Fix environment variable quoting for sandbox commands

- Remove outer double quotes from GIT_SSH_COMMAND value in sandbox-utils.ts
  The value should be raw since bwrap --setenv sets it directly without
  shell interpretation

- Use `env` command instead of export string concatenation in macOS sandbox
  Each VAR=value is now a separate argument that shellquote handles properly,
  avoiding shell parsing issues with values containing spaces or quotes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/sandbox/macos-sandbox-utils.ts

@@ -685,7 +685,7 @@ export function wrapCommandWithSandboxMacOS(
   })
 
   // Generate proxy environment variables using shared utility
-  const proxyEnv = `export ${generateProxyEnvVars(httpProxyPort, socksProxyPort).join(' ')} && `
+  const proxyEnvArgs = generateProxyEnvVars(httpProxyPort, socksProxyPort)
 
   // Use the user's shell (zsh, bash, etc.) to ensure aliases/snapshots work
   // Resolve the full path to the shell binary
@@ -696,13 +696,17 @@ export function wrapCommandWithSandboxMacOS(
   }
   const shell = shellPathResult.stdout.trim()
 
+  // Use `env` command to set environment variables - each VAR=value is a separate
+  // argument that shellquote handles properly, avoiding shell quoting issues
   const wrappedCommand = shellquote.quote([
+    'env',
+    ...proxyEnvArgs,
     'sandbox-exec',
     '-p',
     profile,
     shell,
     '-c',
-    proxyEnv + command,
+    command,
   ])
 
   logForDebugging(

src/sandbox/sandbox-utils.ts

@@ -203,8 +203,9 @@ export function generateProxyEnvVars(
     // Configure Git to use SSH through SOCKS proxy (platform-aware)
     if (getPlatform() === 'macos') {
       // macOS has nc available
+      // Note: No outer quotes - bwrap --setenv sets the value directly without shell interpretation
       envVars.push(
-        `GIT_SSH_COMMAND="ssh -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'"`,
+        `GIT_SSH_COMMAND=ssh -o ProxyCommand='nc -X 5 -x localhost:${socksProxyPort} %h %p'`,
       )
     }