fix(plugin): warn on missing kubernetes adapter env

packages/plugins/sandbox-providers/kubernetes/src/manifest.ts

@@ -72,7 +72,7 @@ const manifest: PaperclipPluginManifestV1 = {
           egressAllowCidrs: {
             type: "array",
             items: { type: "string" },
-            description: "Additional CIDRs to allow egress to from agent pods.",
+            description: "Additional CIDRs to allow HTTPS egress to from agent pods. CIDR egress is restricted to TCP port 443.",
           },
           egressMode: {
             type: "string",

packages/plugins/sandbox-providers/kubernetes/src/plugin.ts

@@ -72,11 +72,24 @@ function deriveTenantNamespace(config: KubernetesProviderConfig, companyId: stri
  * TODO: future milestones may thread per-run secrets differently (e.g. via
  * a secret store reference on the environment config).
  */
-function extractAdapterEnvFromProcess(envKeys: string[]): Record<string, string> {
+export function extractAdapterEnvFromProcess(
+  envKeys: string[],
+  warn: (message: string) => void = console.warn,
+): Record<string, string> {
   const out: Record<string, string> = {};
+  const missing: string[] = [];
   for (const k of envKeys) {
     const v = process.env[k];
-    if (v) out[k] = v;
+    if (v) {
+      out[k] = v;
+    } else {
+      missing.push(k);
+    }
+  }
+  if (missing.length > 0) {
+    warn(
+      `[plugin-kubernetes] adapter environment variable(s) missing from plugin worker process: ${missing.join(", ")}. Agent pods may fail provider authentication unless these keys are optional for the selected adapter.`,
+    );
   }
   return out;
 }