fix(sandbox): preserve workbench output provenance

[icecrasher321]

Summary

• Preserve accumulated input provenance across workbench calls using the existing durable history and redaction registries.
• Apply that history to model output, file exports, and CLI inputs. Align provider exceptions and visible secret values with shared redaction policy.
• Reuse existing provenance budgets and lifecycle rules. Workbenches with missing or unclassifiable history withhold output until replacement.

Type of Change

• Bug fix

Testing

34,949 application tests passed under Node 24 (20 skipped), plus 14 real Redis integration checks and 13 local-process acceptance tests. Regression checks confirmed the relevant cases fail without the fixes.

Full lint, application type-check, API validation, all 52 audits, staging-aware block registry checks, docs manifest verification, and diff checks passed. Hosted-provider validation was not run.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 30, 2026 10:58pm UTC

[cubic-dev-ai]

All reported issues were addressed across 26 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[High risk] Refactors secret provenance tracking across sandbox execution.

The PR appears safe to merge based on the changes since the previous review.

Summary

The PR preserves encrypted secret provenance across workbench calls and applies accumulated history to output, file exports, and CLI inputs. The latest changes also distinguish file-size and provenance-storage failures, refine webhook exception redaction, and allow empty mounted values.

_{Reviews (2) · Last reviewed commit: "fix(sandbox): preserve boundary compatib..."}

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 28 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}