fix(mothership): bound browser-run workflow logs and keep the pointer length-blind

run_workflow can complete in the browser, and that restoration projected the
raw block logs, so a large browser-run workflow was still withheld. The
block-log compaction now lives in the shared workflow-output module and applies
to both the server handler and the client restoration when no `select` is
given. `select` still reads full values.

The omitted-output pointer no longer reports bytes. They were measured before
secret projection and so disclosed a secret's length. It reports the value
count and says "inspect with logs get" rather than promising the full value.

One `measureModelContent` in the projection module now serves both the
compaction and the withheld-size logging. It stops counting at the value cap
and tolerates values JSON cannot encode. The byte cap is exported beside
`MAX_CONTENT_NODES`.

Author: waleedlatif1

apps/sim/executor/utils/resolved-secret-content-projection.ts

@@ -25,6 +25,8 @@ export {
 
 /** Values one model-content projection will walk before refusing the whole payload. */
 export const MAX_CONTENT_NODES = 100_000
+/** Encoded bytes a model-content projection accepts by default before refusing the payload. */
+export const MAX_MODEL_CONTENT_BYTES = MAX_INLINE_MATERIALIZATION_BYTES
 const MAX_CONTENT_DEPTH = 100
 const INTERNAL_DIAGNOSTIC_IDENTIFIER_PATTERN =
   /__var_[A-Za-z0-9_]+|__sim_code_\d+_(?:binding|input|runtime)_\d+[A-Za-z0-9_]*|__sim_placeholder_[a-f0-9]{64}__|__sim_runtime_[A-Za-z0-9_]+_\d+[A-Za-z0-9_]*|__SIM_RUNTIME_PAYLOAD_PATH/g
@@ -352,12 +354,41 @@ function projectContent(
 export function projectResolvedSecretContent(
   value: unknown,
   matcher: ResolvedSecretMatcher,
-  maxBytes = MAX_INLINE_MATERIALIZATION_BYTES,
+  maxBytes = MAX_MODEL_CONTENT_BYTES,
   options: ResolvedSecretContentProjectionOptions = {}
 ): ResolvedSecretContentProjection {
   return projectContent(value, matcher, maxBytes, options)
 }
 
+/** Size of a value as the model-content projection sees it, for budgeting and diagnostics. */
+export interface ModelContentMeasure {
+  /** Values walked, stopping at `MAX_CONTENT_NODES + 1`: past the cap the exact count is moot. */
+  values: number
+  /** Encoded bytes; absent when counting stopped at the value cap. */
+  bytes?: number
+}
+
+class ModelContentMeasureLimit extends Error {}
+
+/**
+ * Measures a value in the units the projection caps, without walking past the value cap: a
+ * payload that is already over it is reported as over rather than serialized in full. Returns
+ * undefined for a value JSON cannot encode (a BigInt, a cycle), which the projection refuses too.
+ */
+export function measureModelContent(value: unknown): ModelContentMeasure | undefined {
+  let values = 0
+  try {
+    const encoded = JSON.stringify(value, (_key, item: unknown) => {
+      values += 1
+      if (values > MAX_CONTENT_NODES) throw new ModelContentMeasureLimit()
+      return item
+    })
+    return { values, bytes: encoded === undefined ? 0 : Buffer.byteLength(encoded, 'utf8') }
+  } catch (error) {
+    return error instanceof ModelContentMeasureLimit ? { values } : undefined
+  }
+}
+
 /** Returns the registry-revision-cached matcher used for all model-visible projection. */
 export function getResolvedSecretModelMatcher(
   registry: ResolvedSecretTraceRegistry | undefined
@@ -397,7 +428,7 @@ export function getResolvedSecretModelMatcher(
 export function projectResolvedSecretModelContent(
   value: unknown,
   registry: ResolvedSecretTraceRegistry | undefined,
-  maxBytes = MAX_INLINE_MATERIALIZATION_BYTES,
+  maxBytes = MAX_MODEL_CONTENT_BYTES,
   options: ResolvedSecretContentProjectionOptions = {}
 ): ResolvedSecretContentProjection {
   const snapshot = getResolvedSecretModelMatcher(registry)
@@ -420,7 +451,7 @@ export function projectResolvedSecretModelContent(
 export function projectResolvedSecretModelJsonContent(
   value: unknown,
   registry: ResolvedSecretTraceRegistry | undefined,
-  maxBytes = MAX_INLINE_MATERIALIZATION_BYTES,
+  maxBytes = MAX_MODEL_CONTENT_BYTES,
   options: ResolvedSecretContentProjectionOptions = {}
 ): ResolvedSecretContentProjection {
   const snapshot = getResolvedSecretModelMatcher(registry)
@@ -456,7 +487,7 @@ export function projectResolvedSecretModelJsonContent(
 export function projectResolvedSecretDiagnosticContent(
   value: unknown,
   registry: ResolvedSecretTraceRegistry | undefined,
-  maxBytes = MAX_INLINE_MATERIALIZATION_BYTES
+  maxBytes = MAX_MODEL_CONTENT_BYTES
 ): ResolvedSecretContentProjection {
   return projectResolvedSecretModelContent(value, registry, maxBytes, {
     sanitizeInternalIdentifiers: true,
@@ -510,7 +541,7 @@ export function isResolvedSecretModelContentUnchanged(
   if (!snapshot.complete) return false
   if (!snapshot.matcher) return true
 
-  const projection = projectContent(value, snapshot.matcher, MAX_INLINE_MATERIALIZATION_BYTES, {
+  const projection = projectContent(value, snapshot.matcher, MAX_MODEL_CONTENT_BYTES, {
     projectPrimitiveLiterals: true,
     rejectResolvedSecretLiterals: true,
   })
@@ -524,7 +555,7 @@ export function isResolvedSecretModelContentUnchanged(
 export function projectResolvedSecretModelJsonStrings(
   values: readonly (string | undefined)[],
   registry: ResolvedSecretTraceRegistry | undefined,
-  maxBytes = MAX_INLINE_MATERIALIZATION_BYTES
+  maxBytes = MAX_MODEL_CONTENT_BYTES
 ): ResolvedSecretContentProjection {
   const snapshot = getResolvedSecretModelMatcher(registry)
   if (!snapshot.complete) return { safe: false }

apps/sim/lib/mothership/request/tools/client.test.ts

@@ -202,6 +202,51 @@ describe('workflow client tool completion', () => {
     )
   })
 
+  /**
+   * A browser-run workflow reaches the model through this restoration, not the server handler, so
+   * it needs the same block-log budget: a synthetic run whose block outputs exceed the projection's
+   * traversal cap would otherwise be withheld whole once a secret is active.
+   */
+  it('bounds bulky block-log outputs so a large browser run still projects', async () => {
+    const rows = (count: number) =>
+      Array.from({ length: count }, (_, index) => ({
+        id: `row_${index}`,
+        data: { a: 'x', b: 'y', c: 'z', d: 'w' },
+      }))
+    getTrustedWorkflowToolExecution.mockResolvedValue({
+      ...trustedExecution('execution-1'),
+      blockLogs: [
+        { blockId: 'small', blockName: 'Small', output: { count: 1 } },
+        ...Array.from({ length: 4 }, (_, index) => ({
+          blockId: `query-${index}`,
+          blockName: `Query ${index}`,
+          output: { rows: rows(5_000) },
+        })),
+      ],
+    })
+    waitForToolConfirmation.mockResolvedValue({
+      status: 'success',
+      data: { workflowId: 'workflow-1', executionId: 'execution-1' },
+    })
+
+    const completion = await waitForWorkflowToolCompletion({
+      toolCallId: 'tool-1',
+      workflowId: 'workflow-1',
+      timeoutMs: 1_000,
+      registry: createParentRegistry(),
+    })
+
+    const data = completion?.data as Record<string, unknown>
+    expect(data.output).toEqual({ value: 'child read {{PARENT_SECRET}} from execution-1' })
+    const logs = data.logs as Array<Record<string, unknown>>
+    expect(logs[0]?.output).toEqual({ count: 1 })
+    expect(logs.some((log) => typeof log.output === 'string')).toBe(true)
+    for (const log of logs.filter((entry) => typeof entry.output === 'string')) {
+      expect(log.output).toContain('logs get execution-1 --trace')
+    }
+    expect(JSON.stringify(completion)).not.toContain('parent-secret-value')
+  })
+
   it('preserves the server-confirmed status while omitting unavailable execution content', async () => {
     const registry = createParentRegistry()
     waitForToolConfirmation.mockResolvedValue({

apps/sim/lib/mothership/request/tools/client.ts

@@ -15,7 +15,7 @@ import {
   unsealClientToolContext,
 } from '@/lib/mothership/request/tools/client-completion-seal.server'
 import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
-import { presentWorkflowLogs } from '@/lib/mothership/tools/workflow-output'
+import { compactBlockLogOutputs, presentWorkflowLogs } from '@/lib/mothership/tools/workflow-output'
 import {
   createStructuralWorkflowToolCompletionData,
   getWorkflowToolCompletionExecutionId,
@@ -376,7 +376,10 @@ export async function waitForWorkflowToolCompletion({
     ...(Object.hasOwn(trustedExecution, 'finalOutput')
       ? { output: trustedExecution.finalOutput }
       : {}),
-    logs: trustedExecution.blockLogs,
+    // `select` reads full values from these logs; only logs echoed whole are bounded.
+    logs: select?.length
+      ? trustedExecution.blockLogs
+      : compactBlockLogOutputs(trustedExecution.blockLogs, executionId),
     ...(trustedExecution.error !== undefined ? { error: trustedExecution.error } : {}),
     ...(status === MothershipStreamV1ToolOutcome.cancelled
       ? { reason: 'user_cancelled', cancelledByUser: true }

apps/sim/lib/mothership/request/tools/resolved-secret-result.ts

@@ -1,6 +1,9 @@
 import type { ToolCallEffect, ToolExecutionResult } from '@/lib/mothership/tool-executor/types'
 import { TOOL_EFFECT_PHASE } from '@/lib/mothership/tool-executor/types'
-import { projectResolvedSecretModelJsonContent } from '@/executor/utils/resolved-secret-content-projection'
+import {
+  measureModelContent,
+  projectResolvedSecretModelJsonContent,
+} from '@/executor/utils/resolved-secret-content-projection'
 import type {
   ResolvedSecretIncompletenessReason,
   ResolvedSecretTraceRegistry,
@@ -259,26 +262,19 @@ export function projectToolErrorMessageForCopilot(
  * Sizes the content a withheld result would have carried, for the log line only.
  *
  * A complete registry can still refuse content by its encoded size or by the number of values the
- * projection must walk (its node cap is reached well before the byte cap by row-shaped payloads).
- * Both measures are reported so a `content-refused` line names which one it hit. Numbers only:
- * the content itself never reaches the log.
+ * projection must walk (its value cap is reached well before the byte cap by row-shaped payloads).
+ * Both measures are reported so a `content-refused` line names which one it hit; counting stops
+ * at the value cap, so a huge payload is not serialized again just to be logged. Numbers only.
  */
 export function measureWithheldContent(result: ToolExecutionResult): {
   resultBytes?: number
   resultValues?: number
 } {
-  try {
-    let values = 0
-    const encoded = JSON.stringify(
-      { output: result.output, error: result.error },
-      (_key, value) => {
-        values += 1
-        return value
-      }
-    )
-    return { resultBytes: Buffer.byteLength(encoded, 'utf8'), resultValues: values }
-  } catch {
-    return {}
+  const measure = measureModelContent({ output: result.output, error: result.error })
+  if (!measure) return {}
+  return {
+    resultValues: measure.values,
+    ...(measure.bytes !== undefined ? { resultBytes: measure.bytes } : {}),
   }
 }
 

apps/sim/lib/mothership/tools/handlers/function-execute-file-mounts.test.ts

@@ -250,7 +250,17 @@ describe('Mothership file mounts bind content and classification to the same rec
           safe: true,
           provenance: {
             status: 'exact',
-            entries: kind === 'secret' ? [expect.objectContaining({})] : [],
+            // A mounted file's secret crosses anonymously: its ciphertext binds it, not a name.
+            entries:
+              kind === 'secret'
+                ? [
+                    {
+                      encryptedValue: 'fixture-ciphertext',
+                      sourceUserId: 'reader',
+                      sourceWorkspaceId: 'workspace',
+                    },
+                  ]
+                : [],
           },
         })
       }

apps/sim/lib/mothership/tools/handlers/workflow/mutations.ts

@@ -2,7 +2,6 @@ import { createLogger } from '@sim/logger'
 import { filterUndefined, isPlainRecord, isRecordLike } from '@sim/utils/object'
 import { createCopilotWorkspaceApiKey } from '@/lib/api-key/application/create-api-key'
 import { PlatformEvents } from '@/lib/core/telemetry'
-import { MAX_INLINE_MATERIALIZATION_BYTES } from '@/lib/execution/payloads/limits'
 import { messageForCopilotApplicationError } from '@/lib/mothership/application/error'
 import { executeCopilotApiKeyUseCase } from '@/lib/mothership/application/execute-api-key-use-case'
 import {
@@ -30,7 +29,11 @@ import type {
   VariableOperation,
 } from '@/lib/mothership/tools/handlers/param-types'
 import { requireCopilotWorkspace } from '@/lib/mothership/tools/server/workspace-scope'
-import { presentWorkflowLogs } from '@/lib/mothership/tools/workflow-output'
+import {
+  compactBlockLogInputs,
+  compactBlockLogOutputs,
+  presentWorkflowLogs,
+} from '@/lib/mothership/tools/workflow-output'
 import { decodeVfsPathSegments, encodeVfsPathSegments } from '@/lib/mothership/vfs/path-utils'
 import { cancelWorkflowRun } from '@/lib/workflows/application/cancel-run'
 import { createWorkflow } from '@/lib/workflows/application/create-workflow'
@@ -48,101 +51,10 @@ import {
 } from '@/lib/workflows/application/update-workflow-content'
 import { sanitizeForCopilot } from '@/lib/workflows/sanitization/json-sanitizer'
 import { hasExecutionResult, readAttemptedExecutionId } from '@/executor/utils/errors'
-import { MAX_CONTENT_NODES } from '@/executor/utils/resolved-secret-content-projection'
 import type { WorkflowState } from '@/stores/workflows/workflow/types'
 
 const logger = createLogger('WorkflowMutations')
 
-/** Above this a Function block's `input.code` is echoed upstream JSON, not code worth reading. */
-const LOG_CODE_INPUT_MAX_CHARS = 240
-/** Any other echoed input string over this is data the caller already has, or can fetch. */
-const LOG_INPUT_STRING_MAX_CHARS = 2_000
-const LOG_INPUT_KEEP_CHARS = 200
-
-/**
- * Compacts the block inputs echoed back in `logs`. A Function block's `input.code` embeds the
- * fully serialized upstream rows, so a seven-block run repeated the same rows several times
- * across ~14k chars of tool result. Outputs are bounded separately by {@link compactBlockLogOutputs},
- * and the full input stays one `logs get <executionId> --trace` away.
- */
-function compactBlockLogInputs(logs: unknown, executionId: string | undefined): unknown {
-  if (!Array.isArray(logs)) return logs
-  const reference = executionId ?? '<executionId>'
-  return logs.map((entry) => {
-    if (!isPlainRecord(entry) || !isPlainRecord(entry.input)) return entry
-    const input: Record<string, unknown> = {}
-    for (const [key, value] of Object.entries(entry.input)) {
-      const limit = key === 'code' ? LOG_CODE_INPUT_MAX_CHARS : LOG_INPUT_STRING_MAX_CHARS
-      input[key] =
-        typeof value === 'string' && value.length > limit
-          ? `${value.slice(0, LOG_INPUT_KEEP_CHARS)} …[${value.length} chars, see logs get ${reference} --trace]`
-          : value
-    }
-    return { ...entry, input }
-  })
-}
-
-/**
- * Budgets for the block outputs echoed back in `logs`, a quarter of each cap the model-facing
- * projection enforces on the whole result. Reaching either cap withholds everything, including
- * the final output and error the run was for; those stay intact here and share the remaining
- * three quarters with the rest of the envelope. The value budget matters first: row-shaped
- * outputs reach the projection's traversal cap long before its byte cap.
- */
-const LOG_OUTPUT_VALUE_BUDGET = Math.floor(MAX_CONTENT_NODES / 4)
-const LOG_OUTPUT_BYTE_BUDGET = Math.floor(MAX_INLINE_MATERIALIZATION_BYTES / 4)
-
-/** Counts values the way the projection walks them, and the bytes they encode to. */
-function measureLogOutput(value: unknown): { values: number; bytes: number } {
-  let values = 0
-  const encoded = JSON.stringify(value, (_key, item) => {
-    values += 1
-    return item
-  })
-  return { values, bytes: encoded === undefined ? 0 : Buffer.byteLength(encoded, 'utf8') }
-}
-
-/**
- * Replaces the bulkiest block outputs in `logs` with a pointer once they exceed the budgets
- * above, largest first, so the rest of the run still reaches the model. The full outputs stay in
- * the run's archived trace, one `logs get <executionId> --trace` away, matching how
- * {@link compactBlockLogInputs} treats oversized inputs.
- */
-function compactBlockLogOutputs(logs: unknown, executionId: string | undefined): unknown {
-  if (!Array.isArray(logs)) return logs
-  const reference = executionId ?? '<executionId>'
-  const sizes = logs.map((entry) =>
-    isPlainRecord(entry) && entry.output !== undefined ? measureLogOutput(entry.output) : undefined
-  )
-  let values = 0
-  let bytes = 0
-  for (const size of sizes) {
-    values += size?.values ?? 0
-    bytes += size?.bytes ?? 0
-  }
-  if (values <= LOG_OUTPUT_VALUE_BUDGET && bytes <= LOG_OUTPUT_BYTE_BUDGET) return logs
-
-  const compacted = [...logs]
-  const bulkiestFirst = sizes
-    .map((size, index) => ({ size, index }))
-    .filter((entry): entry is { size: { values: number; bytes: number }; index: number } =>
-      Boolean(entry.size)
-    )
-    .sort(
-      (left, right) => right.size.values - left.size.values || right.size.bytes - left.size.bytes
-    )
-  for (const { size, index } of bulkiestFirst) {
-    if (values <= LOG_OUTPUT_VALUE_BUDGET && bytes <= LOG_OUTPUT_BYTE_BUDGET) break
-    compacted[index] = {
-      ...(logs[index] as Record<string, unknown>),
-      output: `…[output omitted: ${size.values} values, ${size.bytes} bytes; see logs get ${reference} --trace]`,
-    }
-    values -= size.values
-    bytes -= size.bytes
-  }
-  return compacted
-}
-
 function stripBinaryFields(value: unknown): unknown {
   if (value === null || value === undefined) return value
   if (typeof value !== 'object') return value