fix(security): document fail-closed tool redaction

Author: TheodoreSpeaks

apps/docs/openapi-v2-logs.json

@@ -1206,7 +1206,7 @@
                 "type": "null"
               }
             ],
-            "description": "Workflow graph snapshot captured for the run, with credential values redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters are null; and `{{VAR}}` references in non-opaque fields are preserved. Null when no snapshot is retained."
+            "description": "Workflow graph snapshot captured for the run, with credential values redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters and every parameter without authoritative codec metadata are null; and `{{VAR}}` references in non-opaque fields are preserved. Null when no snapshot is retained."
           },
           "traceSpans": {
             "type": "array",

apps/docs/openapi-v2-workflows.json

@@ -2876,7 +2876,7 @@
             "format": "date-time"
           },
           "state": {
-            "description": "Deployed workflow graph snapshot pinned by this version. Credential-bearing values are redacted: `oauth-input`, `password: true`, and table sub-block values are null, and sensitive nested tool parameters are null.",
+            "description": "Deployed workflow graph snapshot pinned by this version. Credential-bearing values are redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters and every parameter without authoritative codec metadata are null.",
             "$ref": "#/components/schemas/DeployedWorkflowState"
           }
         },

apps/sim/app/api/v2/workflows/[id]/versions/[version]/route.test.ts

@@ -30,10 +30,14 @@ vi.mock('@/lib/workflows/persistence/utils', () => ({
   getWorkflowDeploymentVersion: mocks.readVersion,
 }))
 vi.mock('@/lib/workflows/search-replace/indexer', () => ({
-  getToolInputParamConfigs: ({ tool }: { tool: { params?: Record<string, unknown> } }) =>
+  getToolInputParamConfigs: ({
+    tool,
+  }: {
+    tool: { type: string; params?: Record<string, unknown> }
+  }) =>
     Object.entries(tool.params ?? {}).map(([paramId, value]) => ({
       paramId,
-      authoritative: true,
+      authoritative: tool.type !== 'custom-tool' && tool.type !== 'mcp',
       value,
       config: {
         id: paramId,
@@ -182,7 +186,7 @@ describe('GET /api/v2/workflows/[id]/versions/[version]', () => {
     expect(subBlocks.tools.value).toEqual([
       {
         type: 'custom-tool',
-        params: { apiKey: null, query: 'safe input' },
+        params: { apiKey: null, query: null },
       },
     ])
     expect(subBlocks.headers.value).toBeNull()

apps/sim/lib/api/contracts/v2/logs.ts

@@ -74,7 +74,7 @@ const v2LogWorkflowStateSchema = z
   )
   .nullable()
   .describe(
-    'Workflow graph snapshot captured for the run, with credential values redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters are null; and `{{VAR}}` references in non-opaque fields are preserved. Null when no snapshot is retained.'
+    'Workflow graph snapshot captured for the run, with credential values redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters and every parameter without authoritative codec metadata are null; and `{{VAR}}` references in non-opaque fields are preserved. Null when no snapshot is retained.'
   )
 
 const v2LogWorkflowSummarySchema = z.object({

apps/sim/lib/api/contracts/v2/workflows.ts

@@ -614,7 +614,7 @@ export const v2WorkflowVersionDetailSchema = z
       .describe('ISO 8601 timestamp when this version was created.')
       .meta({ format: 'date-time' }),
     state: deployedWorkflowStateSchema.describe(
-      'Deployed workflow graph snapshot pinned by this version. Credential-bearing values are redacted: `oauth-input`, `password: true`, and table sub-block values are null, and sensitive nested tool parameters are null.'
+      'Deployed workflow graph snapshot pinned by this version. Credential-bearing values are redacted: `oauth-input`, `password: true`, and table sub-block values are null; sensitive nested tool parameters and every parameter without authoritative codec metadata are null.'
     ),
   })
   .meta({

apps/sim/lib/logs/application/get-public-log.ts

@@ -24,7 +24,8 @@ type PublicWorkflowLog = NonNullable<Awaited<ReturnType<typeof getPublicWorkflow
  *
  * `preserveEnvVars` keeps `{{VAR}}` references, which name a workspace environment variable
  * rather than carrying its value — resolution happens at execution time — so the reference is
- * not a secret and is what keeps consecutive run snapshots diffable.
+ * not a secret and is what keeps consecutive run snapshots diffable. Tool parameters without
+ * authoritative codec metadata are withheld rather than guessed safe.
  *
  * A run with no retained snapshot projects as `null`, and so does a stored value that is not an
  * object: the sanitizer can make no guarantee about a shape it cannot walk, so it is withheld

apps/sim/lib/logs/application/public-log-use-cases.test.ts

@@ -44,10 +44,14 @@ vi.mock('@/lib/logs/execution/trace-store', () => ({
 }))
 
 vi.mock('@/lib/workflows/search-replace/indexer', () => ({
-  getToolInputParamConfigs: ({ tool }: { tool: { params?: Record<string, unknown> } }) =>
+  getToolInputParamConfigs: ({
+    tool,
+  }: {
+    tool: { type: string; params?: Record<string, unknown> }
+  }) =>
     Object.entries(tool.params ?? {}).map(([paramId, value]) => ({
       paramId,
-      authoritative: true,
+      authoritative: tool.type !== 'custom-tool' && tool.type !== 'mcp',
       value,
       config: {
         id: paramId,
@@ -211,7 +215,7 @@ describe('public log application use cases', () => {
     expect(subBlocks.tools.value).toEqual([
       {
         type: 'custom-tool',
-        params: { apiKey: null, query: 'safe input' },
+        params: { apiKey: null, query: null },
       },
     ])
     expect(subBlocks.headers.value).toBeNull()

apps/sim/lib/workflows/application/read-workflow-version.ts

@@ -21,7 +21,8 @@ function isWorkflowState(value: unknown): value is WorkflowState {
  * `preserveEnvVars` keeps `{{VAR}}` references: those name a workspace environment variable
  * rather than carrying its value — resolution happens at execution time — so the reference is
  * not a secret and is what keeps the pinned graph diffable. Literal inline secrets, opaque table
- * cells, and sensitive nested tool parameters are nulled.
+ * cells, sensitive nested tool parameters, and tool parameters without authoritative codec
+ * metadata are nulled.
  */
 function sanitizeVersionState(state: WorkflowState): WorkflowState {
   const sanitized = sanitizeWorkflowForSharing(state, {

apps/sim/lib/workflows/credentials/credential-extractor.test.ts

@@ -12,19 +12,21 @@ import { getBlock } from '@/blocks/registry'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
 
 vi.mock('@/lib/workflows/search-replace/indexer', () => ({
-  getToolInputParamConfigs: ({ tool }: { tool: { params?: Record<string, unknown> } }) =>
-    Object.entries(tool.params ?? {})
-      .filter(([paramId]) => paramId !== 'unclassified')
-      .map(([paramId, value]) => ({
-        paramId,
-        authoritative: true,
-        value,
-        config: {
-          id: paramId,
-          type: 'short-input',
-          password: paramId === 'apiKey' || paramId === 'token',
-        },
-      })),
+  getToolInputParamConfigs: ({
+    tool,
+  }: {
+    tool: { type: string; params?: Record<string, unknown> }
+  }) =>
+    Object.entries(tool.params ?? {}).map(([paramId, value]) => ({
+      paramId,
+      authoritative: tool.type !== 'custom-tool' && tool.type !== 'mcp',
+      value,
+      config: {
+        id: paramId,
+        type: 'short-input',
+        password: paramId === 'apiKey' || paramId === 'token',
+      },
+    })),
 }))
 
 function stateWithSubBlock(type: string, value: unknown): Partial<WorkflowState> {
@@ -111,15 +113,15 @@ describe('export sanitizer resource coverage', () => {
     expect(sanitized.blocks?.b1?.subBlocks?.tableId?.value).toBeNull()
   })
 
-  it('uses tool-input codecs to withhold secret params while preserving safe config', () => {
+  it('uses authoritative tool-input codecs to withhold secrets while preserving safe config', () => {
     const value = [
       {
-        type: 'custom-tool',
-        customToolId: 'tool-1',
+        type: 'gmail',
+        toolId: 'gmail_send',
+        operation: 'send_gmail',
         params: {
           apiKey: 'sk-plaintext-secret',
           query: 'safe input',
-          unclassified: 'must-not-pass-through',
         },
       },
     ]
@@ -137,9 +139,10 @@ describe('export sanitizer resource coverage', () => {
 
     expect(sanitized.blocks?.b1?.subBlocks?.field?.value).toEqual([
       {
-        type: 'custom-tool',
-        customToolId: 'tool-1',
-        params: { apiKey: null, query: 'safe input', unclassified: null },
+        type: 'gmail',
+        toolId: 'gmail_send',
+        operation: 'send_gmail',
+        params: { apiKey: null, query: 'safe input' },
       },
     ])
   })
@@ -164,18 +167,21 @@ describe('export sanitizer resource coverage', () => {
     expect(sanitized.blocks?.b1?.subBlocks?.field?.value).toBeNull()
   })
 
-  it('withholds an opaque persisted type when the block is no longer registered', () => {
+  it('withholds every unclassified custom-tool parameter', () => {
     vi.mocked(getBlock).mockReturnValue(undefined as never)
 
     const sanitized = sanitizeWorkflowForSharing(
       stateWithSubBlock('tool-input', [
-        { type: 'custom-tool', params: { token: 'plaintext-secret' } },
+        {
+          type: 'custom-tool',
+          params: { token: 'plaintext-secret', query: 'ordinary configuration' },
+        },
       ]),
       { redactOpaqueCredentialInputs: true }
     )
 
     expect(sanitized.blocks?.b1?.subBlocks?.field?.value).toEqual([
-      { type: 'custom-tool', params: { token: null } },
+      { type: 'custom-tool', params: { token: null, query: null } },
     ])
   })
 })

apps/sim/lib/workflows/credentials/credential-extractor.ts

@@ -278,6 +278,11 @@ function isEnvironmentVariableReference(value: unknown): value is string {
   return typeof value === 'string' && value.startsWith('{{') && value.endsWith('}}')
 }
 
+/**
+ * Sanitizes nested tool parameters using the same codecs as workflow search and fork remapping.
+ * Only parameters resolved from a registered definition retain non-sensitive values. Custom, MCP,
+ * and unknown schemas lack reliable secret annotations, so their generic parameters are withheld.
+ */
 function sanitizeToolInputValue(value: unknown, options: WorkflowSanitizationOptions): unknown {
   const tools = parseStoredToolInputValue(value)
   if (!Array.isArray(value)) return null