feat: add trusted process environment values

src/agents/extensions/sandbox/blaxel/sandbox.py

@@ -1071,6 +1071,10 @@ async def create(
     ) -> SandboxSession:
         if manifest is None:
             manifest = Manifest(root=DEFAULT_BLAXEL_WORKSPACE_ROOT)
+        manifest._reject_process_environment_values(
+            backend_id="blaxel",
+            supported_alternative="use DockerSandboxClient",
+        )
         self._validate_manifest_for_create(manifest)
 
         timeouts_in = options.timeouts
@@ -1154,6 +1158,10 @@ async def resume(
         if not isinstance(state, BlaxelSandboxSessionState):
             raise TypeError("BlaxelSandboxClient.resume expects a BlaxelSandboxSessionState")
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="blaxel",
+            supported_alternative="use DockerSandboxClient instead",
+        )
         SandboxInstance = _import_blaxel_sdk()
         blaxel_sandbox = None
         reconnected = False

src/agents/extensions/sandbox/cloudflare/sandbox.py

@@ -1584,6 +1584,10 @@ async def create(
 
         if manifest is None:
             manifest = Manifest()
+        manifest._reject_process_environment_values(
+            backend_id="cloudflare",
+            supported_alternative="use DockerSandboxClient",
+        )
         self._validate_manifest_for_create(manifest)
         if manifest.root != "/workspace":
             raise ConfigurationError(
@@ -1636,6 +1640,10 @@ async def resume(self, state: SandboxSessionState) -> SandboxSession:
                 "CloudflareSandboxClient.resume expects a CloudflareSandboxSessionState"
             )
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="cloudflare",
+            supported_alternative="use DockerSandboxClient instead",
+        )
         if state.mount_authority_rebound or _manifest_has_configured_mount_authority(
             state.manifest
         ):

src/agents/extensions/sandbox/daytona/sandbox.py

@@ -1259,6 +1259,12 @@ async def create(
     ) -> SandboxSession:
         if manifest is None:
             manifest = Manifest(root=DEFAULT_DAYTONA_WORKSPACE_ROOT)
+        manifest._reject_process_environment_values(
+            backend_id="daytona",
+            supported_alternative=(
+                "use DockerSandboxClient for protected process environment transport"
+            ),
+        )
         self._validate_manifest_for_create(manifest)
 
         timeouts_in = options.timeouts
@@ -1332,6 +1338,12 @@ async def resume(
     ) -> SandboxSession:
         if not isinstance(state, DaytonaSandboxSessionState):
             raise TypeError("DaytonaSandboxClient.resume expects a DaytonaSandboxSessionState")
+        state.manifest._reject_process_environment_values(
+            backend_id="daytona",
+            supported_alternative=(
+                "use DockerSandboxClient for protected process environment transport"
+            ),
+        )
         state.assert_path_grants_rebound()
 
         daytona_sandbox = None

src/agents/extensions/sandbox/e2b/sandbox.py

@@ -1697,6 +1697,10 @@ async def create(
         if options is None:
             raise ValueError("E2BSandboxClient.create requires options")
         manifest = manifest if manifest is not None else Manifest()
+        manifest._reject_process_environment_values(
+            backend_id="e2b",
+            supported_alternative="use DockerSandboxClient",
+        )
         self._validate_manifest_for_create(manifest)
 
         sandbox_type = _coerce_sandbox_type(options.sandbox_type)
@@ -1777,6 +1781,10 @@ async def resume(
         if not isinstance(state, E2BSandboxSessionState):
             raise TypeError("E2BSandboxClient.resume expects an E2BSandboxSessionState")
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="e2b",
+            supported_alternative="use DockerSandboxClient instead",
+        )
 
         sandbox_type = _coerce_sandbox_type(state.sandbox_type)
         SandboxClass = _import_sandbox_class(sandbox_type)

src/agents/extensions/sandbox/modal/sandbox.py

@@ -2110,6 +2110,10 @@ async def create(
         if options is None:
             raise ValueError("ModalSandboxClient.create requires options with app_name")
         manifest = manifest if manifest is not None else Manifest()
+        manifest._reject_process_environment_values(
+            backend_id="modal",
+            supported_alternative="use DockerSandboxClient",
+        )
         self._validate_manifest_for_create(manifest)
         app_name = options.app_name
         if not app_name:
@@ -2289,6 +2293,10 @@ async def resume(
         if not isinstance(state, ModalSandboxSessionState):
             raise TypeError("ModalSandboxClient.resume expects a ModalSandboxSessionState")
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="modal",
+            supported_alternative="use DockerSandboxClient instead",
+        )
         if _manifest_has_configured_mount_authority(state.manifest) and not (
             state.mount_authority_rebound
         ):

src/agents/extensions/sandbox/runloop/sandbox.py

@@ -1599,6 +1599,10 @@ async def create(
             if manifest is not None
             else Manifest(root=_default_runloop_manifest_root(user_parameters))
         )
+        manifest._reject_process_environment_values(
+            backend_id="runloop",
+            supported_alternative="use DockerSandboxClient",
+        )
         _validate_runloop_manifest_root(manifest, user_parameters=user_parameters)
         self._validate_manifest_for_create(manifest)
 
@@ -1697,6 +1701,10 @@ async def resume(
         if not isinstance(state, RunloopSandboxSessionState):
             raise TypeError("RunloopSandboxClient.resume expects a RunloopSandboxSessionState")
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="runloop",
+            supported_alternative="use DockerSandboxClient instead",
+        )
 
         devbox = None
         reconnected = False

src/agents/extensions/sandbox/vercel/sandbox.py

@@ -1564,6 +1564,10 @@ async def create(
             _resolve_manifest_root(manifest),
             options.allow_s3_credential_exposure,
         )
+        resolved_manifest._reject_process_environment_values(
+            backend_id="vercel",
+            supported_alternative="use DockerSandboxClient",
+        )
         try:
             self._validate_manifest_for_create(resolved_manifest)
             trusted_s3_mounts = _vercel_s3_mount_map(resolved_manifest)
@@ -1623,6 +1627,10 @@ async def resume(self, state: SandboxSessionState) -> SandboxSession:
         if not isinstance(state, VercelSandboxSessionState):
             raise TypeError("VercelSandboxClient.resume expects a VercelSandboxSessionState")
         state.assert_path_grants_rebound()
+        state.manifest._reject_process_environment_values(
+            backend_id="vercel",
+            supported_alternative="use DockerSandboxClient instead",
+        )
         if state.s3_mounts_non_resumable or _vercel_s3_mounts(state.manifest):
             raise MountConfigError(
                 message=(