feat(claude-code-plugin): add cos exec for remote code

[pratikbin]

What

New cos exec verb and /createos-sandbox:exec slash command: run untrusted code or any ad-hoc script as one source file in a throwaway CreateOS box, instead of on the user's machine.

cos exec -i input.txt solution.py --flag=x     # stdin from file, args passed untouched
cos exec -t 10 -N suspect.js                    # 10 s limit, outbound blocked
cos exec -l py - <<'PY'                         # code on stdin
print(sum(range(10)))
PY

• Languages: py js mjs cjs ts go sh rb c cpp rs (from extension or -l)
• stdout/stderr pass through; exit code is the program's; -t wall-clock limit (default 120 s, exit 124); cos: exit=N time=Ns on stderr
• Egress open by default (snippets often call APIs); -p/-e restrict, -N denies via an unroutable IP rule (IP rules apply immediately)
• Box auto-destroys on every exit path

Skill description + "when to reach" table now steer Claude to exec for untrusted code and ad-hoc scripts. Model: fc-sdk/examples/56-remote-code-execution.

Review

Codex adversarial review findings addressed:

• program args after <file> were rewritten by the long-option normalizer → exec no longer normalizes
• .js was forced into ESM → runs as main.js; .mjs/.cjs separate
• slash command || fallback masked failed runs → if/else

Known, deferred: -N blocks connections but DNS lookups may still resolve, so it is not a hard exfiltration guarantee.

Verified live

Python with stdin/args/non-zero exit, --k=v args untouched, CJS require/__dirname, Go, TS, JS infinite loop → 124, egress open by default vs -N blocked, slash-command exit code preserved, zero leaked boxes.

Follow-ups

• Docs: Integrations/Claude-Code.mdx in createos-v2-landing does not list exec yet
• Other commands/*.md share the || exit-masking fallback