Add opt-in decryption for CLI and web observability by TooTallNate · Pull Request #1000 · vercel/workflow

TooTallNate · 2026-02-11T05:23:53Z

Summary

Adds encryption-aware observability so users can view encrypted workflow data in the CLI and web UI:

CLI

--decrypt flag for workflow inspect commands
EncryptedDataRef with util.inspect.custom for styled encrypted data display
Fetches WorkflowRun for key resolution, caches per runId

Web UI

getEncryptionKeyForRun RPC endpoint with client-side importKey() decryption
Decrypt button in title bar with hover tooltip explaining scope
Auto-decrypt expanded event data when encryption key becomes available
Encrypted marker objects with named constructors and Lucide Lock icon in DataInspector
Encryption key lifted to run-level state for consistent decrypt across all tabs

Shared

hydrateResourceIOWithKey() for browser-side decryption
Event data encryption support across step, hook, and sleep resource types

vercel · 2026-02-11T05:23:58Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
example-nextjs-workflow-turbopack	Ready	Preview, Comment	Feb 19, 2026 5:14pm
example-nextjs-workflow-webpack	Ready	Preview, Comment	Feb 19, 2026 5:14pm
example-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-astro-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-express-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-fastify-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-hono-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-nitro-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-nuxt-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-sveltekit-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-vite-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workflow-docs	Ready	Preview, Comment, Open in v0	Feb 19, 2026 5:14pm
workflow-nest	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workflow-swc-playground	Ready	Preview, Comment	Feb 19, 2026 5:14pm

github-actions · 2026-02-11T05:24:01Z

🧪 E2E Test Results

❌ Some tests failed

Summary

	Passed	Failed	Skipped	Total
✅ ▲ Vercel Production	534	0	38	572
✅ 💻 Local Development	556	0	68	624
✅ 📦 Local Production	556	0	68	624
✅ 🐘 Local Postgres	556	0	68	624
✅ 🪟 Windows	49	0	3	52
❌ 🌍 Community Worlds	110	46	9	165
✅ 📋 Other	135	0	21	156
Total	2496	46	275	2817

❌ Failed Tests

🌍 Community Worlds (46 failed)

mongodb (1 failed):

webhookWorkflow

turso (45 failed):

addTenWorkflow
addTenWorkflow
should work with react rendering in step
promiseAllWorkflow
promiseRaceWorkflow
promiseAnyWorkflow
hookWorkflow
webhookWorkflow
sleepingWorkflow
parallelSleepWorkflow
nullByteWorkflow
workflowAndStepMetadataWorkflow
fetchWorkflow
promiseRaceStressTestWorkflow
error handling error propagation workflow errors nested function calls preserve message and stack trace
error handling error propagation workflow errors cross-file imports preserve message and stack trace
error handling error propagation step errors basic step error preserves message and stack trace
error handling error propagation step errors cross-file step error preserves message and function names in stack
error handling retry behavior regular Error retries until success
error handling retry behavior FatalError fails immediately without retries
error handling retry behavior RetryableError respects custom retryAfter delay
error handling retry behavior maxRetries=0 disables retries
error handling retry behavior workflow completes despite transient 5xx on step_completed
error handling catchability FatalError can be caught and detected with FatalError.is()
hookCleanupTestWorkflow - hook token reuse after workflow completion
concurrent hook token conflict - two workflows cannot use the same hook token simultaneously
stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
closureVariableWorkflow - nested step functions with closure variables
spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
health check (queue-based) - workflow and step endpoints respond to health check messages
pathsAliasWorkflow - TypeScript path aliases resolve correctly
Calculator.calculate - static workflow method using static step methods from another class
AllInOneService.processNumber - static workflow method using sibling static step methods
ChainableService.processWithThis - static step methods using this to reference the class
thisSerializationWorkflow - step function invoked with .call() and .apply()
customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE
instanceMethodStepWorkflow - instance methods with "use step" directive
crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context
stepFunctionAsStartArgWorkflow - step function reference passed as start() argument
cancelRun - cancelling a running workflow
cancelRun via CLI - cancelling a running workflow
pages router addTenWorkflow via pages router
pages router promiseAllWorkflow via pages router
pages router sleepingWorkflow via pages router

Details by Category

✅ ▲ Vercel Production

App	Passed	Skipped
✅ astro	48	4
✅ example	48	4
✅ express	48	4
✅ fastify	48	4
✅ hono	48	4
✅ nextjs-turbopack	51	1
✅ nextjs-webpack	51	1
✅ nitro	48	4
✅ nuxt	48	4
✅ sveltekit	48	4
✅ vite	48	4

✅ 💻 Local Development

App	Passed	Skipped
✅ astro-stable	45	7
✅ express-stable	45	7
✅ fastify-stable	45	7
✅ hono-stable	45	7
✅ nextjs-turbopack-canary	49	3
✅ nextjs-turbopack-stable	49	3
✅ nextjs-webpack-canary	49	3
✅ nextjs-webpack-stable	49	3
✅ nitro-stable	45	7
✅ nuxt-stable	45	7
✅ sveltekit-stable	45	7
✅ vite-stable	45	7

✅ 📦 Local Production

App	Passed	Skipped
✅ astro-stable	45	7
✅ express-stable	45	7
✅ fastify-stable	45	7
✅ hono-stable	45	7
✅ nextjs-turbopack-canary	49	3
✅ nextjs-turbopack-stable	49	3
✅ nextjs-webpack-canary	49	3
✅ nextjs-webpack-stable	49	3
✅ nitro-stable	45	7
✅ nuxt-stable	45	7
✅ sveltekit-stable	45	7
✅ vite-stable	45	7

✅ 🐘 Local Postgres

App	Passed	Skipped
✅ astro-stable	45	7
✅ express-stable	45	7
✅ fastify-stable	45	7
✅ hono-stable	45	7
✅ nextjs-turbopack-canary	49	3
✅ nextjs-turbopack-stable	49	3
✅ nextjs-webpack-canary	49	3
✅ nextjs-webpack-stable	49	3
✅ nitro-stable	45	7
✅ nuxt-stable	45	7
✅ sveltekit-stable	45	7
✅ vite-stable	45	7

✅ 🪟 Windows

App	Passed	Failed	Skipped
✅ nextjs-turbopack	49	0	3

❌ 🌍 Community Worlds

App	Passed	Failed	Skipped
✅ mongodb-dev	3	0	0
❌ mongodb	48	1	3
✅ redis-dev	3	0	0
✅ redis	49	0	3
✅ turso-dev	3	0	0
❌ turso	4	45	3

✅ 📋 Other

App	Passed	Skipped
✅ e2e-local-dev-nest-stable	45	7
✅ e2e-local-postgres-nest-stable	45	7
✅ e2e-local-prod-nest-stable	45	7

📋 View full workflow run

TooTallNate · 2026-02-11T05:24:04Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

This stack of pull requests is managed by Graphite. Learn more about stacking.

changeset-bot · 2026-02-11T05:24:13Z

🦋 Changeset detected

Latest commit: 9ef7740

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 15 packages

Name	Type
@workflow/cli	Patch
@workflow/core	Patch
@workflow/web	Patch
@workflow/web-shared	Patch
workflow	Patch
@workflow/world-testing	Patch
@workflow/builders	Patch
@workflow/next	Patch
@workflow/nitro	Patch
@workflow/astro	Patch
@workflow/nest	Patch
@workflow/rollup	Patch
@workflow/sveltekit	Patch
@workflow/vite	Patch
@workflow/nuxt	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

…sts, fix stale comments

…step/hook/sleep callbacks

…ks from step/hook/sleep callbacks" This reverts commit 1ec73ba.

…ent race condition

…r storytime

…ompletion corruption check - Scan-forward consume loop skips past out-of-order events to find ones current subscribers can match, fixing deadlocks from async DB writes - Replace aggressive setTimeout(0) unconsumed check with 1s watchdog timer that only fires on true deadlock (no progress for 1 second) - Add onEventConsumed callback for passive timestamp observation without participating in event matching (replaces timestamp subscriber) - Add post-completion check in runWorkflow: if events remain unconsumed after workflow completes, throw WorkflowRuntimeError (catches duplicate/orphaned events that scan-forward skipped past) - Update all tests for new mechanics (splice-based, watchdog timing, corruption detection via post-completion check)

…display

…flowResourceData

…rRun RPC

…ton click

…eld pollution

…in DataInspector

… collapsed preview

…ution sites

TooTallNate mentioned this pull request Feb 11, 2026

Add AES-256-GCM encryption primitives and HKDF key derivation #956

Merged

vercel Bot deployed to Preview – workflow-swc-playground February 11, 2026 05:24 View deployment

vercel Bot deployed to Preview – workbench-astro-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-vite-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-express-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-nitro-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – example-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-hono-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-sveltekit-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-fastify-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workflow-nest February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workbench-nuxt-workflow February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – example-nextjs-workflow-turbopack February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – example-nextjs-workflow-webpack February 11, 2026 05:25 View deployment

vercel Bot deployed to Preview – workflow-docs February 11, 2026 05:25 View deployment

TooTallNate force-pushed the nate/opt-in-decrypt branch from 7142697 to cfa8bb9 Compare February 11, 2026 09:22

vercel Bot deployed to Preview – workflow-swc-playground February 11, 2026 09:23 View deployment

vercel Bot deployed to Preview – workbench-astro-workflow February 11, 2026 09:24 View deployment

vercel Bot deployed to Preview – workbench-sveltekit-workflow February 11, 2026 09:24 View deployment

vercel Bot deployed to Preview – workbench-vite-workflow February 11, 2026 09:24 View deployment

vercel Bot deployed to Preview – workbench-express-workflow February 11, 2026 09:24 View deployment

vercel Bot deployed to Preview – workbench-hono-workflow February 11, 2026 09:24 View deployment

TooTallNate added 30 commits February 18, 2026 17:02

Fix review comments: cache stream encryption key, remove redundant ca…

65b06ba

…sts, fix stale comments

Trying to clean up some type non-sense

7dfe3f5

Make EventsConsumer async-aware: remove all setTimeout(0) hacks from …

1ec73ba

…step/hook/sleep callbacks

Revert "Make EventsConsumer async-aware: remove all setTimeout(0) hac…

1eff2d5

…ks from step/hook/sleep callbacks" This reverts commit 1ec73ba.

Add failing test: encrypted Promise.all replay triggers unconsumed ev…

0155949

…ent race condition

Fix failing test

02bfd98

.

b8afbd7

Add full encryption test suite to workflow.test.ts and attempt fix fo…

c68e1d9

…r storytime

.

d5e1039

Make decryption an explicit opt-in for o11y tooling

9ff06de

Restore encrypted data handling in o11y hydration layer

18e35f8

Use EncryptedDataRef with util.inspect.custom for CLI encrypted data …

9ad205c

…display

Fix Decrypt button crash: use correct 'refresh' callback from useWork…

2b2d9b6

…flowResourceData

Implement client-side decryption for web o11y with getEncryptionKeyFo…

4fb407d

…rRun RPC

Fix CLI decrypt: fetch WorkflowRun for key resolution, cache per runId

3157a45

Use named constructor pattern for encrypted data display in web o11y

e6a7388

Decrypt event data when encryption key is available after Decrypt but…

6d8bc3e

…ton click

Lift encryption key to run-level state, auto-decrypt on fetch, fix fi…

a07fc21

…eld pollution

Re-load expanded event data when encryption key becomes available

f23c7cb

Consolidate Decrypt to title bar Button, remove sidebar decrypt card

7374cbd

Add hover tooltip to Decrypt button explaining scope and state

7120677

Show flat Encrypted label for encrypted fields, use Lucide Lock icon …

3bfe8ec

…in DataInspector

Render eventData subfields individually to avoid encrypted markers in…

3f10420

… collapsed preview

Revert: render eventData subfields individually

4a0c137

Fix Lock icon vertical alignment in DataInspector encrypted label

fbf470e

update changeset

288691d

Fix loading state never clearing for hook/sleep resource types

7018c6c

Update CLI, web, and stream callers for CryptoKey: importKey at resol…

6766332

…ution sites

Pass teamId to the get-key endpoint

9ef7740

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add opt-in decryption for CLI and web observability#1000

Add opt-in decryption for CLI and web observability#1000
TooTallNate wants to merge 46 commits intonate/wire-encryptionfrom
nate/opt-in-decrypt

TooTallNate commented Feb 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

TooTallNate commented Feb 11, 2026

Uh oh!

changeset-bot Bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

TooTallNate commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

CLI

Web UI

Shared

Uh oh!

vercel Bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 E2E Test Results

Summary

❌ Failed Tests

Details by Category

Uh oh!

TooTallNate commented Feb 11, 2026

Uh oh!

changeset-bot Bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TooTallNate commented Feb 11, 2026 •

edited

Loading

vercel Bot commented Feb 11, 2026 •

edited

Loading

github-actions Bot commented Feb 11, 2026 •

edited

Loading

changeset-bot Bot commented Feb 11, 2026 •

edited

Loading