fix(executor): decide the environment read from the author's own text

Resolved data is quoted inside the expression the handler sees, so a
payload containing `environmentVariables` read exactly like the author
reaching for the map, and a caller could restore the full secret set by
sending the word. The resolver now records that answer per branch from the
pre-resolution expression, where only the author's text exists, and the
handler reads the record — falling back to scanning only when a caller did
not resolve through the resolver, since narrowing a real read would route
the run silently.

A closed regex literal also counts as a value now, so the division in
`/re/.source.length / 2` no longer opens a second regex that swallows the
quotes after it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/executor/handlers/condition/condition-handler.test.ts

@@ -256,6 +256,28 @@ describe('ConditionBlockHandler', () => {
     expect(toolParams.mountedSecrets).toEqual([])
   })
 
+  it('trusts the resolver record over the word appearing in a resolved expression', async () => {
+    // The resolver saw the author's text before any value was inlined; the expression by now
+    // carries trigger data, where the same word means nothing.
+    mockExecuteTool.mockResolvedValueOnce(matchedAt(0))
+
+    const conditions = [
+      {
+        id: 'cond1',
+        title: 'if',
+        value: `'environmentVariables.OPENAI_API_KEY' === 'x'`,
+        _readsEnvironmentVariables: false,
+      },
+      { id: 'else1', title: 'else', value: '' },
+    ]
+
+    await handler.execute(mockContext, mockBlock, { conditions: JSON.stringify(conditions) })
+
+    const [, toolParams] = mockExecuteTool.mock.calls[0]
+    expect(toolParams.secretScope).toBe('selected')
+    expect(toolParams.mountedSecrets).toEqual([])
+  })
+
   it('keeps the whole environment for a condition that reads the environment directly', async () => {
     // Every shape an expression can reach the map through, including the ones a member-access
     // pattern would miss — narrowing one of those would route the run silently.

apps/sim/executor/handlers/condition/condition-handler.ts

@@ -17,6 +17,7 @@ import {
   extractBranchIndex,
   isBranchNodeId,
 } from '@/executor/utils/subflow-utils'
+import { CONDITION_READS_ENVIRONMENT_KEY } from '@/executor/variables/resolver'
 import type { SerializedBlock } from '@/serializer/types'
 import { executeTool } from '@/tools'
 import type { ToolResponse } from '@/tools/types'
@@ -29,6 +30,8 @@ interface ConditionEntry {
   id: string
   title: string
   value: string
+  /** Set by the resolver from the author's pre-resolution expression. */
+  [CONDITION_READS_ENVIRONMENT_KEY]?: boolean
 }
 
 /** Verdict for a whole condition list evaluated in one function execution. */
@@ -97,32 +100,36 @@ function buildConditionScript(expressions: string[], evalContext: Record<string,
  * sandbox the full environment only widens what a future defect in this path could reach —
  * the whole map was readable as the `environmentVariables` global.
  *
- * Both scans read the expressions rather than the built script, which also carries the source
- * block's output as data. Reading that data would let it decide what the sandbox holds: a
- * payload containing the word `environmentVariables` would restore the whole map, and one
- * containing `{{SECRET}}` would mount that secret and have the compiler expand it into the
- * data — a caller choosing which secret materializes next to it. Every legitimate route to a
- * secret runs through an expression, including a workflow variable holding `{{NAME}}`, because
- * the resolver inlines that value into the expression before this runs.
+ * Neither signal is read from the built script, which also carries the source block's output as
+ * data. Reading that data would let it decide what the sandbox holds — a payload containing
+ * `{{SECRET}}` would mount that secret and have the compiler expand it beside the payload.
+ * Placeholders are therefore read from the expressions, which is where every legitimate route
+ * to a secret passes, including a workflow variable holding `{{NAME}}`: the resolver inlines
+ * that value into the expression before this runs.
  *
- * Within an expression the bare `environmentVariables` identifier is enough, rather than a
- * member access. Narrowing the secrets an expression can see when it does reach for the map by
- * some shape the pattern did not anticipate — `environmentVariables?.FLAG`, or a read through
- * `Object.keys` — would route the run down a branch the author did not write, silently.
- * Matching too widely only costs the narrowing itself, and never mounts more than this path
- * already mounted.
+ * A direct read of the environment map is not read from the resolved expression either, for the
+ * same reason one step further in: resolved data is quoted inside it, so a payload containing
+ * the word would be indistinguishable from the author reaching for the map. The resolver
+ * records the answer from the author's pre-resolution text instead. When that record is absent
+ * — a caller that did not resolve through it — the expression is scanned as a fallback, because
+ * narrowing a read this missed would route the run down a branch the author did not write,
+ * silently, while matching too widely only costs the narrowing.
  */
-function scopeConditionSecrets(expressions: string[]): {
+function scopeConditionSecrets(conditions: ConditionEntry[]): {
   secretScope: 'all' | 'selected'
   mountedSecrets: string[]
 } {
-  if (expressions.some((expression) => /\benvironmentVariables\b/.test(expression))) {
+  const readsEnvironment = conditions.some((condition) => {
+    const recorded = condition[CONDITION_READS_ENVIRONMENT_KEY]
+    return recorded ?? /\benvironmentVariables\b/.test(condition.value)
+  })
+  if (readsEnvironment) {
     return { secretScope: 'all', mountedSecrets: [] }
   }
 
   const named = new Set<string>()
-  for (const expression of expressions) {
-    for (const match of expression.matchAll(createEnvVarPattern())) {
+  for (const condition of conditions) {
+    for (const match of String(condition.value ?? '').matchAll(createEnvVarPattern())) {
       named.add(String(match[1]).trim())
     }
   }
@@ -141,11 +148,11 @@ function scopeConditionSecrets(expressions: string[]): {
 async function runConditionCode(
   ctx: ExecutionContext,
   code: string,
-  expressions: string[],
+  conditions: ConditionEntry[],
   currentNodeId?: string
 ): Promise<ToolResponse> {
   const { blockNameMapping, blockOutputSchemas } = collectBlockData(ctx, currentNodeId)
-  const { secretScope, mountedSecrets } = scopeConditionSecrets(expressions)
+  const { secretScope, mountedSecrets } = scopeConditionSecrets(conditions)
 
   return executeTool(
     'function_execute',
@@ -188,14 +195,15 @@ function isTimeoutFailure(error: string | undefined): boolean {
 /** Evaluates the whole condition list in a single function execution. */
 async function evaluateConditionList(
   ctx: ExecutionContext,
-  expressions: string[],
+  conditions: ConditionEntry[],
   evalContext: Record<string, unknown>,
   currentNodeId?: string
 ): Promise<ConditionEvaluation> {
+  const expressions = conditions.map((condition) => String(condition.value || ''))
   const result = await runConditionCode(
     ctx,
     buildConditionScript(expressions, evalContext),
-    expressions,
+    conditions,
     currentNodeId
   )
 
@@ -275,12 +283,13 @@ async function evaluateConditionList(
  */
 async function evaluateSingleCondition(
   ctx: ExecutionContext,
-  expression: string,
+  condition: ConditionEntry,
   evalContext: Record<string, unknown>,
   currentNodeId?: string
 ): Promise<boolean> {
+  const expression = String(condition.value || '')
   const code = `const context = ${JSON.stringify(evalContext)};\nreturn ${buildBooleanTest(expression)}`
-  const result = await runConditionCode(ctx, code, [expression], currentNodeId)
+  const result = await runConditionCode(ctx, code, [condition], currentNodeId)
 
   if (!result.success) {
     if (result.retryable === false) {
@@ -464,11 +473,9 @@ export class ConditionBlockHandler implements BlockHandler {
   ): Promise<ConditionEntry | null> {
     if (conditions.length === 0) return null
 
-    const expressions = conditions.map((condition) => String(condition.value || ''))
-
     let evaluation: ConditionEvaluation
     try {
-      evaluation = await evaluateConditionList(ctx, expressions, evalContext, currentNodeId)
+      evaluation = await evaluateConditionList(ctx, conditions, evalContext, currentNodeId)
     } catch (error) {
       if (isNonRetryableExecutionError(error)) throw error
       evaluation = {
@@ -520,7 +527,7 @@ export class ConditionBlockHandler implements BlockHandler {
       try {
         const conditionMet = await evaluateSingleCondition(
           ctx,
-          String(condition.value || ''),
+          condition,
           evalContext,
           currentNodeId
         )

apps/sim/executor/variables/resolver.test.ts

@@ -236,16 +236,50 @@ describe('VariableResolver function block inputs', () => {
     )
 
     expect(result.conditions).toEqual([
-      { id: 'condition-1', title: 'if', value: '123 === 123' },
-      { id: 'condition-2', title: 'else if', value: 'true === true' },
+      { id: 'condition-1', title: 'if', value: '123 === 123', _readsEnvironmentVariables: false },
+      {
+        id: 'condition-2',
+        title: 'else if',
+        value: 'true === true',
+        _readsEnvironmentVariables: false,
+      },
       {
         id: 'condition-3',
         title: 'else if',
         value: '"Bearer {{API_KEY}}" === "Bearer token"',
+        _readsEnvironmentVariables: false,
       },
     ])
   })
 
+  it('records whether the author, not the trigger data, reads the environment map', async () => {
+    const { ctx, resolver } = createResolver()
+    ctx.environmentVariables = {}
+    const conditionBlock = createBlock('condition', 'Condition', BlockType.CONDITION)
+    // The second branch only quotes a producer output that happens to contain the word.
+    const conditions = [
+      { id: 'c1', title: 'if', value: `environmentVariables.FLAG === 'on'` },
+      { id: 'c2', title: 'else if', value: `"<producer.result>" === 'x'` },
+    ]
+    ;(ctx.blockStates as Map<string, any>).set('producer', {
+      output: { result: 'environmentVariables.OPENAI_API_KEY' },
+      executed: true,
+      executionTime: 0,
+    })
+
+    const result = await resolver.resolveInputs(
+      ctx,
+      conditionBlock.id,
+      { conditions: JSON.stringify(conditions) },
+      conditionBlock
+    )
+
+    const resolvedConditions = result.conditions as Array<Record<string, unknown>>
+    expect(resolvedConditions[0]._readsEnvironmentVariables).toBe(true)
+    expect(resolvedConditions[1]._readsEnvironmentVariables).toBe(false)
+    expect(resolvedConditions[1].value).toContain('environmentVariables.OPENAI_API_KEY')
+  })
+
   it('preserves legacy condition outcomes end to end through the boundary compiler', async () => {
     const environmentVariables = {
       API_KEY: 'token',

apps/sim/executor/variables/resolver.ts

@@ -36,6 +36,18 @@ import {
 import { WorkflowResolver } from '@/executor/variables/resolvers/workflow'
 import type { SerializedBlock, SerializedWorkflow } from '@/serializer/types'
 
+/**
+ * Marks a Condition branch whose author-written expression reads the environment map.
+ *
+ * Carried per branch because only the pre-resolution text can answer it: the handler decides
+ * which secrets to mount, and by the time it runs, resolved trigger data quoted inside the
+ * expression would read the same as the author reaching for the map.
+ */
+export const CONDITION_READS_ENVIRONMENT_KEY = '_readsEnvironmentVariables'
+
+/** The sandbox global holding the run's secrets, in whatever shape an expression reaches it. */
+const ENVIRONMENT_MAP_IDENTIFIER = /\benvironmentVariables\b/
+
 /** Key used to carry pre-resolved context variables through the inputs map. */
 export const FUNCTION_BLOCK_CONTEXT_VARS_KEY = '_runtimeContextVars'
 /** Key used to carry display-resolved code through the function execution path. */
@@ -346,6 +358,11 @@ export class VariableResolver {
             const value = Reflect.get(condition, 'value')
             return {
               ...condition,
+              // Recorded before resolution: once values are inlined, an expression that reads
+              // the environment map is indistinguishable from one that merely quotes trigger
+              // data containing the word, and the handler decides what to mount from this.
+              [CONDITION_READS_ENVIRONMENT_KEY]:
+                typeof value === 'string' && ENVIRONMENT_MAP_IDENTIFIER.test(value),
               value:
                 typeof value === 'string'
                   ? await this.resolveTemplateWithoutConditionFormatting(
@@ -1129,14 +1146,17 @@ export class VariableResolver {
   private canStartJavaScriptRegex(
     template: string,
     previousSignificantIndex: number,
-    controlHeadParenCloses: ReadonlySet<number>
+    closes: { controlHeadParenCloses: ReadonlySet<number>; regexCloseIndices: ReadonlySet<number> }
   ): boolean {
     if (previousSignificantIndex < 0) {
       return true
     }
     const previous = template[previousSignificantIndex]
     if (previous === ')') {
-      return controlHeadParenCloses.has(previousSignificantIndex)
+      return closes.controlHeadParenCloses.has(previousSignificantIndex)
+    }
+    if (previous === '/' && closes.regexCloseIndices.has(previousSignificantIndex)) {
+      return false
     }
     if (JAVASCRIPT_REGEX_ALLOWED_AFTER.has(previous)) {
       return true
@@ -1304,6 +1324,7 @@ export class VariableResolver {
     let lastSignificantIndex = -1
     const openParenIsControlHead: boolean[] = []
     const controlHeadParenCloses = new Set<number>()
+    const regexCloseIndices = new Set<number>()
 
     for (let i = 0; i < index; i++) {
       const char = template[i]
@@ -1346,6 +1367,9 @@ export class VariableResolver {
         }
         if (char === '/' && !mode.inCharacterClass) {
           modes.pop()
+          // The literal that just closed is a value, so the next `/` divides it.
+          regexCloseIndices.add(i)
+          lastSignificantIndex = i
         }
         continue
       }
@@ -1414,7 +1438,10 @@ export class VariableResolver {
         if (
           !isPython &&
           char === '/' &&
-          this.canStartJavaScriptRegex(template, previousSignificantIndex, controlHeadParenCloses)
+          this.canStartJavaScriptRegex(template, previousSignificantIndex, {
+            controlHeadParenCloses,
+            regexCloseIndices,
+          })
         ) {
           modes.push({ type: 'regex', inCharacterClass: false })
           continue
@@ -1480,7 +1507,10 @@ export class VariableResolver {
       if (
         !isPython &&
         char === '/' &&
-        this.canStartJavaScriptRegex(template, previousSignificantIndex, controlHeadParenCloses)
+        this.canStartJavaScriptRegex(template, previousSignificantIndex, {
+          controlHeadParenCloses,
+          regexCloseIndices,
+        })
       ) {
         modes.push({ type: 'regex', inCharacterClass: false })
         continue