fix(agents): complete direct Function execution and safe diagnostics

Author: waleedlatif1

apps/docs/content/docs/workflows/blocks/function.mdx

@@ -140,12 +140,19 @@ rather than returning part of what your code wrote.
 </Callout>
 
 <Callout type="warn">
-Returned files live with the execution rather than in your workspace, and a text
-file containing a resolved secret value is refused rather than returned — there is
-nowhere on an execution file to record that it carries one. Write such a file to a
-workspace path instead, or keep the secret out of the output.
+Returned workflow files live with the execution rather than in your workspace.
+A file containing a literal protected secret value is refused. Keep secrets out of
+returned files, or use an explicit workspace export that records their provenance.
 </Callout>
 
+When called directly with `sim tools execute function_execute`, generated files
+belong to the authenticated user and have `context: "copilot"`. Download one with
+`sim tools files download "<file.id>" --output-file ./result.txt` in the same
+workspace context. Direct calls also check filenames and refuse files whose
+secret provenance is uncertain, including binary output after a protected secret
+was used. For code that needs no secrets, pass `secretScope: "selected"` and
+`mountedSecrets: []` in the tool input.
+
 ## Language
 
 JavaScript without imports runs in a fast local sandbox. JavaScript with `import` or `require`, Python, and Shell run in the configured remote sandbox provider.

apps/sim/lib/environment/utils.test.ts

@@ -305,6 +305,108 @@ describe('getPersonalAndWorkspaceEnv access filtering', () => {
     }))
   })
 
+  it('skips every lookup when no names are selected', async () => {
+    const snapshot = await getPersonalAndWorkspaceEnv('user-1', 'workspace-1', {
+      requestedNames: [],
+    })
+    expect(snapshot).toEqual({
+      personalEncrypted: {},
+      workspaceEncrypted: {},
+      personalDecrypted: {},
+      workspaceDecrypted: {},
+      personalOwners: {},
+      conflicts: [],
+      decryptionFailures: [],
+      workspaceUnredactedKeys: [],
+    })
+    expect(mockCheckWorkspaceAccess).not.toHaveBeenCalled()
+    expect(mockGetAccessibleEnvCredentials).not.toHaveBeenCalled()
+    expect(encryptionMockFns.mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('filters selection before decryption while retaining owner, precedence and visibility provenance', async () => {
+    mockGetAccessibleEnvCredentials.mockResolvedValue([
+      {
+        type: 'env_workspace',
+        envKey: 'SELECTED',
+        envOwnerUserId: null,
+        updatedAt: new Date(),
+        unredacted: true,
+      },
+      {
+        type: 'env_workspace',
+        envKey: 'OTHER',
+        envOwnerUserId: null,
+        updatedAt: new Date(),
+        unredacted: true,
+      },
+      {
+        type: 'env_personal',
+        envKey: 'SHARED',
+        envOwnerUserId: 'owner-2',
+        updatedAt: new Date(),
+        unredacted: false,
+      },
+    ])
+    queueTableRows(environment, [
+      { variables: { SELECTED: 'personal-cipher', OTHER: 'other-personal-cipher' } },
+    ])
+    queueTableRows(workspaceEnvironment, [
+      {
+        variables: {
+          SELECTED: 'workspace-cipher',
+          OTHER: 'other-workspace-cipher',
+          DENIED: 'denied-cipher',
+        },
+      },
+    ])
+    queueTableRows(environment, [
+      { userId: 'owner-2', variables: { SHARED: 'shared-cipher', UNRELATED: 'unrelated-cipher' } },
+    ])
+    const snapshot = await getPersonalAndWorkspaceEnv('user-1', 'workspace-1', {
+      requestedNames: ['SELECTED', 'SHARED', 'DENIED', 'SELECTED'],
+    })
+    expect(snapshot).toMatchObject({
+      personalEncrypted: { SELECTED: 'personal-cipher', SHARED: 'shared-cipher' },
+      workspaceEncrypted: { SELECTED: 'workspace-cipher' },
+      personalDecrypted: { SELECTED: 'plain:personal-cipher', SHARED: 'plain:shared-cipher' },
+      workspaceDecrypted: { SELECTED: 'plain:workspace-cipher' },
+      personalOwners: { SELECTED: 'user-1', SHARED: 'owner-2' },
+      conflicts: ['SELECTED'],
+      workspaceUnredactedKeys: ['SELECTED'],
+    })
+    expect(encryptionMockFns.mockDecryptSecret.mock.calls.flat()).toEqual(
+      expect.arrayContaining(['personal-cipher', 'workspace-cipher', 'shared-cipher'])
+    )
+    expect(encryptionMockFns.mockDecryptSecret).toHaveBeenCalledTimes(3)
+  })
+
+  it('rechecks selected credential access after a grant is revoked', async () => {
+    const credential = {
+      type: 'env_workspace',
+      envKey: 'SELECTED',
+      envOwnerUserId: null,
+      updatedAt: new Date(),
+      unredacted: false,
+    }
+    mockGetAccessibleEnvCredentials.mockResolvedValueOnce([credential]).mockResolvedValueOnce([])
+    for (let index = 0; index < 2; index++) {
+      queueTableRows(environment, [{ variables: {} }])
+      queueTableRows(workspaceEnvironment, [{ variables: { SELECTED: 'workspace-cipher' } }])
+    }
+    expect(
+      (await getPersonalAndWorkspaceEnv('user-1', 'workspace-1', { requestedNames: ['SELECTED'] }))
+        .workspaceDecrypted
+    ).toEqual({ SELECTED: 'plain:workspace-cipher' })
+    expect(
+      (await getPersonalAndWorkspaceEnv('user-1', 'workspace-1', { requestedNames: ['SELECTED'] }))
+        .workspaceDecrypted
+    ).toEqual({})
+    expect(mockCheckWorkspaceAccess).toHaveBeenCalledTimes(2)
+    expect(mockGetAccessibleEnvCredentials).toHaveBeenCalledTimes(2)
+    expect(encryptionMockFns.mockDecryptSecret).toHaveBeenCalledOnce()
+  })
+
   it('filters every workspace secret when the caller has zero credential grants', async () => {
     queueTableRows(environment, [{ variables: { PERSONAL_KEY: 'personal-cipher' } }])
     queueTableRows(workspaceEnvironment, [{ variables: { WORKSPACE_KEY: 'workspace-cipher' } }])

apps/sim/lib/environment/utils.ts

@@ -353,10 +353,36 @@ export async function resolveEffectiveEnvironmentVariables(
 export async function getPersonalAndWorkspaceEnv(
   userId: string,
   workspaceId?: string,
-  options?: { workspaceAccess?: WorkspaceAccess }
+  options?: { workspaceAccess?: WorkspaceAccess; requestedNames?: readonly string[] }
 ): Promise<EnvironmentResolutionSnapshot> {
-  const { personalEncrypted, workspaceEncrypted, personalOwners, workspaceUnredactedKeys } =
-    await loadAccessibleEncryptedEnvironment(userId, workspaceId, options)
+  if (options?.requestedNames?.length === 0) {
+    return {
+      personalEncrypted: {},
+      workspaceEncrypted: {},
+      personalDecrypted: {},
+      workspaceDecrypted: {},
+      personalOwners: {},
+      conflicts: [],
+      decryptionFailures: [],
+      workspaceUnredactedKeys: [],
+    }
+  }
+  const accessible = await loadAccessibleEncryptedEnvironment(userId, workspaceId, options)
+  const requestedNames = options?.requestedNames ? new Set(options.requestedNames) : undefined
+  const selectRequested = (values: Record<string, string>): Record<string, string> => {
+    if (!requestedNames) return values
+    return Object.fromEntries(
+      [...requestedNames].flatMap((name) =>
+        Object.hasOwn(values, name) ? [[name, values[name]]] : []
+      )
+    )
+  }
+  const personalEncrypted = selectRequested(accessible.personalEncrypted)
+  const workspaceEncrypted = selectRequested(accessible.workspaceEncrypted)
+  const personalOwners = selectRequested(accessible.personalOwners)
+  const workspaceUnredactedKeys = accessible.workspaceUnredactedKeys.filter(
+    (name) => !requestedNames || requestedNames.has(name)
+  )
 
   const decryptionFailures: string[] = []
 

apps/sim/lib/function-execution/execute-request.ts

@@ -99,6 +99,7 @@ import {
   validateWorkspaceFileWriteTarget,
   writeWorkspaceFileByPath,
 } from '@/lib/mothership/vfs/resource-writer'
+import { uploadCopilotFile } from '@/lib/uploads/contexts/copilot'
 import { uploadExecutionFile } from '@/lib/uploads/contexts/execution/execution-file-manager'
 import {
   createWorkspaceFileSecretProvenanceFromRegistry,
@@ -110,6 +111,7 @@ import {
   type WorkspaceFileSecretProvenanceIdentity,
 } from '@/lib/uploads/contexts/workspace/workspace-file-secret-provenance'
 import { deleteFiles } from '@/lib/uploads/core/storage-service'
+import { deleteFileMetadata } from '@/lib/uploads/server/metadata'
 import { getFileExtension, getMimeTypeFromExtension } from '@/lib/uploads/utils/file-utils'
 import { getWorkflowById } from '@/lib/workflows/utils'
 import { rebindWorkspaceFileDelegatedPrincipal } from '@/lib/workspace-files/application/delegated-principal'
@@ -2079,13 +2081,25 @@ function collectedFileName(relativePath: string): string {
  * and the harvest is all-or-nothing by design. Best-effort on purpose: the
  * caller needs to hear why its export was refused, not that the tidy-up failed.
  */
-async function discardUploadedExecutionFiles(files: readonly UserFile[]): Promise<void> {
+async function discardUploadedSandboxFiles(files: readonly UserFile[]): Promise<void> {
   if (files.length === 0) return
   try {
-    await deleteFiles(
+    const context = files[0].context === 'copilot' ? 'copilot' : 'execution'
+    const result = await deleteFiles(
       files.map((file) => file.key),
-      'execution'
+      context
     )
+    if (context === 'copilot') {
+      const failedKeys = new Set(result.failed.map((failure) => failure.key))
+      for (const file of files) {
+        if (!failedKeys.has(file.key)) await deleteFileMetadata(file.key)
+      }
+    }
+    if (result.failed.length > 0) {
+      logger.warn('Could not remove some partially uploaded sandbox output files', {
+        fileCount: result.failed.length,
+      })
+    }
   } catch (error) {
     logger.warn('Could not remove partially uploaded sandbox output files', {
       fileCount: files.length,
@@ -2132,10 +2146,27 @@ async function collectSandboxOutputFiles(args: {
   const resolvedWorkspaceId =
     args.workspaceId ||
     (args.workflowId ? (await getWorkflowById(args.workflowId))?.workspaceId : undefined)
+  const personalOwnerId =
+    (routeContext.principal.kind === 'session' ||
+      routeContext.principal.kind === 'personal_api_key' ||
+      routeContext.principal.kind === 'oauth_access_token') &&
+    !args.workflowId &&
+    !args.executionId
+      ? routeContext.fileAccessUserId
+      : undefined
+  const storageTarget = personalOwnerId
+    ? { context: 'copilot' as const, userId: personalOwnerId }
+    : args.workflowId && args.executionId
+      ? {
+          context: 'execution' as const,
+          workflowId: args.workflowId,
+          executionId: args.executionId,
+        }
+      : undefined
 
   // Fails rather than returning an empty list: the code did produce files, and
   // reporting success without them would read as "your script wrote nothing".
-  if (!resolvedWorkspaceId || !args.workflowId || !args.executionId) {
+  if (!resolvedWorkspaceId || !storageTarget) {
     return {
       response: exportFailure(
         'Workspace, workflow, and execution context are required to return files from the sandbox.',
@@ -2158,15 +2189,24 @@ async function collectSandboxOutputFiles(args: {
       const mimeType = getMimeTypeFromExtension(getFileExtension(name))
 
       /** Literal secrets must be refused regardless of the export's name or encoding. */
-      const scannedProvenance = await getOutputFileSecretProvenance(buffer, false, routeContext, {
+      let scannedProvenance = await getOutputFileSecretProvenance(buffer, false, routeContext, {
         userId: args.authUserId,
         workspaceId: resolvedWorkspaceId,
       })
+      if (personalOwnerId) {
+        scannedProvenance = mergeWorkspaceFileSecretProvenance(
+          scannedProvenance,
+          await getOutputFileSecretProvenance(Buffer.from(name), false, routeContext, {
+            userId: personalOwnerId,
+            workspaceId: resolvedWorkspaceId,
+          })
+        )
+      }
       if (
         scannedProvenance.status === 'unknown' ||
         (scannedProvenance.status === 'exact' && scannedProvenance.entries.length > 0)
       ) {
-        await discardUploadedExecutionFiles(files)
+        await discardUploadedSandboxFiles(files)
         return {
           response: exportFailure(
             `Sandbox output file "${name}" contains a resolved secret value and was not returned. Write the file without embedding secret values, or export it to a workspace file where its provenance can be recorded.`,
@@ -2192,22 +2232,46 @@ async function collectSandboxOutputFiles(args: {
           })
         : scannedProvenance
 
-      const userFile = await uploadExecutionFile(
-        {
-          workspaceId: resolvedWorkspaceId,
-          workflowId: args.workflowId,
-          executionId: args.executionId,
-        },
-        buffer,
-        name,
-        mimeType,
-        args.authUserId,
-        secretProvenance
-      )
+      if (
+        personalOwnerId &&
+        (secretProvenance.status !== 'exact' || secretProvenance.entries.length > 0)
+      ) {
+        await discardUploadedSandboxFiles(files)
+        return {
+          response: exportFailure(
+            `Sandbox output file "${name}" cannot be returned because its secret provenance is uncertain. Return a text file without secret values, or export it from a workflow that records file provenance.`,
+            400,
+            args.stdout,
+            args.executionTime,
+            args.cost
+          ),
+        }
+      }
+
+      const userFile =
+        storageTarget.context === 'copilot'
+          ? await uploadCopilotFile({
+              buffer,
+              fileName: name,
+              contentType: mimeType,
+              userId: storageTarget.userId,
+            })
+          : await uploadExecutionFile(
+              {
+                workspaceId: resolvedWorkspaceId,
+                workflowId: storageTarget.workflowId,
+                executionId: storageTarget.executionId,
+              },
+              buffer,
+              name,
+              mimeType,
+              args.authUserId,
+              secretProvenance
+            )
       files.push(userFile)
     }
   } catch (error) {
-    await discardUploadedExecutionFiles(files)
+    await discardUploadedSandboxFiles(files)
     throw error
   }