improvement(provenance): cleanup boundary

Author: icecrasher321

apps/sim/app/api/function/execute/route.test.ts

@@ -590,7 +590,7 @@ describe('Function Execute API Route', () => {
         createMockRequest(
           'POST',
           {
-            code: 'return environmentVariables.API_KEY',
+            code: 'return {{API_KEY}}',
             envVars: { API_KEY: 'secret-at-the-end' },
             workflowId: 'workflow-1',
             workspaceId: 'workspace-1',
@@ -686,7 +686,7 @@ describe('Function Execute API Route', () => {
         createMockRequest(
           'POST',
           {
-            code: 'print("done")',
+            code: 'print("{{API_KEY}}")',
             language: 'python',
             workspaceId: 'workspace-1',
             envVars: { API_KEY: 'secret-value' },
@@ -821,6 +821,54 @@ describe('Function Execute API Route', () => {
       expect(mockExecuteInSandbox).not.toHaveBeenCalled()
     })
 
+    it('runs with authenticated incomplete mount provenance and marks exported bytes unknown', async () => {
+      envFlagsMock.isRemoteSandboxEnabled = true
+      mockExecuteInSandbox.mockResolvedValueOnce({
+        result: 'raw result',
+        stdout: '',
+        sandboxId: 'sandbox-123',
+        exportedFiles: { '/home/user/output.txt': 'raw output' },
+      })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'print("done")',
+            language: 'python',
+            workspaceId: 'workspace-1',
+            outputs: {
+              files: [
+                {
+                  path: 'files/output.txt',
+                  sandboxPath: '/home/user/output.txt',
+                  mimeType: 'text/plain',
+                },
+              ],
+            },
+            [PRIVATE_SECRET_PROVENANCE_FIELD]: {
+              version: 1,
+              complete: false,
+              selections: [],
+            },
+          },
+          { [PRIVATE_SECRET_PROVENANCE_HEADER]: PRIVATE_SECRET_PROVENANCE_BUNDLE_V1 }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      expect((await response.json()).output.result).toEqual(
+        expect.objectContaining({ fileId: 'wf_output_txt', vfsPath: 'files/output.txt' })
+      )
+      expect(mockExecuteInSandbox).toHaveBeenCalledOnce()
+      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+        expect.objectContaining({
+          buffer: Buffer.from('raw output'),
+          secretProvenance: { status: 'unknown' },
+        })
+      )
+    })
+
     it('does not rewrite a static export path that happens to equal a resolved secret', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({
@@ -853,6 +901,7 @@ describe('Function Execute API Route', () => {
       expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
         expect.objectContaining({
           target: expect.objectContaining({ path: 'files/report-secret-value.txt' }),
+          secretProvenance: { status: 'exact', entries: [] },
         })
       )
       expect(JSON.stringify(data)).toContain('files/report-secret-value.txt')
@@ -890,7 +939,7 @@ describe('Function Execute API Route', () => {
       )
     })
 
-    it('keeps a binary export unknown when files were mounted without a provenance envelope', async () => {
+    it('classifies a binary export exact-empty when ordinary files were mounted without secret provenance', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
@@ -919,7 +968,7 @@ describe('Function Execute API Route', () => {
 
       expect(response.status).toBe(200)
       expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
-        expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+        expect.objectContaining({ secretProvenance: { status: 'exact', entries: [] } })
       )
     })
 
@@ -987,7 +1036,7 @@ describe('Function Execute API Route', () => {
 
       const response = await POST(
         createMockRequest('POST', {
-          code: 'print("done")',
+          code: 'print("{{API_KEY}}")',
           language: 'python',
           workspaceId: 'workspace-1',
           envVars: { API_KEY: 'secret-value' },
@@ -2002,6 +2051,73 @@ describe('Function Execute API Route', () => {
       expect(Object.values(request.contextVariables)).not.toContain('must-not-bind')
     })
 
+    it('does not infer provenance from an unused low-entropy environment value', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'Box eSign', stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return "Box eSign"',
+            envVars: { SERVICENOW_PASSWORD: 'x' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(200)
+      expect(data.output.result).toBe('Box eSign')
+      expect(data.__resolvedSecretNames).toEqual([])
+    })
+
+    it('does not build provenance matchers for unused oversized environment values', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'safe', stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return "safe"',
+            envVars: { UNUSED: 'x'.repeat(65 * 1024) },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      expect((await response.json()).__resolvedSecretNames).toEqual([])
+    })
+
+    it('tracks only compiled names when configured secrets share the same value', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'true', stdout: '' })
+      const oneResponse = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return {{SECOND}}',
+            envVars: { FIRST: 'true', SECOND: 'true' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'true', stdout: '' })
+      const bothResponse = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'const first = {{FIRST}}; return {{SECOND}}',
+            envVars: { FIRST: 'true', SECOND: 'true' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      expect((await oneResponse.json()).__resolvedSecretNames).toEqual(['SECOND'])
+      expect((await bothResponse.json()).__resolvedSecretNames).toEqual(['FIRST', 'SECOND'])
+    })
+
     it('lowers missing shell placeholders while preserving comments and heredoc delimiters', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       const response = await POST(
@@ -2134,7 +2250,7 @@ describe('Function Execute API Route', () => {
       expect(mockExecuteInSandbox).not.toHaveBeenCalled()
     })
 
-    it('reports exact secret values returned through placeholders and the environment map', async () => {
+    it('reports exact secret values returned through placeholders without inferring direct environment reads', async () => {
       mockExecuteInIsolatedVM.mockResolvedValueOnce({
         result: 'secret-valueother-secret',
         stdout: '',
@@ -2171,14 +2287,15 @@ describe('Function Execute API Route', () => {
       const directData = await directResponse.json()
 
       expect(envData.__resolvedSecretNames).toEqual(['ENV_ONLY', 'SHARED'])
-      expect(directData.__resolvedSecretNames).toEqual(['API_KEY'])
+      expect(directData.output.result).toBe('secret-value')
+      expect(directData.__resolvedSecretNames).toEqual([])
     })
 
     it.each([
       { name: 'numeric', secret: '123', result: 123 },
       { name: 'boolean', secret: 'true', result: true },
     ])(
-      'records provenance for a typed $name secret returned through direct environment access',
+      'preserves a typed $name value returned through legacy direct environment access without inferred provenance',
       async ({ secret, result }) => {
         mockExecuteInIsolatedVM.mockResolvedValueOnce({ result, stdout: '' })
 
@@ -2197,11 +2314,11 @@ describe('Function Execute API Route', () => {
         const data = await response.json()
 
         expect(data.output.result).toBe(result)
-        expect(data.__resolvedSecretNames).toEqual(['API_KEY'])
+        expect(data.__resolvedSecretNames).toEqual([])
       }
     )
 
-    it('reports shell substitutions and exact secret output from direct environment access', async () => {
+    it('reports placeholder output without inferring provenance from legacy shell environment access', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteShellInSandbox.mockResolvedValueOnce({
         result: null,
@@ -2245,7 +2362,8 @@ describe('Function Execute API Route', () => {
       const directData = await directResponse.json()
 
       expect(referencedData.__resolvedSecretNames).toEqual(['API_KEY'])
-      expect(directData.__resolvedSecretNames).toEqual(['API_KEY'])
+      expect(directData.output.stdout).toBe('secret-value')
+      expect(directData.__resolvedSecretNames).toEqual([])
     })
 
     it('returns nonzero shell stderr as a visible 422 error and diagnostic output', async () => {
@@ -2289,8 +2407,8 @@ describe('Function Execute API Route', () => {
       )
 
       expect(response.status).toBe(200)
-      expect((await response.json()).__resolvedSecretNames).toBeUndefined()
-      expect(response.headers.get('x-sim-private-tool-metadata')).toBeNull()
+      expect((await response.json()).__resolvedSecretNames).toEqual([])
+      expect(response.headers.get('x-sim-private-tool-metadata')).toBe('resolved-secret-names-v1')
       expect(mockExecuteInIsolatedVM).toHaveBeenCalled()
     })
 

apps/sim/app/api/function/execute/route.ts

@@ -989,7 +989,6 @@ interface FunctionRouteExecutionContext {
   outputSecretNamesByScanLiteral: Map<string, string[]>
   outputSecretPlaintextsByName: Map<string, string>
   mountedFileSecretProvenanceScanner?: MountedFileSecretProvenanceScanner
-  hasMountedSandboxFiles: boolean
 }
 
 type ResolvedSecretNamesMetadataType =
@@ -1007,10 +1006,16 @@ function inspectMountedWorkspaceFileProvenance(
 ): MountedWorkspaceFileProvenanceInspection {
   const inspection = inspectPrivateSecretProvenanceRequest(headers, body)
   if (inspection.status === 'unsupported') return { status: 'none' }
+  if (inspection.status !== 'verified' || !isPrivateSecretProvenanceBundleV1(inspection.value)) {
+    return { status: 'invalid' }
+  }
+  if (!inspection.value.complete) {
+    return {
+      status: 'verified',
+      provenance: { version: 1, complete: false, entries: [] },
+    }
+  }
   if (
-    inspection.status !== 'verified' ||
-    !isPrivateSecretProvenanceBundleV1(inspection.value) ||
-    !inspection.value.complete ||
     inspection.value.selections.length !== 1 ||
     inspection.value.selections[0]?.key !== MOUNTED_WORKSPACE_FILES_PROVENANCE_KEY
   ) {
@@ -1211,19 +1216,13 @@ function activateOutputSecretProvenance(
 }
 
 /**
- * True when any secret material was in scope for this execution — a mounted environment secret, or
- * a secret carried by a mounted input file. When false, nothing secret ever reached the sandbox, so
- * no export of any kind can carry one.
- *
- * Mounted bytes are classified from the caller's provenance envelope. Files mounted *without* one
- * are unclassifiable rather than clean: absence of an envelope is absence of evidence, not evidence
- * the mount carried nothing. Those fail closed here so the classification can never be stronger
- * than what the caller actually attested to.
+ * True when this execution compiled a secret placeholder or received a mounted file with verified
+ * secret provenance. Ordinary mounts without a provenance envelope are user data, not evidence that
+ * a Sim secret was resolved in this call.
  */
 function hasSecretMaterialInScope(context: FunctionRouteExecutionContext): boolean {
   if (context.outputSecretPlaintextsByName.size > 0) return true
-  const scanner = context.mountedFileSecretProvenanceScanner
-  return scanner ? scanner.hasSecrets : context.hasMountedSandboxFiles
+  return context.mountedFileSecretProvenanceScanner?.hasSecrets ?? false
 }
 
 /**
@@ -2030,29 +2029,6 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       outputSecretNamesByScanLiteral: new Map(),
       outputSecretPlaintextsByName: new Map(),
       mountedFileSecretProvenanceScanner,
-      hasMountedSandboxFiles: (_sandboxFiles?.length ?? 0) > 0,
-    }
-    for (const [name, plaintext] of Object.entries(envVars)) {
-      if (!plaintext) continue
-      routeContext.outputSecretPlaintextsByName.set(name, plaintext)
-      const scanLiterals = new Set([plaintext, JSON.stringify(plaintext).slice(1, -1)])
-      for (const scanLiteral of scanLiterals) {
-        const names = routeContext.outputSecretNamesByScanLiteral.get(scanLiteral) ?? []
-        names.push(name)
-        routeContext.outputSecretNamesByScanLiteral.set(scanLiteral, names)
-      }
-    }
-    if (routeContext.outputSecretNamesByScanLiteral.size > 0) {
-      try {
-        routeContext.outputSecretMatcher = createResolvedSecretMatcher(
-          [...routeContext.outputSecretNamesByScanLiteral].map(([plaintext, names]) => ({
-            plaintext,
-            replacement: `{{${names[0]}}}`,
-          }))
-        )
-      } catch {
-        routeContext.outputProvenanceComplete = false
-      }
     }
 
     const lang = isValidCodeLanguage(language) ? language : DEFAULT_CODE_LANGUAGE
@@ -2081,6 +2057,30 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       environmentVariables: envVars,
       reservedNames: Object.keys(contextVariables),
     })
+    for (const name of compilation.resolvedSecretNames) {
+      if (!Object.hasOwn(envVars, name)) continue
+      const plaintext = envVars[name]
+      if (!plaintext) continue
+      routeContext.outputSecretPlaintextsByName.set(name, plaintext)
+      const scanLiterals = new Set([plaintext, JSON.stringify(plaintext).slice(1, -1)])
+      for (const scanLiteral of scanLiterals) {
+        const names = routeContext.outputSecretNamesByScanLiteral.get(scanLiteral) ?? []
+        names.push(name)
+        routeContext.outputSecretNamesByScanLiteral.set(scanLiteral, names)
+      }
+    }
+    if (routeContext.outputSecretNamesByScanLiteral.size > 0) {
+      try {
+        routeContext.outputSecretMatcher = createResolvedSecretMatcher(
+          [...routeContext.outputSecretNamesByScanLiteral].map(([plaintext, names]) => ({
+            plaintext,
+            replacement: `{{${[...names].sort()[0]}}}`,
+          }))
+        )
+      } catch {
+        routeContext.outputProvenanceComplete = false
+      }
+    }
     resolvedCode = compilation.code
     compilerInternalIdentifiers = [...compilation.internalIdentifiers]
     compilerPrivateInputs = [...compilation.privateInputs]