fix(mothership): refuse Chat table predicates over unsafe cells

A table read whose rows, counts, cursor or affected count depend on cell
values is refused for Chat, before the predicate runs, when the table has an
unvouched row or a secret in a referenced column. Inline run-file bytes are
collected per storage key, and table-selection fallbacks are projected.

Author: waleedlatif1

apps/sim/lib/mothership/__integration__/content-delivery.integration.ts

@@ -51,8 +51,9 @@ vi.mock('@/lib/mothership/async-runs/repository', async (importOriginal) => ({
 }))
 
 import { db } from '@sim/db'
-import { copilotChats } from '@sim/db/schema'
+import { copilotChats, userTableRowSecretProvenance } from '@sim/db/schema'
 import { sha256Hex } from '@sim/security/hash'
+import { eq, sql } from 'drizzle-orm'
 import contentRoutes from '@/lib/api/server/routes/copilot-content-routes.json'
 import { matchV2Route } from '@/lib/api/server/routes/in-process-transport'
 import { withWorkspaceInvocationScope } from '@/lib/core/application/workspace-invocation-scope'
@@ -329,16 +330,68 @@ describe('content reaching Chat is admitted per item', () => {
       expectPerItem(read, { secretAdmitted: true })
     })
 
-    it('drops row-search matches that would probe unadmitted cells (#18b)', async () => {
-      const read = await cli('POST', `/api/v2/tables/${fixture.table.tableId}/rows/search`, {
+    it('refuses predicates over a table whose cells it cannot vouch for (#18b)', async () => {
+      const table = `/api/v2/tables/${fixture.table.tableId}`
+      const guess = { field: 'note', op: 'contains', value: 'second' }
+      const refused = [
+        await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' }),
+        await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess, limit: 1 }),
+        await cli('POST', `${table}/query/count`, { workspaceId: ws(), predicate: guess }),
+      ]
+      for (const read of refused) {
+        expect(read.status).toBe(403)
+        expect(read.body).not.toContain(CANARY.unknown)
+        expect(read.body).not.toContain(CANARY.secret)
+      }
+      /** The same predicate reads nothing but row ids, so it stays available. */
+      const byId = await cli('POST', `${table}/query`, {
         workspaceId: ws(),
-        q: 'second',
+        predicate: { field: 'id', op: 'in', value: [fixture.table.rows.clean] },
       })
-      expect(read.status).toBe(200)
-      const rows = new Set(
-        JSON.parse(read.body).data.matches.map((match: { rowId: string }) => match.rowId)
-      )
-      expect(rows).toEqual(new Set([fixture.table.rows.clean]))
+      expect(byId.status).toBe(200)
+      expect(modelView(byId)).toContain(CANARY.clean)
+    })
+
+    it('runs predicates over a table whose every cell is vouched for', async () => {
+      const created = await cli('POST', '/api/v2/tables', {
+        workspaceId: ws(),
+        name: `clean_${generateId().slice(0, 8)}`,
+        schema: { columns: [{ name: 'note', type: 'string' }] },
+      })
+      expect(created.status).toBe(201)
+      const table = `/api/v2/tables/${JSON.parse(created.body).data.id}`
+      for (const note of ['alpha second', 'beta']) {
+        expect(
+          (await cli('POST', `${table}/rows`, { workspaceId: ws(), data: { note } })).status
+        ).toBe(201)
+      }
+      const guess = { field: 'note', op: 'contains', value: 'second' }
+      const search = await cli('POST', `${table}/rows/search`, { workspaceId: ws(), q: 'second' })
+      expect(search.status).toBe(200)
+      expect(JSON.parse(search.body).data.matches).toHaveLength(1)
+      const query = await cli('POST', `${table}/query`, { workspaceId: ws(), predicate: guess })
+      expect(query.status).toBe(200)
+      expect(modelView(query)).toContain('alpha second')
+      const count = await cli('POST', `${table}/query/count`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(count.status).toBe(200)
+
+      /** A sidecar that claims exact but holds no valid entry list vouches for nothing. */
+      const malformed = await cli('POST', `${table}/rows`, {
+        workspaceId: ws(),
+        data: { note: 'gamma' },
+      })
+      await db
+        .update(userTableRowSecretProvenance)
+        .set({ entries: sql`'{"not":"a list"}'::jsonb` })
+        .where(eq(userTableRowSecretProvenance.rowId, JSON.parse(malformed.body).data.id))
+      const afterCorruption = await cli('POST', `${table}/query`, {
+        workspaceId: ws(),
+        predicate: guess,
+      })
+      expect(afterCorruption.status).toBe(403)
     })
 
     it('shares only clean files publicly on Chat’s behalf (#9, D1)', async () => {

apps/sim/lib/mothership/chat/process-contents.ts

@@ -1276,12 +1276,22 @@ async function resolveTableSelectionResource(
 
   const rendered = `${describe(sizeClause(lines.length, selectedRowCount - lines.length))}${lines.join('\n')}`
   const projected = projectResolvedSecretModelContent(rendered, selectionRegistry)
+  /** A fallback names the table, which is redacted like the rest; unredactable, it is omitted. */
+  const fallback = (reason: string) => {
+    const named = `Selected ${scope} from table ${JSON.stringify(table.name)} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+    const projectedName = projectResolvedSecretModelContent(named, selectionRegistry)
+    return projectedName.safe && typeof projectedName.value === 'string'
+      ? projectedName.value
+      : `Selected ${scope} (${selectedRowCount} rows, ${columns.length} columns). ${reason}`
+  }
   const preview =
     !cellsProjected || !projected.safe || typeof projected.value !== 'string'
-      ? `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). Cell values could not be checked for secret values, so none were inlined.`
+      ? fallback('Cell values could not be checked for secret values, so none were inlined.')
       : projected.value.length <= MAX_TABLE_SELECTION_PREVIEW_LENGTH
         ? `${projected.value}${omittedNote}`
-        : `Selected ${scope} from table "${table.name}" (${selectedRowCount} rows, ${columns.length} columns). The column headings exceed the selection content limit; no cell values were inlined.`
+        : fallback(
+            'The column headings exceed the selection content limit; no cell values were inlined.'
+          )
   /** The descriptor names columns and rows; it is shown to the model too, so it is redacted too. */
   const projectedSelection = projectResolvedSecretModelContent(selection, selectionRegistry)
   const descriptor =

apps/sim/lib/table/application/rows.test.ts

@@ -20,7 +20,7 @@ import {
 } from '@sim/testing/mocks/table-rows-service.mock'
 import { workspaceAuthzMock, workspaceAuthzMockFns } from '@sim/testing/mocks/workspace-authz.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import type { TableDefinition } from '@/lib/table/types'
+import type { TableDefinition, TablePredicate } from '@/lib/table/types'
 
 const {
   mockIsScopeCompatible,
@@ -29,9 +29,9 @@ const {
   mockRowProvenance,
   mockFindRowMatches,
   mockClassifyColumns,
-  mockTableHasUnvouchedRows,
+  mockTableHasCellsUnsafe,
 } = vi.hoisted(() => ({
-  mockTableHasUnvouchedRows: vi.fn(),
+  mockTableHasCellsUnsafe: vi.fn(),
   mockFindRowMatches: vi.fn(),
   mockClassifyColumns: vi.fn(),
   mockIsScopeCompatible: vi.fn(),
@@ -60,7 +60,7 @@ vi.mock('@/lib/table/column-types', () => ({
 vi.mock('@/lib/table/rows/secret-provenance', () => ({
   ...tableRowsSecretProvenanceMock,
   classifyStoredTableRowColumns: mockClassifyColumns,
-  tableHasUnvouchedRows: mockTableHasUnvouchedRows,
+  tableHasCellsUnsafeForPredicate: mockTableHasCellsUnsafe,
   TableRowProvenanceReader: class extends tableRowsSecretProvenanceMock.TableRowProvenanceReader {
     rowProvenance(rowId: string) {
       return mockRowProvenance(rowId)
@@ -997,54 +997,86 @@ describe('row delivery to Chat', () => {
     }
   )
 
-  describe('query counts Chat sees', () => {
-    const filtered = (principal: Caller) =>
+  describe('predicates Chat runs over cell values', () => {
+    const query = (principal: Caller, predicate?: TablePredicate) =>
       queryTableRows.execute({
         principal,
-        input: {
-          tableId: TABLE.id,
-          limit: 25,
-          includeTotal: true,
-          predicate: { all: [{ field: 'name', op: 'eq', value: 'guess' }] },
-        },
+        input: { tableId: TABLE.id, limit: 25, includeTotal: true, predicate },
       })
+    const BY_NAME: TablePredicate = { all: [{ field: 'name', op: 'eq', value: 'guess' }] }
 
     beforeEach(() => {
       mockQueryRows.mockResolvedValue({ ...PAGE, rowCount: 1, totalCount: 3 })
+      mockTableHasCellsUnsafe.mockResolvedValue(false)
     })
 
     it('counts only the rows delivered on the page', async () => {
       mockRowProvenance.mockReturnValue({ status: 'unknown' })
-      mockTableHasUnvouchedRows.mockResolvedValue(false)
-      const result = await observeContentDelivery({ admit: gate(false) }, () => filtered(CHAT))
+      const result = await observeContentDelivery({ admit: gate(false) }, () =>
+        query(CHAT, BY_NAME)
+      )
       expect(result).toMatchObject({ rows: [], rowCount: 0, totalCount: 3 })
     })
 
-    it('refuses a filtered total over a table holding rows Chat may not read', async () => {
+    it('refuses a predicate over cells it cannot vouch for, before running it', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, new Set(['column-name']))
+      expect(mockQueryRows).not.toHaveBeenCalled()
+    })
+
+    it('refuses when a cell it reads becomes unsafe during the read', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValueOnce(false).mockResolvedValueOnce(true)
       mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      mockTableHasUnvouchedRows.mockResolvedValue(true)
       await expect(
-        observeContentDelivery({ admit: gate(true) }, () => filtered(CHAT))
+        observeContentDelivery({ admit: gate(true) }, () => query(CHAT, BY_NAME))
       ).rejects.toBeInstanceOf(ContentRefusedError)
     })
 
-    it('keeps an unfiltered total, which says only how many rows exist', async () => {
+    it('checks nothing for an id-only predicate or no predicate, which read no cell', async () => {
       mockRowProvenance.mockReturnValue({ status: 'exact', entries: [] })
-      mockTableHasUnvouchedRows.mockResolvedValue(true)
-      const result = await observeContentDelivery({ admit: gate(true) }, () =>
-        queryTableRows.execute({
-          principal: CHAT,
-          input: { tableId: TABLE.id, limit: 25, includeTotal: true },
-        })
+      await observeContentDelivery({ admit: gate(true) }, () => query(CHAT))
+      await observeContentDelivery({ admit: gate(true) }, () =>
+        query(CHAT, { all: [{ field: 'id', op: 'in', value: ['row-1'] }] })
       )
-      expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
-      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
+    })
+
+    it('refuses a free-text search over a table with any unsafe cell', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () =>
+          searchTableRows.execute({ principal: CHAT, input: { tableId: TABLE.id, q: 'guess' } })
+        )
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockTableHasCellsUnsafe).toHaveBeenCalledWith(TABLE.id, 'all')
+      expect(mockFindRowMatches).not.toHaveBeenCalled()
+    })
+
+    it('refuses an update by filter over unsafe cells before changing anything', async () => {
+      mockTableHasCellsUnsafe.mockResolvedValue(true)
+      await expect(
+        observeContentDelivery({ admit: gate(true) }, () =>
+          updateTableRows.execute({
+            principal: CHAT,
+            input: {
+              tableId: TABLE.id,
+              filter: { name: 'guess' },
+              data: { name: 'x' },
+              dataKeying: 'names',
+            },
+          })
+        )
+      ).rejects.toBeInstanceOf(ContentRefusedError)
+      expect(mockUpdateRowsByFilter).not.toHaveBeenCalled()
     })
 
-    it('answers a person with the stored counts, unread', async () => {
-      const result = await filtered(PRINCIPAL)
+    it('answers a person with the stored counts, unchecked', async () => {
+      const result = await query(PRINCIPAL, BY_NAME)
       expect(result).toMatchObject({ rowCount: 1, totalCount: 3 })
-      expect(mockTableHasUnvouchedRows).not.toHaveBeenCalled()
+      expect(mockTableHasCellsUnsafe).not.toHaveBeenCalled()
     })
   })