feat(secrets): non-secret workspace variables

apps/sim/app/api/knowledge/search/route.ts

@@ -39,7 +39,10 @@ import {
 } from '@/app/api/knowledge/search/utils'
 import { createKnowledgeRegistryResponse } from '@/app/api/knowledge/secret-provenance'
 import { checkKnowledgeBaseAccess, type KnowledgeBaseAccessResult } from '@/app/api/knowledge/utils'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 import { getRerankModelPricing } from '@/providers/models'
 import { calculateCost } from '@/providers/utils'
 
@@ -372,10 +375,14 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const resultSecretRegistry =
       modelInputProvenance.registry ??
-      new ResolvedSecretTraceRegistry([], {
-        userId,
-        ...(workspaceId ? { workspaceId } : {}),
-      })
+      new ResolvedSecretTraceRegistry(
+        [],
+        {
+          userId,
+          ...(workspaceId ? { workspaceId } : {}),
+        },
+        EMPTY_NON_SECRET_NAMES
+      )
     const resultProvenanceSnapshot = await importKnowledgeSearchResultSecretProvenance({
       registry: resultSecretRegistry,
       results,

apps/sim/app/api/knowledge/search/utils.test.ts

@@ -16,7 +16,10 @@ import { afterAll, afterEach, beforeEach, describe, expect, it, vi } from 'vites
 import { env } from '@/lib/core/config/env'
 import * as documentsUtilsModule from '@/lib/knowledge/documents/utils'
 import { runWithKnowledgeModelInputProvenance } from '@/lib/knowledge/model-input-provenance'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 
 /**
  * Spy on the real documents/utils namespace instead of vi.mock: the shared
@@ -804,9 +807,11 @@ describe('Knowledge Search Utils', () => {
         },
       })
 
-      const registry = new ResolvedSecretTraceRegistry([
-        { name: 'TOKEN', plaintext: 'secret-value', encryptedValue: 'encrypted-token' },
-      ])
+      const registry = new ResolvedSecretTraceRegistry(
+        [{ name: 'TOKEN', plaintext: 'secret-value', encryptedValue: 'encrypted-token' }],
+        undefined,
+        EMPTY_NON_SECRET_NAMES
+      )
       registry.recordResolved('TOKEN', 'secret-value')
 
       await runWithKnowledgeModelInputProvenance(registry, () =>

apps/sim/app/api/knowledge/secret-provenance.ts

@@ -27,7 +27,10 @@ import {
   knowledgeDocumentTagValueSelectionKey,
   parseKnowledgeDocumentTagProvenanceTargets,
 } from '@/lib/knowledge/secret-provenance-selection'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 
 function invalidKnowledgeProvenanceResponse(): NextResponse {
   return NextResponse.json({ error: 'Invalid knowledge secret provenance' }, { status: 400 })
@@ -151,10 +154,14 @@ export async function createKnowledgeProvenanceResponse(options: {
   )
   if (negotiation.status === 'not-requested') return NextResponse.json(options.body)
   if (negotiation.status === 'rejected') return invalidKnowledgeProvenanceResponse()
-  const registry = new ResolvedSecretTraceRegistry([], {
-    userId: options.userId,
-    ...(options.workspaceId ? { workspaceId: options.workspaceId } : {}),
-  })
+  const registry = new ResolvedSecretTraceRegistry(
+    [],
+    {
+      userId: options.userId,
+      ...(options.workspaceId ? { workspaceId: options.workspaceId } : {}),
+    },
+    EMPTY_NON_SECRET_NAMES
+  )
   for (const provenance of options.provenances) {
     if (provenance.status === 'unknown') {
       registry.markIncomplete()
@@ -225,10 +232,14 @@ export async function createKnowledgePersistedResponse(options: {
   if (negotiation.status === 'not-requested') return NextResponse.json(options.body)
   if (negotiation.status === 'rejected') return invalidKnowledgeProvenanceResponse()
 
-  const registry = new ResolvedSecretTraceRegistry([], {
-    userId: options.userId,
-    ...(options.workspaceId ? { workspaceId: options.workspaceId } : {}),
-  })
+  const registry = new ResolvedSecretTraceRegistry(
+    [],
+    {
+      userId: options.userId,
+      ...(options.workspaceId ? { workspaceId: options.workspaceId } : {}),
+    },
+    EMPTY_NON_SECRET_NAMES
+  )
   await importKnowledgePersistedResponseSecretProvenance({
     registry,
     documents: options.documents,

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -72,7 +72,10 @@ import {
 import { getMeaningfulWorkflowDescription } from '@/lib/mcp/workflow-tool-schema'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 import { projectResolvedSecretModelContent } from '@/executor/utils/resolved-secret-content-projection'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('WorkflowMcpServeAPI')
 const MAX_MCP_SERVE_BODY_BYTES = 10 * 1024 * 1024
@@ -286,7 +289,7 @@ async function projectWorkflowMcpModelContent(
   privateProvenance: unknown,
   scope: { userId: string; workspaceId: string }
 ): Promise<unknown> {
-  const registry = new ResolvedSecretTraceRegistry([], scope)
+  const registry = new ResolvedSecretTraceRegistry([], scope, EMPTY_NON_SECRET_NAMES)
   const imported = await registry.importCrossingProvenance(privateProvenance, value, {
     trusted: true,
   })

apps/sim/app/api/memory/secret-provenance.ts

@@ -20,7 +20,10 @@ import {
   serializePrivateToolMetadataResponseEnvelope,
 } from '@/lib/execution/private-tool-metadata'
 import { readBoundMemorySecretProvenance } from '@/lib/memory/secret-provenance'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 
 const MAX_PRIVATE_MEMORY_CROSSINGS = 10_000
 const PRIVATE_MEMORY_QUERY_CHUNK_SIZE = 8
@@ -91,10 +94,14 @@ export async function createMemoryResponse(options: {
   if (negotiation.status === 'not-requested') return NextResponse.json(options.body)
   if (negotiation.status === 'rejected') return invalidMemoryProvenanceResponse()
 
-  const registry = new ResolvedSecretTraceRegistry([], {
-    userId: options.userId,
-    workspaceId: options.workspaceId,
-  })
+  const registry = new ResolvedSecretTraceRegistry(
+    [],
+    {
+      userId: options.userId,
+      workspaceId: options.workspaceId,
+    },
+    EMPTY_NON_SECRET_NAMES
+  )
   if (options.memories.length > MAX_PRIVATE_MEMORY_CROSSINGS) {
     registry.markIncomplete()
   } else {

apps/sim/app/api/workflows/[id]/log/route.ts

@@ -18,7 +18,10 @@ import { validateWorkflowAccess } from '@/app/api/workflows/middleware'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 import type { SerializableExecutionState } from '@/executor/execution/types'
 import type { ExecutionResult } from '@/executor/types'
-import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import {
+  EMPTY_NON_SECRET_NAMES,
+  ResolvedSecretTraceRegistry,
+} from '@/executor/utils/resolved-secret-trace-registry'
 
 const logger = createLogger('WorkflowLogAPI')
 
@@ -122,10 +125,14 @@ export const POST = withRouteHandler(
         const isChatExecution = result.metadata?.source === 'chat'
         const triggerType = isChatExecution ? 'chat' : 'manual'
         const loggingSession = new LoggingSession(id, executionId, triggerType, requestId)
-        const resolvedSecretTraceRegistry = new ResolvedSecretTraceRegistry([], {
-          userId: actorUserId,
-          workspaceId: existingLog.workspaceId,
-        })
+        const resolvedSecretTraceRegistry = new ResolvedSecretTraceRegistry(
+          [],
+          {
+            userId: actorUserId,
+            workspaceId: existingLog.workspaceId,
+          },
+          EMPTY_NON_SECRET_NAMES
+        )
         const trustedExecutionData = await materializeExecutionData(
           existingLog.executionData as Record<string, unknown>,
           {