[BUG] Sandbox silently disabled in SEA binary — ripgrep path resolution fails due to Bun-only detection in k1()/ZY()

Bug Description

Sandbox shows ⚠ sandbox disabled in the /sandbox status line despite sandbox.enabled: true being correctly configured in ~/.claude/settings.json. No error or warning is shown explaining why sandbox failed to activate.

After investigation, the root cause is that socat is not installed on the system. The checkDependencies function silently returns errors, causing isSandboxingEnabled() to return false — with no user-facing indication of which dependency is missing.

This is related to #32285 (same silent failure path, different missing dependency).

Environment

• Claude Code version: 2.1.71
• OS: macOS 26.3.1 (Tahoe), arm64 (Apple Silicon)
• Platform: macOS with Seatbelt (sandbox-exec available at /usr/bin/sandbox-exec)
• Auth: AWS Bedrock (CLAUDE_CODE_USE_BEDROCK=1)
• ripgrep: Installed (v14.1.1)
• socat: NOT installed
• sandbox-exec: Available (/usr/bin/sandbox-exec)

Settings Configuration

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false,
    "network": {
      "allowLocalBinding": true
    }
  }
}

Steps to Reproduce

1. Configure sandbox as shown above in ~/.claude/settings.json
2. Ensure socat is NOT installed (which socat returns not found)
3. Start Claude Code
4. Observe ⚠ sandbox disabled (⏎ to configure) in the status bar
5. No error, no log, no indication that socat is the missing dependency

Expected Behavior

1. Claude Code should clearly warn the user which dependency is missing (e.g., "Sandbox requires socat. Install with brew install socat.")
2. Ideally, the /sandbox command should show a diagnostic with dependency status
3. At minimum, a startup warning should be shown when sandbox.enabled: true but dependencies are missing

Actual Behavior

• Sandbox silently disabled with only a ⚠ icon in the status bar
• No indication of what's wrong or how to fix it
• User is left to reverse-engineer the binary or guess at missing dependencies
• The official docs (https://code.claude.com/docs/en/sandboxing, https://code.claude.com/docs/en/settings#sandbox-settings) do not mention socat as a required dependency for macOS

Workaround

Install socat: brew install socat

(Discovered through investigation, not documented)

Suggested Fix

1. When sandbox.enabled: true and checkDependencies fails, surface the specific missing dependencies in the UI
2. Add socat to the documented macOS sandbox requirements
3. Consider making the /sandbox command show a dependency checklist

Related Issues

• #32285 — Same silent failure path when ripgrep is missing