Cowork 'Failed to create bridge sockets' error on session resume (allowedDomains=0)

Description

When using Claude Desktop's Cowork feature on macOS, tasks fail at the confirmation step with the error:

CLI output was not valid JSON. This may indicate an error during startup. 
Output: Error: Failed to create bridge sockets after 5 attempts

Reproduction Pattern (Updated Jan 20)

The failure occurs specifically when:

1. Cowork task starts successfully
2. Task explores/analyzes (reads files, creates plans) - works
3. Task pauses for user confirmation ("Should I proceed?")
4. User confirms ("yes")
5. Task fails immediately with bridge sockets error

Real Example

• User asks: "Organize and tidy up [folder]"
• Cowork reads 204 files across 25 folders - ✅ works
• Cowork analyzes duplicates, creates reorganization plan - ✅ works
• Cowork asks "Should I proceed with this plan?"
• User says "yes"
• Fails with: "Failed to create bridge sockets after 5 attempts" ❌

This means any task requiring user confirmation will fail at the execution step.

Root Cause Analysis

After extensive debugging, the issue is NOT missing socat (socat is installed and working). The actual root cause is:

1. Resume/continuation sessions have allowedDomains=0 - no network access allowed
2. Initial task start has allowedDomains=1 - network access permitted
3. The CLI sandbox bridge creation (VEB function in claude-agent-sdk) attempts to create socat bridges to HTTP/SOCKS proxy ports
4. With allowedDomains=0, the bridge sockets cannot connect to the proxy endpoints, causing the failure

Evidence from Logs

Working new session (isResume=false, allowedDomains=1):

[Spawn:config] Creating spawn function for process=stoic-kind-gauss, isResume=false, mounts=4, allowedDomains=1
[Process] Exited, code=0, duration=90000ms  # Runs successfully for ~90 seconds

Failing resume session (isResume=true, allowedDomains=0):

[Spawn:config] Creating spawn function for process=amazing-dazzling-fermi, isResume=true, mounts=4, allowedDomains=0
[Process] Exited, code=0, duration=1207ms  # Exits in ~1 second with bridge socket error

All resume/continuation sessions exit in ~1 second with the bridge socket error, while initial task starts run successfully.

Environment

• OS: macOS 15.3 (Darwin 25.3.0)
• Architecture: arm64 (Apple Silicon)
• Claude Desktop: 1.1.381
• Claude Code SDK: 2.1.8
• socat: 1.8.1.0 (installed via Homebrew at /opt/homebrew/bin/socat)

Steps to Reproduce

1. Have socat installed (brew install socat)
2. Open Claude Desktop
3. Start a Cowork task that requires confirmation (e.g., "organize these files")
4. Let Cowork analyze and propose a plan
5. When asked for confirmation, say "yes"
6. Fails with bridge sockets error

Expected Behavior

Task should continue after user confirmation.

Actual Behavior

• Initial task analysis: Works correctly
• After user confirmation to proceed: Fails immediately with "Failed to create bridge sockets after 5 attempts"

Technical Details

The bridge socket creation code in claude-agent-sdk/cli.js (function VEB) does:

// Creates socat bridges from Unix sockets to TCP proxy ports
socat UNIX-LISTEN:/tmp/claude-http-xxx.sock,fork TCP:localhost:{httpProxyPort}
socat UNIX-LISTEN:/tmp/claude-socks-xxx.sock,fork TCP:localhost:{socksProxyPort}

When allowedDomains=0, the proxy ports either don't exist or aren't accessible, causing socat to fail to connect, and the socket files never get created in /tmp.

Suggested Fix

1. Don't require bridge sockets for resume/continuation sessions if network access isn't needed
2. Or: Grant allowedDomains=1 to resume sessions the same as new sessions
3. Or: Skip sandbox network bridge setup when allowedDomains=0
4. Better error message explaining the actual cause (network permissions vs socat)

Workaround

Current workaround: Use one-shot tasks that don't require confirmation. Unfortunately, most useful tasks (file organization, code changes) require confirmation, making Cowork largely unusable on macOS.

Alternative: Use Claude Code CLI directly instead of Cowork for tasks requiring interactive confirmation.