fix(execution): stop classifying secret-free binary sandbox exports as unknown

Author: icecrasher321

apps/sim/app/api/function/execute/route.test.ts

@@ -858,6 +858,91 @@ describe('Function Execute API Route', () => {
       expect(JSON.stringify(data)).toContain('files/report-secret-value.txt')
     })
 
+    it('classifies a binary export exact-empty when no secret was in scope', async () => {
+      envFlagsMock.isRemoteSandboxEnabled = true
+      mockExecuteInSandbox.mockResolvedValueOnce({
+        result: 'done',
+        stdout: '',
+        sandboxId: 'sandbox-123',
+        exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+      })
+
+      const response = await POST(
+        createMockRequest('POST', {
+          code: 'print("done")',
+          language: 'python',
+          workspaceId: 'workspace-1',
+          outputs: {
+            files: [
+              {
+                path: 'files/small.jpg',
+                sandboxPath: '/home/user/small.jpg',
+                mimeType: 'image/jpeg',
+              },
+            ],
+          },
+        })
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+        expect.objectContaining({ secretProvenance: { status: 'exact', entries: [] } })
+      )
+    })
+
+    it('keeps a binary export unknown when a mounted input file carried a secret', async () => {
+      envFlagsMock.isRemoteSandboxEnabled = true
+      mockExecuteInSandbox.mockResolvedValueOnce({
+        result: 'done',
+        stdout: '',
+        sandboxId: 'sandbox-123',
+        exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+      })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'print("done")',
+            language: 'python',
+            workspaceId: 'workspace-1',
+            outputs: {
+              files: [
+                {
+                  path: 'files/small.jpg',
+                  sandboxPath: '/home/user/small.jpg',
+                  mimeType: 'image/jpeg',
+                },
+              ],
+            },
+            [PRIVATE_SECRET_PROVENANCE_FIELD]: {
+              version: 1,
+              complete: true,
+              selections: [
+                {
+                  key: MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY,
+                  provenance: {
+                    version: 1,
+                    complete: true,
+                    entries: [{ encryptedValue: 'encrypted:mounted-secret' }],
+                    scope: { userId: 'user-123', workspaceId: 'workspace-1' },
+                  },
+                },
+              ],
+            },
+          },
+          {
+            [PRIVATE_SECRET_PROVENANCE_HEADER]: PRIVATE_SECRET_PROVENANCE_BUNDLE_V1,
+          }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+        expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+      )
+    })
+
     it('marks binary exports unknown without failing the Function execution', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({

apps/sim/app/api/function/execute/route.ts

@@ -83,6 +83,7 @@ import {
   resolveWorkspaceFileReference,
 } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import {
+  EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE,
   mergeWorkspaceFileSecretProvenance,
   type WorkspaceFileSecretProvenance,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
@@ -1208,13 +1209,38 @@ function activateOutputSecretProvenance(
   }
 }
 
+/**
+ * True when any secret material was in scope for this execution — a mounted environment secret, or
+ * a secret carried by a mounted input file. When false, nothing secret ever reached the sandbox, so
+ * no export of any kind can carry one.
+ */
+function hasSecretMaterialInScope(context: FunctionRouteExecutionContext): boolean {
+  return (
+    context.outputSecretPlaintextsByName.size > 0 ||
+    (context.mountedFileSecretProvenanceScanner?.hasSecrets ?? false)
+  )
+}
+
+/**
+ * Classifies the secret provenance of one exported sandbox file.
+ *
+ * Text exports are scanned for the exact resolved-secret plaintexts in scope. Binary exports cannot
+ * be scanned soundly — re-encoding can carry a secret without leaving a literal substring — so they
+ * are classified only when no secret material was in scope at all; with nothing available to embed,
+ * the bytes are provably secret-free. Otherwise they stay unknown, which fails closed at every
+ * model and runtime boundary that later reads the file.
+ */
 async function getOutputFileSecretProvenance(
   buffer: Buffer,
   isBinary: boolean,
   context: FunctionRouteExecutionContext,
   scope: { userId: string; workspaceId: string }
 ): Promise<WorkspaceFileSecretProvenance> {
-  if (isBinary) return { status: 'unknown' }
+  if (isBinary) {
+    return hasSecretMaterialInScope(context)
+      ? { status: 'unknown' }
+      : EXACT_EMPTY_WORKSPACE_FILE_SECRET_PROVENANCE
+  }
   const mountedFileProvenance = context.mountedFileSecretProvenanceScanner?.scan(buffer) ?? {
     status: 'exact' as const,
     entries: [],

apps/sim/lib/copilot/tools/handlers/vfs.test.ts

@@ -292,6 +292,50 @@ describe('vfs handlers oversize policy', () => {
     )
   })
 
+  it('windows against the real line count when a read under-reports totalLines', async () => {
+    const vfs = makeVfs()
+    vfs.readFileContentWithProvenance.mockResolvedValue({
+      // `/extract` synthesizes a whole extracted document but reports totalLines: 1.
+      value: { content: 'page one\npage two\npage three', totalLines: 1 },
+      file: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+    })
+    getOrMaterializeVFS.mockResolvedValue(vfs)
+
+    const result = await executeVfsRead(
+      { path: 'files/report.pdf/extract', offset: 1, limit: 2 },
+      GREP_CTX
+    )
+
+    expect(result.success).toBe(true)
+    expect(result.output).toEqual({ content: 'page two\npage three', totalLines: 1 })
+  })
+
+  it('leaves an attachment read unwindowed so its label is never blanked', async () => {
+    const vfs = makeVfs()
+    const imageResult = {
+      content: 'Image: photo.jpeg (157.0KB, image/jpeg, resized for vision)',
+      totalLines: 1,
+      attachment: {
+        type: 'image',
+        name: 'photo.jpeg',
+        source: { type: 'base64', media_type: 'image/jpeg', data: 'AAAA' },
+      },
+    }
+    vfs.readFileContentWithProvenance.mockResolvedValue({
+      value: imageResult,
+      file: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+    })
+    getOrMaterializeVFS.mockResolvedValue(vfs)
+
+    const result = await executeVfsRead(
+      { path: 'files/photo.jpeg/content', offset: 1, limit: 100 },
+      GREP_CTX
+    )
+
+    expect(result.success).toBe(true)
+    expect(result.output).toEqual(imageResult)
+  })
+
   it('rejects only the file read when durable provenance cannot be verified', async () => {
     const vfs = makeVfs()
     vfs.readFileContentWithProvenance.mockResolvedValue({

apps/sim/lib/copilot/tools/handlers/vfs.ts

@@ -285,12 +285,21 @@ export async function executeVfsRead(
     }
     const offset = parseOptionalNumber(params.offset)
     const limit = parseOptionalNumber(params.limit)
+    /**
+     * Applies the caller's line window, clamped against the content's ACTUAL line count rather than
+     * the self-reported `totalLines`. Synthesized results report `totalLines: 1` for content that is
+     * not one line (e.g. `files/x.pdf/extract` returns a whole extracted document), and clamping to
+     * that collapses the read to its first line — or to nothing for any nonzero offset. An
+     * attachment result is skipped outright: its `content` is a one-line label beside the bytes, so
+     * a window can only blank the label while the model still receives the attachment.
+     */
     const applyWindow = <T extends { content: string; totalLines: number }>(result: T): T => {
       if (offset === undefined && limit === undefined) return result
+      if (hasModelAttachment(result)) return result
       const lines = result.content.split('\n')
-      const start = Math.max(0, Math.min(result.totalLines, offset ?? 0))
-      const endRaw = limit !== undefined ? start + Math.max(0, limit) : result.totalLines
-      const end = Math.max(start, Math.min(result.totalLines, endRaw))
+      const start = Math.max(0, Math.min(lines.length, offset ?? 0))
+      const endRaw = limit !== undefined ? start + Math.max(0, limit) : lines.length
+      const end = Math.max(start, Math.min(lines.length, endRaw))
       return {
         ...result,
         content: lines.slice(start, end).join('\n'),

apps/sim/lib/embeddings/client.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import { chunkArray } from '@sim/utils'
+import { chunkArray } from '@sim/utils/helpers'
 import { env, envNumber } from '@/lib/core/config/env'
 import { mapWithConcurrency } from '@/lib/core/utils/concurrency'
 import {

apps/sim/lib/execution/mounted-file-secret-provenance.test.ts

@@ -52,6 +52,25 @@ describe('mounted file output provenance scanner', () => {
     })
   })
 
+  it('reports whether the mount carried any secret material', async () => {
+    const withSecrets = await createMountedFileSecretProvenanceScanner({
+      version: 1,
+      complete: true,
+      entries: [{ encryptedValue: 'encrypted-a' }],
+      scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+    })
+    expect(withSecrets?.hasSecrets).toBe(true)
+
+    const withoutSecrets = await createMountedFileSecretProvenanceScanner({
+      version: 1,
+      complete: true,
+      entries: [],
+      scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+    })
+    expect(withoutSecrets?.hasSecrets).toBe(false)
+    expect(withoutSecrets?.scan(Buffer.from('anything'))).toEqual({ status: 'exact', entries: [] })
+  })
+
   it('fails closed when encrypted provenance is incomplete or cannot be decrypted', async () => {
     await expect(
       createMountedFileSecretProvenanceScanner({ version: 1, complete: false, entries: [] })

apps/sim/lib/execution/mounted-file-secret-provenance.ts

@@ -11,6 +11,12 @@ const MAX_MOUNTED_FILE_SECRET_MATCH_EVENTS = 1_000_000
 const ANONYMOUS_MOUNTED_FILE_SECRET_NAME = 'MOUNTED_FILE_SECRET'
 
 export interface MountedFileSecretProvenanceScanner {
+  /**
+   * True when the mount actually carried secret material. False means the mounted files were
+   * classified and contributed nothing, so no mounted secret can reach an output file — which lets
+   * callers classify content this scanner cannot soundly scan (binary bytes) instead of failing closed.
+   */
+  hasSecrets: boolean
   scan(buffer: Buffer): WorkspaceFileSecretProvenance
 }
 
@@ -57,7 +63,7 @@ export async function createMountedFileSecretProvenanceScanner(
   }
 
   if (entriesByScanLiteral.size === 0) {
-    return { scan: () => ({ status: 'exact', entries: [] }) }
+    return { hasSecrets: false, scan: () => ({ status: 'exact', entries: [] }) }
   }
 
   let matcher
@@ -69,10 +75,11 @@ export async function createMountedFileSecretProvenanceScanner(
     return undefined
   }
   if (!matcher) {
-    return { scan: () => ({ status: 'exact', entries: [] }) }
+    return { hasSecrets: false, scan: () => ({ status: 'exact', entries: [] }) }
   }
 
   return {
+    hasSecrets: true,
     scan(buffer) {
       const matched = new Map<string, WorkspaceFileSecretProvenanceEntry>()
       try {