From d379fcddf84050849a063b68bc6fdb54f6d4e5fc Mon Sep 17 00:00:00 2001
From: Alex Clarke <alex.j.tusa@gmail.com>
Date: Fri, 24 Jul 2026 16:50:04 -0600
Subject: [PATCH] fix: bypass forgotten sandbox mode check for MCP secret
 interpolation

---
 src/vault/utils.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/vault/utils.rs b/src/vault/utils.rs
index 52b04e3..d329148 100644
--- a/src/vault/utils.rs
+++ b/src/vault/utils.rs
@@ -1,4 +1,5 @@
 use crate::config::ensure_parent_exists;
+use crate::sandbox::SANDBOX_ENV_FLAG;
 use crate::vault::{SECRET_RE, Vault};
 use anyhow::Result;
 use anyhow::anyhow;
@@ -14,6 +15,7 @@ use indoc::formatdoc;
 use inquire::validator::Validation;
 use inquire::{Confirm, Password, PasswordDisplayMode, Select, Text, min_length, required};
 use log::debug;
+use std::env;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
@@ -355,6 +357,9 @@ fn required_cli_preflight(label: &str, cli: &str, install_url: &str) {
 }
 
 pub fn interpolate_secrets(content: &str, vault: &Vault) -> Result<(String, Vec<String>)> {
+    if env::var_os(SANDBOX_ENV_FLAG).is_some() {
+        return Ok((content.to_string(), vec![]));
+    }
     interpolate_secrets_with(content, vault.auth_hint(), |name| {
         vault.get_secret(name, false)
     })