fix(custom-blocks): require curated outputs instead of exposing the whole result

Author: TheodoreSpeaks

apps/sim/blocks/custom/build-config.test.ts

@@ -94,15 +94,18 @@ describe('buildCustomBlockConfig', () => {
     expect(findSub(config, 'docs')?.multiple).toBe(true)
   })
 
-  it('exposes the full result and hides plumbing when no outputs are curated', () => {
+  it('advertises no data fields — and no whole-result fallback — without curation', () => {
     const config = buildCustomBlockConfig(row, fields, { icon })
+    // Curation is required at publish, so an uncurated row exposes only the
+    // system fields. `result` must not come back: it would advertise the child's
+    // raw terminal state (agent toolCalls/thinking, nested workflow ids).
     expect(Object.keys(config.outputs).sort()).toEqual([
       'error',
       'errorRef',
       'errorType',
-      'result',
       'success',
     ])
+    expect(config.outputs.result).toBeUndefined()
     expect(config.outputs.childWorkflowId).toBeUndefined()
     expect(config.outputs.childTraceSpans).toBeUndefined()
   })

apps/sim/blocks/custom/build-config.ts

@@ -212,12 +212,12 @@ function buildOutputs(exposed: CustomBlockOutput[] | undefined): BlockConfig['ou
     errorType: { type: 'string', description: 'Machine-readable failure class' },
     errorRef: { type: 'string', description: 'Opaque reference to the failed run' },
   }
-  if (exposed && exposed.length > 0) {
-    for (const out of exposed) {
-      outputs[out.name] = { type: 'json', description: `Output: ${out.path}` }
-    }
-  } else {
-    outputs.result = { type: 'json', description: 'Workflow execution result' }
+  // No whole-`result` fallback: curation is required at publish, so every
+  // consumer-visible field is one the publisher chose. A legacy row with no
+  // curated outputs advertises no data fields and fails loudly at invocation
+  // rather than silently reverting to exposing the child's raw terminal state.
+  for (const out of exposed ?? []) {
+    outputs[out.name] = { type: 'json', description: `Output: ${out.path}` }
   }
   return outputs
 }

apps/sim/executor/handlers/workflow/workflow-handler.test.ts

@@ -456,7 +456,7 @@ describe('WorkflowBlockHandler', () => {
         workflowId: 'source-workflow-id',
         organizationId: 'org-1',
         ownerUserId: 'owner-9',
-        exposedOutputs: [],
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
         requiredInputIds: [],
       })
       mockGetPersonalAndWorkspaceEnv.mockResolvedValue({
@@ -519,7 +519,7 @@ describe('WorkflowBlockHandler', () => {
         workflowId: 'source-workflow-id',
         organizationId: 'org-1',
         ownerUserId: 'owner-9',
-        exposedOutputs: [],
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
         requiredInputIds: [],
       })
       mockGetPersonalAndWorkspaceEnv.mockResolvedValue({
@@ -620,7 +620,7 @@ describe('WorkflowBlockHandler', () => {
         workflowId: 'source-workflow-id',
         organizationId: 'org-1',
         ownerUserId: 'owner-9',
-        exposedOutputs: [],
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
         requiredInputIds: [],
       })
       mockGetPersonalAndWorkspaceEnv.mockResolvedValue({
@@ -1038,7 +1038,7 @@ describe('WorkflowBlockHandler', () => {
         workflowId: 'source-workflow-id',
         organizationId: 'org-1',
         ownerUserId: 'owner-9',
-        exposedOutputs: [],
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
         requiredInputIds: [],
       })
       mockGetPersonalAndWorkspaceEnv.mockResolvedValue({
@@ -1285,6 +1285,26 @@ describe('WorkflowBlockHandler', () => {
       expect(error.childWorkflowName).toBe('Published Block')
     })
 
+    it('fails loudly on a legacy row with no curated outputs', async () => {
+      // Curation is required at publish; a pre-rule row must not silently fall
+      // back to exposing the child's raw terminal state.
+      mockGetCustomBlockAuthority.mockResolvedValue({
+        workflowId: 'source-workflow-id',
+        organizationId: 'org-1',
+        ownerUserId: 'owner-9',
+        exposedOutputs: [],
+        requiredInputIds: [],
+      })
+
+      const error = await handler
+        .execute(customBlockContext(), customBlock(), {})
+        .catch((e: any) => e)
+
+      expect(error.consumerFacing.errorType).toBe('unavailable')
+      expect(error.message).toContain('re-publish')
+      expect(mockExecutorExecute).not.toHaveBeenCalled()
+    })
+
     it('classifies an unavailable block so consumers can branch on it', async () => {
       mockGetCustomBlockAuthority.mockResolvedValue(null)
 
@@ -1328,7 +1348,7 @@ describe('WorkflowBlockHandler', () => {
         workflowId: 'source-workflow-id',
         organizationId: 'org-1',
         ownerUserId: 'owner-9',
-        exposedOutputs: [],
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
         requiredInputIds: ['field-1'],
       })
       mockFetch.mockImplementation(async (url: unknown) => {
@@ -1429,13 +1449,15 @@ describe('WorkflowBlockHandler', () => {
       expect(result.cost).toBeUndefined()
     })
 
-    it('exposes the whole child result when no outputs are curated', () => {
+    it('never dumps the child result when no outputs are curated', () => {
+      // Curation is required at publish and guarded at invocation, so this path
+      // is unreachable in production — but it must not fall back to exposing the
+      // terminal block's raw state (agent toolCalls/thinking, nested workflow
+      // ids) if it is ever reached.
       const result = (handler as any).projectCustomBlockOutput(childResult, [])
 
-      expect(result).toEqual({
-        success: true,
-        result: { data: 'whole result' },
-      })
+      expect(result).toEqual({ success: true })
+      expect((result as any).result).toBeUndefined()
     })
   })
 })

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -219,6 +219,22 @@ export class WorkflowBlockHandler implements BlockHandler {
       loadUserId = authority.ownerUserId
       exposedOutputs = authority.exposedOutputs
       requiredInputIds = authority.requiredInputIds
+
+      // Curation is required at publish, so this only trips on a row that
+      // predates that rule. Fail loudly rather than fall back to exposing the
+      // child's raw terminal state, which is what the boundary exists to stop.
+      if (exposedOutputs.length === 0) {
+        throw this.buildBoundaryFailure(
+          new BoundarySafeError({
+            errorType: 'unavailable',
+            message:
+              'This custom block exposes no outputs. Its publisher must re-publish it with at least one output selected.',
+          }),
+          block,
+          instanceId,
+          undefined
+        )
+      }
     }
 
     if (!workflowId) {
@@ -1126,19 +1142,20 @@ export class WorkflowBlockHandler implements BlockHandler {
   }
 
   /**
-   * Shape a custom block's successful output. With curated `exposedOutputs`, each
-   * maps a child block output (blockId + dot-path, read from the child's per-block
-   * logs) to a named top-level field. With none, exposes the child's whole
-   * `result`. Never leaks child workflow id/name/trace spans — nor its cost, which
+   * Shape a custom block's successful output: each curated `exposedOutput` maps a
+   * child block output (blockId + dot-path, read from the child's per-block logs)
+   * to a named top-level field.
+   *
+   * Curation is required at publish, so there is no whole-`result` fallback —
+   * that path would hand the consumer the terminal block's raw state, including
+   * an agent's `toolCalls`/`thinkingContent`/`cost` or a nested workflow block's
+   * identifiers. Never leaks child workflow id/name/trace spans, nor cost, which
    * is billed to the source workspace by the child's own logging session.
    */
   private projectCustomBlockOutput(
     executionResult: ExecutionResult,
     exposedOutputs: CustomBlockOutput[]
   ): BlockOutput {
-    if (exposedOutputs.length === 0) {
-      return { success: true, result: executionResult.output ?? {} }
-    }
     const logs = executionResult.logs ?? []
     const output: Record<string, unknown> = {}
     for (const { blockId, path, name } of exposedOutputs) {

apps/sim/lib/api/contracts/custom-blocks.ts

@@ -102,8 +102,17 @@ export const publishCustomBlockBodySchema = z.object({
   iconUrl: iconUrlSchema.optional(),
   /** Per-input placeholder hints keyed by Start field id; the field set itself is always derived from the deployment. */
   inputs: z.array(inputPlaceholderSchema).max(50).optional(),
-  /** Curated outputs; omit/empty to expose the child's whole result. */
-  exposedOutputs: z.array(exposedOutputWriteSchema).max(50).optional(),
+  /**
+   * Curated outputs. REQUIRED: every field a consumer receives must be one the
+   * publisher explicitly chose. There is deliberately no "expose everything"
+   * fallback — the terminal block's raw state carries execution metadata
+   * (an agent's `toolCalls`, `providerTiming.thinkingContent`, `cost`; a nested
+   * workflow block's ids) that would cross the invocation boundary unchosen.
+   */
+  exposedOutputs: z
+    .array(exposedOutputWriteSchema)
+    .min(1, 'Select at least one output to expose to consumers')
+    .max(50),
 })
 
 export type PublishCustomBlockBody = z.input<typeof publishCustomBlockBodySchema>
@@ -120,7 +129,12 @@ export const updateCustomBlockBodySchema = z
     /** A URL (https or internal serve path) sets/replaces the icon; `null` clears it (default icon). */
     iconUrl: iconUrlSchema.nullable().optional(),
     inputs: z.array(inputPlaceholderSchema).max(50).optional(),
-    exposedOutputs: z.array(exposedOutputWriteSchema).max(50).optional(),
+    /** Omit to leave the curated outputs unchanged; never settable to empty. */
+    exposedOutputs: z
+      .array(exposedOutputWriteSchema)
+      .min(1, 'Select at least one output to expose to consumers')
+      .max(50)
+      .optional(),
   })
   .refine((v) => Object.keys(v).length > 0, { message: 'At least one field is required' })
 

apps/sim/lib/copilot/tools/handlers/deployment/custom-block.test.ts

@@ -341,7 +341,11 @@ describe('executeDeployCustomBlock', () => {
     publishCustomBlockMock.mockResolvedValue(publishedBlock)
 
     const result = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'files/icon.png' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'files/icon.png',
+      },
       context
     )
 
@@ -364,7 +368,11 @@ describe('executeDeployCustomBlock', () => {
     publishCustomBlockMock.mockResolvedValue(publishedBlock)
 
     const result = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'https://example.com/icon.png' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'https://example.com/icon.png',
+      },
       context
     )
 
@@ -379,7 +387,11 @@ describe('executeDeployCustomBlock', () => {
     listWorkspaceFilesMock.mockResolvedValue([])
 
     const result = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'files/missing.png' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'files/missing.png',
+      },
       context
     )
 
@@ -390,22 +402,34 @@ describe('executeDeployCustomBlock', () => {
 
   it('rejects non-https icon URL schemes on pass-through', async () => {
     const dataUri = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'data:image/svg+xml;base64,PHN2Zy8+' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'data:image/svg+xml;base64,PHN2Zy8+',
+      },
       context
     )
     expect(dataUri.success).toBe(false)
     expect(dataUri.error).toContain('https')
 
     const plainHttp = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'http://example.com/icon.png' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'http://example.com/icon.png',
+      },
       context
     )
     expect(plainHttp.success).toBe(false)
     expect(publishCustomBlockMock).not.toHaveBeenCalled()
 
     publishCustomBlockMock.mockResolvedValue(publishedBlock)
     const servePath = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: '/api/files/serve/workspace-logos%2Ficon.png' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: '/api/files/serve/workspace-logos%2Ficon.png',
+      },
       context
     )
     expect(servePath.success).toBe(true)
@@ -417,7 +441,11 @@ describe('executeDeployCustomBlock', () => {
     ])
 
     const result = await executeDeployCustomBlock(
-      { name: 'Enrich Lead', iconUrl: 'files/notes.pdf' },
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'answer' }],
+        iconUrl: 'files/notes.pdf',
+      },
       context
     )
 
@@ -434,4 +462,12 @@ describe('executeDeployCustomBlock', () => {
     expect(result.success).toBe(false)
     expect(result.error).toContain('organization')
   })
+
+  it('refuses to publish without curated outputs', async () => {
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('exposedOutputs is required')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
 })

apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts

@@ -258,6 +258,17 @@ export async function executeDeployCustomBlock(
           'Workflow must be deployed before publishing as a custom block. Use deploy_api first.',
       }
     }
+    // Curation is required on publish: every consumer-visible field must be one
+    // the publisher chose, since there is no whole-`result` fallback.
+    const exposedOutputs = params.exposedOutputs
+    if (!exposedOutputs || exposedOutputs.length === 0) {
+      return {
+        success: false,
+        error:
+          'exposedOutputs is required: select at least one workflow output to expose to consumers',
+      }
+    }
+
     const block = await publishCustomBlock({
       organizationId,
       workspaceId,
@@ -267,7 +278,7 @@ export async function executeDeployCustomBlock(
       description: description ?? '',
       iconUrl,
       inputs: params.inputs,
-      exposedOutputs: params.exposedOutputs,
+      exposedOutputs,
     })
     recordAudit({
       workspaceId,