fix(box): ignore box.local.env in multi-workspace deployments

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-authored-by: multica-agent <[email protected]>

src/langbot/pkg/box/service.py

@@ -1843,10 +1843,17 @@ class BoxService:
         can read settings such as a service base URL. A per-call ``env`` supplied
         by the agent or caller overrides the matching defaults. Non-dict configs
         and non-string keys or values are ignored.
+
+        The setting is instance-wide, so it is disabled in multi-workspace
+        deployments to keep operator values from reaching every tenant's sandbox.
         """
         raw_env = self._local_config().get('env')
         if not isinstance(raw_env, dict):
             return {}
+        if self._cloud_managed:
+            if raw_env:
+                self.ap.logger.warning('box.local.env is ignored in multi-workspace deployments.')
+            return {}
 
         env: dict[str, str] = {}
         for key, value in raw_env.items():

src/langbot/templates/config.yaml

@@ -391,6 +391,8 @@ box:
         workspace_quota_mb: null  # Optional disk quota override (>= 0). null = profile default.
         # Extra environment variables injected into every Box exec payload.
         # The agent-supplied per-call env overrides matching keys. Values must be strings.
+        # Every sandbox command, including untrusted agent commands, can read them;
+        # do not put secrets here. Loaded at startup; ignored in multi-workspace deployments.
         env: {}
     # Default nsjail cgroup memory limit for each MCP stdio server process, in MB.
     # Node.js MCP servers (npx/bunx) need more memory than Python ones because V8