fix(mothership): admit stored content to Chat per item through one gate

Content from workspace files, run files, knowledge and table rows now reaches
Chat's model only after each item is classified and admitted by the gate of
the surface it leaves through: the registry gate (Chat tools, CLI, mounts) or
the session gate (run_code sandbox proxy). Unknown items are excluded per
item instead of withholding whole results; items with recorded secrets are
redacted where text, refused where opaque. Non-Chat callers are unchanged.

Every operation that admits Copilot declares contentDelivery, and a sourced
use case must account for what it returns, or Chat's transports refuse the
response. Closes the bulk-download, search, run-file, base64, knowledge,
share, export, table and tools-execute paths, and redacts grep lines before
clipping them.

Author: waleedlatif1

.claude/rules/sim-content-delivery.md

@@ -0,0 +1,81 @@
+---
+description: How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content.
+paths:
+  - "apps/sim/lib/core/application/content-delivery.ts"
+  - "apps/sim/lib/mothership/content-delivery/**"
+  - "apps/sim/lib/**/application/admit-*.ts"
+  - "apps/sim/lib/**/application/operations.ts"
+  - "apps/sim/lib/mothership/agent-cli/**"
+  - "apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"
+---
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, public links, and match results.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links).
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither ever admits `unknown`, and one refused item never
+  latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out | Left out (opaque) | Included |
+| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Compile refused | Error text redacted | Compiles |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export, table export download | Not available to Chat | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |

.cursor/rules/sim-content-delivery.mdc

@@ -0,0 +1,77 @@
+---
+description: "How stored content (workspace files, run files, knowledge, table rows) reaches Chat's model, and the per-path policy. Read before changing a use case, route or Chat surface that returns such content."
+globs: ["apps/sim/lib/core/application/content-delivery.ts","apps/sim/lib/mothership/content-delivery/**","apps/sim/lib/**/application/admit-*.ts","apps/sim/lib/**/application/operations.ts","apps/sim/lib/mothership/agent-cli/**","apps/sim/lib/mothership/tools/sandbox-resource-transport.ts"]
+---
+
+<!-- Generated from .claude/rules/sim-content-delivery.md by `bun run skills:sync`. Edit the source, not this file. -->
+
+# Sim Content Delivery to Chat
+
+Content derived from a provenance-bearing store reaches Chat's model only after **each item** it
+came from is admitted by the gate of the surface it leaves through. The stores are workspace files
+(and their versions), run files, knowledge documents and chunks, and table rows. "Derived" covers
+bytes, text, excerpts, chunks, cells, previews, base64, archives, rendered or compiled output,
+error text that quotes content, public links, and match results.
+
+Only Copilot principals (`delegated` / `organization_delegated` with `serviceId: 'copilot'`) are
+classified. Every other caller is admitted without a provenance read, so the UI, API keys, MCP and
+the workflow executor see byte-identical results.
+
+## The pieces
+
+- `lib/core/application/content-delivery.ts`: the primitive.
+  - `admitContent(principal, sources)` returns per-item verdicts. `requireAdmittedContent` is the
+    single-item form and throws `ContentRefusedError` (403).
+  - `admitWrittenContent` is for a committed write that returns content. A refusal or gate failure
+    does not undo the write: audit and effects run, then the operation answers with the refusal.
+  - A source is `{ kind, id, provenance, view }`. `view` is `'complete'` (text whose every entry
+    may appear), `{ derived: value }` (only entries occurring in `value`), or `'opaque'` (bytes no
+    redaction reaches: binary, base64, archives, images, public links).
+- Gates, installed by the surface: the **registry gate** (Chat tools, CLI, mounts) imports entries
+  into the registry egress projects with; the **session gate** (run_code sandbox proxy) records
+  them into the workbench history. Neither ever admits `unknown`, and one refused item never
+  latches the shared registry.
+- `observeContentOutsideModel` reads for Chat without classifying, for content that never reaches
+  the model (the user's own edit preview; a derived file that carries its sources' provenance).
+  Name why at each use.
+
+## Rules
+
+1. **Every operation that admits Copilot declares `contentDelivery`**: `'sourced'` when its result
+   can carry content from a store (including a match oracle), `'none'` otherwise. Definition throws
+   without it, and `copilot-route-inventory.test.ts` lists every Chat-reachable route without one.
+2. **A `sourced` use case accounts for what it returns**, before it loads content: call
+   `admitContent` (with `[]` when this call returns none). Otherwise Chat gets
+   `ContentDeliveryUnaccountedError`, and the transports turn the response into a 403.
+3. **Classify before loading bytes**, and exclude refused items per item. Withhold a whole result
+   only when its items cannot be separated (one file, one render, one compile).
+4. **A new `sourced` route needs a case in `lib/mothership/__integration__/content-delivery.integration.ts`.**
+   `copilot-content-routes.json` lists them; the suite fails for a listed route it does not drive.
+   Refresh the list with `vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts`.
+5. **Do not reach a store's bytes around a use case for Chat.** A helper that reads content for
+   Chat goes through the gated use case, or names `observeContentOutsideModel` and why.
+
+## Policy
+
+U = `unknown`, E = exact with secret entries, R/C = unrecorded or clean. Each item is decided on its
+own unless noted.
+
+| Path | U | E | R / C |
+|---|---|---|---|
+| File download (CLI `files get`) | Delivered once; invocation withheld from the model; workbench copy stays unknown | Redacted | Delivered |
+| File download (run_code proxy) and mounts | Refused, not recorded, listed in `excludedInputs` | Recorded in workbench history | Delivered |
+| File text, version text, `files read`, grep | 403 | Redacted (grep redacts before clipping) | Delivered |
+| Bulk download zip | Left out | Left out (opaque) | Included |
+| `files search` | Results dropped | Results dropped (a match is an oracle) | Returned |
+| File edit (`PATCH` content) | 403 before reading | Diagnostics redacted | Unchanged |
+| Chat public share activation | 403 | 403 (a link is opaque) | Shares |
+| Rendered view, streamed image, inline attachments | Refused | Refused (opaque) | Delivered |
+| Doc compile | Compile refused | Error text redacted | Compiles |
+| Run file download | 403 | Redacted | Delivered |
+| Run read / execute / resume `base64` | `base64` removed, descriptor kept | Same | Inlined (sync runs only) |
+| KB chunks, search, documents, tags | Item dropped (single read: 403) | Redacted | Delivered |
+| KB export, table export download | Not available to Chat | | |
+| Table rows, query, read, `table_selection` | Row dropped (single read: 403) | Redacted | Delivered |
+| Row search | Match dropped | Match in a secret column dropped | Returned |
+| Table import from a file | Rows stored unknown | Per-cell entries | Exact-empty, as before |
+| `tools execute` for file, knowledge, table, memory, function, custom, MCP tools | Not available to Chat | | |

apps/sim/AGENTS.md

@@ -9,6 +9,7 @@ Applies to `apps/sim/**` on top of the root [AGENTS.md](/AGENTS.md), which holds
 - Styling and emcn chrome, UI copy, settings pages: `sim-styling.md`, `sim-ui-copy.md`, `sim-settings-pages.md`
 - URL state, list and menu order, caching: `sim-url-state.md`, `sim-list-ordering.md`, `sim-caching.md`
 - Tools, blocks, triggers: `sim-integrations.md`; isolated-vm sandbox worker: `sim-sandbox.md`
+- Anything that returns stored file, run-file, knowledge or table content to Chat: `sim-content-delivery.md`
 - Tests: `sim-testing.md` and the `test-audit` skill
 - Landing pages: `app/(landing)/CLAUDE.md`, `landing-seo-geo.md`, `constitution.md` (product language)
 

apps/sim/app/api/v2/lib/response.ts

@@ -14,6 +14,7 @@ import {
   InsufficientScopeError,
   OAuthAccessTokenExpiredError,
 } from '@/lib/core/application'
+import { ContentDeliveryUnobservedError } from '@/lib/core/application/content-delivery'
 import {
   asOrchestrationError,
   OrchestrationError,
@@ -530,6 +531,10 @@ export function v2ErrorForOrchestration(
  * one its failure class maps to.
  */
 export function v2CaughtOrchestrationError(error: unknown): NextResponse | null {
+  /** Chat reached stored content outside any classifying surface: transient, never a content leak. */
+  if (error instanceof ContentDeliveryUnobservedError) {
+    return v2Error('SERVICE_UNAVAILABLE', error.message)
+  }
   const classified = asOrchestrationError(error)
   if (!classified) return null
   if (classified instanceof InsufficientScopeError) return v2InsufficientScope(classified)

apps/sim/ee/access-requests/lib/application/operations.ts

@@ -51,6 +51,7 @@ function defineAccessRequestOperation(
          * permission-group-exempt: requests never grant a withheld capability without administrator review.
          */
         capability: 'none',
+        contentDelivery: 'none',
       })
   return Object.freeze({ ...workspaceOperation, organizationOperation, admin })
 }

apps/sim/ee/workspace-forking/application/operations.ts

@@ -14,6 +14,7 @@ export const forkOperations = {
   discover: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.discover',
     oauthScope: 'api:read',
   }),
@@ -23,6 +24,7 @@ export const forkOperations = {
   preview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.preview',
     oauthScope: 'api:write',
   }),
@@ -32,6 +34,7 @@ export const forkOperations = {
   create: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.create',
     oauthScope: 'api:write',
   }),
@@ -41,6 +44,7 @@ export const forkOperations = {
   syncPreview: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync.preview',
     oauthScope: 'api:write',
   }),
@@ -50,6 +54,7 @@ export const forkOperations = {
   sync: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync',
     oauthScope: 'api:write',
   }),
@@ -59,6 +64,7 @@ export const forkOperations = {
   mappingsRead: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.read',
     oauthScope: 'api:read',
   }),
@@ -68,6 +74,7 @@ export const forkOperations = {
   mappingsUpdate: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.mappings.update',
     oauthScope: 'api:write',
   }),
@@ -77,6 +84,7 @@ export const forkOperations = {
   rollback: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.rollback',
     oauthScope: 'api:write',
   }),
@@ -86,6 +94,7 @@ export const forkOperations = {
   unlink: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.unlink',
     oauthScope: 'api:write',
   }),
@@ -95,6 +104,7 @@ export const forkOperations = {
   exclusions: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.exclusions',
     oauthScope: 'api:write',
   }),
@@ -107,6 +117,7 @@ export const forkOperations = {
   syncDefault: defineWorkspaceOperation({
     ...adminPolicy,
     capability: 'none',
+    contentDelivery: 'none',
     id: 'workspaces.fork.sync_default',
     oauthScope: 'api:write',
   }),

apps/sim/lib/api-key/application/operations.ts

@@ -33,6 +33,7 @@ export const apiKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
     principalKinds: ['delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -45,6 +46,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
@@ -54,12 +56,14 @@ export const byokKeyOperations = {
     minimumRole: 'admin',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   listOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.list',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -84,6 +88,7 @@ export const byokKeyOperations = {
   // permission-group-exempt: BYOK is its own entitlement-gated section, and api_keys.manage names the Sim API Keys tab instead
   deleteOrganization: defineOrganizationByokOperation({
     id: 'byok_keys.organization.delete',
+    contentDelivery: 'none',
     capability: 'none',
     authority: 'organization_admin',
     minimumRole: 'admin',
@@ -100,6 +105,7 @@ export const byokKeyOperations = {
     minimumRole: 'read',
     workspaceApiKey: 'deny',
     capability: 'none',
+    contentDelivery: 'none',
     principalKinds: ['session', 'delegated'],
     delegatedServices: ['copilot'],
   }),

apps/sim/lib/api-key/application/workspace-api-keys.ts

@@ -31,19 +31,22 @@ export const workspaceApiKeyOperations = {
     id: 'api_keys.workspace.list',
     minimumRole: 'read',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   rename: defineWorkspaceOperation({
     ...principalPolicy,
     id: 'api_keys.workspace.rename',
     minimumRole: 'admin',
     capability: 'api_keys.manage',
+    contentDelivery: 'none',
   }),
   /** permission-group-exempt: admins must retain the ability to revoke exposed credentials. */
   revoke: defineWorkspaceOperation({
     ...principalPolicy,
     id: 'api_keys.workspace.revoke',
     minimumRole: 'admin',
     capability: 'none',
+    contentDelivery: 'none',
   }),
 } as const
 const authorizationOptions = { delegation: { audience: 'sim:settings', isWithinScope: () => true } }