fix(provenance): make one length floor the whole substitution rule

A literal shorter than eight characters is no longer substituted anywhere. It
was already the floor for matches inside a larger token; below it a second tier
still substituted whenever the hit sat on a word boundary — standing alone,
delimited, or as the whole value — on the theory that those positions made the
hit unambiguous.

Position is not the variable that matters. A hit on `7` is uninformative wherever
it sits, because the value space is ten. That tier rewrote `_raw_idx = 7` into
`_raw_idx = {{WEEKLY_OWNWORK_TTL}}` for the one shard whose index collided with a
TTL variable, and turned 2,000 boolean `had_error` cells into `[REDACTED_SECRET]`
because a `*_ENABLED` variable held `false`. Each was patched with a per-value
exception list; the floor subsumes both, so the lists are deleted.

With no literal below the floor reaching a matcher, the tier's machinery is
unreachable and goes with it: the match-policy type, its classifier, the word
boundary test, and the detect/render mode that existed only to select between
them. One constant now governs the question.

The cost is explicit and accepted: a secret shorter than eight characters is no
longer redacted from logs or model-visible content. Substitution cannot hide a
value that short — an observer who can read the surrounding text can enumerate
it. Two tests that pinned the old tier are rewritten to pin this, rather than
deleted, so the trade stays visible.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/execution/block-executor.test.ts

@@ -530,15 +530,15 @@ describe('BlockExecutor', () => {
     const resolver = new VariableResolver(workflow, {}, state)
     const onBlockComplete = vi.fn(async () => {})
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'SHORT_SECRET', plaintext: 'Test', encryptedValue: 'encrypted-test' },
+      { name: 'SHORT_SECRET', plaintext: 'TestValue', encryptedValue: 'encrypted-test' },
     ])
     const handler: BlockHandler = {
       canHandle: () => true,
       execute: async (blockContext, block) => {
         if (block.id === secretBlock.id) {
-          blockContext.resolvedSecretTraceRegistry?.recordResolved('SHORT_SECRET', 'Test')
+          blockContext.resolvedSecretTraceRegistry?.recordResolved('SHORT_SECRET', 'TestValue')
         }
-        return { result: 'Test' }
+        return { result: 'TestValue' }
       },
     }
     const executor = new BlockExecutor([handler], resolver, { onBlockComplete }, state)

apps/sim/executor/handlers/agent/memory.test.ts

@@ -347,14 +347,14 @@ describe('Memory', () => {
       expect(result.content).toBe('foreign-secret')
     })
 
-    it.each(['123'])(
+    it.each(['12345678'])(
       'projects short secret %s only in model text and arguments',
       async (secret) => {
         const registry = new ResolvedSecretTraceRegistry([
           { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
         ])
         registry.recordResolved('TOKEN', secret)
-        const converted = secret === '123' ? 123 : true
+        const converted = secret === '12345678' ? 12345678 : true
         const message: Message = {
           role: 'assistant',
           content: `Result: ${secret}`,

apps/sim/executor/handlers/pi/search/tool.test.ts

@@ -36,7 +36,7 @@ function executionContext(
 const ctx = executionContext()
 
 function buildTool(provider: 'exa' | 'serper' | 'parallel' | 'firecrawl' = 'exa', context = ctx) {
-  return buildPiSearchToolSpec(context, { provider, apiKey: 'key-123' }, 'local')
+  return buildPiSearchToolSpec(context, { provider, apiKey: 'key-1234567' }, 'local')
 }
 
 async function run(
@@ -69,7 +69,7 @@ describe('buildPiSearchToolSpec', () => {
 
     const [toolId, params, options] = mockExecuteTool.mock.calls[0]
     expect(toolId).toBe('exa_search')
-    expect(params.apiKey).toBe('key-123')
+    expect(params.apiKey).toBe('key-1234567')
     expect(params.timeout).toBe(10_000)
     expect(options.executionContext).toBe(ctx)
     expect(options.resolvedSecretTraceRegistry).toBeInstanceOf(ResolvedSecretTraceRegistry)
@@ -83,7 +83,7 @@ describe('buildPiSearchToolSpec', () => {
 
     const [toolId, params] = mockExecuteTool.mock.calls[0]
     expect(toolId).toBe('serper_search')
-    expect(params).toEqual({ query: 'pi', num: 2, apiKey: 'key-123', timeout: 10_000 })
+    expect(params).toEqual({ query: 'pi', num: 2, apiKey: 'key-1234567', timeout: 10_000 })
   })
 
   it('normalizes a successful provider response into the envelope', async () => {
@@ -193,17 +193,17 @@ describe('buildPiSearchToolSpec', () => {
 
   it('projects only the exact resolver-recorded search key and leaves the raw result unchanged', async () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'SEARCH_KEY', plaintext: 'key-123', encryptedValue: 'search-ciphertext' },
+      { name: 'SEARCH_KEY', plaintext: 'key-1234567', encryptedValue: 'search-ciphertext' },
       { name: 'UNRELATED', plaintext: 'Test', encryptedValue: 'unrelated-ciphertext' },
     ])
-    registry.recordResolvedAtInputPath('SEARCH_KEY', 'key-123', ['searchApiKey'])
-    registry.recordResolvedInputProjection(['searchApiKey'], 'key-123', '{{SEARCH_KEY}}')
+    registry.recordResolvedAtInputPath('SEARCH_KEY', 'key-1234567', ['searchApiKey'])
+    registry.recordResolvedInputProjection(['searchApiKey'], 'key-1234567', '{{SEARCH_KEY}}')
     registry.recordResolvedAtInputPath('UNRELATED', 'Test', ['task'])
     registry.recordResolvedInputProjection(['task'], 'Test', '{{UNRELATED}}')
     const output = {
       results: [
         {
-          title: 'key-123',
+          title: 'key-1234567',
           url: 'https://example.com/docs',
           text: 'Test',
         },
@@ -213,7 +213,7 @@ describe('buildPiSearchToolSpec', () => {
 
     const result = await buildPiSearchToolSpec(
       executionContext(registry),
-      { provider: 'exa', apiKey: 'key-123' },
+      { provider: 'exa', apiKey: 'key-1234567' },
       'local',
       '{{SEARCH_KEY}}'
     ).execute({ query: 'pi' })
@@ -231,7 +231,7 @@ describe('buildPiSearchToolSpec', () => {
     expect(output).toEqual({
       results: [
         {
-          title: 'key-123',
+          title: 'key-1234567',
           url: 'https://example.com/docs',
           text: 'Test',
         },

apps/sim/executor/utils/resolved-secret-content-projection.test.ts

@@ -161,37 +161,37 @@ describe('projectResolvedSecretModelContent', () => {
 
   it('keeps longest-match semantics when a known opaque placeholder is nested in a secret', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'Test', plaintext: 'Test', encryptedValue: 'test-ciphertext' },
+      { name: 'TestName', plaintext: 'TestName', encryptedValue: 'test-ciphertext' },
       {
         name: 'COMPOSITE',
-        plaintext: 'x{{Test}}y',
+        plaintext: 'x{{TestName}}y',
         encryptedValue: 'composite-ciphertext',
       },
     ])
-    registry.recordResolved('Test', 'Test')
-    registry.recordResolved('COMPOSITE', 'x{{Test}}y')
+    registry.recordResolved('TestName', 'TestName')
+    registry.recordResolved('COMPOSITE', 'x{{TestName}}y')
 
-    expect(projectResolvedSecretModelContent('x{{Test}}y', registry)).toEqual({
+    expect(projectResolvedSecretModelContent('x{{TestName}}y', registry)).toEqual({
       safe: true,
       value: '{{COMPOSITE}}',
     })
   })
 
   it('projects exact typed numeric secrets, leaving booleans and null identifying nothing', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'NUMBER', plaintext: '123', encryptedValue: 'number-ciphertext' },
+      { name: 'NUMBER', plaintext: '12345678', encryptedValue: 'number-ciphertext' },
       { name: 'BOOLEAN', plaintext: 'true', encryptedValue: 'boolean-ciphertext' },
       { name: 'NULL', plaintext: 'null', encryptedValue: 'null-ciphertext' },
     ])
-    registry.recordResolved('NUMBER', '123')
+    registry.recordResolved('NUMBER', '12345678')
     registry.recordResolved('BOOLEAN', 'true')
     registry.recordResolved('NULL', 'null')
 
     expect(
       projectResolvedSecretModelContent(
         {
-          strings: ['123', 'true', 'null'],
-          number: 123,
+          strings: ['12345678', 'true', 'null'],
+          number: 12345678,
           boolean: true,
           nothing: null,
           unrelatedNumber: 1234,
@@ -212,12 +212,12 @@ describe('projectResolvedSecretModelContent', () => {
     })
   })
 
-  it.each(['123'])('keeps projected JSON argument strings valid (%s)', (secret) => {
+  it.each(['12345678'])('keeps projected JSON argument strings valid (%s)', (secret) => {
     const registry = new ResolvedSecretTraceRegistry([
       { name: 'TOKEN', plaintext: secret, encryptedValue: 'ciphertext' },
     ])
     registry.recordResolved('TOKEN', secret)
-    const typedValue = secret === '123' ? 123 : true
+    const typedValue = secret === '12345678' ? 12345678 : true
 
     const projection = projectResolvedSecretModelJsonStrings(
       [JSON.stringify({ secret, converted: typedValue, nested: [typedValue] })],
@@ -255,37 +255,37 @@ describe('projectResolvedSecretModelContent', () => {
 
   it('is stable when a secret literal overlaps its own provenance alias', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'TOKEN', plaintext: 'TOKEN', encryptedValue: 'ciphertext' },
+      { name: 'TOKEN', plaintext: 'TOKENTOKEN', encryptedValue: 'ciphertext' },
     ])
-    registry.recordResolved('TOKEN', 'TOKEN')
+    registry.recordResolved('TOKEN', 'TOKENTOKEN')
 
-    const first = projectResolvedSecretModelContent('Bearer TOKEN', registry)
+    const first = projectResolvedSecretModelContent('Bearer TOKENTOKEN', registry)
     expect(first).toEqual({ safe: true, value: 'Bearer {{TOKEN}}' })
     if (!first.safe) return
     expect(projectResolvedSecretModelContent(first.value, registry)).toEqual(first)
   })
 
   it('preserves the canonical provenance label when its name equals the secret plaintext', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'Test', plaintext: 'Test', encryptedValue: 'ciphertext' },
+      { name: 'TestName', plaintext: 'TestName', encryptedValue: 'ciphertext' },
     ])
-    registry.recordResolved('Test', 'Test')
+    registry.recordResolved('TestName', 'TestName')
 
     expect(
       projectResolvedSecretModelContent(
         {
-          result: 'Test',
-          source: 'return {{Test}}',
-          error: "NameError: name 'Test' is not defined",
+          result: 'TestName',
+          source: 'return {{TestName}}',
+          error: "NameError: name 'TestName' is not defined",
         },
         registry
       )
     ).toEqual({
       safe: true,
       value: {
-        result: '{{Test}}',
-        source: 'return {{Test}}',
-        error: "NameError: name '{{Test}}' is not defined",
+        result: '{{TestName}}',
+        source: 'return {{TestName}}',
+        error: "NameError: name '{{TestName}}' is not defined",
       },
     })
   })
@@ -308,7 +308,7 @@ describe('projectResolvedSecretModelContent', () => {
       complete: true,
       matches: [
         {
-          plaintext: 'x'.repeat(64 * 1024),
+          plaintext: 'xxxxxxxx'.repeat(64 * 1024),
           replacement: '[REDACTED_SECRET]',
         },
       ],
@@ -321,16 +321,18 @@ describe('projectResolvedSecretModelContent', () => {
 
   it('keeps provenance-shaped content deterministic without trusting it as a protocol handle', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'Test', plaintext: 'Test', encryptedValue: 'ciphertext' },
+      { name: 'TestName', plaintext: 'TestName', encryptedValue: 'ciphertext' },
     ])
-    registry.recordResolved('Test', 'Test')
+    registry.recordResolved('TestName', 'TestName')
 
-    expect(projectResolvedSecretModelContent('{{Test}}', registry)).toEqual({
+    expect(projectResolvedSecretModelContent('{{TestName}}', registry)).toEqual({
       safe: true,
-      value: '{{Test}}',
+      value: '{{TestName}}',
     })
-    expect(isResolvedSecretModelContentUnchanged('{{Test}}', registry)).toBe(false)
-    expect(isResolvedSecretModelContentUnchanged(['resource', '{{Test}}'], registry)).toBe(false)
+    expect(isResolvedSecretModelContentUnchanged('{{TestName}}', registry)).toBe(false)
+    expect(isResolvedSecretModelContentUnchanged(['resource', '{{TestName}}'], registry)).toBe(
+      false
+    )
     expect(isResolvedSecretModelContentUnchanged(['resource', 'safe'], registry)).toBe(true)
   })
 })
@@ -409,7 +411,7 @@ describe('projectResolvedSecretModelJsonContent', () => {
 
   it('enforces the byte limit after secret aliases are projected', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'X', plaintext: 'x', encryptedValue: 'ciphertext' },
+      { name: 'X', plaintext: 'xxxxxxxx', encryptedValue: 'ciphertext' },
     ])
     registry.recordResolved('X', 'x')
 
@@ -445,7 +447,7 @@ describe('projectResolvedSecretDiagnosticError', () => {
 
   it('sanitizes an inactive compiler alias without activating or scanning its secret', () => {
     const registry = new ResolvedSecretTraceRegistry([
-      { name: 'X', plaintext: 'x', encryptedValue: 'ciphertext' },
+      { name: 'X', plaintext: 'xxxxxxxx', encryptedValue: 'ciphertext' },
     ])
     const error = new Error('Box __var_X')
 

apps/sim/executor/utils/resolved-secret-content-projection.ts

@@ -38,7 +38,6 @@ function createResolvedSecretModelMatcher(
 ): ResolvedSecretMatcher | undefined {
   const matcher = createResolvedSecretMatcher(matches, {
     preserveNamedProvenanceLabels: true,
-    mode: 'render',
   })
   if (!matcher) return undefined
 
@@ -75,7 +74,7 @@ function createResolvedSecretModelMatcher(
       })),
       ...opaquePlaceholderMatches,
     ],
-    { preserveNamedProvenanceLabels: true, mode: 'render' }
+    { preserveNamedProvenanceLabels: true }
   )
 }