diff --git a/src/mount-script.test.ts b/src/mount-script.test.ts
index 3ba0385..a32a90a 100644
--- a/src/mount-script.test.ts
+++ b/src/mount-script.test.ts
@@ -7,6 +7,7 @@ import {
   mkdtempSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -17,8 +18,17 @@ import {
   buildRelayfileMountStartShell,
   buildRelayfileMountFlushShell,
   buildRelayfileMountInitialSyncShell,
+  buildRelayfileMountInitialSyncBackgroundShell,
+  buildRelayfileMountInitialSyncStatusShell,
   buildRelayfileMountPathArgsShell,
   buildRelayfileMountShellTemplate,
+  parseRelayfileMountInitialSyncStatus,
+  type RelayfileMountInitialSyncStatus,
+  RELAYFILE_INITIAL_SYNC_EXIT_PATH,
+  RELAYFILE_INITIAL_SYNC_LOG_PATH,
+  RELAYFILE_INITIAL_SYNC_PID_PATH,
+  RELAYFILE_INITIAL_SYNC_REAPED_PATH,
+  RELAYFILE_INITIAL_SYNC_SCRIPT_PATH,
 } from "./mount-script.js";
 
 const TOKEN = "relay_pa_thisisasecrettoken_do_not_leak";
@@ -712,3 +722,615 @@ describe("initial-sync idle watchdog progress files", () => {
     );
   });
 });
+
+/**
+ * Regression guard for AgentWorkforce/sandbox#30.
+ *
+ * The detached initial-sync launcher generates a shell script under /tmp and
+ * hands it to a background process. Two things went wrong at once:
+ *
+ *   - `cat > <script>` created the file at the process umask default, so under
+ *     the production sandbox's 022 umask the script landed group/world
+ *     readable; and
+ *   - the default `argv` ingress rendered the path-scoped token into that
+ *     script as a `--token` literal.
+ *
+ * Together those left a reusable credential readable by any sibling process in
+ * the sandbox, even though a mode-0600 creds file was already being supplied
+ * alongside the launch command. The script also outlived the sync that used it.
+ *
+ * These tests execute the real launcher through /bin/sh under an explicit 022
+ * umask and assert against the file that actually lands on disk — a string
+ * assertion on the generated shell would not have caught the umask defect.
+ */
+describe("detached initial-sync script credential hygiene (sandbox#30)", () => {
+  const sleep = (ms: number): Promise<void> =>
+    new Promise((resolve) => setTimeout(resolve, ms));
+
+  async function waitFor(
+    predicate: () => boolean,
+    { timeoutMs = 15_000, stepMs = 25 } = {},
+  ): Promise<boolean> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (predicate()) {
+        return true;
+      }
+      await sleep(stepMs);
+    }
+    return predicate();
+  }
+
+  /**
+   * Read the mode of the file that actually landed the way the launcher itself
+   * does — through `stat`, asserted by the exit code of the comparison rather
+   * than by a string match in JS. GNU/busybox spell it `stat -c %a`, BSD
+   * `stat -f %Lp`.
+   */
+  function assertLandedMode(path: string, expected: string): void {
+    const check = spawnSync(
+      "/bin/sh",
+      [
+        "-c",
+        'mode=$(stat -c %a "$1" 2>/dev/null || stat -f %Lp "$1" 2>/dev/null)' +
+          ' || exit 2; printf %s "$mode"; [ "$mode" = "$2" ]',
+        "sh",
+        path,
+        expected,
+      ],
+      { encoding: "utf8" },
+    );
+    assert.notEqual(
+      check.status,
+      2,
+      `could not stat the file the launcher actually created: ${path}`,
+    );
+    assert.equal(
+      check.status,
+      0,
+      `expected ${path} to land at mode ${expected}, got ${check.stdout}`,
+    );
+  }
+
+  /**
+   * The launcher tolerates `unknown` when neither `stat` spelling exists, so
+   * the refusal path below can only be exercised where one of them works.
+   */
+  function statSupported(): boolean {
+    const probe = spawnSync("/bin/sh", [
+      "-c",
+      "stat -c %a /tmp >/dev/null 2>&1 || stat -f %Lp /tmp >/dev/null 2>&1",
+    ]);
+    return probe.status === 0;
+  }
+
+  /**
+   * Paths the launcher owns for a given run id. Registered for removal so a
+   * failing assertion cannot leave a credential-bearing file behind in /tmp.
+   */
+  function runPaths(t: TestContext, runId: string): {
+    scriptPath: string;
+    exitPath: string;
+    logPath: string;
+    pidPath: string;
+    reapedPath: string;
+  } {
+    const paths = {
+      scriptPath: `${RELAYFILE_INITIAL_SYNC_SCRIPT_PATH}.${runId}`,
+      exitPath: `${RELAYFILE_INITIAL_SYNC_EXIT_PATH}.${runId}`,
+      logPath: `${RELAYFILE_INITIAL_SYNC_LOG_PATH}.${runId}`,
+      pidPath: `${RELAYFILE_INITIAL_SYNC_PID_PATH}.${runId}`,
+      reapedPath: `${RELAYFILE_INITIAL_SYNC_REAPED_PATH}.${runId}`,
+    };
+    t.after(() => {
+      for (const path of Object.values(paths)) {
+        rmSync(path, { force: true });
+      }
+    });
+    return paths;
+  }
+
+  /**
+   * A relayfile-mount stand-in that blocks until a release file appears, so the
+   * generated script is guaranteed to still be on disk while the test stats it.
+   * The bounded spin means a wedged test cannot leave the fake running forever.
+   */
+  function blockingFakeMount(t: TestContext): {
+    binDir: string;
+    root: string;
+    release: () => void;
+  } {
+    const root = mkdtempSync(join(tmpdir(), "sandbox-sec30-"));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const binDir = join(root, "bin");
+    const mkdir = spawnSync("mkdir", ["-p", binDir]);
+    assert.equal(mkdir.status, 0, mkdir.stderr?.toString());
+
+    const releasePath = join(root, "release");
+    const fakeMount = join(binDir, "relayfile-mount");
+    writeFileSync(
+      fakeMount,
+      `#!/bin/sh
+attempts=0
+while [ ! -f '${releasePath}' ] && [ "$attempts" -lt 400 ]; do
+  attempts=$((attempts + 1))
+  sleep 0.05
+done
+exit 0
+`,
+    );
+    chmodSync(fakeMount, 0o755);
+    return {
+      binDir,
+      root,
+      release: () => writeFileSync(releasePath, "go"),
+    };
+  }
+
+  function launch(
+    launcher: string,
+    binDir: string,
+  ): ReturnType<typeof spawnSync> {
+    // The explicit 022 umask is the point: it is the production sandbox's
+    // umask, and it is what made `cat >` produce a 0644 script.
+    return spawnSync("/bin/sh", ["-c", `umask 022; ${launcher}`], {
+      env: { ...process.env, PATH: `${binDir}:${process.env.PATH ?? ""}` },
+      encoding: "utf8",
+    });
+  }
+
+  it("creates the generated script at mode exactly 0600 under a 022 umask", async (t) => {
+    const runId = "sec30-mode";
+    const { scriptPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    // The property under test is the mode of the file on disk, so it is read
+    // back off the real file: once by `stat` (exit code), once through node.
+    assertLandedMode(scriptPath, "600");
+    const mode = statSync(scriptPath).mode & 0o777;
+    assert.equal(
+      mode.toString(8),
+      "600",
+      "the generated script may carry a credential and must never be readable " +
+        "by another user or process in the sandbox",
+    );
+    // ...and this is why the mode is the whole fix: under the default argv
+    // ingress the credential really is sitting in that file.
+    assert.ok(
+      readFileSync(scriptPath, "utf8").includes(TOKEN),
+      "expected the default ingress to put the credential in the script, " +
+        "which is what makes the 0600 mode load-bearing",
+    );
+
+    release();
+  });
+
+  it("keeps the token literal out of the generated script under creds-file ingress", async (t) => {
+    const runId = "sec30-no-literal";
+    const { scriptPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+
+    assert.doesNotMatch(
+      launcher,
+      /--token/,
+      "creds-file ingress must not render --token anywhere in the launcher",
+    );
+    assert.ok(
+      !launcher.includes(TOKEN),
+      "creds-file ingress must not render the token literal in the launcher",
+    );
+    assert.match(launcher, /RELAYFILE_MOUNT_CREDS_FILE=/);
+
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    const contents = readFileSync(scriptPath, "utf8");
+    assert.ok(
+      !contents.includes(TOKEN),
+      "the on-disk generated script still contains the credential literal",
+    );
+    assertLandedMode(scriptPath, "600");
+    assert.equal(statSync(scriptPath).mode & 0o777, 0o600);
+
+    release();
+  });
+
+  it("still renders --token for the default argv ingress (older daemons)", () => {
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId: "sec30-compat" },
+    );
+    // A creds file alone must NOT silently drop the flag: pre-creds binaries
+    // ignore RELAYFILE_MOUNT_CREDS_FILE, so dropping --token for them would
+    // turn a working mount into a silent authentication failure. Removing the
+    // literal is opt-in via tokenIngress.
+    assert.match(launcher, /--token/);
+    assert.ok(launcher.includes(TOKEN));
+  });
+
+  it("rejects creds-file ingress that has no creds file to read", () => {
+    assert.throws(
+      () =>
+        buildRelayfileMountInitialSyncBackgroundShell(
+          { ...BASE, tokenIngress: "creds-file" },
+          { runId: "sec30-guard" },
+        ),
+      /credsFilePath/,
+      "creds-file ingress renders no token by any route, so a missing creds " +
+        "file must fail loudly at build time",
+    );
+  });
+
+  it("removes the generated script once the detached sync exits", async (t) => {
+    const runId = "sec30-cleanup";
+    const { scriptPath, exitPath, logPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    release();
+
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "detached sync never wrote its exit sentinel",
+    );
+    // The script is removed BEFORE the exit sentinel lands, so a poller that
+    // has observed completion can never race back and read the script.
+    assert.equal(
+      existsSync(scriptPath),
+      false,
+      "the generated script outlived the sync that used it",
+    );
+    // Non-secret diagnostics are deliberately preserved for failure analysis.
+    assert.equal(readFileSync(exitPath, "utf8").trim(), "0");
+    assert.equal(existsSync(logPath), true, "the sync log must be preserved");
+  });
+
+  /**
+   * The gating test for the mode check: it runs the check rather than reading
+   * it. The launcher is mutated back to the pre-fix creation mode (`umask 022`
+   * in place of `umask 077`), which is the exact regression the check exists to
+   * catch, and then executed — so a check that is present in the generated text
+   * but broken at runtime fails here instead of passing a string match.
+   */
+  it("refuses to launch, at runtime, when the script does not land at 0600", async (t) => {
+    if (!statSupported()) {
+      t.skip("no stat -c/-f available; the launcher tolerates an unknown mode");
+      return;
+    }
+    const runId = "sec30-refuse";
+    const { scriptPath, exitPath, pidPath, logPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+      },
+      { runId },
+    );
+    const defective = launcher.replace(
+      "(umask 077 && cat > ",
+      "(umask 022 && cat > ",
+    );
+    assert.notEqual(
+      defective,
+      launcher,
+      "the mode must be constrained at creation by `umask 077`, not by a " +
+        "chmod after the write, which would leave a readable window",
+    );
+
+    const result = launch(defective, binDir);
+
+    assert.notEqual(
+      result.status,
+      0,
+      "a script that landed group/world readable must abort the launch",
+    );
+    assert.match(
+      result.stderr ?? "",
+      /is mode 644, not 600; refusing to launch/,
+      "expected the refusal to name the mode that actually landed",
+    );
+    assert.equal(
+      existsSync(scriptPath),
+      false,
+      "the readable script must be removed, not left in /tmp",
+    );
+    // Nothing may have been handed to a detached process: no pid, no log, no
+    // exit sentinel, because the sync never started.
+    assert.equal(existsSync(pidPath), false, "a sync was started anyway");
+    assert.equal(existsSync(logPath), false, "a sync was started anyway");
+    assert.equal(
+      await waitFor(() => existsSync(exitPath), { timeoutMs: 500 }),
+      false,
+      "a sync was started anyway",
+    );
+
+    // Nothing should be holding the fake mount, but release it the way the
+    // other launching tests do so a surprise child cannot outlive the test.
+    release();
+  });
+
+  /**
+   * A relayfile-mount stand-in that exits immediately with a chosen status, so
+   * the runner reaches its completion window straight away.
+   */
+  function instantFakeMount(
+    t: TestContext,
+    exitCode: number,
+  ): { binDir: string; root: string } {
+    const root = mkdtempSync(join(tmpdir(), "sandbox-sec30-window-"));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const binDir = join(root, "bin");
+    const mkdir = spawnSync("mkdir", ["-p", binDir]);
+    assert.equal(mkdir.status, 0, mkdir.stderr?.toString());
+    const fakeMount = join(binDir, "relayfile-mount");
+    writeFileSync(fakeMount, `#!/bin/sh\nexit ${exitCode}\n`);
+    chmodSync(fakeMount, 0o755);
+    return { binDir, root };
+  }
+
+  /**
+   * Wedge the runner open inside its completion window. The runner removes the
+   * generated script between reaping the child and publishing the exit
+   * sentinel; a `rm` that performs the removal and then blocks holds that
+   * window open for as long as the test needs, so the window is observed
+   * rather than raced for.
+   *
+   * Only the runner's own `rm -f <script>` is intercepted: the launcher's
+   * pre-run sweep passes five paths, and the sync script's idle-marker removal
+   * names a different file.
+   */
+  function installHoldingRm(
+    binDir: string,
+    scriptPath: string,
+    enteredPath: string,
+    releasePath: string,
+  ): void {
+    const rm = join(binDir, "rm");
+    writeFileSync(
+      rm,
+      `#!/bin/sh
+if [ "$#" -eq 2 ] && [ "$2" = '${scriptPath}' ]; then
+  /bin/rm -f "$2"
+  : > '${enteredPath}'
+  attempts=0
+  while [ ! -f '${releasePath}' ] && [ "$attempts" -lt 400 ]; do
+    attempts=$((attempts + 1))
+    sleep 0.05
+  done
+  exit 0
+fi
+exec /bin/rm "$@"
+`,
+    );
+    chmodSync(rm, 0o755);
+  }
+
+  /** Run the real status probe the way the orchestrator's poll loop does. */
+  function probeStatus(runId: string): RelayfileMountInitialSyncStatus {
+    const probe = spawnSync(
+      "/bin/sh",
+      ["-c", buildRelayfileMountInitialSyncStatusShell({ runId })],
+      { encoding: "utf8" },
+    );
+    assert.equal(probe.status, 0, probe.stderr);
+    return parseRelayfileMountInitialSyncStatus(probe.stdout);
+  }
+
+  /**
+   * Removing the script after the sync is done with it (the credential fix
+   * above) put a fork+exec between reaping the child and publishing its exit
+   * status. Inside that interval the pid file names a dead process, so the
+   * probe's dead-PID heuristic called a healthy sync a crash — `exit 127`,
+   * which `startMount` turns into a failed mount. Reported by CodeRabbit on
+   * PR #39.
+   *
+   * This must-fire holds the window open and polls the real probe inside it.
+   * Before the completion marker it fails on the first poll.
+   */
+  it("does not report a failure inside the completion window", async (t) => {
+    const runId = "sec30-window";
+    const { scriptPath, exitPath, reapedPath, pidPath } = runPaths(t, runId);
+    const { binDir, root } = instantFakeMount(t, 0);
+    const enteredPath = join(root, "rm-entered");
+    const releasePath = join(root, "rm-release");
+    installHoldingRm(binDir, scriptPath, enteredPath, releasePath);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+
+    assert.equal(
+      await waitFor(() => existsSync(enteredPath)),
+      true,
+      "the runner never reached the script removal",
+    );
+
+    // Confirm this really is the window before asserting anything about it:
+    // child reaped, script gone, exit status not yet published.
+    assert.equal(existsSync(reapedPath), true, "the window was never marked");
+    assert.equal(existsSync(scriptPath), false, "the script was not removed");
+    assert.equal(existsSync(pidPath), true, "the pid file is what misleads the probe");
+    assert.equal(existsSync(exitPath), false, "the exit sentinel landed too early");
+
+    for (let poll = 0; poll < 25; poll += 1) {
+      const status = probeStatus(runId);
+      assert.deepEqual(
+        status,
+        { state: "running" },
+        `probe reported ${JSON.stringify(status)} inside the completion ` +
+          "window; startMount turns a non-zero exit here into a failed mount " +
+          "for a sync that is finishing normally",
+      );
+      await sleep(10);
+    }
+
+    assert.equal(
+      existsSync(exitPath),
+      false,
+      "the window closed on its own, so those polls proved nothing",
+    );
+
+    writeFileSync(releasePath, "go");
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "the exit sentinel never landed after the window closed",
+    );
+    assert.deepEqual(probeStatus(runId), { state: "exited", exitCode: 0 });
+  });
+
+  /**
+   * The must-not-fire. Same on-disk state as the window above, minus the
+   * completion marker: a sync whose runner died without ever publishing an
+   * exit status is still a failure, and the marker must not soften that.
+   */
+  it("still reports a failure for a sync that died before completion", (t) => {
+    const runId = "sec30-died";
+    const { pidPath, reapedPath } = runPaths(t, runId);
+    // Above both Linux's default pid_max and macOS's, so it names no process
+    // on any host and cannot be reused out from under the assertion.
+    writeFileSync(pidPath, "4194305\n");
+
+    assert.deepEqual(
+      probeStatus(runId),
+      { state: "exited", exitCode: 127 },
+      "a dead sync with no exit status must still read as a failure",
+    );
+
+    // The marker is the only difference between the two states.
+    writeFileSync(reapedPath, "");
+    assert.deepEqual(probeStatus(runId), { state: "running" });
+  });
+
+  it("still reports a genuinely failed sync as a failure end to end", async (t) => {
+    const runId = "sec30-failed";
+    const { exitPath } = runPaths(t, runId);
+    const { binDir, root } = instantFakeMount(t, 3);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "the exit sentinel never landed",
+    );
+
+    const status = probeStatus(runId);
+    assert.equal(status.state, "exited");
+    assert.notEqual(
+      status.state === "exited" ? status.exitCode : 0,
+      0,
+      "a sync whose mount failed must not be reported as a success",
+    );
+  });
+
+  it("clears a stale completion marker before a new run", (t) => {
+    // A marker left by a previous run would make this run's dead-PID check
+    // unreachable, so the launcher's pre-run sweep has to take it.
+    const runId = "sec30-stale";
+    const { reapedPath } = runPaths(t, runId);
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId },
+    );
+    const sweep = launcher.split("\n").find((line) => line.startsWith("rm -f "));
+    assert.ok(sweep, "expected a pre-run sweep");
+    assert.ok(
+      sweep.includes(reapedPath),
+      "the pre-run sweep must clear a stale completion marker",
+    );
+  });
+
+  it("constrains the mode at creation rather than by a chmod after the write", () => {
+    // Fast unit alongside the executing test above: creation order is a
+    // property of the generated text, and a chmod-after-write would leave a
+    // readable window that a mode assertion on the finished file cannot see.
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId: "sec30-order" },
+    );
+    assert.match(launcher, /\(umask 077 && cat > /);
+    const verifyAt = launcher.indexOf("relayfile_initial_sync_mode=");
+    const launchAt = launcher.indexOf("nohup sh -c");
+    assert.ok(verifyAt > 0, "expected a post-write mode verification");
+    assert.ok(
+      verifyAt < launchAt,
+      "the mode check must run before the script is handed to the detached process",
+    );
+  });
+});
diff --git a/src/mount-script.ts b/src/mount-script.ts
index df43e85..98641b3 100644
--- a/src/mount-script.ts
+++ b/src/mount-script.ts
@@ -66,10 +66,22 @@ export type RelayfileMountShellOptions = {
    *     omitted from argv entirely. Requires a daemon build that reads the
    *     `RELAYFILE_MOUNT_TOKEN` env var. Confirm that capability before
    *     flipping the default to `'env'`.
+   *   - `'creds-file'`: no token literal is rendered at all — not in argv, not
+   *     in the env prefix. The daemon reads the credential from the mode-0600
+   *     file named by `credsFilePath`, which is therefore required. This is the
+   *     only ingress that leaves a generated on-disk script free of a reusable
+   *     credential, so it is what the detached initial-sync launcher should use
+   *     wherever the daemon build is known to honour RELAYFILE_MOUNT_CREDS_FILE.
    *
-   * The credentials-in-argv exposure was tracked as AgentWorkforce/sandbox#21.
+   * `'creds-file'` is opt-in rather than implied by `credsFilePath` alone.
+   * Pre-creds binaries ignore the unknown env var (see `credsFilePath`), so
+   * dropping `--token` for them would turn a working mount into a silent
+   * authentication failure rather than a loud one.
+   *
+   * The credentials-in-argv exposure was tracked as AgentWorkforce/sandbox#21;
+   * the credential-in-generated-script exposure as AgentWorkforce/sandbox#30.
    */
-  tokenIngress?: "argv" | "env";
+  tokenIngress?: "argv" | "env" | "creds-file";
 };
 
 /**
@@ -95,6 +107,8 @@ const EXACT_LOCAL_LAYOUT_ARG = `--local-layout ${shellQuote("exact")}`;
  * RELAYFILE_MOUNT_CREDS_FILE (see `credsFilePath` docs for the version-skew
  * rationale). When `tokenIngress === 'env'`, adds
  * RELAYFILE_MOUNT_TOKEN=<literal> so the launch token never enters argv.
+ * When `tokenIngress === 'creds-file'` no token literal is emitted at all —
+ * the creds file is the sole ingress.
  * The explicit `env` executable is required because initial-sync commands can
  * sit directly behind coreutils `timeout`, which does not shell-parse a bare
  * `VAR=value` assignment.
@@ -102,6 +116,14 @@ const EXACT_LOCAL_LAYOUT_ARG = `--local-layout ${shellQuote("exact")}`;
 function mountEnvPrefix(
   opts: Pick<RelayfileMountShellOptions, "credsFilePath" | "tokenIngress" | "token">,
 ): string {
+  if (opts.tokenIngress === "creds-file" && !opts.credsFilePath) {
+    // Fail at build time, not as an unauthenticated daemon in the sandbox:
+    // this ingress deliberately renders no token, so without a creds file the
+    // command carries no credential by any route.
+    throw new Error(
+      "relayfile mount tokenIngress 'creds-file' requires credsFilePath",
+    );
+  }
   const parts: string[] = [];
   if (opts.credsFilePath) {
     parts.push(`RELAYFILE_MOUNT_CREDS_FILE=${shellQuote(opts.credsFilePath)}`);
@@ -272,6 +294,16 @@ export const RELAYFILE_INITIAL_SYNC_SCRIPT_PATH = "/tmp/relayfile-initial-sync.s
 export const RELAYFILE_INITIAL_SYNC_EXIT_PATH = "/tmp/relayfile-initial-sync.exit";
 export const RELAYFILE_INITIAL_SYNC_LOG_PATH = "/tmp/relayfile-initial-sync.log";
 export const RELAYFILE_INITIAL_SYNC_PID_PATH = "/tmp/relayfile-initial-sync.pid";
+/**
+ * Written by the runner the instant `wait` returns — after the child has been
+ * reaped, before the exit sentinel is published. It marks the completion
+ * window: the runner knows the exit status but has not written it yet, so the
+ * child PID is already dead while the sync is in fact finishing normally. The
+ * status probe treats this as in-progress, otherwise its dead-PID heuristic
+ * reports a false exit 127 on a perfectly healthy sync.
+ */
+export const RELAYFILE_INITIAL_SYNC_REAPED_PATH =
+  "/tmp/relayfile-initial-sync.reaped";
 
 export type RelayfileMountInitialSyncRunOptions = {
   runId?: string;
@@ -316,6 +348,10 @@ export function buildRelayfileMountInitialSyncBackgroundShell(
     RELAYFILE_INITIAL_SYNC_PID_PATH,
     runOptions.runId,
   );
+  const reapedPath = relayfileInitialSyncPath(
+    RELAYFILE_INITIAL_SYNC_REAPED_PATH,
+    runOptions.runId,
+  );
   const syncShell = buildRelayfileMountInitialSyncShell(opts);
   const runner = [
     "if command -v setsid >/dev/null 2>&1; then",
@@ -325,18 +361,48 @@ export function buildRelayfileMountInitialSyncBackgroundShell(
     "fi;",
     "relayfile_initial_sync_pid=$!;",
     `echo "$relayfile_initial_sync_pid" > ${shellQuote(pidPath)};`,
-    'wait "$relayfile_initial_sync_pid";',
-    `echo $? > ${shellQuote(exitPath)}`,
+    "relayfile_initial_sync_status=0;",
+    'wait "$relayfile_initial_sync_pid" || relayfile_initial_sync_status=$?;',
+    // Claim the completion window before anything else runs in it. From here
+    // the child PID is dead but the exit status is not yet published, and the
+    // status probe would otherwise read that dead PID as a crash. `:` is a
+    // shell builtin, so this is a bare redirection — no fork stands between
+    // `wait` returning and the window being marked.
+    `: > ${shellQuote(reapedPath)};`,
+    // Shred the generated script the moment the sync is done with it, and do
+    // it BEFORE the exit sentinel lands: a poller that sees the sentinel must
+    // never be able to race back and read the script. `rm` is a fork+exec and
+    // sits entirely inside the window marked above. The log, pid, reaped and
+    // exit sentinels survive — they are the non-secret failure diagnostics.
+    `rm -f ${shellQuote(scriptPath)};`,
+    `echo "$relayfile_initial_sync_status" > ${shellQuote(exitPath)}`,
   ].join(" ");
   return [
     "set -e",
-    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)} &&`,
-    // Quoted heredoc delimiter: the sync shell lands in the script file
-    // verbatim, with no re-quoting hazards from nesting it in `sh -c`.
-    `cat > ${shellQuote(scriptPath)} <<'RELAYFILE_INITIAL_SYNC_EOF'
+    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)} ${shellQuote(reapedPath)}`,
+    // The script can carry a credential (see `tokenIngress`), so it must never
+    // exist group/world-readable for even an instant. `umask 077` in a subshell
+    // constrains the mode at creation — a chmod after the write would leave a
+    // readable window a sibling process could win. Quoted heredoc delimiter:
+    // the sync shell lands in the file verbatim, with no re-quoting hazards
+    // from nesting it in `sh -c`.
+    `(umask 077 && cat > ${shellQuote(scriptPath)}) <<'RELAYFILE_INITIAL_SYNC_EOF'
 ${syncShell}
-RELAYFILE_INITIAL_SYNC_EOF
-`,
+RELAYFILE_INITIAL_SYNC_EOF`,
+    // Defence in depth: confirm the mode that actually landed before handing
+    // the script to a detached process. GNU/busybox spell it `stat -c %a`,
+    // BSD `stat -f %Lp`. If neither exists we cannot read the mode back, but
+    // the umask above already fixed it at creation, so `unknown` is tolerated
+    // rather than failing a sandbox shut for lacking `stat`.
+    `relayfile_initial_sync_mode=$(stat -c %a ${shellQuote(scriptPath)} 2>/dev/null || stat -f %Lp ${shellQuote(scriptPath)} 2>/dev/null || echo unknown)`,
+    'case "$relayfile_initial_sync_mode" in',
+    "  600|unknown) ;;",
+    "  *)",
+    `    rm -f ${shellQuote(scriptPath)};`,
+    '    echo "relayfile initial sync script is mode $relayfile_initial_sync_mode, not 600; refusing to launch" >&2;',
+    "    exit 1",
+    "    ;;",
+    "esac",
     `nohup sh -c ${shellQuote(runner)} >/dev/null 2>&1 & echo $!`,
   ].join("\n");
 }
@@ -356,9 +422,21 @@ export function buildRelayfileMountInitialSyncStatusShell(
     RELAYFILE_INITIAL_SYNC_PID_PATH,
     runOptions.runId,
   );
+  const reapedPath = relayfileInitialSyncPath(
+    RELAYFILE_INITIAL_SYNC_REAPED_PATH,
+    runOptions.runId,
+  );
   return [
     `if [ -f ${shellQuote(exitPath)} ]; then`,
     `echo "${RELAYFILE_INITIAL_SYNC_EXIT_MARKER}$(cat ${shellQuote(exitPath)})";`,
+    // The completion window: the child is reaped, the exit sentinel is on its
+    // way. Report in-progress rather than falling through to the dead-PID
+    // check below, which would call a healthy sync a crash. If the runner is
+    // itself killed inside this window the sync stalls to the caller's
+    // deadline instead — an honest "did not finish" beats a false failure on
+    // the healthy path, which is the only path this window is reached on.
+    `elif [ -f ${shellQuote(reapedPath)} ]; then`,
+    `echo ${RELAYFILE_INITIAL_SYNC_RUNNING_MARKER};`,
     `elif [ -f ${shellQuote(pidPath)} ]; then`,
     `relayfile_initial_sync_pid=$(cat ${shellQuote(pidPath)} 2>/dev/null || true);`,
     'case "$relayfile_initial_sync_pid" in',
@@ -479,10 +557,13 @@ function buildMountArgs(opts: RelayfileMountShellOptions): string[] {
     `--workspace ${shellQuote(opts.workspaceId)}`,
     `--local-dir ${shellQuote(opts.localDir)}`,
     `--state-dir ${shellQuote(opts.stateDir)}`,
-    // Token goes via env prefix (see mountEnvPrefix) when tokenIngress === 'env',
-    // so it never enters argv. Otherwise it is emitted as --token for
+    // Token goes via env prefix (see mountEnvPrefix) when tokenIngress === 'env'
+    // and is not rendered at all when tokenIngress === 'creds-file', so in
+    // neither case does it enter argv. Otherwise it is emitted as --token for
     // backwards compat with daemon builds that only read the flag.
-    ...(opts.tokenIngress === "env" ? [] : [`--token ${shellQuote(opts.token)}`]),
+    ...(opts.tokenIngress === "env" || opts.tokenIngress === "creds-file"
+      ? []
+      : [`--token ${shellQuote(opts.token)}`]),
     ...(opts.websocket === false ? ["--websocket=false"] : []),
     ...(opts.lazyRepos ? ["--lazy-repos"] : []),
     ...scopedRemoteRoots(opts.paths ?? [], { allowProviderRoot: true })