Address comment

packages/core/src/index.ts

@@ -105,6 +105,8 @@ export * from './utils/filesearch/fileSearch.js';
 export * from './utils/errorParsing.js';
 export * from './utils/fastAckHelper.js';
 export * from './utils/workspaceContext.js';
+export * from './utils/envUtils.js';
+export * from './utils/envExpansion.js';
 export * from './utils/environmentContext.js';
 export * from './utils/ignorePatterns.js';
 export * from './utils/partUtils.js';

packages/core/src/services/shellExecutionService.ts

@@ -22,6 +22,7 @@ import {
 import { isBinary, truncateString } from '../utils/textUtils.js';
 import pkg from '@xterm/headless';
 import { debugLogger } from '../utils/debugLogger.js';
+import { parseSandboxEnv } from '../utils/envUtils.js';
 import { Storage } from '../config/storage.js';
 import {
   serializeTerminalToObject,
@@ -426,17 +427,9 @@ export class ShellExecutionService {
     };
 
     // Forward SANDBOX_ENV key=value pairs
-    if (process.env['SANDBOX_ENV']) {
-      for (let env of process.env['SANDBOX_ENV'].split(',')) {
-        if ((env = env.trim())) {
-          const index = env.indexOf('=');
-          if (index > 0) {
-            const key = env.substring(0, index);
-            const value = env.substring(index + 1);
-            baseEnv[key] = value;
-          }
-        }
-      }
+    const sandboxEnv = parseSandboxEnv(process.env['SANDBOX_ENV']);
+    for (const [key, value] of Object.entries(sandboxEnv)) {
+      baseEnv[key] = value;
     }
 
     if (!isInteractive) {

packages/core/src/utils/envUtils.test.ts

@@ -0,0 +1,91 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { describe, it, expect } from 'vitest';
+import { parseSandboxEnv } from './envUtils.js';
+
+describe('parseSandboxEnv', () => {
+  it('should return an empty object for empty input', () => {
+    expect(parseSandboxEnv(undefined)).toEqual({});
+    expect(parseSandboxEnv('')).toEqual({});
+  });
+
+  it('should parse simple key-value pairs', () => {
+    const input = 'KEY1=VALUE1,KEY2=VALUE2';
+    const expected = {
+      KEY1: 'VALUE1',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+
+  it('should handle values with commas using heuristic', () => {
+    const input = 'KEY1=VALUE1,WITH,COMMAS,KEY2=VALUE2';
+    const expected = {
+      KEY1: 'VALUE1,WITH,COMMAS',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+
+  it('should forward host environment variables (limitations noted)', () => {
+    const hostEnv = {
+      HOST_VAR1: 'host_value1',
+      HOST_VAR2: 'host_value2',
+    };
+    // Put forwarded ones first to avoid ambiguity with values containing commas
+    const input = 'HOST_VAR1,KEY2=VALUE2';
+    const expected = {
+      HOST_VAR1: 'host_value1',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input, hostEnv)).toEqual(expected);
+
+    // Note: If a forwarded var follows a KEY=VALUE, it's treated as part of the value
+    const input2 = 'KEY1=VALUE1,HOST_VAR2';
+    const expected2 = {
+      KEY1: 'VALUE1,HOST_VAR2',
+    };
+    expect(parseSandboxEnv(input2, hostEnv)).toEqual(expected2);
+  });
+
+  it('should handle keys and values with spaces (trimmed)', () => {
+    const input = ' KEY1 = VALUE1 , KEY2 = VALUE2 ';
+    const expected = {
+      KEY1: 'VALUE1',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+
+  it('should handle multiple equals signs in a value', () => {
+    const input = 'KEY1=VALUE1=WITH=EQUALS,KEY2=VALUE2';
+    const expected = {
+      KEY1: 'VALUE1=WITH=EQUALS',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+
+  it('should handle commas and equals in the middle (heuristic limitation)', () => {
+    const input = 'KEY1=VALUE1,KEY2=VALUE2';
+    const expected = {
+      KEY1: 'VALUE1',
+      KEY2: 'VALUE2',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+
+  it('should demonstrate the heuristic limitation: equals after comma', () => {
+    // If a value contains '=' after a comma, it will be misparsed as a new key.
+    const input = 'KEY1=foo,bar=baz';
+    const expected = {
+      KEY1: 'foo',
+      bar: 'baz',
+    };
+    expect(parseSandboxEnv(input)).toEqual(expected);
+  });
+});

packages/core/src/utils/envUtils.ts

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Parses a SANDBOX_ENV string into a map of environment variables.
+ *
+ * The input string is a comma-separated list of either:
+ * 1. `KEY=VALUE` pairs.
+ * 2. `HOST_VAR_NAME` which forwards the variable from the host environment.
+ *
+ * Heuristic: A comma is treated as a separator ONLY if the next part contains an `=`.
+ * This allows values to contain commas (e.g., `VAR1=a,b,VAR2=c`).
+ *
+ * Note: If a value contains an `=` after a comma, it will be misparsed as a new key.
+ * This is a known limitation of the heuristic.
+ *
+ * @param input - The SANDBOX_ENV string to parse.
+ * @param hostEnv - The host environment variables (defaults to process.env).
+ * @returns A record of parsed environment variables.
+ */
+export function parseSandboxEnv(
+  input: string | undefined,
+  hostEnv: Record<string, string | undefined> = process.env,
+): Record<string, string> {
+  const result: Record<string, string> = {};
+  if (!input) {
+    return result;
+  }
+
+  let currentPair = '';
+  const parts = input.split(',');
+
+  for (let part of parts) {
+    part = part.trim();
+    if (!part) continue;
+
+    if (part.includes('=')) {
+      // If we have a pending pair, process it first
+      if (currentPair) {
+        const [key, ...valParts] = currentPair.split('=');
+        result[key.trim()] = valParts.join('=').trim();
+      }
+      currentPair = part;
+    } else {
+      if (currentPair) {
+        // This part is a continuation of the previous value (it has a comma)
+        currentPair += ',' + part;
+      } else {
+        // This is a forwarded host variable
+        const val = hostEnv[part];
+        if (val !== undefined) {
+          result[part] = val;
+        }
+      }
+    }
+  }
+
+  // Process the last pair
+  if (currentPair) {
+    const [key, ...valParts] = currentPair.split('=');
+    result[key.trim()] = valParts.join('=').trim();
+  }
+
+  return result;
+}