fix(runtime): require Cloud control secrets (#2418)

Co-authored-by: Chan <dadachann@users.noreply.github.com>

src/langbot/pkg/box/connector.py

@@ -368,6 +368,10 @@ class BoxRuntimeConnector(ManagedRuntimeConnector):
         if not self._control_token and allow_generate:
             self._control_token = secrets.token_urlsafe(48)
         if not self._control_token:
+            if getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') == 'cloud':
+                raise BoxRuntimeUnavailableError(
+                    f'{BOX_CONTROL_TOKEN_ENV} must be configured with a strong shared secret for a Cloud Box runtime'
+                )
             return ''
         try:
             self._control_token = validate_control_token(self._control_token)

src/langbot/pkg/plugin/connector.py

@@ -264,6 +264,11 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
         if not self._control_token and allow_generate:
             self._control_token = secrets.token_urlsafe(48)
         if not self._control_token:
+            if self.runtime_profile == 'shared':
+                raise PluginRuntimeNotConnectedError(
+                    f'{PLUGIN_RUNTIME_CONTROL_TOKEN_ENV} must be configured with a strong shared secret '
+                    'for a Cloud Plugin Runtime'
+                )
             return {}
         try:
             self._control_token = validate_runtime_secret(