fix(providers): redact resolved level content from sanitizer diagnostics

The model-level fields accept environment and block references, so an
unrecognized level is not necessarily a mistyped level — it is whatever the
reference resolved to, which can be secret content. The diagnostics added for
dropped and undeclared levels echoed it straight into server logs.

- log a level only when the catalogue declares it somewhere, or it is an
  `auto` / `none` sentinel; anything else is reported by length alone
- stop discarding levels for a model the catalogue has never seen. Absent is
  unknown, not known-incapable, and a reference is exactly how a newly released
  model arrives before Sim catalogues it — the provider decides instead. Models
  the catalogue knows, and every dynamic-provider id, keep the protective drop

Author: waleedlatif1

apps/sim/providers/index.test.ts

@@ -604,4 +604,63 @@ describe('executeProviderRequest — model level normalization', () => {
 
     expect(mockLoggerWarn).not.toHaveBeenCalled()
   })
+
+  /**
+   * These fields take environment and block references, so a mistyped reference resolves the
+   * secret into the level. The diagnostics must never echo it.
+   */
+  it('redacts a level that is not a catalogue level before logging it', async () => {
+    const secret = 'sk-proj-abcdef0123456789'
+
+    await executeProviderRequest('openai', {
+      model: 'gpt-5',
+      workspaceId: 'ws-1',
+      reasoningEffort: secret,
+    })
+
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({ value: `[redacted ${secret.length} chars]` })
+    )
+    const loggedText = JSON.stringify(mockLoggerWarn.mock.calls)
+    expect(loggedText).not.toContain(secret)
+  })
+
+  it('keeps the auto sentinel readable in a drop diagnostic', async () => {
+    await executeProviderRequest('anthropic', {
+      model: 'claude-opus-4-6',
+      workspaceId: 'ws-1',
+      reasoningEffort: 'auto',
+    })
+
+    expect(mockLoggerWarn).toHaveBeenCalledWith(
+      'Model does not support this level; dropping it from the request',
+      expect.objectContaining({ value: 'auto' })
+    )
+  })
+
+  /**
+   * A model the catalogue has never seen is unknown, not known-incapable — which is exactly
+   * how a newly released model arrives through a reference before Sim catalogues it. The
+   * provider decides, rather than the level being discarded on a stale list.
+   */
+  it('forwards levels for a model absent from the catalogue', async () => {
+    await executeProviderRequest('openai', {
+      model: 'gpt-6-unreleased',
+      workspaceId: 'ws-1',
+      reasoningEffort: 'high',
+    })
+
+    expect(sentRequest().reasoningEffort).toBe('high')
+  })
+
+  it('still drops levels for a dynamic-provider model that does not take them', async () => {
+    await executeProviderRequest('ollama', {
+      model: 'ollama/llama3',
+      workspaceId: 'ws-1',
+      reasoningEffort: 'high',
+    })
+
+    expect(sentRequest().reasoningEffort).toBeUndefined()
+  })
 })

apps/sim/providers/index.ts

@@ -19,6 +19,8 @@ import {
   getReasoningEffortValuesForModel,
   getThinkingLevelsForModel,
   getVerbosityValuesForModel,
+  isKnownModelId,
+  isKnownModelLevelValue,
 } from '@/providers/models'
 import { getProviderExecutor } from '@/providers/registry'
 import {
@@ -66,14 +68,27 @@ const MODEL_LEVEL_SENTINELS = new Set(['auto', 'none'])
 
 type ModelLevelField = 'reasoningEffort' | 'verbosity' | 'thinkingLevel'
 
+/**
+ * Renders a level for a log line.
+ *
+ * These fields accept variable and environment references, so an unrecognized value is not
+ * necessarily a mistyped level — it is whatever the reference resolved to, which may be secret
+ * content. Only a level the catalogue declares somewhere is safe to echo; anything else is
+ * reported by length alone, which is enough to tell a stray level from a resolved blob.
+ */
+function describeLevel(value: string): string {
+  const isSafe = MODEL_LEVEL_SENTINELS.has(value) || isKnownModelLevelValue(value)
+  return isSafe ? value : `[redacted ${value.length} chars]`
+}
+
 /**
  * Clears a level whose resolved model does not accept the field at all.
  *
  * Dropping is the safe default — a provider that has no such parameter rejects the whole
  * request — but the discard is reported because the model can be bound to a variable or block
  * reference and is therefore only known at execution time. Without this, a run whose reference
- * resolved to a model outside Sim's catalogue would quietly fall back to that model's default
- * while the caller believed the level applied.
+ * resolved to a model that does not take the field would quietly fall back to that model's
+ * default while the caller believed the level applied.
  */
 function dropUnsupportedLevel(
   field: ModelLevelField,
@@ -84,7 +99,7 @@ function dropUnsupportedLevel(
     logger.warn('Model does not support this level; dropping it from the request', {
       field,
       model,
-      value,
+      value: describeLevel(value),
     })
   }
   return undefined
@@ -111,7 +126,7 @@ function warnOnUnrecognizedLevel(
   logger.warn('Model level is not one this model declares; forwarding to the provider', {
     field,
     model,
-    value,
+    value: describeLevel(value),
     declaredValues,
   })
 }
@@ -128,23 +143,32 @@ function sanitizeRequest(request: ProviderRequest): ProviderRequest {
     sanitizedRequest.temperature = undefined
   }
 
-  if (model && !supportsReasoningEffort(model)) {
+  /**
+   * A model absent from the catalogue is unknown, not known-incapable. Since the model can be
+   * bound to a reference, that is exactly how a newly released model arrives before Sim has
+   * catalogued it — so its levels are forwarded and the provider decides, rather than being
+   * discarded on the strength of a list that has not caught up. Models the catalogue does
+   * know, and every dynamic-provider id, keep the protective drop.
+   */
+  const isCatalogued = Boolean(model) && isKnownModelId(model)
+
+  if (model && isCatalogued && !supportsReasoningEffort(model)) {
     sanitizedRequest.reasoningEffort = dropUnsupportedLevel(
       'reasoningEffort',
       model,
       sanitizedRequest.reasoningEffort
     )
   }
 
-  if (model && !supportsVerbosity(model)) {
+  if (model && isCatalogued && !supportsVerbosity(model)) {
     sanitizedRequest.verbosity = dropUnsupportedLevel(
       'verbosity',
       model,
       sanitizedRequest.verbosity
     )
   }
 
-  if (model && !supportsThinking(model)) {
+  if (model && isCatalogued && !supportsThinking(model)) {
     sanitizedRequest.thinkingLevel = dropUnsupportedLevel(
       'thinkingLevel',
       model,

apps/sim/providers/models.ts

@@ -4553,6 +4553,33 @@ export function getThinkingLevelsForModel(modelId: string): string[] | null {
   return capability?.levels ?? null
 }
 
+const ALL_MODEL_LEVEL_VALUES = new Set<string>()
+for (const provider of Object.values(PROVIDER_DEFINITIONS)) {
+  for (const model of provider.models) {
+    for (const value of model.capabilities.reasoningEffort?.values ?? []) {
+      ALL_MODEL_LEVEL_VALUES.add(value)
+    }
+    for (const value of model.capabilities.verbosity?.values ?? []) {
+      ALL_MODEL_LEVEL_VALUES.add(value)
+    }
+    for (const level of model.capabilities.thinking?.levels ?? []) {
+      ALL_MODEL_LEVEL_VALUES.add(level)
+    }
+  }
+}
+
+/**
+ * Whether a string is a tuning level some model in the catalogue declares, regardless of which.
+ *
+ * Callers that need to put a caller-supplied level into a log or an error gate on this first.
+ * These fields accept variable and environment references, so an unrecognized value is not
+ * necessarily a mistyped level — it can be whatever that reference resolved to, up to and
+ * including secret content that must never be echoed.
+ */
+export function isKnownModelLevelValue(value: string): boolean {
+  return ALL_MODEL_LEVEL_VALUES.has(value)
+}
+
 /**
  * Per-provider defaults for thinking stream visibility, used when a model does
  * not declare `capabilities.thinking.streamed` explicitly. Gemini and OpenAI