feat(sandbox): inject user env vars and secret refs into execution

[anticorrelator]

Adds user-defined environment variables to sandbox code execution and locks down the broader unified config contract that governs how every per-adapter capability (env vars, dependencies, internet access) is advertised, stored, rendered, and enforced. Each sandbox config carries a list of env var entries — either literal name/value pairs or secret references that point to an encrypted key in the Secret table — plus internet_access and dependencies fields. SANDBOX_ADAPTER_METADATA advertises which capabilities each adapter supports so the frontend renders only the editors that apply and the runtime fails closed on anything else.

At resolution time literals pass through directly, secret refs are decrypted from the Secret table (with a clear error when a referenced key is missing), and the merged env dict is forwarded to the underlying provider SDK for all seven adapters (E2B, Deno, Daytona, Vercel Python/TypeScript, Modal, WASM). The settings dialog gets a new env-vars editor with a secret picker populated from the existing secrets query, so admins can bind a sandbox env var to an existing secret without re-typing the plaintext.

PR #12655 originally introduced the shape of a unified config (three structured sections: env_vars, dependencies, internet_access, plus three capability flags on AdapterMetadata) but never locked it as a contract. This change writes the contract down and reconciles every layer so the rules are enforced rather than emergent:

• AdapterMetadata is the canonical source of capability advertisement. Class-level docstring + per-field comments specify, for each capability, what the values mean, what build_backend must do, and how the UI should render. SandboxAdapter.build_backend and validate_config cross-reference it so future adapter authors find the rules from source.
• Fail-closed runtime, no silent drops. Every adapter × capability cell is now either flag-true + wired end-to-end or flag-false + build_backend raises UnsupportedOperation on non-empty input. MODAL supports_env_vars flipped to True (the runtime always worked); ModalSandboxBackend.execute() now raises on per-call env overrides instead of silently warning.
• Preserve-on-save UI. formValuesToConfigPatch (extracted to utils.tsx) deep-merges form state into a clone of the raw stored config, preserving capability-gated keys when the flag is false or activeBackend is undefined. The Advanced Config JSON editor cannot create or mutate env_vars / internet_access / dependencies — only the structured editors author them. Hidden capability sections render a single muted "Not supported by the selected backend." placeholder so users see the gap is intentional. InternetAccessMode.ALLOWLIST is reserved-for-future and not user-selectable.
• Parametrized conformance tests. New test_unified_config_contract.py iterates over SANDBOX_ADAPTER_METADATA.keys() and asserts flag/config-model/runtime agreement for all three capabilities; test_capability_advertisement.py and test_queries.py were refactored to parametrize from the same registry source. Adding a new adapter automatically participates — no hand-maintained per-adapter list can drift.

Env vars land on the sandbox config and resolve into the dict that feeds build_backend(), rather than as a per-call argument to execute(). This was driven by Modal's lifecycle: Sandbox.create() accepts env_dict but sandbox.exec() does not, so env must land at sandbox-creation time. Routing env through the config dict gives every adapter a single injection point that maps cleanly to whatever its SDK supports — and makes env vars uniform with the other two capabilities the contract now covers.

                  ┌──────────────────────────────────────────────┐
                  │   AdapterMetadata  (canonical contract)      │
                  │   - supports_env_vars: bool                  │
                  │   - internet_access: Literal[none|bool|...]  │
                  │   - dependencies_language: Optional[Literal] │
                  │   [docstring = unified config contract]      │
                  └──────────────────────┬───────────────────────┘
                                         │ SANDBOX_ADAPTER_METADATA
                                         │ (single registry)
         ┌───────────────────────────────┼───────────────────────────────┐
         │ renders from                  │ enforced by                   │ parametrized by
         ▼                               ▼                               ▼
 ┌────────────────────────┐   ┌────────────────────────┐   ┌──────────────────────────┐
 │  SandboxConfigDialog   │   │  SandboxBackendInfo    │   │  test_unified_config_    │
 │  env vars editor +     │   │  (GQL)                 │   │  contract                │
 │  secret picker         │   │  - supportsEnvVars     │   │  test_capability_        │
 │  flags → render only   │   │  - internetAccess      │   │  advertisement           │
 │  preserve-on-save      │   │  - dependenciesLang    │   │  test_queries            │
 │  "Not supported by..." │   └────────────────────────┘   │  iterate METADATA.keys() │
 │  utils.tsx (testable)  │                                │  flag ↔ model ↔ runtime  │
 └────────────┬───────────┘                                └──────────────────────────┘
              │ writes structured sections only
              ▼
 ┌──────────────────────────┐        ┌──────────────────────────┐
 │     sandbox_configs      │        │       Secret table       │
 │  env_vars · dependencies │        │    (Fernet-encrypted)    │
 │     · internet_access    │        └────────────┬─────────────┘
 │  (literal | secret_ref)  │                     │ decrypt
 └────────────┬─────────────┘                     │ secret_refs
              │                                   │
              ▼                                   ▼
 ┌───────────────────────────────────────────────────────────────┐
 │                     _resolve_user_env                         │
 │   literals pass through · secret_refs decrypted from table    │
 │          MissingSecretError if referenced key absent          │
 └────────────────────────────┬──────────────────────────────────┘
                              │ merged env dict
                              ▼
 ┌───────────────────────────────────────────────────────────────┐
 │       get_or_create_backend → build_backend(config)           │
 │                                                               │
 │   flag=True   → wire end-to-end (SDK forward)                 │
 │   flag=False  → raise UnsupportedOperation                    │
 │                 (fail-closed; no silent drops)                │
 └────────────────────────────┬──────────────────────────────────┘
                              │
            ┌─────────────────┴────────────────┐
            ▼                                  ▼
 ┌──────────────────────┐          ┌──────────────────────┐
 │ Per-exec injection   │          │ Create-time injection│
 │ E2B · Deno · Daytona │          │    Vercel · Modal    │
 │         WASM         │          │  (Modal per-call env │
 │                      │          │   now raises Unsupp.)│
 └──────────────────────┘          └──────────────────────┘

Test plan

• Unit tests for env var resolution: literal pass-through, secret-ref decryption, missing-secret error path
• Unit tests for each backend forwarding the merged env dict to its SDK call
• Unit tests asserting capability advertisement per adapter (supports_env_vars, internet_access, dependencies_language)
• End-to-end resolution test covering the full config → resolver → backend chain
• Parametrized conformance test (test_unified_config_contract.py) iterating SANDBOX_ADAPTER_METADATA.keys() — flag/config-model/runtime agreement for all three capabilities
• test_capability_advertisement.py and test_queries.py refactored to parametrize from the same registry source (no duplicate hard-coded matrix)
• test_user_env_forwarding.py covers MODAL's new execute-time policy (per-call execute(env=...) raises UnsupportedOperation; session-level user_env still forwarded)
• Frontend unit tests (formValuesToConfigPatch.test.ts) covering the three preserve-on-save data-loss scenarios: flag flip False→True→False, activeBackend undefined, non-UI-path stored data
• Playwright coverage for the settings-page env var editor and secret picker
• Manual verification: create a sandbox config with a literal env var and a secret ref, run a code evaluator, confirm both values land in the sandboxed process
• Manual verification: delete a referenced secret and confirm the resulting execution error surfaces the missing key name
• Manual verification: configure a sandbox with internet_access set to a non-"none" mode via the API and confirm build_backend raises UnsupportedOperation (fail-closed)
• Manual verification: round-trip a sandbox config in the UI with an unrelated capability flag flipped — confirm capability-gated keys persist (preserve-on-save)

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.