fix(plan): preserve secret metadata during benchmark reads

Author: icecrasher321

apps/sim/lib/mothership/agent-cli/read-only.test.ts

@@ -1,4 +1,6 @@
+import { createEmbeddedClient } from 'sim/embed'
 import { describe, expect, it } from 'vitest'
+import { runEngine } from '@/lib/mothership/agent-cli/engines'
 import { isReadOnlyCliRequest, readOnlyCliTransport } from '@/lib/mothership/agent-cli/read-only'
 
 describe('benchmark reference workspace inspection', () => {
@@ -49,7 +51,7 @@ describe('benchmark reference workspace inspection', () => {
     }
   )
 
-  it.each(['/api/v2/secrets', '/api/v2/secrets?cursor=next', '/api/v2/secrets/name'])(
+  it.each(['/api/v2/secrets/name'])(
     'refuses credential values from %s before contacting the source',
     async (path) => {
       let dispatched = false
@@ -62,6 +64,67 @@ describe('benchmark reference workspace inspection', () => {
     }
   )
 
+  it('preserves secret metadata and pagination without returning even visible values', async () => {
+    const metadata = {
+      name: 'EXAMPLE_REFERENCE',
+      scope: 'workspace',
+      description: null,
+      unredacted: true,
+      role: 'admin',
+      createdAt: '2026-01-01T00:00:00.000Z',
+      updatedAt: '2026-01-01T00:00:00.000Z',
+    }
+    const transport = readOnlyCliTransport(async () =>
+      Response.json({
+        data: [{ ...metadata, value: 'private-fixture-value' }],
+        nextCursor: 'next-page',
+      })
+    )
+    const response = await transport('https://sim.test/api/v2/secrets?cursor=first-page')
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ data: [metadata], nextCursor: 'next-page' })
+  })
+
+  it('lets the real grep engine search paginated secret names through benchmark transport', async () => {
+    const transport = readOnlyCliTransport(async (input) => {
+      const last = new URL(new Request(input).url).searchParams.get('cursor') === 'next-page'
+      return Response.json({
+        data: [
+          {
+            name: last ? 'EXAMPLE_SECOND' : 'EXAMPLE_FIRST',
+            scope: 'workspace',
+            description: null,
+            unredacted: true,
+            role: 'admin',
+            value: 'private-fixture-value',
+            createdAt: '2026-01-01T00:00:00.000Z',
+            updatedAt: '2026-01-01T00:00:00.000Z',
+          },
+        ],
+        nextCursor: last ? null : 'next-page',
+      })
+    })
+    const result = await runEngine(
+      'grep',
+      ['EXAMPLE_'],
+      {
+        userId: 'user-1',
+        workspaceId: 'workspace',
+        client: createEmbeddedClient({
+          endpoint: 'https://sim.test',
+          apiKey: 'fixture',
+          workspaceId: 'workspace',
+          transport,
+        }),
+      },
+      { scope: 'secrets' }
+    )
+    expect(result.exitCode).toBe(0)
+    expect(result.stdout).toContain('EXAMPLE_FIRST')
+    expect(result.stdout).toContain('EXAMPLE_SECOND')
+    expect(result.stdout).not.toContain('private-fixture-value')
+  })
+
   it('retains paginated reads and table queries without allowing lookalike mutation paths', async () => {
     const transport = readOnlyCliTransport(async () => Response.json({ data: 'authorized result' }))
     for (const path of ['/api/v2/workflows?cursor=next', '/api/v2/tables/table']) {

apps/sim/lib/mothership/agent-cli/read-only.ts

@@ -1,5 +1,6 @@
 import { toRecord } from '@sim/utils/object'
 import type { BlockState } from '@sim/workflow-types/workflow'
+import { v2ListSecretsContract, v2SecretSchema } from '@/lib/api/contracts/v2/secrets'
 import { v2WorkflowGraphSchema } from '@/lib/api/contracts/v2/workflows'
 import type { AgentCliRequest } from '@/lib/mothership/generated/agent-cli'
 import { sanitizeWorkflowForSharing } from '@/lib/workflows/credentials/credential-extractor'
@@ -33,7 +34,7 @@ export function readOnlyCliTransport(transport: typeof fetch): typeof fetch {
     const request = new Request(input, init)
     const path = new URL(request.url).pathname
     if (
-      /^\/api\/v2\/secrets(?:\/|$)/.test(path) ||
+      /^\/api\/v2\/secrets\//.test(path) ||
       (request.method !== 'GET' &&
         !(request.method === 'POST' && /^\/api\/v2\/tables\/[^/]+\/query(?:\/count)?$/.test(path)))
     ) {
@@ -45,7 +46,15 @@ export function readOnlyCliTransport(transport: typeof fetch): typeof fetch {
       )
     }
     const response = await transport(request)
-    if (!response.ok || !/^\/api\/v2\/workflows\/[^/]+\/state$/.test(path)) return response
+    if (!response.ok) return response
+    if (path === '/api/v2/secrets') {
+      const page = v2ListSecretsContract.response.schema.parse(await response.json())
+      return Response.json({
+        ...page,
+        data: page.data.map((secret) => v2SecretSchema.parse(secret)),
+      })
+    }
+    if (!/^\/api\/v2\/workflows\/[^/]+\/state$/.test(path)) return response
     const graph = v2WorkflowGraphSchema.parse(toRecord(await response.json()).data)
     const sanitized = sanitizeWorkflowForSharing(
       { blocks: graph.blocks as Record<string, BlockState> },

apps/sim/lib/mothership/memory/application/read-scope.test.ts

@@ -12,7 +12,10 @@ import {
   createTrustedCopilotPrincipal,
   createTrustedOrganizationCopilotPrincipal,
 } from '@/lib/mothership/auth/application-delegation'
-import { MEMORY_SCOPE_AUDIENCE, readMemoryScope } from './read-scope'
+import {
+  MEMORY_SCOPE_AUDIENCE,
+  readMemoryScope,
+} from '@/lib/mothership/memory/application/read-scope'
 
 const mocks = vi.hoisted(() => ({
   capability: vi.fn(),

scripts/check-unused-exports.baseline.json

@@ -3562,7 +3562,6 @@
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2ListSecretsQuerySchema",
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretDeleteDataSchema",
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretNameSchema",
-  "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretSchema",
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretScopeSchema",
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretSortFields",
   "apps/sim/lib/api/contracts/v2/secrets.ts#v2SecretWithValueSchema",