test(logs): attribute the serializer refusal at its owner and pin block log redaction

Moves the missing-required-fields attribution check to the serializer that
throws it, drops an execution-core case whose internal row passed by default,
and covers the block failure line's secret projection now that it, not the
Agent handler, logs provider errors. Tightens comments the diff added.

Author: waleedlatif1

apps/sim/executor/execution/block-executor.test.ts

@@ -625,6 +625,48 @@ describe('BlockExecutor', () => {
     expect(blockFailureLogsSince(loggerIndex)).toHaveLength(2)
   })
 
+  it.each([
+    ['projects secrets and runtime identifiers out of', false],
+    ['fails closed to a structural', true],
+  ] as const)('%s the block failure line for a provider error', async (_name, incomplete) => {
+    const secret = 'block-failure-secret'
+    /** The Agent handler hands its provider error registry to the block executor this way. */
+    const errorRegistry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: secret, encryptedValue: 'encrypted-block-failure-secret' },
+    ])
+    errorRegistry.recordResolved('TOKEN', secret)
+    if (incomplete) errorRegistry.markIncomplete('unspecified')
+    const block = createBlock()
+    const workflow: SerializedWorkflow = {
+      version: '1',
+      blocks: [block],
+      connections: [],
+      loops: {},
+      parallels: {},
+    }
+    const loggerIndex = blockExecutorBaseLogger.withMetadata.mock.results.length
+    const state = new ExecutionState()
+    const handler: BlockHandler = {
+      canHandle: () => true,
+      execute: async (ctx) => {
+        ctx.errorResolvedSecretTraceRegistry = errorRegistry
+        throw new Error(`provider failed with ${secret} __var_TOKEN __sim_runtime_test_1`)
+      },
+    }
+    const executor = new BlockExecutor(
+      [handler],
+      new VariableResolver(workflow, {}, state),
+      {},
+      state
+    )
+
+    await executor.execute(createContext(state), createNode(block), block).catch(() => undefined)
+
+    const logged = JSON.stringify(blockFailureLogsSince(loggerIndex))
+    expect(logged).toContain('Block execution failed')
+    for (const leaked of [secret, '__var_', '__sim_']) expect(logged).not.toContain(leaked)
+  })
+
   it('logs an internal child workflow fault with the block and run identity', async () => {
     const loggerIndex = blockExecutorBaseLogger.withMetadata.mock.results.length
 

apps/sim/executor/execution/block-executor.ts

@@ -789,7 +789,7 @@ export class BlockExecutor {
       }
     }
 
-    /** Projected only when logged: a tool failure arrives already logged and skips it. */
+    /** Lazy, so a failure a tool already logged skips the secret projection. */
     let errorDiagnostic: Record<string, unknown> | undefined
     const getErrorDiagnostic = () => {
       if (errorDiagnostic) return errorDiagnostic
@@ -887,7 +887,7 @@ export class BlockExecutor {
         executionTime: duration,
       },
     })
-    /** A thrown primitive has no `cause` link back to the value logged above. */
+    /** The raw thrown value is never marked logged, so the fresh block error carries the mark. */
     markFailureLogged(blockError)
     throw blockError
   }

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -327,7 +327,6 @@ function describeProviderTransportFailure(error: Error): string | null {
   return null
 }
 
-/** A provider refusing the key it was given. */
 function isProviderKeyRejection(error: unknown): boolean {
   const status = (error as { status?: unknown } | null)?.status
   return status === 401 || status === 402 || status === 403

apps/sim/executor/handlers/human-in-the-loop/human-in-the-loop-handler.ts

@@ -560,7 +560,6 @@ export class HumanInTheLoopBlockHandler implements BlockHandler {
           const result = await executeTool(toolId, toolParams, { executionContext: ctx })
           const durationMs = Date.now() - startTime
 
-          /** `executeTool` already logged the failure with its tool id and attribution. */
           if (!result.success) {
             return {
               toolId,

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -1200,7 +1200,6 @@ export class WorkflowBlockHandler implements BlockHandler {
         ? `Custom block execution failed (ref: ${ref})`
         : 'Custom block execution failed'
 
-    /** No `cause` crosses the boundary, so the failure's marks are carried explicitly. */
     return inheritFailureMarks(
       new ChildWorkflowError({
         message,

apps/sim/lib/core/errors/failure-log.ts

@@ -57,9 +57,9 @@ export function markFailureKind<T>(error: T, kind: FailureKind): T {
 }
 
 /**
- * Attributes `error` from its cause chain. A database failure anywhere is always internal,
- * then the outermost link with an explicit mark, a {@link UserFailure}, a Sim `HttpError` status,
- * or an upstream `status` decides. Anything unattributed is internal.
+ * Attributes `error` from its cause chain. A database or retryable setup failure is always
+ * internal, then the outermost link with an explicit mark, a {@link UserFailure}, a Sim `HttpError`
+ * status, or an upstream `status` decides. Anything unattributed is internal.
  */
 export function classifyFailure(error: unknown): FailureKind {
   if (findDatabaseQueryError(error)) return 'internal'

apps/sim/lib/workflows/executor/execution-core.test.ts

@@ -162,13 +162,11 @@ vi.mock('@/serializer', () => ({
   },
 }))
 
-import { classifyFailure } from '@/lib/core/errors/failure-log'
 import {
   executeWorkflowCore,
   FINALIZED_EXECUTION_ID_TTL_MS,
   wasExecutionFinalizedByCore,
 } from '@/lib/workflows/executor/execution-core'
-import { MissingRequiredFieldsError } from '@/serializer/errors'
 
 const uploadWorkflowInputMock = uploadsExecutionMockFns.mockUploadExecutionFile
 largeValueMetadataMockFns.mockRegisterLargeValueOwner.mockResolvedValue(true)
@@ -705,32 +703,6 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
     )
   })
 
-  it.each([
-    [
-      'a block missing a required field',
-      new MissingRequiredFieldsError('Slack', ['Slack Account']),
-      'user',
-    ],
-    [
-      'an unknown block type, a registry regression',
-      new Error('Invalid block type: retired'),
-      'internal',
-    ],
-  ] as const)('attributes a serializer refusal for %s', async (_name, refusal, kind) => {
-    serializeWorkflowMock.mockImplementationOnce(() => {
-      throw refusal
-    })
-
-    const thrown = await executeWorkflowCore({
-      snapshot: createSnapshot() as any,
-      callbacks: {},
-      loggingSession: loggingSession as any,
-    }).catch((error: unknown) => error)
-
-    expect(thrown).toBe(refusal)
-    expect(classifyFailure(thrown)).toBe(kind)
-  })
-
   it('activates trusted pre-execution provenance on the installed execution registry', async () => {
     executorExecuteMock.mockResolvedValue({
       success: true,

apps/sim/serializer/index.test.ts

@@ -23,6 +23,7 @@ import {
   toolsUtilsMock,
 } from '@sim/testing/mocks'
 import { describe, expect, it, vi } from 'vitest'
+import { classifyFailure } from '@/lib/core/errors/failure-log'
 import { DAGBuilder } from '@/executor/dag/builder'
 import { Serializer } from '@/serializer/index'
 import { getToolMetadata, getToolParams } from '@/tools/metadata'
@@ -356,15 +357,22 @@ describe('Serializer', () => {
         enabled: true,
       }
 
-      expect(() => {
+      let refusal: unknown
+      try {
         serializer.serializeWorkflow(
           { 'test-block': blockWithMissingUserOnlyField },
           [],
           {},
           undefined,
           true
         )
-      }).toThrow('Test Jina Block is missing required fields: API Key')
+      } catch (error) {
+        refusal = error
+      }
+      expect(refusal).toBeInstanceOf(Error)
+      expect((refusal as Error).message).toBe('Test Jina Block is missing required fields: API Key')
+      /** The author's configuration, so execution logs it at info rather than paging at error. */
+      expect(classifyFailure(refusal)).toBe('user')
     })
 
     it.concurrent('should not validate user-or-llm fields during serialization', () => {

apps/sim/tools/index.ts

@@ -1059,7 +1059,7 @@ const RESPONSE_SIZE_LIMIT_ERROR_MESSAGE =
 const SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE =
   'External integration tools cannot target this Sim instance; use an internal operation'
 
-/** The author's workflow data is too large to send; their fault, logged once by the tool catch. */
+/** The author's data is too large to send, so it is a user failure. */
 function bodySizeLimitError(): Error {
   return markFailureKind(new Error(BODY_SIZE_LIMIT_ERROR_MESSAGE), 'user')
 }
@@ -2424,7 +2424,7 @@ async function executeToolImplementation(
       ...errorDetails,
       ...(functionSandboxCost ? { cost: functionSandboxCost } : {}),
     }
-    /** A handler rebuilding this result as a thrown error carries `output`, and with it both marks. */
+    /** Lets `adoptToolFailure` carry both marks onto a handler's rebuilt error. */
     markFailureLogged(failureOutput)
     markFailureKind(failureOutput, loggedKind ?? classifyFailure(error))
     return {