fix: prove Linux Agent sandbox boundary

hub/test/unit/agent-security.test.ts

@@ -46,7 +46,7 @@ describe("agent subprocess security policy", () => {
     expect(policy.env).not.toHaveProperty("HUB_SESSION_SECRET");
     expect(policy.env.HOME).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
     expect(policy.env.CLAUDE_CONFIG_DIR).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
-    expect(policy.env.CLAUDE_CODE_TMPDIR).toMatch(new RegExp(`^${escapeRegExp(canonicalWorkspace)}/`));
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
 
     expect(policy.sandbox).toMatchObject({
       enabled: true,
@@ -81,6 +81,24 @@ describe("agent subprocess security policy", () => {
     })).rejects.toThrow("unsupported provider environment variable: DATABASE_URL");
   });
 
+  it("keeps the short SDK socket directory inside the project workspace", async () => {
+    const { workspaceRoot, workspace } = await makeWorkspace();
+    const policy = await createAgentSecurityPolicy({
+      workspaceRoot,
+      workspaceDir: workspace,
+      hostEnv: { PATH: "/usr/bin:/bin" },
+    });
+
+    expect(policy.env.CLAUDE_CODE_TMPDIR).toBe(join(".cph", "t"));
+    const absoluteTemp = join(await realpath(workspace), ".cph", "t");
+    expect(policy.env.TMPDIR).toBe(absoluteTemp);
+    expect(policy.env.TMP).toBe(absoluteTemp);
+    expect(policy.env.TEMP).toBe(absoluteTemp);
+    expect(policy.sandbox.filesystem.allowWrite).toEqual([await realpath(workspace)]);
+    expect(policy.sandbox.filesystem.denyWrite).toEqual(["/"]);
+    expect(policy.sandbox.filesystem.allowRead).not.toContain(expect.stringMatching(/^\/run\//));
+  });
+
   it("rejects a project workspace whose real path escapes the configured workspace root", async () => {
     const { root, workspaceRoot } = await makeWorkspace();
     const outside = join(root, "outside");