fix(sandbox): mask the session's CLI capability in returned sandbox output by waleedlatif1 · Pull Request #8498 · simstudioai/sim

waleedlatif1 · 2026-10-01T01:24:44Z

Summary

Addresses the release review finding on apps/sim/lib/execution/remote-sandbox/index.ts (the provenance check ignores the session's environment): code running in a Chat sandbox session could print SIM_API_KEY and the token-bearing SIM_ENDPOINT, and the values came back unmasked to the model and the transcript.

Root cause

buildMothershipSandboxSession exported the per-call CLI capability (SIM_API_KEY and the scoped SIM_ENDPOINT) through session.envs, which executeInSandbox / executeShellInSandbox spread into the process environment. Nothing in the output path knew those values were sensitive, so env, echo $SIM_API_KEY, a traceback, or a returned result carried them verbatim. This is pre-existing (it predates the previous release), not a regression from the release diff.

Fix

SandboxSessionRequest gains secretEnvs: variables present on every execution whose values are masked in its output.
The Chat session builder puts SIM_API_KEY and SIM_ENDPOINT in secretEnvs; SIM_WORKSPACE / SIM_ORGANIZATION_ID stay in envs.
Both sandbox entry points mask those values (plus their URI/form-encoded forms, via the existing redactKnownSensitiveValues) in stdout, stderr, the __SIM_RESULT__ payload and error text, before anything is parsed or returned.
Exported files are masked too: declared text exports like stdout, and binary declared files plus everything harvested from SIM_OUTPUT_DIR over their raw bytes (latin1 round trip, so every other byte survives unchanged; byteLength is recomputed). Non-session executions skip this entirely.

Behaviour changes

Sandbox output that contains the session capability now shows [REDACTED] in its place. Programs still receive the real values in their environment, so the CLI works unchanged.
Secret provenance recording is unchanged: the capability is not a user secret, so it does not taint the machine.

Severity context

The capability is short-lived: a fresh key per tool call, only its hash stored, accepted only while the tool call's Redis scope and the run's ownership lease are both live, and revoked in the scope's finally before the result reaches the model. This change is defense in depth so a printed copy never lands in the transcript or logs at all.

Not changed

Moving the key out of the process environment into a SIM_API_KEY_FILE was considered and left out: it changes the CLI contract, and masking already covers what is returned.

Test plan

New session-sandbox.test.ts case, for code and shell, completing and failing: the program receives the real values, and the returned result contains neither the key, the endpoint, nor its URI-encoded form, while non-secret session envs stay visible
New file-export case, for code and shell: a declared text file, a declared binary file and a harvested file carrying the key and the URI-encoded endpoint come back masked, with non-UTF-8 bytes intact
Confirmed each masking branch goes red when reverted on its own, and green with it
sandbox-session.test.ts updated for the envs / secretEnvs split
vitest run lib/execution lib/mothership/tools and lib/function-execution
bun run lint, bun run type-check, bun run check:audits

…utput The Mothership session sandbox exports SIM_API_KEY and the token-bearing SIM_ENDPOINT to every execution, but nothing masked their values, so code that printed its environment returned them to the model and transcript. The session request now carries them as secretEnvs, and the sandbox masks their values in stdout, stderr, the result payload, and error text before any of it is parsed or returned. Provenance recording is unchanged.

vercel · 2026-10-01T01:24:47Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 1, 2026 1:39am UTC

waleedlatif1 · 2026-10-01T01:24:49Z

@greptile

waleedlatif1 · 2026-10-01T01:24:50Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T01:24:56Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 5 files

_{Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic}

cubic-dev-ai

All reported issues were addressed across 5 files

_{Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.

Re-trigger cubic}

greptile-apps · 2026-10-01T01:29:43Z

Confidence Score: 5/5

[Medium risk] Separates sensitive environment variables from regular ones in sandbox execution.

The PR appears safe to merge, with a non-blocking masking gap for non-ASCII configured endpoints in binary exports.

Findings

Non-ASCII endpoints escape masking ▶

Summary

The PR separates the Chat sandbox CLI capability from ordinary session environment variables and masks it in process output and exported files.

Code and shell executions continue to receive the real capability.
A configured non-ASCII endpoint can remain visible in a binary or harvested export.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Session capability] --> B[Sandbox process environment]
  B --> C[Process output]
  B --> D[Exported files]
  C --> E[String mask]
  D --> F[Binary byte mask]
  E --> G[Returned result]
  F --> G

_{Reviews (3) · Last reviewed commit: "fix(sandbox): mask the session's capabil..."}

… files Code could write SIM_API_KEY or SIM_ENDPOINT to a declared output file or into SIM_OUTPUT_DIR, and those bytes were returned unmasked. Text exports are now masked like stdout; binary and harvested files are masked over their raw bytes through a latin1 round trip, so every other byte survives unchanged and the reported byteLength matches the masked content.

waleedlatif1 · 2026-10-01T01:39:23Z

@greptile

waleedlatif1 · 2026-10-01T01:39:24Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T01:39:30Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

waleedlatif1 · 2026-10-01T01:42:44Z

Closing in favour of #8503, which fixes the same finding by feeding the session's callback credentials into the existing model-output redaction registry.

waleedlatif1 · 2026-10-01T01:51:17Z

@greptile

waleedlatif1 · 2026-10-01T01:51:18Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-01T01:51:25Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 5 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

greptile-apps · 2026-10-01T01:59:24Z

+ * unit and back, so every byte outside a masked value, including non-UTF-8 binary, survives as-is.
+ */
+function maskFileBytes(contentBase64: string, mask: (output: string) => string): string {
+  const bytes = Buffer.from(contentBase64, 'base64').toString('latin1')


Non-ASCII endpoints escape masking

If the configured sandbox CLI endpoint contains a non-ASCII character and a program writes its UTF-8 bytes to a binary or harvested file, this code reads those bytes as Latin-1 before masking. The endpoint string no longer matches, so the returned file can retain the token-bearing URL. This leaves a copy in the exported output despite the session mask.

How this was verified: Binary file bytes are compared as Latin-1 text against the configured endpoint string, which is not Unicode-normalized.

Knowledge Base Used: Agent execution and sandbox tasks

vercel Bot temporarily deployed to Preview October 1, 2026 01:24 Inactive

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/remote-sandbox/index.ts

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/remote-sandbox/index.ts

waleedlatif1 mentioned this pull request Oct 1, 2026

v0.9.8: search cleanup recovery, new search providers, billing and chat reliability #8494

Merged

vercel Bot temporarily deployed to Preview October 1, 2026 01:39 Inactive

waleedlatif1 marked this pull request as draft October 1, 2026 01:41

greptile-apps Bot reviewed Oct 1, 2026

View reviewed changes

Comment thread apps/sim/lib/execution/remote-sandbox/index.ts

waleedlatif1 closed this Oct 1, 2026

cubic-dev-ai Bot reviewed Oct 1, 2026

View reviewed changes

greptile-apps Bot reviewed Oct 1, 2026

View reviewed changes

Conversation

waleedlatif1 commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause

Fix

Behaviour changes

Severity context

Not changed

Test plan

Uh oh!

vercel Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

waleedlatif1 commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 1, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Oct 1, 2026

Choose a reason for hiding this comment

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Oct 1, 2026 •

edited

Loading

vercel Bot commented Oct 1, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Oct 1, 2026 •

edited

Loading