Revert "fix(execution): count the runtime payload as secret material in scope"

This reverts commit 754e37c.

The classifier's secret catalog is the Secrets feature and nothing else:
`outputSecretNamesByScanLiteral` and `outputSecretPlaintextsByName` are built
only from `envVars`, and mounted-file entries trace back to the same place.
`contextVariables`, `blockData`, and `workflowVariables` are ordinary workflow
data — resolved block outputs the user already sees in logs — and the text
export path does not scan them either.

Treating their mere presence as secret material was a heuristic, not a security
property, and it created exactly the asymmetry rejected two rounds earlier: a
binary derived from a context variable would be `unknown` while a text export of
the same bytes stays exact-empty. Stricter than the text path for the same
content is not a boundary.

It was also nearly inert. `scopeEnvironmentVariables` returns every workspace
secret when scope is `all` (the default), so any workflow Function block with
secrets configured already trips the env branch. The only slice it changed was
executions with no env vars at all, where the workspace has no secret for a
context variable to carry.

A Secret resolved into an upstream block's output and arriving here through
blockData is a real gap, but it is pre-existing, identical for text exports, and
belongs at the executor -> route boundary as a provenance envelope for params —
not as a presence check in this classifier.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/function/execute/route.test.ts

@@ -890,40 +890,6 @@ describe('Function Execute API Route', () => {
       )
     })
 
-    it('keeps a binary export unknown when resolved context variables reach the sandbox', async () => {
-      envFlagsMock.isRemoteSandboxEnabled = true
-      mockExecuteInSandbox.mockResolvedValueOnce({
-        result: 'done',
-        stdout: '',
-        sandboxId: 'sandbox-123',
-        exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
-      })
-
-      const response = await POST(
-        createMockRequest('POST', {
-          code: 'print("done")',
-          language: 'python',
-          workspaceId: 'workspace-1',
-          // Resolved upstream block output — the route has no catalog to classify it.
-          contextVariables: { upstreamValue: 'could-be-anything' },
-          outputs: {
-            files: [
-              {
-                path: 'files/small.jpg',
-                sandboxPath: '/home/user/small.jpg',
-                mimeType: 'image/jpeg',
-              },
-            ],
-          },
-        })
-      )
-
-      expect(response.status).toBe(200)
-      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
-        expect.objectContaining({ secretProvenance: { status: 'unknown' } })
-      )
-    })
-
     it('keeps a binary export unknown when files were mounted without a provenance envelope', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({

apps/sim/app/api/function/execute/route.ts

@@ -990,12 +990,6 @@ interface FunctionRouteExecutionContext {
   outputSecretPlaintextsByName: Map<string, string>
   mountedFileSecretProvenanceScanner?: MountedFileSecretProvenanceScanner
   hasMountedSandboxFiles: boolean
-  /**
-   * Whether the serialized runtime payload carried `params` or `contextVariables` into the sandbox.
-   * Those are resolved block outputs and workflow variables — the route has no catalog for them, so
-   * it cannot tell a secret-bearing one from an ordinary value.
-   */
-  hasUnclassifiedRuntimeInputs: boolean
 }
 
 type ResolvedSecretNamesMetadataType =
@@ -1225,15 +1219,9 @@ function activateOutputSecretProvenance(
  * are unclassifiable rather than clean: absence of an envelope is absence of evidence, not evidence
  * the mount carried nothing. Those fail closed here so the classification can never be stronger
  * than what the caller actually attested to.
- *
- * The serialized runtime payload counts too. It carries `params` and `contextVariables` — resolved
- * block outputs and workflow variables — into the sandbox as a private-input file, and the route
- * has no catalog to tell a secret-bearing one from an ordinary value. Only an execution with
- * nothing at all in scope earns an exact-empty binary.
  */
 function hasSecretMaterialInScope(context: FunctionRouteExecutionContext): boolean {
   if (context.outputSecretPlaintextsByName.size > 0) return true
-  if (context.hasUnclassifiedRuntimeInputs) return true
   const scanner = context.mountedFileSecretProvenanceScanner
   return scanner ? scanner.hasSecrets : context.hasMountedSandboxFiles
 }
@@ -2043,12 +2031,6 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       outputSecretPlaintextsByName: new Map(),
       mountedFileSecretProvenanceScanner,
       hasMountedSandboxFiles: (_sandboxFiles?.length ?? 0) > 0,
-      // Values, not keys: `executionParams._context` is explicitly set to undefined just above,
-      // so a key count would read every execution as carrying params. Raised below once the
-      // resolved context variables are known.
-      hasUnclassifiedRuntimeInputs: Object.values(executionParams).some(
-        (value) => value !== undefined
-      ),
     }
     for (const [name, plaintext] of Object.entries(envVars)) {
       if (!plaintext) continue
@@ -2092,11 +2074,6 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       ...codeResolution.contextVariables,
       ...preResolvedContextVariables,
     }
-    // Resolved block outputs and workflow variables ride into the sandbox inside the runtime
-    // payload, so an output file can carry them even with nothing mounted and no env secret.
-    if (Object.keys(contextVariables).length > 0) {
-      routeContext.hasUnclassifiedRuntimeInputs = true
-    }
     const compilation = await compileCodePlaceholders({
       code: codeResolution.resolvedCode,
       language: lang,