Uses @anthropic-ai/sandbox-runtime to enforce filesystem and network restrictions on bash commands (sandbox-exec on macOS, bubblewrap on Linux). Features: - Per-project config via .pi/sandbox.json - Global config via ~/.pi/agent/sandbox.json - Enabled by default with sensible defaults - --no-sandbox flag to disable - /sandbox command to view current config