fix(copilot): secrets injection into sandbox

Author: icecrasher321

apps/docs/content/docs/en/platform/credentials.mdx

@@ -75,6 +75,10 @@ This is an observability projection only. Secret resolution and workflow behavio
 Masking is activated only when Sim successfully resolves a value from **Settings → Secrets** through `{{KEY}}`. A hardcoded literal, direct `environmentVariables['KEY']` read, or shell `$KEY` read does not activate it by itself. Once activated, every exact occurrence of that value in the run's log-facing content is masked. Encoded, hashed, or otherwise transformed versions are not matched. Do not deliberately return or print secrets.
 </Callout>
 
+### Copilot code execution
+
+When Copilot runs its built-in Function or code-execution tool, the sandbox still receives the real value for a successful `{{KEY}}` substitution. Before the tool result is returned to Copilot, exact occurrences of that activated value are replaced with `{{KEY}}`. This keeps the plaintext out of Copilot's tool-result context without changing the code that ran or its local runtime result. If Sim cannot verify the execution's secret provenance, it omits the result content instead of returning it unverified. Hardcoded, directly read, encoded, hashed, and otherwise transformed values follow the same limitations described above.
+
 ## Secret Details
 
 Click **Details** on any secret row to open its detail view.
@@ -122,7 +126,7 @@ When a workflow runs, secrets resolve in this order:
 
 <FAQ items={[
   { question: "Are my secrets encrypted at rest?", answer: "Yes. Values saved under Secrets are encrypted before being stored in the database." },
-  { question: "Can a saved secret still appear in a workflow result?", answer: "Yes. Functional data is not rewritten, so the raw value can still reach downstream blocks, tools, and models and can appear in workflow execution responses, streams, or callbacks if your workflow deliberately returns or prints it. Log-facing views and read APIs, including Workflow Output on the Logs Overview and the Logs block's Get Run Details output, receive a protected copy after a successful {{KEY}} substitution." },
+  { question: "Can a saved secret still appear in a workflow result?", answer: "Yes. Functional workflow data is not rewritten, so the raw value can still reach downstream blocks, tools, and models and can appear in workflow execution responses, streams, or callbacks if your workflow deliberately returns or prints it. Log-facing views and read APIs receive a protected copy after a successful {{KEY}} substitution. Copilot's built-in Function and code-execution tool results are also protected before they are returned to Copilot." },
   { question: "What happens if both a workspace secret and a personal secret have the same key name?", answer: "The workspace secret takes precedence. During execution, the resolver checks workspace secrets first and uses personal secrets only as a fallback. This ensures production workflows use the shared, team-managed value." },
   { question: "Who determines which personal secret is used for automated runs?", answer: "For manual runs, the personal secrets of the user who clicked Run are used as fallback. For automated runs triggered by API, webhook, or schedule, the personal secrets of the workflow owner are used instead." },
   { question: "Can I import secrets from a .env file?", answer: "Yes. Paste .env-style content (KEY=VALUE format) into any key or value field and the secrets will be auto-populated. The parser supports export KEY=VALUE, quoted values, and inline comments." },

apps/sim/app/api/mothership/execute/route.test.ts

@@ -190,7 +190,9 @@ describe('mothership private trace provenance transport', () => {
   }
 
   function activateSecret(options: CopilotLifecycleOptions): void {
-    options.resolvedSecretTraceRegistry?.recordResolved('API_KEY', 'secret-value')
+    const registry =
+      options.environmentContext?.resolvedSecretTraceRegistry ?? options.resolvedSecretTraceRegistry
+    registry?.recordResolved('API_KEY', 'secret-value')
   }
 
   it('does not expose private provenance unless the internal caller requests it', async () => {
@@ -218,7 +220,7 @@ describe('mothership private trace provenance transport', () => {
     expect(mockGetPersonalAndWorkspaceEnv).not.toHaveBeenCalled()
     expect(mockRunHeadlessCopilotLifecycle).toHaveBeenCalledWith(
       expect.any(Object),
-      expect.objectContaining({ resolvedSecretTraceRegistry: undefined })
+      expect.objectContaining({ environmentContext: undefined })
     )
   })
 
@@ -227,6 +229,7 @@ describe('mothership private trace provenance transport', () => {
     mockRunHeadlessCopilotLifecycle.mockImplementation(
       async (_payload: Record<string, unknown>, options: CopilotLifecycleOptions) => {
         expect(options.resolvedSecretTraceRegistry?.isComplete()).toBe(false)
+        expect(options.environmentContext).toBeUndefined()
         return successResult()
       }
     )
@@ -258,9 +261,10 @@ describe('mothership private trace provenance transport', () => {
   it('fails provenance closed without changing a runtime value that rotated after catalog load', async () => {
     mockRunHeadlessCopilotLifecycle.mockImplementation(
       async (_payload: Record<string, unknown>, options: CopilotLifecycleOptions) => {
-        expect(
-          options.resolvedSecretTraceRegistry?.recordResolved('API_KEY', 'rotated-secret-value')
-        ).toBe(false)
+        const registry =
+          options.environmentContext?.resolvedSecretTraceRegistry ??
+          options.resolvedSecretTraceRegistry
+        expect(registry?.recordResolved('API_KEY', 'rotated-secret-value')).toBe(false)
         return { ...successResult(), content: 'rotated-secret-value' }
       }
     )
@@ -292,6 +296,11 @@ describe('mothership private trace provenance transport', () => {
   it('returns encrypted provenance on a marker-gated successful request', async () => {
     mockRunHeadlessCopilotLifecycle.mockImplementation(
       async (_payload: Record<string, unknown>, options: CopilotLifecycleOptions) => {
+        expect(options.environmentContext?.decryptedEnvVars).toEqual({
+          API_KEY: 'secret-value',
+        })
+        expect(options.environmentContext?.resolvedSecretTraceRegistry).toBeDefined()
+        expect(options.resolvedSecretTraceRegistry).toBeUndefined()
         activateSecret(options)
         return successResult()
       }
@@ -322,6 +331,7 @@ describe('mothership private trace provenance transport', () => {
       scope: { userId: 'user-1', workspaceId: 'workspace-1' },
     })
     expect(JSON.stringify(body.__resolvedSecretTraceProvenance)).not.toContain('secret-value')
+    expect(mockGetPersonalAndWorkspaceEnv).toHaveBeenCalledTimes(1)
   })
 
   it('imports MCP schema-discovery provenance before starting the lifecycle', async () => {
@@ -344,7 +354,10 @@ describe('mothership private trace provenance transport', () => {
     )
     mockRunHeadlessCopilotLifecycle.mockImplementation(
       async (payload: Record<string, unknown>, options: CopilotLifecycleOptions) => {
-        expect(options.resolvedSecretTraceRegistry?.exportProvenance()).toEqual(provenance)
+        const registry =
+          options.environmentContext?.resolvedSecretTraceRegistry ??
+          options.resolvedSecretTraceRegistry
+        expect(registry?.exportProvenance()).toEqual(provenance)
         expect(JSON.stringify(payload)).not.toContain('encrypted-secret')
         expect(JSON.stringify(payload)).not.toContain('__resolvedSecretTraceProvenance')
         return successResult()
@@ -388,7 +401,10 @@ describe('mothership private trace provenance transport', () => {
     )
     mockRunHeadlessCopilotLifecycle.mockImplementation(
       async (_payload: Record<string, unknown>, options: CopilotLifecycleOptions) => {
-        expect(options.resolvedSecretTraceRegistry?.isComplete()).toBe(false)
+        const registry =
+          options.environmentContext?.resolvedSecretTraceRegistry ??
+          options.resolvedSecretTraceRegistry
+        expect(registry?.isComplete()).toBe(false)
         return successResult()
       }
     )

apps/sim/app/api/mothership/execute/route.ts

@@ -10,6 +10,10 @@ import { buildIntegrationToolSchemas } from '@/lib/copilot/chat/payload'
 import { processContextsServer } from '@/lib/copilot/chat/process-contents'
 import { generateWorkspaceContext } from '@/lib/copilot/chat/workspace-context'
 import { computeWorkspaceEntitlements } from '@/lib/copilot/entitlements'
+import {
+  type CopilotEnvironmentContext,
+  createCopilotEnvironmentContext,
+} from '@/lib/copilot/environment-context'
 import {
   MothershipStreamV1EventType,
   MothershipStreamV1TextChannel,
@@ -33,7 +37,6 @@ import {
 } from '@/lib/workspaces/permissions/utils'
 import {
   createIncompleteResolvedSecretTraceRegistry,
-  createResolvedSecretTraceRegistry,
   ResolvedSecretTraceProvenanceAccumulator,
   type ResolvedSecretTraceRegistry,
 } from '@/executor/utils/resolved-secret-trace-registry'
@@ -135,6 +138,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
   let messageId: string | undefined
   let requestId: string | undefined
   let resolvedSecretTraceRegistry: ResolvedSecretTraceRegistry | undefined
+  let environmentContext: CopilotEnvironmentContext | undefined
   const includePrivateProvenance = requestsPrivateToolMetadata(
     req.headers,
     RESOLVED_SECRET_PROVENANCE_METADATA_V1
@@ -192,14 +196,8 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         const environment = await getPersonalAndWorkspaceEnv(userId, workspaceId, {
           workspaceAccess,
         })
-        resolvedSecretTraceRegistry = await createResolvedSecretTraceRegistry({
-          personalEncrypted: environment.personalEncrypted,
-          workspaceEncrypted: environment.workspaceEncrypted,
-          personalDecrypted: environment.personalDecrypted,
-          workspaceDecrypted: environment.workspaceDecrypted,
-          decryptionFailures: environment.decryptionFailures,
-          scope,
-        })
+        environmentContext = await createCopilotEnvironmentContext(userId, workspaceId, environment)
+        resolvedSecretTraceRegistry = environmentContext.resolvedSecretTraceRegistry
       } catch (error) {
         logger.warn('Failed to build Mothership trace secret catalog', {
           error: getErrorMessage(error),
@@ -376,7 +374,10 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
         interactive: false,
         abortSignal: lifecycleAbortController.signal,
         billingAttribution,
-        resolvedSecretTraceRegistry,
+        environmentContext,
+        ...(!environmentContext && resolvedSecretTraceRegistry
+          ? { resolvedSecretTraceRegistry }
+          : {}),
         onEvent,
       })