sandbox exec_command can run command lists outside the requested workdir #4914

Description

exec_command wraps a requested working directory as cd <workdir> && <cmd>. When <cmd> contains shell-list or background-job operators, later commands can run from the sandbox root instead of the requested directory. If the requested directory does not exist, user commands can still execute from the wrong directory.

Reproduction

With workdir=project and cmd="true; printf expected > marker", a missing project directory still allows marker to be written in the workspace root. With an existing directory and cmd="true & wait; printf expected > marker", the marker can also be written in the workspace root because the background list changes shell precedence.

Impact

Agents using shell command lists can read or write files outside the effective run-scoped working directory. This makes workdir unreliable for ordinary shell commands and can cause task-local artifacts to land in the wrong workspace location.

Proposed direction

Make the directory change a completed shell step before parsing the caller command list, and terminate execution when the directory change fails. Add public-tool regression coverage for semicolon, newline, and background command lists.