Address PR review feedback (#6629)

- validate render errors against workspace-file provenance before returning details\n- cover blocked provenance with a regression test

Author: j15z

apps/sim/lib/copilot/tools/handlers/vfs.test.ts

@@ -328,6 +328,35 @@ describe('vfs handlers oversize policy', () => {
     expect(result).toEqual({ success: false, error })
   })
 
+  it('does not expose dynamic file read errors when provenance cannot be verified', async () => {
+    const vfs = makeVfs()
+    const error = 'Document compiler not configured (MOTHERSHIP_E2B_DOC_TEMPLATE_ID is unset)'
+    vfs.readFileContentWithProvenance.mockResolvedValue({
+      value: {
+        content: JSON.stringify({ ok: false, error }),
+        totalLines: 1,
+        error,
+      },
+      file: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+    })
+    getOrMaterializeVFS.mockResolvedValue(vfs)
+    importWorkspaceFileSecretProvenanceForModelView.mockResolvedValueOnce(false)
+
+    const result = await executeVfsRead({ path: 'files/reports/brief.pdf/render' }, GREP_CTX)
+
+    expect(result).toEqual({
+      success: false,
+      error:
+        'This file result cannot be shared safely because its secret provenance is unavailable.',
+    })
+    expect(importWorkspaceFileSecretProvenanceForModelView).toHaveBeenCalledWith(
+      expect.objectContaining({
+        identity: { fileId: 'file-1', key: 'workspace/key-1', context: 'workspace' },
+        view: 'derived',
+      })
+    )
+  })
+
   it('marks a windowed read as a derived provenance view', async () => {
     const vfs = makeVfs()
     vfs.readFileContentWithProvenance.mockResolvedValue({

apps/sim/lib/copilot/tools/handlers/vfs.ts

@@ -405,9 +405,6 @@ export async function executeVfsRead(
       : null
     const fileContent = fileEnvelope?.value
     if (fileContent) {
-      if (fileContent.error !== undefined) {
-        return { success: false, error: fileContent.error }
-      }
       const isAttachment = hasModelAttachment(fileContent)
       if (
         !isAttachment &&
@@ -445,6 +442,9 @@ export async function executeVfsRead(
             'This file result cannot be shared safely because its secret provenance is unavailable.',
         }
       }
+      if (fileContent.error !== undefined) {
+        return { success: false, error: fileContent.error }
+      }
       logger.debug('vfs_read resolved workspace file', {
         path,
         totalLines: fileContent.totalLines,