do not redact feature flag style env vars

Author: Vikhyath Mondreti

apps/sim/executor/handlers/agent/memory.test.ts

@@ -337,8 +337,8 @@ describe('Memory', () => {
       expect(result.content).toBe('foreign-secret')
     })
 
-    it.each(['123', 'true'])(
-      'projects low-entropy secret %s only in model text and arguments',
+    it.each(['123'])(
+      'projects short secret %s only in model text and arguments',
       async (secret) => {
         const registry = new ResolvedSecretTraceRegistry([
           { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },

apps/sim/executor/utils/resolved-secret-content-projection.test.ts

@@ -3,7 +3,9 @@
  */
 import { describe, expect, it, vi } from 'vitest'
 import {
+  createResolvedSecretMatcher,
   isResolvedSecretModelContentUnchanged,
+  projectResolvedSecretContent,
   projectResolvedSecretDiagnosticError,
   projectResolvedSecretModelContent,
   projectResolvedSecretModelJsonContent,
@@ -175,7 +177,7 @@ describe('projectResolvedSecretModelContent', () => {
     })
   })
 
-  it('projects exact typed primitive secrets without rewriting unrelated primitives', () => {
+  it('projects exact typed numeric secrets, leaving booleans and null identifying nothing', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '123', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'true', encryptedValue: 'boolean-ciphertext' },
@@ -200,17 +202,17 @@ describe('projectResolvedSecretModelContent', () => {
     ).toEqual({
       safe: true,
       value: {
-        strings: ['{{NUMBER}}', '{{BOOLEAN}}', '{{NULL}}'],
+        strings: ['{{NUMBER}}', 'true', 'null'],
         number: '{{NUMBER}}',
-        boolean: '{{BOOLEAN}}',
-        nothing: '{{NULL}}',
+        boolean: true,
+        nothing: null,
         unrelatedNumber: 1234,
         unrelatedBoolean: false,
       },
     })
   })
 
-  it.each(['123', 'true'])('keeps projected JSON argument strings valid (%s)', (secret) => {
+  it.each(['123'])('keeps projected JSON argument strings valid (%s)', (secret) => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
     ])
@@ -231,6 +233,26 @@ describe('projectResolvedSecretModelContent', () => {
     })
   })
 
+  it('leaves a boolean-valued secret in a JSON argument string untouched', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'TOKEN', plaintext: 'true', encryptedValue: 'ciphertext' },
+    ])
+    registry.recordResolved('TOKEN', 'true')
+
+    const projection = projectResolvedSecretModelJsonStrings(
+      [JSON.stringify({ secret: 'true', converted: true, nested: [true] })],
+      registry
+    )
+
+    expect(projection.safe).toBe(true)
+    if (!projection.safe || !Array.isArray(projection.value)) return
+    expect(JSON.parse(projection.value[0] as string)).toEqual({
+      secret: 'true',
+      converted: true,
+      nested: [true],
+    })
+  })
+
   it('is stable when a secret literal overlaps its own provenance alias', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: 'TOKEN', encryptedValue: 'ciphertext' },
@@ -464,3 +486,46 @@ describe('projectResolvedSecretDiagnosticError', () => {
     })
   })
 })
+
+describe('literals too small to identify anything', () => {
+  const matcher = createResolvedSecretMatcher(
+    [
+      { plaintext: 'false', replacement: '{{BANNER_ENABLED}}' },
+      { plaintext: 'xoxb-real-secret-value', replacement: '{{SLACK_TOKEN}}' },
+    ],
+    { preserveNamedProvenanceLabels: true, mode: 'render' }
+  )!
+
+  const project = (value: unknown) =>
+    projectResolvedSecretContent(value, matcher, 1_000_000, { projectPrimitiveLiterals: true })
+
+  /** A `*_ENABLED` variable holding `false` once rewrote 2,000 boolean cells in one table read. */
+  it('leaves a typed boolean cell alone', () => {
+    expect(project({ had_error: false, ok: true, missing: null })).toEqual({
+      safe: true,
+      value: { had_error: false, ok: true, missing: null },
+    })
+  })
+
+  it('leaves a delimited occurrence inside surrounding text alone', () => {
+    expect(project({ url: 'https://x?fromUser=false&sort=count' })).toEqual({
+      safe: true,
+      value: { url: 'https://x?fromUser=false&sort=count' },
+    })
+  })
+
+  it('still substitutes a real secret sharing the same matcher', () => {
+    expect(project({ token: 'xoxb-real-secret-value', flag: false })).toEqual({
+      safe: true,
+      value: { token: '{{SLACK_TOKEN}}', flag: false },
+    })
+  })
+
+  it('builds no matcher at all when every literal is non-identifying', () => {
+    expect(
+      createResolvedSecretMatcher([{ plaintext: 'true', replacement: '{{FLAG}}' }], {
+        mode: 'render',
+      })
+    ).toBeUndefined()
+  })
+})

apps/sim/executor/utils/resolved-secret-match-policy.test.ts

@@ -4,6 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   getResolvedSecretMatchPolicy,
+  isNonIdentifyingSecretLiteral,
   isWordBoundaryMatch,
   MIN_UNANCHORED_MATCH_LENGTH,
 } from '@/executor/utils/resolved-secret-match-policy'
@@ -89,3 +90,19 @@ describe('isWordBoundaryMatch', () => {
     expect(isWordBoundaryMatch('abc', 3, 3)).toBe(true)
   })
 })
+
+describe('isNonIdentifyingSecretLiteral', () => {
+  it.each(['true', 'false', 'null'])(
+    'excludes %s, whose value space is too small to identify',
+    (literal) => {
+      expect(isNonIdentifyingSecretLiteral(literal)).toBe(true)
+    }
+  )
+
+  it.each(['0', '1', 'False', 'TRUE', 'Null', 'nullish', '', 'hunter2', 'sk_live_abc'])(
+    'keeps %s protectable',
+    (literal) => {
+      expect(isNonIdentifyingSecretLiteral(literal)).toBe(false)
+    }
+  )
+})

apps/sim/executor/utils/resolved-secret-match-policy.ts

@@ -35,6 +35,37 @@ export type ResolvedSecretMatchPolicy = 'anywhere' | 'boundary'
  */
 export const MIN_UNANCHORED_MATCH_LENGTH = 8
 
+/**
+ * Literals that may not match at all, at any offset, because they identify nothing.
+ *
+ * This is cardinality, not entropy — the distinction the floor above turns on. An all-`f` HMAC key
+ * is low-entropy but drawn from an enormous space, so a hit on it is evidence. `false` is drawn
+ * from a space of two: a hit on it is evidence of nothing, and substituting it protects nothing an
+ * attacker could not guess by flipping a coin. Meanwhile it rewrites every boolean any workflow
+ * ever wrote — one deployment turned 2,000 `had_error` cells into `[REDACTED_SECRET]` because a
+ * `*_BANNER_ENABLED` variable happened to hold `false`.
+ *
+ * Exactly the three JSON renderings of a non-string primitive, and nothing else. `0` and `1` are
+ * deliberately absent: a short numeric secret is entirely plausible where a boolean one is not.
+ * Matching is case-sensitive because the set is defined by what `String(value)` produces for a
+ * typed primitive, not by what looks boolean — an environment variable literally holding `False`
+ * keeps its protection.
+ *
+ * The residual is one bit: a variable whose whole value is the string `false` is no longer hidden.
+ */
+const NON_IDENTIFYING_SECRET_LITERALS: ReadonlySet<string> = new Set(['true', 'false', 'null'])
+
+/**
+ * True when a literal carries too little information to be worth protecting anywhere.
+ *
+ * Applied where literals are turned into matchers, so it governs detection and substitution alike:
+ * such a value is never rewritten out of content, and never recorded into durable provenance as
+ * something a later read must redact.
+ */
+export function isNonIdentifyingSecretLiteral(plaintext: string): boolean {
+  return NON_IDENTIFYING_SECRET_LITERALS.has(plaintext)
+}
+
 /**
  * Combining marks count so a substitution cannot split a grapheme cluster. `_` deliberately does
  * NOT: `sk_live_...` and `user_483920_profile` are the dominant way a secret gets joined into an

apps/sim/executor/utils/resolved-secret-matcher.ts

@@ -1,6 +1,7 @@
 import { MAX_INLINE_MATERIALIZATION_BYTES } from '@/lib/execution/payloads/limits'
 import {
   getResolvedSecretMatchPolicy,
+  isNonIdentifyingSecretLiteral,
   type ResolvedSecretMatchPolicy,
   satisfiesResolvedSecretMatchPolicy,
 } from '@/executor/utils/resolved-secret-match-policy'
@@ -457,7 +458,12 @@ export function createResolvedSecretMatcher(
   const replacementByPlaintext = new Map<string, string>()
 
   for (const match of matches) {
-    if (!match.plaintext) continue
+    /**
+     * Dropped before any construction-time check runs, so no later stage can be talked into
+     * treating one of these as protectable — including the wide-match-set checks below, which
+     * deliberately ignore the narrow policy.
+     */
+    if (!match.plaintext || isNonIdentifyingSecretLiteral(match.plaintext)) continue
     const current = replacementByPlaintext.get(match.plaintext)
     if (current === undefined || compareStrings(match.replacement, current) < 0) {
       replacementByPlaintext.set(match.plaintext, match.replacement)

apps/sim/executor/utils/resolved-secret-trace-registry.test.ts

@@ -1010,11 +1010,11 @@ describe('ResolvedSecretTraceRegistry', () => {
 
   it('conservatively retains every active secret that shares a raw plaintext literal', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'FIRST', plaintext: 'true', encryptedValue: 'first-ciphertext' },
-      { name: 'SECOND', plaintext: 'true', encryptedValue: 'second-ciphertext' },
+      { name: 'FIRST', plaintext: '4815162342', encryptedValue: 'first-ciphertext' },
+      { name: 'SECOND', plaintext: '4815162342', encryptedValue: 'second-ciphertext' },
     ])
-    registry.recordResolved('FIRST', 'true')
-    registry.recordResolved('SECOND', 'true')
+    registry.recordResolved('FIRST', '4815162342')
+    registry.recordResolved('SECOND', '4815162342')
 
     const expected = {
       version: 1 as const,
@@ -1024,11 +1024,11 @@ describe('ResolvedSecretTraceRegistry', () => {
         { name: 'SECOND', encryptedValue: 'second-ciphertext' },
       ],
     }
-    expect(registry.exportCommittedProvenanceForValue('true')).toEqual(expected)
-    expect(registry.exportCommittedProvenanceForValue(true)).toEqual(expected)
+    expect(registry.exportCommittedProvenanceForValue('4815162342')).toEqual(expected)
+    expect(registry.exportCommittedProvenanceForValue(4815162342)).toEqual(expected)
   })
 
-  it('exports active numeric, boolean, and null literals crossing a value boundary', () => {
+  it('exports active numeric literals crossing a value boundary, but not boolean or null', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '1234', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'false', encryptedValue: 'boolean-ciphertext' },
@@ -1048,11 +1048,7 @@ describe('ResolvedSecretTraceRegistry', () => {
     ).toEqual({
       version: 1,
       complete: true,
-      entries: [
-        { encryptedValue: 'boolean-ciphertext' },
-        { encryptedValue: 'null-ciphertext' },
-        { encryptedValue: 'number-ciphertext' },
-      ],
+      entries: [{ encryptedValue: 'number-ciphertext' }],
     })
   })
 
@@ -1576,3 +1572,53 @@ describe('incompleteness diagnostics', () => {
     expect(logged).not.toContain('MISSING')
   })
 })
+
+describe('non-identifying literals in durable provenance', () => {
+  /**
+   * The amplifier behind the boolean redaction: once recorded on a row, every later read of that
+   * table reactivated the value and rewrote every boolean in it.
+   */
+  it('never records a value too small to identify anything', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+      { name: 'TOKEN', plaintext: 'xoxb-real-secret-value', encryptedValue: 'token-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+    registry.recordResolved('TOKEN', 'xoxb-real-secret-value')
+
+    expect(registry.exportProvenanceForValue({ had_error: false, note: 'fromUser=false' })).toEqual(
+      { version: 1, complete: true, entries: [] }
+    )
+    expect(registry.exportProvenanceForValue({ token: 'xoxb-real-secret-value' })).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'TOKEN', encryptedValue: 'token-ciphertext' }],
+    })
+  })
+
+  it('still recognizes the internal alias, which names the variable its value cannot', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+
+    expect(registry.exportProvenanceForValue({ code: '__var_BANNER_ENABLED' })).toEqual({
+      version: 1,
+      complete: true,
+      entries: [{ name: 'BANNER_ENABLED', encryptedValue: 'flag-ciphertext' }],
+    })
+  })
+
+  it('keeps it out of the model matcher so nothing downstream can substitute it', () => {
+    const registry = new ResolvedSecretTraceRegistry([
+      { name: 'BANNER_ENABLED', plaintext: 'false', encryptedValue: 'flag-ciphertext' },
+    ])
+    registry.recordResolved('BANNER_ENABLED', 'false')
+
+    const snapshot = registry.getModelEgressSnapshot()
+    expect(snapshot.complete).toBe(true)
+    if (snapshot.complete) {
+      expect(snapshot.matches.map((match) => match.plaintext)).not.toContain('false')
+    }
+  })
+})

apps/sim/executor/utils/resolved-secret-trace-registry.ts

@@ -4,6 +4,7 @@ import { decryptSecret } from '@/lib/core/security/encryption'
 import { isLargeArrayManifest } from '@/lib/execution/payloads/large-array-manifest-metadata'
 import { isLargeValueRef } from '@/lib/execution/payloads/large-value-ref'
 import { MAX_INLINE_MATERIALIZATION_BYTES } from '@/lib/execution/payloads/limits'
+import { isNonIdentifyingSecretLiteral } from '@/executor/utils/resolved-secret-match-policy'
 import {
   createResolvedSecretMatcher,
   OPAQUE_RESOLVED_SECRET_REPLACEMENT,
@@ -1303,7 +1304,12 @@ export class ResolvedSecretTraceRegistry {
   private buildMatches(entries: Iterable<ActiveSecretEntry>): readonly ResolvedSecretTraceMatch[] {
     const candidatesByPlaintext = new Map<string, ActiveSecretEntry[]>()
     for (const entry of entries) {
-      if (entry.plaintext.length === 0) continue
+      /**
+       * Dropped here too, not only inside the matcher, so a literal that will never be substituted
+       * also never counts toward the matcher capacity bound or appears to a snapshot reader as
+       * something this registry protects.
+       */
+      if (entry.plaintext.length === 0 || isNonIdentifyingSecretLiteral(entry.plaintext)) continue
       const candidates = candidatesByPlaintext.get(entry.plaintext) ?? []
       candidates.push(entry)
       candidatesByPlaintext.set(entry.plaintext, candidates)
@@ -1511,7 +1517,12 @@ export class ResolvedSecretTraceRegistry {
         compareStrings(left.encryptedValue, right.encryptedValue)
     )
     for (const entry of sortedCandidateEntries) {
-      if (entry.plaintext.length === 0) continue
+      /**
+       * Excluded from scan literals as well as from the matcher, so such a value is never recorded
+       * into durable provenance as something a later read must redact. A named entry still joins
+       * the alias loop below — `__var_NAME` identifies the variable even when its value does not.
+       */
+      if (entry.plaintext.length === 0 || isNonIdentifyingSecretLiteral(entry.plaintext)) continue
       const candidates = candidatesByPlaintext.get(entry.plaintext) ?? []
       const entryKey = activeEntryKey(entry)
       if (!candidates.some((candidate) => activeEntryKey(candidate) === entryKey)) {

apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts

@@ -227,7 +227,7 @@ describe('projectToolResultForCopilot', () => {
     ).toEqual({ success: true, output: { result: encoded } })
   })
 
-  it('projects exact typed primitive secrets and the same values as strings', () => {
+  it('projects exact typed numeric secrets, leaving booleans and null identifying nothing', () => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'NUMBER', plaintext: '123', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'true', encryptedValue: 'boolean-ciphertext' },
@@ -256,11 +256,11 @@ describe('projectToolResultForCopilot', () => {
       success: true,
       output: {
         number: '{{NUMBER}}',
-        boolean: '{{BOOLEAN}}',
-        nothing: '{{NULL}}',
+        boolean: true,
+        nothing: null,
         numberText: '{{NUMBER}}',
-        booleanText: '{{BOOLEAN}}',
-        nilText: '{{NULL}}',
+        booleanText: 'true',
+        nilText: 'null',
       },
     })
   })