fix(sandbox): redact temporary session credentials in model output

Author: icecrasher321

apps/sim/lib/execution/remote-sandbox/types.ts

@@ -92,6 +92,11 @@ export interface SandboxSessionRequest {
   cli?: { path: string; content: string; runtime?: { path: string; content: string } }
   /** Extra environment variables present on every execution in the session. */
   envs?: Record<string, string>
+  /**
+   * Ephemeral callback credentials for model-output redaction after execution. They expire with
+   * the tool lease and do not contribute to durable machine or exported-file provenance.
+   */
+  outputProvenance?: DurableSecretProvenance
   /**
    * This execution mounts bytes whose secret provenance is unknown, so the machine's input
    * history must not stay certified clean even when the caller's own inputs are.

apps/sim/lib/function-execution/execute-request.ts

@@ -1030,6 +1030,7 @@ interface FunctionRouteExecutionContext {
   runtimeFileSecretTraceRegistry?: ResolvedSecretTraceRegistry
   runtimeInputProvenanceUnrecorded?: boolean
   resolvedSecretTraceRegistry?: ResolvedSecretTraceRegistry
+  sessionOutputProvenance?: DurableSecretProvenance
 }
 
 /** Keeps bound file provenance in both ordinary Function results and exported artifact bytes. */
@@ -1276,6 +1277,17 @@ async function functionJsonResponse<T>(
   context: FunctionRouteExecutionContext,
   init?: ResponseInit
 ) {
+  /**
+   * Narrow callback receipts to the returned JSON before compaction. Scanning serialized bytes
+   * avoids activating secret-only traversal limits on large results that contain no credential.
+   */
+  if (context.sessionOutputProvenance && context.resolvedSecretTraceRegistry) {
+    await importDurableSecretProvenance(
+      context.resolvedSecretTraceRegistry,
+      context.sessionOutputProvenance,
+      JSON.stringify(body)
+    )
+  }
   const responseBody = {
     ...body,
     largeValueKeys: context.largeValueKeys,
@@ -2487,6 +2499,7 @@ export async function executeFunctionRequest(
       ),
       mountedFileSecretProvenanceScanner,
       resolvedSecretTraceRegistry: auth.resolvedSecretTraceRegistry,
+      sessionOutputProvenance: admittedSession?.outputProvenance,
     }
 
     const lang = isValidCodeLanguage(language) ? language : DEFAULT_CODE_LANGUAGE

apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts

@@ -6,6 +6,18 @@ import { createDelegatedPrincipal } from '@sim/testing/factories/principal.facto
 import { createDeferred } from '@sim/testing/helpers/deferred'
 import { setEnv } from '@sim/testing/mocks/env.mock'
 import { envFlagsMock } from '@sim/testing/mocks/env-flags.mock'
+import {
+  mothershipAgentUrlMock,
+  mothershipAgentUrlMockFns,
+} from '@sim/testing/mocks/mothership-agent-url.mock'
+import {
+  mothershipAsyncRunsMock,
+  mothershipAsyncRunsMockFns,
+} from '@sim/testing/mocks/mothership-async-runs.mock'
+import {
+  mothershipGoFetchMock,
+  mothershipGoFetchMockFns,
+} from '@sim/testing/mocks/mothership-go-fetch.mock'
 import { redisConfigMockFns } from '@sim/testing/mocks/redis-config.mock'
 import {
   remoteSandboxProviderMock,
@@ -30,9 +42,9 @@ vi.mock('@/lib/execution/remote-sandbox/resolve', () => ({
   repairMissingSandboxImage: async () => null,
   RUNTIME_INSTALL_TIMEOUT_MS: 60_000,
 }))
-vi.mock('@/lib/mothership/tools/sandbox-session', () => ({
-  buildMothershipSandboxSession: async (args: { sessionKey: string }) => ({ key: args.sessionKey }),
-}))
+vi.mock('@/lib/mothership/async-runs/repository', () => mothershipAsyncRunsMock)
+vi.mock('@/lib/mothership/request/go/fetch', () => mothershipGoFetchMock)
+vi.mock('@/lib/mothership/server/agent-url', () => mothershipAgentUrlMock)
 vi.mock('@/lib/workspace-files/application/delegated-principal', () => ({
   rebindWorkspaceFileDelegatedPrincipal: ({ principal }: { principal: unknown }) => principal,
 }))
@@ -61,6 +73,10 @@ import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/reso
 import type { ToolExecutionContext } from '@/lib/mothership/tool-executor/types'
 import { executeFunctionExecute } from '@/lib/mothership/tools/handlers/function-execute'
 import { executeRunCode } from '@/lib/mothership/tools/handlers/run-code'
+import {
+  readSandboxResourceScope,
+  withSandboxResourceScope,
+} from '@/lib/mothership/tools/sandbox-resources'
 import { chatSandboxSessionKey } from '@/lib/mothership/tools/sandbox-session-key'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { buildFunctionExecuteBody, functionExecuteTool } from '@/tools/function/execute'
@@ -83,34 +99,47 @@ function workerPath(path: string) {
   return path.startsWith('/') ? join(root, path.slice(1)) : join(root, 'home/user', path)
 }
 
+async function runWorkerProcess(
+  executable: string,
+  args: string[],
+  options: Parameters<SandboxHandle['runCommand']>[1]
+) {
+  const envs = Object.fromEntries(
+    Object.entries(options.envs ?? {}).map(([key, value]) => [
+      key,
+      value
+        .replaceAll('/home/user', workerPath('/home/user'))
+        .replaceAll('/tmp/sim/', `${workerPath('/tmp/sim')}/`)
+        .replaceAll('/tmp/.sim-private-input-', workerPath('/tmp/.sim-private-input-')),
+    ])
+  )
+  try {
+    const output = await execute(executable, args, {
+      cwd: workerPath('/home/user'),
+      env: { PATH: '/usr/bin:/bin:/opt/homebrew/bin', ...envs },
+      timeout: options.timeoutMs,
+      maxBuffer: options.maxOutputBytes,
+    })
+    return { ...output, exitCode: 0 }
+  } catch (error) {
+    const failure = error as { stdout: string; stderr: string; code: number }
+    return { stdout: failure.stdout, stderr: failure.stderr, exitCode: failure.code }
+  }
+}
+
 function localWorker(): SandboxHandle {
   return {
     sandboxId: `local-${generateShortId(12)}`,
-    runCode: async () => {
-      throw new Error('This reproduction uses actual shell processes')
-    },
-    async runCommand(command, options) {
-      const envs = Object.fromEntries(
-        Object.entries(options.envs ?? {}).map(([key, value]) => [
-          key,
-          value
-            .replaceAll('/home/user', workerPath('/home/user'))
-            .replaceAll('/tmp/sim/', `${workerPath('/tmp/sim')}/`),
-        ])
-      )
-      try {
-        const output = await execute('/bin/bash', ['-c', command], {
-          cwd: workerPath('/home/user'),
-          env: { PATH: '/usr/bin:/bin:/opt/homebrew/bin', ...envs },
-          timeout: options.timeoutMs,
-          maxBuffer: options.maxOutputBytes,
-        })
-        return { ...output, exitCode: 0 }
-      } catch (error) {
-        const failure = error as { stdout: string; stderr: string; code: number }
-        return { stdout: failure.stdout, stderr: failure.stderr, exitCode: failure.code }
+    async runCode(code, options) {
+      const result = await runWorkerProcess(process.execPath, ['-e', code], options)
+      return {
+        text: '',
+        stdout: result.stdout,
+        stderr: result.stderr,
+        ...(result.exitCode ? { error: { name: 'RuntimeError', value: result.stderr } } : {}),
       }
     },
+    runCommand: (command, options) => runWorkerProcess('/bin/bash', ['-c', command], options),
     extendLifetime: async () => {},
     getFileSize: async (path) => (await stat(workerPath(path))).size,
     readFile: async (path) => readFile(workerPath(path), 'utf8'),
@@ -175,7 +204,16 @@ beforeEach(async () => {
       throw new Error('Only the existing disposable worker may be used')
     },
   })
-  setEnv({ ENCRYPTION_KEY: 'a'.repeat(64) })
+  setEnv({
+    ENCRYPTION_KEY: 'a'.repeat(64),
+    MOTHERSHIP_SIM_TRANSPORT: 'direct',
+    MOTHERSHIP_SANDBOX_CLI_ENDPOINT: 'https://callback.test',
+  })
+  mothershipAsyncRunsMockFns.mockIsActiveSandboxResourceOwner.mockResolvedValue(true)
+  mothershipAgentUrlMockFns.mockGetMothershipBaseURL.mockResolvedValue('https://worker.test')
+  mothershipGoFetchMockFns.mockFetchGo.mockImplementation(async () =>
+    Response.json({ version: 1, entrypoint: 'fixture-bootstrap' })
+  )
   envFlagsMock.isMothershipSandboxEnabled = true
   envFlagsMock.isRemoteSandboxEnabled = true
   root = await mkdtemp('/private/tmp/sim-workbench-test-')
@@ -250,9 +288,13 @@ function context(): ToolExecutionContext {
   }
 }
 
-async function run(code: string, secrets: string[] = []) {
+async function run(
+  code: string,
+  secrets: string[] = [],
+  language: 'shell' | 'javascript' = 'shell'
+) {
   const current = context()
-  const raw = await executeRunCode({ code, language: 'shell', secrets }, current)
+  const raw = await inResourceScope(() => executeRunCode({ code, language, secrets }, current))
   const projected = inspectToolResultForCopilot(
     raw,
     current.resolvedSecretTraceRegistry,
@@ -262,7 +304,82 @@ async function run(code: string, secrets: string[] = []) {
   return { raw, projected }
 }
 
+function inResourceScope<T>(action: () => Promise<T>) {
+  return withSandboxResourceScope(
+    {
+      ...scope,
+      chatId,
+      runId: 'fixture-run',
+      toolCallId: 'fixture-call',
+      ownerToken: 'fixture-owner',
+    },
+    AbortSignal.timeout(15_000),
+    undefined,
+    action
+  )
+}
+
 describe('persistent workbench output confidentiality', () => {
+  it.each(['javascript', 'shell'] as const)(
+    'redacts session credentials in %s output while preserving routing metadata',
+    async (language) => {
+      const code =
+        language === 'shell'
+          ? 'printf "%s" "$SIM_API_KEY" > session-key.txt; printf "%s %s" "$SIM_API_KEY" "$SIM_WORKSPACE"'
+          : '(await import("node:fs")).writeFileSync("session-key.txt", process.env.SIM_API_KEY); process.stdout.write(process.env.SIM_API_KEY + " " + process.env.SIM_WORKSPACE)'
+      const result = await run(code, [], language)
+      expect(result.raw.success).toBe(true)
+      const credential = await readFile(workerPath('session-key.txt'), 'utf8')
+      expect(credential).toMatch(/^mothership-sandbox:/)
+      expect(result.projected.safe).toBe(true)
+      expect(JSON.stringify(result.projected.result)).not.toContain(credential)
+      expect(JSON.stringify(result.projected.result)).toContain('{{SIM_API_KEY}}')
+      expect(JSON.stringify(result.projected.result)).toContain(scope.workspaceId)
+      expect(
+        await readSessionSecretProvenance(chatSandboxSessionKey(chatId), {
+          providerId: 'e2b',
+          sandboxId: machine.sandboxId,
+        })
+      ).toEqual({ status: 'exact', entries: [] })
+    }
+  )
+  it('redacts session credentials when the provider falls back to a one-shot machine', async () => {
+    remoteSandboxProviderMockFns.mockResolveProvider.mockReturnValue({
+      id: 'e2b',
+      dependencyStrategy: 'prebuilt',
+      resolveLifetimeMs: (ms: number) => ms,
+      create: async () => machine,
+    })
+    const result = await run('printf "%s" "$SIM_API_KEY" > session-key.txt; cat session-key.txt')
+    const credential = await readFile(workerPath('session-key.txt'), 'utf8')
+    expect(result.raw.success).toBe(true)
+    expect(result.projected.safe).toBe(true)
+    expect(JSON.stringify(result.projected.result)).not.toContain(credential)
+    expect(JSON.stringify(result.projected.result)).toContain('{{SIM_API_KEY}}')
+  })
+  it('omits session authentication if its encrypted receipt cannot be created', async () => {
+    setEnv({ ENCRYPTION_KEY: '' })
+    const result = await run('test -z "$SIM_API_KEY" && printf allowed')
+    expect(result.raw.success).toBe(true)
+    expect(JSON.stringify(result.projected.result)).toContain('allowed')
+  })
+  it('keeps large ordinary results readable when callback credentials are absent from them', async () => {
+    const result = await run('return Array.from({ length: 100_001 }, () => 0)', [], 'javascript')
+    expect(result.raw.success).toBe(true)
+    expect(result.raw.output).toHaveProperty('result.length', 100_001)
+    expect(result.projected.safe).toBe(true)
+  })
+  it('revokes callback authentication before a result reaches the model', async () => {
+    const result = await run(
+      'printf "%s" "$SIM_API_KEY" > session-key.txt; printf "%s" "$SIM_ENDPOINT" > session-endpoint.txt; printf done'
+    )
+    const credential = await readFile(workerPath('session-key.txt'), 'utf8')
+    const endpoint = await readFile(workerPath('session-endpoint.txt'), 'utf8')
+    expect(result.raw.success).toBe(true)
+    expect(result.projected.safe).toBe(true)
+    expect(await readSandboxResourceScope(endpoint.split('/').at(-1)!, credential)).toBeNull()
+  })
+
   it('allows a mounted empty value without requiring a redaction receipt', async () => {
     const emptyCatalog = [
       { name: 'TOKEN', plaintext: '', encryptedValue: (await encryptSecret('')).encrypted },
@@ -395,6 +512,22 @@ describe('persistent workbench output confidentiality', () => {
     expect(JSON.stringify(output.projected.result)).not.toContain(canary)
     expect(JSON.stringify(output.projected.result)).toContain('{{TOKEN}}')
   })
+  it('keeps ordinary binary exports usable when only callback authentication is present', async () => {
+    const result = await inResourceScope(() =>
+      executeFunctionExecute(
+        {
+          code: "printf '\\211PNG\\000\\001' > image.png",
+          language: 'shell',
+          outputs: { files: [{ path: 'files/image.png', sandboxPath: 'image.png' }] },
+        },
+        context()
+      )
+    )
+    expect(result.success).toBe(true)
+    const saved = io.write.mock.calls.at(-1)![0]
+    expect(saved.buffer).toEqual(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0, 1]))
+    expect(saved.secretProvenance).toEqual({ status: 'exact', entries: [] })
+  })
   it('retains historical secret provenance on a text export', async () => {
     await run('printf "%s" "$TOKEN" > saved.txt', ['TOKEN'])
     const current = context()

apps/sim/lib/mothership/tools/sandbox-session.test.ts

@@ -31,7 +31,7 @@ const fetchBootstrap = mothershipGoFetchMockFns.mockFetchGo
 const baseURL = mothershipAgentUrlMockFns.mockGetMothershipBaseURL
 
 urlsMockFns.mockGetBaseUrl.mockReturnValue('https://unused.test')
-setEnv({ MOTHERSHIP_SANDBOX_CLI_ENDPOINT: 'https://sim.test' })
+setEnv({ MOTHERSHIP_SANDBOX_CLI_ENDPOINT: 'https://sim.test', ENCRYPTION_KEY: 'a'.repeat(64) })
 
 const request = { sessionKey: 'chat', workspaceId: 'workspace', userId: 'user' }
 

apps/sim/lib/mothership/tools/sandbox-session.ts

@@ -5,7 +5,9 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { env } from '@/lib/core/config/env'
+import { encryptSecret } from '@/lib/core/security/encryption'
 import { getBaseUrl } from '@/lib/core/utils/urls'
+import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import type { SandboxSessionRequest } from '@/lib/execution/remote-sandbox/types'
 import { WorkbenchBootstrap } from '@/lib/mothership/generated/workbench'
 import { fetchGo } from '@/lib/mothership/request/go/fetch'
@@ -79,11 +81,23 @@ export async function buildMothershipSandboxSession(args: {
   if (getSimConnection().mode === 'checkpoint') return { key: args.sessionKey }
   const cli = await workbenchCli(args.userId, args.signal)
   let cliEnvs: Record<string, string> | undefined
+  let outputProvenance: DurableSecretProvenance | undefined
   try {
     const apiKey = `mothership-sandbox:${generateId()}`
     const endpoint = env.MOTHERSHIP_SANDBOX_CLI_ENDPOINT?.trim() || getBaseUrl()
     const scopedEndpoint = await sandboxResourceEndpoint(endpoint, args, apiKey)
     if (scopedEndpoint !== endpoint) {
+      outputProvenance = {
+        status: 'exact',
+        entries: [
+          {
+            name: 'SIM_API_KEY',
+            encryptedValue: (await encryptSecret(apiKey)).encrypted,
+            sourceUserId: args.userId,
+            ...(args.workspaceId ? { sourceWorkspaceId: args.workspaceId } : {}),
+          },
+        ],
+      }
       cliEnvs = {
         SIM_API_KEY: apiKey,
         ...(args.organizationId
@@ -101,6 +115,6 @@ export async function buildMothershipSandboxSession(args: {
   return {
     key: args.sessionKey,
     cli,
-    ...(cliEnvs ? { envs: cliEnvs } : {}),
+    ...(cliEnvs ? { envs: cliEnvs, outputProvenance } : {}),
   }
 }