fix(mothership): mount code secrets explicitly

Author: Sg312

apps/sim/lib/function-execution/execute-request.test.ts

@@ -567,6 +567,43 @@ describe('Function execution request', () => {
       )
     })
 
+    it.each([
+      {
+        language: 'javascript',
+        code: 'return { template: "{{API_KEY}}", name: "environmentVariables" }',
+      },
+      { language: 'python', code: '__sim_result__ = {"template": "{{API_KEY}}"}' },
+      { language: 'shell', code: "printf '%s' '{{API_KEY}}'" },
+    ])(
+      'preserves literal $language templates in trusted Mothership code with an explicitly mounted secret',
+      async ({ language, code }) => {
+        envFlagsMock.isMothershipSandboxEnabled = true
+        hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValueOnce({
+          success: true,
+          userId: 'user-123',
+          authType: 'internal_jwt',
+          sandboxProfile: 'mothership',
+        })
+        const secret = 'private-test-value-938'
+        const response = await POST(
+          createMockRequest('POST', {
+            code,
+            language,
+            envVars: { API_KEY: secret },
+            secretScope: 'selected',
+            mountedSecrets: ['API_KEY'],
+          })
+        )
+        expect(response.status).toBe(200)
+        const request =
+          language === 'shell'
+            ? mockExecuteShellInSandbox.mock.calls.at(-1)?.[0]
+            : mockExecuteInSandbox.mock.calls.at(-1)?.[0]
+        expect(request.code).toContain('{{API_KEY}}')
+        expect(request.code).not.toContain(secret)
+      }
+    )
+
     it.each([
       { language: 'javascript', code: 'return 42' },
       { language: 'python', code: '__sim_result__ = 42' },

apps/sim/lib/function-execution/execute-request.ts

@@ -20,6 +20,7 @@ import {
   CodePlaceholderCompileError,
   type CodePlaceholderPrivateInput,
   type CodePlaceholderRuntimeBinding,
+  type CompiledCodePlaceholders,
   compileCodePlaceholders,
 } from '@/lib/execution/code-placeholders'
 import { parseExecutionDeadlineHeader } from '@/lib/execution/execution-deadline-header'
@@ -2413,13 +2414,23 @@ export async function executeFunctionRequest(
       outputSandboxPaths.length > 0 ||
       Boolean(outputSandboxPath)
 
-    const compilation = await compileCodePlaceholders({
-      code: codeResolution.resolvedCode,
-      language: lang,
-      params: executionParams,
-      environmentVariables: envVars,
-      reservedNames: Object.keys(contextVariables),
-    })
+    /** Mothership mounts named secrets explicitly; its code may author literal workflow templates. */
+    const compilation: CompiledCodePlaceholders = usesMothershipSandbox
+      ? {
+          code: codeResolution.resolvedCode,
+          bindings: [],
+          privateInputs: [],
+          runtimeBindings: [],
+          internalIdentifiers: [],
+          resolvedSecretNames: Object.keys(envVars),
+        }
+      : await compileCodePlaceholders({
+          code: codeResolution.resolvedCode,
+          language: lang,
+          params: executionParams,
+          environmentVariables: envVars,
+          reservedNames: Object.keys(contextVariables),
+        })
     for (const name of compilation.resolvedSecretNames) {
       if (!Object.hasOwn(envVars, name)) continue
       const plaintext = envVars[name]

apps/sim/lib/mothership/generated/workbench.ts

@@ -3,6 +3,9 @@
 
 import { z } from "zod";
 
+/** Secret names explicitly requested for one workbench code call. Values never cross this wire. */
+export const WorkbenchSecretNames = z.array(z.string().trim().min(1).max(1024)).max(100);
+
 /** Executable bootstrap is served only on the authenticated Sim → worker connection. */
 export const WorkbenchBootstrap = z.strictObject({
   version: z.literal(1),

apps/sim/lib/mothership/tools/handlers/function-execute-session.test.ts

@@ -3,13 +3,17 @@
  */
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockExecuteTool } = vi.hoisted(() => ({
+const { mockExecuteTool, mockMaterializeSecrets } = vi.hoisted(() => ({
   mockExecuteTool: vi.fn().mockResolvedValue({ success: true, output: {} }),
+  mockMaterializeSecrets: vi
+    .fn()
+    .mockResolvedValue({ envVars: { API_KEY: 'test-value' }, catalogEntries: [] }),
 }))
 
 vi.mock('@/tools', () => ({ executeTool: mockExecuteTool }))
-vi.mock('@/executor/utils/code-secret-references', () => ({
-  extractCodeSecretNames: vi.fn().mockResolvedValue([]),
+vi.mock('@/lib/mothership/tools/secret-mount-materializer.server', () => ({
+  materializeCopilotCodeSecrets: mockMaterializeSecrets,
+  CopilotCodeSecretAccessError: class extends Error {},
 }))
 vi.mock('@/executor/utils/resolved-secret-trace-registry', () => ({
   ResolvedSecretTraceRegistry: class {
@@ -51,6 +55,7 @@ const BASE_CONTEXT: ToolExecutionContext = {
 describe('executeFunctionExecute session plumbing', () => {
   beforeEach(() => {
     mockExecuteTool.mockClear()
+    mockMaterializeSecrets.mockClear()
   })
 
   it('derives the session key from the chat, one per chat', async () => {
@@ -77,6 +82,57 @@ describe('executeFunctionExecute session plumbing', () => {
     expect(params.sandboxSessionKey).toBeUndefined()
   })
 
+  it.each([
+    { language: 'python', code: 'import json\nprint(json.dumps({"apiKey": "{{EXA_API_KEY}}"}))' },
+    { language: 'python', code: 'print("{{" + "EXA_API_KEY" + "}}")' },
+    { language: 'javascript', code: 'return JSON.stringify({ apiKey: "{{EXA_API_KEY}}" })' },
+    { language: 'shell', code: "printf '%s' '{{EXA_API_KEY}}'" },
+  ])('keeps authored $language templates literal without requesting secrets', async (params) => {
+    await executeFunctionExecute(params, BASE_CONTEXT)
+    expect(mockMaterializeSecrets).not.toHaveBeenCalled()
+    expect(mockExecuteTool.mock.calls[0][1]).toMatchObject({
+      code: params.code,
+      envVars: {},
+      secretScope: 'selected',
+      mountedSecrets: [],
+    })
+  })
+
+  it('mounts only explicitly named secrets within the caller policy', async () => {
+    await executeFunctionExecute(
+      {
+        code: "return environmentVariables['API_KEY']",
+        language: 'javascript',
+        secrets: [' API_KEY ', 'API_KEY'],
+      },
+      {
+        ...BASE_CONTEXT,
+        secretMountPolicy: { secretScope: 'selected', mountedSecrets: ['API_KEY'] },
+      }
+    )
+    expect(mockMaterializeSecrets).toHaveBeenCalledExactlyOnceWith({
+      actorUserId: 'user-1',
+      workspaceId: 'ws-1',
+      requestedNames: ['API_KEY'],
+    })
+    expect(mockExecuteTool.mock.calls[0][1]).toMatchObject({
+      envVars: { API_KEY: 'test-value' },
+      mountedSecrets: ['API_KEY'],
+    })
+    expect(mockExecuteTool.mock.calls[0][1]).not.toHaveProperty('secrets')
+  })
+
+  it('rejects explicit secrets outside the allowlist before materialization or execution', async () => {
+    await expect(
+      executeFunctionExecute(
+        { code: 'return 1', secrets: ['API_KEY'] },
+        { ...BASE_CONTEXT, secretMountPolicy: { secretScope: 'selected', mountedSecrets: [] } }
+      )
+    ).rejects.toThrow('Secret access is not allowed for: API_KEY')
+    expect(mockMaterializeSecrets).not.toHaveBeenCalled()
+    expect(mockExecuteTool).not.toHaveBeenCalled()
+  })
+
   it('converts second-denominated timeouts, including string values', async () => {
     // The catalog doc promises seconds; models also send the number as a string.
     // Without the tolerant parse, "90" reached the body schema's z.coerce and

apps/sim/lib/mothership/tools/handlers/function-execute.ts

@@ -17,6 +17,7 @@ import {
 import { executeCopilotTableUseCase } from '@/lib/mothership/application/execute-table-use-case'
 import { resolveCopilotFilePrincipal } from '@/lib/mothership/auth/file-delegation'
 import { messageForCopilotTableError } from '@/lib/mothership/auth/table-delegation'
+import { WorkbenchSecretNames } from '@/lib/mothership/generated/workbench'
 import { applySecretMountPolicy } from '@/lib/mothership/secret-mount-policy'
 import type {
   ToolExecutionContext,
@@ -47,7 +48,6 @@ import {
   buildWorkspaceFileFolderDisplayPath,
   parseWorkspaceFileFolderDisplayPath,
 } from '@/lib/workspace-files/folder-display-path'
-import { extractCodeSecretNames } from '@/executor/utils/code-secret-references'
 import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { executeTool as executeAppTool } from '@/tools'
 
@@ -404,6 +404,7 @@ export async function executeFunctionExecute(
   context: ToolExecutionContext
 ): Promise<ToolExecutionResult> {
   const enrichedParams = omit(params, [
+    'secrets',
     'sandboxProfile',
     'internalSandboxProfile',
     // Server-derived below — a model-supplied value must never select a session.
@@ -440,7 +441,7 @@ export async function executeFunctionExecute(
     enrichedParams.sandboxId = params.sandboxId.trim()
   }
   const requestedNames = applySecretMountPolicy(
-    await extractCodeSecretNames(params.code, params.language),
+    WorkbenchSecretNames.parse(params.secrets === undefined ? [] : params.secrets),
     context.secretMountPolicy
   )
   const completePendingActivation =