feat(logs): allow omitting workflow snapshots from diagnostic reads

Author: waleedlatif1

apps/docs/content/docs/cli/logs.mdx

@@ -31,6 +31,8 @@ sim logs get <runId> [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
+| `--include-workflow-state` | No | Include the saved workflow snapshot. Set false to omit block configuration from a log read. Other run fields are unchanged. |
+| `--no-include-workflow-state` | No | Send --include-workflow-state as false. |
 | `--trace` | No | Show expanded trace spans with inputs, outputs, errors, timing, and cost. |
 
 </CommandTable>

apps/docs/content/docs/cli/reference.mdx

@@ -2731,6 +2731,8 @@ sim logs get <runId> [options]
 
 | Option | Required | Description |
 | --- | --- | --- |
+| `--include-workflow-state` | No | Include the saved workflow snapshot. Set false to omit block configuration from a log read. Other run fields are unchanged. |
+| `--no-include-workflow-state` | No | Send --include-workflow-state as false. |
 | `--trace` | No | Show expanded trace spans with inputs, outputs, errors, timing, and cost. |
 
 </CommandTable>

apps/docs/openapi-v2-logs.json

@@ -383,6 +383,16 @@
               "pattern": "^[A-Za-z0-9._:-]+$",
               "description": "Unique workflow run identifier."
             }
+          },
+          {
+            "name": "includeWorkflowState",
+            "in": "query",
+            "required": false,
+            "description": "Include the saved workflow snapshot. Set false to omit block configuration from a log read. Other run fields are unchanged.",
+            "schema": {
+              "description": "Include the saved workflow snapshot. Set false to omit block configuration from a log read. Other run fields are unchanged.",
+              "type": "boolean"
+            }
           }
         ],
         "responses": {
@@ -1602,7 +1612,7 @@
                 "type": "null"
               }
             ],
-            "description": "Workflow graph captured for the run, or null if unavailable. Sensitive values are redacted to null; environment-variable references may be preserved."
+            "description": "Workflow graph captured for the run, or null if unavailable or includeWorkflowState=false. Sensitive values are redacted to null; environment-variable references may be preserved."
           },
           "traceSpans": {
             "type": "array",

apps/sim/app/api/v2/logs/[runId]/route.test.ts

@@ -99,7 +99,7 @@ describe('GET /api/v2/logs/[runId]', () => {
     expect(body.data).not.toHaveProperty('executionData')
     expect(mocks.execute).toHaveBeenCalledWith({
       principal: auth.principal,
-      input: { runId: 'run-1' },
+      input: { runId: 'run-1', includeWorkflowState: true },
       request,
     })
   })

apps/sim/app/api/v2/logs/[runId]/route.ts

@@ -36,7 +36,10 @@ export const GET = defineV2JsonRoute({
   operation: logOperations.readDetail,
   rateLimit: v2RateLimits.publicApi,
   errorPolicy: v2LogErrorPolicies.concealDetailAuthorization,
-  mapInput: ({ params }) => ({ runId: params.runId }),
+  mapInput: ({ params, query }) => ({
+    runId: params.runId,
+    includeWorkflowState: query.includeWorkflowState,
+  }),
   useCase: getPublicLog,
   present: ({ log, workflowFolderPath, executionData, costLedger }) => {
     const detail: V2LogDetail = {

apps/sim/lib/api/contracts/v2/logs.ts

@@ -2,7 +2,6 @@ import { z } from 'zod'
 import { traceSpansSchema } from '@/lib/api/contracts/logs'
 import {
   booleanQueryFlagSchema,
-  noInputSchema,
   runIdSchema,
   workspaceIdSchema,
 } from '@/lib/api/contracts/primitives'
@@ -24,9 +23,8 @@ import { v2RunFileSchema } from '@/lib/api/contracts/v2/workflows'
 import { PERSISTED_WORKFLOW_EXECUTION_STATUSES } from '@/lib/logs/types'
 
 /**
- * v2 logs contracts. The query schemas are reused verbatim from v1 (the request
- * shape is unchanged); only the response envelope is upgraded to the canonical
- * v2 shapes with concrete item schemas.
+ * v2 logs contracts. List queries retain the v1 filters; responses use the
+ * canonical v2 envelope and concrete item schemas.
  */
 
 const v2LogCostSchema = z
@@ -164,7 +162,7 @@ const v2LogWorkflowStateSchema = z
   )
   .nullable()
   .describe(
-    'Workflow graph captured for the run, or null if unavailable. Sensitive values are redacted to null; environment-variable references may be preserved.'
+    'Workflow graph captured for the run, or null if unavailable or includeWorkflowState=false. Sensitive values are redacted to null; environment-variable references may be preserved.'
   )
 
 const v2LogWorkflowSummarySchema = z.object({
@@ -717,7 +715,21 @@ export const v2ListLogsContract = defineRouteContract({
 export const v2GetLogContract = defineRouteContract({
   method: 'GET',
   path: '/api/v2/logs/[runId]',
-  query: noInputSchema,
+  query: z
+    .object({
+      includeWorkflowState: booleanQueryFlagSchema
+        .default(true)
+        .describe(
+          'Include the saved workflow snapshot. Set false to omit block configuration from a log read. Other run fields are unchanged.'
+        ),
+    })
+    .strict()
+    .meta({
+      id: 'GetLogQuery',
+      title: 'Execution log detail options',
+      description: 'Controls whether a log detail read includes its saved workflow snapshot.',
+      examples: [{ includeWorkflowState: false }],
+    }),
   params: v2LogParamsSchema,
   response: {
     mode: 'json',

apps/sim/lib/logs/application/get-public-log.ts

@@ -30,6 +30,7 @@ interface PublicLogContext extends ActiveWorkspaceApplicationContext {
 
 export interface GetPublicLogInput {
   runId: string
+  includeWorkflowState?: boolean
 }
 
 export interface GetPublicLogResult {
@@ -94,7 +95,7 @@ export const getPublicLog = defineAuthorizedWorkspaceUseCase({
     return { ...workspace, executionId: scope.executionId, workflowId: scope.workflowId }
   },
   authorizationOptions: logDelegationAuthorization<PublicLogContext>(),
-  execute: async ({ principal, context }): Promise<GetPublicLogResult> => {
+  execute: async ({ principal, input, context }): Promise<GetPublicLogResult> => {
     /**
      * Attribution and the projection subject in one value; a workspace API key
      * represents no user and therefore reads the run whole. See
@@ -118,7 +119,8 @@ export const getPublicLog = defineAuthorizedWorkspaceUseCase({
 
     const log = await getPublicWorkflowLog(
       { column: 'executionId', value: context.executionId },
-      context.workspaceId
+      context.workspaceId,
+      { includeWorkflowState: input.includeWorkflowState }
     )
     if (!log || log.workflowId !== context.workflowId) {
       throw new OrchestrationError('not_found', 'Log not found')

apps/sim/lib/logs/application/public-log-use-cases.test.ts

@@ -139,7 +139,8 @@ describe('public log application use cases', () => {
     expect(mocks.loadWorkspace).toHaveBeenCalledWith('workspace-1')
     expect(mocks.getLog).toHaveBeenCalledWith(
       { column: 'executionId', value: 'run-1' },
-      'workspace-1'
+      'workspace-1',
+      { includeWorkflowState: undefined }
     )
     expect(mocks.materialize).toHaveBeenCalledWith(
       { pointer: true },

apps/sim/lib/logs/public-queries.ts

@@ -454,7 +454,11 @@ export async function getPublicWorkflowLogScope(executionId: string) {
  * is deliberately left-sided: a missing snapshot does not make an otherwise
  * valid execution disappear from the log resource.
  */
-export async function getPublicWorkflowLog(lookup: PublicWorkflowLogLookup, workspaceId?: string) {
+export async function getPublicWorkflowLog(
+  lookup: PublicWorkflowLogLookup,
+  workspaceId?: string,
+  options: { includeWorkflowState?: boolean } = {}
+) {
   const lookupCondition =
     lookup.column === 'id'
       ? eq(workflowExecutionLogs.id, lookup.value)
@@ -478,7 +482,10 @@ export async function getPublicWorkflowLog(lookup: PublicWorkflowLogLookup, work
       costTotal: workflowExecutionLogs.costTotal,
       files: workflowExecutionLogs.files,
       createdAt: workflowExecutionLogs.createdAt,
-      workflowState: workflowExecutionSnapshots.stateData,
+      workflowState:
+        options.includeWorkflowState === false
+          ? sql<null>`null`
+          : workflowExecutionSnapshots.stateData,
       workflowName: workflow.name,
       workflowDescription: workflow.description,
       workflowFolderId: workflow.folderId,

apps/sim/lib/workspaces/__integration__/http-cli.integration.ts

@@ -9,6 +9,8 @@ import {
   permissions,
   user,
   workflow,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
   workspace,
   workspaceOperationReceipt,
 } from '@sim/db/schema'
@@ -17,6 +19,7 @@ import { eq } from 'drizzle-orm'
 import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, describe, expect, it } from 'vitest'
 import { hashApiKey } from '@/lib/api-key/crypto'
+import { GET as logGet } from '@/app/api/v2/logs/[runId]/route'
 import { POST as importPreview } from '@/app/api/v2/workflows/import/preview/route'
 import { POST as importApply } from '@/app/api/v2/workflows/import/route'
 import { POST as forkPreview } from '@/app/api/v2/workspaces/[workspaceId]/fork/preview/route'
@@ -29,6 +32,10 @@ const userId = generateId()
 const workspaceId = generateId()
 const personalKey = `sk-sim-fixture-${generateId()}`
 const workspaceKey = `sk-sim-fixture-${generateId()}`
+const logRunId = generateId()
+const logSnapshotId = generateId()
+const foreignWorkspaceId = generateId()
+const logSnapshot = { blocks: {}, edges: [], variables: { fixture: 'configuration'.repeat(2000) } }
 const childWorkspaceIds: string[] = []
 let endpoint: string
 let directory: string
@@ -118,6 +125,29 @@ describe('v2 and CLI workflow protocol against PostgreSQL', () => {
       entityId: workspaceId,
       permissionType: 'admin',
     })
+    await db.insert(workspace).values({
+      id: foreignWorkspaceId,
+      name: 'Inaccessible log fixture',
+      ownerId: userId,
+      billedAccountUserId: userId,
+    })
+    await db.insert(workflowExecutionSnapshots).values({
+      id: logSnapshotId,
+      stateHash: generateId(),
+      stateData: logSnapshot,
+    })
+    await db.insert(workflowExecutionLogs).values({
+      id: generateId(),
+      workspaceId,
+      executionId: logRunId,
+      stateSnapshotId: logSnapshotId,
+      level: 'info',
+      status: 'completed',
+      trigger: 'manual',
+      startedAt: now,
+      endedAt: now,
+      executionData: { finalOutput: { delivered: false }, traceSpans: [] },
+    })
     await db.insert(apiKey).values([
       {
         id: generateId(),
@@ -160,8 +190,10 @@ describe('v2 and CLI workflow protocol against PostgreSQL', () => {
         const path = new URL(request.url).pathname
         const match = path.match(/^\/api\/v2\/workspaces\/([^/]+)\/(.*)$/)
         const context = { params: Promise.resolve({ workspaceId: match?.[1] ?? workspaceId }) }
-        const response =
-          path === '/api/v2/workflows/import/preview'
+        const logMatch = path.match(/^\/api\/v2\/logs\/([^/]+)$/)
+        const response = logMatch
+          ? await logGet(request, { params: Promise.resolve({ runId: logMatch[1] }) })
+          : path === '/api/v2/workflows/import/preview'
             ? await importPreview(request, { params: Promise.resolve({}) })
             : path === '/api/v2/workflows/import'
               ? await importApply(request, { params: Promise.resolve({}) })
@@ -207,11 +239,63 @@ describe('v2 and CLI workflow protocol against PostgreSQL', () => {
       })
     for (const id of childWorkspaceIds) await db.delete(workspace).where(eq(workspace.id, id))
     await db.delete(workspace).where(eq(workspace.id, workspaceId))
+    await db.delete(workspace).where(eq(workspace.id, foreignWorkspaceId))
+    await db
+      .delete(workflowExecutionSnapshots)
+      .where(eq(workflowExecutionSnapshots.id, logSnapshotId))
     await db.delete(user).where(eq(user.id, userId))
     await rm(directory, { recursive: true, force: true })
     await db.$client.end()
   })
 
+  it('omits only the requested log snapshot through the CLI and preserves the default read', async () => {
+    const args = ['logs', 'get', logRunId]
+    const before = await cli(args)
+    expect(before.code, before.stderr).toBe(0)
+    const original = JSON.parse(before.stdout)
+    expect(original.workflowState.variables).toEqual(logSnapshot.variables)
+
+    const explicit = await cli([...args, '--include-workflow-state'])
+    expect(explicit.code, explicit.stderr).toBe(0)
+    expect(JSON.parse(explicit.stdout)).toEqual(original)
+    const compact = await cli([...args, '--no-include-workflow-state'])
+    expect(compact.code, compact.stderr).toBe(0)
+    expect(JSON.parse(compact.stdout)).toEqual({ ...original, workflowState: null })
+    expect(Buffer.byteLength(compact.stdout)).toBeLessThan(Buffer.byteLength(before.stdout) / 2)
+    const after = await cli(args)
+    expect(after.code, after.stderr).toBe(0)
+    expect(JSON.parse(after.stdout)).toEqual(original)
+  })
+
+  it('validates log query flags and retains authorization for compact reads over HTTP', async () => {
+    const path = `${endpoint}/api/v2/logs/${logRunId}`
+    const headers = { 'X-API-Key': workspaceKey }
+    const invalid = await fetch(`${path}?includeWorkflowState=invalid`, { headers })
+    expect(invalid.status).toBe(400)
+    expect(await invalid.json()).toMatchObject({ error: { code: 'BAD_REQUEST' } })
+    const unknown = await fetch(`${path}?includeWorkflowState=false&unknown=true`, { headers })
+    expect(unknown.status).toBe(400)
+    const unauthenticated = await fetch(`${path}?includeWorkflowState=false`)
+    expect(unauthenticated.status).toBe(401)
+
+    await db
+      .update(workflowExecutionLogs)
+      .set({ workspaceId: foreignWorkspaceId })
+      .where(eq(workflowExecutionLogs.executionId, logRunId))
+    try {
+      for (const query of ['', '?includeWorkflowState=false']) {
+        const concealed = await fetch(`${path}${query}`, { headers })
+        expect(concealed.status).toBe(404)
+        expect(await concealed.json()).toMatchObject({ error: { code: 'NOT_FOUND' } })
+      }
+    } finally {
+      await db
+        .update(workflowExecutionLogs)
+        .set({ workspaceId })
+        .where(eq(workflowExecutionLogs.executionId, logRunId))
+    }
+  })
+
   it('previews stdin JSON, applies @file input, waits, and returns the same receipt on retry', async () => {
     const preview = await cli(
       ['workflows', 'import-preview', '--workflow', '@-', '--mappings', '@mappings.json'],