fix(logs): resolve --field under a withheld --where and mark nested content omissions

Author: waleedlatif1

apps/docs/openapi-v2-logs.json

@@ -1451,7 +1451,7 @@
           "contentWithheld": {
             "type": "boolean",
             "const": true,
-            "description": "Present when the log projection withheld some or all of this span's content (input, output, thinking, error message) because it could not be proven safe to display. Status, timing, and usage remain. A field missing from a span carrying this marker may exist on the run but was not returned."
+            "description": "Present when the log projection withheld some or all of this span's content (input, output, thinking, error message, tool-call or provider-segment content) because it could not be proven safe to display. Status, timing, and usage remain. A field missing from a span carrying this marker may exist on the run but was not returned."
           },
           "toolCalls": {
             "type": "array",

apps/sim/lib/api/contracts/logs.ts

@@ -277,7 +277,7 @@ export const traceSpanSchema: z.ZodType<LogTraceSpan> = z
         contentWithheld: z
           .literal(true)
           .describe(
-            "Present when the log projection withheld some or all of this span's content (input, output, thinking, error message) because it could not be proven safe to display. Status, timing, and usage remain. A field missing from a span carrying this marker may exist on the run but was not returned."
+            "Present when the log projection withheld some or all of this span's content (input, output, thinking, error message, tool-call or provider-segment content) because it could not be proven safe to display. Status, timing, and usage remain. A field missing from a span carrying this marker may exist on the run but was not returned."
           )
           .optional(),
         toolCalls: z.array(toolCallSchema).describe('Tool calls recorded by the span.').optional(),

apps/sim/lib/logs/execution/trace-secret-projection.test.ts

@@ -553,6 +553,33 @@ describe('projectTraceSpansForSecrets', () => {
     expect(intact).not.toHaveProperty('contentWithheld')
   })
 
+  it('marks a span whose tool-call content was omitted', async () => {
+    const [span] = await projectTraceSpansForSecrets(
+      [
+        createSpan({
+          output: { safe: 'keep' },
+          toolCalls: [
+            {
+              name: 'legacy',
+              duration: 1,
+              startTime: '2026-07-01T00:00:00.000Z',
+              endTime: '2026-07-01T00:00:00.001Z',
+              output: { secretval: 1, '{{TOKEN}}': 2 },
+            },
+          ],
+        }),
+      ],
+      {
+        registry: createRegistry([{ plaintext: 'secretval', replacement: '{{TOKEN}}' }]),
+        store: STORE,
+      }
+    )
+
+    expect(span.output).toEqual({ safe: 'keep' })
+    expect(span.toolCalls?.[0]).not.toHaveProperty('output')
+    expect(span.contentWithheld).toBe(true)
+  })
+
   it('fails closed when a later log transform reintroduces an active literal', async () => {
     const source = [createSpan({ output: { apiKey: '[REDACTED]' } })]
 

apps/sim/lib/logs/execution/trace-secret-projection.ts

@@ -82,6 +82,8 @@ interface ProjectionContext {
   sourceLargeValueBytes: number
   storedLargeValueBytes: number
   storedLargeValueCount: number
+  /** Content fields omitted so far; a span compares it across its own fields to set `contentWithheld`. */
+  omittedContentFields: number
 }
 
 interface OversizedHydrationGate {
@@ -162,6 +164,7 @@ function createProjectionContext(
     manifestIds: new WeakMap<object, string>(),
     nextManifestId: 0,
     largeValueCount: 0,
+    omittedContentFields: 0,
     sourceLargeValueBytes: 0,
     storedLargeValueBytes: 0,
     storedLargeValueCount: 0,
@@ -840,6 +843,7 @@ async function sanitizeContentField(
     logger.warn('Omitting trace content that could not be sanitized', {
       failure: describeProjectionFailure(error),
     })
+    context.omittedContentFields += 1
     return OMIT
   }
 }
@@ -959,13 +963,14 @@ async function sanitizeTraceSpan(
   }
 
   let projected = omit(span, ['displayResolvedSecretTraceProvenance']) as TraceSpan
+  const omittedBefore = context.omittedContentFields
 
   for (const key of ['input', 'output', 'thinking', 'errorMessage'] as const) {
     const value = span[key]
     if (value === undefined) continue
     const sanitized = await sanitizeContentField(value, context)
     if (sanitized === OMIT) {
-      projected = { ...(omit(projected, [key]) as TraceSpan), contentWithheld: true }
+      projected = omit(projected, [key]) as TraceSpan
     } else {
       projected[key] = sanitized as never
     }
@@ -993,6 +998,8 @@ async function sanitizeTraceSpan(
     projected.providerTiming = { ...span.providerTiming, segments }
   }
 
+  if (context.omittedContentFields > omittedBefore) projected.contentWithheld = true
+
   assertContentIsSafe(projected, depth)
 
   if (span.children !== undefined) {

apps/sim/lib/logs/types.ts

@@ -309,10 +309,10 @@ export interface TraceSpan {
    */
   childTraceAccess?: 'granted' | 'disabled' | 'missing' | 'truncated'
   /**
-   * Set by secret projection when it omitted one of this span's own content fields
-   * (`input`, `output`, `thinking`, `errorMessage`) it could not prove safe, or reduced
-   * the span to structure only (which also strips tool-call and provider-segment
-   * content). Status, timing, and usage remain. Without it a withheld field is
+   * Set by secret projection when it omitted content it could not prove safe from
+   * this span (`input`, `output`, `thinking`, `errorMessage`, or its tool-call and
+   * provider-segment content), or reduced the span to structure only. Status, timing,
+   * and usage remain. Without it a withheld field is
    * indistinguishable from one the block never produced.
    */
   contentWithheld?: true

apps/sim/lib/mothership/agent-cli/engines.test.ts

@@ -154,6 +154,13 @@ describe('logs query on a span whose content was withheld', () => {
     expect(report.rows[1].note).toMatch(/withheld/)
     expect(report.contentWithheld).toBe(1)
   })
+
+  it('still resolves a readable --field when --where hits withheld content', async () => {
+    const report = await logsQueryWithheld({ field: 'duration', where: 'result.count=6' })
+    expect(report.rows[1]).toMatchObject({ runId: 'run-2', value: 12 })
+    expect(report.rows[1].note).toMatch(/--where/)
+    expect(report.contentWithheld).toBe(1)
+  })
 })
 
 const DEPS_STATE = {

apps/sim/lib/mothership/agent-cli/engines/query.ts

@@ -28,6 +28,8 @@ const PATH_NOT_FOUND_NOTE = 'path not found on span'
  * prove safe to display, so an unresolved content path says nothing about the run.
  */
 const CONTENT_WITHHELD_NOTE = 'span content withheld by the log projection; value unknown'
+const WHERE_WITHHELD_NOTE =
+  'span content withheld by the log projection; --where could not be checked, run kept'
 
 /**
  * Keys that live on the span itself. A path whose head is anything else is read
@@ -205,30 +207,29 @@ export const logsQueryCommand: AgentCliEngine = {
           hits: matches.length,
           blockStatus: last.status ?? 'success',
         }
+        let whereWithheld = false
         if (wherePath) {
           const matched = resolveSpanPathWithFallback(last, wherePath)
           if (matched.resolvedUnder) whereResolvedUnder = matched.resolvedUnder
           // Filtering on a withheld value would silently drop a run that may well match.
-          if (matched.value === undefined && last.contentWithheld) {
-            contentWithheld++
-            return { ...matchedRow, value: null, note: CONTENT_WITHHELD_NOTE }
-          }
-          if (String(matched.value) !== whereValue) {
+          whereWithheld = matched.value === undefined && last.contentWithheld === true
+          if (!whereWithheld && String(matched.value) !== whereValue) {
             filteredOut++
             return undefined
           }
         }
         const resolved = resolveSpanPathWithFallback(last, field)
         if (resolved.resolvedUnder) fieldResolvedUnder = resolved.resolvedUnder
-        if (resolved.value === undefined) {
-          if (last.contentWithheld) contentWithheld++
-          return {
-            ...matchedRow,
-            value: null,
-            note: last.contentWithheld ? CONTENT_WITHHELD_NOTE : PATH_NOT_FOUND_NOTE,
-          }
-        }
-        return { ...matchedRow, value: clipValue(resolved.value) }
+        const fieldWithheld = resolved.value === undefined && last.contentWithheld === true
+        if (whereWithheld || fieldWithheld) contentWithheld++
+        const note = fieldWithheld
+          ? CONTENT_WITHHELD_NOTE
+          : resolved.value === undefined
+            ? PATH_NOT_FOUND_NOTE
+            : whereWithheld
+              ? WHERE_WITHHELD_NOTE
+              : undefined
+        return { ...matchedRow, value: clipValue(resolved.value), ...(note ? { note } : {}) }
       }
     )