fix(chat): expression resolution hardening - #3149
Conversation
|
✅ No security or compliance issues detected. Reviewed everything up to a210b9d. Security Overview
Detected Code Changes
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d08d48738b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7410497d0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5a0bd8ab9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
5a0bd8a to
530632a
Compare
|
@codex re-review |
This comment has been minimized.
This comment has been minimized.
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
f741049 to
fa8a797
Compare
fa8a797 to
e93f222
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e93f22285e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a3d4cf7d30
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Found 3 test failures on Blacksmith runners: Failures
|
![Fix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/fix-with-codesmith-light.png)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 27d0dc1508
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a210b9db65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ActionParameter("core.table.insert_rows", "rows_data"): _REDACT_SECRETS, | ||
| ActionParameter("core.table.update_row", "row_data"): _REDACT_SECRETS, | ||
| ActionParameter("core.cases.insert_row", "row"): _REDACT_SECRETS, | ||
| ActionParameter("ai.agent.create_preset", "instructions"): _REDACT_SECRETS, |
There was a problem hiding this comment.
When a workspace-chat agent calls ai.agent.create_preset or ai.agent.update_preset with base_url: ${{ SECRETS.api.KEY }}, the unlisted parameter defaults to RESOLVE; AgentPresetBase only imposes a length limit, so the plaintext is persisted. A later default ai.agent.get_preset call returns the full configuration without loading that secret into its mask set, exposing it to the model. Add base_url to the redaction policy for both preset mutations.
Useful? React with 👍 / 👎.
1 participant
Scope of guarantee
This PR enforces per-parameter expression policies at the argument-resolution boundary: direct
SECRETSexpressions and template-input-propagated secret dependencies (including compound expressions and nested templates) are masked at protected durable sinks (case content/fields/comments, table rows, preset instructions), and workflow-authoring source (patch_ops,definition_yaml) is preserved unevaluated.It does not track transitive dataflow: a secret that passes through an intermediate step result (
steps.*),ACTIONS, orVARSreaches sinks unmasked. This boundary is deliberate — whole-step-result taint was tried and reverted because it masked entire enrichment responses (any step using a secret credential tainted its full output) — and is pinned bytest_template_step_result_is_not_tainted_by_its_arguments. Policies apply only where authored source crosses into a sink parameter; materialized runtime values carry no policy metadata.Full decision ledger: amendment comment on ENG-1572.
Summary by cubic
Hardened expression evaluation for chat, template actions, and durable metadata to prevent secret exfiltration. Masks secrets at sinks, preserves authored workflow source, and keeps step results inert across template boundaries.
inputs.*are tree-masked and compound templates are redacted before evaluation.prepare_resolved_contextpartitions args by policy before expression collection and usesprepare_action_argsso preserved subtrees are excluded and durable fields are redacted ahead of any secret fetch.source_provenancethrough nested templates and unified step arg handling viaTemplateExecutionState; UDF steps withRESOLVEskip source substitution, and step results remain inert runtime data.ai.agent.*(instructions,name,description,new_slug) andcore.table.*(columns/default,column,update).Written for commit a210b9d. Summary will update on new commits.