fix(secrets): preserve raw outputs with durable provenance

Author: icecrasher321

apps/sim/executor/handlers/function/function-handler.test.ts

@@ -200,6 +200,49 @@ describe('FunctionBlockHandler', () => {
     }
   })
 
+  it('forwards an explicit selected secret scope without changing legacy unset blocks', async () => {
+    await handler.execute(mockContext, mockBlock, {
+      code: 'return {{API_KEY}}',
+      secretScope: 'selected',
+      mountedSecrets: [' API_KEY ', 42, 'SECOND_KEY', '', 'API_KEY'],
+    })
+
+    expect(mockExecuteTool).toHaveBeenCalledWith(
+      'function_execute',
+      expect.objectContaining({
+        secretScope: 'selected',
+        mountedSecrets: ['API_KEY', 'SECOND_KEY'],
+      }),
+      { executionContext: mockContext }
+    )
+
+    vi.clearAllMocks()
+    mockExecuteTool.mockResolvedValue({ success: true, output: { result: 'Success' } })
+
+    await handler.execute(mockContext, mockBlock, { code: 'return {{API_KEY}}' })
+
+    const legacyParams = mockExecuteTool.mock.calls[0][1]
+    expect(legacyParams).not.toHaveProperty('secretScope')
+    expect(legacyParams).not.toHaveProperty('mountedSecrets')
+  })
+
+  it('fails closed for an invalid explicit secret scope', async () => {
+    await handler.execute(mockContext, mockBlock, {
+      code: 'return {{API_KEY}}',
+      secretScope: 'invalid',
+      mountedSecrets: ['API_KEY'],
+    })
+
+    expect(mockExecuteTool).toHaveBeenCalledWith(
+      'function_execute',
+      expect.objectContaining({
+        secretScope: 'selected',
+        mountedSecrets: [],
+      }),
+      { executionContext: mockContext }
+    )
+  })
+
   it('should handle execution errors from the tool', async () => {
     const inputs = { code: 'throw new Error("Code failed");' }
     const errorResult = { success: false, error: 'Function execution failed: Code failed' }

apps/sim/executor/handlers/function/function-handler.ts

@@ -1,3 +1,4 @@
+import { normalizeSecretMountPolicy } from '@/lib/copilot/secret-mount-policy'
 import { getRemainingExecutionMs } from '@/lib/core/execution-limits'
 import {
   normalizeRecord,
@@ -68,13 +69,21 @@ export class FunctionBlockHandler implements BlockHandler {
               ? remainingExecutionMs
               : Math.min(requestedTimeout, remainingExecutionMs)
           )
+    const secretMountPolicy =
+      inputs.secretScope === undefined
+        ? undefined
+        : normalizeSecretMountPolicy({
+            secretScope: inputs.secretScope,
+            mountedSecrets: inputs.mountedSecrets,
+          })
 
     const toolParams = {
       code: codeContent,
       ...(sourceCode ? { sourceCode } : {}),
       language: inputs.language || DEFAULT_CODE_LANGUAGE,
       timeout,
       ...(inputs.sandboxId ? { sandboxId: inputs.sandboxId } : {}),
+      ...(secretMountPolicy ?? {}),
       envVars: normalizeStringRecord(ctx.environmentVariables),
       workflowVariables: normalizeWorkflowVariables(ctx.workflowVariables),
       blockData: {},

apps/sim/executor/utils/resolved-secret-matcher.test.ts

@@ -8,11 +8,34 @@ import {
   OPAQUE_RESOLVED_SECRET_REPLACEMENT,
   sanitizeResolvedSecretPrimitive,
   sanitizeResolvedSecretString,
+  scanResolvedSecretString,
 } from '@/executor/utils/resolved-secret-matcher'
 
 const PRESERVE_NAMED_PROVENANCE = { preserveNamedProvenanceLabels: true } as const
 
 describe('resolved secret matcher', () => {
+  it('reports each matched literal once across large repeated content', () => {
+    const matcher = createResolvedSecretMatcher([
+      { plaintext: 'x', replacement: '{{SHORT}}' },
+      { plaintext: 'xx', replacement: '{{OVERLAP}}' },
+      { plaintext: 'abc', replacement: '{{PREFIX}}' },
+      { plaintext: 'bc', replacement: '{{SUFFIX}}' },
+    ])
+    const matches: string[] = []
+
+    expect(matcher).toBeDefined()
+    if (!matcher) return
+    expect(
+      scanResolvedSecretString(
+        `${'x'.repeat(1_000_001)}abcabc`,
+        matcher,
+        (match) => matches.push(match),
+        4
+      )
+    ).toBe(4)
+    expect(matches).toEqual(['x', 'xx', 'abc', 'bc'])
+  })
+
   it('uses exact matching for typed primitive renderings', () => {
     const matcher = createResolvedSecretMatcher([{ plaintext: '23', replacement: '{{TOKEN}}' }])
 

apps/sim/executor/utils/resolved-secret-matcher.ts

@@ -231,7 +231,7 @@ export function containsResolvedSecretLiteral(
   return false
 }
 
-/** Visits exact secret literals with the same bounded automaton used by content projection. */
+/** Visits each distinct exact secret literal once with the content-projection automaton. */
 export function scanResolvedSecretString(
   value: string,
   matcher: ResolvedSecretMatcher,
@@ -240,16 +240,40 @@ export function scanResolvedSecretString(
 ): number {
   let node = matcher.root
   let matchEvents = 0
+  const matchedPlaintexts = new Set<string>()
+  const nextUnmatchedOutput = new WeakMap<SecretTrieNode, SecretTrieNode | null>()
+
+  const findNextUnmatchedOutput = (
+    candidate: SecretTrieNode | undefined
+  ): SecretTrieNode | undefined => {
+    let current = candidate
+    const exhaustedPath: SecretTrieNode[] = []
+    while (current?.replacement && matchedPlaintexts.has(current.replacement.plaintext)) {
+      const cached = nextUnmatchedOutput.get(current)
+      if (cached !== undefined) {
+        current = cached ?? undefined
+        continue
+      }
+      exhaustedPath.push(current)
+      current = current.outputLink
+    }
+    for (const exhausted of exhaustedPath) {
+      nextUnmatchedOutput.set(exhausted, current ?? null)
+    }
+    return current
+  }
+
   for (let index = 0; index < value.length; index += 1) {
     node = advanceMatcher(matcher, node, value[index])
-    let outputNode: SecretTrieNode | undefined = node.replacement ? node : node.outputLink
+    let outputNode = findNextUnmatchedOutput(node.replacement ? node : node.outputLink)
     while (outputNode?.replacement) {
       matchEvents += 1
       if (matchEvents > maxMatchEvents) {
         throw new ResolvedSecretMatcherError('Secret matcher event limit exceeded')
       }
+      matchedPlaintexts.add(outputNode.replacement.plaintext)
       onMatch(outputNode.replacement.plaintext)
-      outputNode = outputNode.outputLink
+      outputNode = findNextUnmatchedOutput(outputNode)
     }
   }
   return matchEvents

apps/sim/executor/utils/resolved-secret-trace-registry.test.ts

@@ -248,6 +248,42 @@ describe('ResolvedSecretTraceRegistry', () => {
     }
   })
 
+  it('keeps a named anonymous secret distinct from anonymous provenance', async () => {
+    mockDecryptSecret.mockResolvedValueOnce({ decrypted: 'same-secret' })
+    const registry = new ResolvedSecretTraceRegistry(
+      [{ name: 'anonymous', plaintext: 'same-secret', encryptedValue: 'shared-ciphertext' }],
+      { userId: 'user-1', workspaceId: 'workspace-1' }
+    )
+    registry.recordResolved('anonymous', 'same-secret')
+    await registry.importProvenance(
+      {
+        version: 1,
+        complete: true,
+        entries: [{ encryptedValue: 'shared-ciphertext' }],
+        scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+      },
+      { trusted: true, anonymous: true }
+    )
+
+    expect(registry.exportCommittedProvenanceForValue('same-secret')).toEqual({
+      version: 1,
+      complete: true,
+      entries: [
+        { encryptedValue: 'shared-ciphertext' },
+        { name: 'anonymous', encryptedValue: 'shared-ciphertext' },
+      ],
+      scope: { userId: 'user-1', workspaceId: 'workspace-1' },
+    })
+    const snapshot = registry.getModelEgressSnapshot()
+    expect(snapshot.complete).toBe(true)
+    if (snapshot.complete) {
+      expect(snapshot.matches).toContainEqual({
+        plaintext: 'same-secret',
+        replacement: ANONYMOUS_SECRET_TRACE_REPLACEMENT,
+      })
+    }
+  })
+
   it('projects committed provenance while temporary activations are pending', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'API_KEY', plaintext: 'secret-value', encryptedValue: 'encrypted-value' },
@@ -701,6 +737,102 @@ describe('ResolvedSecretTraceRegistry', () => {
     })
   })
 
+  it('exports active provenance for a registered legacy runtime alias', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'API-KEY', plaintext: 'secret-value', encryptedValue: 'present-ciphertext' },
+    ])
+    registry.recordResolved('API-KEY', 'secret-value')
+
+    expect(registry.exportCommittedProvenanceForValue('prefix __var_API_KEY suffix')).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'API-KEY', encryptedValue: 'present-ciphertext' }],
+    })
+  })
+
+  it('ignores repeated unrelated runtime aliases without exhausting the scan budget', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'API_KEY', plaintext: 'secret-value', encryptedValue: 'present-ciphertext' },
+    ])
+    registry.recordResolved('API_KEY', 'secret-value')
+
+    expect(
+      registry.exportCommittedProvenanceForValue(`${'__var_Z '.repeat(1_000_001)}__var_API_KEY`)
+    ).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'API_KEY', encryptedValue: 'present-ciphertext' }],
+    })
+  })
+
+  it('matches legacy runtime aliases as complete tokens instead of prefixes', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'A', plaintext: 'secret-a', encryptedValue: 'ciphertext-a' },
+      { name: 'API_KEY', plaintext: 'secret-api', encryptedValue: 'ciphertext-api' },
+    ])
+    registry.recordResolved('A', 'secret-a')
+    registry.recordResolved('API_KEY', 'secret-api')
+
+    expect(registry.exportCommittedProvenanceForValue('__var_API_KEY')).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'API_KEY', encryptedValue: 'ciphertext-api' }],
+    })
+  })
+
+  it('conservatively retains every secret mapped to a colliding runtime alias', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'API-KEY', plaintext: 'first-secret', encryptedValue: 'first-ciphertext' },
+      { name: 'API_KEY', plaintext: 'second-secret', encryptedValue: 'second-ciphertext' },
+    ])
+    registry.recordResolved('API-KEY', 'first-secret')
+    registry.recordResolved('API_KEY', 'second-secret')
+
+    expect(registry.exportCommittedProvenanceForValue('__var_API_KEY')).toEqual({
+      version: 1,
+      complete: true,
+      entries: [
+        { name: 'API-KEY', encryptedValue: 'first-ciphertext' },
+        { name: 'API_KEY', encryptedValue: 'second-ciphertext' },
+      ],
+    })
+  })
+
+  it('retains an alias-specific entry when multiple names share one plaintext', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'FIRST', plaintext: 'shared-secret', encryptedValue: 'first-ciphertext' },
+      { name: 'SECOND', plaintext: 'shared-secret', encryptedValue: 'second-ciphertext' },
+    ])
+    registry.recordResolved('FIRST', 'shared-secret')
+    registry.recordResolved('SECOND', 'shared-secret')
+
+    expect(registry.exportCommittedProvenanceForValue('__var_SECOND')).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'SECOND', encryptedValue: 'second-ciphertext' }],
+    })
+  })
+
+  it('conservatively retains every active secret that shares a raw plaintext literal', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'FIRST', plaintext: 'true', encryptedValue: 'first-ciphertext' },
+      { name: 'SECOND', plaintext: 'true', encryptedValue: 'second-ciphertext' },
+    ])
+    registry.recordResolved('FIRST', 'true')
+    registry.recordResolved('SECOND', 'true')
+
+    const expected = {
+      version: 1 as const,
+      complete: true,
+      entries: [
+        { name: 'FIRST', encryptedValue: 'first-ciphertext' },
+        { name: 'SECOND', encryptedValue: 'second-ciphertext' },
+      ],
+    }
+    expect(registry.exportCommittedProvenanceForValue('true')).toEqual(expected)
+    expect(registry.exportCommittedProvenanceForValue(true)).toEqual(expected)
+  })
+
   it('exports active numeric, boolean, and null literals crossing a value boundary', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '1234', encryptedValue: 'number-ciphertext' },