> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openliate.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# [E] Environment & Sandbox Layer

> Safe environment variable resolution, secret masking, and execution sandboxing

## Overview

Layer **`[E]`** manages secret injection, credential resolution, and runtime sandboxing. Implemented in `src/environment/environment.ts` as `EnvironmentResolver`.

***

## Capabilities

### 1. Safe `$VAR` Resolution

Variables prefixed with `$` are dynamically resolved from `process.env` or `.env` files without crashing if missing:

```json agent.json theme={"dark"}
{
  "E": {
    "SARVAM_API_KEY": "$SARVAM_API_KEY",
    "CUSTOM_TOKEN": "$MY_SECRET"
  }
}
```

### 2. Secret Masking

When logging or returning traces, OpenLiate automatically masks sensitive credentials:

* Formats like `sk-...`, `Bearer ...`, or keys matching `SARVAM_API_KEY` are redacted into `sk-***`.

### 3. Sandboxing & Guardrails

* **Domain Whitelisting:** Outbound tool requests can be restricted to authorized domains.
* **Execution Timeouts:** Long-running tool operations are aborted cleanly if they exceed execution timeouts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.