fix(mothership): withhold unregistered table secrets from sim_cli results

Table rows read through sim_cli reached the model without their persisted
secret provenance, so stored secrets in cells were never redacted. Row use
cases now report the provenance of the rows they return to an observing
transport (mirroring the workspace-file delivery observer), and the agent CLI
table transport imports it into the tool call's registry, answers 503 without
a registry, and marks the registry incomplete when a row-bearing table route
returns without reporting provenance. Provenance reported by detached work
after the call settles is ignored.

Export download links are refused outright: a signed link to the whole table
as plaintext CSV cannot carry provenance once fetched.

Run-state and enrichment error text (runState.error, blockErrors, enrichment
provider errors) is captured from executor output without its secret
provenance, so a read that returns any of it is withheld as well; reads whose
run state carries no error text are unaffected.

Author: waleedlatif1

apps/sim/executor/utils/resolved-secret-trace-registry.test.ts

@@ -1798,6 +1798,7 @@ describe('incompleteness diagnostics', () => {
     'client-tool-content-unavailable',
     'knowledge-result-provenance-unavailable',
     'table-result-provenance-unavailable',
+    'table-run-state-provenance-unavailable',
     'mounted-file-provenance-unavailable',
     'workspace-file-provenance-unknown',
     'file-source-unidentified',

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -70,6 +70,11 @@ export type ResolvedSecretIncompletenessReason =
   | 'knowledge-row-missing'
   | 'knowledge-row-content-mismatch'
   | 'table-result-provenance-unavailable'
+  /**
+   * A table result carried run-state or enrichment error text, captured from executor output that
+   * can hold resolved secret plaintext, with no provenance persisted beside it.
+   */
+  | 'table-run-state-provenance-unavailable'
   | 'mounted-file-provenance-unavailable'
   | 'workspace-file-provenance-unknown'
   | 'file-source-unidentified'

apps/sim/lib/api/server/routes/in-process-transport.ts

@@ -24,6 +24,8 @@ type RouteHandler = (
 ) => Promise<Response>
 
 interface CompiledRoute {
+  /** The generated route pattern, e.g. `/api/v2/tables/{tableId}/rows`. */
+  pattern: string
   regex: RegExp
   params: string[]
   /** Literal segments — a more specific pattern wins over a parameterized one. */
@@ -32,6 +34,7 @@ interface CompiledRoute {
 }
 
 interface MatchedRoute {
+  pattern: string
   params: Record<string, string>
   literals: number
   load: () => Promise<object>
@@ -52,7 +55,13 @@ const COMPILED: CompiledRoute[] = V2_ROUTES.map((route) => {
       return '([^/]+)'
     })
     .join('/')
-  return { regex: new RegExp(`^${source}$`), params, literals, load: route.load }
+  return {
+    pattern: route.pattern,
+    regex: new RegExp(`^${source}$`),
+    params,
+    literals,
+    load: route.load,
+  }
 })
 
 export function matchV2Route(pathname: string): MatchedRoute | null {
@@ -65,7 +74,7 @@ export function matchV2Route(pathname: string): MatchedRoute | null {
     route.params.forEach((name, index) => {
       params[name] = decodeURIComponent(match[index + 1] ?? '')
     })
-    best = { params, literals: route.literals, load: route.load }
+    best = { pattern: route.pattern, params, literals: route.literals, load: route.load }
   }
   return best
 }

apps/sim/lib/mothership/agent-cli/index.ts

@@ -11,6 +11,7 @@ import { runCli } from '@/lib/mothership/agent-cli/run-cli'
 import { createScopedCliTransport } from '@/lib/mothership/agent-cli/scoped-transport'
 import { executeAgentCliService } from '@/lib/mothership/agent-cli/services'
 import { applySink } from '@/lib/mothership/agent-cli/sink'
+import { createTableReadTransport } from '@/lib/mothership/agent-cli/table-read-transport'
 import { createTracedCliTransport } from '@/lib/mothership/agent-cli/traced-transport'
 import { createWorkbenchFileProvenance } from '@/lib/mothership/agent-cli/workbench-file-provenance'
 import { resolveInvocationWorkspace } from '@/lib/mothership/application/workspace-target'
@@ -80,10 +81,14 @@ async function executeBoundAgentCliRequest(
   const files = sessionKey ? createWorkbenchFileProvenance({ ...context, sessionKey }) : undefined
   const reads = createFileReadTransport({
     endpoint,
-    transport: createTracedCliTransport(
+    transport: createTableReadTransport({
       endpoint,
-      createScopedCliTransport(endpoint, invocationIdentity)
-    ),
+      transport: createTracedCliTransport(
+        endpoint,
+        createScopedCliTransport(endpoint, invocationIdentity)
+      ),
+      registry: context.resolvedSecretTraceRegistry,
+    }),
     userId: context.userId,
     invocation: invocationIdentity,
     registry: context.resolvedSecretTraceRegistry,

apps/sim/lib/mothership/agent-cli/table-read-transport.test.ts

@@ -0,0 +1,280 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({ scoped: vi.fn(), decrypt: vi.fn() }))
+vi.mock('@/lib/core/security/encryption', () => ({ decryptSecret: mocks.decrypt }))
+vi.mock('@/lib/mothership/agent-cli/scoped-transport', () => ({
+  createScopedCliTransport: () => mocks.scoped,
+}))
+vi.mock('@/lib/mothership/application/workspace-target', () => ({
+  resolveInvocationWorkspace: async (owner: { userId: string }, workspaceId?: string) => ({
+    workspaceId: workspaceId ?? 'workspace',
+    userId: owner.userId,
+  }),
+}))
+vi.mock('@/lib/execution/remote-sandbox/session-files', () => ({
+  SESSION_SANDBOX_HOME: '/home/user',
+  readSessionSandboxFile: vi.fn(),
+  writeSessionSandboxFile: vi.fn(),
+}))
+vi.mock('@/lib/execution/remote-sandbox/session-file-snapshot', () => ({
+  openSessionFileSnapshot: vi.fn(),
+}))
+
+import { V2_ROUTES } from '@/lib/api/server/routes/v2-route-table.generated'
+import {
+  createTableReadTransport,
+  TABLE_ROUTES_WITHOUT_ROW_DATA,
+} from '@/lib/mothership/agent-cli/table-read-transport'
+import { inspectToolResultForCopilot } from '@/lib/mothership/request/tools/resolved-secret-result'
+import { executeSimCli } from '@/lib/mothership/tools/handlers/sim-cli'
+import { reportTableRowDelivery } from '@/lib/table/application/row-delivery-observer'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+
+const SECRET = 'PRIVATE_TABLE_CELL_CANARY_FOR_LOCAL_TEST'
+const scope = { userId: 'reader', workspaceId: 'workspace' }
+const endpoint = 'https://sim.test'
+const rowUrl = `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`
+const rowBody = { data: { id: 'row', data: { token: SECRET } } }
+
+function registry() {
+  return new ResolvedSecretTraceRegistry([], scope)
+}
+
+function secretProvenance() {
+  const source = new ResolvedSecretTraceRegistry(
+    [{ name: 'TABLE_SECRET', plaintext: SECRET, encryptedValue: 'fixture-ciphertext' }],
+    scope
+  )
+  source.recordResolved('TABLE_SECRET', SECRET, { propagated: true })
+  return source.exportProvenance()
+}
+
+/** Stands in for a v2 table route whose use case reports the rows it returns. */
+async function deliveringRoute() {
+  await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
+  return Response.json(rowBody)
+}
+
+function projected(output: string, trace: ResolvedSecretTraceRegistry) {
+  return JSON.stringify(inspectToolResultForCopilot({ success: true, output }, trace, 'sim_cli'))
+}
+
+describe('table provenance at the CLI and model-result boundary', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.decrypt.mockResolvedValue({ decrypted: SECRET })
+  })
+
+  it('activates reported row provenance so the model projection redacts the cell', async () => {
+    const trace = registry()
+    const inner = vi.fn(deliveringRoute)
+    const response = await createTableReadTransport({
+      endpoint,
+      transport: inner,
+      registry: trace,
+    })(rowUrl)
+
+    expect(response.status).toBe(200)
+    const output = await response.text()
+    expect(output).toBe(JSON.stringify(rowBody))
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+    expect(projected(output, trace)).not.toContain(SECRET)
+  })
+
+  it('withholds a row-bearing result that reported no provenance', async () => {
+    const trace = registry()
+    const response = await createTableReadTransport({
+      endpoint,
+      transport: async () => Response.json(rowBody),
+      registry: trace,
+    })(rowUrl)
+
+    expect(response.status).toBe(200)
+    expect(trace.isPermanentlyIncomplete()).toBe(true)
+    expect(projected(await response.text(), trace)).not.toContain(SECRET)
+  })
+
+  it('withholds a result whose run state carries error text without provenance', async () => {
+    const trace = registry()
+    const response = await createTableReadTransport({
+      endpoint,
+      transport: async () => {
+        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
+          unprovenancedErrorText: true,
+        })
+        return Response.json(rowBody)
+      },
+      registry: trace,
+    })(rowUrl)
+
+    expect(response.status).toBe(200)
+    expect(trace.isPermanentlyIncomplete()).toBe(true)
+    expect(trace.getIncompletenessDiagnostics()?.reasons).toEqual([
+      'table-run-state-provenance-unavailable',
+    ])
+  })
+
+  it('keeps a delivered result without run-state error text complete', async () => {
+    const trace = registry()
+    await createTableReadTransport({
+      endpoint,
+      transport: async () => {
+        await reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }], {
+          unprovenancedErrorText: false,
+        })
+        return Response.json(rowBody)
+      },
+      registry: trace,
+    })(rowUrl)
+
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+  })
+
+  it.each(['GET', 'HEAD'])(
+    'refuses to return a table export download link (%s)',
+    async (method) => {
+      const trace = registry()
+      const inner = vi.fn(async () =>
+        Response.json({ data: { url: 'https://signed.test/export.csv' } })
+      )
+      const response = await createTableReadTransport({
+        endpoint,
+        transport: inner,
+        registry: trace,
+      })(`${endpoint}/api/v2/tables/table/exports/export/download?workspaceId=workspace`, {
+        method,
+      })
+
+      expect(response.status).toBe(403)
+      expect(await response.text()).not.toContain('signed.test')
+      expect(inner).not.toHaveBeenCalled()
+      expect(trace.isPermanentlyIncomplete()).toBe(false)
+    }
+  )
+
+  it('ignores provenance that detached work reports after the call settles', async () => {
+    const trace = registry()
+    let release!: () => void
+    const released = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    let detached: Promise<void> | undefined
+    await createTableReadTransport({
+      endpoint,
+      transport: async () => {
+        detached = released.then(() =>
+          reportTableRowDelivery(secretProvenance(), [{ col_token: SECRET }])
+        )
+        return Response.json({ error: { message: 'Row not found' } }, { status: 404 })
+      },
+      registry: trace,
+    })(rowUrl)
+
+    release()
+    await detached
+    expect(projected(JSON.stringify(rowBody), trace)).toContain(SECRET)
+  })
+
+  it('refuses row reads without a registry instead of returning plaintext', async () => {
+    const inner = vi.fn(deliveringRoute)
+    const response = await createTableReadTransport({ endpoint, transport: inner })(rowUrl)
+
+    expect(response.status).toBe(503)
+    expect(await response.text()).not.toContain(SECRET)
+    expect(inner).not.toHaveBeenCalled()
+  })
+
+  it('keeps a failed row read from poisoning the turn', async () => {
+    const trace = registry()
+    const response = await createTableReadTransport({
+      endpoint,
+      transport: async () =>
+        Response.json({ error: { message: 'Row not found' } }, { status: 404 }),
+      registry: trace,
+    })(rowUrl)
+
+    expect(response.status).toBe(404)
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+  })
+
+  it.each([
+    ['GET', `${endpoint}/api/v2/files/file?workspaceId=workspace`],
+    ['GET', `${endpoint}/api/v2/tables/table?workspaceId=workspace`],
+    ['POST', `${endpoint}/api/v2/tables/table/rows/search`],
+    ['DELETE', `${endpoint}/api/v2/tables/table/rows/row?workspaceId=workspace`],
+    ['GET', 'https://elsewhere.test/api/v2/tables/table/rows/row'],
+  ])('passes %s %s through untouched without a registry', async (method, url) => {
+    const upstream = Response.json({ data: { ok: true } })
+    const inner = vi.fn(async () => upstream)
+    const response = await createTableReadTransport({ endpoint, transport: inner })(url, {
+      method,
+    })
+
+    expect(response).toBe(upstream)
+    expect(inner).toHaveBeenCalledWith(url, { method })
+  })
+
+  it('composes into the sim_cli stack so a table read through the real CLI is redacted', async () => {
+    mocks.scoped.mockImplementation(deliveringRoute)
+    const trace = registry()
+    const result = await executeSimCli(
+      {
+        request: {
+          invocation: {
+            kind: 'cli',
+            argv: ['tables', 'rows', 'get', 'table', 'row'],
+          },
+        },
+      },
+      {
+        userId: 'reader',
+        workspaceId: 'workspace',
+        workflowId: '',
+        chatId: 'chat',
+        resolvedSecretTraceRegistry: trace,
+      }
+    )
+
+    expect(mocks.scoped).toHaveBeenCalled()
+    expect(new URL(String(mocks.scoped.mock.calls[0]?.[0])).pathname).toBe(
+      '/api/v2/tables/table/rows/row'
+    )
+    expect(JSON.stringify(result.output)).toContain(SECRET)
+    expect(trace.isPermanentlyIncomplete()).toBe(false)
+    expect(JSON.stringify(inspectToolResultForCopilot(result, trace, 'sim_cli'))).not.toContain(
+      SECRET
+    )
+  })
+
+  /**
+   * Every v2 table route is either declared row-free or must deliver provenance.
+   * A new route lands in the row-bearing set by default — its results are withheld
+   * until its use case reports delivery — and this list forces that to be a decision.
+   */
+  it('classifies every v2 table route', async () => {
+    const methods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'] as const
+    const declared = new Set<string>()
+    for (const route of V2_ROUTES) {
+      if (route.pattern !== '/api/v2/tables' && !route.pattern.startsWith('/api/v2/tables/'))
+        continue
+      const module = await route.load()
+      for (const method of methods) {
+        if (typeof Reflect.get(module, method) === 'function')
+          declared.add(`${method} ${route.pattern}`)
+      }
+    }
+
+    expect([...TABLE_ROUTES_WITHOUT_ROW_DATA].filter((key) => !declared.has(key))).toEqual([])
+    expect([...declared].filter((key) => !TABLE_ROUTES_WITHOUT_ROW_DATA.has(key)).sort()).toEqual([
+      'GET /api/v2/tables/{tableId}/exports/{exportId}/download',
+      'GET /api/v2/tables/{tableId}/rows',
+      'GET /api/v2/tables/{tableId}/rows/{rowId}',
+      'GET /api/v2/tables/{tableId}/rows/{rowId}/enrichment/{groupId}',
+      'PATCH /api/v2/tables/{tableId}/rows/{rowId}',
+      'POST /api/v2/tables/{tableId}/query',
+      'POST /api/v2/tables/{tableId}/rows',
+      'POST /api/v2/tables/{tableId}/rows/upsert',
+    ])
+  }, 60_000)
+})