improvement(provenance): cleanup secrets boundary - #6374

Too many files changed for review (265 files, 100 file limit).

Bypass the limit by tagging @greptile-apps to review.

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 7, 2026 5:06pm

PR Summary

High Risk
Changes authentication-adjacent secret provenance, model egress projection, and durable storage classification across function execution, providers, Agent, and file/knowledge APIs; incorrect path binding or relaxed legacy paths could leak secrets or over-redact.

Overview
This PR tightens the secrets boundary so provenance and scanning apply only to secrets that were actually compiled or resolved on that call, not every configured environment value. Legacy direct environmentVariables reads and unused env entries no longer infer lineage; placeholder compilation drives output matchers and __resolvedSecretNames.

Durable writes (knowledge, memory, file manage, decompress) now accept incomplete or unavailable authenticated provenance and persist unknown instead of failing the request. Ordinary file mounts without a provenance envelope are treated as user data, not implicit secret scope; binary exports from mounts without secret evidence can be exact-empty.

Model egress shifts to input-path–aware registry APIs (importProvenanceForValueAtInputPath, forkForInputPaths, exportCommittedProvenanceForInputPaths). The Agent handler projects only resolver-recorded paths to provider-facing copies while keeping raw block inputs unchanged; structural fields (tool ids, enums, inline bytes) fail closed. Providers can project legacy unmarked prompts when a private envelope is present; headerless internal calls are preserved where tests expect legacy behavior.

Mothership stops importing MCP discovery provenance into the lifecycle registry and no longer omits MCP tools on schema text matches. Workflow MCP and successful executions without private envelopes are allowed (legacy), with projection only when provenance is present. Workflow sync responses attach provenance from the terminal response body via the logging session, not the full run state.

Fork mapped KB document copy reuses the shared document copier and keeps tracked provenance (exact, exact-empty, unknown) on copy.

^{Reviewed by Cursor Bugbot for commit 043a152. Configure here.}

bugbot run