fix(workflows): retain tool context when masking encoded params

Author: icecrasher321

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/utils.test.ts

@@ -107,30 +107,35 @@ describe('structured field rendering', () => {
     expect(toDiffText([1])).not.toBe(toDiffText(['1']))
   })
 
-  it('masks declared tool password fields without projecting away other tool data', () => {
-    declareSubBlocks({
-      convex: [
-        { id: 'deployKey', type: 'short-input', password: true },
-        { id: 'secretAccess', type: 'dropdown' },
-      ],
-    })
-    const tools = [
-      {
-        type: 'convex',
-        customToolId: 'tool-a',
-        params: { deployKey: 'private', secretAccess: 'none', query: 'ok' },
-      },
-    ]
-    const rendered = toDiffText(tools, 'agent', 'tools')
-    expect(rendered).not.toContain('private')
-    expect(JSON.parse(rendered)).toEqual([
-      {
-        type: 'convex',
-        customToolId: 'tool-a',
-        params: { deployKey: '•••', secretAccess: 'none', query: 'ok' },
-      },
-    ])
-  })
+  it.each([false, true])(
+    'masks declared tool passwords without discarding other params (encoded: %s)',
+    (encoded) => {
+      declareSubBlocks({
+        convex: [
+          { id: 'deployKey', type: 'short-input', password: true },
+          { id: 'secretAccess', type: 'dropdown' },
+        ],
+      })
+      const stored = (params: Record<string, unknown>) =>
+        encoded ? JSON.stringify(params) : params
+      const tools = [
+        {
+          type: 'convex',
+          customToolId: 'tool-a',
+          params: stored({ deployKey: 'private', secretAccess: 'none', query: 'ok' }),
+        },
+      ]
+      const rendered = toDiffText(tools, 'agent', 'tools')
+      expect(rendered).not.toContain('private')
+      expect(JSON.parse(rendered)).toEqual([
+        {
+          type: 'convex',
+          customToolId: 'tool-a',
+          params: stored({ deployKey: '•••', secretAccess: 'none', query: 'ok' }),
+        },
+      ])
+    }
+  )
 
   it('masks nested secrets in objects, encoded JSON and table cells', () => {
     const value = {

apps/sim/app/workspace/[workspaceId]/w/components/workflow-diff/utils.ts

@@ -193,7 +193,7 @@ function isSecretKey(key: string): boolean {
  * Tool params persist structured values as JSON strings, so a header map with
  * an Authorization entry arrives encoded; decode, mask and re-encode it.
  */
-function maskEncodedSecrets(value: string): string {
+function maskEncodedSecrets(value: string, blockType?: string): string {
   const trimmed = value.trimStart()
   if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return value
   let parsed: unknown
@@ -203,7 +203,7 @@ function maskEncodedSecrets(value: string): string {
     return value
   }
   if (parsed === null || typeof parsed !== 'object') return value
-  const masked = maskSecretsDeep(parsed)
+  const masked = maskSecretsDeep(parsed, blockType)
   return JSON.stringify(masked) === JSON.stringify(parsed) ? value : JSON.stringify(masked)
 }
 
@@ -214,7 +214,7 @@ function maskEncodedSecrets(value: string): string {
  */
 export function maskSecretsDeep(value: unknown, blockType?: string): unknown {
   if (Array.isArray(value)) return value.map((entry) => maskSecretsDeep(entry))
-  if (typeof value === 'string') return maskEncodedSecrets(value)
+  if (typeof value === 'string') return maskEncodedSecrets(value, blockType)
   if (value === null || typeof value !== 'object') return value
   let record = value as Record<string, unknown>
   const cells = record.cells