fix(execution): fail closed when files are mounted without a provenance envelope

The binary classifier read an absent mounted-file scanner as "no mounted
secrets". That is absence of evidence, not evidence of absence: the request
contract permits _sandboxFiles without the provenance envelope, so a caller
that mounts secret-bearing bytes and omits the envelope would have a derived
binary persisted as provably secret-free.

Not reachable today — the route is internal-JWT-only and its one file-mounting
caller always emits the envelope — but the classification rested on an
invariant nothing enforced.

- the copilot handler emits the envelope on the same condition that produces
  the mount, so tables ship one too and the two cannot drift apart
- a mount with no verified scanner now counts as secret material in scope, so
  the classification is never stronger than what the caller attested to

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/function/execute/route.test.ts

@@ -890,6 +890,39 @@ describe('Function Execute API Route', () => {
       )
     })
 
+    it('keeps a binary export unknown when files were mounted without a provenance envelope', async () => {
+      envFlagsMock.isRemoteSandboxEnabled = true
+      mockExecuteInSandbox.mockResolvedValueOnce({
+        result: 'done',
+        stdout: '',
+        sandboxId: 'sandbox-123',
+        exportedFiles: { '/home/user/small.jpg': '/9j/4AAQ' },
+      })
+
+      const response = await POST(
+        createMockRequest('POST', {
+          code: 'print("done")',
+          language: 'python',
+          workspaceId: 'workspace-1',
+          _sandboxFiles: [{ path: '/home/user/in.bin', content: 'mounted bytes' }],
+          outputs: {
+            files: [
+              {
+                path: 'files/small.jpg',
+                sandboxPath: '/home/user/small.jpg',
+                mimeType: 'image/jpeg',
+              },
+            ],
+          },
+        })
+      )
+
+      expect(response.status).toBe(200)
+      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+        expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+      )
+    })
+
     it('keeps a binary export unknown when a mounted input file carried a secret', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({

apps/sim/app/api/function/execute/route.ts

@@ -989,6 +989,7 @@ interface FunctionRouteExecutionContext {
   outputSecretNamesByScanLiteral: Map<string, string[]>
   outputSecretPlaintextsByName: Map<string, string>
   mountedFileSecretProvenanceScanner?: MountedFileSecretProvenanceScanner
+  hasMountedSandboxFiles: boolean
 }
 
 type ResolvedSecretNamesMetadataType =
@@ -1213,12 +1214,16 @@ function activateOutputSecretProvenance(
  * True when any secret material was in scope for this execution — a mounted environment secret, or
  * a secret carried by a mounted input file. When false, nothing secret ever reached the sandbox, so
  * no export of any kind can carry one.
+ *
+ * Mounted bytes are classified from the caller's provenance envelope. Files mounted *without* one
+ * are unclassifiable rather than clean: absence of an envelope is absence of evidence, not evidence
+ * the mount carried nothing. Those fail closed here so the classification can never be stronger
+ * than what the caller actually attested to.
  */
 function hasSecretMaterialInScope(context: FunctionRouteExecutionContext): boolean {
-  return (
-    context.outputSecretPlaintextsByName.size > 0 ||
-    (context.mountedFileSecretProvenanceScanner?.hasSecrets ?? false)
-  )
+  if (context.outputSecretPlaintextsByName.size > 0) return true
+  const scanner = context.mountedFileSecretProvenanceScanner
+  return scanner ? scanner.hasSecrets : context.hasMountedSandboxFiles
 }
 
 /**
@@ -2025,6 +2030,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       outputSecretNamesByScanLiteral: new Map(),
       outputSecretPlaintextsByName: new Map(),
       mountedFileSecretProvenanceScanner,
+      hasMountedSandboxFiles: (_sandboxFiles?.length ?? 0) > 0,
     }
     for (const [name, plaintext] of Object.entries(envVars)) {
       if (!plaintext) continue

apps/sim/lib/copilot/tools/handlers/function-execute.ts

@@ -636,12 +636,14 @@ export async function executeFunctionExecute(
           secretActorUserId ?? context.userId,
           mountedRegistry
         )
+        // Every mount ships its provenance envelope, tables included. The route classifies an
+        // output file from that envelope, so a mount without one is unclassifiable there — it
+        // cannot tell "nothing secret was mounted" from "nobody said". Emitting on the same
+        // condition that produces the mount keeps the two from drifting apart.
         if (resolved.length > 0) {
           const existing = (enrichedParams._sandboxFiles as SandboxFile[]) || []
           enrichedParams._sandboxFiles = [...existing, ...resolved]
-        }
 
-        if (inputFiles.length > 0 || inputDirectories.length > 0) {
           const provenance = mountedRegistry.exportProvenance()
           const bundle: PrivateSecretProvenanceBundleV1 = {
             version: 1,