[Cherry-pick] Cherry-pick to release-v0.178.0

[truefoundry-saas]

Automated cherry-pick for release request 93763333-6a02-4c3d-99ce-ad7f94c86a4b.

Source PRs (merged to main):

• fix: point Environments secrets Learn more at sandbox session docs #969
• feat: validate sandbox environment resource limits and enhance form validation #976
• feat: enable sandbox environments by default and remove related featu… #1002

Warning

This PR does not contain the fix yet. The cherry-pick conflicted, so
automation stopped at the first conflicting commit and left the rest out.
GitHub therefore shows this PR as mergeable, with no conflict to resolve —
it carries only the 1 commit(s) that applied before the conflict.
Paste the prompt below into any coding agent that has this repository open.
It checks out this branch, applies the missing commits, and pushes.
Do not merge the PR. The release request checks every commit within a few
minutes (or use "Sync status" on it). The PR is merged when the request is
approved — or, if it is already approved, when a QA member or engineering
admin uses "Retry merge".

Agent prompt — copy from here:

Apply the missing cherry-pick commits onto this pull request. Work only in this repository. Do not merge the pull request and do not open a new one.

Repository: truefoundry/trueforge
Branch to check out and push to: cherry-pick/93763333-6a02-4c3d-99ce-ad7f94c86a4b/release-v0.178.0
Base branch (do not commit onto this directly): release-v0.178.0
The first commit conflicted in: packages/trueforge-ui/test/atoms/draft/AgentRuntimeConfigFields.test.tsx.

Commits still missing, in this order:
1. 95f5c5c5047b12eca493008457865cffcc7e3fb4
2. 6b423685f43554284193f4433a75094c3721ad7b

Steps:
1. Fetch and check out the branch above.
2. For each missing commit, in the order listed, run `git cherry-pick -x <sha>`. Keep the `-x`: the release request confirms a commit from the "cherry picked from" line it writes.
3. If a cherry-pick conflicts, resolve it so that commit's changes land on this branch, then `git add` the resolved files and `git cherry-pick --continue`. Do not skip a commit and do not abort the sequence.
4. Push to the same branch. This pull request updates on its own.
5. Stop. Do not merge the pull request.

Conflicting file(s):

• packages/trueforge-ui/test/atoms/draft/AgentRuntimeConfigFields.test.tsx

Commits still to apply (starting at the conflict):

• 95f5c5c5047b12eca493008457865cffcc7e3fb4
• 6b423685f43554284193f4433a75094c3721ad7b

Do not merge manually — this PR is merged automatically when the release request is approved. If you do merge it yourself, use "Sync status" on the request so it stops showing as pending.

---

Note

Medium Risk
Changes default UI exposure and sandbox environment write validation/resource caps, which can reject previously accepted manifests or surface Environments UI where it was off.

Overview
Sandbox Environments is always on in the product: the VITE_SANDBOX_ENVIRONMENTS_ENABLED build flag, Docker ARG, and sandboxEnvironments server config are removed, and the TrueForge adapter always wires sandboxEnvironments. Composer and agent runtime always show environment selection and the Environments tab (no gating on an optional server port).

API and validation tighten sandbox environment manifests: env var keys must match ^[A-Za-z_][A-Za-z0-9_]*$ with length caps on names, values, domain allow lists, and secret lists; PUT rejects CPU/memory/disk above new env-configured maxima (SANDBOX_ENVIRONMENT_*_MAX, documented in .env.example). OpenAPI and route 400 descriptions reflect resource allocation errors.

Docs UX: the Environments secrets “Learn more” link targets the sandbox docs section on how changes reach a running session. Tests drop coverage for the removed feature flag.

^{Reviewed by Cursor Bugbot for commit aa4ba25. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: aa4ba25

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@truefoundry/trueforge	Patch
@truefoundry/trueforge-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit aa4ba25. Configure here.}

[cursor]

Stored env schema tightened without migration

Medium Severity

New env-var and secret-name constraints live on the shared manifest fields that StoredSandboxEnvironmentManifestSchema parses on every store read. Existing rows with empty values, hyphenated or dotted keys, long domain_allow_list strings, or non-matching secret env names now fail parseStoredSandboxEnvironmentManifest, which can 500 list, get, and sandbox resolve. Resource caps correctly stay on the PUT schema only.

Additional Locations (1)

• packages/trueforge/src/schemas/sandboxEnvironment.ts#L70-L104

 

^{Triggered by project rule: @truefoundry/trueforge review rules}

^{Reviewed by Cursor Bugbot for commit aa4ba25. Configure here.}