fix(chat): stop classifying secret-free binary sandbox exports as unknown

apps/sim/app/api/function/execute/route.test.ts

@@ -858,6 +858,124 @@ describe('Function Execute API Route', () => {
  expect(JSON.stringify(data)).toContain('files/report-secret-value.txt')
  })
 
+ it('classifies a binary export exact-empty when no secret was in scope', async () => {
+ envFlagsMock.isRemoteSandboxEnabled = true
+ mockExecuteInSandbox.mockResolvedValueOnce({
+ result: 'done',
+ stdout: '',
+ sandboxId: 'sandbox-123',
+ exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+ })
+
+ const response = await POST(
+ createMockRequest('POST', {
+ code: 'print("done")',
+ language: 'python',
+ workspaceId: 'workspace-1',
+ outputs: {
+ files: [
+ {
+ path: 'files/small.jpg',
+ sandboxPath: '/home/user/small.jpg',
+ mimeType: 'image/jpeg',
+ },
+ ],
+ },
+ })
+ )
+
+ expect(response.status).toBe(200)
+ expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+ expect.objectContaining({ secretProvenance: { status: 'exact', entries: [] } })
+ )
+ })
+
+ it('keeps a binary export unknown when files were mounted without a provenance envelope', async () => {
+ envFlagsMock.isRemoteSandboxEnabled = true
+ mockExecuteInSandbox.mockResolvedValueOnce({
+ result: 'done',
+ stdout: '',
+ sandboxId: 'sandbox-123',
+ exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+ })
+
+ const response = await POST(
+ createMockRequest('POST', {
+ code: 'print("done")',
+ language: 'python',
+ workspaceId: 'workspace-1',
+ _sandboxFiles: [{ path: '/home/user/in.bin', content: 'mounted bytes' }],
+ outputs: {
+ files: [
+ {
+ path: 'files/small.jpg',
+ sandboxPath: '/home/user/small.jpg',
+ mimeType: 'image/jpeg',
+ },
+ ],
+ },
+ })
+ )
+
+ expect(response.status).toBe(200)
+ expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+ expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+ )
+ })
+
+ it('keeps a binary export unknown when a mounted input file carried a secret', async () => {
+ envFlagsMock.isRemoteSandboxEnabled = true
+ mockExecuteInSandbox.mockResolvedValueOnce({
+ result: 'done',
+ stdout: '',
+ sandboxId: 'sandbox-123',
+ exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+ })
+
+ const response = await POST(
+ createMockRequest(
+ 'POST',
+ {
+ code: 'print("done")',
+ language: 'python',
+ workspaceId: 'workspace-1',
+ outputs: {
+ files: [
+ {
+ path: 'files/small.jpg',
+ sandboxPath: '/home/user/small.jpg',
+ mimeType: 'image/jpeg',
+ },
+ ],
+ },
+ [PRIVATE_SECRET_PROVENANCE_FIELD]: {
+ version: 1,
+ complete: true,
+ selections: [
+ {
+ key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY,
+ provenance: {
+ version: 1,
+ complete: true,
+ entries: [{ encryptedValue: 'encrypted:mounted-secret' }],
+ scope: { userId: 'user-123', workspaceId: 'workspace-1' },
+ },
+ },
+ ],
+ },
+ },
+ {
+ [PRIVATE_SECRET_PROVENANCE_HEADER]: PRIVATE_SECRET_PROVENANCE_BUNDLE_V1,
+ }
+ )
+ )
+
+ expect(response.status).toBe(200)
+ expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+ expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+ )
+ })
+
  it('marks binary exports unknown without failing the Function execution', async () => {
  envFlagsMock.isRemoteSandboxEnabled = true
  mockExecuteInSandbox.mockResolvedValueOnce({

apps/sim/app/api/function/execute/route.ts

@@ -83,6 +83,7 @@ import {
  resolveWorkspaceFileReference,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
+ EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE,
  mergeWorkspaceFileSecretProvenance,
  type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -988,6 +989,7 @@ interface FunctionRouteExecutionContext {
  outputSecretNamesByScanLiteral: Map<string, string[]>
  outputSecretPlaintextsByName: Map<string, string>
  mountedFileSecretProvenanceScanner?: MountedFileSecretProvenanceScanner
+ hasMountedSandboxFiles: boolean
 }
 
 type ResolvedSecretNamesMetadataType =
@@ -1208,13 +1210,42 @@ function activateOutputSecretProvenance(
  }
 }
 
+/**
+ * True when any secret material was in scope for this execution — a mounted environment secret, or
+ * a secret carried by a mounted input file. When false, nothing secret ever reached the sandbox, so
+ * no export of any kind can carry one.
+ *
+ * Mounted bytes are classified from the caller's provenance envelope. Files mounted *without* one
+ * are unclassifiable rather than clean: absence of an envelope is absence of evidence, not evidence
+ * the mount carried nothing. Those fail closed here so the classification can never be stronger
+ * than what the caller actually attested to.
+ */
+function hasSecretMaterialInScope(context: FunctionRouteExecutionContext): boolean {
+ if (context.outputSecretPlaintextsByName.size > 0) return true
+ const scanner = context.mountedFileSecretProvenanceScanner
+ return scanner ? scanner.hasSecrets : context.hasMountedSandboxFiles
+}
+
+/**
+ * Classifies the secret provenance of one exported sandbox file.
+ *
+ * Text exports are scanned for the exact resolved-secret plaintexts in scope. Binary exports cannot
+ * be scanned soundly — re-encoding can carry a secret without leaving a literal substring — so they
+ * are classified only when no secret material was in scope at all; with nothing available to embed,
+ * the bytes are provably secret-free. Otherwise they stay unknown, which fails closed at every
+ * model and runtime boundary that later reads the file.
+ */
 async function getOutputFileSecretProvenance(
  buffer: Buffer,
  isBinary: boolean,
  context: FunctionRouteExecutionContext,
  scope: { userId: string; workspaceId: string }
 ): Promise<WorkspaceFileSecretProvenance> {
- if (isBinary) return { status: 'unknown' }
+ if (isBinary) {
+ return hasSecretMaterialInScope(context)
+ ? { status: 'unknown' }
+ : EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
+ }
  const mountedFileProvenance = context.mountedFileSecretProvenanceScanner?.scan(buffer) ?? {
  status: 'exact' as const,
  entries: [],
@@ -1999,6 +2030,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
  outputSecretNamesByScanLiteral: new Map(),
  outputSecretPlaintextsByName: new Map(),
  mountedFileSecretProvenanceScanner,
+ hasMountedSandboxFiles: (_sandboxFiles?.length ?? 0) > 0,
  }
  for (const [name, plaintext] of Object.entries(envVars)) {
  if (!plaintext) continue

apps/sim/lib/copilot/tools/handlers/function-execute.test.ts

@@ -759,6 +759,22 @@ describe('executeFunctionExecute file mounts', () => {
  expect(mockExecuteTool).not.toHaveBeenCalled()
  })
 
+ it('omits the envelope when mounts it cannot attest to are already on the params', async () => {
+ mockExecuteTool.mockResolvedValue({ success: true, output: { result: 'ok' } })
+
+ await executeFunctionExecute(
+ {
+ inputFiles: ['files/data.csv'],
+ _sandboxFiles: [{ path: '/home/user/preserved.bin', content: 'from another resolver' }],
+ },
+ context
+ )
+
+ const call = mockExecuteTool.mock.calls[0]?.[1]
+ expect(call?._sandboxFiles?.length).toBeGreaterThan(1)
+ expect(call?.[PRIVATE_SECRET_PROVENANCE_FIELD]).toBeUndefined()
+ })
+
  it('projects only mounted-file secrets that cross the settled Function result', async () => {
  mockImportWorkspaceFileSecretProvenanceForRuntime.mockImplementation(
  async ({ registry }: { registry?: ResolvedSecretTraceRegistry }) =>

apps/sim/lib/copilot/tools/handlers/function-execute.ts

@@ -636,21 +636,30 @@ export async function executeFunctionExecute(
  secretActorUserId ?? context.userId,
  mountedRegistry
  )
+ // Every mount ships its provenance envelope, tables included. The route classifies an
+ // output file from that envelope, so a mount without one is unclassifiable there — it
+ // cannot tell "nothing secret was mounted" from "nobody said". Emitting on the same
+ // condition that produces the mount keeps the two from drifting apart.
  if (resolved.length > 0) {
  const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
  enrichedParams._sandboxFiles = [...existing, ...resolved]
- }
 
- if (inputFiles.length > 0 || inputDirectories.length > 0) {
- const provenance = mountedRegistry.exportProvenance()
- const bundle: PrivateSecretProvenanceBundleV1 = {
- version: 1,
- complete: provenance.complete,
- selections: provenance.complete
- ? [{ key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY, provenance }]
- : [],
+ // The envelope attests to the WHOLE mounted set or it is not emitted at all. Mounts
+ // that arrived already on the params came from outside this resolver, so
+ // `mountedRegistry` knows nothing about them; an envelope covering only `resolved`
+ // would read at the route as a complete attestation over every mounted byte. With no
+ // envelope the route fails closed instead, which is the honest answer.
+ if (existing.length === 0) {
+ const provenance = mountedRegistry.exportProvenance()
+ const bundle: PrivateSecretProvenanceBundleV1 = {
+ version: 1,
+ complete: provenance.complete,
+ selections: provenance.complete
+ ? [{ key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY, provenance }]
+ : [],
+ }
+ enrichedParams[PRIVATE_SECRET_PROVENANCE_FIELD] = bundle
  }
- enrichedParams[PRIVATE_SECRET_PROVENANCE_FIELD] = bundle
  }
  }
  }

apps/sim/lib/copilot/tools/handlers/vfs.test.ts

@@ -292,6 +292,50 @@ describe('vfs handlers oversize policy', () => {
  )
  })
 
+ it('windows against the real line count when a read under-reports totalLines', async () => {
+ const vfs = makeVfs()
+ vfs.readFileContentWithProvenance.mockResolvedValue({
+ // `/extract` synthesizes a whole extracted document but reports totalLines: 1.
+ value: { content: 'page one\npage two\npage three', totalLines: 1 },
+ file: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+ })
+ getOrMaterializeVFS.mockResolvedValue(vfs)
+
+ const result = await executeVfsRead(
+ { path: 'files/report.pdf/extract', offset: 1, limit: 2 },
+ GREP_CTX
+ )
+
+ expect(result.success).toBe(true)
+ expect(result.output).toEqual({ content: 'page two\npage three', totalLines: 1 })
+ })
+
+ it('leaves an attachment read unwindowed so its label is never blanked', async () => {
+ const vfs = makeVfs()
+ const imageResult = {
+ content: 'Image: photo.jpeg (157.0KB, image/jpeg, resized for vision)',
+ totalLines: 1,
+ attachment: {
+ type: 'image',
+ name: 'photo.jpeg',
+ source: { type: 'base64', media_type: 'image/jpeg', data: 'AAAA' },
+ },
+ }
+ vfs.readFileContentWithProvenance.mockResolvedValue({
+ value: imageResult,
+ file: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+ })
+ getOrMaterializeVFS.mockResolvedValue(vfs)
+
+ const result = await executeVfsRead(
+ { path: 'files/photo.jpeg/content', offset: 1, limit: 100 },
+ GREP_CTX
+ )
+
+ expect(result.success).toBe(true)
+ expect(result.output).toEqual(imageResult)
+ })
+
  it('rejects only the file read when durable provenance cannot be verified', async () => {
  const vfs = makeVfs()
  vfs.readFileContentWithProvenance.mockResolvedValue({

apps/sim/lib/copilot/tools/handlers/vfs.ts

@@ -285,12 +285,21 @@ export async function executeVfsRead(
  }
  const offset = parseOptionalNumber(params.offset)
  const limit = parseOptionalNumber(params.limit)
+ /**
+ * Applies the caller's line window, clamped against the content's ACTUAL line count rather than
+ * the self-reported `totalLines`. Synthesized results report `totalLines: 1` for content that is
+ * not one line (e.g. `files/x.pdf/extract` returns a whole extracted document), and clamping to
+ * that collapses the read to its first line — or to nothing for any nonzero offset. An
+ * attachment result is skipped outright: its `content` is a one-line label beside the bytes, so
+ * a window can only blank the label while the model still receives the attachment.
+ */
  const applyWindow = <T extends { content: string; totalLines: number }>(result: T): T => {
  if (offset === undefined && limit === undefined) return result
+ if (hasModelAttachment(result)) return result
  const lines = result.content.split('\n')
- const start = Math.max(0, Math.min(result.totalLines, offset ?? 0))
- const endRaw = limit !== undefined ? start + Math.max(0, limit) : result.totalLines
- const end = Math.max(start, Math.min(result.totalLines, endRaw))
+ const start = Math.max(0, Math.min(lines.length, offset ?? 0))
+ const endRaw = limit !== undefined ? start + Math.max(0, limit) : lines.length
+ const end = Math.max(start, Math.min(lines.length, endRaw))
  return {
  ...result,
  content: lines.slice(start, end).join('\n'),

apps/sim/lib/embeddings/client.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { chunkArray } from '@sim/utils'
+import { chunkArray } from '@sim/utils/helpers'
 import { env, envNumber } from '@/lib/core/config/env'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import {

apps/sim/lib/execution/mounted-file-secret-provenance.test.ts

@@ -52,6 +52,38 @@ describe('mounted file output provenance scanner', () => {
  })
  })
 
+ it('reports whether the mount carried any secret material', async () => {
+ const withSecrets = await createMountedFileSecretProvenanceScanner({
+ version: 1,
+ complete: true,
+ entries: [{ encryptedValue: 'encrypted-a' }],
+ scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+ })
+ expect(withSecrets?.hasSecrets).toBe(true)
+
+ const withoutSecrets = await createMountedFileSecretProvenanceScanner({
+ version: 1,
+ complete: true,
+ entries: [],
+ scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+ })
+ expect(withoutSecrets?.hasSecrets).toBe(false)
+ expect(withoutSecrets?.scan(Buffer.from('anything'))).toEqual({ status: 'exact', entries: [] })
+ })
+
+ it('keeps hasSecrets true when attested entries yield no scannable plaintext', async () => {
+ encryptionMockFns.mockDecryptSecret.mockImplementation(async () => ({ decrypted: '' }))
+
+ const scanner = await createMountedFileSecretProvenanceScanner({
+ version: 1,
+ complete: true,
+ entries: [{ encryptedValue: 'encrypted-a' }],
+ scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+ })
+
+ expect(scanner?.hasSecrets).toBe(true)
+ })
+
  it('fails closed when encrypted provenance is incomplete or cannot be decrypted', async () => {
  await expect(
  createMountedFileSecretProvenanceScanner({ version: 1, complete: false, entries: [] })