test(sandbox): certify workbench history against real Redis and close the mount bypass

- Replace the certification unit test, which restated the history script in a
  fake Redis, with an integration suite that runs the real code boundary against
  the real script in a disposable Redis.
- Have the route test's mocked mount resolver return a fixed count per test
  rather than restating the counting rule.
- Strip model-supplied `_sandboxFiles` from Copilot Function calls. Only resolved
  inputs may populate it, and a supplied URL mount would skip their provenance.
- Document that public storage contexts always count as unprovenanced mounts.

Author: waleedlatif1

apps/sim/lib/execution/remote-sandbox/session-input-certification.integration.ts

@@ -0,0 +1,121 @@
+/**
+ * The persistent workbench's input history is what lets a scratch file reach the model. This runs
+ * the real code boundary against the real history script in a disposable Redis, so a mount the
+ * caller could not classify has to leave the machine uncertified. Only the sandbox provider is a
+ * stand-in: it hands back an existing machine that executes nothing.
+ *
+ * Set TEST_REDIS_URL to an isolated local Redis service.
+ */
+import { createHash } from 'node:crypto'
+import {
+  remoteSandboxProviderMock,
+  remoteSandboxProviderMockFns,
+} from '@sim/testing/mocks/remote-sandbox-provider.mock'
+import { generateShortId } from '@sim/utils/id'
+import { afterAll, describe, expect, it, vi } from 'vitest'
+
+const { redisUrl, inheritedRedisUrl, mockFindSessionSandbox } = await vi.hoisted(async () => {
+  const { readTestRedisUrl } = await import('@sim/db/testing/test-infrastructure')
+  const url = readTestRedisUrl()
+  const inheritedRedisUrl = process.env.REDIS_URL
+  /** The real Redis module reads this at import. */
+  if (url) process.env.REDIS_URL = url
+  return { redisUrl: url, inheritedRedisUrl, mockFindSessionSandbox: vi.fn() }
+})
+
+vi.mock('@/lib/execution/remote-sandbox/provider', () => remoteSandboxProviderMock)
+vi.mock('@/lib/execution/remote-sandbox/resolve', () => ({
+  resolveWorkspaceSandbox: async () => null,
+  provisionRuntimeDependencies: async () => {},
+  repairMissingSandboxImage: async () => null,
+  RUNTIME_INSTALL_TIMEOUT_MS: 60_000,
+}))
+
+import { getRedisClient } from '@/lib/core/config/redis'
+import { CodeLanguage } from '@/lib/execution/languages'
+import {
+  executeInSandbox,
+  executeShellInSandbox,
+  SIM_RESULT_PREFIX,
+} from '@/lib/execution/remote-sandbox'
+import { observeSandboxSessionInputs } from '@/lib/execution/remote-sandbox/execution-observer'
+import {
+  initializeSessionFileProvenance,
+  isSessionFileProvenanceClean,
+} from '@/lib/execution/remote-sandbox/session-file-provenance'
+import type { SandboxHandle, SandboxProvider } from '@/lib/execution/remote-sandbox/types'
+
+remoteSandboxProviderMockFns.mockResolveProvider.mockImplementation(
+  () =>
+    ({
+      id: 'e2b',
+      dependencyStrategy: 'prebuilt',
+      resolveLifetimeMs: (ms: number) => ms,
+      create: async () => {
+        throw new Error('The certification fixture only reuses an existing machine')
+      },
+      findSessionSandbox: mockFindSessionSandbox,
+    }) satisfies SandboxProvider
+)
+
+function machine(sandboxId: string): SandboxHandle {
+  return {
+    sandboxId,
+    runCode: async () => ({ text: `${SIM_RESULT_PREFIX}{"ok":true}`, stdout: '', stderr: '' }),
+    runCommand: async () => ({ stdout: '', stderr: '', exitCode: 0 }),
+    extendLifetime: async () => {},
+    getFileSize: async () => 0,
+    readFile: async () => '',
+    readFileWithLimit: async () => ({ content: '', byteLength: 0 }),
+    writeFile: async () => {},
+    removeFile: async () => {},
+    listFiles: async () => [],
+    kill: async () => {},
+  }
+}
+
+/** Machine-history keys this suite created, so cleanup never touches another suite's state. */
+const createdKeys: string[] = []
+
+afterAll(async () => {
+  const redis = getRedisClient()
+  if (redis && createdKeys.length) await redis.del(...createdKeys)
+  if (inheritedRedisUrl === undefined) process.env.REDIS_URL = undefined
+  else process.env.REDIS_URL = inheritedRedisUrl
+})
+
+describe.skipIf(!redisUrl)('workbench certification at the code boundary', () => {
+  it.each([
+    ['code', false],
+    ['code', true],
+    ['shell', false],
+    ['shell', true],
+  ] as const)('%s with unprovenanced mounts %s', async (kind, unprovenanced) => {
+    const sandboxId = `machine-${generateShortId(12)}`
+    const key = `certification-${generateShortId(12)}`
+    const identity = { providerId: 'e2b', sandboxId } as const
+    createdKeys.push(
+      `mothership:workbench-provenance:v1:${createHash('sha256')
+        .update(JSON.stringify([key, identity.providerId, sandboxId]))
+        .digest('hex')}`
+    )
+    mockFindSessionSandbox.mockResolvedValue(machine(sandboxId))
+    await initializeSessionFileProvenance(key, identity)
+    expect(await isSessionFileProvenanceClean(key, identity)).toBe(true)
+
+    const request = {
+      code: 'print(1)',
+      language: CodeLanguage.Python,
+      timeoutMs: 30_000,
+      session: { key, ...(unprovenanced ? { unprovenancedInputs: true } : {}) },
+    }
+    await observeSandboxSessionInputs(
+      () => true,
+      () =>
+        kind === 'code'
+          ? executeInSandbox(request)
+          : executeShellInSandbox({ ...request, envs: {} })
+    )
+    expect(await isSessionFileProvenanceClean(key, identity)).toBe(!unprovenanced)
+  })
+})

apps/sim/lib/execution/remote-sandbox/session-input-certification.test.ts

@@ -47,13 +47,15 @@ const {
   mockWriteWorkspaceFileByPath,
   mockUploadExecutionFile,
   mockMountContributors,
+  mockUnprovenancedMountCount,
   mockRenderedMountContributors,
 } = vi.hoisted(() => ({
   mockExecuteInIsolatedVM: vi.fn(),
   mockValidateWorkspaceFileWriteTarget: vi.fn(),
   mockWriteWorkspaceFileByPath: vi.fn(),
   mockUploadExecutionFile: vi.fn(),
   mockMountContributors: vi.fn(),
+  mockUnprovenancedMountCount: vi.fn(),
   mockRenderedMountContributors: vi.fn(),
 }))
 
@@ -153,7 +155,7 @@ vi.mock('@/lib/function-execution/sandbox-mounts', () => ({
   }) => ({
     contributingFiles: mockMountContributors(),
     renderedContributingFiles: mockRenderedMountContributors(),
-    unprovenancedMountCount: mockMountContributors() ? 0 : planned.length,
+    unprovenancedMountCount: mockUnprovenancedMountCount(),
     sandboxFiles: planned.map(({ mountPath }) => ({
       type: 'url' as const,
       path: mountPath,
@@ -260,6 +262,7 @@ describe('Function execution request', () => {
   beforeEach(() => {
     resetDbChainMock()
     mockMountContributors.mockReturnValue(undefined)
+    mockUnprovenancedMountCount.mockReturnValue(0)
     mockRenderedMountContributors.mockReturnValue(undefined)
     mockUploadExecutionFile.mockImplementation(async (context, buffer, name, type) => ({
       id: 'execution-file-1',
@@ -2566,6 +2569,7 @@ describe('Function execution request', () => {
       ['no mounts', false],
     ] as const)('withholds workbench certification for %s', async (_label, mounted) => {
       envFlagsMock.isMothershipSandboxEnabled = true
+      mockUnprovenancedMountCount.mockReturnValue(mounted ? 1 : 0)
       hybridAuthMockFns.mockCheckInternalAuth.mockResolvedValue({
         success: true,
         userId: 'user-123',

apps/sim/lib/function-execution/execute-request.test.ts

@@ -281,6 +281,10 @@ export async function resolveUserFileMounts(args: {
    * Mounts whose own bytes have no provenance source (no principal to bind one, or a key with no
    * canonical metadata record). Workflow runs keep their legacy absence policy; a persistent
    * workbench must not certify a machine that received one.
+   *
+   * Storage contexts other than workspace and execution (chat, copilot, knowledge-base, logs, and
+   * the other public contexts) never have a source, so they always count here and taint a
+   * workbench. That is conservative by design.
    */
   unprovenancedMountCount: number
 }> {

apps/sim/lib/function-execution/sandbox-mounts.ts

@@ -57,6 +57,33 @@ describe('Function physical-session input certification', () => {
   )
 })
 
+describe('Function sandbox mounts', () => {
+  it('never forwards a model-supplied sandbox mount, which would bypass input provenance', async () => {
+    mocks.execute.mockImplementation(async (_tool, params) => ({
+      success: true,
+      output: { sandboxFiles: params._sandboxFiles ?? [] },
+    }))
+    const result = await executeFunctionExecute(
+      {
+        code: 'print(open("/tmp/sim/inputs/x").read())',
+        language: 'python',
+        _sandboxFiles: [{ type: 'url', path: '/tmp/sim/inputs/x', url: 'https://storage.test/x' }],
+      },
+      {
+        userId: 'user',
+        workflowId: '',
+        workspaceId: 'workspace',
+        chatId: 'chat',
+        resolvedSecretTraceRegistry: new ResolvedSecretTraceRegistry([], {
+          userId: 'user',
+          workspaceId: 'workspace',
+        }),
+      }
+    )
+    expect(result.output).toEqual({ sandboxFiles: [] })
+  })
+})
+
 describe('Generic Secrets function execution', () => {
   it('mounts the authorized environment and propagates echoed secrets into model redaction', async () => {
     setEnv({ ENCRYPTION_KEY: 'a'.repeat(64) })

apps/sim/lib/mothership/tools/handlers/function-execute-provenance.test.ts

@@ -499,6 +499,8 @@ export async function executeFunctionExecute(
     'internalSandboxProfile',
     // Server-derived below — a model-supplied value must never select a session.
     'sandboxSessionKey',
+    // Server-derived from resolved inputs; a model-supplied mount would skip their provenance.
+    '_sandboxFiles',
     PRIVATE_SECRET_PROVENANCE_FIELD,
   ])
   // One persistent session sandbox per chat: files and installed packages