perf(cli): load a manual run's draft once and keep embedded CLI results lean (#8625)

* perf(cli): load a manual run's draft once and keep embedded CLI results lean

- Manual runs reuse the draft state the use case loaded to pick and validate
  the trigger, instead of reading the draft tables twice more in the execute
  service and the execution core. The trigger is now chosen from the same
  snapshot that runs.
- Embedded (in-app agent) synchronous runs ask for file references without
  inline base64 unless --include-file-base64 is passed; --async never sends it.
- Embedded logs get leaves the workflow snapshot out unless
  --include-workflow-state is passed, via a new embeddedRequestDefault contract
  field. The installed CLI and public API defaults are unchanged.
- Add test-cli-run-latency-e2e.ts, which times both commands per segment
  against a running app and writes a JSON report; CI runs a short pass.

* fix(cli): cover followed runs, assert lean results, own CI step for the CLI E2E

- Embedded --follow runs also ask for file references only.
- The E2E asserts this checkout's embedded results carry no inline file bytes
  or workflow snapshot; a compared CLI build is measured, not asserted.
- Run the CLI E2E against its own self-hosted app: hosted billing admits runs
  through Redis, which the HTTP E2E job does not provision.

* fix(cli): remove the CLI E2E's execution logs and snapshots on cleanup

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -269,6 +269,49 @@ jobs:
           VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
             bun run test:workflow-version-compare:e2e
 
+      # Self-hosted without billing: hosted billing admits runs through Redis, which
+      # this job does not provision.
+      - name: Verify embedded CLI workflow runs and log reads over real HTTP
+        working-directory: apps/sim
+        env:
+          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3018
+          BETTER_AUTH_URL: http://127.0.0.1:3018
+          NEXT_PUBLIC_FORCE_HOSTED: 'false'
+          INTERNAL_API_SECRET: cli-http-ci-local-secret-at-least-32-characters
+          DISABLE_TELEMETRY: 'true'
+          NEXT_TELEMETRY_DISABLED: '1'
+          READY_TIMEOUT_SECONDS: 300
+        run: |
+          report_dir="$RUNNER_TEMP/e2e"
+          server_log="$report_dir/cli-next.log"
+          mkdir -p "$report_dir"
+          node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3018 > "$server_log" 2>&1 &
+          server_pid=$!
+          finish() {
+            kill "$server_pid" 2>/dev/null || true
+            wait "$server_pid" 2>/dev/null || true
+          }
+          trap finish EXIT
+          fail_startup() {
+            echo "::error::$1"
+            tail -n 200 "$server_log"
+            exit 1
+          }
+          started=$SECONDS
+          until curl --fail --silent --max-time 10 http://127.0.0.1:3018/api/health > /dev/null; do
+            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local CLI app exited during startup.'
+            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
+              fail_startup "Local CLI app did not become ready within $READY_TIMEOUT_SECONDS seconds."
+            sleep 2
+          done
+          echo "Local CLI app ready after $((SECONDS - started))s"
+          CLI_LATENCY_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+          CLI_LATENCY_E2E_DATABASE_URL="$DATABASE_URL" \
+          CLI_LATENCY_E2E_RUNS=3 \
+          CLI_LATENCY_E2E_WARMUP=1 \
+          CLI_LATENCY_E2E_REPORT_PATH="$report_dir/cli-run-latency-report.json" \
+            bun run test:cli-run-latency:e2e
+
       # A self-hosted app: hosted billing admits a run only through a Redis usage
       # reservation, and the SCIM suite above asserts PostgreSQL rate-limit storage,
       # so workflow execution gets its own app rather than adding Redis to that one.

apps/docs/content/docs/cli/logs.mdx

@@ -31,7 +31,7 @@ sim logs get <runId> [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
-| `--include-workflow-state` | No | Include the saved workflow snapshot (default: true). Set false to omit block configuration from a log read. Other run fields are unchanged. |
+| `--include-workflow-state` | No | Include the saved workflow snapshot (default: true; Sim’s in-app agent leaves it out unless this flag is passed). Set false to omit block configuration from a log read. Other run fields are unchanged. |
 | `--no-include-workflow-state` | No | Send --include-workflow-state as false. |
 | `--trace` | No | Show expanded trace spans with inputs, outputs, errors, timing, and cost. |
 

apps/docs/content/docs/cli/reference.mdx

@@ -2751,7 +2751,7 @@ sim logs get <runId> [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
-| `--include-workflow-state` | No | Include the saved workflow snapshot (default: true). Set false to omit block configuration from a log read. Other run fields are unchanged. |
+| `--include-workflow-state` | No | Include the saved workflow snapshot (default: true; Sim’s in-app agent leaves it out unless this flag is passed). Set false to omit block configuration from a log read. Other run fields are unchanged. |
 | `--no-include-workflow-state` | No | Send --include-workflow-state as false. |
 | `--trace` | No | Show expanded trace spans with inputs, outputs, errors, timing, and cost. |
 
@@ -6695,7 +6695,7 @@ sim workflows run <workflowId> [options]
 | `--async` | No | Queue the run and return immediately. |
 | `--execution-timeout-seconds <value>` | No | Maximum duration of an asynchronous run, in seconds, capped by the plan's execution timeout. Requires `async: true`; otherwise returns `400`. |
 | `--select-output <value...>` | No | Return blockName.path values (e.g. agent_1.content), or childWorkflowId.blockName.path for a child workflow (applies to every invocation) — in blockOutputs on a sync run, or from the streamed result with --follow; missing paths are omitted. Not available with --async (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
-| `--include-file-base64` | No | Inline eligible output files as base64 content. Rejected when `async` is true. |
+| `--include-file-base64` | No | Inline eligible output files as base64 content (default: true; Sim’s in-app agent gets file references only unless this flag is passed). Rejected when `async` is true. |
 | `--no-include-file-base64` | No | Send --include-file-base64 as false. |
 | `--base64-max-bytes <value>` | No | Maximum total bytes of file content to inline as base64, lowering but never raising the server limit of 16 MiB. Rejected when `async` is true. |
 | `--run-id <value>` | No | One-shot identifier for this run; NOT an idempotency key — reusing a claimed value fails with RUN_ID_CONFLICT instead of replaying the first result, and a fresh value starts another run. |

apps/docs/content/docs/cli/workflows.mdx

@@ -633,7 +633,7 @@ sim workflows run <workflowId> [options]
 | `--async` | No | Queue the run and return immediately. |
 | `--execution-timeout-seconds <value>` | No | Maximum duration of an asynchronous run, in seconds, capped by the plan's execution timeout. Requires `async: true`; otherwise returns `400`. |
 | `--select-output <value...>` | No | Return blockName.path values (e.g. agent_1.content), or childWorkflowId.blockName.path for a child workflow (applies to every invocation) — in blockOutputs on a sync run, or from the streamed result with --follow; missing paths are omitted. Not available with --async (space-separated, or @path / @- with one value per line; @@value for a literal leading @). |
-| `--include-file-base64` | No | Inline eligible output files as base64 content. Rejected when `async` is true. |
+| `--include-file-base64` | No | Inline eligible output files as base64 content (default: true; Sim’s in-app agent gets file references only unless this flag is passed). Rejected when `async` is true. |
 | `--no-include-file-base64` | No | Send --include-file-base64 as false. |
 | `--base64-max-bytes <value>` | No | Maximum total bytes of file content to inline as base64, lowering but never raising the server limit of 16 MiB. Rejected when `async` is true. |
 | `--run-id <value>` | No | One-shot identifier for this run; NOT an idempotency key — reusing a claimed value fails with RUN_ID_CONFLICT instead of replaying the first result, and a fresh value starts another run. |

apps/sim/lib/workflows/application/execute-manual-workflow.ts

@@ -10,7 +10,10 @@ import {
   executeWorkflowService,
 } from '@/lib/workflows/executor/execute-service'
 import { getExecutionStateForWorkflow } from '@/lib/workflows/executor/execution-state'
-import { loadWorkflowFromNormalizedTables } from '@/lib/workflows/persistence/utils'
+import {
+  loadWorkflowFromNormalizedTables,
+  type NormalizedWorkflowData,
+} from '@/lib/workflows/persistence/utils'
 import {
   resolveTriggerRunOptions,
   validateTriggerInput,
@@ -119,6 +122,7 @@ function executionServiceInput(params: {
   principal: WorkflowExecutionPrincipal
   context: Awaited<ReturnType<typeof resolveActiveWorkflowApplicationContext>>
   input: ManualExecutionInput
+  draftState: NormalizedWorkflowData
 }) {
   return {
     workflowId: params.context.workflowId,
@@ -141,6 +145,7 @@ function executionServiceInput(params: {
     includeToolCalls: params.input.includeToolCalls,
     triggerType: 'manual' as const,
     useDraftState: true,
+    draftState: params.draftState,
   }
 }
 
@@ -189,7 +194,7 @@ export const executeManualWorkflowOperation = defineAuthorizedWorkflowUseCase({
     }
 
     return executeWorkflowService({
-      ...executionServiceInput({ principal, context, input }),
+      ...executionServiceInput({ principal, context, input, draftState: state }),
       input: executionInput,
       triggerBlockId: selected.triggerBlockId,
     })
@@ -218,7 +223,7 @@ export const executeManualWorkflowFromBlockOperation = defineAuthorizedWorkflowU
     }
 
     return executeWorkflowService({
-      ...executionServiceInput({ principal, context, input }),
+      ...executionServiceInput({ principal, context, input, draftState: state }),
       input: input.input,
       runFromBlock: {
         startBlockId: input.blockId,

apps/sim/lib/workflows/executor/execute-service.ts

@@ -30,6 +30,7 @@ import {
   loadDeployedWorkflowState,
   loadWorkflowDeploymentVersionState,
   loadWorkflowFromNormalizedTables,
+  type NormalizedWorkflowData,
 } from '@/lib/workflows/persistence/utils'
 import { shouldEmitAgentStreamEvents } from '@/lib/workflows/streaming/agent-stream-protocol'
 import { resolveOutputSelectors } from '@/lib/workflows/streaming/resolve-output-selectors'
@@ -110,6 +111,12 @@ export interface ExecuteWorkflowServiceParams {
   includeToolCalls?: boolean
   /** Execute the current saved state manually instead of the active deployment. */
   useDraftState?: boolean
+  /**
+   * The saved state the application use case loaded to choose and validate the entry
+   * point. Requires `useDraftState`; the run executes this same snapshot instead of
+   * reading the draft tables again.
+   */
+  draftState?: NormalizedWorkflowData
   /** Explicit trigger entry point selected and validated by the application use case. */
   triggerBlockId?: string
   /** Trusted prior-run snapshot resolved by the application use case. */
@@ -272,6 +279,7 @@ export async function executeWorkflowService(
     includeThinking = false,
     includeToolCalls = false,
     useDraftState = false,
+    draftState,
     triggerBlockId,
     runFromBlock,
     stopAfterBlockId,
@@ -295,6 +303,9 @@ export async function executeWorkflowService(
   if (stopAfterBlockId && !useDraftState) {
     throw new Error('Stop-after-block requires manual execution state')
   }
+  if (draftState && !useDraftState) {
+    throw new Error('A preloaded draft state requires manual execution state')
+  }
 
   if (callChain) {
     const chainError = validateCallChain(callChain)
@@ -467,7 +478,7 @@ export async function executeWorkflowService(
     let workflowBlocks: Record<string, unknown> = {}
     try {
       const workflowData = useDraftState
-        ? await loadWorkflowFromNormalizedTables(workflowId)
+        ? (draftState ?? (await loadWorkflowFromNormalizedTables(workflowId)))
         : deploymentVersionId
           ? await loadWorkflowDeploymentVersionState(workflowId, deploymentVersionId, workspaceId)
           : await loadDeployedWorkflowState(workflowId, workspaceId)
@@ -594,6 +605,7 @@ export async function executeWorkflowService(
               workflowTriggerType: triggerType,
               triggerBlockId,
               useDraftState,
+              draftState,
               runFromBlock,
               stopAfterBlockId,
               onStream,
@@ -697,6 +709,7 @@ export async function executeWorkflowService(
           abortSignal: timeoutController.signal,
           runFromBlock,
           stopAfterBlockId,
+          draftState,
         })
 
         await handlePostExecutionPauseState({ result, workflowId, executionId, loggingSession })

apps/sim/lib/workflows/executor/execute-workflow.ts

@@ -11,6 +11,7 @@ import { LoggingSession } from '@/lib/logs/execution/logging-session'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { executeWorkflowCore } from '@/lib/workflows/executor/execution-core'
 import { handlePostExecutionPauseState } from '@/lib/workflows/executor/pause-persistence'
+import type { NormalizedWorkflowData } from '@/lib/workflows/persistence/utils'
 import { ExecutionSnapshot } from '@/executor/execution/snapshot'
 import type {
   BlockCompletionCallbackData,
@@ -54,6 +55,8 @@ export interface ExecuteWorkflowOptions {
   abortSignal?: AbortSignal
   /** Use the live/draft workflow state instead of the deployed state. Used by copilot. */
   useDraftState?: boolean
+  /** Draft state the caller already loaded, reused instead of reading the draft tables again. */
+  draftState?: NormalizedWorkflowData
   /** Immutable workflow state selected by a trusted server-side trigger boundary. */
   workflowStateOverride?: NonNullable<ExecutionMetadata['workflowStateOverride']>
   /** Stop execution after this block completes. Used for "run until block" feature. */
@@ -226,6 +229,7 @@ export async function executeWorkflow(
       trustedInitialResolvedSecretTraceProvenance:
         streamConfig?.trustedInitialResolvedSecretTraceProvenance,
       runFromBlock: streamConfig?.runFromBlock,
+      draftState: streamConfig?.draftState,
     }))
 
     const blockTypes = [

apps/sim/lib/workflows/executor/execution-core.ts

@@ -43,6 +43,7 @@ import {
   loadDeployedWorkflowState,
   loadWorkflowDeploymentVersionState,
   loadWorkflowFromNormalizedTables,
+  type NormalizedWorkflowData,
 } from '@/lib/workflows/persistence/utils'
 import { TriggerUtils } from '@/lib/workflows/triggers/triggers'
 import { updateWorkflowRunCounts } from '@/lib/workflows/utils'
@@ -143,6 +144,12 @@ export interface ExecuteWorkflowCoreOptions {
   trustedInitialResolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceV1
   /** Immutable deployment admitted by the durable parent log for a resumed execution. */
   resumeDeploymentVersionId?: string
+  /**
+   * Draft state the caller already loaded for this draft-state run. Reused instead of
+   * reading the draft tables again, so the graph that executes is the snapshot the
+   * caller validated its trigger and output selectors against.
+   */
+  draftState?: NormalizedWorkflowData
   /**
    * Environment the caller already resolved for this run, reused instead of loading
    * and decrypting it again. Used only when it was resolved for exactly the
@@ -627,6 +634,7 @@ async function executeWorkflowCoreImpl(
     stopAfterBlockId,
     runFromBlock,
     resumeDeploymentVersionId,
+    draftState,
   } = options
   loggingSession.setExecutionDeadlineAt(getExecutionDeadlineAt(abortSignal))
   const { metadata, input, workflowVariables, selectedOutputs } = snapshot
@@ -721,7 +729,7 @@ async function executeWorkflowCoreImpl(
       }
 
       if (useDraftState) {
-        const draftData = await loadWorkflowFromNormalizedTables(workflowId)
+        const draftData = draftState ?? (await loadWorkflowFromNormalizedTables(workflowId))
 
         if (!draftData) {
           throw new Error('Workflow not found or not yet saved')

apps/sim/package.json

@@ -25,6 +25,7 @@
     "test:workflow-version-compare:e2e": "bun --no-env-file scripts/test-workflow-version-compare-e2e.ts",
     "test:workflow-stop-after:e2e": "bun --no-env-file scripts/test-workflow-stop-after-e2e.ts",
     "test:desktop-inbox:e2e": "bun --no-env-file scripts/test-desktop-inbox-e2e.ts",
+    "test:cli-run-latency:e2e": "bun --no-env-file scripts/test-cli-run-latency-e2e.ts",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "email:dev": "email dev --dir components/emails",