fix(worker): gate temporal activity diagnostics

worker/src/temporal/activities/__tests__/secret-resolver.test.ts

@@ -71,22 +71,36 @@ function createComponent(opts: {
 
 describe('resolveSecretInputOverrides', () => {
   it('resolves a secret-type input override via secrets.get()', async () => {
+    const previousDebugValue = process.env.SENTRIS_DEBUG_WORKFLOW;
+    const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const secrets = createMockSecrets({ 'secret-id-1': 'my-api-key' });
     const component = createComponent({
       inputPorts: [{ id: 'apiKey', editor: 'secret' }],
     });
 
-    const inputs: Record<string, unknown> = {};
-    const overrides = { apiKey: 'secret-id-1' };
+    try {
+      delete process.env.SENTRIS_DEBUG_WORKFLOW;
 
-    await resolveSecretInputOverrides(inputs, overrides, {
-      secrets,
-      component,
-      resolvedParams: {},
-    });
+      const inputs: Record<string, unknown> = {};
+      const overrides = { apiKey: 'secret-id-1' };
 
-    expect(inputs.apiKey).toBe('my-api-key');
-    expect(secrets.get).toHaveBeenCalledWith('secret-id-1');
+      await resolveSecretInputOverrides(inputs, overrides, {
+        secrets,
+        component,
+        resolvedParams: {},
+      });
+
+      expect(inputs.apiKey).toBe('my-api-key');
+      expect(secrets.get).toHaveBeenCalledWith('secret-id-1');
+      expect(consoleSpy).not.toHaveBeenCalled();
+    } finally {
+      consoleSpy.mockRestore();
+      if (previousDebugValue === undefined) {
+        delete process.env.SENTRIS_DEBUG_WORKFLOW;
+      } else {
+        process.env.SENTRIS_DEBUG_WORKFLOW = previousDebugValue;
+      }
+    }
   });
 
   it('leaves non-secret input overrides untouched', async () => {
@@ -267,23 +281,37 @@ describe('resolveSecretInputOverrides', () => {
 
 describe('resolveSecretParams', () => {
   it('resolves secret-type parameter and writes to params', async () => {
+    const previousDebugValue = process.env.SENTRIS_DEBUG_WORKFLOW;
+    const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const secrets = createMockSecrets({ 'param-secret': 'secret-val' });
     const component = createComponent({
       paramPorts: [{ id: 'password', editor: 'secret' }],
     });
 
-    const params: Record<string, unknown> = {};
+    try {
+      delete process.env.SENTRIS_DEBUG_WORKFLOW;
 
-    await resolveSecretParams(
-      params,
-      { password: 'param-secret' },
-      {
-        secrets,
-        component,
-      },
-    );
+      const params: Record<string, unknown> = {};
 
-    expect(params.password).toBe('secret-val');
+      await resolveSecretParams(
+        params,
+        { password: 'param-secret' },
+        {
+          secrets,
+          component,
+        },
+      );
+
+      expect(params.password).toBe('secret-val');
+      expect(consoleSpy).not.toHaveBeenCalled();
+    } finally {
+      consoleSpy.mockRestore();
+      if (previousDebugValue === undefined) {
+        delete process.env.SENTRIS_DEBUG_WORKFLOW;
+      } else {
+        process.env.SENTRIS_DEBUG_WORKFLOW = previousDebugValue;
+      }
+    }
   });
 
   it('leaves non-secret parameters untouched', async () => {

worker/src/temporal/activities/__tests__/trace.activity.test.ts

@@ -40,14 +40,28 @@ describe('recordTraceEventActivity', () => {
   });
 
   it('records trace event via the trace service when initialized', async () => {
+    const previousDebugValue = process.env.SENTRIS_DEBUG_WORKFLOW;
+    const consoleSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
     const trace = createMockTrace();
-    initializeTraceActivity({ trace: trace as any });
 
-    const event = createTraceEvent({ type: 'NODE_COMPLETED', nodeRef: 'node-2' });
-    await recordTraceEventActivity(event);
+    try {
+      delete process.env.SENTRIS_DEBUG_WORKFLOW;
+      initializeTraceActivity({ trace: trace as any });
+
+      const event = createTraceEvent({ type: 'NODE_COMPLETED', nodeRef: 'node-2' });
+      await recordTraceEventActivity(event);
 
-    expect(trace.record).toHaveBeenCalledTimes(1);
-    expect(trace.record).toHaveBeenCalledWith(event);
+      expect(trace.record).toHaveBeenCalledTimes(1);
+      expect(trace.record).toHaveBeenCalledWith(event);
+      expect(consoleSpy).not.toHaveBeenCalled();
+    } finally {
+      consoleSpy.mockRestore();
+      if (previousDebugValue === undefined) {
+        delete process.env.SENTRIS_DEBUG_WORKFLOW;
+      } else {
+        process.env.SENTRIS_DEBUG_WORKFLOW = previousDebugValue;
+      }
+    }
   });
 
   it('records different event types correctly', async () => {

worker/src/temporal/activities/secret-resolver.ts

@@ -12,6 +12,7 @@ import {
   type ComponentPortMetadata,
   type ISecretsService,
 } from '@sentris/component-sdk';
+import { workflowDiagnosticLog } from '../workflow-diagnostics';
 
 /**
  * Resolve secret references found in `inputOverrides` and write the
@@ -67,11 +68,13 @@ export async function resolveSecretInputOverrides(
 
     // This is a secret reference, resolve it
     try {
-      console.log(`[Activity] Resolving secret reference for input '${key}'...`);
+      workflowDiagnosticLog(`[Activity] Resolving secret reference for input '${key}'...`);
       const resolved = await secrets.get(value);
       if (resolved?.value) {
         inputs[key] = resolved.value;
-        console.log(`[Activity] Successfully resolved secret reference for input '${key}'`);
+        workflowDiagnosticLog(
+          `[Activity] Successfully resolved secret reference for input '${key}'`,
+        );
       } else {
         console.warn(`[Activity] Secret reference not found in store for input '${key}'`);
       }
@@ -121,11 +124,13 @@ export async function resolveSecretParams(
     }
 
     try {
-      console.log(`[Activity] Resolving secret reference for param '${key}'...`);
+      workflowDiagnosticLog(`[Activity] Resolving secret reference for param '${key}'...`);
       const resolved = await secrets.get(value);
       if (resolved?.value) {
         params[key] = resolved.value;
-        console.log(`[Activity] Successfully resolved secret reference for param '${key}'`);
+        workflowDiagnosticLog(
+          `[Activity] Successfully resolved secret reference for param '${key}'`,
+        );
       } else {
         console.warn(`[Activity] Secret reference not found in store for param '${key}'`);
       }

worker/src/temporal/activities/trace.activity.ts

@@ -1,4 +1,5 @@
 import type { ITraceService, TraceEvent } from '@sentris/component-sdk';
+import { workflowDiagnosticLog } from '../workflow-diagnostics';
 
 // Trace service instance will be injected at runtime
 let trace: ITraceService | undefined;
@@ -20,5 +21,5 @@ export async function recordTraceEventActivity(event: TraceEvent): Promise<void>
   }
 
   trace.record(event);
-  console.log(`[TraceActivity] Recorded event ${event.type} for ${event.nodeRef}`);
+  workflowDiagnosticLog(`[TraceActivity] Recorded event ${event.type} for ${event.nodeRef}`);
 }