From 46ea2cfbe44a7b83cddf9378b904c51ac0c4fcc7 Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Mon, 30 Mar 2026 10:24:41 +0800
Subject: [PATCH] fix(sandbox/v2): enhance resolveEnvRef to support
 base64-encoded environment variables

Updated the resolveEnvRef function to handle $ENV_B64.XXX references, allowing for base64-decoding of environment variables. This enhancement is particularly useful for managing multi-line values such as SSH private keys, improving the flexibility of environment variable handling.
---
 agent/sandbox/v2/options.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/agent/sandbox/v2/options.go b/agent/sandbox/v2/options.go
index 2e51f55f..ba4005dd 100644
--- a/agent/sandbox/v2/options.go
+++ b/agent/sandbox/v2/options.go
@@ -1,6 +1,7 @@
 package sandboxv2
 
 import (
+	"encoding/base64"
 	"fmt"
 	"os"
 	"strings"
@@ -10,8 +11,19 @@ import (
 	infra "github.com/yaoapp/yao/sandbox/v2"
 )
 
-// resolveEnvRef resolves $ENV.XXX references to os.Getenv("XXX").
+// resolveEnvRef resolves $ENV.XXX and $ENV_B64.XXX references.
+// $ENV.XXX      → os.Getenv("XXX")
+// $ENV_B64.XXX  → base64-decode(os.Getenv("XXX")), useful for multi-line
+//
+//	values like SSH private keys.
 func resolveEnvRef(value string) string {
+	if strings.HasPrefix(value, "$ENV_B64.") {
+		raw := os.Getenv(value[9:])
+		if decoded, err := base64.StdEncoding.DecodeString(raw); err == nil {
+			return string(decoded)
+		}
+		return raw
+	}
 	if strings.HasPrefix(value, "$ENV.") {
 		return os.Getenv(value[5:])
 	}