projectDiagnosticError(error, { isTimeout: executionTimedOut }),
+          executionId,
+        })
 
         const executionResult = hasExecutionResult(error) ? error.executionResult : undefined
         const status = executionTimedOut ? 408 : getExecutionErrorStatus(error)
@@ -2424,13 +2422,10 @@ async function handleExecutePost(
             ? getTimeoutErrorMessage(timeoutController.timeoutMs)
             : getErrorMessage(error, 'Unknown error')
 
-          logFailureOnce(
-            reqLogger,
-            'SSE execution failed',
-            error,
-            loggingSession.projectDiagnosticError(error, { isTimeout }),
-            executionId
-          )
+          logFailureOnce(reqLogger, 'SSE execution failed', error, {
+            metadata: () => loggingSession.projectDiagnosticError(error, { isTimeout }),
+            executionId,
+          })
 
           const executionResult = hasExecutionResult(error) ? error.executionResult : undefined
           let compactErrorLogs: BlockLog[] | undefined

apps/sim/background/async-preprocessing-correlation.test.ts

@@ -488,9 +488,7 @@ describe('async preprocessing correlation threading', () => {
         }),
       })
     )
-    expect(loggingSessionMockFns.mockProjectDiagnosticError).toHaveBeenCalledWith(rawError, {
-      executionId: 'execution-fault',
-    })
+    expect(loggingSessionMockFns.mockProjectDiagnosticError).toHaveBeenCalledWith(rawError)
     expect(workflowExecutionLogger.error).toHaveBeenCalledWith(
       '[request-fault] Workflow execution failed: workflow-1',
       { executionId: 'execution-fault', error: projectedError, failureKind: 'internal' }

apps/sim/background/webhook-execution.test.ts

@@ -482,12 +482,12 @@ describe('executeWebhookJob fault vs error handling', () => {
     expect(loggingSessionMockFns.mockSafeCompleteWithError).toHaveBeenCalled()
     expect(loggingSessionMockFns.mockProjectDiagnosticError).toHaveBeenCalledWith(rawError, {
       workflowId: 'workflow-1',
-      executionId: 'execution-1',
       provider: 'gmail',
     })
     expect(webhookExecutionLogger.error).toHaveBeenCalledWith(
       '[request-1] Webhook execution failed',
       {
+        executionId: 'execution-1',
         workflowId: 'workflow-1',
         provider: 'gmail',
         error: projectedError,

apps/sim/background/webhook-execution.ts

@@ -1268,17 +1268,14 @@ async function executeWebhookJobInternal(
       throw new RetryableSetupError(errorMessage, { cause: retryableSetupCause })
     }
 
-    logFailureOnce(
-      logger,
-      `[${requestId}] Webhook execution failed`,
-      error,
-      loggingSession.projectDiagnosticError(error, {
-        workflowId: payload.workflowId,
-        executionId,
-        provider: payload.provider,
-      }),
-      executionId
-    )
+    logFailureOnce(logger, `[${requestId}] Webhook execution failed`, error, {
+      metadata: () =>
+        loggingSession.projectDiagnosticError(error, {
+          workflowId: payload.workflowId,
+          provider: payload.provider,
+        }),
+      executionId,
+    })
 
     // The finalized flag is set inside a fire-and-forget post-execution promise; await it so the
     // signal is reliable and the failure is fully persisted before we decide fault vs error.

apps/sim/background/workflow-execution.ts

@@ -307,13 +307,10 @@ export async function executeWorkflowJob(
           metadata: payload.metadata,
         }
       } catch (error: unknown) {
-        logFailureOnce(
-          logger,
-          `[${requestId}] Workflow execution failed: ${workflowId}`,
-          error,
-          loggingSession.projectDiagnosticError(error, { executionId }),
-          executionId
-        )
+        logFailureOnce(logger, `[${requestId}] Workflow execution failed: ${workflowId}`, error, {
+          metadata: () => loggingSession.projectDiagnosticError(error),
+          executionId,
+        })
 
         if (error instanceof ExecutionTimeoutError) throw error
 

apps/sim/executor/errors/boundary.ts

@@ -1,4 +1,4 @@
-import { markFailureKind } from '@/lib/core/errors/failure-log'
+import { UserFailure } from '@/lib/core/errors/user-failure'
 
 /**
  * Machine-readable class of a custom-block failure. Every member describes a
@@ -41,14 +41,13 @@ export interface CustomBlockFailure {
  * replaces the older convention of throwing *before* the `try` block to dodge
  * the catch's sanitizer, where redaction depended on lexical position.
  */
-export class BoundarySafeError extends Error {
+export class BoundarySafeError extends UserFailure {
   readonly errorType: CustomBlockErrorType
 
   constructor(options: { message: string; errorType: CustomBlockErrorType }) {
     super(options.message)
     this.name = 'BoundarySafeError'
     this.errorType = options.errorType
-    markFailureKind(this, 'user')
   }
 }
 

apps/sim/executor/execution/block-executor.ts

@@ -789,23 +789,31 @@ export class BlockExecutor {
       }
     }
 
-    const diagnosticRegistry = ctx.errorResolvedSecretTraceRegistry
-      ? ctx.errorResolvedSecretTraceRegistry
-      : inputDisplayRegistry?.forkForToolCall()
-    if (
-      !ctx.errorResolvedSecretTraceRegistry &&
-      diagnosticRegistry &&
-      ctx.resolvedSecretTraceRegistry &&
-      ctx.resolvedSecretTraceRegistry !== inputDisplayRegistry
-    ) {
-      diagnosticRegistry.mergeToolCallRegistry(ctx.resolvedSecretTraceRegistry)
+    /** Projected only when logged: a tool failure arrives already logged and skips it. */
+    let errorDiagnostic: Record<string, unknown> | undefined
+    const getErrorDiagnostic = () => {
+      if (errorDiagnostic) return errorDiagnostic
+      if (isDatabaseError) {
+        errorDiagnostic = { cause: describeError(error) }
+        return errorDiagnostic
+      }
+      const diagnosticRegistry = ctx.errorResolvedSecretTraceRegistry
+        ? ctx.errorResolvedSecretTraceRegistry
+        : inputDisplayRegistry?.forkForToolCall()
+      if (
+        !ctx.errorResolvedSecretTraceRegistry &&
+        diagnosticRegistry &&
+        ctx.resolvedSecretTraceRegistry &&
+        ctx.resolvedSecretTraceRegistry !== inputDisplayRegistry
+      ) {
+        diagnosticRegistry.mergeToolCallRegistry(ctx.resolvedSecretTraceRegistry)
+      }
+      errorDiagnostic = projectResolvedSecretDiagnosticError(
+        error,
+        diagnosticRegistry ?? ctx.resolvedSecretTraceRegistry
+      )
+      return errorDiagnostic
     }
-    const errorDiagnostic = isDatabaseError
-      ? { cause: describeError(error) }
-      : projectResolvedSecretDiagnosticError(
-          error,
-          diagnosticRegistry ?? ctx.resolvedSecretTraceRegistry
-        )
 
     /** A user Stop or the run's own time limit aborted this block; neither is a Sim fault. */
     if (isAbort && ctx.abortSignal?.aborted) markFailureKind(error, 'user')
@@ -814,11 +822,13 @@ export class BlockExecutor {
       phase === 'input_resolution' ? 'Failed to resolve block inputs' : 'Block execution failed',
       error,
       {
-        blockId: node.id,
-        blockType: block.metadata?.id,
-        executionId: ctx.executionId,
-        workflowId: ctx.workflowId,
-        ...errorDiagnostic,
+        metadata: () => ({
+          blockId: node.id,
+          blockType: block.metadata?.id,
+          executionId: ctx.executionId,
+          workflowId: ctx.workflowId,
+          ...getErrorDiagnostic(),
+        }),
       }
     )
 
@@ -857,7 +867,7 @@ export class BlockExecutor {
       }
       this.execLogger.info('Block has error port - returning error output instead of throwing', {
         blockId: node.id,
-        ...errorDiagnostic,
+        ...getErrorDiagnostic(),
       })
       return errorOutput
     }

apps/sim/executor/execution/engine.ts

@@ -197,13 +197,11 @@ export class ExecutionEngine {
       this.finalizeIncompleteLogs()
 
       const errorMessage = normalizeError(error)
-      logFailureOnce(
-        this.execLogger,
-        'Execution failed',
-        error,
-        projectResolvedSecretDiagnosticError(error, this.context.resolvedSecretTraceRegistry),
-        this.context.executionId
-      )
+      logFailureOnce(this.execLogger, 'Execution failed', error, {
+        metadata: () =>
+          projectResolvedSecretDiagnosticError(error, this.context.resolvedSecretTraceRegistry),
+        executionId: this.context.executionId,
+      })
 
       const executionResult: ExecutionResult = {
         success: false,
@@ -485,16 +483,13 @@ export class ExecutionEngine {
        * Block failures were logged by the block executor. This catches a completion-handling
        * fault, which only this frame sees when a concurrent failure already won `executionError`.
        */
-      logFailureOnce(
-        this.execLogger,
-        'Node execution failed',
-        error,
-        {
-          nodeId,
-          ...projectResolvedSecretDiagnosticError(error, this.context.resolvedSecretTraceRegistry),
-        },
-        this.context.executionId
-      )
+      logFailureOnce(this.execLogger, 'Node execution failed', error, {
+        metadata: () =>
+          projectResolvedSecretDiagnosticError(error, this.context.resolvedSecretTraceRegistry, {
+            nodeId,
+          }),
+        executionId: this.context.executionId,
+      })
       throw error
     }
   }

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { isPlainRecord, omit } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
-import { isProviderKeyRejection, markFailureKind } from '@/lib/core/errors/failure-log'
+import { markFailureKind } from '@/lib/core/errors/failure-log'
 import { normalizeStringRecord, normalizeWorkflowVariables } from '@/lib/core/utils/records'
 import {
   projectModelSchemaAnnotations,
@@ -327,6 +327,12 @@ function describeProviderTransportFailure(error: Error): string | null {
   return null
 }
 
+/** A provider refusing the key it was given. */
+function isProviderKeyRejection(error: unknown): boolean {
+  const status = (error as { status?: unknown } | null)?.status
+  return status === 401 || status === 402 || status === 403
+}
+
 /**
  * Handler for Agent blocks that process LLM requests with optional tools.
  */
@@ -3042,8 +3048,10 @@ export class AgentBlockHandler implements BlockHandler {
 
       return this.processProviderResponse(response, block, responseFormat, ctx)
     } catch (error) {
-      const errorRegistry = this.createErrorRegistry(providerErrorRegistry, modelRuntimeRegistry)
-      ctx.errorResolvedSecretTraceRegistry = errorRegistry
+      ctx.errorResolvedSecretTraceRegistry = this.createErrorRegistry(
+        providerErrorRegistry,
+        modelRuntimeRegistry
+      )
       try {
         this.handleExecutionError(error)
       } finally {
@@ -3076,7 +3084,7 @@ export class AgentBlockHandler implements BlockHandler {
       throw markFailureKind(new Error(transportFailure), 'third_party_server')
     }
     /** The handler cannot tell a hosted provider key (Sim's) from the author's own. */
-    if (isProviderKeyRejection((error as { status?: unknown } | null)?.status)) {
+    if (isProviderKeyRejection(error)) {
       markFailureKind(error, 'internal')
     }
   }

apps/sim/executor/handlers/pi/cloud/authoring/backend.ts

@@ -22,7 +22,6 @@ import { createLogger } from '@sim/logger'
 import { generateShortId } from '@sim/utils/id'
 import { isRecordLike } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
-import { adoptToolFailure } from '@/lib/core/errors/failure-log'
 import { getMaxExecutionTimeout, getRemainingExecutionMs } from '@/lib/core/execution-limits'
 import { withPiSandbox } from '@/lib/execution/remote-sandbox'
 import {
@@ -58,6 +57,7 @@ import {
   raceAbort,
   resolvePiTimeoutMs,
   scrubGitSecrets,
+  toolResultError,
 } from '@/executor/handlers/pi/cloud/shared'
 import type {
   PiBackendRun,
@@ -186,10 +186,7 @@ async function openPullRequest(
   )
 
   if (!result.success) {
-    throw adoptToolFailure(
-      new Error(`PR creation failed for branch ${branch}: ${result.error ?? 'unknown error'}`),
-      result
-    )
+    throw toolResultError(`PR creation failed for branch ${branch}`, result)
   }
 
   if (!isRecordLike(result.output)) {
@@ -225,12 +222,7 @@ async function repositoryDefaultBranch(
     { signal }
   )
   if (!result.success) {
-    throw adoptToolFailure(
-      new Error(
-        `Failed to determine the repository default branch: ${result.error ?? 'unknown error'}`
-      ),
-      result
-    )
+    throw toolResultError('Failed to determine the repository default branch', result)
   }
   if (!isRecordLike(result.output)) {
     throw new Error('GitHub repository response must be an object')
@@ -271,12 +263,7 @@ async function updatePullRequest(
       { signal }
     )
     if (!result.success) {
-      throw adoptToolFailure(
-        new Error(
-          `PR update failed for branch ${params.targetBranch}: ${result.error ?? 'unknown error'}`
-        ),
-        result
-      )
+      throw toolResultError(`PR update failed for branch ${params.targetBranch}`, result)
     }
   }