fix(sandbox): preserve boundary compatibility

Author: icecrasher321

apps/sim/lib/execution/remote-sandbox/session-files.test.ts

@@ -35,6 +35,8 @@ vi.mock('@/lib/execution/remote-sandbox/session-lock', () => ({
 }))
 
 import { observeSandboxExecution } from '@/lib/execution/remote-sandbox/execution-observer'
+import { SandboxOutputLimitError } from '@/lib/execution/remote-sandbox/output-limits'
+import { readSessionSecretProvenance } from '@/lib/execution/remote-sandbox/session-file-provenance'
 import {
   readSessionSandboxFile,
   writeSessionSandboxFile,
@@ -63,6 +65,24 @@ describe('workbench file cancellation', () => {
     run.mockResolvedValue({ stdout: '', stderr: '', exitCode: 0 })
   })
 
+  it('distinguishes a file-size failure without returning provider diagnostics', async () => {
+    read.mockRejectedValueOnce(new SandboxOutputLimitError(4 * 1024 * 1024 + 1, 4 * 1024 * 1024))
+    expect(await readSessionSandboxFile('chat', 'large.txt')).toEqual({
+      outcome: 'error',
+      detail: 'Workbench file exceeds the maximum read size of 4194304 bytes',
+    })
+  })
+
+  it('distinguishes a provenance outage from a missing file without returning storage diagnostics', async () => {
+    vi.mocked(readSessionSecretProvenance).mockRejectedValueOnce(
+      new Error('SYNTHETIC_PRIVATE_DIAGNOSTIC')
+    )
+    expect(await readSessionSandboxFile('chat', 'input.txt')).toEqual({
+      outcome: 'error',
+      detail: 'Workbench file secret provenance is unavailable',
+    })
+  })
+
   it('does not write if Stop arrives during the sandbox lookup', async () => {
     const controller = new AbortController()
     find.mockImplementation(async () => {

apps/sim/lib/execution/remote-sandbox/session-files.ts

@@ -1,10 +1,11 @@
 import { posix } from 'node:path'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
-import { PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
+import { isPayloadSizeLimitError, PayloadSizeLimitError } from '@/lib/core/utils/stream-limits'
 import type { DurableSecretProvenance } from '@/lib/execution/durable-secret-provenance'
 import { prepareSandboxSessionAccess } from '@/lib/execution/remote-sandbox/execution-observer'
 import { withSandboxFilePublication } from '@/lib/execution/remote-sandbox/file-publication'
+import { isSandboxOutputLimitError } from '@/lib/execution/remote-sandbox/output-limits'
 import { resolveProvider } from '@/lib/execution/remote-sandbox/provider'
 import {
   ensureSessionSandbox,
@@ -66,19 +67,32 @@ export async function readSessionSandboxFile(
       if (!sandbox) return { outcome: 'no-session' }
       await sandbox.extendLifetime?.(SESSION_SANDBOX_IDLE_MS)
       signal.throwIfAborted()
+      let file: { content: string }
       try {
-        const file = await sandbox.readFileWithLimit(resolved, {
+        file = await sandbox.readFileWithLimit(resolved, {
           maxBytes: READ_LIMIT_BYTES,
           encoding,
           signal,
         })
+      } catch (error) {
+        signal.throwIfAborted()
+        if (isSandboxOutputLimitError(error) || isPayloadSizeLimitError(error)) {
+          return {
+            outcome: 'error',
+            detail: `Workbench file exceeds the maximum read size of ${READ_LIMIT_BYTES} bytes`,
+          }
+        }
+        return { outcome: 'no-file', detail: 'Workbench file is missing or unreadable' }
+      }
+      try {
         const secretProvenance = await readSessionSecretProvenance(sessionKey, {
           providerId: provider.id,
           sandboxId: sandbox.sandboxId,
         })
         return { outcome: 'read', content: file.content, secretProvenance }
-      } catch (error) {
-        return { outcome: 'no-file', detail: 'Workbench file could not be read safely' }
+      } catch {
+        signal.throwIfAborted()
+        return { outcome: 'error', detail: 'Workbench file secret provenance is unavailable' }
       }
     })
   } catch (error) {

apps/sim/lib/mothership/agent-cli/run-cli-files.test.ts

@@ -124,6 +124,7 @@ describe('the CLI owns workbench file semantics', () => {
       return {
         outcome: 'read',
         content: Buffer.from(JSON.stringify({ session })).toString('base64'),
+        secretProvenance: { status: 'exact', entries: [] },
       }
     })
     const transport = async (input: string | URL | Request, init?: RequestInit) => {
@@ -153,6 +154,7 @@ describe('the CLI owns workbench file semantics', () => {
     read.mockResolvedValue({
       outcome: 'read',
       content: Buffer.from('wf-one\nwf-two\n').toString('base64'),
+      secretProvenance: { status: 'exact', entries: [] },
     })
     const transport = async (input: string | URL | Request) => {
       requests.push(new URL(input instanceof Request ? input.url : input))

apps/sim/lib/mothership/agent-cli/run-cli.test.ts

@@ -23,7 +23,11 @@ describe('embedded CLI binary workbench bridge', () => {
   it('preserves arbitrary bytes in both directions and binds both to the same chat', async () => {
     const bytes = Uint8Array.from([0, 255, 137, 80, 78, 71, 13, 10, 128, 195, 0])
     const stream = new Blob([bytes]).stream()
-    readFile.mockResolvedValue({ outcome: 'read', content: Buffer.from(bytes).toString('base64') })
+    readFile.mockResolvedValue({
+      outcome: 'read',
+      content: Buffer.from(bytes).toString('base64'),
+      secretProvenance: { status: 'exact', entries: [] },
+    })
     writeFile.mockResolvedValue({ outcome: 'written', path: '/home/user/result.png' })
     embedded.mockImplementation(async (_args, _identity, options) => {
       expect(await options.readFile('image.png')).toEqual(Buffer.from(bytes))
@@ -51,7 +55,11 @@ describe('embedded CLI binary workbench bridge', () => {
   })
 
   it('resolves equals-form file flags identically without reading escaped literals', async () => {
-    readFile.mockResolvedValue({ outcome: 'read', content: Buffer.from('{}').toString('base64') })
+    readFile.mockResolvedValue({
+      outcome: 'read',
+      content: Buffer.from('{}').toString('base64'),
+      secretProvenance: { status: 'exact', entries: [] },
+    })
     embedded.mockImplementation(async (_args, _identity, options) => {
       expect(await options.readFile('input.json')).toEqual(Buffer.from('{}'))
       return { exitCode: 0, stdout: '', stderr: '' }

apps/sim/lib/mothership/tools/handlers/function-execute.ts

@@ -597,7 +597,7 @@ export async function executeFunctionExecute(
 
     /** Receipt records every value placed in the runtime, including silent resolutions. */
     for (const [name, plaintext] of Object.entries(mounted.envVars)) {
-      if (!mountedRegistry.recordResolved(name, plaintext)) {
+      if (plaintext.length > 0 && !mountedRegistry.recordResolved(name, plaintext)) {
         throw new CopilotCodeSecretAccessError('Mounted secret provenance is unavailable')
       }
     }

apps/sim/lib/mothership/tools/handlers/workbench-confidentiality.live.test.ts

@@ -6,55 +6,30 @@ import { createDelegatedPrincipal } from '@sim/testing/factories/principal.facto
 import { createDeferred } from '@sim/testing/helpers/deferred'
 import { setEnv } from '@sim/testing/mocks/env.mock'
 import { envFlagsMock } from '@sim/testing/mocks/env-flags.mock'
+import { redisConfigMockFns } from '@sim/testing/mocks/redis-config.mock'
+import {
+  remoteSandboxProviderMock,
+  remoteSandboxProviderMockFns,
+} from '@sim/testing/mocks/remote-sandbox-provider.mock'
+import { toolsMock, toolsMockFns } from '@sim/testing/mocks/tools.mock'
 import { generateShortId } from '@sim/utils/id'
 import Redis from 'ioredis'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const io = vi.hoisted(() => ({ execute: vi.fn(), mount: vi.fn(), find: vi.fn(), write: vi.fn() }))
-vi.mock('@/tools', () => ({ executeTool: io.execute }))
+const io = vi.hoisted(() => ({ mount: vi.fn(), find: vi.fn(), write: vi.fn() }))
+vi.mock('@/tools', () => toolsMock)
 vi.mock('@/lib/mothership/tools/secret-mount-materializer.server', () => ({
   materializeCopilotCodeSecrets: io.mount,
   CopilotCodeSecretAccessError: class extends Error {},
 }))
 vi.mock('@/lib/secrets/usage/record', () => ({ recordSecretUsage: vi.fn() }))
-vi.mock('@/lib/execution/remote-sandbox/provider', () => ({
-  resolveProvider: () => ({
-    id: 'e2b',
-    dependencyStrategy: 'prebuilt',
-    resolveLifetimeMs: (ms: number) => ms,
-    findSessionSandbox: io.find,
-    create: async () => {
-      throw new Error('Only the existing disposable worker may be used')
-    },
-  }),
-}))
+vi.mock('@/lib/execution/remote-sandbox/provider', () => remoteSandboxProviderMock)
 vi.mock('@/lib/execution/remote-sandbox/resolve', () => ({
   resolveWorkspaceSandbox: async () => null,
   provisionRuntimeDependencies: async () => {},
   repairMissingSandboxImage: async () => null,
   RUNTIME_INSTALL_TIMEOUT_MS: 60_000,
 }))
-vi.mock('@/lib/core/config/redis', () => ({
-  getRedisClient: () => redis,
-  getConfiguredRedisUrl: () => undefined,
-  acquireLock: async (key: string, owner: string, ttl: number) =>
-    (await redis.set(key, owner, 'EX', ttl, 'NX')) === 'OK',
-  extendLock: async (key: string, owner: string, ttl: number) =>
-    (await redis.eval(
-      "if redis.call('GET',KEYS[1]) == ARGV[1] then return redis.call('EXPIRE',KEYS[1],ARGV[2]) else return 0 end",
-      1,
-      key,
-      owner,
-      ttl
-    )) === 1,
-  releaseLock: async (key: string, owner: string) =>
-    redis.eval(
-      "if redis.call('GET',KEYS[1]) == ARGV[1] then return redis.call('DEL',KEYS[1]) else return 0 end",
-      1,
-      key,
-      owner
-    ),
-}))
 vi.mock('@/lib/mothership/tools/sandbox-session', () => ({
   buildMothershipSandboxSession: async (args: { sessionKey: string }) => ({ key: args.sessionKey }),
 }))
@@ -168,6 +143,38 @@ function localWorker(): SandboxHandle {
 }
 
 beforeEach(async () => {
+  redisConfigMockFns.mockGetRedisClient.mockReturnValue(redis)
+  redisConfigMockFns.mockAcquireLock.mockImplementation(
+    async (key: string, owner: string, ttl: number) =>
+      (await redis.set(key, owner, 'EX', ttl, 'NX')) === 'OK'
+  )
+  redisConfigMockFns.mockExtendLock.mockImplementation(
+    async (key: string, owner: string, ttl: number) =>
+      (await redis.eval(
+        "if redis.call('GET',KEYS[1]) == ARGV[1] then return redis.call('EXPIRE',KEYS[1],ARGV[2]) else return 0 end",
+        1,
+        key,
+        owner,
+        ttl
+      )) === 1
+  )
+  redisConfigMockFns.mockReleaseLock.mockImplementation(async (key: string, owner: string) => {
+    await redis.eval(
+      "if redis.call('GET',KEYS[1]) == ARGV[1] then return redis.call('DEL',KEYS[1]) else return 0 end",
+      1,
+      key,
+      owner
+    )
+  })
+  remoteSandboxProviderMockFns.mockResolveProvider.mockReturnValue({
+    id: 'e2b',
+    dependencyStrategy: 'prebuilt',
+    resolveLifetimeMs: (ms: number) => ms,
+    findSessionSandbox: io.find,
+    create: async () => {
+      throw new Error('Only the existing disposable worker may be used')
+    },
+  })
   setEnv({ ENCRYPTION_KEY: 'a'.repeat(64) })
   envFlagsMock.isMothershipSandboxEnabled = true
   envFlagsMock.isRemoteSandboxEnabled = true
@@ -189,7 +196,7 @@ beforeEach(async () => {
     file: { id: 'review-file', name: 'review.txt', size: canary.length, type: 'text/plain' },
     vfsPath: 'files/review.txt',
   }))
-  io.execute.mockImplementation(
+  toolsMockFns.mockExecuteTool.mockImplementation(
     async (
       _id,
       params: CodeExecutionInput,
@@ -256,6 +263,18 @@ async function run(code: string, secrets: string[] = []) {
 }
 
 describe('persistent workbench output confidentiality', () => {
+  it('allows a mounted empty value without requiring a redaction receipt', async () => {
+    const emptyCatalog = [
+      { name: 'TOKEN', plaintext: '', encryptedValue: (await encryptSecret('')).encrypted },
+    ]
+    io.mount.mockResolvedValue({ envVars: { TOKEN: '' }, catalogEntries: emptyCatalog })
+    const result = await run('printenv TOKEN >/dev/null && test -z "$TOKEN" && printf allowed', [
+      'TOKEN',
+    ])
+    expect(result.raw.success).toBe(true)
+    expect(result.projected.safe).toBe(true)
+    expect(JSON.stringify(result.projected.result)).toContain('allowed')
+  })
   it('control: same-call secret output is redacted', async () => {
     const result = await run('printf "%s" "$TOKEN"', ['TOKEN'])
     expect(result.raw.success).toBe(true)

apps/sim/lib/webhooks/provider-subscriptions.test.ts

@@ -33,23 +33,29 @@ describe('createExternalWebhookSubscription', () => {
     mockGetEffectiveDecryptedEnv.mockResolvedValue({ ASHBY_API_KEY: 'real-secret-key' })
   })
 
-  it('projects resolved values out of provider failures while preserving status', async () => {
-    const failure = Object.assign(new Error('Provider refused real-secret-key'), { status: 429 })
-    mockGetProviderHandler.mockReturnValue({
-      createSubscription: async () => {
-        throw failure
-      },
-    })
-    await expect(
-      createExternalWebhookSubscription(
-        {} as NextRequest,
-        { provider: 'ashby', providerConfig: { apiKey: '{{ASHBY_API_KEY}}' } },
-        { workspaceId: 'ws-1' },
-        'user-1',
-        'req-1'
-      )
-    ).rejects.toMatchObject({ message: 'Provider refused {{ASHBY_API_KEY}}', status: 429 })
-  })
+  it.each([
+    ['{{ASHBY_API_KEY}}', '{{ASHBY_API_KEY}}'],
+    ['real-secret-key', '[REDACTED_SECRET]'],
+  ])(
+    'projects configured credential %s out of provider failures while preserving status',
+    async (apiKey, replacement) => {
+      const failure = Object.assign(new Error('Provider refused real-secret-key'), { status: 429 })
+      mockGetProviderHandler.mockReturnValue({
+        createSubscription: async () => {
+          throw failure
+        },
+      })
+      await expect(
+        createExternalWebhookSubscription(
+          {} as NextRequest,
+          { provider: 'ashby', providerConfig: { apiKey } },
+          { workspaceId: 'ws-1' },
+          'user-1',
+          'req-1'
+        )
+      ).rejects.toMatchObject({ message: `Provider refused ${replacement}`, status: 429 })
+    }
+  )
 
   it('resolves {{ENV_VAR}} references in providerConfig before calling the provider', async () => {
     const createSubscription = vi.fn().mockResolvedValue({
@@ -118,21 +124,27 @@ describe('cleanupExternalWebhook', () => {
    * non-admin owner without a credential grant leave `{{VAR}}` unresolved, and
    * the provider was handed the literal reference as its credential.
    */
-  it('keeps resolved cleanup values out of retryable deployment failures', async () => {
-    mockGetProviderHandler.mockReturnValue({
-      deleteSubscription: async () => {
-        throw new Error('Provider refused real-secret-key')
-      },
-    })
-    await expect(
-      cleanupExternalWebhook(
-        { provider: 'calendly', providerConfig: { apiKey: '{{CALENDLY_API_KEY}}' } },
-        { userId: 'user-1', workspaceId: 'workspace-1' },
-        'req-1',
-        { throwOnError: true }
-      )
-    ).rejects.toThrow('Provider refused {{CALENDLY_API_KEY}}')
-  })
+  it.each([
+    ['{{CALENDLY_API_KEY}}', '{{CALENDLY_API_KEY}}'],
+    ['real-secret-key', '[REDACTED_SECRET]'],
+  ])(
+    'keeps configured cleanup credential %s out of retryable deployment failures',
+    async (apiKey, replacement) => {
+      mockGetProviderHandler.mockReturnValue({
+        deleteSubscription: async () => {
+          throw new Error('Provider refused real-secret-key')
+        },
+      })
+      await expect(
+        cleanupExternalWebhook(
+          { provider: 'calendly', providerConfig: { apiKey } },
+          { userId: 'user-1', workspaceId: 'workspace-1' },
+          'req-1',
+          { throwOnError: true }
+        )
+      ).rejects.toThrow(`Provider refused ${replacement}`)
+    }
+  )
 
   it('resolves {{ENV_VAR}} references before deleting the provider subscription', async () => {
     const deleteSubscription = vi.fn().mockResolvedValue(undefined)