fix(logs): restore workflow input on log details for runs without secret provenance

PR #6000 added a resolved-secret gate to the log display projection: when a
run's persisted resolvedSecretTraceProvenance is absent or incomplete,
projectTraceSpansForSecrets returns structural-only spans, which stripped the
whole display envelope. That silently blanked the Input and Output panels for
every run written before #6000, and for any run whose registry goes incomplete.

Splits the display envelope in two. Per-block content (finalOutput, blockInput,
blockExecutions, errors, trace spans) keeps the existing gate and fails closed.
Only workflowInput is exempted, via projectWorkflowBoundarySpansForSecrets:
with complete provenance it is byte-identical to the current matcher path, and
with absent or incomplete provenance the content survives instead of collapsing.

workflowInput is exempt because an inbound trigger payload is captured before
any secret is resolved. That premise does NOT hold for nested runs: a workflow
or custom_block execution is handed workflowInput built from its parent's
already-resolved block outputs, so those keep the gated treatment. The check is
a denylist of nested trigger types, because webhook runs record the provider
(zoho_desk, slack) as the trigger type and an allowlist would fail closed on
exactly the population this fixes.

Runs written before workflowInput was persisted recover it from the trigger
block state, gated on an absent provenance key plus present block states, which
together identify pre-stamping data without dating the row. Recovery refuses
when more than one block state matches the trigger shape, since a paused run
carries a resume placeholder with the same shape and its capability URL must
never render as the workflow input.

Verified against 137 executions on a live instance: the only display key that
differs from the pre-fix baseline is workflowInput, on 72 runs, none lost.

Author: mzxchandra

apps/sim/lib/logs/execution/logging-session.test.ts

@@ -157,6 +157,28 @@ describe('LoggingSession terminal provenance', () => {
     )
   })
 
+  it('stamps provenance on finalization when no registry was installed explicitly', async () => {
+    startWorkflowExecutionMock.mockResolvedValue({})
+    loadWorkflowStateForExecutionMock.mockResolvedValue({
+      blocks: {},
+      edges: [],
+      loops: {},
+      parallels: {},
+    })
+    const session = new LoggingSession('workflow-1', 'execution-implicit-registry', 'webhook')
+
+    await session.start({ userId: 'user-1', workspaceId: 'workspace-1' })
+    await session.completeWithError({ error: { message: 'failed' } })
+
+    expect(completeWorkflowExecutionMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        executionState: expect.objectContaining({
+          resolvedSecretTraceProvenance: expect.objectContaining({ version: 1 }),
+        }),
+      })
+    )
+  })
+
   it.each(['cancellation', 'pause'] as const)(
     'preserves raw execution state on %s finalization',
     async (finalization) => {

apps/sim/lib/logs/execution/trace-secret-projection.test.ts

@@ -17,6 +17,7 @@ vi.mock('@/lib/execution/payloads/store', () => ({
 import {
   enforceTraceSpanSecretInvariant,
   projectTraceSpansForSecrets,
+  projectWorkflowBoundarySpansForSecrets,
 } from '@/lib/logs/execution/trace-secret-projection'
 import type { TraceSpan } from '@/lib/logs/types'
 import {
@@ -1109,3 +1110,56 @@ describe('projectTraceSpansForSecrets', () => {
     expect(cursor?.children).toEqual([])
   })
 })
+
+describe('projectWorkflowBoundarySpansForSecrets', () => {
+  it('retains boundary content when provenance is absent', async () => {
+    const [result] = await projectWorkflowBoundarySpansForSecrets(
+      [createSpan({ output: { workflowInput: { channel: 'C123' } } })],
+      { store: STORE }
+    )
+
+    expect(result.output).toEqual({ workflowInput: { channel: 'C123' } })
+  })
+
+  it('retains boundary content when provenance is incomplete', async () => {
+    const [result] = await projectWorkflowBoundarySpansForSecrets(
+      [createSpan({ output: { workflowInput: { channel: 'C123' } } })],
+      { registry: createRegistry([], false), store: STORE }
+    )
+
+    expect(result.output).toEqual({ workflowInput: { channel: 'C123' } })
+  })
+
+  it('redacts resolved secrets when provenance is complete', async () => {
+    const [result] = await projectWorkflowBoundarySpansForSecrets(
+      [createSpan({ output: { workflowInput: { key: 'raw-secret' } } })],
+      {
+        registry: createRegistry([{ plaintext: 'raw-secret', replacement: '{{API_SECRET}}' }]),
+        store: STORE,
+      }
+    )
+
+    expect(result.output).toEqual({ workflowInput: { key: '{{API_SECRET}}' } })
+  })
+})
+
+describe('projectWorkflowBoundarySpansForSecrets structural fallback', () => {
+  it('falls back to structure when the bounded clone exceeds projection limits', async () => {
+    let source = createSpan({ id: 'depth-150', output: { workflowInput: { channel: 'C123' } } })
+    for (let depth = 149; depth >= 0; depth -= 1) {
+      source = createSpan({ id: `depth-${depth}`, children: [source] })
+    }
+
+    const [result] = await projectWorkflowBoundarySpansForSecrets([source], { store: STORE })
+
+    let projectedDepth = 0
+    let cursor: TraceSpan | undefined = result
+    while (cursor?.children?.[0]) {
+      expect(cursor).not.toHaveProperty('output')
+      projectedDepth += 1
+      cursor = cursor.children[0]
+    }
+    expect(projectedDepth).toBe(100)
+    expect(cursor).not.toHaveProperty('output')
+  })
+})

apps/sim/lib/logs/execution/trace-secret-projection.ts

@@ -1520,6 +1520,37 @@ export async function enforceTraceSpanSecretInvariant(
   }
 }
 
+/**
+ * Projects workflow-boundary spans - content captured before the executor
+ * resolves any secret, so it structurally cannot be a resolved-secret sink.
+ * Collapsing it to structure whenever provenance is unavailable leaves the log
+ * with nothing readable at all. With a complete registry this is identical to
+ * {@link projectTraceSpansForSecrets}; with absent or incomplete provenance the
+ * content is retained through the same clone used for a complete registry that
+ * holds no secrets. Anything downstream of block execution - including the
+ * workflow's final output - must not be routed here.
+ *
+ * That clone bounds span STRUCTURE (node count and depth) but not the payload
+ * inside `output`, which it keeps by reference. A caller must therefore only
+ * route content here that it is willing to return verbatim - the same exposure
+ * the no-secrets path already carries for every span it clones.
+ */
+export async function projectWorkflowBoundarySpansForSecrets(
+  traceSpans: TraceSpan[],
+  options: ProjectTraceSpansForSecretsOptions
+): Promise<TraceSpan[]> {
+  if (options.registry?.isComplete()) return projectTraceSpansForSecrets(traceSpans, options)
+
+  try {
+    return cloneTraceSpansForProjection(traceSpans)
+  } catch {
+    logger.warn(
+      'Workflow-boundary projection exceeded structural limits; retaining structural spans only'
+    )
+    return structuralOnlyTraceSpans(traceSpans)
+  }
+}
+
 /**
  * Produces the only Secrets-feature-safe representation of execution TraceSpans.
  * Runtime logs and outputs remain untouched; only schema-defined trace content is copied.