The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 6, 2026 8:00pm

@greptile review

PR Summary

High Risk
Changes in-flight PII handling on the execution path (inputs, block outputs, resumed state) and raises default Presidio load; mis-tuned concurrency could overload the fleet, but fail-fast throw behavior preserves the prior abort semantics on redaction failure.

Overview
Fixes a PII leak where block outputs (and workflow inputs) already offloaded to large-value refs skipped masking because inline string redaction treats refs as opaque. In-flight stages now run hydrate → mask → re-store refs, then mask inline strings — in block-executor for block outputs and in execution-core for workflow input (resume snapshot block-state re-mask was already on this two-pass model).

redactLargeValueRefs no longer processes payload keys sequentially: it collects all refs once (deduped by identity) and hydrates/masks/re-stores in parallel via resolveReplacements and PII_REF_CONCURRENCY (default 4), with throw-mode still aborting when any ref fails.

Throughput knobs: default app → mask-batch concurrency 4 → 64 (PII_MASK_CHUNK_CONCURRENCY); new PII_REF_CONCURRENCY and PII_SERVICE_CHUNK_CONCURRENCY (Presidio route fan-out, was hardcoded 4). Tests cover multi-key parallel refs and throw-on-partial failure.

^{Reviewed by Cursor Bugbot for commit 0aa7648. Bugbot is set up for automated code reviews on this repo. Configure here.}

Greptile Summary

This PR fixes a correctness gap in PII redaction: block outputs that exceed the large-value threshold are offloaded to object-storage refs before reaching the redactor, and the plain string walk treats a ref as opaque — so PII inside those refs was never masked. The fix adds a redactLargeValueRefs hydrate → mask → re-store pass before the string walk at both the block-output and workflow-input redaction points.

• Bug fix: redactLargeValueRefsInValue is now called ahead of redactObjectStrings in both block-executor.ts and execution-core.ts, ensuring large-value refs are materialized, masked via Presidio, and re-stored before the payload continues downstream.
• Parallelization: resolveReplacements collects all refs across the whole payload in one shared walk, then hydrates/masks/re-stores them in parallel (bounded by PII_REF_CONCURRENCY, default 4) using mapWithConcurrency with a total mapper — satisfying the utility's "fn must not reject" contract by catching per-ref errors and rethrowing the first one only after the pool drains.
• Throughput increase: PII_MASK_CHUNK_CONCURRENCY default raised from 4 → 64 to saturate the load-balanced Presidio fleet behind the internal ALB; env-tunable for single-instance deployments.

Confidence Score: 5/5

The change is safe to merge: the correctness fix is well-scoped, the parallel pool uses a total mapper that correctly defers the abort until after all workers drain, and both new test cases pin the security-critical throw-mode path.

All three call sites follow the same hydrate → mask → re-store ordering. The mapWithConcurrency contract is satisfied — the mapper never rejects; errors are captured and rethrown after the pool completes. The raised CHUNK_CONCURRENCY default is env-tunable and the existing comment explicitly calls out the single-instance tuning knob. No data-path regressions were found.

No files require special attention.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant BE as BlockExecutor / ExecutionCore
    participant LV as redactLargeValueRefsInValue
    participant CR as collectRefs (sync walk)
    participant RR as resolveReplacements (parallel)
    participant S3 as Object Storage
    participant PR as Presidio (maskPIIBatchViaHttp)
    participant RS as redactObjectStrings

    BE->>LV: normalizedOutput (may contain LargeValueRefs)
    LV->>CR: walk payload, collect all refs
    CR-->>LV: refs[]
    LV->>RR: "unique refs, bounded concurrency (PII_REF_CONCURRENCY=4)"
    loop For each ref (parallel)
        RR->>S3: materializeLargeValueRef
        S3-->>RR: materialized value
        RR->>PR: "maskPIIBatchViaHttp (PII_MASK_CHUNK_CONCURRENCY=64)"
        PR-->>RR: masked value
        RR->>S3: compactExecutionPayload (re-store masked)
        S3-->>RR: new LargeValueRef
    end
    RR-->>LV: replacements Map
    LV->>LV: substituteRefs (sync swap)
    LV-->>BE: payload with refs replaced by masked refs
    BE->>RS: redactObjectStrings (mask inline strings)
    RS-->>BE: fully masked output

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant BE as BlockExecutor / ExecutionCore
    participant LV as redactLargeValueRefsInValue
    participant CR as collectRefs (sync walk)
    participant RR as resolveReplacements (parallel)
    participant S3 as Object Storage
    participant PR as Presidio (maskPIIBatchViaHttp)
    participant RS as redactObjectStrings

    BE->>LV: normalizedOutput (may contain LargeValueRefs)
    LV->>CR: walk payload, collect all refs
    CR-->>LV: refs[]
    LV->>RR: "unique refs, bounded concurrency (PII_REF_CONCURRENCY=4)"
    loop For each ref (parallel)
        RR->>S3: materializeLargeValueRef
        S3-->>RR: materialized value
        RR->>PR: "maskPIIBatchViaHttp (PII_MASK_CHUNK_CONCURRENCY=64)"
        PR-->>RR: masked value
        RR->>S3: compactExecutionPayload (re-store masked)
        S3-->>RR: new LargeValueRef
    end
    RR-->>LV: replacements Map
    LV->>LV: substituteRefs (sync swap)
    LV-->>BE: payload with refs replaced by masked refs
    BE->>RS: redactObjectStrings (mask inline strings)
    RS-->>BE: fully masked output

_{Reviews (3): Last reviewed commit: "fix(pii): keep resolveReplacements mappe..." | Re-trigger Greptile}

Greptile Summary

This PR fixes a correctness gap where PII inside large-value refs (function/tool outputs offloaded to object storage before reaching the redactor) was never sent to Presidio, and simultaneously raises throughput by parallelizing ref hydration and increasing the mask-batch chunk concurrency default from 4 to 64.

• Correctness fix: both the block-output and workflow-input redaction stages now run a redactLargeValueRefsInValue pass (hydrate → mask → re-store) before the inline redactObjectStrings walk, closing the gap where opaque refs bypassed PII redaction entirely.
• Parallelization: refs are now collected across the whole payload first and processed in one bounded-concurrency pass (PII_REF_CONCURRENCY, default 4) instead of one sequential pass per payload key, with a shared seen WeakSet preventing duplicate work on refs that appear under multiple keys.
• Concurrency raise: PII_MASK_CHUNK_CONCURRENCY default 4 → 64, sized for a load-balanced Presidio fleet behind an internal ALB; multiplied with REF_CONCURRENCY the new ceiling is 256 concurrent Presidio requests per payload (up from 16).

Confidence Score: 4/5

Safe to merge; the correctness fix is sound and tests cover the critical paths. The one rough edge is a contract tension in the concurrency utility that works today but could surprise a future maintainer.

The hydrate→mask→re-store ordering is correct, the shared seen WeakSet prevents duplicate work, and substituteRefs correctly uses Map identity to swap refs. The one concern worth tracking: resolveReplacements passes a mapper that intentionally throws (in throw mode) to mapWithConcurrency, whose documented contract says fn MUST NOT reject. The behavior is currently correct because Promise.all propagates the rejection as intended, but if mapWithConcurrency is ever changed to isolate per-item errors, the abort-on-failure behavior in throw mode would silently stop working.

apps/sim/lib/logs/execution/pii-large-values.ts — the resolveReplacements + mapWithConcurrency interaction in throw mode is the one area that deserves a second look.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant BE as BlockExecutor
    participant LV as redactLargeValueRefsInValue
    participant OS as Object Storage
    participant PR as Presidio
    participant RS as redactObjectStrings

    BE->>LV: normalizedOutput with large-value refs
    LV->>LV: collectRefs sync walk
    LV->>OS: materializeLargeValueRef parallel x REF_CONCURRENCY
    OS-->>LV: materialized values
    LV->>PR: maskPIIBatchViaHttp parallel chunks x CHUNK_CONCURRENCY
    PR-->>LV: masked values
    LV->>OS: compactExecutionPayload re-store as new ref
    OS-->>LV: new masked LargeValueRef
    LV-->>BE: output with fresh masked refs
    BE->>RS: redactObjectStrings inline strings only
    RS-->>BE: fully masked output
    BE->>BE: compactExecutionPayload final pass

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant BE as BlockExecutor
    participant LV as redactLargeValueRefsInValue
    participant OS as Object Storage
    participant PR as Presidio
    participant RS as redactObjectStrings

    BE->>LV: normalizedOutput with large-value refs
    LV->>LV: collectRefs sync walk
    LV->>OS: materializeLargeValueRef parallel x REF_CONCURRENCY
    OS-->>LV: materialized values
    LV->>PR: maskPIIBatchViaHttp parallel chunks x CHUNK_CONCURRENCY
    PR-->>LV: masked values
    LV->>OS: compactExecutionPayload re-store as new ref
    OS-->>LV: new masked LargeValueRef
    LV-->>BE: output with fresh masked refs
    BE->>RS: redactObjectStrings inline strings only
    RS-->>BE: fully masked output
    BE->>BE: compactExecutionPayload final pass

_{Reviews (2): Last reviewed commit: "perf(pii): mask offloaded refs in block ..." | Re-trigger Greptile}

@greptile review

Both re-raised Greptile P2s are already addressed in 932e2f90d (the re-review re-posted them against the same lines):

1. mapWithConcurrency contract — resolveReplacements now uses a total mapper: it try/catches per-ref errors and records the first, then rethrows after the pool drains (pii-large-values.ts:126–133). The fn no longer rejects, so the util's "fn MUST NOT reject" contract holds, and throw mode still fails fast (an unmaskable ref aborts the run).
2. Multi-ref throw coverage — added aborts (throws) when one of several refs fails in throw mode in pii-large-values.test.ts, which exercises exactly the parallel-pool + PiiRedactionError propagation path.