Fei.Chen 49a0e131b3
fix(sandbox): honor sandbox.environment on the local provider (#6463)
* fix(sandbox): honor sandbox.environment on the local provider

LocalSandboxProvider ignored the documented sandbox.environment config
field (only the AIO provider consumed it), leaving public generation
skills (video-generation / image-generation) with no way to receive
provider API keys on the default local sandbox: env inheritance is
scrubbed by policy (#3861), the skills declare no required-secrets, and
dashboard runs cannot supply config.context.secrets. Fixes #6461.

- LocalSandbox accepts an operator environment; execute_command layers
  it through the existing authorized injection channel
  (build_sandbox_env), so injected entries survive the secret scrub
  while platform credentials still never leak.
- Request-scoped env (declared required-secrets) wins on key collision.
- LocalSandboxProvider resolves $VAR refs from the gateway process env,
  mirroring the AIO provider, and passes the mapping to every sandbox it
  yields; missing/unloadable config degrades to injecting nothing.

* fix(sandbox): address review on local sandbox.environment

- P1: operator-injected values join the bash-tool output redaction set
  (request-scoped values keep precedence on name collision), so an
  echoed sandbox.environment credential no longer flows back into the
  model-visible tool result.
- P2: consume resolved SandboxConfig.environment values verbatim. The
  file-backed AppConfig loader already substitutes $VAR references;
  re-resolving corrupted credentials whose value legitimately starts
  with '$'. Drop the now-unneeded AIO-style resolver.
- Validate operator environment keys at LocalSandbox construction (a
  typo'd key fails at startup, not on first command execution).
- Tests: verbatim passthrough, happy-path config loading, acquire()
  wiring (generic + thread), key validation, and a P1 redaction
  regression through the real bash tool path.
- Docs: SandboxConfig docstring and sandbox/AGENTS.md now describe the
  operator injection channel and its output masking.

* fix(sandbox): redact effective local credentials in bash results

* fix(ci): keep local sandbox guidance within inherited budget

---------

Co-authored-by: vicfei <4058491+vicfei@users.noreply.github.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-08 22:50:45 +08:00
..