fix(workflows): preserve redacted run outputs

TheodoreSpeaks · TheodoreSpeaks · commit e92b6ab505f6 · 2026-08-11T20:51:06.000-07:00
diff --git a/apps/sim/lib/logs/execution/trace-store.test.ts b/apps/sim/lib/logs/execution/trace-store.test.ts
@@ -21,6 +21,7 @@ vi.mock('@/lib/execution/payloads/store', () => ({
 import {
   externalizeExecutionData,
   materializeExecutionData,
+  materializeExecutionDataForDisplayWithBlockOutputs,
   projectExecutionDataForDisplay,
   RESOLVED_SECRET_PROVENANCE_KEY,
   SECRET_PROJECTION_VERSION,
@@ -92,6 +93,67 @@ describe('execution data storage', () => {
 })
 
 describe('projectExecutionDataForDisplay', () => {
+  it('projects authoritative state-only block outputs without mutating execution state', async () => {
+    const executionData = {
+      secretProjectionVersion: SECRET_PROJECTION_VERSION,
+      traceSpans: [],
+      executionState: {
+        resolvedSecretTraceProvenance: {
+          version: 1 as const,
+          complete: true,
+          entries: [{ name: 'OPENAI_API_KEY', encryptedValue: 'ciphertext' }],
+          scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+        },
+        blockStates: {
+          'function-1': {
+            output: { token: 12345678, derived: 12345683 },
+            resolvedSecretTraceProvenance: {
+              version: 1 as const,
+              complete: true,
+              entries: [{ name: 'OPENAI_API_KEY', encryptedValue: 'ciphertext' }],
+              scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+            },
+          },
+        },
+      },
+    }
+
+    const materialized = await materializeExecutionDataForDisplayWithBlockOutputs(
+      executionData,
+      CONTEXT,
+      ['function-1']
+    )
+
+    expect(materialized.executionData).not.toHaveProperty('executionState')
+    expect(materialized.blockOutputs).toEqual(
+      new Map([['function-1', { token: '{{OPENAI_API_KEY}}', derived: 12345683 }]])
+    )
+    expect(executionData.executionState.blockStates['function-1'].output).toEqual({
+      token: 12345678,
+      derived: 12345683,
+    })
+    expect(JSON.stringify(materialized.executionData)).not.toContain('12345678')
+    expect(JSON.stringify([...materialized.blockOutputs])).not.toContain('12345678')
+  })
+
+  it('omits state-only block outputs that lack usable secret provenance', async () => {
+    const materialized = await materializeExecutionDataForDisplayWithBlockOutputs(
+      {
+        secretProjectionVersion: SECRET_PROJECTION_VERSION,
+        executionState: {
+          blockStates: {
+            'function-1': { output: { token: 'unproven-secret' } },
+          },
+        },
+      },
+      CONTEXT,
+      ['function-1']
+    )
+
+    expect(materialized.blockOutputs).toEqual(new Map())
+    expect(JSON.stringify(materialized)).not.toContain('unproven-secret')
+  })
+
   it('retains run-global projection for legacy rows without exact value sidecars', async () => {
     const executionData = {
       finalOutput: { result: 12345678, derived: 12345683 },
diff --git a/apps/sim/lib/logs/execution/trace-store.ts b/apps/sim/lib/logs/execution/trace-store.ts
@@ -3,6 +3,10 @@ import { toError } from '@sim/utils/errors'
 import { omit } from '@sim/utils/object'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
 import { materializeLargeValueRef, storeLargeValue } from '@/lib/execution/payloads/store'
+import {
+  collectFunctionalBlockOutputs,
+  type FunctionalExecutionDataSource,
+} from '@/lib/logs/execution/functional-outputs'
 import { projectTraceSpansForSecrets } from '@/lib/logs/execution/trace-secret-projection'
 import type { TraceSpan } from '@/lib/logs/types'
 import {
@@ -72,6 +76,11 @@ export interface TraceStoreReadContext {
   userId?: string
 }
 
+export interface DisplayExecutionDataWithBlockOutputs {
+  executionData: Record<string, unknown>
+  blockOutputs: Map<string, unknown>
+}
+
 /**
  * Write-path context. Requires the execution owner's `userId`: the externalized
  * object is tracked in `workspace_files`, whose `user_id` column is NOT NULL
@@ -269,6 +278,102 @@ export async function materializeExecutionDataForDisplay(
   return projectExecutionDataForDisplay(materialized, context)
 }
 
+/**
+ * Materializes one trusted row into its display envelope plus secret-safe functional outputs.
+ * Execution-state output remains authoritative when present, but only requested blocks are
+ * projected and returned; the raw execution state never crosses the display boundary.
+ */
+export async function materializeExecutionDataForDisplayWithBlockOutputs(
+  executionData: Record<string, unknown> | null | undefined,
+  context: TraceStoreReadContext,
+  blockIds: readonly string[]
+): Promise<DisplayExecutionDataWithBlockOutputs> {
+  const materialized = await materializeExecutionData(executionData, context)
+  const displayData = await projectExecutionDataForDisplay(materialized, context)
+  if (blockIds.length === 0) {
+    return { executionData: displayData, blockOutputs: new Map() }
+  }
+
+  const executionState = readRecord(materialized.executionState)
+  const blockStates = readRecord(executionState?.blockStates)
+  if (!blockStates) {
+    return {
+      executionData: displayData,
+      blockOutputs: collectFunctionalBlockOutputs(
+        displayData as FunctionalExecutionDataSource | undefined
+      ),
+    }
+  }
+
+  const runRegistry = await importResolvedSecretTraceRegistry(
+    materialized[RESOLVED_SECRET_PROVENANCE_KEY] ??
+      executionState?.[RESOLVED_SECRET_PROVENANCE_KEY],
+    'traceStore.blockOutputRunProvenance'
+  )
+  const blockOutputs = new Map<string, unknown>()
+  const projectionStore = createReadOnlyProjectionStore(context)
+
+  for (const blockId of new Set(blockIds)) {
+    const blockState = readRecord(blockStates[blockId])
+    if (!blockState || blockState.output === undefined) continue
+
+    const hasExactProvenance = Object.hasOwn(blockState, RESOLVED_SECRET_PROVENANCE_KEY)
+    const registry = hasExactProvenance
+      ? await importResolvedSecretTraceRegistry(
+          blockState[RESOLVED_SECRET_PROVENANCE_KEY],
+          'traceStore.blockOutputExactProvenance'
+        )
+      : runRegistry
+    const now = new Date().toISOString()
+    const [projected] = await projectTraceSpansForSecrets(
+      [
+        {
+          id: `${LOG_DISPLAY_PROJECTION_SPAN_ID}-block-output`,
+          name: 'Block Output Display Projection',
+          type: 'display',
+          duration: 0,
+          startTime: now,
+          endTime: now,
+          output: { value: blockState.output },
+        },
+      ],
+      { registry, allowLargeValueWrites: false, store: projectionStore }
+    )
+    if (projected?.output && Object.hasOwn(projected.output, 'value')) {
+      blockOutputs.set(blockId, projected.output.value)
+    }
+  }
+
+  return { executionData: displayData, blockOutputs }
+}
+
+function readRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined
+}
+
+async function importResolvedSecretTraceRegistry(
+  provenance: unknown,
+  origin: string
+): Promise<ResolvedSecretTraceRegistry | undefined> {
+  if (!isResolvedSecretTraceProvenanceV1(provenance)) return undefined
+
+  const registry = new ResolvedSecretTraceRegistry([], provenance.scope)
+  await registry.importProvenance(provenance, { trusted: true, origin })
+  return registry
+}
+
+function createReadOnlyProjectionStore(context: TraceStoreReadContext) {
+  return {
+    workspaceId: context.workspaceId ?? undefined,
+    workflowId: context.workflowId ?? undefined,
+    executionId: context.executionId,
+    userId: context.userId,
+    trackReference: false,
+  }
+}
+
 /**
  * Projects execution-log content with the encrypted provenance saved by the
  * trusted executor. Current workflow input and final output values use their
@@ -284,12 +389,7 @@ export async function projectExecutionDataForDisplay(
   executionData: Record<string, unknown>,
   context: TraceStoreReadContext
 ): Promise<Record<string, unknown>> {
-  const executionState =
-    executionData.executionState &&
-    typeof executionData.executionState === 'object' &&
-    !Array.isArray(executionData.executionState)
-      ? (executionData.executionState as Record<string, unknown>)
-      : undefined
+  const executionState = readRecord(executionData.executionState)
   const hasTopLevelProvenance = Object.hasOwn(executionData, RESOLVED_SECRET_PROVENANCE_KEY)
   const stateProvenance = executionState?.[RESOLVED_SECRET_PROVENANCE_KEY]
   const provenance = executionData[RESOLVED_SECRET_PROVENANCE_KEY] ?? stateProvenance
@@ -302,15 +402,7 @@ export async function projectExecutionDataForDisplay(
     return projectLegacyExecutionDataForDisplay(executionData)
   }
 
-  let registry: ResolvedSecretTraceRegistry | undefined
-
-  if (isResolvedSecretTraceProvenanceV1(provenance)) {
-    registry = new ResolvedSecretTraceRegistry([], provenance.scope)
-    await registry.importProvenance(provenance, {
-      trusted: true,
-      origin: 'traceStore.spanProvenance',
-    })
-  }
+  const registry = await importResolvedSecretTraceRegistry(provenance, 'traceStore.spanProvenance')
 
   /**
    * Compaction drops `executionState`, and with it the only copy of the
@@ -339,13 +431,7 @@ export async function projectExecutionDataForDisplay(
     })
   }
 
-  const projectionStore = {
-    workspaceId: context.workspaceId ?? undefined,
-    workflowId: context.workflowId ?? undefined,
-    executionId: context.executionId,
-    userId: context.userId,
-    trackReference: false,
-  }
+  const projectionStore = createReadOnlyProjectionStore(context)
 
   const exactValueProjections = new Map<string, unknown>()
   for (const [valueKey, provenanceKey] of Object.entries(EXACT_LOG_VALUE_PROVENANCE_KEYS)) {
diff --git a/apps/sim/lib/workflows/executor/execution-status.test.ts b/apps/sim/lib/workflows/executor/execution-status.test.ts
@@ -5,17 +5,17 @@ import { dbChainMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@s
 import { and } from 'drizzle-orm'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetJob, mockMaterializeForDisplay } = vi.hoisted(() => ({
+const { mockGetJob, mockMaterializeForDisplayWithBlockOutputs } = vi.hoisted(() => ({
   mockGetJob: vi.fn(),
-  mockMaterializeForDisplay: vi.fn(),
+  mockMaterializeForDisplayWithBlockOutputs: vi.fn(),
 }))
 
 vi.mock('@/lib/core/async-jobs', () => ({
   getJobQueue: vi.fn().mockResolvedValue({ getJob: mockGetJob }),
 }))
 
 vi.mock('@/lib/logs/execution/trace-store', () => ({
-  materializeExecutionDataForDisplay: mockMaterializeForDisplay,
+  materializeExecutionDataForDisplayWithBlockOutputs: mockMaterializeForDisplayWithBlockOutputs,
 }))
 
 vi.mock('@/lib/workflows/executor/paused-execution-metadata', () => ({
@@ -35,7 +35,10 @@ describe('getWorkflowExecutionStatus queue projection', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetDbChainMock()
-    mockMaterializeForDisplay.mockResolvedValue({})
+    mockMaterializeForDisplayWithBlockOutputs.mockResolvedValue({
+      executionData: {},
+      blockOutputs: new Map(),
+    })
   })
 
   it('selects run outputs only from the secret-safe display projection', async () => {
@@ -60,23 +63,24 @@ describe('getWorkflowExecutionStatus queue projection', () => {
     ])
     queueTableRows(schemaMock.resumeQueue, [])
     queueTableRows(schemaMock.pausedExecutions, [])
-    mockMaterializeForDisplay.mockResolvedValueOnce({
-      finalOutput: { token: '[REDACTED]' },
-      traceSpans: [{ blockId: 'block-1', output: { token: '[REDACTED]' } }],
+    mockMaterializeForDisplayWithBlockOutputs.mockResolvedValueOnce({
+      executionData: { finalOutput: { token: '[REDACTED]' } },
+      blockOutputs: new Map([['block-1', { token: '[REDACTED]' }]]),
     })
     const status = await getWorkflowExecutionStatus({
       ...input,
       includeOutput: true,
       selectedOutputs: ['block-1'],
     })
 
-    expect(mockMaterializeForDisplay).toHaveBeenCalledWith(
+    expect(mockMaterializeForDisplayWithBlockOutputs).toHaveBeenCalledWith(
       expect.objectContaining({ executionState: expect.anything() }),
       {
         workspaceId: 'workspace-1',
         workflowId: 'workflow-1',
         executionId: 'execution-1',
-      }
+      },
+      ['block-1']
     )
     expect(status).toMatchObject({
       finalOutput: { token: '[REDACTED]' },
diff --git a/apps/sim/lib/workflows/executor/execution-status.ts b/apps/sim/lib/workflows/executor/execution-status.ts
@@ -4,11 +4,7 @@ import { and, eq, inArray, sql } from 'drizzle-orm'
 import type { WorkflowExecutionStatusResponse } from '@/lib/api/contracts/workflows'
 import { getJobQueue } from '@/lib/core/async-jobs'
 import type { Job } from '@/lib/core/async-jobs/types'
-import {
-  collectFunctionalBlockOutputs,
-  type FunctionalExecutionDataSource,
-} from '@/lib/logs/execution/functional-outputs'
-import { materializeExecutionDataForDisplay } from '@/lib/logs/execution/trace-store'
+import { materializeExecutionDataForDisplayWithBlockOutputs } from '@/lib/logs/execution/trace-store'
 import {
   RESUME_EXECUTION_JOB_ID_PREFIX,
   WORKFLOW_EXECUTION_JOB_ID_PREFIX,
@@ -27,7 +23,7 @@ import type { PausePoint } from '@/executor/types'
 
 type LogStatus = 'pending' | 'running' | 'completed' | 'failed' | 'cancelled'
 
-interface ExecutionDataShape extends FunctionalExecutionDataSource {
+interface ExecutionDataShape {
   finalOutput?: { error?: string } & Record<string, unknown>
   error?: { message?: string } | string
   completionFailure?: string
@@ -259,14 +255,19 @@ export async function getWorkflowExecutionStatus(
 
   const cost = logRow.costTotal != null ? { total: Number(logRow.costTotal) } : null
 
-  const executionData = (await materializeExecutionDataForDisplay(
+  const requestedBlockIds = [
+    ...new Set(selectedOutputs.map((selector) => selector.split('.')[0]).filter(Boolean)),
+  ]
+  const materialized = await materializeExecutionDataForDisplayWithBlockOutputs(
     logRow.executionData as Record<string, unknown> | null,
     {
       workspaceId: logRow.workspaceId,
       workflowId: logRow.workflowId,
       executionId: logRow.executionId,
-    }
-  )) as ExecutionDataShape | undefined
+    },
+    requestedBlockIds
+  )
+  const executionData = materialized.executionData as ExecutionDataShape
 
   const error = status === 'failed' ? extractError(executionData) : null
 
@@ -277,7 +278,7 @@ export async function getWorkflowExecutionStatus(
 
   const blockOutputs =
     selectedOutputs.length > 0
-      ? pickSelectedOutputs(selectedOutputs, collectFunctionalBlockOutputs(executionData))
+      ? pickSelectedOutputs(selectedOutputs, materialized.blockOutputs)
       : null
 
   return {
