fix(provenance): report why a projection was refused, at the point of refusal (#6483)

* fix(provenance): report why a projection was refused, at the point of refusal

A refusal fails closed and reaches the user as one fixed sentence. The guard
that caused it may have tripped many frames — or a whole process — earlier, and
the incompleteness latch is one-way, so by then the causing call has long
returned. #6478 recorded the reason when the guard tripped, but marking
early-returns once a registry is already incomplete, so a run that inherits an
incomplete registry refused with nothing recorded anywhere. That is the case
production actually hits.

Retain reasons on the registry and report them where the refusal happens. The
reason is recorded before the already-incomplete return so a causal chain
accumulates, and before the silence checks so a by-design origin that logs
nothing when marked is still nameable at refusal. Propagation inherits through
markIncomplete's source argument, and copying incomplete input paths carries
their reasons, so a fork cannot latch without its cause.

Route all 68 refusal sites through one choke point that logs boundary, cause,
input path and workspace before throwing. It returns never, so callers still
narrow; messages and thrown types are unchanged at every site. Records carry a
cause discriminator, since a latched registry and a caller-side cross-check of
the projection's own output both arrive here and only the former has reasons.

No behaviour change.

* fix(provenance): stop registry-less refusals deduplicating across requests

A refusal with no registry aborts the request rather than iterating, so it
reaches the reporter at most once per request. Remembering it for the process
silenced every later request, including the one being investigated.

* improvement(provenance): inherit copied-path reasons once per copy

Semantics are unchanged — reasons are still inherited only when at least one
incomplete path was actually copied — but the source set is walked once rather
than once per copied path.

Author: waleedlatif1

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -73,6 +73,7 @@ import {
 import { getMeaningfulWorkflowDescription } from '@/lib/mcp/workflow-tool-schema'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
+import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('WorkflowMcpServeAPI')
@@ -293,7 +294,13 @@ async function projectWorkflowMcpModelContent(
     throw new Error('MCP workflow execution provenance is invalid')
   }
   const projection = projectResolvedSecretModelContent(value, registry)
-  if (!projection.safe) throw new Error('MCP workflow output could not be safely projected')
+  if (!projection.safe) {
+    refuseResolvedSecretProjection({
+      site: 'mcpServe.workflowOutput',
+      message: 'MCP workflow output could not be safely projected',
+      registry,
+    })
+  }
   return projection.value
 }
 
@@ -939,7 +946,10 @@ async function handleToolsCall(
           })
         : rawErrorMessage
       if (typeof errorMessage !== 'string') {
-        throw new Error('MCP workflow execution error could not be safely projected')
+        refuseResolvedSecretProjection({
+          site: 'mcpServe.executionError',
+          message: 'MCP workflow execution error could not be safely projected',
+        })
       }
       const status = getWorkflowErrorStatus(response.status)
       const responseHeaders: Record<string, string> = {}

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -24,11 +24,14 @@ import {
   projectResolvedSecretModelContent,
   projectResolvedSecretModelJsonStrings,
 } from '@/executor/utils/resolved-secret-content-projection'
+import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { PROVIDER_DEFINITIONS } from '@/providers/models'
 
 const logger = createLogger('Memory')
 
+const MEMORY_CONTENT_REFUSAL = 'Memory content could not be safely projected'
+
 export class Memory {
   async fetchMemoryMessages(ctx: ExecutionContext, inputs: AgentInputs): Promise<Message[]> {
     if (!inputs.memoryType || inputs.memoryType === 'none') {
@@ -82,7 +85,12 @@ export class Memory {
           messages
         )))
     ) {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.storedProvenanceImport',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry: ctx.resolvedSecretTraceRegistry,
+        inputPath: 'messages',
+      })
     }
 
     return Promise.all(
@@ -95,7 +103,12 @@ export class Memory {
           ctx.resolvedSecretTraceRegistry?.exportProvenance().scope
         )
         if (!(await importDurableSecretProvenance(modelRegistry, messageProvenance, message))) {
-          throw new Error('Memory content could not be safely projected')
+          refuseResolvedSecretProjection({
+            site: 'memory.messageProvenanceImport',
+            message: MEMORY_CONTENT_REFUSAL,
+            registry: modelRegistry,
+            inputPath: 'messages',
+          })
         }
         return this.projectMessageForModel(modelRegistry, message)
       })
@@ -213,12 +226,21 @@ export class Memory {
   }
 
   private projectMessageForModel(registry: ResolvedSecretTraceRegistry, message: Message): Message {
-    const functionArguments = this.readFunctionCallArguments(message.function_call)
+    const functionArguments = this.readFunctionCallArguments(
+      message.function_call,
+      registry,
+      'function_call'
+    )
     const toolArguments = message.tool_calls?.map((toolCall) => {
       if (!isPlainRecord(toolCall)) {
-        throw new Error('Memory content could not be safely projected')
+        refuseResolvedSecretProjection({
+          site: 'memory.toolCallShape',
+          message: MEMORY_CONTENT_REFUSAL,
+          registry,
+          inputPath: 'tool_calls',
+        })
       }
-      return this.readFunctionCallArguments(toolCall.function)
+      return this.readFunctionCallArguments(toolCall.function, registry, 'tool_calls.function')
     })
     const contentProjection = projectResolvedSecretModelContent(message.content, registry)
     const argumentProjection = projectResolvedSecretModelJsonStrings(
@@ -232,7 +254,12 @@ export class Memory {
       !Array.isArray(argumentProjection.value) ||
       argumentProjection.value.length !== 1 + (toolArguments?.length ?? 0)
     ) {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.messageContentProjection',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry,
+        inputPath: 'content,function_call,tool_calls',
+      })
     }
 
     const content = contentProjection.value
@@ -241,25 +268,45 @@ export class Memory {
       (functionArguments !== undefined && typeof projectedFunctionArguments !== 'string') ||
       (functionArguments === undefined && projectedFunctionArguments !== undefined)
     ) {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.functionCallArgumentProjection',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry,
+        inputPath: 'function_call.arguments',
+      })
     }
     if (
       (toolArguments !== undefined && projectedToolArguments.length !== toolArguments.length) ||
       (toolArguments === undefined && projectedToolArguments.length !== 0)
     ) {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.toolCallArgumentArity',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry,
+        inputPath: 'tool_calls.function.arguments',
+      })
     }
 
     const projectedToolCalls = message.tool_calls?.map((toolCall, index) => {
       const argument = (projectedToolArguments as unknown[])[index]
       const originalFunction = isPlainRecord(toolCall) ? toolCall.function : undefined
       if (originalFunction === undefined || originalFunction === null) return toolCall
       if (!isPlainRecord(originalFunction)) {
-        throw new Error('Memory content could not be safely projected')
+        refuseResolvedSecretProjection({
+          site: 'memory.toolCallFunctionShape',
+          message: MEMORY_CONTENT_REFUSAL,
+          registry,
+          inputPath: 'tool_calls.function',
+        })
       }
       if (!Object.hasOwn(originalFunction, 'arguments')) return toolCall
       if (typeof argument !== 'string') {
-        throw new Error('Memory content could not be safely projected')
+        refuseResolvedSecretProjection({
+          site: 'memory.toolCallArgumentType',
+          message: MEMORY_CONTENT_REFUSAL,
+          registry,
+          inputPath: 'tool_calls.function.arguments',
+        })
       }
       return {
         ...toolCall,
@@ -283,14 +330,32 @@ export class Memory {
     }
   }
 
-  private readFunctionCallArguments(functionCall: unknown): string | undefined {
+  /**
+   * Takes the registry and path from its caller so a refusal here reports the run that failed.
+   * Without them the refusal would deduplicate process-wide and name no cause.
+   */
+  private readFunctionCallArguments(
+    functionCall: unknown,
+    registry: ResolvedSecretTraceRegistry,
+    inputPath: string
+  ): string | undefined {
     if (functionCall === undefined || functionCall === null) return undefined
     if (!isPlainRecord(functionCall)) {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.functionCallShape',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry,
+        inputPath,
+      })
     }
     if (!Object.hasOwn(functionCall, 'arguments')) return undefined
     if (typeof functionCall.arguments !== 'string') {
-      throw new Error('Memory content could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'memory.functionCallArgumentType',
+        message: MEMORY_CONTENT_REFUSAL,
+        registry,
+        inputPath,
+      })
     }
     return functionCall.arguments
   }

apps/sim/executor/handlers/agent/memory.ts

@@ -18,6 +18,7 @@ import type { BlockHandler, ExecutionContext } from '@/executor/types'
 import { buildAPIUrl, buildAuthHeaders, extractAPIErrorMessage } from '@/executor/utils/http'
 import { isJSONString, parseJSON, stringifyJSON } from '@/executor/utils/json'
 import { projectResolvedSecretDiagnosticError } from '@/executor/utils/resolved-secret-content-projection'
+import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import type {
   ResolvedSecretInputPath,
   ResolvedSecretTraceRegistry,
@@ -81,7 +82,12 @@ export class EvaluatorBlockHandler implements BlockHandler {
       modelInputPaths
     )
     if (!modelInputProjection.complete) {
-      throw new Error('Evaluator model input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'evaluator.contentMetricsModelInput',
+        message: 'Evaluator model input could not be safely projected',
+        registry: ctx.resolvedSecretTraceRegistry,
+        inputPath: 'content,metrics',
+      })
     }
     const processedContent = this.processContent(modelInputProjection.value.content)
     const projectedMetrics = Array.isArray(modelInputProjection.value.metrics)

apps/sim/executor/handlers/evaluator/evaluator-handler.ts

@@ -43,13 +43,18 @@ import type {
   StreamingExecution,
 } from '@/executor/types'
 import { buildAPIUrl, buildAuthHeaders, extractAPIErrorMessage } from '@/executor/utils/http'
+import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import type {
   ResolvedSecretInputPath,
   ResolvedSecretTraceRegistry,
 } from '@/executor/utils/resolved-secret-trace-registry'
 import type { SerializedBlock } from '@/serializer/types'
 
 const logger = createLogger('MothershipBlockHandler')
+
+const MOTHERSHIP_INPUT_REFUSAL = 'Mothership input could not be safely projected'
+const MOTHERSHIP_SKILL_SELECTOR_REFUSAL =
+  'Mothership skill selector could not be safely projected for display'
 const CANCELLATION_CHECK_INTERVAL_MS = 500
 const MAX_MOTHERSHIP_ATTACHMENT_BYTES = 10 * 1024 * 1024
 const MOTHERSHIP_EXECUTE_STREAM_HEADER = 'X-Mothership-Execute-Stream'
@@ -234,11 +239,15 @@ function projectPrivateMothershipSkillSelectorsForDisplay(
   privateSelectorInputPaths: readonly ResolvedSecretInputPath[]
 ): unknown {
   if (!Array.isArray(skills) || privateSelectorIndexes.size === 0) return skills
-  const projection = registry
-    .forkForInputPaths(privateSelectorInputPaths)
-    .projectResolvedInputSelection({ skills })
+  const selectorRegistry = registry.forkForInputPaths(privateSelectorInputPaths)
+  const projection = selectorRegistry.projectResolvedInputSelection({ skills })
   if (!projection.complete || !Array.isArray(projection.value.skills)) {
-    throw new Error('Mothership skill selector could not be safely projected for display')
+    refuseResolvedSecretProjection({
+      site: 'mothership.skillSelectorDisplay',
+      message: MOTHERSHIP_SKILL_SELECTOR_REFUSAL,
+      registry: selectorRegistry,
+      inputPath: 'skills',
+    })
   }
   for (const inputIndex of privateSelectorIndexes) {
     const source = skills[inputIndex]
@@ -249,7 +258,12 @@ function projectPrivateMothershipSkillSelectorsForDisplay(
       typeof source.skillId !== 'string' ||
       typeof projected.skillId !== 'string'
     ) {
-      throw new Error('Mothership skill selector could not be safely projected for display')
+      refuseResolvedSecretProjection({
+        site: 'mothership.skillSelectorDisplayEntry',
+        message: MOTHERSHIP_SKILL_SELECTOR_REFUSAL,
+        registry: selectorRegistry,
+        inputPath: 'skills.skillId',
+      })
     }
   }
   return projection.value.skills
@@ -293,19 +307,34 @@ function assertMothershipToolSchemaProjectionsAreSafe(
   if (!Array.isArray(tools)) return
   const projection = registry.projectResolvedInputSelection({ tools })
   if (!projection.complete || !Array.isArray(projection.value.tools)) {
-    throw new Error('Mothership input could not be safely projected')
+    refuseResolvedSecretProjection({
+      site: 'mothership.toolSchemaProjection',
+      message: MOTHERSHIP_INPUT_REFUSAL,
+      registry,
+      inputPath: 'tools',
+    })
   }
 
   for (const { inputIndex, selection } of selectIndexedMothershipMcpTools(tools)) {
     if (!selection.schema) continue
     const projectedCandidate = projection.value.tools[inputIndex]
     if (!isPlainRecord(projectedCandidate)) {
-      throw new Error('Mothership input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'mothership.toolSchemaProjectedEntry',
+        message: MOTHERSHIP_INPUT_REFUSAL,
+        registry,
+        inputPath: 'tools.schema',
+      })
     }
     const projectedSchema = projectedCandidate.schema ?? selection.schema
     const schemaProjection = projectModelSchemaAnnotations(selection.schema, projectedSchema)
     if (!schemaProjection.safe) {
-      throw new Error('Mothership input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'mothership.toolSchemaAnnotations',
+        message: MOTHERSHIP_INPUT_REFUSAL,
+        registry,
+        inputPath: 'tools.schema',
+      })
     }
   }
 }
@@ -316,7 +345,11 @@ function assertMothershipStructuralInputsDoNotResolveSecrets(
 ): void {
   const provenance = registry.exportCommittedProvenanceForInputPaths(inputPaths)
   if (!provenance.complete) {
-    throw new Error('Mothership input could not be safely projected')
+    refuseResolvedSecretProjection({
+      site: 'mothership.structuralInputProvenance',
+      message: MOTHERSHIP_INPUT_REFUSAL,
+      registry,
+    })
   }
   if (provenance.entries.length > 0) {
     throw new Error('Mothership structural model inputs cannot contain secret references')
@@ -640,7 +673,12 @@ async function buildMothershipFileAttachments(
   }
   const projectedFiles = normalizeFileInput(projectedFilesInput)
   if (!projectedFiles || projectedFiles.length !== files.length) {
-    throw new Error('Mothership input could not be safely projected')
+    refuseResolvedSecretProjection({
+      site: 'mothership.fileAttachmentArity',
+      message: MOTHERSHIP_INPUT_REFUSAL,
+      registry: ctx.resolvedSecretTraceRegistry,
+      inputPath: 'files',
+    })
   }
 
   const userFiles = files.map((file) =>
@@ -767,7 +805,12 @@ export class MothershipBlockHandler implements BlockHandler {
       modelInputPaths
     )
     if (!modelInputProjection.complete || typeof modelInputProjection.value.prompt !== 'string') {
-      throw new Error('Mothership input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'mothership.modelInput',
+        message: MOTHERSHIP_INPUT_REFUSAL,
+        registry: sourceRegistry,
+        inputPath: 'prompt,files,tools,skills',
+      })
     }
     const messages = [
       {

apps/sim/executor/handlers/mothership/mothership-handler.ts

@@ -53,6 +53,7 @@ import type {
   NormalizedBlockOutput,
   StreamingExecution,
 } from '@/executor/types'
+import { refuseResolvedSecretProjection } from '@/executor/utils/resolved-secret-projection-refusal'
 import { isPiSupportedProvider, resolvePiModelId } from '@/providers/pi-providers'
 import { getProviderFromModel } from '@/providers/utils'
 import type { SerializedBlock } from '@/serializer/types'
@@ -172,7 +173,12 @@ export class PiBlockHandler implements BlockHandler {
       [['task']]
     )
     if (!taskProjection.complete || typeof taskProjection.value.task !== 'string') {
-      throw new Error('Pi input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'pi.taskModelInput',
+        message: 'Pi input could not be safely projected',
+        registry: ctx.resolvedSecretTraceRegistry,
+        inputPath: 'task',
+      })
     }
     const task = taskProjection.value.task
     const model = asOptString(inputs.model) ?? DEFAULT_MODEL
@@ -431,7 +437,12 @@ export class PiBlockHandler implements BlockHandler {
       [['searchApiKey']]
     )
     if (!searchInputProjection.complete) {
-      throw new Error('Pi search input could not be safely projected')
+      refuseResolvedSecretProjection({
+        site: 'pi.searchApiKeyInput',
+        message: 'Pi search input could not be safely projected',
+        registry: ctx.resolvedSecretTraceRegistry,
+        inputPath: 'searchApiKey',
+      })
     }
     const projectedApiKey = Object.is(searchInputProjection.value.searchApiKey, rawSearchApiKey)
       ? apiKey