Improvement: Env var precedence Personal > Project > Agent > Automation

[yannickmonney]

Problem

Environment-variable resolution and its user-facing description do not state (or consistently implement) a single precedence order. The intended priority is:

Personal > Project > Agent > Automation

(higher wins on name collision — personal overrides project, which overrides agent, which overrides automation/workflow.)

That order must be reflected in runtime merge behaviour and in every description/help string that explains env vars.

Current behaviour

• Scopes exist separately: personal (userEnv), project secrets (projectSecrets), agent (agentEnv), automation/workflow (workflowEnv + step env) — see user_env.ts, agent_env.ts, workflow_env.ts, projects/secrets/.
• Shared editor: EnvVarListEditor (app/components/env/env-var-list-editor.tsx).
• Chat / external-agent injection (run_external_agent.ts) flips user vs agent by credential mode (managed → agent wins; BYO → user wins). Project secrets are a separate injection channel, not part of that session-env merge.
• Workflow sandbox merge (merge_sandbox_env.ts / workflow_sandbox_exec.ts) uses workflow < file < step, then agent, then broker — not the Personal > Project > Agent > Automation stack.
• UI copy (workflows.configuration.envHelp, step envHelp, userEnv.page.*, settings.agents.env.description, projectSecrets.*) describes local override behaviour only — none documents Personal > Project > Agent > Automation. Docs docs/en/platform/member/environment.md likewise omit the cross-scope chain.

Proposed change

1. Runtime: Resolve colliding keys in the order Personal > Project > Agent > Automation everywhere sandbox/session env is assembled (chat external-agent turns and workflow sandbox steps), unless a documented security exception (e.g. broker/credential scrub keys) must still win — call those out explicitly.
2. Copy: Update env-var descriptions (settings personal env, agent env, project secrets/agent-access blurb, automation/workflow env help, step env help) and self-host/member docs so they state the same priority in plain language.
3. Keep secret write-only / scrub behaviour intact; only the documented precedence and merge order change.

Acceptance criteria

• On a name collision across scopes, the winning value follows Personal > Project > Agent > Automation (covered by unit/integration tests on the merge helpers).
• Personal, Project, Agent, and Automation/workflow env UI descriptions all state that priority correctly (en + locales).
• Member/docs page for environment variables states the same order.
• Any intentional exceptions (broker creds, protected credential keys) are named in code comments and docs, not left as silent flips.

Affected service

Platform (web app)