fix(logs): keep trusted ids beside projected diagnostics and dedupe resumes on the parent run

The resume and child failure lines keep their execution, block, and resume
ids outside the secret projection, which drops everything when it fails
closed. Resumed runs execute under the parent's execution id, so the resume
boundaries dedupe on it; a 4xx resume admission refusal is the caller's. The
tool failure line names the credential selected after normalization.

Author: waleedlatif1

apps/sim/background/resume-execution.test.ts

@@ -94,10 +94,10 @@ describe('executeResumeJob terminal errors', () => {
 
     await expect(executeResumeJob(payload)).rejects.toBe(rawError)
 
-    expect(resumeExecutionLogger.error).toHaveBeenCalledWith('Background resume execution failed', {
-      errorType: 'error',
-      hasStack: true,
-    })
+    expect(resumeExecutionLogger.error).toHaveBeenCalledWith(
+      'Background resume execution failed',
+      expect.objectContaining({ errorType: 'error', hasStack: true })
+    )
     const loggerPayload = JSON.stringify(resumeExecutionLogger.error.mock.calls)
     expect(loggerPayload).not.toContain(secret)
     expect(loggerPayload).not.toContain('__var_')

apps/sim/background/resume-execution.ts

@@ -249,9 +249,14 @@ export async function executeResumeJob(payload: ResumeExecutionPayload, signal?:
       executedAt: new Date().toISOString(),
     }
   } catch (error) {
+    /** The resumed run executes under its parent's execution id, so dedupe on that one. */
     logFailureOnce(logger, 'Background resume execution failed', error, {
-      metadata: () => projectResolvedSecretDiagnosticError(error, undefined, { workflowId }),
-      executionId: resumeExecutionId,
+      metadata: () => ({
+        resumeExecutionId,
+        workflowId,
+        ...projectResolvedSecretDiagnosticError(error, undefined),
+      }),
+      executionId: parentExecutionId,
     })
     throw error
   } finally {

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -1575,14 +1575,12 @@ export class WorkflowBlockHandler implements BlockHandler {
 
     if (!success) {
       const rootErrorMessage = childResult.error || 'Child workflow execution failed'
-      logger.warn(
-        `Child workflow ${childWorkflowName} failed`,
-        projectResolvedSecretDiagnosticError(rootErrorMessage, parent?.registry, {
-          executionId: parent?.executionId,
-          blockId: parent?.blockId,
-          childExecutionId: parent?.childExecutionId,
-        })
-      )
+      logger.warn(`Child workflow ${childWorkflowName} failed`, {
+        executionId: parent?.executionId,
+        blockId: parent?.blockId,
+        childExecutionId: parent?.childExecutionId,
+        ...projectResolvedSecretDiagnosticError(rootErrorMessage, parent?.registry),
+      })
       const chain = [childWorkflowName]
       const childFailure = new ChildWorkflowError({
         message: formatWorkflowChainMessage(chain, rootErrorMessage),

apps/sim/lib/workflows/executor/human-in-the-loop-manager.test.ts

@@ -486,10 +486,10 @@ describe('resume failure diagnostic projection', () => {
         })
       ).rejects.toBe(rawError)
 
-      expect(humanInTheLoopLogger.error).toHaveBeenCalledWith('Resume execution failed', {
-        errorType: 'error',
-        hasStack: true,
-      })
+      expect(humanInTheLoopLogger.error).toHaveBeenCalledWith(
+        'Resume execution failed',
+        expect.objectContaining({ errorType: 'error', hasStack: true })
+      )
       const loggerPayload = JSON.stringify(humanInTheLoopLogger.error.mock.calls)
       expect(loggerPayload).not.toContain(secret)
       expect(loggerPayload).not.toContain('__var_')

apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts

@@ -8,7 +8,7 @@ import type { Edge } from '@xyflow/react'
 import { and, asc, desc, eq, inArray, lt, type SQL, sql } from 'drizzle-orm'
 import { releaseExecutionSlot } from '@/lib/billing/calculations/usage-reservation'
 import { assertBillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
-import { logFailureOnce } from '@/lib/core/errors/failure-log'
+import { logFailureOnce, markFailureKind } from '@/lib/core/errors/failure-log'
 import {
   createTimeoutAbortController,
   getAsyncExecutionTimeoutForBillingAttribution,
@@ -1055,13 +1055,18 @@ export class PauseResumeManager {
           )
         })
       }
+      /** A refusal to admit the resume (already resumed, not paused) is the caller's, not Sim's. */
+      if (error instanceof ResumeAdmissionError && error.statusCode < 500) {
+        markFailureKind(error, 'user')
+      }
+      /** The resumed run executes under its parent's execution id, so dedupe on that one. */
       logFailureOnce(logger, 'Resume execution failed', error, {
-        metadata: () =>
-          projectResolvedSecretDiagnosticError(error, undefined, {
-            parentExecutionId: pausedExecution.executionId,
-            contextId,
-          }),
-        executionId: resumeExecutionId,
+        metadata: () => ({
+          resumeExecutionId,
+          contextId,
+          ...projectResolvedSecretDiagnosticError(error, undefined),
+        }),
+        executionId: pausedExecution.executionId,
       })
       if (!(error instanceof ResumeAdmissionError)) {
         await PauseResumeManager.processQueuedResumes(

apps/sim/tools/index.ts

@@ -1710,6 +1710,8 @@ async function executeToolImplementation(
 
   // Hoisted so the outer catch can attribute a thrown failure to the chosen key.
   let hostedKeyForMetrics: { provider: string; tool: string; key: string } | undefined
+  /** Hoisted so the outer catch names the account selected after normalization. */
+  let selectedCredentialId: string | undefined
   let completePendingSecretActivation: (() => void) | undefined
 
   try {
@@ -1890,6 +1892,7 @@ async function executeToolImplementation(
       const workflowId = scope.workflowId
       const userId = scope.userId
       const credentialId = contextParams.credential as string
+      selectedCredentialId = credentialId
       const toolLabel = tool?.name || toolId
       const impersonateEmail = contextParams.impersonateUserEmail as string | undefined
 
@@ -2321,7 +2324,7 @@ async function executeToolImplementation(
         workflowId: executionContext?.workflowId ?? undefined,
         executionId: executionContext?.executionId,
         blockId: typeof toolContext.blockId === 'string' ? toolContext.blockId : undefined,
-        credentialId: typeof params.credential === 'string' ? params.credential : undefined,
+        credentialId: selectedCredentialId,
         ...(typeof upstreamStatus === 'number' ? { status: upstreamStatus } : {}),
         ...projectToolLogMetadata(
           {