fix: restore bounded agent sandbox execution

hub/src/agent/runner.ts

@@ -29,7 +29,7 @@
  * `workspace.ts` `confine()` path validator as a tool wrapper — the OS sandbox
  * is the mechanism, the contract pins the invariant.
  */
-import { query, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
+import { query, type HookCallback, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";
 import { claudeSdkToolConfigForRole } from "./roleTools.js";
 import { createAgentSecurityPolicy } from "./security.js";
@@ -96,6 +96,22 @@ export interface RunResult {
 
 const DEFAULT_MAX_TURNS = 25;
 
+const denyUnsandboxedBash: HookCallback = async (input) => {
+  if (input.hook_event_name !== "PreToolUse" || input.tool_name !== "Bash") return {};
+  const toolInput = input.tool_input;
+  if (
+    typeof toolInput !== "object" || toolInput === null ||
+    !("dangerouslyDisableSandbox" in toolInput) || toolInput.dangerouslyDisableSandbox !== true
+  ) return {};
+  return {
+    hookSpecificOutput: {
+      hookEventName: "PreToolUse",
+      permissionDecision: "deny",
+      permissionDecisionReason: "This deployment requires every Bash command to remain sandboxed.",
+    },
+  };
+};
+
 export async function runAgent(req: RunRequest): Promise<RunResult> {
   const onStream = req.onStream;
   const cap = req.maxTurns ?? DEFAULT_MAX_TURNS;
@@ -151,6 +167,12 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
       // settings that could widen tools, hooks, MCP servers, or sandbox paths.
       settingSources: [],
       strictMcpConfig: true,
+      // Claude Code 2.1.202 can honor the per-call opt-out despite
+      // sandbox.allowUnsandboxedCommands=false. Enforce the invariant again at
+      // the PreToolUse boundary, before the Bash process can be spawned.
+      hooks: {
+        PreToolUse: [{ matcher: "Bash", hooks: [denyUnsandboxedBash] }],
+      },
     };
     if (req.systemPrompt !== undefined) options.systemPrompt = req.systemPrompt;
     if (req.model !== undefined) options.model = req.model;