fix(streaming): redact tool payloads on selected outputs in public chat

Redaction only ran on the empty-selection branch, but a deployment almost
always selects outputs, so it was dead in the case it exists for. Selecting
toolCalls streamed the raw arguments and results to a public chat client in a
chunk frame, and providerTiming carried thinking content the same way.

Both paths now extract from the sanitized block output rather than the raw log:
the streamed selected output, which is the reachable vector, and the final
envelope. Sanitizing the source rather than per selected path means a newly
selectable field cannot reopen the hole.

Author: icecrasher321

apps/sim/lib/workflows/streaming/streaming.test.ts

@@ -660,6 +660,44 @@ describe('final envelope tool payloads', () => {
     expect(JSON.stringify(final)).not.toContain('72')
   })
 
+  /**
+   * A deployment almost always selects outputs, so redaction that only covered
+   * the empty-selection branch would be dead in the case it exists for.
+   */
+  it('redacts tool payloads when the deployment selects toolCalls directly', async () => {
+    const stream = await createStreamingResponse({
+      requestId: 'request-1',
+      streamConfig: { isSecureMode: true, selectedOutputs: ['block_toolCalls'] },
+      executeFn: async ({ onBlockComplete }) => {
+        const toolOnlyOutput = { toolCalls: agentOutput.toolCalls }
+        await onBlockComplete('block', toolOnlyOutput)
+        return {
+          success: true,
+          output: {},
+          logs: [
+            {
+              blockId: 'block',
+              output: toolOnlyOutput,
+              startedAt: new Date().toISOString(),
+              endedAt: new Date().toISOString(),
+              durationMs: 1,
+              success: true,
+            },
+          ],
+        } as any
+      },
+    })
+
+    // The payload rides the chunk frame, not `final`, so assert on the whole
+    // stream — sanitizing only the envelope would still leak here.
+    const events = await collectSSEEvents(stream)
+    const serialized = JSON.stringify(events)
+
+    expect(serialized).not.toContain('private')
+    expect(serialized).not.toContain('72')
+    expect(serialized).toContain('get_weather')
+  })
+
   it('keeps tool results for the authenticated workflow API', async () => {
     const stream = await createStreamingResponse({
       requestId: 'request-1',

apps/sim/lib/workflows/streaming/streaming.ts

@@ -1,6 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { omit } from '@sim/utils/object'
+import { isRecordLike, omit } from '@sim/utils/object'
 import { createTimeoutAbortController, getTimeoutErrorMessage } from '@/lib/core/execution-limits'
 import {
   extractBlockIdFromOutputId,
@@ -366,6 +366,23 @@ async function buildMinimalResult(
     return minimalResult
   }
 
+  /**
+   * Selected outputs are extracted from the sanitized block output, not the raw
+   * log. A deployment can select `toolCalls` or `providerTiming` directly, so
+   * sanitizing per selected path would leave the leak open for whichever path
+   * was missed; sanitizing the source closes it for every path at once. Cached
+   * per block because several descriptors can target the same one.
+   */
+  const sanitizedBlockOutputs = new Map<string, Record<string, unknown>>()
+  const sanitizedOutputFor = (blockId: string, output: Record<string, unknown>) => {
+    const cached = sanitizedBlockOutputs.get(blockId)
+    if (cached) return cached
+
+    const sanitized = sanitizeOutputForEnvelope(output, envelopeOptions)
+    sanitizedBlockOutputs.set(blockId, sanitized)
+    return sanitized
+  }
+
   let selectedOutputBytes = assertSelectedOutputBytes(minimalResult.output)
   for (const descriptor of getSelectedOutputDescriptors(selectedOutputs)) {
     const { blockId, path } = descriptor
@@ -406,7 +423,11 @@ async function buildMinimalResult(
         getBase64DecodedByteBudget(remainingBytes)
       ),
     }
-    const value = await extractOutputValue(blockLog.output, path, extractionContext)
+    const value = await extractOutputValue(
+      sanitizedOutputFor(blockId, blockLog.output),
+      path,
+      extractionContext
+    )
     if (value === undefined) {
       continue
     }
@@ -692,6 +713,18 @@ export async function createStreamingResponse(
           (descriptor) => descriptor.blockId === blockId
         )
 
+        /**
+         * A selected output is streamed here and then skipped in the `final`
+         * envelope, so this is the reachable path for a deployment that selects
+         * `toolCalls` or `providerTiming` — sanitizing only the envelope would
+         * leave the payload flowing through the chunk frame instead.
+         */
+        const sanitizedOutput = isRecordLike(output)
+          ? sanitizeOutputForEnvelope(output, {
+              redactToolPayloads: streamConfig.isSecureMode === true,
+            })
+          : output
+
         for (const descriptor of matchingOutputs) {
           if (state.selectedOutputError) {
             break
@@ -714,7 +747,11 @@ export async function createStreamingResponse(
               ),
             }
             const materializationContext = buildMaterializationContext(extractionContext)
-            const outputValue = await extractOutputValue(output, descriptor.path, extractionContext)
+            const outputValue = await extractOutputValue(
+              sanitizedOutput,
+              descriptor.path,
+              extractionContext
+            )
 
             if (outputValue !== undefined) {
               const materializedOutput = await materializeInlineExecutionValue(