fix: prove Linux Agent sandbox boundary

hub/deploy/README.md

@@ -1,8 +1,8 @@
 # Hub service installation
 
 The initial production target is a supported Linux host with systemd,
-PostgreSQL, Node.js 20 or newer, `pg_isready`, `runuser`, `setpriv`, bubblewrap
-and `cph`. The Hub runs as the dedicated non-login `cph-hub` user; do not
+PostgreSQL, Node.js 20 or newer, `pg_isready`, `runuser`, `setpriv`, bubblewrap,
+`socat` and `cph`. The Hub runs as the dedicated non-login `cph-hub` user; do not
 create or run the unit as root.
 
 Build or deploy the Hub under `/srv/curriculum-project-hub`, then run:
@@ -18,13 +18,13 @@ On a clean host the first invocation creates
 production key and exits with status 78. Fill every required blank, set
 `CPH_BIN` to an executable compatible `cph`, keep the file mode at `0600`, and
 run the same command again. No systemd unit is installed until configuration,
-paths, Node, bubblewrap, `cph --version`, PostgreSQL connectivity and directory
+paths, Node, bubblewrap, `socat`, `cph --version`, PostgreSQL connectivity and directory
 ownership all pass preflight.
 
 An existing service account is accepted only when its primary group, home and
 non-login shell match the requested configuration and it has no supplementary
 groups. After provisioning, the installer executes path-access, built Hub,
-Prisma, an authenticated database query, `cph` and bubblewrap namespace probes
+Prisma, an authenticated database query, `cph`, `socat` and bubblewrap namespace probes
 as that account with `no_new_privs` set. Inaccessible parents, UID-specific
 database/network policy, or a host that forbids unprivileged user namespaces
 therefore fail before unit installation.

hub/deploy/cph-hub.service

@@ -6,6 +6,7 @@ Wants=network-online.target
 # after installation. Deployment preflight validates the executable itself;
 # this start-time assertion keeps later package/host changes fail-closed.
 AssertPathExists=__BWRAP_BIN__
+AssertPathExists=__SOCAT_BIN__
 
 [Service]
 Type=simple

hub/deploy/deploy_platform.sh

@@ -9,7 +9,7 @@
 #   PLATFORM_DEPLOY_BASE     optional, defaults to /srv/curriculum-project-hub
 #   PLATFORM_DEPLOY_HEALTH_URL optional, defaults to http://127.0.0.1:8788/api/healthz
 # The target host must have Node.js 20+, npm, rsync, PostgreSQL client tools
-# (`pg_isready`), systemd, bubblewrap (`bwrap`, for the ADR-0018 agent sandbox),
+# (`pg_isready`), systemd, bubblewrap (`bwrap`) and `socat` (for the ADR-0018 agent sandbox),
 # and a compatible `cph` binary named by platform.env. The service installer
 # provisions the dedicated non-root identity and persistent directories.
 # Use a dedicated `deploy` user that has passwordless sudo for systemctl and

hub/deploy/install_service.sh

@@ -24,13 +24,14 @@ ENV_FILE="${ENV_FILE:-$BASE/.secrets/platform.env}"
 SYSTEMD_UNIT_DIR="${SYSTEMD_UNIT_DIR:-/etc/systemd/system}"
 NODE_BIN="${NODE_BIN:-$(command -v node || true)}"
 BWRAP_BIN="${BWRAP_BIN:-$(command -v bwrap || true)}"
+SOCAT_BIN="${SOCAT_BIN:-$(command -v socat || true)}"
 PG_ISREADY_BIN="${PG_ISREADY_BIN:-$(command -v pg_isready || true)}"
 RUNUSER_BIN="${RUNUSER_BIN:-$(command -v runuser || true)}"
 SETPRIV_BIN="${SETPRIV_BIN:-$(command -v setpriv || true)}"
 CPH_BIN_DEFAULT="${CPH_BIN_DEFAULT:-/usr/local/bin/cph}"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PREFLIGHT_JS="$HUB_DIR/dist/deployment/preflight-cli.js"
-RUNTIME_PATH="$(dirname "$NODE_BIN"):$(dirname "$BWRAP_BIN"):$(dirname "$SETPRIV_BIN"):/usr/local/bin:/usr/bin:/bin"
+RUNTIME_PATH="$(dirname "$NODE_BIN"):$(dirname "$BWRAP_BIN"):$(dirname "$SOCAT_BIN"):$(dirname "$SETPRIV_BIN"):/usr/local/bin:/usr/bin:/bin"
 
 fail() {
   echo "[install] error: $*" >&2
@@ -68,6 +69,7 @@ done
 for pair in \
   "NODE_BIN:$NODE_BIN" \
   "BWRAP_BIN:$BWRAP_BIN" \
+  "SOCAT_BIN:$SOCAT_BIN" \
   "PG_ISREADY_BIN:$PG_ISREADY_BIN"; do
   label="${pair%%:*}"
   value="${pair#*:}"
@@ -98,6 +100,7 @@ for pair in \
   "SYSTEMD_UNIT_DIR:$SYSTEMD_UNIT_DIR" \
   "NODE_BIN:$NODE_BIN" \
   "BWRAP_BIN:$BWRAP_BIN" \
+  "SOCAT_BIN:$SOCAT_BIN" \
   "RUNUSER_BIN:$RUNUSER_BIN" \
   "SETPRIV_BIN:$SETPRIV_BIN" \
   "RUNTIME_PATH:$RUNTIME_PATH"; do
@@ -152,6 +155,7 @@ PREFLIGHT_ARGS=(
   --cache-dir "$CACHE_DIR"
   --workspace-root "$WORKSPACE_ROOT"
   --bwrap-bin "$BWRAP_BIN"
+  --socat-bin "$SOCAT_BIN"
   --pg-isready-bin "$PG_ISREADY_BIN"
 )
 
@@ -247,6 +251,7 @@ sed \
   -e "s|__ENV_FILE__|$ENV_FILE|g" \
   -e "s|__NODE_BIN__|$NODE_BIN|g" \
   -e "s|__BWRAP_BIN__|$BWRAP_BIN|g" \
+  -e "s|__SOCAT_BIN__|$SOCAT_BIN|g" \
   -e "s|__RUNTIME_PATH__|$RUNTIME_PATH|g" \
   "$SCRIPT_DIR/cph-hub.service" >"$TMP_UNIT"
 install -o root -g root -m 0644 "$TMP_UNIT" "$UNIT"

hub/src/agent/diagnostics.ts

@@ -0,0 +1,115 @@
+const MAX_LOGGED_CHARS = 8_000;
+const MAX_LOGGED_LINES = 20;
+const MAX_LINE_CHARS = 2_000;
+const MAX_PENDING_LINE_CHARS = 16_000;
+
+interface DiagnosticLogger {
+  warn(bindings: Readonly<Record<string, unknown>>, message: string): void;
+}
+
+export interface AgentSdkStderrSink {
+  readonly write: (data: string) => void;
+  readonly flush: () => void;
+}
+
+/**
+ * Turn the SDK subprocess stderr stream into bounded, run-correlated logs.
+ * Complete lines are buffered so a credential split across chunks is still
+ * removed before anything reaches the logger.
+ */
+export function createAgentSdkStderrSink(input: {
+  readonly logger: DiagnosticLogger;
+  readonly runId: string;
+  readonly projectId: string;
+  readonly sensitiveValues: readonly (string | undefined)[];
+}): AgentSdkStderrSink {
+  const secrets = [...new Set(input.sensitiveValues.filter((value): value is string => value !== undefined && value !== ""))]
+    .sort((left, right) => right.length - left.length);
+  let pending = "";
+  let droppingOversizedLine = false;
+  let remainingChars = MAX_LOGGED_CHARS;
+  let remainingLines = MAX_LOGGED_LINES;
+  let limitReported = false;
+
+  const reportLimit = (): void => {
+    if (limitReported) return;
+    limitReported = true;
+    input.logger.warn(
+      { runId: input.runId, projectId: input.projectId },
+      "agent SDK stderr log limit reached; further diagnostics omitted",
+    );
+  };
+
+  const emit = (line: string): void => {
+    if (line.trim() === "") return;
+    if (remainingChars <= 0 || remainingLines <= 0) {
+      reportLimit();
+      return;
+    }
+    const redacted = redactDiagnostic(line, secrets);
+    const allowed = Math.min(MAX_LINE_CHARS, remainingChars);
+    const diagnostic = boundedDiagnostic(redacted, allowed);
+    remainingChars -= diagnostic.length;
+    remainingLines--;
+    input.logger.warn(
+      { runId: input.runId, projectId: input.projectId, sdkStderr: diagnostic },
+      "agent SDK stderr",
+    );
+    if (redacted.length > allowed || remainingChars <= 0 || remainingLines <= 0) reportLimit();
+  };
+
+  const append = (fragment: string): void => {
+    if (fragment === "" || droppingOversizedLine) return;
+    if (pending.length + fragment.length > MAX_PENDING_LINE_CHARS) {
+      pending = "";
+      droppingOversizedLine = true;
+      emit("[oversized stderr line omitted]");
+      return;
+    }
+    pending += fragment;
+  };
+
+  const write = (data: string): void => {
+    let lineStart = 0;
+    for (let index = 0; index < data.length; index++) {
+      const character = data[index];
+      if (character !== "\n" && character !== "\r") continue;
+      append(data.slice(lineStart, index));
+      if (!droppingOversizedLine) emit(pending);
+      pending = "";
+      droppingOversizedLine = false;
+      if (character === "\r" && data[index + 1] === "\n") index++;
+      lineStart = index + 1;
+    }
+    append(data.slice(lineStart));
+  };
+
+  const flush = (): void => {
+    if (droppingOversizedLine) {
+      droppingOversizedLine = false;
+    } else {
+      emit(pending);
+    }
+    pending = "";
+  };
+
+  return { write, flush };
+}
+
+function boundedDiagnostic(value: string, limit: number): string {
+  if (value.length <= limit) return value;
+  const marker = "…[truncated]";
+  if (limit <= marker.length) return marker.slice(0, limit);
+  return `${value.slice(0, limit - marker.length)}${marker}`;
+}
+
+function redactDiagnostic(value: string, secrets: readonly string[]): string {
+  let redacted = value;
+  for (const secret of secrets) redacted = redacted.replaceAll(secret, "[REDACTED]");
+  return redacted
+    .replace(/\u001B\[[0-?]*[ -/]*[@-~]/g, "")
+    .replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, " ")
+    .replace(/\b(postgres(?:ql)?):\/\/([^:\s/@]+):([^@\s]+)@/gi, "$1://$2:[REDACTED]@")
+    .replace(/\b((?:api[_-]?key|token|secret|password)\s*[:=]\s*)\S+/gi, "$1[REDACTED]")
+    .trim();
+}

hub/src/agent/runner.ts

@@ -19,11 +19,12 @@
  *
  * ADR-0018: the agent execution surface is bounded by the run's workspace.
  * The SDK sandbox (bubblewrap on Linux, seatbelt on macOS) confines the Claude
- * Code process and its subprocesses at the OS level — writes are confined to
- * the workspace, host reads are denied by default and re-opened only for the
- * workspace plus named system runtimes, and `failIfUnavailable` hard-fails if
- * the sandbox can't start. The subprocess gets a minimal environment and SDK
- * credential protection removes provider secrets from Bash. This upholds `AgentFileOp.Authorized`
+ * Code process and its subprocesses at the OS level — writes, including the
+ * SDK's Unix-socket scratch, are confined to the workspace. Host reads are
+ * denied by default and re-opened only for the workspace plus named system
+ * runtimes, and `failIfUnavailable` hard-fails if the sandbox can't start. The
+ * subprocess gets a minimal environment and SDK credential protection removes
+ * provider secrets from Bash. This upholds `AgentFileOp.Authorized`
  * (ADR-0018 / `Spec.System.AgentSurface`) without re-implementing the
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
  * is the mechanism, the contract pins the invariant.
@@ -70,6 +71,8 @@ export interface RunRequest {
   readonly sessionId: string;
   readonly prisma: PrismaClient;
   readonly onStream?: StreamCallback;
+  /** Optional diagnostic sink for Claude SDK subprocess stderr. */
+  readonly onSdkStderr?: ((data: string) => void) | undefined;
   /**
    * Abort controller for the run. Aborting the signal interrupts the SDK query
    * (it stops the agent loop and cleans up); the run resolves with status
@@ -153,6 +156,7 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
     if (req.resumeSessionId !== undefined) options.resume = req.resumeSessionId;
     if (req.mcpServers !== undefined) options.mcpServers = req.mcpServers;
     if (req.abortController !== undefined) options.abortController = req.abortController;
+    if (req.onSdkStderr !== undefined) options.stderr = req.onSdkStderr;
 
     const conversation = query({
       prompt: req.prompt,

hub/src/agent/security.ts

@@ -21,7 +21,10 @@ const SAFE_HOST_ENV_KEYS = [
   "CPH_BIN",
 ] as const;
 
-const PROVIDER_SECRET_ENV_KEYS = ["ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_API_KEY"] as const;
+const SANDBOX_HIDDEN_ENV_KEYS = [
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+] as const;
 
 export interface AgentSecurityInput {
   readonly workspaceRoot: string;
@@ -37,6 +40,7 @@ export interface AgentSandboxPolicy {
   readonly allowUnsandboxedCommands: false;
   readonly filesystem: {
     readonly allowWrite: string[];
+    readonly denyWrite: string[];
     readonly denyRead: string[];
     readonly allowRead: string[];
   };
@@ -61,12 +65,16 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   const hostEnv = input.hostEnv ?? process.env;
   const { workspaceRoot, workspaceDir } = await resolveProjectWorkspace(input.workspaceRoot, input.workspaceDir);
 
-  const runtimeRoot = await ensureDirectoryTree(workspaceDir, [".cph", "agent-runtime"]);
+  const cphRoot = await ensureDirectoryTree(workspaceDir, [".cph"]);
+  const runtimeRoot = await ensureDirectoryTree(cphRoot, ["agent-runtime"]);
   const agentHome = await ensureDirectoryTree(runtimeRoot, ["home"]);
   const agentCache = await ensureDirectoryTree(runtimeRoot, ["cache"]);
   const agentConfig = await ensureDirectoryTree(runtimeRoot, ["config"]);
   const agentState = await ensureDirectoryTree(runtimeRoot, ["state"]);
-  const agentTmp = await ensureDirectoryTree(runtimeRoot, ["tmp"]);
+  // Keep the SDK temp root both short enough for Linux AF_UNIX sockets and
+  // physically inside the project boundary pinned by AgentFileOp.Authorized.
+  const agentTmp = await ensureDirectoryTree(cphRoot, ["t"]);
+  const claudeCodeTmp = join(".cph", "t");
 
   const path = hostEnv["PATH"]?.trim();
   if (path === undefined || path === "") {
@@ -82,11 +90,14 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
   env.XDG_CACHE_HOME = agentCache;
   env.XDG_CONFIG_HOME = agentConfig;
   env.XDG_STATE_HOME = agentState;
+  // General subprocess temp paths stay absolute so tools continue to work
+  // after `cd`. Only the SDK's socket prefix is relative: Claude resolves it
+  // from the canonical workspace cwd before Bash commands can change cwd.
   env.TMPDIR = agentTmp;
   env.TMP = agentTmp;
   env.TEMP = agentTmp;
   env.CLAUDE_CONFIG_DIR = agentConfig;
-  env.CLAUDE_CODE_TMPDIR = agentTmp;
+  env.CLAUDE_CODE_TMPDIR = claudeCodeTmp;
   env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1";
   env.DISABLE_TELEMETRY = "1";
   env.DO_NOT_TRACK = "1";
@@ -112,6 +123,10 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
       allowUnsandboxedCommands: false,
       filesystem: {
         allowWrite: [workspaceDir],
+        // Reject every write path by default, then re-open only the canonical
+        // workspace. This prevents bubblewrap's ordinary temp exceptions from
+        // turning an unauthorized path into a successful ephemeral write.
+        denyWrite: ["/"],
         // Deny host reads by default, then re-open exactly this run's
         // workspace plus the named system runtime needed to execute tools.
         // SDK allowRead takes precedence over matching denyRead paths.
@@ -120,7 +135,7 @@ export async function createAgentSecurityPolicy(input: AgentSecurityInput): Prom
       },
       credentials: {
         files: sensitiveReadPaths.map((path) => ({ path, mode: "deny" as const })),
-        envVars: PROVIDER_SECRET_ENV_KEYS.map((name) => ({ name, mode: "deny" as const })),
+        envVars: SANDBOX_HIDDEN_ENV_KEYS.map((name) => ({ name, mode: "deny" as const })),
       },
     },
   };
@@ -144,8 +159,10 @@ function hostRuntimeReadPaths(env: Readonly<Record<string, string | undefined>>)
       ]
     : [
         "/bin",
+        "/sbin",
         "/usr/bin",
         "/usr/local/bin",
+        "/usr/sbin",
         "/lib",
         "/lib64",
         "/usr/lib",

hub/src/deployment/preflight-cli.ts

@@ -29,6 +29,7 @@ interface Options {
   readonly cacheDir: string;
   readonly workspaceRoot: string;
   readonly bwrapBin: string;
+  readonly socatBin: string;
   readonly pgIsReadyBin: string;
   readonly serviceUid?: number;
   readonly serviceGid?: number;
@@ -50,6 +51,7 @@ async function main(): Promise<void> {
   await validateExecutable(options.runuserBin, "runuser");
   await validateExecutable(options.setprivBin, "setpriv");
   await validateExecutable(options.bwrapBin, "bubblewrap");
+  await validateExecutable(options.socatBin, "socat");
   await validateExecutable(result.cphBin, "cph");
   await validateExecutable(options.pgIsReadyBin, "pg_isready");
   await validateCph(result.cphBin);
@@ -257,7 +259,7 @@ async function validateServiceRuntime(
     HOME: configuredInput.serviceHome,
     XDG_STATE_HOME: configuredInput.stateDir,
     XDG_CACHE_HOME: configuredInput.cacheDir,
-    PATH: [dirname(options.nodeBin), dirname(options.bwrapBin), dirname(result.cphBin), "/usr/bin", "/bin"].join(":"),
+    PATH: [dirname(options.nodeBin), dirname(options.bwrapBin), dirname(options.socatBin), dirname(result.cphBin), "/usr/bin", "/bin"].join(":"),
   };
   const pathAccessRequirements = (input: DeploymentPreflightInput) => [
     [input.hubDir, constants.R_OK | constants.X_OK],
@@ -278,6 +280,7 @@ async function validateServiceRuntime(
     ...pathAccessRequirements(canonicalInput),
     [options.nodeBin, constants.X_OK],
     [options.bwrapBin, constants.X_OK],
+    [options.socatBin, constants.X_OK],
     [options.setprivBin, constants.X_OK],
     [result.cphBin, constants.X_OK],
   ] as const;
@@ -315,6 +318,7 @@ async function validateServiceRuntime(
     "Hub dependency and authenticated database probe",
   );
   await runAsService(options, serviceEnv, result.cphBin, ["--version"], "cph runtime probe");
+  await runAsService(options, serviceEnv, options.socatBin, ["-V"], "socat runtime probe");
   await runAsService(
     options,
     serviceEnv,
@@ -390,6 +394,7 @@ function parseArgs(argv: readonly string[]): Options {
     "--cache-dir",
     "--workspace-root",
     "--bwrap-bin",
+    "--socat-bin",
     "--pg-isready-bin",
     "--service-uid",
     "--service-gid",
@@ -417,6 +422,7 @@ function parseArgs(argv: readonly string[]): Options {
     cacheDir: required(values, "--cache-dir"),
     workspaceRoot: required(values, "--workspace-root"),
     bwrapBin: required(values, "--bwrap-bin"),
+    socatBin: required(values, "--socat-bin"),
     pgIsReadyBin: required(values, "--pg-isready-bin"),
     ...(serviceUid === undefined ? {} : { serviceUid, serviceGid: serviceGid! }),
   };

hub/src/feishu/trigger.ts

@@ -35,6 +35,7 @@ import { acquireLock, currentLockRunId, releaseLock } from "../lock.js";
 import { createPermissionAuthorizer, type AuthorizationDecision, type PermissionAuthorizer } from "../permission.js";
 import { writeAudit } from "../audit.js";
 import { formatRunCostLine } from "../agent/cost.js";
+import { createAgentSdkStderrSink } from "../agent/diagnostics.js";
 import { StreamingAgentCard } from "./card/streaming-card.js";
 import { createFileDeliveryMcpServer } from "./fileDeliveryTool.js";
 import { readFeishuContext } from "./read.js";
@@ -331,6 +332,12 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     // stop the SDK query. Cleared in the finally below.
     const abortController = new AbortController();
     activeRuns.set(run.id, abortController);
+    const sdkStderr = createAgentSdkStderrSink({
+      logger: deps.logger,
+      runId: run.id,
+      projectId,
+      sensitiveValues: Object.values(provider.sdkEnv),
+    });
     runAgent({
       prompt: promptForAgent,
       model,
@@ -345,6 +352,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       sessionId: session.id,
       prisma: deps.prisma,
       abortController,
+      onSdkStderr: sdkStderr.write,
       onStream: (event) => {
         switch (event.type) {
           case "text-delta":
@@ -433,6 +441,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
         await writeAudit(deps.prisma, { runId: run.id, projectId, action: "run.failed", metadata: { error: String(e) } });
       })
       .finally(async () => {
+        sdkStderr.flush();
         try {
           await releaseLock(deps.prisma, run.id);
         } catch (e) {

hub/test/integration/agent-sandbox-linux.test.ts

@@ -1,6 +1,7 @@
 import { execFile } from "node:child_process";
+import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { access, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, realpath, rm, writeFile } from "node:fs/promises";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
 import { join } from "node:path";
 import { promisify } from "node:util";
@@ -25,25 +26,36 @@ describe("real Claude SDK sandbox boundary", () => {
 
   itOnLinux("denies sibling workspace, service files, credentials, and unsandboxed Bash while cph still works", async () => {
     await access("/usr/bin/bwrap", constants.X_OK);
+    await access("/usr/bin/socat", constants.X_OK);
     const noNewPrivilegesStatus = await readFile("/proc/self/status", "utf8");
     expect(noNewPrivilegesStatus).toMatch(/^NoNewPrivs:\s+1$/m);
+    expect(noNewPrivilegesStatus).toMatch(/^CapEff:\s+0+$/m);
+    expect(process.getuid?.()).toBeGreaterThan(0);
 
     const { stdout: cphPathOutput } = await execFileAsync("/usr/bin/which", ["cph"]);
     const cphBin = cphPathOutput.trim();
     await access(cphBin, constants.X_OK);
 
-    // Keep CLAUDE_CODE_TMPDIR short enough for the SDK's AF_UNIX socket paths;
-    // otherwise the SDK deliberately falls back to shared /tmp.
-    const root = await mkdtemp("/tmp/cph-");
-    roots.push(root);
+    // CI provisions this runner-owned root below /var/lib before dropping into
+    // no_new_privs. Keeping the fixture out of /tmp proves that an SDK-wide
+    // temp exception cannot make a cross-project escape look contained.
+    const configuredTestRoot = process.env["CPH_SANDBOX_TEST_ROOT"]?.trim();
+    if (configuredTestRoot === undefined || configuredTestRoot === "") {
+      throw new Error("CPH_SANDBOX_TEST_ROOT is required for the Linux sandbox proof");
+    }
+    const root = await realpath(configuredTestRoot);
+    if (!root.startsWith("/var/lib/")) {
+      throw new Error(`CPH_SANDBOX_TEST_ROOT must be below /var/lib: ${root}`);
+    }
+    const nonce = randomUUID().replaceAll("-", "");
     const workspaceRoot = join(root, "workspaces");
-    const workspace = join(workspaceRoot, "org-a", "project-a");
-    const sibling = join(workspaceRoot, "org-b", "project-b");
-    const serviceSecret = join(root, "service-secrets", "platform.env");
+    const workspace = join(workspaceRoot, "org-a", `project_${nonce}`);
+    const sibling = join(workspaceRoot, "org-b", `project_${randomUUID().replaceAll("-", "")}`);
+    const serviceSecret = join(root, `service-secret-${nonce}`);
+    roots.push(workspace, sibling, serviceSecret);
     await Promise.all([
       mkdir(workspace, { recursive: true }),
       mkdir(sibling, { recursive: true }),
-      mkdir(join(root, "service-secrets"), { recursive: true }),
     ]);
     await Promise.all([
       writeFile(join(workspace, "allowed.txt"), "allowed\n"),
@@ -57,8 +69,14 @@ describe("real Claude SDK sandbox boundary", () => {
     const canonicalSibling = await realpath(sibling);
     const canonicalServiceSecret = await realpath(serviceSecret);
     const resultPath = join(canonicalWorkspace, "sandbox-result.txt");
+    const cphVersionPath = join(canonicalWorkspace, "cph-version.txt");
+    const effectiveTempProbePath = join(canonicalWorkspace, ".cph", "t", "effective-temp.txt");
+    const denialLogPath = join(canonicalWorkspace, ".cph", "t", "denials.log");
     const siblingEscapePath = join(canonicalSibling, "escape.txt");
-    const unsandboxedEscapePath = join(await realpath(root), "unsandboxed-escape.txt");
+    const unsandboxedEscapePath = join(root, `unsandboxed-escape-${nonce}`);
+    const hostTmpEscapePath = `/tmp/cph-host-temp-${nonce}`;
+    const hostVarTmpEscapePath = `/var/tmp/cph-host-temp-${nonce}`;
+    roots.push(unsandboxedEscapePath, hostTmpEscapePath, hostVarTmpEscapePath);
 
     setHostEnv({
       CPH_BIN: cphBin,
@@ -70,21 +88,32 @@ describe("real Claude SDK sandbox boundary", () => {
 
     const bashCommand = [
       "set -eu",
+      `if printf 'unsafe\\n' > ${shellQuote(unsandboxedEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 31; fi`,
       `test "$(cat ${shellQuote(join(canonicalWorkspace, "allowed.txt"))})" = "allowed"`,
-      `if cat ${shellQuote(join(canonicalSibling, "secret.txt"))} >/dev/null 2>&1; then exit 21; fi`,
-      `if printf 'escape\\n' > ${shellQuote(siblingEscapePath)} 2>/dev/null; then exit 22; fi`,
-      `if cat ${shellQuote(canonicalServiceSecret)} >/dev/null 2>&1; then exit 23; fi`,
+      `if sibling_value=$(cat ${shellQuote(join(canonicalSibling, "secret.txt"))} 2>> ${shellQuote(denialLogPath)}); then exit 21; fi`,
+      `if printf 'escape\\n' > ${shellQuote(siblingEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 32; fi`,
+      `if service_value=$(cat ${shellQuote(canonicalServiceSecret)} 2>> ${shellQuote(denialLogPath)}); then exit 23; fi`,
+      `mkdir ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
+      `cd ${shellQuote(join(canonicalWorkspace, "subdir"))}`,
+      `test "\${TMPDIR-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
+      `test "\${TMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
+      `test "\${TEMP-unset}" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
+      'test "${CLAUDE_CODE_TMPDIR-unset}" = ".cph/t"',
+      `test "$(realpath "$TMPDIR")" = ${shellQuote(join(canonicalWorkspace, ".cph", "t"))}`,
+      `printf 'workspace-temp\\n' > "$TMPDIR/effective-temp.txt"`,
+      `if printf 'host-temp\\n' > ${shellQuote(hostTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 33; fi`,
+      `if printf 'host-var-temp\\n' > ${shellQuote(hostVarTmpEscapePath)} 2>> ${shellQuote(denialLogPath)}; then exit 34; fi`,
       'test "${DATABASE_URL-unset}" = unset',
       'test "${FEISHU_APP_SECRET-unset}" = unset',
       'test "${HUB_SESSION_SECRET-unset}" = unset',
       'test "${ANTHROPIC_AUTH_TOKEN-unset}" = unset',
       'test "${ANTHROPIC_API_KEY-unset}" = unset',
-      "cph --version | grep '^cph '",
+      `cph --version > ${shellQuote(cphVersionPath)}`,
       `printf 'sandbox-ok\\n' > ${shellQuote(resultPath)}`,
     ].join("\n");
-    const bypassCommand = `printf 'unsafe\\n' > ${shellQuote(unsandboxedEscapePath)}`;
-    const stub = await startAnthropicStub(bypassCommand, bashCommand);
+    const stub = await startAnthropicStub(bashCommand);
     const streamEvents: StreamEvent[] = [];
+    const sdkStderr: string[] = [];
     try {
       const result = await runAgent({
         prompt: "Run the supplied sandbox boundary probe.",
@@ -110,20 +139,33 @@ describe("real Claude SDK sandbox boundary", () => {
           agentMessage: { create: async () => ({}) },
         } as unknown as import("@prisma/client").PrismaClient,
         onStream: (event) => streamEvents.push(event),
+        onSdkStderr: (data) => sdkStderr.push(data),
       });
 
-      expect(result).toMatchObject({ status: "completed" });
-      expect(stub.requestCount()).toBeGreaterThanOrEqual(3);
+      expect(
+        result.status,
+        [result.error, sdkStderr.join(""), JSON.stringify(streamEvents)].filter(Boolean).join("\n"),
+      ).toBe("completed");
+      expect(stub.requestCount()).toBeGreaterThanOrEqual(2);
       const toolResults = streamEvents.filter((event) => event.type === "tool-result");
-      expect(toolResults).toHaveLength(2);
-      expect(toolResults[0]).toMatchObject({ isError: true });
-      const sandboxedResult = toolResults[1];
+      expect(toolResults).toHaveLength(1);
+      const sandboxedResult = toolResults[0];
       expect(sandboxedResult?.type).toBe("tool-result");
       if (sandboxedResult?.type !== "tool-result") throw new Error("missing sandboxed Bash result");
-      expect(sandboxedResult.isError, sandboxedResult.result).toBe(false);
+      expect(sandboxedResult.isError, `${sandboxedResult.result}\n${sdkStderr.join("")}`).toBe(false);
       await expect(access(unsandboxedEscapePath)).rejects.toMatchObject({ code: "ENOENT" });
-      await expect(readFile(resultPath, "utf8")).resolves.toBe("sandbox-ok\n");
+      const resultContents = await readFile(resultPath, "utf8").catch((error: unknown) => {
+        throw new Error(`sandbox result file missing after tool success:\n${sandboxedResult.result}`, { cause: error });
+      });
+      expect(resultContents).toBe("sandbox-ok\n");
+      await expect(readFile(cphVersionPath, "utf8")).resolves.toMatch(/^cph /);
+      await expect(readFile(effectiveTempProbePath, "utf8")).resolves.toBe("workspace-temp\n");
+      const denialLog = await readFile(denialLogPath, "utf8");
+      expect(denialLog).not.toContain("sibling-secret");
+      expect(denialLog).not.toContain("platform-secret");
       await expect(access(siblingEscapePath)).rejects.toMatchObject({ code: "ENOENT" });
+      await expect(access(hostTmpEscapePath)).rejects.toMatchObject({ code: "ENOENT" });
+      await expect(access(hostVarTmpEscapePath)).rejects.toMatchObject({ code: "ENOENT" });
       await expect(readFile(join(canonicalSibling, "secret.txt"), "utf8")).resolves.toBe("sibling-secret\n");
       await expect(readFile(canonicalServiceSecret, "utf8")).resolves.toBe("platform-secret\n");
     } finally {
@@ -139,7 +181,7 @@ function setHostEnv(values: Readonly<Record<string, string>>): void {
   }
 }
 
-async function startAnthropicStub(bypassCommand: string, sandboxedCommand: string): Promise<{
+async function startAnthropicStub(bashCommand: string): Promise<{
   readonly baseUrl: string;
   readonly requestCount: () => number;
   readonly close: () => Promise<void>;
@@ -156,10 +198,11 @@ async function startAnthropicStub(bypassCommand: string, sandboxedCommand: strin
       };
       requests++;
       const events = requests === 1
-        ? bashToolEvents(bypassCommand, requests, true)
-        : requests === 2
-          ? bashToolEvents(sandboxedCommand, requests, false)
-          : finalTextEvents(requests);
+        // Deliberately request the SDK's bypass flag. Production sets
+        // allowUnsandboxedCommands=false, so the flag must be ignored and the
+        // host-side escape sentinels must remain absent.
+        ? bashToolEvents(bashCommand, requests, true)
+        : finalTextEvents(requests);
       writeAnthropicStream(response, events);
     } catch (error) {
       response.writeHead(500, { "content-type": "application/json" });

hub/test/integration/deployment-preflight-cli.test.ts

@@ -128,6 +128,7 @@ describe("deployment preflight CLI", () => {
     expect(probeLog).toContain(workspaceRoot);
     expect(probeLog).toContain("service-setpriv\n");
     expect(probeLog).toContain("service-bwrap\n");
+    expect(probeLog).toContain("service-socat\n");
     expect(probeLog).toContain("service-prisma\n");
     expect(probeLog).toContain("service-database\n");
   });
@@ -141,6 +142,7 @@ describe("deployment preflight CLI", () => {
     const binDir = join(root, "bin");
     const cphBin = join(binDir, "cph");
     const bwrapBin = join(binDir, "bwrap");
+    const socatBin = join(binDir, "socat");
     const pgIsReadyBin = join(binDir, "pg_isready");
     const runuserBin = join(binDir, "runuser");
     const setprivBin = join(binDir, "setpriv");
@@ -155,6 +157,7 @@ describe("deployment preflight CLI", () => {
     await Promise.all([
       executable(cphBin, `#!/bin/sh\nprintf 'cph\\n' >> '${options.marker}'\nprintf 'cph 0.0.2\\n'\n`),
       executable(bwrapBin, `#!/bin/sh\nprintf 'service-bwrap\\n' >> '${options.marker}'\nexit 0\n`),
+      executable(socatBin, `#!/bin/sh\nprintf 'service-socat\\n' >> '${options.marker}'\nexit 0\n`),
       executable(
         runuserBin,
         `#!/bin/sh\nprintf '%s\\n' "$*" >> '${options.marker}'\n[ "$1" = "-u" ] || exit 91\nshift 2\n[ "$1" = "--" ] || exit 92\nshift\nexec "$@"\n`,
@@ -226,6 +229,8 @@ describe("deployment preflight CLI", () => {
         options.workspaceRoot,
         "--bwrap-bin",
         bwrapBin,
+        "--socat-bin",
+        socatBin,
         "--pg-isready-bin",
         pgIsReadyBin,
       ],

hub/test/unit/agent-diagnostics.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it, vi } from "vitest";
+import { createAgentSdkStderrSink } from "../../src/agent/diagnostics.js";
+
+describe("agent SDK stderr diagnostics", () => {
+  it("redacts a credential split across chunks and correlates the log", () => {
+    const warn = vi.fn();
+    const sink = createAgentSdkStderrSink({
+      logger: { warn },
+      runId: "run-1",
+      projectId: "project-1",
+      sensitiveValues: ["provider-secret"],
+    });
+
+    sink.write("sandbox startup token=provider-");
+    sink.write("secret\nremaining diagnostic");
+    sink.flush();
+
+    const serialized = JSON.stringify(warn.mock.calls);
+    expect(serialized).not.toContain("provider-secret");
+    expect(serialized).toContain("[REDACTED]");
+    expect(warn).toHaveBeenCalledWith(
+      expect.objectContaining({ runId: "run-1", projectId: "project-1" }),
+      "agent SDK stderr",
+    );
+  });
+
+  it("bounds line length, line count, and an unterminated line", () => {
+    const warn = vi.fn();
+    const sink = createAgentSdkStderrSink({
+      logger: { warn },
+      runId: "run-2",
+      projectId: "project-2",
+      sensitiveValues: [],
+    });
+
+    sink.write(`${"x".repeat(3_000)}\n`);
+    sink.write(Array.from({ length: 30 }, (_, index) => `line-${index}`).join("\n"));
+    sink.flush();
+
+    expect(warn.mock.calls.length).toBeLessThanOrEqual(21);
+    const diagnostics = warn.mock.calls
+      .map(([bindings]) => (bindings as { sdkStderr?: string }).sdkStderr)
+      .filter((value): value is string => value !== undefined);
+    expect(diagnostics.every((value) => value.length <= 2_000)).toBe(true);
+    expect(warn.mock.calls.some(([, message]) => String(message).includes("limit reached"))).toBe(true);
+  });
+});

hub/test/unit/agent-security.test.ts

@@ -46,7 +46,7 @@ describe("agent subprocess security policy", () => {
     expect(policy.env).not.toHaveProperty("HUB_SESSION_SECRET");
     expect(policy.env.HOME).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
     expect(policy.env.CLAUDE_CONFIG_DIR).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
-    expect(policy.env.CLAUDE_CODE_TMPDIR).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
 
     expect(policy.sandbox).toMatchObject({
       enabled: true,
@@ -81,6 +81,24 @@ describe("agent subprocess security policy", () => {
     })).rejects.toThrow("unsupported provider environment variable: DATABASE_URL");
   });
 
+  it("keeps the short SDK socket directory inside the project workspace", async () => {
+    const { workspaceRoot, workspace } = await makeWorkspace();
+    const policy = await createAgentSecurityPolicy({
+      workspaceRoot,
+      workspaceDir: workspace,
+      hostEnv: { PATH: "/usr/bin:/bin" },
+    });
+
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
+    const absoluteTemp = join(await realpath(workspace), ".cph", "t");
+    expect(policy.env.TMPDIR).toBe(absoluteTemp);
+    expect(policy.env.TMP).toBe(absoluteTemp);
+    expect(policy.env.TEMP).toBe(absoluteTemp);
+    expect(policy.sandbox.filesystem.allowWrite).toEqual([await realpath(workspace)]);
+    expect(policy.sandbox.filesystem.denyWrite).toEqual(["/"]);
+    expect(policy.sandbox.filesystem.allowRead).not.toContain(expect.stringMatching(/^\/run\//));
+  });
+
   it("rejects a project workspace whose real path escapes the configured workspace root", async () => {
     const { root, workspaceRoot } = await makeWorkspace();
     const outside = join(root, "outside");