improvement(chat): secrets mounting / exposure improvements and controls

[icecrasher321]

Summary

Exposure and scoping of secrets usage for chat agent.

Type of Change

• Other: Security Improvement

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 2, 2026 8:30am

[cursor]

PR Summary

High Risk
Changes span authentication-adjacent secret authorization, Copilot tool confirmation, and workflow execution binding—areas where forged client input or policy mistakes could leak secrets or accept untrusted outcomes.

Overview
Copilot code execution now mounts secrets only when code contains explicit {{KEY}} references and the actor may view the raw value; headless surfaces (Sim Chat, Scheduled Tasks, Inbox) gain All secrets vs Selected secrets policy (default All for compatibility), with UI and API to persist it.

Exposure controls tighten elsewhere: workspace env GET masks other users’ personal secrets unless the viewer is a credential admin; credential list treats owned personal secrets as admin for raw view; Sim Chat secret policy stays in runtime inputs but is stripped from block logs and traces via privateInputIds.

Copilot /api/copilot/confirm is reworked: generic client tool completions are sealed instead of stored verbatim; workflow tool confirmations ignore client payloads and derive structural success/failure from trusted execution logs, with claim binding, idempotent retries, and pre-claim rejection for browser/terminal tools.

Workflow execute can bind copilotToolCallId on interactive SSE Copilot runs (atomic claim, trusted logging correlation, post-execution wait before terminal SSE). Mothership execute keeps secret policy server-only via secretMountPolicy / environmentContext. Function execute scopes selected mounts with safer record access and language-aware {{KEY}} parsing; trace registry pending activations fail projections closed until resolution finishes. New resolved-secret content projection supports masking Copilot-visible tool results.

^{Reviewed by Cursor Bugbot for commit ea06a77. Configure here.}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[greptile-apps]

Greptile Summary

This PR introduces explicit authorization, scoping, propagation, and output-projection controls for secrets used by Copilot code execution.

• Adds all-versus-selected secret policies for scheduled tasks, Inbox, and Mothership execution.
• Restricts plaintext materialization by execution actor, workspace permission, credential role, and explicit code references.
• Carries secret provenance through execution and projects activated values out of Copilot-visible results and logs.
• Adds durable client-tool completion sealing, workflow-confirmation validation, schema migrations, UI controls, documentation, and extensive tests.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains from the available follow-up review context.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/copilot/tools/secret-mount-materializer.server.ts	Adds actor-, workspace-, and credential-aware plaintext secret materialization with bounded, atomic decryption.
apps/sim/lib/copilot/tools/handlers/function-execute.ts	Extracts explicit secret references, applies mount policy, materializes authorized values, and propagates provenance.
apps/sim/executor/utils/resolved-secret-content-projection.ts	Adds non-mutating, fail-closed projection of activated secret values from supported result content.
apps/sim/app/api/copilot/confirm/route.ts	Seals generic client completions and validates workflow confirmations against durable claims and trusted execution state.
apps/sim/lib/workflows/schedules/orchestration.ts	Normalizes and persists scheduled-task secret access policy.
apps/sim/lib/mothership/inbox/executor.ts	Propagates Inbox secret policy while disabling plaintext mounting for external senders.
packages/db/schema.ts	Adds backward-compatible persisted secret-scope and mounted-secret fields for schedules and Inbox configuration.

Sequence Diagram

sequenceDiagram
participant Surface as Chat / Schedule / Inbox
participant Policy as Secret policy
participant Copilot as Copilot lifecycle
participant Tool as Function execution
participant Auth as Secret materializer
participant Exec as Code runtime
participant Projection as Result projection
Surface->>Policy: all or selected secret configuration
Policy->>Copilot: normalized policy and secret actor
Copilot->>Tool: "execute code containing explicit {{KEY}} references"
Tool->>Policy: filter referenced names
Tool->>Auth: authorize actor and requested names
Auth-->>Tool: permitted plaintext values
Tool->>Exec: mount authorized values
Exec-->>Tool: runtime result
Tool->>Projection: result plus activated-secret provenance
Projection-->>Copilot: Copilot-safe projected result

Loading

_{Reviews (6): Last reviewed commit: "fix(copilot): trust compacted workflow c..." | Re-trigger Greptile}

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[icecrasher321]

@greptile

[icecrasher321]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ea06a77. Configure here.}