fix(forks): detect secrets referenced from advanced-mode fields

[icecrasher321]

Summary

{{ENV}} detection in the fork reference scan shared one gate with
resource-id detection, so a secret referenced from an ACTIVE advanced
(manual) canonical member — e.g. a {{SLACK_CHANNEL}} typed into Slack's
advanced "Channel ID" — was never recorded as a reference.

Three consequences, all silent:

• No row in the Secrets section of the fork edit-mapping modal, so the key
  could not be mapped across workspaces at all.
• promote-plan builds unmappedRequired from the same scan, so the
  required-env sync gate never fired for it.
• A push to a target missing that secret therefore succeeded, writing a
  {{KEY}} that resolves to nothing at runtime. The identical reference in
  a basic-mode field would have hard-blocked the same push.

Detection now gates on EXECUTION rather than ownership. A dormant member
and a condition-hidden field still go undetected — they never run, so they
must not become sync blockers — but an active manual member is exactly the
value that does run, and its key is a live secret reference like any other.

Resource-id detection keeps the verbatimManual policy unchanged, so a
hand-typed credential/KB id stays a user-owned escape hatch. This also
reconciles the two halves of the pass: remapEnvInValue already rewrote a
manual member's ref unconditionally while detection suppressed it.

Pins the fix with cases for explicit canonicalModes and the value
heuristic, rewrite/detect agreement on a mapped key, both still-undetected
paths, and the resource-id escape hatch surviving alongside env detection.

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 11, 2026 11:05pm

[cursor]

PR Summary

Medium Risk
Touches fork promote/sync reference detection for required env secrets, which gates cross-workspace pushes. The change is narrowly scoped and makes the gate stricter (safer), with solid regression coverage.

Overview
Fixes a silent fork-sync gap where {{ENV}} refs in active advanced/manual fields (e.g. Slack's Channel ID) were never recorded as mapping requirements.

Detection previously shared the resource-id ownership gate (verbatimManual), so rewrite and detect disagreed: the secret was rewritten but never surfaced in Secrets mapping or the required-env sync gate. Env detection now gates on execution only — dormant and condition-hidden fields stay skipped; active manual members are detected. Hand-typed resource ids keep their escape-hatch policy unchanged.

^{Reviewed by Cursor Bugbot for commit 1326701. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes workspace-fork promotion scanning so environment variables referenced by active advanced-mode fields and their active dependents are treated as required mappings.

• Separates environment-reference execution gating from the user-owned resource-ID policy.
• Continues excluding dormant canonical members and condition-hidden fields.
• Adds regression coverage for explicit and inferred advanced modes, mapped-key rewriting, inactive fields, and resource-ID escape hatches.

Confidence Score: 5/5

The PR appears safe to merge, with the revised reference scan matching canonical execution semantics and no actionable regressions identified.

Active advanced values and their dependents now contribute live environment-variable requirements, while dormant and condition-hidden values remain excluded and manual resource IDs retain their existing escape-hatch behavior.

Important Files Changed

Filename	Overview
apps/sim/ee/workspace-forking/lib/remap/remap-references.ts	Separates environment-variable detection from manual resource-ID suppression while retaining dormant and condition-hidden execution gates.
apps/sim/ee/workspace-forking/lib/remap/remap-references.test.ts	Adds focused regression tests covering active, dormant, hidden, inferred-mode, mapped, and resource-ID coexistence cases.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Inspect subblock value] --> B{Dormant or condition-hidden?}
B -- Yes --> C[Do not record ENV reference]
B -- No --> D[Record ENV reference]
D --> E{Resolver maps key?}
E -- Yes --> F[Rewrite to target ENV key]
E -- No --> G[Add required unmapped reference]
G --> H[Block promotion until mapped]
A --> I{User-owned manual resource ID?}
I -- Yes --> J[Keep resource ID verbatim]

Loading

_{Reviews (1): Last reviewed commit: "fix(forks): detect secrets referenced fr..." | Re-trigger Greptile}