isExecutionForcedToKubernetes (services/execution-allowlist.ts)

* Pure execution-allowlist guard. Decides whether a candidate execution environment is permitted to run an agent, given the instance-level execution policy. This is security-critical: on a shared cloud instance we FORCE all untrusted tenant agents onto the Kubernetes sandbox-prov

// Source: https://github.com/paperclipai/paperclip | License: MIT | Copyright 2025 Paperclip AI
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Pure execution-allowlist guard.
 *
 * Decides whether a candidate execution environment is permitted to run an
 * agent, given the instance-level execution policy. This is security-critical:
 * on a shared cloud instance we FORCE all untrusted tenant agents onto the
 * Kubernetes sandbox-provider and REFUSE local/in-process execution so that a
 * tenant agent can never run inside the server process or on an unsandboxed
 * local/ssh adapter.
 *
 * The merged tree's environment model represents the Kubernetes sandbox as a
 * core `driver: "sandbox"` environment whose `config.provider` is the plugin's
 * `driverKey` ("kubernet

... (truncated -- full source via MCP)