diff --git a/docs/onecomputer/claude-agent-sdk-runtime.md b/docs/onecomputer/claude-agent-sdk-runtime.md
new file mode 100644
index 0000000..c2e1083
--- /dev/null
+++ b/docs/onecomputer/claude-agent-sdk-runtime.md
@@ -0,0 +1,36 @@
+# Claude Agent SDK runtime requirement
+
+ONEComputer sandboxes are used by ONEVibe as the execution boundary for
+Claude agents. Claude Code CLI availability is not sufficient for this
+contract: the sandbox must also contain the Claude Agent SDK so a Node worker
+can call `query()` directly and stream native SDK messages into ONEVibe's
+durable journal/SSE projection.
+
+The Kasm bootstrap installs the pinned runtime dependency:
+
+```text
+@anthropic-ai/claude-agent-sdk@0.3.210
+```
+
+Bootstrap must fail closed unless both checks pass:
+
+```sh
+claude --version
+NODE_PATH=/home/kasm-user/.npm-global/lib/node_modules node -e "const {createRequire}=require('node:module'); createRequire(process.cwd() + '/.onevibe-agent-sdk.mjs').resolve('@anthropic-ai/claude-agent-sdk')"
+```
+
+The package is installed as an image/bootstrap dependency alongside
+`@anthropic-ai/claude-code`, `pptxgenjs`, and `pdf-lib`; it must not be
+installed by an agent during a user task. A sandbox is not `bootstrapped` until
+the SDK module check succeeds. This keeps model execution deterministic and
+prevents a task from silently switching to a CLI-only runtime.
+
+ONEVibe transfers the worker source into the conversation workspace and
+executes it with Node 22. The worker owns the SDK query, session persistence,
+LiteLLM environment, bounded tool list, and raw journal. ONEComputer remains
+the provider/control boundary; the web browser receives only server-projected
+events and never receives the sandbox process, credential, X11, or VNC handle.
+
+The corresponding ONEVibe proof is documented in
+`onevibe/docs/ONECOMPUTER-CLAUDE-AGENT-SDK.md`. A fresh Azure deployment must
+be run before claiming the combined SDK + visual + SSE gate.
diff --git a/packages/api/src/services/sandbox-providers/kasm-local-provider.ts b/packages/api/src/services/sandbox-providers/kasm-local-provider.ts
index f109a66..85d4daf 100644
--- a/packages/api/src/services/sandbox-providers/kasm-local-provider.ts
+++ b/packages/api/src/services/sandbox-providers/kasm-local-provider.ts
@@ -221,7 +221,7 @@ async function installClaudeDesktopAndCode(id: string): Promise<ExecResult> {
 
   return execInSandbox(
     id,
-    "set -e; export PATH=/opt/node22/bin:/home/kasm-user/.npm-global/bin:$PATH; npm install -g @anthropic-ai/claude-code --prefix /home/kasm-user/.npm-global; grep -q npm-global /home/kasm-user/.bashrc || echo 'export PATH=/opt/node22/bin:/home/kasm-user/.npm-global/bin:$PATH' >> /home/kasm-user/.bashrc; claude --version",
+    "set -e; export PATH=/opt/node22/bin:/home/kasm-user/.npm-global/bin:$PATH; npm install -g @anthropic-ai/claude-code @anthropic-ai/claude-agent-sdk@0.3.210 pptxgenjs pdf-lib --prefix /home/kasm-user/.npm-global; grep -q npm-global /home/kasm-user/.bashrc || echo 'export PATH=/opt/node22/bin:/home/kasm-user/.npm-global/bin:$PATH' >> /home/kasm-user/.bashrc; claude --version; NODE_PATH=/home/kasm-user/.npm-global/lib/node_modules node -e \"require('pptxgenjs'); require('pdf-lib'); const {createRequire}=require('node:module'); createRequire(process.cwd() + '/.onevibe-agent-sdk.mjs').resolve('@anthropic-ai/claude-agent-sdk')\"",
   );
 }