diff --git a/src-tauri/crates/agent-core/src/specialization/mcp/manager/mod.rs b/src-tauri/crates/agent-core/src/specialization/mcp/manager/mod.rs
index cd0482d43f..3551fa5251 100644
--- a/src-tauri/crates/agent-core/src/specialization/mcp/manager/mod.rs
+++ b/src-tauri/crates/agent-core/src/specialization/mcp/manager/mod.rs
@@ -181,6 +181,9 @@ mod tests {
 
     #[tokio::test]
     async fn mark_and_clear_needs_auth_round_trip() {
+        // `mark_needs_auth` / `clear_needs_auth` write the on-disk
+        // needs-auth cache, which is keyed off `ORGII_HOME`.
+        let _sandbox = test_helpers::test_env::sandbox();
         let mgr = McpManager::new();
         assert!(!mgr.is_needs_auth("srv").await);
         mgr.mark_needs_auth("srv", &http("https://x.test")).await;
diff --git a/src-tauri/crates/agent-core/src/specialization/mcp/needs_auth_cache.rs b/src-tauri/crates/agent-core/src/specialization/mcp/needs_auth_cache.rs
index ad30d1ef1e..417c6cf526 100644
--- a/src-tauri/crates/agent-core/src/specialization/mcp/needs_auth_cache.rs
+++ b/src-tauri/crates/agent-core/src/specialization/mcp/needs_auth_cache.rs
@@ -51,7 +51,21 @@ pub(crate) fn cache_path() -> Option<PathBuf> {
             return Some(PathBuf::from(dir).join("mcp-needs-auth-cache.json"));
         }
     }
-    dirs::home_dir().map(|home| home.join(".orgii").join("mcp-needs-auth-cache.json"))
+    // Unit tests must never fall through to the developer's real home: the
+    // cache is process-global state keyed off `ORGII_HOME`, so an unsandboxed
+    // test both writes to `~/.orgii` and races whichever sandboxed test is
+    // holding `test_env::lock_home()` at that moment. Fail loudly instead.
+    #[cfg(test)]
+    {
+        panic!(
+            "needs-auth cache resolved without ORGII_HOME — the calling test must hold a \
+             `test_helpers::test_env::sandbox()` guard"
+        );
+    }
+    #[cfg(not(test))]
+    {
+        dirs::home_dir().map(|home| home.join(".orgii").join("mcp-needs-auth-cache.json"))
+    }
 }
 
 /// Global write lock — serializes the read-modify-write so concurrent