fix(logs): gate workflow input inherited from a prior execution

Greptile review: the boundary exemption assumed a non-nested trigger implies an
inbound payload. A re-run with inputFromExecutionId breaks that. It copies the
source run's workflowInput verbatim, and the destination presents whatever
trigger type its caller asked for, so a value resolved inside a custom_block
parent could arrive in a manual run and be exempted. The destination's own
provenance cannot describe the source's secret resolution, so no matcher covers
it.

The read path could not tell an inherited input from a fresh one, so the re-run
now records its source: LoggingSession.setInputSourceExecutionId stamps it into
the existing trigger data channel, and the display projection withholds the
exemption whenever it is present. Nested runs and inherited-input runs share one
predicate - neither is a pre-resolution inbound payload.

Adds setInputSourceExecutionId to the shared @sim/testing LoggingSession mock so
the execute-route suites exercise the real call.

Author: mzxchandra

apps/sim/app/api/workflows/[id]/execute/route.ts

@@ -1174,6 +1174,15 @@ async function handleExecutePost(
       loggingTriggerType,
       requestId
     )
+    /**
+     * Reusing a prior run's input copies that run's exposure with it, and this
+     * run's own provenance cannot describe a secret the source resolved. Record
+     * the source so the log display projection withholds the workflow-boundary
+     * exemption for this run.
+     */
+    if (inputFromExecutionId) {
+      loggingSession.setInputSourceExecutionId(inputFromExecutionId)
+    }
     if (copilotToolCallId) {
       loggingSession.setTrustedExecutionCorrelation({
         executionId,

apps/sim/lib/logs/execution/logging-session.ts

@@ -201,6 +201,7 @@ export class LoggingSession {
   private postExecutionPromise: Promise<void> | null = null
   private resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
   private traceLargeValueAccess: LargeValueStoreContext = {}
+  private inputSourceExecutionId?: string
 
   constructor(
     workflowId: string,
@@ -226,6 +227,20 @@ export class LoggingSession {
     this.resolvedSecretTraceRegistry = registry
   }
 
+  /**
+   * Records that this run's input was copied from a prior execution
+   * (`inputFromExecutionId`) rather than arriving with the trigger.
+   *
+   * The log display projection reads this to withhold the workflow-boundary
+   * exemption. An inherited input carries the SOURCE run's exposure - a value
+   * resolved inside a custom-block parent stays plaintext through the copy -
+   * and this run's own provenance cannot describe that resolution, so it must
+   * not be treated as a pre-resolution inbound payload.
+   */
+  setInputSourceExecutionId(sourceExecutionId: string): void {
+    this.inputSourceExecutionId = sourceExecutionId
+  }
+
   /** Adds server-validated lifecycle correlation without exposing it to executor metadata. */
   setTrustedExecutionCorrelation(
     correlation: NonNullable<NonNullable<ExecutionTrigger['data']>['correlation']>
@@ -626,9 +641,18 @@ export class LoggingSession {
     }
 
     try {
-      const effectiveTriggerData = this.trustedExecutionCorrelation
-        ? { ...triggerData, correlation: this.trustedExecutionCorrelation }
-        : triggerData
+      const derivedTriggerData = {
+        ...(this.trustedExecutionCorrelation
+          ? { correlation: this.trustedExecutionCorrelation }
+          : {}),
+        ...(this.inputSourceExecutionId
+          ? { inputSourceExecutionId: this.inputSourceExecutionId }
+          : {}),
+      }
+      const effectiveTriggerData =
+        Object.keys(derivedTriggerData).length > 0 || triggerData
+          ? { ...triggerData, ...derivedTriggerData }
+          : undefined
       this.trigger = createTriggerObject(this.triggerType, effectiveTriggerData)
       this.correlation = effectiveTriggerData?.correlation
       this.environment = createEnvironmentObject(

apps/sim/lib/logs/execution/trace-store.test.ts

@@ -302,6 +302,40 @@ describe('projectExecutionDataForDisplay', () => {
     }
   )
 
+  /**
+   * A re-run presents whatever trigger type its caller asked for, so the value
+   * copied out of a nested run would otherwise look inbound. The stamped source
+   * id keeps it gated.
+   */
+  it('gates workflowInput inherited from a prior execution regardless of trigger type', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        trigger: {
+          type: 'manual',
+          source: 'manual',
+          data: { inputSourceExecutionId: 'execution-source-1' },
+        },
+        workflowInput: { apiKey: 'INHERITED-FROM-CUSTOM-BLOCK-PARENT' },
+      },
+      CONTEXT
+    )
+
+    expect(displayData).not.toHaveProperty('workflowInput')
+    expect(JSON.stringify(displayData)).not.toContain('INHERITED-FROM-CUSTOM-BLOCK-PARENT')
+  })
+
+  it('keeps the exemption for a manual run whose trigger data carries no input source', async () => {
+    const displayData = await projectExecutionDataForDisplay(
+      {
+        trigger: { type: 'manual', source: 'manual', data: { correlation: { a: 1 } } },
+        workflowInput: { question: 'typed by the user' },
+      },
+      CONTEXT
+    )
+
+    expect(displayData.workflowInput).toEqual({ question: 'typed by the user' })
+  })
+
   it('still redacts and shows a nested execution input when provenance is complete', async () => {
     const displayData = await projectExecutionDataForDisplay(
       {

apps/sim/lib/logs/execution/trace-store.ts

@@ -246,13 +246,35 @@ const LOG_DISPLAY_BOUNDARY_SPAN_ID = 'secret-safe-log-display-boundary'
  */
 const NESTED_EXECUTION_TRIGGER_TYPES = new Set(['workflow', 'custom_block'])
 
-function isNestedExecution(executionData: Record<string, unknown>): boolean {
+function triggerRecord(
+  executionData: Record<string, unknown>
+): Record<string, unknown> | undefined {
   const trigger = executionData.trigger
-  if (!trigger || typeof trigger !== 'object' || Array.isArray(trigger)) return false
-  const type = (trigger as Record<string, unknown>).type
+  if (!trigger || typeof trigger !== 'object' || Array.isArray(trigger)) return undefined
+  return trigger as Record<string, unknown>
+}
+
+function isNestedExecution(executionData: Record<string, unknown>): boolean {
+  const type = triggerRecord(executionData)?.type
   return typeof type === 'string' && NESTED_EXECUTION_TRIGGER_TYPES.has(type)
 }
 
+/**
+ * Whether this run's input was copied from a prior execution
+ * (`inputFromExecutionId`), stamped by `LoggingSession.setInputSourceExecutionId`.
+ *
+ * A re-run presents whatever trigger type its caller asked for, so the nested
+ * check alone cannot see that the value originated in a nested run. Without
+ * this, a secret resolved inside a custom-block parent could be copied into a
+ * `manual` run and exempted. The inherited value carries the SOURCE run's
+ * exposure, which this run's provenance cannot describe, so it stays gated.
+ */
+function hasInheritedInput(executionData: Record<string, unknown>): boolean {
+  const data = triggerRecord(executionData)?.data
+  if (!data || typeof data !== 'object' || Array.isArray(data)) return false
+  return typeof (data as Record<string, unknown>).inputSourceExecutionId === 'string'
+}
+
 /**
  * Wraps display content in a span so it passes through the same secret
  * projection the executor's trace spans do.
@@ -319,10 +341,11 @@ export async function projectExecutionDataForDisplay(
   }
 
   /**
-   * A nested run's input came from its parent's resolved outputs, so it gets no
-   * boundary exemption - every content key is gated for it.
+   * A nested run's input came from its parent's resolved outputs, and a re-run's
+   * came from another execution. Neither is a pre-resolution inbound payload, so
+   * both forgo the boundary exemption - every content key is gated for them.
    */
-  const nested = isNestedExecution(executionData)
+  const nested = isNestedExecution(executionData) || hasInheritedInput(executionData)
   const gatedKeys: readonly string[] = nested ? LOG_DISPLAY_CONTENT_KEYS : LOG_DISPLAY_GATED_KEYS
   const boundaryKeys: readonly string[] = nested ? [] : LOG_DISPLAY_BOUNDARY_KEYS
 

packages/testing/src/mocks/logging-session.mock.ts

@@ -26,6 +26,7 @@ export const loggingSessionMockFns = {
   mockWaitForCompletion: vi.fn().mockResolvedValue(undefined),
   mockWaitForPostExecution: vi.fn().mockResolvedValue(undefined),
   mockSetTrustedExecutionCorrelation: vi.fn(),
+  mockSetInputSourceExecutionId: vi.fn(),
   mockProjectBlockLogsForDisplay: vi.fn(async (logs: unknown) => logs),
   mockProjectDisplayContent: vi.fn(async (content: unknown) => content),
   mockProjectLiveDisplayText: vi.fn(async (_field: string, value: string) => ({ value })),
@@ -53,6 +54,7 @@ function buildLoggingSessionInstance() {
     waitForCompletion: loggingSessionMockFns.mockWaitForCompletion,
     waitForPostExecution: loggingSessionMockFns.mockWaitForPostExecution,
     setTrustedExecutionCorrelation: loggingSessionMockFns.mockSetTrustedExecutionCorrelation,
+    setInputSourceExecutionId: loggingSessionMockFns.mockSetInputSourceExecutionId,
     projectBlockLogsForDisplay: loggingSessionMockFns.mockProjectBlockLogsForDisplay,
     projectDisplayContent: loggingSessionMockFns.mockProjectDisplayContent,
     projectLiveDisplayText: loggingSessionMockFns.mockProjectLiveDisplayText,