fix(sanitization): secret exposure in function and agent trace spans (#6000)

* fix trace span secret sanitization

* sanitize workflow output logs

* preserve streaming usage estimates

* Fix logging session test after staging merge

* secrets sanitization correctness

* fix(execution): address review regressions

* fix(execution): harden secret trace provenance

* fix(execution): preserve functional state during trace projection

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Mac.localdomain>
Co-authored-by: Vikhyath Mondreti <vikhyath@simstudio.ai>

packages/testing/src/mocks/environment-utils.mock.test.ts

@@ -24,6 +24,14 @@ describe('environment-utils mock', () => {
       conflicts: [],
       decryptionFailures: [],
     })
+    await expect(environmentUtilsMock.getEffectiveEnvironmentSnapshot('user-1')).resolves.toEqual({
+      personalEncrypted: {},
+      workspaceEncrypted: {},
+      personalDecrypted: {},
+      workspaceDecrypted: {},
+      conflicts: [],
+      decryptionFailures: [],
+    })
     await expect(environmentUtilsMock.upsertPersonalEnvVars('user-1', {})).resolves.toEqual({
       added: [],
       updated: [],

packages/testing/src/mocks/environment-utils.mock.ts

@@ -36,6 +36,9 @@ export const environmentUtilsMockFns = {
   mockGetPersonalAndWorkspaceEnv: vi
     .fn()
     .mockImplementation(async () => emptyPersonalAndWorkspaceEnv()),
+  mockGetEffectiveEnvironmentSnapshot: vi
+    .fn()
+    .mockImplementation(async () => emptyPersonalAndWorkspaceEnv()),
   mockUpsertPersonalEnvVars: vi.fn().mockResolvedValue({ added: [], updated: [] }),
   mockUpsertWorkspaceEnvVars: vi.fn().mockResolvedValue([]),
   mockGetEffectiveDecryptedEnv: vi.fn().mockResolvedValue({}),
@@ -52,6 +55,9 @@ export function resetEnvironmentUtilsMock(): void {
   environmentUtilsMockFns.mockGetPersonalAndWorkspaceEnv
     .mockReset()
     .mockImplementation(async () => emptyPersonalAndWorkspaceEnv())
+  environmentUtilsMockFns.mockGetEffectiveEnvironmentSnapshot
+    .mockReset()
+    .mockImplementation(async () => emptyPersonalAndWorkspaceEnv())
   environmentUtilsMockFns.mockUpsertPersonalEnvVars
     .mockReset()
     .mockResolvedValue({ added: [], updated: [] })
@@ -73,6 +79,7 @@ export const environmentUtilsMock = {
     environmentUtilsMockFns.mockInvalidateEffectiveDecryptedEnvCache,
   getEnvironmentVariableKeys: environmentUtilsMockFns.mockGetEnvironmentVariableKeys,
   getPersonalAndWorkspaceEnv: environmentUtilsMockFns.mockGetPersonalAndWorkspaceEnv,
+  getEffectiveEnvironmentSnapshot: environmentUtilsMockFns.mockGetEffectiveEnvironmentSnapshot,
   upsertPersonalEnvVars: environmentUtilsMockFns.mockUpsertPersonalEnvVars,
   upsertWorkspaceEnvVars: environmentUtilsMockFns.mockUpsertWorkspaceEnvVars,
   getEffectiveDecryptedEnv: environmentUtilsMockFns.mockGetEffectiveDecryptedEnv,