Merge remote-tracking branch 'origin/staging' into feat/openrouter-kb-fallback

# Conflicts:
#	apps/sim/tools/generated/tool-ids.ts
#	apps/sim/tools/generated/tool-metadata.ts
#	apps/sim/tools/generated/tool-outputs.ts

Author: TheodoreSpeaks

apps/docs/components/icons.tsx

@@ -6048,6 +6048,37 @@ export function RDSIcon(props: SVGProps<SVGSVGElement>) {
   )
 }
 
+export function DynatraceIcon(props: SVGProps<SVGSVGElement>) {
+  return (
+    <svg {...props} viewBox='0 0 89 90' xmlns='http://www.w3.org/2000/svg'>
+      <path
+        fill='#1496FF'
+        d='M29.9672771,7.52412666 C28.8124385,13.6191079 27.4009692,22.6653432 26.6310768,31.8398939 C25.2837652,48.0076335 26.1178152,58.8502844 26.1178152,58.8502844 L3.34183275,80.4714283 C3.34183275,80.4714283 1.60957493,68.3456235 0.711367168,54.680034 C0.198105592,46.211218 0.00563250016,38.7689252 0.00563250016,34.2778864 C0.00563250016,34.0212556 0.133947894,33.7646248 0.133947894,33.507994 C0.133947894,33.1872055 0.518894077,30.1717937 3.47014814,27.3488551 C6.678033,24.2692856 30.3522232,5.72771114 29.9672771,7.52412666 Z'
+      />
+      <path
+        fill='#1284EA'
+        d='M29.9672771,7.52412666 C28.8124385,13.6191079 27.4009692,22.6653432 26.6310768,31.8398939 C26.6310768,31.8398939 1.41710184,28.8244821 0.00563250016,34.9194633 C0.00563250016,34.5986748 0.45473638,30.8775284 3.40599045,28.0545897 C6.6138753,24.9750203 30.3522232,5.72771114 29.9672771,7.52412666 L29.9672771,7.52412666 Z'
+      />
+      <path
+        fill='#B4DC00'
+        d='M0.00563250016,33.4438363 L0.00563250016,34.8553056 C0.262263289,33.7646248 0.711367168,32.9947324 1.60957493,31.7757362 C3.47014814,29.4019014 6.48555991,28.7603244 7.70455615,28.632009 C13.8636951,27.797959 22.9740881,26.8355935 32.1486388,26.5789627 C48.3805361,26.0657011 59.0948715,27.4130128 59.0948715,27.4130128 L81.870854,5.79186884 C81.870854,5.79186884 69.9375224,3.54634944 56.3360906,1.94240701 C47.4181707,0.851726163 39.5909316,0.274306889 35.1640505,0.0176761002 C34.843262,0.0176761002 31.6995349,-0.367270083 28.7482808,2.45566859 C25.540396,5.53523805 9.24434089,20.9972431 2.70025578,27.2205397 C-0.250998288,30.0434784 0.00563250016,33.1872055 0.00563250016,33.4438363 Z'
+      />
+      <path
+        fill='#6F2DA8'
+        d='M81.036804,61.0958038 C74.877665,61.9298538 65.767272,62.956377 56.5927214,63.2771655 C40.360824,63.790427 29.5823309,62.4431154 29.5823309,62.4431154 L6.8063484,84.128417 C6.8063484,84.128417 18.8679955,86.5022518 32.4694272,88.0420366 C40.8099279,89.004402 48.188063,89.5176636 52.6791018,89.7742944 C52.9998903,89.7742944 53.5131519,89.5176636 53.8339404,89.5176636 C54.1547289,89.5176636 57.298456,88.9402443 60.2497101,86.1173056 C63.457595,83.0377362 82.8332195,60.9033307 81.036804,61.0958038 L81.036804,61.0958038 Z'
+      />
+      <path
+        fill='#591F91'
+        d='M81.036804,61.0958038 C74.877665,61.9298538 65.767272,62.956377 56.5927214,63.2771655 C56.5927214,63.2771655 58.3249792,88.6194558 52.229998,89.7101367 C52.5507864,89.7101367 56.7210368,89.5176636 59.6722908,86.6947249 C62.8801757,83.6151554 82.8332195,60.9033307 81.036804,61.0958038 L81.036804,61.0958038 Z'
+      />
+      <path
+        fill='#73BE28'
+        d='M53.5773096,89.8384521 C53.1282057,89.8384521 52.6791018,89.7742944 52.1658403,89.7742944 C53.3206788,89.5818213 54.0905712,89.1968751 55.3095674,88.2986673 C57.7475599,86.5664095 58.5174523,83.5509978 58.7740831,82.3320015 C59.8647639,76.2370203 61.3403909,67.190785 62.0461256,58.0162343 C63.3292796,41.8484946 62.5593872,31.0700015 62.5593872,31.0700015 L85.3353697,9.38469988 C85.3353697,9.38469988 87.0034698,21.4463469 87.9658353,35.1119364 C88.5432545,44.0298563 88.7357276,51.9212531 88.7998853,56.2839765 C88.7998853,56.604765 89.0565161,59.7484921 86.105262,62.5714308 C82.8973772,65.6510003 66.6013221,81.177163 60.1213947,87.4004596 C57.0418252,90.2233983 53.8980981,89.8384521 53.5773096,89.8384521 L53.5773096,89.8384521 Z'
+      />
+    </svg>
+  )
+}
+
 export function DynamoDBIcon(props: SVGProps<SVGSVGElement>) {
   return (
     <svg

apps/docs/components/ui/icon-mapping.ts

@@ -63,6 +63,7 @@ import {
   DubIcon,
   DuckDuckGoIcon,
   DynamoDBIcon,
+  DynatraceIcon,
   ElasticsearchIcon,
   ElevenLabsIcon,
   EmailBisonIcon,
@@ -316,6 +317,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
   dub: DubIcon,
   duckduckgo: DuckDuckGoIcon,
   dynamodb: DynamoDBIcon,
+  dynatrace: DynatraceIcon,
   elasticsearch: ElasticsearchIcon,
   elevenlabs: ElevenLabsIcon,
   emailbison: EmailBisonIcon,

apps/docs/content/docs/en/integrations/dynatrace.mdx

@@ -64,6 +64,7 @@
     "dub",
     "duckduckgo",
     "dynamodb",
+    "dynatrace",
     "elasticsearch",
     "elevenlabs",
     "emailbison",

apps/docs/content/docs/en/integrations/meta.json

@@ -590,7 +590,7 @@ describe('Function Execute API Route', () => {
         createMockRequest(
           'POST',
           {
-            code: 'return environmentVariables.API_KEY',
+            code: 'return {{API_KEY}}',
             envVars: { API_KEY: 'secret-at-the-end' },
             workflowId: 'workflow-1',
             workspaceId: 'workspace-1',
@@ -686,7 +686,7 @@ describe('Function Execute API Route', () => {
         createMockRequest(
           'POST',
           {
-            code: 'print("done")',
+            code: 'print("{{API_KEY}}")',
             language: 'python',
             workspaceId: 'workspace-1',
             envVars: { API_KEY: 'secret-value' },
@@ -821,6 +821,54 @@ describe('Function Execute API Route', () => {
       expect(mockExecuteInSandbox).not.toHaveBeenCalled()
     })
 
+    it('runs with authenticated incomplete mount provenance and marks exported bytes unknown', async () => {
+      envFlagsMock.isRemoteSandboxEnabled = true
+      mockExecuteInSandbox.mockResolvedValueOnce({
+        result: 'raw result',
+        stdout: '',
+        sandboxId: 'sandbox-123',
+        exportedFiles: { '/home/user/output.txt': 'raw output' },
+      })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'print("done")',
+            language: 'python',
+            workspaceId: 'workspace-1',
+            outputs: {
+              files: [
+                {
+                  path: 'files/output.txt',
+                  sandboxPath: '/home/user/output.txt',
+                  mimeType: 'text/plain',
+                },
+              ],
+            },
+            [PRIVATE_SECRET_PROVENANCE_FIELD]: {
+              version: 1,
+              complete: false,
+              selections: [],
+            },
+          },
+          { [PRIVATE_SECRET_PROVENANCE_HEADER]: PRIVATE_SECRET_PROVENANCE_BUNDLE_V1 }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      expect((await response.json()).output.result).toEqual(
+        expect.objectContaining({ fileId: 'wf_output_txt', vfsPath: 'files/output.txt' })
+      )
+      expect(mockExecuteInSandbox).toHaveBeenCalledOnce()
+      expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
+        expect.objectContaining({
+          buffer: Buffer.from('raw output'),
+          secretProvenance: { status: 'unknown' },
+        })
+      )
+    })
+
     it('does not rewrite a static export path that happens to equal a resolved secret', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({
@@ -853,6 +901,7 @@ describe('Function Execute API Route', () => {
       expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
         expect.objectContaining({
           target: expect.objectContaining({ path: 'files/report-secret-value.txt' }),
+          secretProvenance: { status: 'exact', entries: [] },
         })
       )
       expect(JSON.stringify(data)).toContain('files/report-secret-value.txt')
@@ -890,7 +939,7 @@ describe('Function Execute API Route', () => {
       )
     })
 
-    it('keeps a binary export unknown when files were mounted without a provenance envelope', async () => {
+    it('classifies a binary export exact-empty when ordinary files were mounted without secret provenance', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteInSandbox.mockResolvedValueOnce({
         result: 'done',
@@ -919,7 +968,7 @@ describe('Function Execute API Route', () => {
 
       expect(response.status).toBe(200)
       expect(mockWriteWorkspaceFileByPath).toHaveBeenCalledWith(
-        expect.objectContaining({ secretProvenance: { status: 'unknown' } })
+        expect.objectContaining({ secretProvenance: { status: 'exact', entries: [] } })
       )
     })
 
@@ -987,7 +1036,7 @@ describe('Function Execute API Route', () => {
 
       const response = await POST(
         createMockRequest('POST', {
-          code: 'print("done")',
+          code: 'print("{{API_KEY}}")',
           language: 'python',
           workspaceId: 'workspace-1',
           envVars: { API_KEY: 'secret-value' },
@@ -2002,6 +2051,117 @@ describe('Function Execute API Route', () => {
       expect(Object.values(request.contextVariables)).not.toContain('must-not-bind')
     })
 
+    it('does not infer provenance from an unused low-entropy environment value', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'Box eSign', stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return "Box eSign"',
+            envVars: { SERVICENOW_PASSWORD: 'x' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(200)
+      expect(data.output.result).toBe('Box eSign')
+      expect(data.__resolvedSecretNames).toEqual([])
+    })
+
+    it('does not build provenance matchers for unused oversized environment values', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'safe', stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return "safe"',
+            envVars: { UNUSED: 'x'.repeat(65 * 1024) },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      expect((await response.json()).__resolvedSecretNames).toEqual([])
+    })
+
+    it('conservatively reports only compiled secrets when bounded output classification is exceeded', async () => {
+      const result = Array.from({ length: 100_001 }, () => 'ordinary')
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result, stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'const key = {{API_KEY}}; return params.items',
+            params: { items: result },
+            envVars: { API_KEY: 'secret-value', UNUSED: 'x' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(200)
+      expect(response.headers.get('x-sim-private-tool-metadata')).toBe('resolved-secret-names-v1')
+      expect(data.output.result).toHaveLength(100_001)
+      expect(data.output.result[0]).toBe('ordinary')
+      expect(data.__resolvedSecretNames).toEqual(['API_KEY'])
+    })
+
+    it('conservatively reports a compiled secret whose value exceeds matcher capacity', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'ordinary', stdout: '' })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'const key = {{OVERSIZED_SECRET}}; return "ordinary"',
+            envVars: { OVERSIZED_SECRET: 's'.repeat(64 * 1024 + 1), UNUSED: 'x' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+      const data = await response.json()
+
+      expect(response.status).toBe(200)
+      expect(data.output.result).toBe('ordinary')
+      expect(data.__resolvedSecretNames).toEqual(['OVERSIZED_SECRET'])
+    })
+
+    it('tracks only compiled names when configured secrets share the same value', async () => {
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'true', stdout: '' })
+      const oneResponse = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'return {{SECOND}}',
+            envVars: { FIRST: 'true', SECOND: 'true' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      mockExecuteInIsolatedVM.mockResolvedValueOnce({ result: 'true', stdout: '' })
+      const bothResponse = await POST(
+        createMockRequest(
+          'POST',
+          {
+            code: 'const first = {{FIRST}}; return {{SECOND}}',
+            envVars: { FIRST: 'true', SECOND: 'true' },
+          },
+          { 'x-sim-request-private-tool-metadata': 'resolved-secret-names-v1' }
+        )
+      )
+
+      expect((await oneResponse.json()).__resolvedSecretNames).toEqual(['SECOND'])
+      expect((await bothResponse.json()).__resolvedSecretNames).toEqual(['FIRST', 'SECOND'])
+    })
+
     it('lowers missing shell placeholders while preserving comments and heredoc delimiters', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       const response = await POST(
@@ -2134,7 +2294,7 @@ describe('Function Execute API Route', () => {
       expect(mockExecuteInSandbox).not.toHaveBeenCalled()
     })
 
-    it('reports exact secret values returned through placeholders and the environment map', async () => {
+    it('reports exact secret values returned through placeholders without inferring direct environment reads', async () => {
       mockExecuteInIsolatedVM.mockResolvedValueOnce({
         result: 'secret-valueother-secret',
         stdout: '',
@@ -2171,14 +2331,15 @@ describe('Function Execute API Route', () => {
       const directData = await directResponse.json()
 
       expect(envData.__resolvedSecretNames).toEqual(['ENV_ONLY', 'SHARED'])
-      expect(directData.__resolvedSecretNames).toEqual(['API_KEY'])
+      expect(directData.output.result).toBe('secret-value')
+      expect(directData.__resolvedSecretNames).toEqual([])
     })
 
     it.each([
       { name: 'numeric', secret: '123', result: 123 },
       { name: 'boolean', secret: 'true', result: true },
     ])(
-      'records provenance for a typed $name secret returned through direct environment access',
+      'preserves a typed $name value returned through legacy direct environment access without inferred provenance',
       async ({ secret, result }) => {
         mockExecuteInIsolatedVM.mockResolvedValueOnce({ result, stdout: '' })
 
@@ -2197,11 +2358,11 @@ describe('Function Execute API Route', () => {
         const data = await response.json()
 
         expect(data.output.result).toBe(result)
-        expect(data.__resolvedSecretNames).toEqual(['API_KEY'])
+        expect(data.__resolvedSecretNames).toEqual([])
       }
     )
 
-    it('reports shell substitutions and exact secret output from direct environment access', async () => {
+    it('reports placeholder output without inferring provenance from legacy shell environment access', async () => {
       envFlagsMock.isRemoteSandboxEnabled = true
       mockExecuteShellInSandbox.mockResolvedValueOnce({
         result: null,
@@ -2245,7 +2406,8 @@ describe('Function Execute API Route', () => {
       const directData = await directResponse.json()
 
       expect(referencedData.__resolvedSecretNames).toEqual(['API_KEY'])
-      expect(directData.__resolvedSecretNames).toEqual(['API_KEY'])
+      expect(directData.output.stdout).toBe('secret-value')
+      expect(directData.__resolvedSecretNames).toEqual([])
     })
 
     it('returns nonzero shell stderr as a visible 422 error and diagnostic output', async () => {
@@ -2289,8 +2451,8 @@ describe('Function Execute API Route', () => {
       )
 
       expect(response.status).toBe(200)
-      expect((await response.json()).__resolvedSecretNames).toBeUndefined()
-      expect(response.headers.get('x-sim-private-tool-metadata')).toBeNull()
+      expect((await response.json()).__resolvedSecretNames).toEqual([])
+      expect(response.headers.get('x-sim-private-tool-metadata')).toBe('resolved-secret-names-v1')
       expect(mockExecuteInIsolatedVM).toHaveBeenCalled()
     })