fix(executor): restore delegated workflow execution

apps/sim/executor/execution/executor.test.ts

@@ -429,3 +429,26 @@ describe('DAGExecutor createExecutionContext useDraftState', () => {
  expect(buildMetadataUseDraftState({ isDeployedContext: false })).toBe(true)
  })
 })
+
+describe('DAGExecutor executor delegation origin', () => {
+ it('copies the canonical origin into the runtime execution context', () => {
+ const executorDelegationOrigin = {
+ subjectUserId: 'user-1',
+ workflowId: 'parent-workflow',
+ executionId: 'parent-execution',
+ }
+ const executor = new DAGExecutor({
+ workflow: { version: '1', blocks: [], connections: [] },
+ contextExtensions: { executorDelegationOrigin },
+ })
+
+ const { context } = (
+ executor as unknown as {
+ createExecutionContext: (workflowId: string) => { context: ExecutionContext }
+ }
+ ).createExecutionContext('child-workflow')
+
+ expect(context.workflowId).toBe('child-workflow')
+ expect(context.executorDelegationOrigin).toBe(executorDelegationOrigin)
+ })
+})

apps/sim/executor/execution/executor.ts

@@ -421,6 +421,7 @@ export class DAGExecutor {
  fileKeys: this.contextExtensions.fileKeys,
  allowLargeValueWorkflowScope: this.contextExtensions.allowLargeValueWorkflowScope,
  userId: this.contextExtensions.userId,
+ executorDelegationOrigin: this.contextExtensions.executorDelegationOrigin,
  isDeployedContext: this.contextExtensions.isDeployedContext,
  enforceCredentialAccess: this.contextExtensions.enforceCredentialAccess,
  piiBlockOutputRedaction: this.contextExtensions.piiBlockOutputRedaction,

apps/sim/executor/execution/types.ts

@@ -6,6 +6,7 @@ import type { NodeMetadata } from '@/executor/dag/types'
 import type {
  BlockLog,
  BlockState,
+ ExecutorDelegationOrigin,
  NormalizedBlockOutput,
  StartBlockRunMetadata,
  StreamingExecution,
@@ -231,6 +232,8 @@ export interface ContextExtensions {
  fileKeys?: string[]
  allowLargeValueWorkflowScope?: boolean
  userId?: string
+ /** Canonical signed execution identity inherited by regular nested workflows. */
+ executorDelegationOrigin?: ExecutorDelegationOrigin
  /**
  * Immutable actor/payer decision for this execution. Child workflow
  * executions receive it here (they carry no full metadata), so internal

apps/sim/executor/handlers/agent/agent-handler.test.ts

@@ -27,7 +27,10 @@ import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-tr
 import { executeProviderRequest } from '@/providers'
 import { installStreamingCostPolicy } from '@/providers/cost-policy'
 import { SIM_AUTO_MODEL_ID } from '@/providers/models'
-import { getProviderToolInputProvenance } from '@/providers/tool-input-provenance'
+import {
+ getProviderToolInputProvenance,
+ getProviderToolModelInputRegistry,
+} from '@/providers/tool-input-provenance'
 import { getProviderFromModel, transformBlockTool } from '@/providers/utils'
 import type { SerializedBlock, SerializedWorkflow } from '@/serializer/types'
 import { executeTool } from '@/tools'
@@ -1155,6 +1158,61 @@ describe('AgentBlockHandler', () => {
  expect(runtimeContext.resolvedSecretTraceRegistry.getActiveMatches()).toEqual([])
  })
 
+ it('binds prompt-exposed placeholders to each provider tool for runtime rebinding', async () => {
+ const registry = new ResolvedSecretTraceRegistry([
+ {
+ name: 'TEST_API_KEY_PERSONAL',
+ plaintext: 'personal-secret-value',
+ encryptedValue: 'encrypted-personal-secret',
+ },
+ ])
+ registry.recordResolvedAtInputPath('TEST_API_KEY_PERSONAL', 'personal-secret-value', [
+ 'userPrompt',
+ ])
+ registry.recordResolvedInputProjection(
+ ['userPrompt'],
+ 'Use personal-secret-value',
+ 'Use {{TEST_API_KEY_PERSONAL}}'
+ )
+ mockContext.resolvedSecretTraceRegistry = registry
+
+ await handler.execute(mockContext, mockBlock, {
+ model: 'gpt-4o',
+ userPrompt: 'Use personal-secret-value',
+ tools: [
+ {
+ type: 'custom-tool',
+ title: 'canary',
+ schema: {
+ function: {
+ name: 'canary',
+ parameters: {
+ type: 'object',
+ properties: { secret: { type: 'string' } },
+ required: ['secret'],
+ },
+ },
+ },
+ },
+ ],
+ })
+
+ const [, providerRequest] = mockExecuteProviderRequest.mock.calls[0]
+ const modelInputRegistry = getProviderToolModelInputRegistry(providerRequest.tools[0])
+ expect(providerRequest.messages).toEqual([
+ { role: 'user', content: 'Use {{TEST_API_KEY_PERSONAL}}' },
+ ])
+ expect(
+ modelInputRegistry?.resolveModelExposedEnvReferences({
+ secret: '{{TEST_API_KEY_PERSONAL}}',
+ })
+ ).toMatchObject({
+ complete: true,
+ matched: true,
+ value: { secret: 'personal-secret-value' },
+ })
+ })
+
  it('does not carry a projected system prompt into Agent output provenance', async () => {
  const registry = new ResolvedSecretTraceRegistry([
  { name: 'TOKEN', plaintext: 'x', encryptedValue: 'encrypted-token' },

apps/sim/executor/handlers/agent/agent-handler.ts

@@ -85,6 +85,7 @@ import { isAutoModel, SIM_AUTO_MODEL_ID } from '@/providers/models'
 import {
  type ProviderToolInputProvenance,
  registerProviderToolInputProvenance,
+ registerProviderToolModelInputRegistry,
 } from '@/providers/tool-input-provenance'
 import type { ProviderToolConfig } from '@/providers/types'
 import { getProviderFromModel, transformBlockTool } from '@/providers/utils'
@@ -397,6 +398,11 @@ export class AgentBlockHandler implements BlockHandler {
 
  const settledInputRegistry = ctx.resolvedSecretTraceRegistry
  const resultRegistry = settledInputRegistry?.forkForInputPaths([])
+ if (modelInputProjection.registry) {
+ for (const tool of formatted.tools) {
+ registerProviderToolModelInputRegistry(tool, modelInputProjection.registry)
+ }
+ }
  if (resultRegistry && settledInputRegistry) {
  for (const [tool, provenance] of formatted.inputProvenance) {
  registerProviderToolInputProvenance(tool, {
@@ -2590,6 +2596,7 @@ export class AgentBlockHandler implements BlockHandler {
  },
  {
  resolvedSecretTraceRegistry: modelRuntimeRegistry,
+ executionContext: ctx,
  }
  )
 

apps/sim/executor/handlers/workflow/custom-block-tool-runner.ts

@@ -4,7 +4,7 @@ import { generateId } from '@sim/utils/id'
 import { isPlainRecord } from '@sim/utils/object'
 import type { BillingAttributionSnapshot } from '@/lib/billing/core/billing-attribution'
 import { WorkflowBlockHandler } from '@/executor/handlers/workflow/workflow-handler'
-import type { ExecutionContext } from '@/executor/types'
+import type { ExecutionContext, ExecutorDelegationOrigin } from '@/executor/types'
 import { projectResolvedSecretDiagnosticContent } from '@/executor/utils/resolved-secret-content-projection'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import type { SerializedBlock } from '@/serializer/types'
@@ -55,6 +55,7 @@ export function buildCustomBlockExecutionContext(
  options: {
  abortSignal?: AbortSignal
  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
+ executorDelegationOrigin?: ExecutorDelegationOrigin
  } = {}
 ): ExecutionContext {
  // Prefer the invoking agent run's ids so correlation and cancellation both
@@ -64,6 +65,7 @@ export function buildCustomBlockExecutionContext(
  workflowId: context.workflowId ?? 'custom-block-tool',
  workspaceId: context.workspaceId,
  userId: context.userId,
+ executorDelegationOrigin: options.executorDelegationOrigin,
  executionId,
  isDeployedContext: context.isDeployedContext,
  // Inherit the accumulated chain so the handler appends + validates depth;

apps/sim/executor/handlers/workflow/workflow-handler.test.ts

@@ -582,6 +582,11 @@ describe('WorkflowBlockHandler', () => {
  expect(executorOptions[0].contextExtensions.billingAttribution).toBe(sourceAttribution)
  expect(executorOptions[0].contextExtensions.userId).toBe('owner-9')
  expect(executorOptions[0].contextExtensions.workspaceId).toBe('workspace-source')
+ expect(executorOptions[0].contextExtensions.executorDelegationOrigin).toEqual({
+ subjectUserId: 'owner-9',
+ workflowId: 'source-workflow-id',
+ executionId: loggingSessionArgs[0][1],
+ })
  })
 
  it('builds trusted caller metadata for custom block children with the toggle on', async () => {
@@ -1225,6 +1230,15 @@ describe('WorkflowBlockHandler', () => {
  expect(loggingSessionArgs).toHaveLength(0)
  })
 
+ it('fails before execution when the source child log row cannot be opened', async () => {
+ mockSafeStart.mockResolvedValue(false)
+
+ await expect(handler.execute(customBlockContext(), customBlock(), {})).rejects.toThrow()
+
+ expect(mockExecutorExecute).not.toHaveBeenCalled()
+ expect(executorOptions).toHaveLength(0)
+ })
+
  it('runs the child under its own execution id but keeps the parent readable', async () => {
  const ctx = customBlockContext()
  await handler.execute(ctx, customBlock(), {})
@@ -1235,6 +1249,24 @@ describe('WorkflowBlockHandler', () => {
  expect(ctx.largeValueExecutionIds).toContain(extensions.executionId)
  })
 
+ it('replaces the consumer delegation origin with the source child execution', async () => {
+ const ctx = customBlockContext({
+ executorDelegationOrigin: {
+ subjectUserId: 'consumer-1',
+ workflowId: 'consumer-workflow',
+ executionId: 'parent-execution-id',
+ },
+ })
+
+ await handler.execute(ctx, customBlock(), {})
+
+ expect(executorOptions[0].contextExtensions.executorDelegationOrigin).toEqual({
+ subjectUserId: 'owner-9',
+ workflowId: 'source-workflow-id',
+ executionId: executorOptions[0].contextExtensions.executionId,
+ })
+ })
+
  it('shares one large-value id list so nested custom blocks propagate upward', async () => {
  const ctx = customBlockContext()
  await handler.execute(ctx, customBlock(), {})
@@ -1604,9 +1636,49 @@ describe('WorkflowBlockHandler', () => {
  const extensions = executorOptions[0].contextExtensions
  expect(extensions.executionId).toBe('parent-execution-id')
  expect(extensions.resolvedSecretTraceRegistry).toBe(registry)
+ expect(extensions.executorDelegationOrigin).toEqual({
+ subjectUserId: 'user-1',
+ workflowId: 'parent-workflow-id',
+ executionId: 'parent-execution-id',
+ })
+ expect(mockBuildExecutorDelegationHeaders).toHaveBeenCalledWith(
+ extensions.executorDelegationOrigin
+ )
  expect(extensions.onStream).toBe(ctx.onStream)
  expect(extensions.childWorkflowContext).toBeDefined()
  })
+
+ it('preserves the canonical parent origin through deeper regular children', async () => {
+ const ctx = {
+ ...mockContext,
+ workspaceId: 'workspace-1',
+ workflowId: 'intermediate-workflow-id',
+ executionId: 'parent-execution-id',
+ executorDelegationOrigin: {
+ subjectUserId: 'user-1',
+ workflowId: 'root-workflow-id',
+ executionId: 'parent-execution-id',
+ },
+ } as ExecutionContext
+ mockFetch.mockResolvedValue({
+ ok: true,
+ json: () =>
+ Promise.resolve({
+ data: {
+ name: 'Grandchild Workflow',
+ workspaceId: 'workspace-1',
+ state: { blocks: [], edges: [], loops: {}, parallels: {} },
+ },
+ }),
+ })
+
+ await handler.execute(ctx, mockBlock, { workflowId: 'grandchild-workflow-id' })
+
+ expect(mockBuildExecutorDelegationHeaders).toHaveBeenCalledWith(ctx.executorDelegationOrigin)
+ expect(executorOptions[0].contextExtensions.executorDelegationOrigin).toBe(
+ ctx.executorDelegationOrigin
+ )
+ })
  })
 
  describe('projectCustomBlockOutput', () => {

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -37,6 +37,7 @@ import {
  type BlockHandler,
  type ExecutionContext,
  type ExecutionResult,
+ type ExecutorDelegationOrigin,
  START_BLOCK_METADATA_FIELD,
  type StartBlockRunMetadata,
  type StreamingExecution,
@@ -278,17 +279,22 @@ export class WorkflowBlockHandler implements BlockHandler {
  /** Large-value id list shared with the child (and any nested custom blocks). */
  let sharedLargeValueIds: string[] | undefined
  let childCancellation: { signal: AbortSignal; dispose: () => void } | undefined
+ let childExecutorDelegationOrigin: ExecutorDelegationOrigin | undefined
  /** Settled in `finally` once the child is fully done — see `trackChildRun`. */
  let settleChildRun: (() => void) | undefined
  try {
  if (!loadUserId) {
  throw new Error('Workflow child loading requires a human execution subject')
  }
- const workflowReadHeaders = await buildExecutorDelegationHeaders({
- subjectUserId: loadUserId,
- workflowId: isCustomBlock ? workflowId : ctx.workflowId,
- ...(!isCustomBlock && ctx.executionId ? { executionId: ctx.executionId } : {}),
- })
+ const workflowReadDelegationOrigin: ExecutorDelegationOrigin = isCustomBlock
+ ? { subjectUserId: loadUserId, workflowId }
+ : (ctx.executorDelegationOrigin ?? {
+ subjectUserId: loadUserId,
+ workflowId: ctx.workflowId,
+ ...(ctx.executionId ? { executionId: ctx.executionId } : {}),
+ })
+ if (!isCustomBlock) childExecutorDelegationOrigin = workflowReadDelegationOrigin
+ const workflowReadHeaders = await buildExecutorDelegationHeaders(workflowReadDelegationOrigin)
 
  // A custom block runs the source's latest deployment; if the source has been
  // undeployed there's nothing to run. `BoundarySafeError` marks the message as
@@ -509,10 +515,13 @@ export class WorkflowBlockHandler implements BlockHandler {
  ...(correlation ? { triggerData: { correlation } } : {}),
  })
  if (!childSessionStarted) {
- logger.error('Custom block child logging failed to start; child spend will be unbilled', {
- workflowId,
- childExecutionId,
- })
+ childExecutionId = undefined
+ throw new Error('Custom block child logging failed to start')
+ }
+ childExecutorDelegationOrigin = {
+ subjectUserId: loadUserId,
+ workflowId,
+ executionId: childExecutionId,
  }
  // The child no longer shares the parent's execution id, so it no longer
  // hears the parent's cancellation event — bridge it explicitly.
@@ -599,6 +608,7 @@ export class WorkflowBlockHandler implements BlockHandler {
  enforceCredentialAccess: ctx.enforceCredentialAccess,
  workspaceId: childWorkspaceId,
  userId: childUserId,
+ executorDelegationOrigin: childExecutorDelegationOrigin,
  executionId: childExecutionId ?? ctx.executionId,
  // Large values are cached per execution id, so a child running under its
  // own id still needs the invoking run's id to read values in its inputs.

apps/sim/executor/handlers/workflow/workflow-tool-runner.ts

@@ -9,6 +9,7 @@ import {
  type CustomBlockExecutorContext,
 } from '@/executor/handlers/workflow/custom-block-tool-runner'
 import { WorkflowBlockHandler } from '@/executor/handlers/workflow/workflow-handler'
+import type { ExecutorDelegationOrigin } from '@/executor/types'
 import { classifyExecutionError } from '@/executor/utils/errors'
 import { parseJSON } from '@/executor/utils/json'
 import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
@@ -52,6 +53,7 @@ export async function runWorkflowTool(
  options: {
  abortSignal?: AbortSignal
  resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
+ executorDelegationOrigin?: ExecutorDelegationOrigin
  } = {}
 ): Promise<ToolResponse> {
  if (!params.workflowId) {

apps/sim/executor/types.ts

@@ -338,6 +338,19 @@ export interface BlockState {
  resolvedSecretTraceProvenance?: ResolvedSecretTraceProvenanceV1
 }
 
+/**
+ * Canonical signed execution identity used for executor-delegated internal operations.
+ *
+ * A nested workflow changes {@link ExecutionContext.workflowId} for execution semantics, but it
+ * still belongs to the parent log row identified here. Custom blocks replace this origin with the
+ * publisher-owned child execution after opening their own source-workspace log row.
+ */
+export interface ExecutorDelegationOrigin {
+ subjectUserId: string
+ workflowId: string
+ executionId?: string
+}
+
 export interface ExecutionContext {
  workflowId: string
  workspaceId?: string
@@ -347,6 +360,8 @@ export interface ExecutionContext {
  fileKeys?: string[]
  allowLargeValueWorkflowScope?: boolean
  userId?: string
+ /** Trusted origin for signed executor delegation, distinct from the currently executing child. */
+ executorDelegationOrigin?: ExecutorDelegationOrigin
  isDeployedContext?: boolean
  enforceCredentialAccess?: boolean
  copilotToolExecution?: boolean