…ox wrap

  · packages/core/src/sandbox/pipeline.ts (NEW)
    - splitClauses(input) — minimal shell parser splitting on && || ; |
      with single-quote / double-quote / backslash awareness.
    - allClausesExcluded(input, excluded) — true iff EVERY clause leader is
      in the excluded list. Prevents `git status && rm -rf /` from bypassing
      the sandbox.
    - 6 unit tests covering quoting, escapes, all-excluded, mixed pipelines.

  · packages/core/src/sandbox/index.ts
    - wrapBashCommand now uses allClausesExcluded() instead of "starts with
      excluded + space". Documented behavior change: only whole-pipeline
      excluded ⇒ bypass.

  · packages/core/src/sandbox/attacks.test.ts
    - Replaced the "pipeline bypass is documented behavior" test with a
      "pipeline NO LONGER bypasses" test pinning the new semantics.
    - Added a positive "all-git pipeline still bypasses" test.

  · packages/core/src/plugins/runtime/subprocess.ts (M5.1-ext)
    - PluginSubprocessOpts.sandbox?: SandboxConfig. When set + enabled,
      wraps the node spawn under sandbox-exec (macOS) or bwrap (Linux).
      Plugin's install dir is added to allowRead automatically.
    - spawnAllPlugins() / SpawnAllOpts plumb the sandbox config through.

  · packages/core/src/plugins/wireup.ts
    - WirePluginsOpts.sandbox passes through to spawnAllPlugins().

  · apps/cli/src/repl.ts + headless.ts
    - Both pass settings.sandbox into wirePlugins() so the user can opt
      plugins into OS sandboxing via settings.json.

Tests: core 416 → 429 (+13: 6 pipeline + attack-test rewrites). Total
463 → 476 passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>