fix(logs): keep run identity on every remaining failure line

Fixes the type error on the external failure body, attributes a provider
error payload on a 2xx to the provider, and adds workflow, execution, and
block ids to the MCP failure lines that replace the block executor's. The
condition batch carries its failed result's marks and passes its block id.
Pi GitHub calls carry no run identity, so their errors now carry only the
tool layer's attribution and the block executor still logs them with ids.
Restores the HITL notification warning, which covers soft failures the tool
layer never logs, and attributes refused tool and proxy URLs to the author.

Author: waleedlatif1

apps/sim/executor/handlers/condition/condition-handler.ts

@@ -40,7 +40,14 @@ type ConditionEvaluation =
   | { status: 'matched'; index: number }
   | { status: 'no-match' }
   | { status: 'expression-threw'; index: number; message: string }
-  | { status: 'no-verdict'; message: string; retryable: boolean; timedOut: boolean }
+  | {
+      status: 'no-verdict'
+      message: string
+      retryable: boolean
+      timedOut: boolean
+      /** The failed tool result's output, so a terminal error carries its logged mark. */
+      output?: unknown
+    }
 
 /**
  * Wraps one expression as a boolean test, on its own line so a trailing line
@@ -173,6 +180,7 @@ async function runConditionCode(
         userId: ctx.userId,
         isDeployedContext: ctx.isDeployedContext,
         enforceCredentialAccess: ctx.enforceCredentialAccess,
+        blockId: currentNodeId,
       },
     },
     { executionContext: ctx }
@@ -215,6 +223,7 @@ async function evaluateConditionList(
       message,
       retryable: result.retryable !== false,
       timedOut: isTimeoutFailure(result.error),
+      output: result.output,
     }
   }
 
@@ -515,8 +524,11 @@ export class ConditionBlockHandler implements BlockHandler {
         )
       case 'no-verdict':
         if (!evaluation.retryable) {
-          throw new NonRetryableExecutionError(
-            `Evaluation error in condition "${conditions[0].title}": ${evaluation.message}`
+          throw adoptToolFailure(
+            new NonRetryableExecutionError(
+              `Evaluation error in condition "${conditions[0].title}": ${evaluation.message}`
+            ),
+            evaluation
           )
         }
         // Retrying one branch at a time is what recovers a batch the sandbox
@@ -526,7 +538,7 @@ export class ConditionBlockHandler implements BlockHandler {
         // failure as it stands. The whole list was one call, so no single
         // branch owns that failure; name the first, where evaluation started.
         if (evaluation.timedOut || ctx.abortSignal?.aborted) {
-          throw conditionError(conditions[0], evaluation.message)
+          throw adoptToolFailure(conditionError(conditions[0], evaluation.message), evaluation)
         }
         logger.warn('Batched condition evaluation produced no verdict, retrying one at a time', {
           conditionCount: conditions.length,

apps/sim/executor/handlers/human-in-the-loop/human-in-the-loop-handler.ts

@@ -561,6 +561,10 @@ export class HumanInTheLoopBlockHandler implements BlockHandler {
           const durationMs = Date.now() - startTime
 
           if (!result.success) {
+            logger.warn('Notification tool execution failed', {
+              toolId,
+              error: result.error,
+            })
             return {
               toolId,
               title: toolConfig.title,

apps/sim/executor/handlers/pi/cloud/babysit/github.ts

@@ -1,7 +1,7 @@
 import { getErrorMessage } from '@sim/utils/errors'
 import { isRecordLike } from '@sim/utils/object'
 import { truncate } from '@sim/utils/string'
-import { adoptToolFailure } from '@/lib/core/errors/failure-log'
+import { classifyFailure, markFailureKind } from '@/lib/core/errors/failure-log'
 import type { BabysitRoundDecision } from '@/executor/handlers/pi/cloud/babysit/round'
 import {
   fetchPrSnapshot,
@@ -24,6 +24,7 @@ import type {
   StatusCheckRollupContext,
   SubmittedReviewSummary,
 } from '@/tools/github/types'
+import type { ToolResponse } from '@/tools/types'
 
 const MAX_PAGES = 10
 const MAX_COMMENTS_PER_THREAD = 50
@@ -205,6 +206,11 @@ function toolFailure(label: string, error: unknown): Error {
   )
 }
 
+/** Carries the tool layer's attribution; these calls carry no run identity, so not its logged mark. */
+function attributedToolFailure(label: string, result: ToolResponse): Error {
+  return markFailureKind(toolFailure(label, result.error), classifyFailure(result.output))
+}
+
 function parseReviewThread(value: unknown, index: number): ReviewThread {
   if (!isRecordLike(value)) throw new Error(`Review thread ${index} must be an object`)
   const commentsValue = value.comments
@@ -289,8 +295,7 @@ export async function fetchBabysitThreads(
       },
       { signal }
     )
-    if (!result.success)
-      throw adoptToolFailure(toolFailure('Failed to fetch review threads', result.error), result)
+    if (!result.success) throw attributedToolFailure('Failed to fetch review threads', result)
     const output = result.output
     if (!isRecordLike(output) || !Array.isArray(output.threads)) {
       throw new Error('Review thread response is incomplete')
@@ -425,8 +430,7 @@ export async function fetchBabysitCheckState(
         },
         { signal }
       )
-      if (!result.success)
-        throw adoptToolFailure(toolFailure('Failed to fetch checks', result.error), result)
+      if (!result.success) throw attributedToolFailure('Failed to fetch checks', result)
       const output = result.output
       if (!isRecordLike(output) || !Array.isArray(output.contexts)) {
         throw new Error('Check response is incomplete')

apps/sim/executor/handlers/pi/cloud/shared.ts

@@ -5,7 +5,7 @@
  * security-sensitive details.
  */
 
-import { adoptToolFailure } from '@/lib/core/errors/failure-log'
+import { classifyFailure, markFailureKind } from '@/lib/core/errors/failure-log'
 import { getMaxExecutionTimeout } from '@/lib/core/execution-limits'
 import { resolvePiSandboxLifetimeMs } from '@/lib/execution/remote-sandbox/pi-lifetime'
 import { PI_EVENT_FILTER_PATH } from '@/executor/handlers/pi/cloud/event-filter-source'
@@ -224,9 +224,13 @@ export function scrubGitSecrets(text: string, token: string): string {
 }
 
 /**
- * The error a backend throws for a failed GitHub tool call. Carries the tool layer's marks so the
- * failure `executeTool` already logged is not logged again at error.
+ * The error a backend throws for a failed GitHub tool call. Carries the tool layer's attribution
+ * but not its logged mark: these calls carry no run identity, so the block executor's line, which
+ * does, must still be written.
  */
 export function toolResultError(label: string, result: ToolResponse): Error {
-  return adoptToolFailure(new Error(`${label}: ${result.error ?? 'unknown error'}`), result)
+  return markFailureKind(
+    new Error(`${label}: ${result.error ?? 'unknown error'}`),
+    classifyFailure(result.output)
+  )
 }

apps/sim/executor/handlers/pi/core/redaction.ts

@@ -1,5 +1,5 @@
 import { getErrorMessage } from '@sim/utils/errors'
-import { inheritFailureMarks } from '@/lib/core/errors/failure-log'
+import { classifyFailure, markFailureKind } from '@/lib/core/errors/failure-log'
 import type { PiEvent } from '@/executor/handlers/pi/core/events'
 
 /**
@@ -38,13 +38,16 @@ export function getScrubbedPiErrorMessage(
 }
 
 /**
- * Creates a boundary-safe error without retaining a potentially secret-bearing cause. The failure
- * marks still cross, so a GitHub tool failure the tool layer logged is not logged again.
+ * Creates a boundary-safe error without retaining a potentially secret-bearing cause. The failure's
+ * attribution still crosses, so a GitHub 404 is not logged as a Sim fault.
  */
 export function createScrubbedPiError(
   error: unknown,
   secrets: readonly string[],
   fallback?: string
 ): Error {
-  return inheritFailureMarks(new Error(getScrubbedPiErrorMessage(error, secrets, fallback)), error)
+  return markFailureKind(
+    new Error(getScrubbedPiErrorMessage(error, secrets, fallback)),
+    classifyFailure(error)
+  )
 }

apps/sim/tools/index.ts

@@ -1156,12 +1156,13 @@ async function readToolResponseBody(
  * is logged: an internal operation's or a Function's body carries the author's data, stdout, and
  * source lines.
  */
-const externalHttpFailures = new WeakSet<Error>()
+const externalHttpFailures = new WeakSet<object>()
 
 function createExternalHttpFailure(errorInfo?: ErrorInfo, extractorId?: string): Error {
   const failure = createTransformedErrorFromErrorInfo(errorInfo, extractorId)
   externalHttpFailures.add(failure)
-  return failure
+  /** An error payload on a 2xx carries no status but is still the provider refusing. */
+  return errorInfo?.status === undefined ? markFailureKind(failure, 'third_party_client') : failure
 }
 
 /**
@@ -2338,9 +2339,7 @@ async function executeToolImplementation(
               : {
                   error: normalizedError.message,
                   stack: error instanceof Error ? error.stack : undefined,
-                  ...(error instanceof Error && externalHttpFailures.has(error)
-                    ? { errorData: error.data }
-                    : {}),
+                  ...(externalHttpFailures.has(error) ? { errorData: error.data } : {}),
                 }),
           },
           resolvedSecretTraceRegistry,
@@ -2843,6 +2842,11 @@ async function executeDeclaredInternalOperation({
   }
 }
 
+/** A tool or proxy URL the author configured that Sim refuses to call; the author's to fix. */
+function invalidToolTarget(message: string): Error {
+  return markFailureKind(new Error(message), 'user')
+}
+
 /** Executes one external tool request with DNS validation and IP pinning. */
 async function executeToolRequest(
   toolId: string,
@@ -2860,7 +2864,7 @@ async function executeToolRequest(
     const targetsThisSimInstance = isSelfOriginUrl(fullUrl)
 
     if (targetsThisSimInstance && tool.request.allowSameOrigin !== true) {
-      throw new Error(SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE)
+      throw invalidToolTarget(SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE)
     }
 
     if (targetsThisSimInstance) {
@@ -2892,14 +2896,14 @@ async function executeToolRequest(
       try {
         const urlValidation = await validateUrlWithDNS(fullUrl, 'toolUrl', 'requestTarget')
         if (!urlValidation.isValid) {
-          throw new Error(`Invalid tool URL: ${urlValidation.error}`)
+          throw invalidToolTarget(`Invalid tool URL: ${urlValidation.error}`)
         }
 
         let proxyOption: string | undefined
         if (requestParams.proxyUrl) {
           const proxyValidation = await validateAndPinProxyUrl(requestParams.proxyUrl)
           if (!proxyValidation.isValid) {
-            throw new Error(`Invalid proxy URL: ${proxyValidation.error}`)
+            throw invalidToolTarget(`Invalid proxy URL: ${proxyValidation.error}`)
           }
           proxyOption = proxyValidation.pinnedProxyUrl
         }
@@ -2920,7 +2924,7 @@ async function executeToolRequest(
               ? undefined
               : (redirectUrl) => {
                   if (isSelfOriginUrl(redirectUrl)) {
-                    throw new Error(SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE)
+                    throw invalidToolTarget(SAME_ORIGIN_EXTERNAL_TOOL_ERROR_MESSAGE)
                   }
                 },
         })
@@ -3314,6 +3318,13 @@ async function executeMcpTool(
     const endTimeISO = endTime.toISOString()
     const duration = endTime.getTime() - new Date(actualStartTime).getTime()
 
+    /** These lines replace the block executor's, so they carry the run identity themselves. */
+    const blockId = toRecord(params._context).blockId
+    const runIdentity = {
+      workflowId: context?.workflowId,
+      executionId: context?.executionId,
+      blockId: typeof blockId === 'string' ? blockId : undefined,
+    }
     const errorMsg = toError(error).message
     if (isBodySizeLimitError(errorMsg)) {
       const failure = bodySizeLimitError()
@@ -3322,14 +3333,14 @@ async function executeMcpTool(
         `[${actualRequestId}] Request body size limit exceeded for mcp:${toolId}:`,
         failure,
         {
-          metadata: () =>
-            projectToolLogMetadata(
+          metadata: () => ({
+            ...runIdentity,
+            ...projectToolLogMetadata(
               { originalError: errorMsg },
               context?.resolvedSecretTraceRegistry,
-              {
-                hasOriginalError: errorMsg.length > 0,
-              }
+              { hasOriginalError: errorMsg.length > 0 }
             ),
+          }),
         }
       )
       return {
@@ -3346,8 +3357,9 @@ async function executeMcpTool(
 
     const normalizedError = toError(error)
     logFailureOnce(logger, `[${actualRequestId}] Error executing MCP tool ${toolId}:`, error, {
-      metadata: () =>
-        projectToolLogMetadata(
+      metadata: () => ({
+        ...runIdentity,
+        ...projectToolLogMetadata(
           {
             error: normalizedError.message,
             stack: error instanceof Error ? error.stack : undefined,
@@ -3358,6 +3370,7 @@ async function executeMcpTool(
             hasStack: Boolean(error instanceof Error && error.stack),
           }
         ),
+      }),
     })
 
     const errorMessage = getErrorMessage(error, `Failed to execute MCP tool ${toolId}`)