From 31e6bd8ec8e3d7b96871c17b931dbfd51cf744b9 Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Mon, 30 Mar 2026 11:18:36 +0800
Subject: [PATCH] refactor(sandbox/v2): replace resolveEnvRef with str.EnvVar
 for environment variable handling

Removed the resolveEnvRef function and replaced its usage with str.EnvVar for processing environment variables in BuildCreateOptions and buildEnv functions. This change simplifies the code and enhances consistency in how environment variables are managed across the sandbox.
---
 agent/sandbox/v2/claude/command.go |  3 ++-
 agent/sandbox/v2/options.go        | 28 ++++------------------------
 2 files changed, 6 insertions(+), 25 deletions(-)

diff --git a/agent/sandbox/v2/claude/command.go b/agent/sandbox/v2/claude/command.go
index 1e0c0a0f..6e75d674 100644
--- a/agent/sandbox/v2/claude/command.go
+++ b/agent/sandbox/v2/claude/command.go
@@ -11,6 +11,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/yaoapp/gou/connector"
 	"github.com/yaoapp/gou/store"
+	"github.com/yaoapp/kun/str"
 	agentContext "github.com/yaoapp/yao/agent/context"
 	"github.com/yaoapp/yao/agent/sandbox/v2/types"
 	infra "github.com/yaoapp/yao/sandbox/v2"
@@ -165,7 +166,7 @@ func buildEnv(req *types.StreamRequest, p platform) map[string]string {
 
 	if req.Config != nil && len(req.Config.Secrets) > 0 {
 		for k, v := range req.Config.Secrets {
-			env[k] = v
+			env[k] = str.EnvVar(v)
 		}
 	}
 
diff --git a/agent/sandbox/v2/options.go b/agent/sandbox/v2/options.go
index ba4005dd..d3d56d7e 100644
--- a/agent/sandbox/v2/options.go
+++ b/agent/sandbox/v2/options.go
@@ -1,35 +1,15 @@
 package sandboxv2
 
 import (
-	"encoding/base64"
 	"fmt"
-	"os"
 	"strings"
 	"time"
 
+	"github.com/yaoapp/kun/str"
 	"github.com/yaoapp/yao/agent/sandbox/v2/types"
 	infra "github.com/yaoapp/yao/sandbox/v2"
 )
 
-// resolveEnvRef resolves $ENV.XXX and $ENV_B64.XXX references.
-// $ENV.XXX      → os.Getenv("XXX")
-// $ENV_B64.XXX  → base64-decode(os.Getenv("XXX")), useful for multi-line
-//
-//	values like SSH private keys.
-func resolveEnvRef(value string) string {
-	if strings.HasPrefix(value, "$ENV_B64.") {
-		raw := os.Getenv(value[9:])
-		if decoded, err := base64.StdEncoding.DecodeString(raw); err == nil {
-			return string(decoded)
-		}
-		return raw
-	}
-	if strings.HasPrefix(value, "$ENV.") {
-		return os.Getenv(value[5:])
-	}
-	return value
-}
-
 // BuildCreateOptions converts a SandboxConfig into the V2 infrastructure
 // CreateOptions. Connector config injection is handled separately via the
 // a2o HTTP API (POST /config) after the container starts.
@@ -132,10 +112,10 @@ func BuildCreateOptions(cfg *types.SandboxConfig, identifier, ownerID, workspace
 	if envSize > 0 {
 		opts.Env = make(map[string]string, envSize)
 		for k, v := range cfg.Environment {
-			opts.Env[k] = resolveEnvRef(v)
+			opts.Env[k] = str.EnvVar(v)
 		}
 		for k, v := range cfg.Secrets {
-			opts.Env[k] = resolveEnvRef(v)
+			opts.Env[k] = str.EnvVar(v)
 		}
 	}
 
@@ -147,7 +127,7 @@ func BuildCreateOptions(cfg *types.SandboxConfig, identifier, ownerID, workspace
 	if cfg.Computer.VNC.Enabled {
 		opts.Env["VNC_ENABLED"] = "true"
 		if cfg.Computer.VNC.Password != "" {
-			opts.Env["VNC_PASSWORD"] = resolveEnvRef(cfg.Computer.VNC.Password)
+			opts.Env["VNC_PASSWORD"] = str.EnvVar(cfg.Computer.VNC.Password)
 		}
 		if cfg.Computer.VNC.Resolution != "" {
 			opts.Env["VNC_RESOLUTION"] = cfg.Computer.VNC.Resolution