feat(secrets): make output of generate api key a secret

Author: Sg312

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/question/question.tsx

@@ -5,10 +5,10 @@ import {
   ArrowRight,
   Button,
   Check,
-  checkboxIconVariants,
-  checkboxVariants,
   ChevronLeft,
   ChevronRight,
+  checkboxIconVariants,
+  checkboxVariants,
   cn,
   X,
 } from '@sim/emcn'
@@ -371,7 +371,6 @@ export function QuestionDisplay({
               type='text'
               value={freeText}
               disabled={disabled}
-              autoFocus
               onChange={(e) => setFreeText(e.target.value)}
               onBlur={() => {
                 if (freeText.trim().length === 0) {

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.test.tsx

@@ -18,7 +18,10 @@ vi.mock('next/navigation', () => ({
 }))
 
 import type { CredentialTagData } from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags'
-import { SpecialTags } from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags'
+import {
+  parseSpecialTags,
+  SpecialTags,
+} from '@/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags'
 
 /**
  * Minimal dependency-free render harness (the repo has no `@testing-library/react`). Mounts the
@@ -89,3 +92,24 @@ describe('CredentialDisplay link tag', () => {
     act(() => root.unmount())
   })
 })
+
+describe('parseSpecialTags sim_key placeholder', () => {
+  it('accepts a value-less {"type":"sim_key"} tag as a credential segment', () => {
+    const { segments } = parseSpecialTags('<credential>{"type":"sim_key"}</credential>', false)
+    const credential = segments.find((s) => s.type === 'credential')
+    expect(credential).toEqual({ type: 'credential', data: { type: 'sim_key' } })
+  })
+
+  it('still accepts the legacy {"redacted":true} form as a value-less sim_key placeholder', () => {
+    const { segments } = parseSpecialTags(
+      '<credential>{"type":"sim_key","redacted":true}</credential>',
+      false
+    )
+    const credential = segments.find((s) => s.type === 'credential')
+    expect(credential?.type).toBe('credential')
+    if (credential?.type === 'credential') {
+      expect(credential.data.type).toBe('sim_key')
+      expect(credential.data.value).toBeUndefined()
+    }
+  })
+})

apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/special-tags/special-tags.tsx

@@ -74,7 +74,6 @@ export interface CredentialTagData {
   value?: string
   type: CredentialTagType
   provider?: string
-  redacted?: boolean
   /**
    * Env-var key name to save the pasted secret under (secret_input only),
    * e.g. "OPENAI_API_KEY".
@@ -219,7 +218,11 @@ function isCredentialTagData(value: unknown): value is CredentialTagData {
     }
     return typeof value.name === 'string' && value.name.trim().length > 0
   }
-  if (value.redacted === true) return value.value === undefined || typeof value.value === 'string'
+  // A sim_key chip is platform-filled: the model only marks where the workspace
+  // API key belongs (it never holds the value) and Sim injects it from the tool
+  // result, so the tag is valid with or without a `value`. Every other rendered
+  // type (e.g. link) needs a string value to render.
+  if (value.type === 'sim_key') return true
   return typeof value.value === 'string'
 }
 
@@ -893,7 +896,10 @@ function CredentialDisplay({ data }: { data: CredentialTagData }) {
   }
 
   if (data.type === 'sim_key') {
-    return <SecretReveal value={data.value} redacted={data.redacted || !data.value} />
+    // SecretReveal masks itself when there's no value, so a value-less tag (the
+    // model's placeholder / persisted form) renders masked and a Sim-filled tag
+    // reveals the key + copy button — no separate "redacted" flag needed.
+    return <SecretReveal value={data.value} />
   }
 
   return null

apps/sim/app/workspace/[workspaceId]/home/hooks/stream/stream-context.ts

@@ -187,7 +187,8 @@ export function createStreamLoopContext(deps: StreamLoopDeps): StreamLoopContext
     captureRevealedSimKeys(
       deps.revealedSimKeysRef.current,
       [deps.assistantId, state.streamRequestId],
-      modelContent
+      modelContent,
+      modelBlocks
     )
     const activeChatId = deps.options.targetChatId ?? deps.chatIdRef.current
     if (!activeChatId) {

apps/sim/lib/copilot/chat/persisted-message.test.ts

@@ -90,10 +90,10 @@ describe('persisted-message', () => {
     const persisted = buildPersistedAssistantMessage(result)
 
     expect(persisted.content).not.toContain('sk-sim-secret-123')
-    expect(persisted.content).toContain('"redacted":true')
+    expect(persisted.content).toContain('{"type":"sim_key"}')
     const textBlock = persisted.contentBlocks?.find((b) => b.type === 'text')
     expect(textBlock?.content).not.toContain('sk-sim-secret-123')
-    expect(textBlock?.content).toContain('"redacted":true')
+    expect(textBlock?.content).toContain('{"type":"sim_key"}')
   })
 
   it('redacts sim_key credential tags split across streamed text chunks', () => {
@@ -119,7 +119,7 @@ describe('persisted-message', () => {
     expect(persisted.contentBlocks).toBeDefined()
     const joined = (persisted.contentBlocks ?? []).map((b) => b.content ?? '').join('')
     expect(joined).not.toContain('sk-sim-secret-12345')
-    expect(joined).toContain('"redacted":true')
+    expect(joined).toContain('{"type":"sim_key"}')
   })
 
   it('redacts the api key from a persisted generate_api_key tool result output', () => {

apps/sim/lib/copilot/chat/sim-key-redaction.test.ts

@@ -7,12 +7,21 @@ import type { ChatMessage } from '@/app/workspace/[workspaceId]/home/types'
 import {
   captureRevealedSimKeys,
   extractRevealedSimKeys,
+  extractRevealedSimKeysFromBlocks,
   restoreRevealedSimKeysForMessage,
+  toolResultForModel,
 } from './sim-key-redaction'
 
 const credential = (value: string) =>
   `<credential>${JSON.stringify({ value, type: 'sim_key' })}</credential>`
 const redacted = `<credential>${JSON.stringify({ type: 'sim_key', redacted: true })}</credential>`
+// The value-less placeholder the model now emits (no `redacted` flag).
+const placeholder = `<credential>${JSON.stringify({ type: 'sim_key' })}</credential>`
+
+const apiKeyBlock = (key: string) => ({
+  type: 'tool_call' as const,
+  toolCall: { name: 'generate_api_key', result: { success: true, output: { id: 'k1', key } } },
+})
 
 describe('sim-key-redaction', () => {
   describe('extractRevealedSimKeys', () => {
@@ -28,6 +37,55 @@ describe('sim-key-redaction', () => {
     })
   })
 
+  describe('toolResultForModel', () => {
+    it('reduces a successful generate_api_key result to only its status message', () => {
+      const data = {
+        id: 'k1',
+        name: 'prod',
+        key: 'sk-sim-secret',
+        workspaceId: 'ws-1',
+        message: 'API key "prod" created.',
+      }
+      expect(toolResultForModel('generate_api_key', data)).toBe('API key "prod" created.')
+    })
+
+    it('leaves other tools untouched', () => {
+      const data = { key: 'not-a-secret', ok: true }
+      expect(toolResultForModel('read', data)).toBe(data)
+    })
+
+    it('passes generate_api_key errors through (no key to withhold)', () => {
+      const data = { error: 'name is required' }
+      expect(toolResultForModel('generate_api_key', data)).toBe(data)
+      expect(toolResultForModel('generate_api_key', undefined)).toBe(undefined)
+    })
+  })
+
+  describe('extractRevealedSimKeysFromBlocks', () => {
+    it('pulls generate_api_key output keys in block order', () => {
+      expect(
+        extractRevealedSimKeysFromBlocks([apiKeyBlock('sk-sim-A'), apiKeyBlock('sk-sim-B')])
+      ).toEqual(['sk-sim-A', 'sk-sim-B'])
+    })
+
+    it('skips redacted markers and unrelated tools', () => {
+      const blocks = [
+        apiKeyBlock('[REDACTED]'),
+        {
+          type: 'tool_call' as const,
+          toolCall: { name: 'read', result: { success: true, output: { key: 'sk-x' } } },
+        },
+        apiKeyBlock('sk-sim-A'),
+      ]
+      expect(extractRevealedSimKeysFromBlocks(blocks)).toEqual(['sk-sim-A'])
+    })
+
+    it('returns nothing for empty/undefined block lists', () => {
+      expect(extractRevealedSimKeysFromBlocks(undefined)).toEqual([])
+      expect(extractRevealedSimKeysFromBlocks([])).toEqual([])
+    })
+  })
+
   describe('captureRevealedSimKeys', () => {
     it('records new keys under each provided key', () => {
       const cache = new Map<string, string[]>()
@@ -59,6 +117,21 @@ describe('sim-key-redaction', () => {
       captureRevealedSimKeys(cache, ['msg-1'], 'plain assistant text')
       expect(cache.has('msg-1')).toBe(false)
     })
+
+    it('sources the key from the generate_api_key tool result (model text is a redacted placeholder)', () => {
+      const cache = new Map<string, string[]>()
+      captureRevealedSimKeys(cache, ['msg-1', 'req-1'], `Here is your key: ${redacted}`, [
+        apiKeyBlock('sk-sim-fromtool'),
+      ])
+      expect(cache.get('msg-1')).toEqual(['sk-sim-fromtool'])
+      expect(cache.get('req-1')).toEqual(['sk-sim-fromtool'])
+    })
+
+    it('prefers tool-result keys over any inline content values', () => {
+      const cache = new Map<string, string[]>()
+      captureRevealedSimKeys(cache, ['msg-1'], credential('sk-content'), [apiKeyBlock('sk-tool')])
+      expect(cache.get('msg-1')).toEqual(['sk-tool'])
+    })
   })
 
   describe('restoreRevealedSimKeysForMessage', () => {
@@ -76,6 +149,32 @@ describe('sim-key-redaction', () => {
       expect(restored.contentBlocks?.[0].content).toContain('"sk-sim-A"')
     })
 
+    it('fills a value-less {"type":"sim_key"} placeholder (no redacted flag needed)', () => {
+      const cache = new Map<string, string[]>([['msg-1', ['sk-sim-A']]])
+      const msg: ChatMessage = {
+        id: 'msg-1',
+        role: 'assistant',
+        content: `Here is your key: ${placeholder} save it.`,
+        contentBlocks: [{ type: 'text', content: `Here is your key: ${placeholder} save it.` }],
+      }
+      const restored = restoreRevealedSimKeysForMessage(msg, cache)
+      expect(restored.content).toContain('"sk-sim-A"')
+      expect(restored.contentBlocks?.[0].content).toContain('"sk-sim-A"')
+    })
+
+    it('fills value-less and redacted placeholders positionally in one message', () => {
+      const cache = new Map<string, string[]>([['msg-1', ['sk-sim-A', 'sk-sim-B']]])
+      const msg: ChatMessage = {
+        id: 'msg-1',
+        role: 'assistant',
+        content: `first ${placeholder} second ${redacted}`,
+      }
+      const restored = restoreRevealedSimKeysForMessage(msg, cache)
+      expect(restored.content).toBe(
+        `first ${credential('sk-sim-A')} second ${credential('sk-sim-B')}`
+      )
+    })
+
     it('substitutes multiple keys in stream order', () => {
       const cache = new Map<string, string[]>([['msg-1', ['sk-sim-A', 'sk-sim-B']]])
       const msg: ChatMessage = {