feat(engine): Add ActionStatement mask_output flag to redact action results in execution API by daryllimyt · Pull Request #2578 · TracecatHQ/tracecat

daryllimyt · 2026-04-29T16:34:22Z

Motivation

Some actions can return sensitive plaintext (e.g. tokens) and must not be exposed in API responses while still being usable internally by the workflow.
Provide a minimal, boolean-based opt-in on ActionStatement so individual tasks can request redaction without changing runtime dataflow.

Description

Added mask_output: bool = False to ActionStatement in tracecat/dsl/schemas.py to mark actions whose results should be redacted in API responses.
Imported RunActionInput and added _sanitize_action_result(...) in tracecat/workflow/executions/service.py to return "[REDACTED]" for client-facing result assembly when task.mask_output is true.
Applied redaction during compact event assembly by using the raw result for internal metadata extraction but storing a sanitized value in source.action_result for API consumers.

Screens

Screen.Recording.2026-04-30.at.10.37.06.mov

Testing

Ran uv run ruff check tracecat/dsl/schemas.py tracecat/workflow/executions/service.py, which completed successfully.

Codex Task

Summary by cubic

Adds a mask_output flag to ActionStatement and applies structured redaction to action, child workflow, and agent results in both compact and standard execution API responses. Internal data flow, while-loop logic, and response shapes are preserved; only leaf values are replaced with "[REDACTED]".

New Features
- Added mask_output: bool = False to ActionStatement; surfaced in frontend/src/client/schemas.gen.ts and frontend/src/client/types.gen.ts.
- Propagated mask_output through child workflow and agent memos; compact events and event groups store the flag.
- Redaction now applies to both compact and non-compact execution endpoints.
Bug Fixes
- Preserve redaction metadata when building compact events from scheduled activities and initiated child workflows.
- Redact only leaf values while keeping dict/list/tuple shape; use raw results for metadata and while-loop control.

^{Written for commit d4fa7f9. Summary will update on new commits. Review in cubic}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0d6a6bdb48

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

zeropath-ai · 2026-04-29T16:37:34Z

✅ No security or compliance issues detected. Reviewed everything up to b8198c9.

Security Overview

🔎 Scanned files: 14 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=e3b1a5b0-1d2b-49f8-914c-70d8c160d321&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► docs/automations/actions.mdx Add documentation for `mask_output` feature ► docs/automations/core-concepts/workflow-definition.mdx Add `mask_output` field description to ResponseField ► docs/automations/workflows.mdx Add explanation of `mask_output` in workflow execution views ► frontend/src/client/schemas.gen.ts Add `mask_output` field to ActionStatement schema ► frontend/src/client/types.gen.ts Add `mask_output` property to ActionStatement type ► tests/unit/test_dsl_converter.py Add tests for AgentActionMemo and ChildWorkflowMemo with mask_output ► tests/unit/test_workflow_execution_object_resolution.py Add tests for get_external_action_result and get_collection_page with mask_output ► tests/unit/test_workflow_executions.py Add tests for masking results in compact and non-compact event views Add tests for preserving object shape with mask_output Add tests for preserving Python container shape with mask_output ► tracecat/dsl/common.py Add `mask_output` field to AgentActionMemo and ChildWorkflowMemo Implement parsing of `mask_output` from Temporal memo for ChildWorkflowMemo ► tracecat/dsl/schemas.py Add `mask_output` field to ActionStatement model ► tracecat/dsl/workflow.py Pass `mask_output` to memo creation for child workflows and agents ► tracecat/workflow/executions/router.py Handle `WorkflowExecutionResultMaskedError` in API routes ► tracecat/workflow/executions/schemas.py Add default values and error handling for parsing memo fields related to masking Add helper functions for default memo parsing
Configuration changes	► frontend/src/client/schemas.gen.ts Set default value for `mask_output` to false

cubic-dev-ai

1 issue found across 2 files

Confidence score: 2/5

There is a high-confidence, high-severity regression in tracecat/workflow/executions/service.py: compact execution responses appear to bypass masking because the redaction path expects RunActionInput but receives task.args dicts.
This creates meaningful user-impact risk (potential exposure of unmasked action input data), which makes this risky to merge until the redaction logic handles compact event payloads correctly.
Pay close attention to tracecat/workflow/executions/service.py - compact event action_input shape mismatch is preventing expected redaction.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/executions/service.py">

<violation number="1" location="tracecat/workflow/executions/service.py:160">
P1: Masking is effectively bypassed in compact execution responses because the new redaction check expects `RunActionInput`, while compact events store `action_input` as `task.args` dict.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c16a6f1e7c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4fa7f9038

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

1 issue found across 6 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/executions/schemas.py">

<violation number="1" location="tracecat/workflow/executions/schemas.py:468">
P3: Use bare `raise` instead of `raise e` so the original traceback is preserved.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f55f3f5f00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/executions/service.py">

<violation number="1" location="tracecat/workflow/executions/service.py:941">
P2: Parsing scheduled events for mask metadata is unguarded; an unexpected child workflow type can raise and fail object-result retrieval.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 94a21388c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

3 issues found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/executions/service.py">

<violation number="1" location="tracecat/workflow/executions/service.py:945">
P2: Catching `Exception` here and defaulting to `masked` swallows unexpected failures, which can hide real parsing/runtime regressions and bypass centralized error translation.

(Based on your team's feedback about broad exception handling in services.) [FEEDBACK_USED]</violation>
</file>

<file name="tracecat/workflow/executions/schemas.py">

<violation number="1" location="tracecat/workflow/executions/schemas.py:109">
P1: This fallback fails open on memo parse errors by defaulting `mask_output` to `False`, which can expose unredacted child-workflow results in execution API responses.</violation>

<violation number="2" location="tracecat/workflow/executions/schemas.py:119">
P1: This fallback also defaults `mask_output` to `False` on parse errors, which can leak unredacted agent action results to clients.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

cubic-dev-ai

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/workflow/executions/service.py">

<violation number="1" location="tracecat/workflow/executions/service.py:181">
P2: `model_dump(mode="json")` in the redaction path can raise serialization errors and alter container shape (e.g., tuple→list). Use Python mode here so redaction remains shape-preserving and robust for arbitrary `BaseModel` fields.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

jordan-umusu

LGTM

daryllimyt added the codex label Apr 29, 2026 — with ChatGPT Codex Connector

daryllimyt temporarily deployed to internal-registry-ci April 29, 2026 16:34 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py Outdated

cubic-dev-ai Bot reviewed Apr 29, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py Outdated

This comment has been minimized.

Sign in to view

daryllimyt temporarily deployed to internal-registry-ci April 29, 2026 19:07 — with GitHub Actions Inactive

daryllimyt temporarily deployed to internal-registry-ci April 29, 2026 19:16 — with GitHub Actions Inactive

daryllimyt changed the title ~~Add ActionStatement mask_output flag to redact action results in execution API~~ feat(engine): Add ActionStatement mask_output flag to redact action results in execution API Apr 30, 2026

daryllimyt added 3 commits April 29, 2026 20:19

Add action output masking flag for execution responses

3387331

fix: preserve mask output metadata in compact events

a406701

fix: redact masked action result leaves

c16a6f1

daryllimyt force-pushed the codex/add-flag-to-mask-actionstatement-return-value branch from 122113f to c16a6f1 Compare April 30, 2026 00:19

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 00:19 — with GitHub Actions Inactive

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 00:20 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py

daryllimyt added 2 commits April 29, 2026 22:52

fix: propagate child workflow output masking

1cc0d51

fix: mask non-compact execution results

d4fa7f9

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 02:54 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/schemas.py Outdated

daryllimyt added 2 commits April 30, 2026 10:21

fix: enforce mask_output for execution objects

209bdaa

fix: preserve memo parsing tracebacks

f55f3f5

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 14:23 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/schemas.py Outdated

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py Outdated

docs: clarify masked action outputs

e30554c

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 14:55 — with GitHub Actions Inactive

daryllimyt added 2 commits April 30, 2026 11:08

fix: tolerate malformed execution memos

bd34ae3

fix: fail closed on mask metadata errors

94a2138

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 15:09 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/schemas.py Outdated

Comment thread tracecat/workflow/executions/schemas.py Outdated

Comment thread tracecat/workflow/executions/service.py Outdated

daryllimyt requested a review from jordan-umusu April 30, 2026 15:17

daryllimyt added 4 commits April 30, 2026 11:40

fix: preserve masked object result shape

4356c6f

fix: mask child workflow memo fallback

1402b56

fix: mask agent memo fallback

d0b0f2d

fix: narrow mask metadata error handling

17a1379

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 15:46 — with GitHub Actions Inactive

cubic-dev-ai Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread tracecat/workflow/executions/service.py Outdated

fix: preserve model container shape during redaction

b8198c9

daryllimyt temporarily deployed to internal-registry-ci April 30, 2026 16:02 — with GitHub Actions Inactive

jordan-umusu approved these changes Apr 30, 2026

View reviewed changes

daryllimyt merged commit 3c6887d into main Apr 30, 2026
21 checks passed

daryllimyt deleted the codex/add-flag-to-mask-actionstatement-return-value branch April 30, 2026 16:09

Conversation

daryllimyt commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Description

Screens

Testing

Summary by cubic

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

zeropath-ai Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jordan-umusu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

daryllimyt commented Apr 29, 2026 •

edited

Loading

zeropath-ai Bot commented Apr 29, 2026 •

edited

Loading