feat: implement OS-level command sandboxing with bwrap

[hellodk]

Summary

Implements OS-level isolation for terminal command execution using Bubblewrap (bwrap), with graceful fallback to unsandboxed execution when bwrap is unavailable. This PR provides filesystem isolation (read-only system paths, writable work directory) and environment variable filtering (secrets stripped from the child process environment). It does not implement seccomp syscall filtering or network isolation enforcement beyond the --unshare-net flag already present in bwrap — those remain detection-only / best-effort in this PR.

• Adds OSLevelSandbox class
• Detects bwrap availability on Linux systems; detects (but does not enforce) seccomp kernel support
• Executes commands via bwrap with read-only binds for /lib, /lib64, /usr, /bin, plus configurable extra readonly paths, and a bound writable work directory
• Environment variable filtering: strips known secret/credential env vars (AWS_SECRET_ACCESS_KEY, AWS_ACCESS_KEY_ID, DATABASE_PASSWORD, ANTHROPIC_API_KEY, OPENAI_API_KEY, and others) plus a pattern-based denylist (SECRET, TOKEN, API_KEY, ACCESS_KEY, PRIVATE_KEY, PASSWORD, CREDENTIAL) from the environment passed to both the bwrap-sandboxed process and the unsandboxed fallback process. Applied in src/safety/os-level-sandbox.ts (filterSensitiveEnv).
• Graceful fallback to unsandboxed execution when bwrap unavailable
• Integration-ready with existing CommandSandbox for defense-in-depth

Implementation Details

Core Components

• OSLevelSandbox class: Manages OS-level command isolation
• Bwrap integration: Filesystem isolation via read-only/writable binds; network isolation via --unshare-net when restrict_net is set
• Seccomp support: detected (isSeccompSupported) but not enforced — no seccomp filter is generated or applied to the bwrap invocation in this PR
• Environment filtering: filterSensitiveEnv() denies known secret names plus a pattern-based check, applied to every spawned child process (bwrap and fallback)
• Configuration options: readonly paths, tmpfs setup, network isolation flag

Testing

• 23 unit tests covering:
  • Availability detection (bwrap, seccomp)
  • Sandbox configuration
  • Command execution in sandbox
  • Filesystem isolation
  • Capability restrictions
  • Fallback behavior
  • Error handling
  • Environment variable filtering (new): asserts no secret-shaped env var reaches the bwrap child process or the unsandboxed fallback bash child process
• All tests passing (both real bwrap sandboxing and fallback modes, depending on host)

Acceptance Criteria

• OS-level sandboxing implemented with bwrap support (filesystem isolation)
• Seccomp availability detection (enforcement not implemented — tracked separately if needed)
• Graceful fallback to unsandboxed execution
• Secrets stripped from the environment of sandboxed and fallback child processes
• Comprehensive test suite (23 tests)
• All tests passing
• No breaking changes to existing functionality
• Integration-ready for run_terminal tool

Test Plan

Run the unit tests:
```bash
pnpm run test:unit -- test/unit/safety/os-level-sandbox.test.ts
```

Expected: All 23 OSLevelSandbox tests pass, including the environment-variable-filtering tests.

Related Issues

Closes #69

🤖 Generated with Claude Code