fix(execution): preserve functional state during trace projection

icecrasher321 · icecrasher321 · commit c9302a55a93a · 2026-08-01T12:02:51.000-07:00
diff --git a/apps/sim/app/api/workflows/[id]/log/route.test.ts b/apps/sim/app/api/workflows/[id]/log/route.test.ts
@@ -312,15 +312,22 @@ describe('POST /api/workflows/[id]/log completion attribution', () => {
   })
 
   it('restores trusted Secrets provenance before projecting legacy completion traces', async () => {
+    const trustedExecutionState = {
+      blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+      executedBlocks: ['function-1'],
+      blockLogs: [],
+      decisions: { router: {}, condition: {} },
+      completedLoops: [],
+      activeExecutionPath: ['function-1'],
+      resolvedSecretTraceProvenance: { version: 1, complete: true, entries: [] },
+    }
     dbChainMockFns.limit.mockResolvedValueOnce([
       {
         workflowId: OWNER_WORKFLOW_ID,
         workspaceId: 'workspace-1',
         executionData: {
           billingAttribution: storedBillingAttribution,
-          executionState: {
-            resolvedSecretTraceProvenance: { version: 1, complete: true, entries: [] },
-          },
+          executionState: trustedExecutionState,
         },
       },
     ])
@@ -342,6 +349,44 @@ describe('POST /api/workflows/[id]/log completion attribution', () => {
       entries: [],
       scope: { userId: 'user-1', workspaceId: 'workspace-1' },
     })
+    expect(mockSafeComplete).toHaveBeenCalledWith(
+      expect.objectContaining({ executionState: trustedExecutionState })
+    )
+  })
+
+  it('forwards trusted execution state through legacy error completion', async () => {
+    const trustedExecutionState = {
+      blockStates: { 'function-1': { output: { error: 'raw-secret-value' } } },
+      executedBlocks: ['function-1'],
+      blockLogs: [],
+      decisions: { router: {}, condition: {} },
+      completedLoops: [],
+      activeExecutionPath: ['function-1'],
+      resolvedSecretTraceProvenance: { version: 1, complete: true, entries: [] },
+    }
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      {
+        workflowId: OWNER_WORKFLOW_ID,
+        workspaceId: 'workspace-1',
+        executionData: {
+          billingAttribution: storedBillingAttribution,
+          executionState: trustedExecutionState,
+        },
+      },
+    ])
+
+    const res = await POST(
+      makeRequest(OWNER_WORKFLOW_ID, {
+        executionId: 'trusted-error-execution-id',
+        result: { success: false, error: 'failed' },
+      }),
+      { params: Promise.resolve({ id: OWNER_WORKFLOW_ID }) }
+    )
+
+    expect(res.status).toBe(200)
+    expect(mockSafeCompleteWithError).toHaveBeenCalledWith(
+      expect.objectContaining({ executionState: trustedExecutionState })
+    )
   })
 
   it('forces structural-only traces when trusted stored provenance is unavailable', async () => {
diff --git a/apps/sim/app/api/workflows/[id]/log/route.ts b/apps/sim/app/api/workflows/[id]/log/route.ts
@@ -16,6 +16,7 @@ import { buildTraceSpans } from '@/lib/logs/execution/trace-spans/trace-spans'
 import { materializeExecutionData } from '@/lib/logs/execution/trace-store'
 import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
+import type { SerializableExecutionState } from '@/executor/execution/types'
 import type { ExecutionResult } from '@/executor/types'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 
@@ -133,11 +134,13 @@ export const POST = withRouteHandler(
             executionId,
           }
         )
-        const trustedExecutionState = trustedExecutionData.executionState
-        const trustedProvenance =
-          trustedExecutionState && typeof trustedExecutionState === 'object'
-            ? (trustedExecutionState as Record<string, unknown>).resolvedSecretTraceProvenance
+        const trustedExecutionState =
+          trustedExecutionData.executionState &&
+          typeof trustedExecutionData.executionState === 'object' &&
+          !Array.isArray(trustedExecutionData.executionState)
+            ? (trustedExecutionData.executionState as SerializableExecutionState)
             : undefined
+        const trustedProvenance = trustedExecutionState?.resolvedSecretTraceProvenance
         if (trustedProvenance === undefined) {
           resolvedSecretTraceRegistry.markIncomplete()
         } else {
@@ -168,13 +171,15 @@ export const POST = withRouteHandler(
             totalDurationMs: totalDuration || result.metadata?.duration || 0,
             error: { message },
             traceSpans,
+            executionState: trustedExecutionState,
           })
         } else {
           await loggingSession.safeComplete({
             endedAt: new Date().toISOString(),
             totalDurationMs: totalDuration || result.metadata?.duration || 0,
             finalOutput: result.output || {},
             traceSpans,
+            executionState: trustedExecutionState,
           })
         }
 
diff --git a/apps/sim/executor/handlers/workflow/workflow-handler.test.ts b/apps/sim/executor/handlers/workflow/workflow-handler.test.ts
@@ -1242,25 +1242,42 @@ describe('WorkflowBlockHandler', () => {
     })
 
     it('completes the child session and disposes the cancellation bridge', async () => {
+      const executionState = {
+        blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+      }
+      mockExecutorExecute.mockResolvedValue({
+        success: true,
+        output: { data: 'ok' },
+        executionState,
+      })
+
       await handler.execute(customBlockContext(), customBlock(), {})
 
       expect(mockSafeComplete).toHaveBeenCalledTimes(1)
+      expect(mockSafeComplete).toHaveBeenCalledWith(expect.objectContaining({ executionState }))
       expect(mockSafeCompleteWithError).not.toHaveBeenCalled()
       expect(mockDispose).toHaveBeenCalledTimes(1)
     })
 
     it('records a cancelled child through the cancellation path', async () => {
       // Production shape: the engine reports cancellation as `success: false`
       // plus `status: 'cancelled'` on the ExecutionResult (never on metadata).
+      const executionState = {
+        blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+      }
       mockExecutorExecute.mockResolvedValue({
         success: false,
         output: {},
         status: 'cancelled',
+        executionState,
       })
 
       await handler.execute(customBlockContext(), customBlock(), {}).catch(() => {})
 
       expect(mockSafeCompleteWithCancellation).toHaveBeenCalledTimes(1)
+      expect(mockSafeCompleteWithCancellation).toHaveBeenCalledWith(
+        expect.objectContaining({ executionState })
+      )
       expect(mockSafeComplete).not.toHaveBeenCalled()
       // Already finalized as cancelled — must not be re-completed as an error.
       expect(mockSafeCompleteWithError).not.toHaveBeenCalled()
diff --git a/apps/sim/executor/handlers/workflow/workflow-handler.ts b/apps/sim/executor/handlers/workflow/workflow-handler.ts
@@ -805,7 +805,12 @@ export class WorkflowBlockHandler implements BlockHandler {
     // Cancellation lives on `ExecutionResult.status` — `ExecutionMetadata.status`
     // has no 'cancelled' member, so reading it there never matches.
     if (executionResult.status === 'cancelled') {
-      await session.safeCompleteWithCancellation({ endedAt, totalDurationMs, traceSpans })
+      await session.safeCompleteWithCancellation({
+        endedAt,
+        totalDurationMs,
+        traceSpans,
+        executionState: executionResult.executionState,
+      })
       return
     }
 
@@ -815,6 +820,7 @@ export class WorkflowBlockHandler implements BlockHandler {
       finalOutput: executionResult.output ?? {},
       traceSpans,
       workflowInput,
+      executionState: executionResult.executionState,
     })
   }
 
diff --git a/apps/sim/lib/logs/execution/logging-session.test.ts b/apps/sim/lib/logs/execution/logging-session.test.ts
@@ -151,6 +151,41 @@ describe('LoggingSession terminal provenance', () => {
       })
     )
   })
+
+  it.each(['cancellation', 'pause'] as const)(
+    'preserves raw execution state on %s finalization',
+    async (finalization) => {
+      const session = new LoggingSession('workflow-1', `execution-state-${finalization}`, 'manual')
+      session.setResolvedSecretTraceRegistry(createSecretRegistry([]))
+      const executionState = {
+        blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+        executedBlocks: ['function-1'],
+        blockLogs: [],
+        decisions: { router: {}, condition: {} },
+        completedLoops: [],
+        activeExecutionPath: ['function-1'],
+      }
+
+      if (finalization === 'cancellation') {
+        await session.completeWithCancellation({ executionState })
+      } else {
+        await session.completeWithPause({ executionState })
+      }
+
+      expect(completeWorkflowExecutionMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          executionState: expect.objectContaining({
+            blockStates: executionState.blockStates,
+            resolvedSecretTraceProvenance: {
+              version: 1,
+              complete: true,
+              entries: [],
+            },
+          }),
+        })
+      )
+    }
+  )
 })
 
 beforeEach(() => {
@@ -596,15 +631,25 @@ describe('LoggingSession completion retries', () => {
     completeWorkflowExecutionMock
       .mockRejectedValueOnce(new Error('primary persistence failed'))
       .mockResolvedValueOnce({})
+    const executionState = {
+      blockStates: { 'function-1': { output: { result: secret } } },
+      executedBlocks: ['function-1'],
+      blockLogs: [],
+      decisions: { router: {}, condition: {} },
+      completedLoops: [],
+      activeExecutionPath: ['function-1'],
+    }
 
     await session.safeComplete({
       finalOutput: { echoed: secret },
+      executionState,
     })
 
     expect(completeWorkflowExecutionMock).toHaveBeenLastCalledWith(
       expect.objectContaining({
         finalOutput: { echoed: secret },
         finalizationPath: 'fallback_completed',
+        executionState: expect.objectContaining({ blockStates: executionState.blockStates }),
       })
     )
   })
@@ -944,18 +989,33 @@ describe('LoggingSession completion retries', () => {
     completeWorkflowExecutionMock
       .mockRejectedValueOnce(new Error('pause finalize failed'))
       .mockResolvedValueOnce({})
+    const executionState = {
+      blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+      executedBlocks: ['function-1'],
+      blockLogs: [],
+      decisions: { router: {}, condition: {} },
+      completedLoops: [],
+      activeExecutionPath: ['function-1'],
+    }
 
     await expect(
       session.safeCompleteWithPause({
         endedAt: new Date().toISOString(),
         totalDurationMs: 10,
         traceSpans: [],
         workflowInput: { hello: 'world' },
+        executionState,
       })
     ).resolves.toBeUndefined()
 
     expect(session.hasCompleted()).toBe(true)
     expect(completeWorkflowExecutionMock).toHaveBeenCalledTimes(2)
+    expect(completeWorkflowExecutionMock).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        finalizationPath: 'paused',
+        executionState: expect.objectContaining({ blockStates: executionState.blockStates }),
+      })
+    )
   })
 
   it('persists last started block independently from cost accumulation', async () => {
diff --git a/apps/sim/lib/logs/execution/logging-session.ts b/apps/sim/lib/logs/execution/logging-session.ts
@@ -156,13 +156,15 @@ export interface SessionCancelledParams {
   endedAt?: string
   totalDurationMs?: number
   traceSpans?: TraceSpan[]
+  executionState?: SerializableExecutionState
 }
 
 export interface SessionPausedParams {
   endedAt?: string
   totalDurationMs?: number
   traceSpans?: TraceSpan[]
   workflowInput?: any
+  executionState?: SerializableExecutionState
 }
 
 export interface LoggingSessionOptions {
@@ -902,6 +904,7 @@ export class LoggingSession {
         costSummary,
         finalOutput: { cancelled: true },
         traceSpans,
+        executionState: params.executionState,
         finalizationPath: 'cancelled',
         status: 'cancelled',
       })
@@ -999,6 +1002,7 @@ export class LoggingSession {
         finalOutput: { paused: true },
         traceSpans,
         workflowInput,
+        executionState: params.executionState,
         finalizationPath: 'paused',
         status: 'pending',
       })
@@ -1197,6 +1201,7 @@ export class LoggingSession {
         isError: false,
         finalizationPath: 'fallback_completed',
         finalOutput: params.finalOutput || {},
+        executionState: params.executionState,
       })
     }
   }
@@ -1256,6 +1261,7 @@ export class LoggingSession {
         isError: false,
         finalizationPath: 'cancelled',
         finalOutput: { cancelled: true },
+        executionState: params?.executionState,
         status: 'cancelled',
       })
     }
@@ -1283,6 +1289,7 @@ export class LoggingSession {
         isError: false,
         finalizationPath: 'paused',
         finalOutput: { paused: true },
+        executionState: params?.executionState,
         status: 'pending',
       })
     }
diff --git a/apps/sim/lib/workflows/executor/execution-core.test.ts b/apps/sim/lib/workflows/executor/execution-core.test.ts
@@ -1032,12 +1032,16 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
   })
 
   it('routes cancelled executions through safeCompleteWithCancellation', async () => {
+    const executionState = {
+      blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+    }
     executorExecuteMock.mockResolvedValue({
       success: false,
       status: 'cancelled',
       output: {},
       logs: [],
       metadata: { duration: 123, startTime: 'start', endTime: 'end' },
+      executionState,
     })
 
     const result = await executeWorkflowCore({
@@ -1052,6 +1056,7 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
       expect.objectContaining({
         totalDurationMs: 123,
         traceSpans: [{ id: 'span-1' }],
+        executionState,
       })
     )
     expect(safeCompleteMock).not.toHaveBeenCalled()
@@ -1060,12 +1065,16 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
   })
 
   it('routes paused executions through safeCompleteWithPause', async () => {
+    const executionState = {
+      blockStates: { 'function-1': { output: { result: 'raw-secret-value' } } },
+    }
     executorExecuteMock.mockResolvedValue({
       success: true,
       status: 'paused',
       output: {},
       logs: [],
       metadata: { duration: 123, startTime: 'start', endTime: 'end' },
+      executionState,
     })
 
     const result = await executeWorkflowCore({
@@ -1081,6 +1090,7 @@ describe('executeWorkflowCore terminal finalization sequencing', () => {
         totalDurationMs: 123,
         traceSpans: [{ id: 'span-1' }],
         workflowInput: { hello: 'world' },
+        executionState,
       })
     )
     expect(safeCompleteMock).not.toHaveBeenCalled()
diff --git a/apps/sim/lib/workflows/executor/execution-core.ts b/apps/sim/lib/workflows/executor/execution-core.ts
diff --git a/apps/sim/lib/workflows/streaming/streaming.test.ts b/apps/sim/lib/workflows/streaming/streaming.test.ts
diff --git a/apps/sim/lib/workflows/streaming/streaming.ts b/apps/sim/lib/workflows/streaming/streaming.ts
