refactor(sandbox/v2): replace resolveEnvRef with str.EnvVar for environment variable handling

Removed the resolveEnvRef function and replaced its usage with str.EnvVar for processing environment variables in BuildCreateOptions and buildEnv functions. This change simplifies the code and enhances consistency in how environment variables are managed across the sandbox.

agent/sandbox/v2/claude/command.go

@@ -11,6 +11,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/yaoapp/gou/connector"
 	"github.com/yaoapp/gou/store"
+	"github.com/yaoapp/kun/str"
 	agentContext "github.com/yaoapp/yao/agent/context"
 	"github.com/yaoapp/yao/agent/sandbox/v2/types"
 	infra "github.com/yaoapp/yao/sandbox/v2"
@@ -165,7 +166,7 @@ func buildEnv(req *types.StreamRequest, p platform) map[string]string {
 
 	if req.Config != nil && len(req.Config.Secrets) > 0 {
 		for k, v := range req.Config.Secrets {
-			env[k] = v
+			env[k] = str.EnvVar(v)
 		}
 	}
 

agent/sandbox/v2/options.go

@@ -1,35 +1,15 @@
 package sandboxv2
 
 import (
-	"encoding/base64"
 	"fmt"
-	"os"
 	"strings"
 	"time"
 
+	"github.com/yaoapp/kun/str"
 	"github.com/yaoapp/yao/agent/sandbox/v2/types"
 	infra "github.com/yaoapp/yao/sandbox/v2"
 )
 
-// resolveEnvRef resolves $ENV.XXX and $ENV_B64.XXX references.
-// $ENV.XXX      → os.Getenv("XXX")
-// $ENV_B64.XXX  → base64-decode(os.Getenv("XXX")), useful for multi-line
-//
-//	values like SSH private keys.
-func resolveEnvRef(value string) string {
-	if strings.HasPrefix(value, "$ENV_B64.") {
-		raw := os.Getenv(value[9:])
-		if decoded, err := base64.StdEncoding.DecodeString(raw); err == nil {
-			return string(decoded)
-		}
-		return raw
-	}
-	if strings.HasPrefix(value, "$ENV.") {
-		return os.Getenv(value[5:])
-	}
-	return value
-}
-
 // BuildCreateOptions converts a SandboxConfig into the V2 infrastructure
 // CreateOptions. Connector config injection is handled separately via the
 // a2o HTTP API (POST /config) after the container starts.
@@ -132,10 +112,10 @@ func BuildCreateOptions(cfg *types.SandboxConfig, identifier, ownerID, workspace
 	if envSize > 0 {
 		opts.Env = make(map[string]string, envSize)
 		for k, v := range cfg.Environment {
-			opts.Env[k] = resolveEnvRef(v)
+			opts.Env[k] = str.EnvVar(v)
 		}
 		for k, v := range cfg.Secrets {
-			opts.Env[k] = resolveEnvRef(v)
+			opts.Env[k] = str.EnvVar(v)
 		}
 	}
 
@@ -147,7 +127,7 @@ func BuildCreateOptions(cfg *types.SandboxConfig, identifier, ownerID, workspace
 	if cfg.Computer.VNC.Enabled {
 		opts.Env["VNC_ENABLED"] = "true"
 		if cfg.Computer.VNC.Password != "" {
-			opts.Env["VNC_PASSWORD"] = resolveEnvRef(cfg.Computer.VNC.Password)
+			opts.Env["VNC_PASSWORD"] = str.EnvVar(cfg.Computer.VNC.Password)
 		}
 		if cfg.Computer.VNC.Resolution != "" {
 			opts.Env["VNC_RESOLUTION"] = cfg.Computer.VNC.Resolution