fix(execution): treat partial and unscannable mount attestations as unknown

Two ways the envelope could read as stronger evidence than it was.

The copilot handler preserved `_sandboxFiles` that arrived on the params and
then exported provenance from `mountedRegistry`, which knows only about the
files it resolved itself. The route would have read that partial envelope as a
complete attestation over every mounted byte. The envelope now covers the whole
mounted set or is not emitted at all, and a mount with no envelope already
fails closed.

`hasSecrets` was derived from whether entries produced scannable literals, so
an envelope listing entries that all failed to decrypt reported false and let a
derived binary be marked exact-empty. It now reflects what the envelope
attested to: entries that yield no plaintext make the mount less classifiable,
not more.

Neither was reachable — `_sandboxFiles` is absent from the copilot tool schema,
so nothing can populate the preserved-mount branch — but both had the
classification resting on a property nothing enforced.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/lib/copilot/tools/handlers/function-execute.test.ts

@@ -759,6 +759,22 @@ describe('executeFunctionExecute file mounts', () => {
     expect(mockExecuteTool).not.toHaveBeenCalled()
   })
 
+  it('omits the envelope when mounts it cannot attest to are already on the params', async () => {
+    mockExecuteTool.mockResolvedValue({ success: true, output: { result: 'ok' } })
+
+    await executeFunctionExecute(
+      {
+        inputFiles: ['files/data.csv'],
+        _sandboxFiles: [{ path: '/home/user/preserved.bin', content: 'from another resolver' }],
+      },
+      context
+    )
+
+    const call = mockExecuteTool.mock.calls[0]?.[1]
+    expect(call?._sandboxFiles?.length).toBeGreaterThan(1)
+    expect(call?.[PRIVATE_SECRET_PROVENANCE_FIELD]).toBeUndefined()
+  })
+
   it('projects only mounted-file secrets that cross the settled Function result', async () => {
     mockImportWorkspaceFileSecretProvenanceForRuntime.mockImplementation(
       async ({ registry }: { registry?: ResolvedSecretTraceRegistry }) =>

apps/sim/lib/copilot/tools/handlers/function-execute.ts

@@ -644,15 +644,22 @@ export async function executeFunctionExecute(
           const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
           enrichedParams._sandboxFiles = [...existing, ...resolved]
 
-          const provenance = mountedRegistry.exportProvenance()
-          const bundle: PrivateSecretProvenanceBundleV1 = {
-            version: 1,
-            complete: provenance.complete,
-            selections: provenance.complete
-              ? [{ key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY, provenance }]
-              : [],
+          // The envelope attests to the WHOLE mounted set or it is not emitted at all. Mounts
+          // that arrived already on the params came from outside this resolver, so
+          // `mountedRegistry` knows nothing about them; an envelope covering only `resolved`
+          // would read at the route as a complete attestation over every mounted byte. With no
+          // envelope the route fails closed instead, which is the honest answer.
+          if (existing.length === 0) {
+            const provenance = mountedRegistry.exportProvenance()
+            const bundle: PrivateSecretProvenanceBundleV1 = {
+              version: 1,
+              complete: provenance.complete,
+              selections: provenance.complete
+                ? [{ key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY, provenance }]
+                : [],
+            }
+            enrichedParams[PRIVATE_SECRET_PROVENANCE_FIELD] = bundle
           }
-          enrichedParams[PRIVATE_SECRET_PROVENANCE_FIELD] = bundle
         }
       }
     }

apps/sim/lib/execution/mounted-file-secret-provenance.test.ts

@@ -71,6 +71,19 @@ describe('mounted file output provenance scanner', () => {
     expect(withoutSecrets?.scan(Buffer.from('anything'))).toEqual({ status: 'exact', entries: [] })
   })
 
+  it('keeps hasSecrets true when attested entries yield no scannable plaintext', async () => {
+    encryptionMockFns.mockDecryptSecret.mockImplementation(async () => ({ decrypted: '' }))
+
+    const scanner = await createMountedFileSecretProvenanceScanner({
+      version: 1,
+      complete: true,
+      entries: [{ encryptedValue: 'encrypted-a' }],
+      scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+    })
+
+    expect(scanner?.hasSecrets).toBe(true)
+  })
+
   it('fails closed when encrypted provenance is incomplete or cannot be decrypted', async () => {
     await expect(
       createMountedFileSecretProvenanceScanner({ version: 1, complete: false, entries: [] })

apps/sim/lib/execution/mounted-file-secret-provenance.ts

@@ -12,9 +12,11 @@ const ANONYMOUS_MOUNTED_FILE_SECRET_NAME = 'MOUNTED_FILE_SECRET'
 
 export interface MountedFileSecretProvenanceScanner {
   /**
-   * True when the mount actually carried secret material. False means the mounted files were
-   * classified and contributed nothing, so no mounted secret can reach an output file — which lets
-   * callers classify content this scanner cannot soundly scan (binary bytes) instead of failing closed.
+   * True when the envelope attested to any secret material, whether or not it could be turned into
+   * a scannable literal. False therefore means the mount carried nothing to leak — which lets
+   * callers classify content this scanner cannot soundly scan (binary bytes) instead of failing
+   * closed. Entries that fail to yield plaintext keep this true: losing the ability to scan them
+   * makes the mount less classifiable, not more.
    */
   hasSecrets: boolean
   scan(buffer: Buffer): WorkspaceFileSecretProvenance
@@ -34,6 +36,7 @@ export async function createMountedFileSecretProvenanceScanner(
 ): Promise<MountedFileSecretProvenanceScanner | undefined> {
   if (!provenance.complete || !provenance.scope?.userId) return undefined
 
+  const hasSecrets = provenance.entries.length > 0
   const entriesByScanLiteral = new Map<string, Map<string, WorkspaceFileSecretProvenanceEntry>>()
   try {
     for (const entry of provenance.entries) {
@@ -63,7 +66,7 @@ export async function createMountedFileSecretProvenanceScanner(
   }
 
   if (entriesByScanLiteral.size === 0) {
-    return { hasSecrets: false, scan: () => ({ status: 'exact', entries: [] }) }
+    return { hasSecrets, scan: () => ({ status: 'exact', entries: [] }) }
   }
 
   let matcher
@@ -75,11 +78,11 @@ export async function createMountedFileSecretProvenanceScanner(
     return undefined
   }
   if (!matcher) {
-    return { hasSecrets: false, scan: () => ({ status: 'exact', entries: [] }) }
+    return { hasSecrets, scan: () => ({ status: 'exact', entries: [] }) }
   }
 
   return {
-    hasSecrets: true,
+    hasSecrets,
     scan(buffer) {
       const matched = new Map<string, WorkspaceFileSecretProvenanceEntry>()
       try {