fix(provenance): stop short secret values from rewriting unrelated long text

[icecrasher321]

Summary

Split out detection vs render for projection to not over project.

Type of Change

• Other: UI Improvement

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[gitguardian]

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
35897102	Triggered	Generic High Entropy Secret	7792c9d	apps/sim/executor/utils/resolved-secret-matcher.test.ts	View secret
35897103	Triggered	Generic Password	7792c9d	apps/sim/executor/utils/resolved-secret-match-policy.test.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 6:07pm

[cursor]

PR Summary

Medium Risk
Changes secret redaction and provenance projection behavior for short literals across logs and Copilot; detection stays conservative while render is intentionally narrower, with broad test coverage.

Overview
Short resolved-secret literals (under 8 characters) no longer get substituted when they appear inside another token (e.g. test inside latest). Detection still treats those hits as matches everywhere; render (logs, Copilot, trace projection) only replaces them on word boundaries (standalone, delimited, or underscore-joined identifiers).

This adds a length-based match policy module and a detect / render mode on createResolvedSecretMatcher. Model egress, trace secret projection, and invariant checks build matchers with mode: 'render' so post-checks align with what was actually rewritten. sanitizeResolvedSecretString can run a few settle passes when a substitution exposes a boundary that was previously suppressed.

^{Reviewed by Cursor Bugbot for commit d5cc241. Configure here.}

[greptile-apps]

Greptile Summary

This PR separates detection from rendering and applies boundary-only projection to resolved secret values shorter than eight characters, preventing coincidental substitutions inside ordinary text.

• Adds a shared short-secret matching policy with Unicode-aware boundary handling.
• Adds render-mode matching and bounded multi-pass substitution to the resolved-secret matcher.
• Applies render mode to model-content, Copilot-result, and trace projection paths.
• Expands tests for boundary matching, replacement settling, provenance labels, and trace behavior.

Confidence Score: 3/5

This PR is not safe to merge until embedded short active secrets are prevented from reaching Copilot and persisted trace outputs.

The new render policy deliberately retains sub-eight-character secrets inside alphanumeric tokens, while model and trace projection paths—including trace invariant enforcement—use that same restricted policy.

Files Needing Attention: apps/sim/lib/logs/execution/trace-secret-projection.ts, apps/sim/executor/utils/resolved-secret-content-projection.ts, apps/sim/executor/utils/resolved-secret-matcher.ts

Security Review

A real short active secret embedded in an alphanumeric token can now pass unchanged into Copilot-visible content or persisted traces because projection and invariant enforcement both use the same boundary-restricted matcher. How this was verified: the changed PIN test preserves 483920 in ref483920x, and the trace post-check applies the identical render policy.

Important Files Changed

Filename	Overview
apps/sim/executor/utils/resolved-secret-match-policy.ts	Introduces the eight-character threshold and Unicode-aware boundary policy that intentionally suppresses embedded short matches.
apps/sim/executor/utils/resolved-secret-matcher.ts	Adds render policies and bounded repeated substitution; behavior is well tested, with a minor import-order violation.
apps/sim/executor/utils/resolved-secret-content-projection.ts	Applies render-mode matching to model and diagnostic projections, exposing the short-secret false-negative path.
apps/sim/lib/logs/execution/trace-secret-projection.ts	Uses the restricted matcher for both trace projection and invariant enforcement, allowing embedded short plaintext to survive into log sinks.
apps/sim/lib/copilot/request/tools/resolved-secret-result.test.ts	Explicitly demonstrates that a registered six-digit PIN remains visible when embedded in an alphanumeric token.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Active resolved-secret matches] --> B{Matcher mode}
  B -->|detect| C[Match at any offset]
  B -->|render| D{Secret length at least 8?}
  D -->|yes| C
  D -->|no| E{Word-boundary match?}
  E -->|yes| F[Replace with provenance label]
  E -->|no| G[Leave plaintext unchanged]
  F --> H[Copilot or trace output]
  G --> H
  H --> I[Render-mode invariant check]
  I -->|Same embedded match suppressed| H

Loading

_{Reviews (1): Last reviewed commit: "Merge commit '3b0651ed9c' into staging-v..." | Re-trigger Greptile}