mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-10-27 21:50:36 +00:00
49a0e131b3
* fix(sandbox): honor sandbox.environment on the local provider LocalSandboxProvider ignored the documented sandbox.environment config field (only the AIO provider consumed it), leaving public generation skills (video-generation / image-generation) with no way to receive provider API keys on the default local sandbox: env inheritance is scrubbed by policy (#3861), the skills declare no required-secrets, and dashboard runs cannot supply config.context.secrets. Fixes #6461. - LocalSandbox accepts an operator environment; execute_command layers it through the existing authorized injection channel (build_sandbox_env), so injected entries survive the secret scrub while platform credentials still never leak. - Request-scoped env (declared required-secrets) wins on key collision. - LocalSandboxProvider resolves $VAR refs from the gateway process env, mirroring the AIO provider, and passes the mapping to every sandbox it yields; missing/unloadable config degrades to injecting nothing. * fix(sandbox): address review on local sandbox.environment - P1: operator-injected values join the bash-tool output redaction set (request-scoped values keep precedence on name collision), so an echoed sandbox.environment credential no longer flows back into the model-visible tool result. - P2: consume resolved SandboxConfig.environment values verbatim. The file-backed AppConfig loader already substitutes $VAR references; re-resolving corrupted credentials whose value legitimately starts with '$'. Drop the now-unneeded AIO-style resolver. - Validate operator environment keys at LocalSandbox construction (a typo'd key fails at startup, not on first command execution). - Tests: verbatim passthrough, happy-path config loading, acquire() wiring (generic + thread), key validation, and a P1 redaction regression through the real bash tool path. - Docs: SandboxConfig docstring and sandbox/AGENTS.md now describe the operator injection channel and its output masking. * fix(sandbox): redact effective local credentials in bash results * fix(ci): keep local sandbox guidance within inherited budget --------- Co-authored-by: vicfei <4058491+vicfei@users.noreply.github.com> Co-authored-by: Willem Jiang <willem.jiang@gmail.com>