GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix(workflows): redact run and export secrets by TheodoreSpeaks · Pull Request #6591 · simstudioai/sim

Conversation

@TheodoreSpeaks

@TheodoreSpeaks TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • project run outputs through the secret-safe display materializer
  • apply fail-closed credential redaction to workflow exports
  • add regression coverage for both leak paths

Type of Change

  • Bug fix

Testing

  • 31 targeted tests
  • TypeScript type-check
  • lint and block-registry validation
  • 25 repo audits

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@TheodoreSpeaks
fix(workflows): redact run and export secrets
0146274
@vercel

vercel Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
docs Skipped Skipped Aug 12, 2026 4:25am

Request Review
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@cursor

cursor Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

PR Summary

High Risk
Touches secret-handling paths for execution status outputs and public workflow exports. Fail-closed behavior is safer, but incorrect projection could still leak secrets or drop legitimate outputs.

Overview
Closes two secret-leak paths by making run status and workflow export fail closed on unproven credential data.

Run outputs now go through a new materializeExecutionDataForDisplayWithBlockOutputs path instead of raw collectFunctionalBlockOutputs. Selected block outputs are projected only from authoritative execution-state values with usable secret provenance; legacy/trace fallbacks and unproven state are omitted, and raw executionState never crosses the display boundary.

Workflow export enables redactOpaqueCredentialInputs, so nested tool-input credentials and opaque credential-bearing fields are nulled in the public export payload. Regression coverage covers both leak paths.

Reviewed by Cursor Bugbot for commit 08c27c3. Bugbot is set up for automated code reviews on this repo. Configure here.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@greptile-apps

greptile-apps Bot commented Aug 12, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR routes selected run outputs through provenance-aware display projection and applies fail-closed credential sanitization to workflow exports.

  • Materializes requested functional outputs from authoritative execution-state block data without exposing raw execution state.
  • Prevents trace-only or unproven values from becoming public block outputs.
  • Enables opaque credential redaction for exported workflows and adds regression coverage for both leak paths.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains in the fixes covered by the previous review threads.

No blocking failure remains.

Important Files Changed
Filename Overview
apps/sim/lib/logs/execution/trace-store.ts Adds a display-boundary materializer that projects requested authoritative block-state outputs and excludes raw execution state and trace fallbacks.
apps/sim/lib/workflows/executor/execution-status.ts Uses the secret-safe materializer for final and selected block outputs, resolving the previously reported state-only output loss.
apps/sim/lib/workflows/sanitization/json-sanitizer.ts Enables fail-closed redaction of opaque credential-bearing inputs during public workflow export.
apps/sim/lib/workflows/operations/export-workflow.test.ts Verifies nested tool credential and password parameters are removed while ordinary parameters remain intact.
apps/sim/lib/logs/execution/trace-store.test.ts Covers authoritative state-only projection, provenance failures, partial state, legacy traces, and nonmutation of persisted execution state.

Flowchart

 
%%{init: {'theme': 'neutral'}}%%
flowchart LR
  State[Persisted execution state] --> Materialize[Materialize execution data]
  Materialize --> Project[Project requested block outputs using secret provenance]
  Project --> Status[Workflow status response]
  Trace[Trace spans] -. Not used as functional output fallback .-> Project
  Workflow[Normalized workflow state] --> Sanitize[Fail-closed export sanitization]
  Sanitize --> Export[Public workflow export]
Loading

Reviews (5): Last reviewed commit: "fix(workflows): stop deriving outputs fr..." | Re-trigger Greptile
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks
fix(workflows): preserve redacted run outputs
e92b6ab
@vercel
vercel Bot temporarily deployed to Preview August 12, 2026 03:51 Inactive
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@cursor review
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
greptile-apps[bot]
greptile-apps Bot reviewed Aug 12, 2026
View reviewed changes
Comment thread apps/sim/lib/logs/execution/trace-store.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit e92b6ab. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@TheodoreSpeaks
fix(workflows): retain safe trace output fallback
2936dfc
@vercel
vercel Bot temporarily deployed to Preview August 12, 2026 04:07 Inactive
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@cursor review
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes
Comment thread apps/sim/lib/logs/execution/trace-store.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks
fix(workflows): stop deriving outputs from traces
08c27c3
@vercel
vercel Bot temporarily deployed to Preview August 12, 2026 04:25 Inactive
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@cursor review
cursor[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cursor[bot]
cursor Bot reviewed Aug 12, 2026
View reviewed changes

@cursor cursor Bot left a comment

Copy link
Copy Markdown

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 08c27c3. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@TheodoreSpeaks

TheodoreSpeaks commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@greptile
greptile-apps[bot] reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks
TheodoreSpeaks merged commit 50e5dff into staging Aug 12, 2026
30 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@TheodoreSpeaks
TheodoreSpeaks deleted the fix/runs-materializer branch August 12, 2026 04:32
This was referenced Aug 12, 2026
v0.8.0: desktop app, workflow UI, v2 endpoints #6606
Merged
test(export): pin the table and tool-param loss the sanitized export accepts #6613
Merged
pull Bot pushed a commit to RealShocky/sim that referenced this pull request Aug 12, 2026
@waleedlatif1
test(export): pin the table and tool-param loss the sanitized export …
2054947 
…accepts (simstudioai#6613)

* test(export): pin the table and tool-param loss the sanitized export accepts

simstudioai#6591 enabled `redactOpaqueCredentialInputs` on the workflow export path,
closing a real leak. It also made export lossy for tables and unauthoritative
tool params, and nothing pinned that trade in either direction.

Adds round-trip fixtures (an api block with two table sub-blocks, an agent
block with a custom tool) plus assertions for the current loss, records the
security/usability trade on the flag that governs it, and deletes a duplicate
`sanitizeForExport` in credential-extractor that omitted the redaction flag
and had zero production importers.

No behavior change.

* test(export): make the env-ref leak sweep load-bearing and drop test any

The sweep asserted against a token the fixture no longer contained, so it
passed vacuously. Both the fixture and the assertion now read one symbol,
which is the only form that cannot drift.

Also types the re-imported block lookup instead of casting through any.

This branch was previously deployed

1 inactive deployment
Preview — 08c27c38 Deployed Aug 12, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@cursor cursor[bot] cursor[bot] left review comments

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@TheodoreSpeaks
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.