From f7188bc78bebc7b6d0634cb291fabddf7e0d5d7f Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Mon, 24 Aug 2026 23:47:48 +0200
Subject: [PATCH 1/3] fix(mount): create the detached initial-sync script mode
 0600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The detached initial-sync launcher wrote its generated script with a plain
`cat >`, so the file landed at the process umask default — 0644 under a 022
umask — and the default token ingress rendered the path-scoped credential
into it as a `--token` literal. Any other process able to read the file
could recover a reusable credential, and the script outlived the sync that
used it.

- Create the script inside `(umask 077 && cat > ...)` so the mode is
  constrained at creation; a chmod after the write would leave a readable
  window. Verify the mode that actually landed (`stat -c %a`, falling back
  to `stat -f %Lp`) and refuse to launch if it is not 600.
- Add `tokenIngress: 'creds-file'`, which renders no credential literal at
  all and relies on the mode-0600 creds file already supplied alongside the
  launch command. It is opt-in rather than implied by `credsFilePath`,
  because pre-creds binaries ignore the creds-file env var and would fail
  authentication silently if `--token` were dropped from under them.
- Remove the generated script once the detached sync exits, before the exit
  sentinel is written, so a poller that has observed completion cannot race
  back and read it. The log, pid and exit sentinels are kept as non-secret
  failure diagnostics.

The tests execute the real launcher through /bin/sh under an explicit 022
umask and assert against the file that lands on disk; a string assertion on
the generated shell would not have caught the umask defect. Behaviour
verified on dash, bash --posix and zsh.

Refs AgentWorkforce/sandbox#30

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Session-Id: 798d531e-b682-47ba-90dc-0a26290aa6e6

Session-Id: b4b52699-ca5c-4331-b702-8989d1e91983

Session-Id: b4b52699-ca5c-4331-b702-8989d1e91983

Session-Id: b4b52699-ca5c-4331-b702-8989d1e91983

Session-Id: b4b52699-ca5c-4331-b702-8989d1e91983
---
 src/mount-script.test.ts | 285 +++++++++++++++++++++++++++++++++++++++
 src/mount-script.ts      |  74 ++++++++--
 2 files changed, 346 insertions(+), 13 deletions(-)

diff --git a/src/mount-script.test.ts b/src/mount-script.test.ts
index 3ba0385..c027b1f 100644
--- a/src/mount-script.test.ts
+++ b/src/mount-script.test.ts
@@ -7,6 +7,7 @@ import {
   mkdtempSync,
   readFileSync,
   rmSync,
+  statSync,
   writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
@@ -17,8 +18,13 @@ import {
   buildRelayfileMountStartShell,
   buildRelayfileMountFlushShell,
   buildRelayfileMountInitialSyncShell,
+  buildRelayfileMountInitialSyncBackgroundShell,
   buildRelayfileMountPathArgsShell,
   buildRelayfileMountShellTemplate,
+  RELAYFILE_INITIAL_SYNC_EXIT_PATH,
+  RELAYFILE_INITIAL_SYNC_LOG_PATH,
+  RELAYFILE_INITIAL_SYNC_PID_PATH,
+  RELAYFILE_INITIAL_SYNC_SCRIPT_PATH,
 } from "./mount-script.js";
 
 const TOKEN = "relay_pa_thisisasecrettoken_do_not_leak";
@@ -712,3 +718,282 @@ describe("initial-sync idle watchdog progress files", () => {
     );
   });
 });
+
+/**
+ * Regression guard for AgentWorkforce/sandbox#30.
+ *
+ * The detached initial-sync launcher generates a shell script under /tmp and
+ * hands it to a background process. Two things went wrong at once:
+ *
+ *   - `cat > <script>` created the file at the process umask default, so under
+ *     the production sandbox's 022 umask the script landed group/world
+ *     readable; and
+ *   - the default `argv` ingress rendered the path-scoped token into that
+ *     script as a `--token` literal.
+ *
+ * Together those left a reusable credential readable by any sibling process in
+ * the sandbox, even though a mode-0600 creds file was already being supplied
+ * alongside the launch command. The script also outlived the sync that used it.
+ *
+ * These tests execute the real launcher through /bin/sh under an explicit 022
+ * umask and assert against the file that actually lands on disk — a string
+ * assertion on the generated shell would not have caught the umask defect.
+ */
+describe("detached initial-sync script credential hygiene (sandbox#30)", () => {
+  const sleep = (ms: number): Promise<void> =>
+    new Promise((resolve) => setTimeout(resolve, ms));
+
+  async function waitFor(
+    predicate: () => boolean,
+    { timeoutMs = 15_000, stepMs = 25 } = {},
+  ): Promise<boolean> {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (predicate()) {
+        return true;
+      }
+      await sleep(stepMs);
+    }
+    return predicate();
+  }
+
+  /**
+   * Paths the launcher owns for a given run id. Registered for removal so a
+   * failing assertion cannot leave a credential-bearing file behind in /tmp.
+   */
+  function runPaths(t: TestContext, runId: string): {
+    scriptPath: string;
+    exitPath: string;
+    logPath: string;
+    pidPath: string;
+  } {
+    const paths = {
+      scriptPath: `${RELAYFILE_INITIAL_SYNC_SCRIPT_PATH}.${runId}`,
+      exitPath: `${RELAYFILE_INITIAL_SYNC_EXIT_PATH}.${runId}`,
+      logPath: `${RELAYFILE_INITIAL_SYNC_LOG_PATH}.${runId}`,
+      pidPath: `${RELAYFILE_INITIAL_SYNC_PID_PATH}.${runId}`,
+    };
+    t.after(() => {
+      for (const path of Object.values(paths)) {
+        rmSync(path, { force: true });
+      }
+    });
+    return paths;
+  }
+
+  /**
+   * A relayfile-mount stand-in that blocks until a release file appears, so the
+   * generated script is guaranteed to still be on disk while the test stats it.
+   * The bounded spin means a wedged test cannot leave the fake running forever.
+   */
+  function blockingFakeMount(t: TestContext): {
+    binDir: string;
+    root: string;
+    release: () => void;
+  } {
+    const root = mkdtempSync(join(tmpdir(), "sandbox-sec30-"));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const binDir = join(root, "bin");
+    const mkdir = spawnSync("mkdir", ["-p", binDir]);
+    assert.equal(mkdir.status, 0, mkdir.stderr?.toString());
+
+    const releasePath = join(root, "release");
+    const fakeMount = join(binDir, "relayfile-mount");
+    writeFileSync(
+      fakeMount,
+      `#!/bin/sh
+attempts=0
+while [ ! -f '${releasePath}' ] && [ "$attempts" -lt 400 ]; do
+  attempts=$((attempts + 1))
+  sleep 0.05
+done
+exit 0
+`,
+    );
+    chmodSync(fakeMount, 0o755);
+    return {
+      binDir,
+      root,
+      release: () => writeFileSync(releasePath, "go"),
+    };
+  }
+
+  function launch(
+    launcher: string,
+    binDir: string,
+  ): ReturnType<typeof spawnSync> {
+    // The explicit 022 umask is the point: it is the production sandbox's
+    // umask, and it is what made `cat >` produce a 0644 script.
+    return spawnSync("/bin/sh", ["-c", `umask 022; ${launcher}`], {
+      env: { ...process.env, PATH: `${binDir}:${process.env.PATH ?? ""}` },
+      encoding: "utf8",
+    });
+  }
+
+  it("creates the generated script at mode exactly 0600 under a 022 umask", async (t) => {
+    const runId = "sec30-mode";
+    const { scriptPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    const mode = statSync(scriptPath).mode & 0o777;
+    assert.equal(
+      mode.toString(8),
+      "600",
+      "the generated script may carry a credential and must never be readable " +
+        "by another user or process in the sandbox",
+    );
+
+    release();
+  });
+
+  it("keeps the token literal out of the generated script under creds-file ingress", async (t) => {
+    const runId = "sec30-no-literal";
+    const { scriptPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+
+    assert.doesNotMatch(
+      launcher,
+      /--token/,
+      "creds-file ingress must not render --token anywhere in the launcher",
+    );
+    assert.ok(
+      !launcher.includes(TOKEN),
+      "creds-file ingress must not render the token literal in the launcher",
+    );
+    assert.match(launcher, /RELAYFILE_MOUNT_CREDS_FILE=/);
+
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    const contents = readFileSync(scriptPath, "utf8");
+    assert.ok(
+      !contents.includes(TOKEN),
+      "the on-disk generated script still contains the credential literal",
+    );
+    assert.equal(statSync(scriptPath).mode & 0o777, 0o600);
+
+    release();
+  });
+
+  it("still renders --token for the default argv ingress (older daemons)", () => {
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId: "sec30-compat" },
+    );
+    // A creds file alone must NOT silently drop the flag: pre-creds binaries
+    // ignore RELAYFILE_MOUNT_CREDS_FILE, so dropping --token for them would
+    // turn a working mount into a silent authentication failure. Removing the
+    // literal is opt-in via tokenIngress.
+    assert.match(launcher, /--token/);
+    assert.ok(launcher.includes(TOKEN));
+  });
+
+  it("rejects creds-file ingress that has no creds file to read", () => {
+    assert.throws(
+      () =>
+        buildRelayfileMountInitialSyncBackgroundShell(
+          { ...BASE, tokenIngress: "creds-file" },
+          { runId: "sec30-guard" },
+        ),
+      /credsFilePath/,
+      "creds-file ingress renders no token by any route, so a missing creds " +
+        "file must fail loudly at build time",
+    );
+  });
+
+  it("removes the generated script once the detached sync exits", async (t) => {
+    const runId = "sec30-cleanup";
+    const { scriptPath, exitPath, logPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(scriptPath)),
+      true,
+      "launcher never produced the generated initial-sync script",
+    );
+
+    release();
+
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "detached sync never wrote its exit sentinel",
+    );
+    // The script is removed BEFORE the exit sentinel lands, so a poller that
+    // has observed completion can never race back and read the script.
+    assert.equal(
+      existsSync(scriptPath),
+      false,
+      "the generated script outlived the sync that used it",
+    );
+    // Non-secret diagnostics are deliberately preserved for failure analysis.
+    assert.equal(readFileSync(exitPath, "utf8").trim(), "0");
+    assert.equal(existsSync(logPath), true, "the sync log must be preserved");
+  });
+
+  it("verifies the landed mode before handing the script to a detached process", () => {
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId: "sec30-order" },
+    );
+    assert.match(
+      launcher,
+      /\(umask 077 && cat > /,
+      "the mode must be constrained at creation, not by a chmod after the " +
+        "write, which would leave a readable window",
+    );
+    const verifyAt = launcher.indexOf("relayfile_initial_sync_mode=");
+    const launchAt = launcher.indexOf("nohup sh -c");
+    assert.ok(verifyAt > 0, "expected a post-write mode verification");
+    assert.ok(
+      verifyAt < launchAt,
+      "the mode check must run before the script is handed to the detached process",
+    );
+  });
+});
diff --git a/src/mount-script.ts b/src/mount-script.ts
index df43e85..8d5faee 100644
--- a/src/mount-script.ts
+++ b/src/mount-script.ts
@@ -66,10 +66,22 @@ export type RelayfileMountShellOptions = {
    *     omitted from argv entirely. Requires a daemon build that reads the
    *     `RELAYFILE_MOUNT_TOKEN` env var. Confirm that capability before
    *     flipping the default to `'env'`.
+   *   - `'creds-file'`: no token literal is rendered at all — not in argv, not
+   *     in the env prefix. The daemon reads the credential from the mode-0600
+   *     file named by `credsFilePath`, which is therefore required. This is the
+   *     only ingress that leaves a generated on-disk script free of a reusable
+   *     credential, so it is what the detached initial-sync launcher should use
+   *     wherever the daemon build is known to honour RELAYFILE_MOUNT_CREDS_FILE.
    *
-   * The credentials-in-argv exposure was tracked as AgentWorkforce/sandbox#21.
+   * `'creds-file'` is opt-in rather than implied by `credsFilePath` alone.
+   * Pre-creds binaries ignore the unknown env var (see `credsFilePath`), so
+   * dropping `--token` for them would turn a working mount into a silent
+   * authentication failure rather than a loud one.
+   *
+   * The credentials-in-argv exposure was tracked as AgentWorkforce/sandbox#21;
+   * the credential-in-generated-script exposure as AgentWorkforce/sandbox#30.
    */
-  tokenIngress?: "argv" | "env";
+  tokenIngress?: "argv" | "env" | "creds-file";
 };
 
 /**
@@ -95,6 +107,8 @@ const EXACT_LOCAL_LAYOUT_ARG = `--local-layout ${shellQuote("exact")}`;
  * RELAYFILE_MOUNT_CREDS_FILE (see `credsFilePath` docs for the version-skew
  * rationale). When `tokenIngress === 'env'`, adds
  * RELAYFILE_MOUNT_TOKEN=<literal> so the launch token never enters argv.
+ * When `tokenIngress === 'creds-file'` no token literal is emitted at all —
+ * the creds file is the sole ingress.
  * The explicit `env` executable is required because initial-sync commands can
  * sit directly behind coreutils `timeout`, which does not shell-parse a bare
  * `VAR=value` assignment.
@@ -102,6 +116,14 @@ const EXACT_LOCAL_LAYOUT_ARG = `--local-layout ${shellQuote("exact")}`;
 function mountEnvPrefix(
   opts: Pick<RelayfileMountShellOptions, "credsFilePath" | "tokenIngress" | "token">,
 ): string {
+  if (opts.tokenIngress === "creds-file" && !opts.credsFilePath) {
+    // Fail at build time, not as an unauthenticated daemon in the sandbox:
+    // this ingress deliberately renders no token, so without a creds file the
+    // command carries no credential by any route.
+    throw new Error(
+      "relayfile mount tokenIngress 'creds-file' requires credsFilePath",
+    );
+  }
   const parts: string[] = [];
   if (opts.credsFilePath) {
     parts.push(`RELAYFILE_MOUNT_CREDS_FILE=${shellQuote(opts.credsFilePath)}`);
@@ -325,18 +347,41 @@ export function buildRelayfileMountInitialSyncBackgroundShell(
     "fi;",
     "relayfile_initial_sync_pid=$!;",
     `echo "$relayfile_initial_sync_pid" > ${shellQuote(pidPath)};`,
-    'wait "$relayfile_initial_sync_pid";',
-    `echo $? > ${shellQuote(exitPath)}`,
+    "relayfile_initial_sync_status=0;",
+    'wait "$relayfile_initial_sync_pid" || relayfile_initial_sync_status=$?;',
+    // Shred the generated script the moment the sync is done with it, and do
+    // it BEFORE the exit sentinel lands: a poller that sees the sentinel must
+    // never be able to race back and read the script. The log, pid and exit
+    // sentinels survive — they are the non-secret failure diagnostics.
+    `rm -f ${shellQuote(scriptPath)};`,
+    `echo "$relayfile_initial_sync_status" > ${shellQuote(exitPath)}`,
   ].join(" ");
   return [
     "set -e",
-    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)} &&`,
-    // Quoted heredoc delimiter: the sync shell lands in the script file
-    // verbatim, with no re-quoting hazards from nesting it in `sh -c`.
-    `cat > ${shellQuote(scriptPath)} <<'RELAYFILE_INITIAL_SYNC_EOF'
+    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)}`,
+    // The script can carry a credential (see `tokenIngress`), so it must never
+    // exist group/world-readable for even an instant. `umask 077` in a subshell
+    // constrains the mode at creation — a chmod after the write would leave a
+    // readable window a sibling process could win. Quoted heredoc delimiter:
+    // the sync shell lands in the file verbatim, with no re-quoting hazards
+    // from nesting it in `sh -c`.
+    `(umask 077 && cat > ${shellQuote(scriptPath)}) <<'RELAYFILE_INITIAL_SYNC_EOF'
 ${syncShell}
-RELAYFILE_INITIAL_SYNC_EOF
-`,
+RELAYFILE_INITIAL_SYNC_EOF`,
+    // Defence in depth: confirm the mode that actually landed before handing
+    // the script to a detached process. GNU/busybox spell it `stat -c %a`,
+    // BSD `stat -f %Lp`. If neither exists we cannot read the mode back, but
+    // the umask above already fixed it at creation, so `unknown` is tolerated
+    // rather than failing a sandbox shut for lacking `stat`.
+    `relayfile_initial_sync_mode=$(stat -c %a ${shellQuote(scriptPath)} 2>/dev/null || stat -f %Lp ${shellQuote(scriptPath)} 2>/dev/null || echo unknown)`,
+    'case "$relayfile_initial_sync_mode" in',
+    "  600|unknown) ;;",
+    "  *)",
+    `    rm -f ${shellQuote(scriptPath)};`,
+    '    echo "relayfile initial sync script is mode $relayfile_initial_sync_mode, not 600; refusing to launch" >&2;',
+    "    exit 1",
+    "    ;;",
+    "esac",
     `nohup sh -c ${shellQuote(runner)} >/dev/null 2>&1 & echo $!`,
   ].join("\n");
 }
@@ -479,10 +524,13 @@ function buildMountArgs(opts: RelayfileMountShellOptions): string[] {
     `--workspace ${shellQuote(opts.workspaceId)}`,
     `--local-dir ${shellQuote(opts.localDir)}`,
     `--state-dir ${shellQuote(opts.stateDir)}`,
-    // Token goes via env prefix (see mountEnvPrefix) when tokenIngress === 'env',
-    // so it never enters argv. Otherwise it is emitted as --token for
+    // Token goes via env prefix (see mountEnvPrefix) when tokenIngress === 'env'
+    // and is not rendered at all when tokenIngress === 'creds-file', so in
+    // neither case does it enter argv. Otherwise it is emitted as --token for
     // backwards compat with daemon builds that only read the flag.
-    ...(opts.tokenIngress === "env" ? [] : [`--token ${shellQuote(opts.token)}`]),
+    ...(opts.tokenIngress === "env" || opts.tokenIngress === "creds-file"
+      ? []
+      : [`--token ${shellQuote(opts.token)}`]),
     ...(opts.websocket === false ? ["--websocket=false"] : []),
     ...(opts.lazyRepos ? ["--lazy-repos"] : []),
     ...scopedRemoteRoots(opts.paths ?? [], { allowProviderRoot: true })

From ca357152d30a8886fa8b96826a07b833645962f5 Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Tue, 25 Aug 2026 03:57:31 +0200
Subject: [PATCH 2/3] test(mount): execute the initial-sync launcher to gate
 the 0600 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "verifies the landed mode" test only grepped the generated launcher for
`umask 077` and for the position of the mode check. A grep asserts a proxy: it
passes just as happily when the check is present in the generated text but
broken at runtime, which is the regression that matters for a credential fix.
The property is that the file on disk is 0600 and holds no reusable token.

- Add a gating test that runs the check. It mutates the launcher back to the
  pre-fix creation mode (`umask 022` for `umask 077`) — the exact regression
  the check exists to catch — executes it under an explicit 022 umask, and
  asserts the launcher refuses: non-zero exit, a refusal naming the mode that
  actually landed, the readable script removed, and no pid, log or exit
  sentinel, because nothing was handed to a detached process.
- Assert the landed mode through `stat` by exit code, the way the launcher
  reads it, alongside the existing `statSync` check.
- Assert that under the default argv ingress the credential really is in the
  file that lands, so the 0600 mode is load-bearing rather than incidental.
- Keep the text assertions as a fast unit: creation order is a property of the
  generated shell, and a chmod-after-write would leave a readable window that
  a mode assertion on the finished file cannot see.

Negative controls: with the `case` arm widened so the mode check tolerates
0644, the text test stays green and the new executing test goes red — cubic's
scenario exactly. With `umask 077` removed entirely, 5 of 7 go red; the two
build-time invariants are meant to pass in both states.

Refs AgentWorkforce/sandbox#30

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Session-Id: 39f5e60a-56d3-46fd-95d8-8f82f024eba2
---
 src/mount-script.test.ts | 134 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 127 insertions(+), 7 deletions(-)

diff --git a/src/mount-script.test.ts b/src/mount-script.test.ts
index c027b1f..12f9e0d 100644
--- a/src/mount-script.test.ts
+++ b/src/mount-script.test.ts
@@ -757,6 +757,49 @@ describe("detached initial-sync script credential hygiene (sandbox#30)", () => {
     return predicate();
   }
 
+  /**
+   * Read the mode of the file that actually landed the way the launcher itself
+   * does — through `stat`, asserted by the exit code of the comparison rather
+   * than by a string match in JS. GNU/busybox spell it `stat -c %a`, BSD
+   * `stat -f %Lp`.
+   */
+  function assertLandedMode(path: string, expected: string): void {
+    const check = spawnSync(
+      "/bin/sh",
+      [
+        "-c",
+        'mode=$(stat -c %a "$1" 2>/dev/null || stat -f %Lp "$1" 2>/dev/null)' +
+          ' || exit 2; printf %s "$mode"; [ "$mode" = "$2" ]',
+        "sh",
+        path,
+        expected,
+      ],
+      { encoding: "utf8" },
+    );
+    assert.notEqual(
+      check.status,
+      2,
+      `could not stat the file the launcher actually created: ${path}`,
+    );
+    assert.equal(
+      check.status,
+      0,
+      `expected ${path} to land at mode ${expected}, got ${check.stdout}`,
+    );
+  }
+
+  /**
+   * The launcher tolerates `unknown` when neither `stat` spelling exists, so
+   * the refusal path below can only be exercised where one of them works.
+   */
+  function statSupported(): boolean {
+    const probe = spawnSync("/bin/sh", [
+      "-c",
+      "stat -c %a /tmp >/dev/null 2>&1 || stat -f %Lp /tmp >/dev/null 2>&1",
+    ]);
+    return probe.status === 0;
+  }
+
   /**
    * Paths the launcher owns for a given run id. Registered for removal so a
    * failing assertion cannot leave a credential-bearing file behind in /tmp.
@@ -853,6 +896,9 @@ exit 0
       "launcher never produced the generated initial-sync script",
     );
 
+    // The property under test is the mode of the file on disk, so it is read
+    // back off the real file: once by `stat` (exit code), once through node.
+    assertLandedMode(scriptPath, "600");
     const mode = statSync(scriptPath).mode & 0o777;
     assert.equal(
       mode.toString(8),
@@ -860,6 +906,13 @@ exit 0
       "the generated script may carry a credential and must never be readable " +
         "by another user or process in the sandbox",
     );
+    // ...and this is why the mode is the whole fix: under the default argv
+    // ingress the credential really is sitting in that file.
+    assert.ok(
+      readFileSync(scriptPath, "utf8").includes(TOKEN),
+      "expected the default ingress to put the credential in the script, " +
+        "which is what makes the 0600 mode load-bearing",
+    );
 
     release();
   });
@@ -904,6 +957,7 @@ exit 0
       !contents.includes(TOKEN),
       "the on-disk generated script still contains the credential literal",
     );
+    assertLandedMode(scriptPath, "600");
     assert.equal(statSync(scriptPath).mode & 0o777, 0o600);
 
     release();
@@ -977,17 +1031,83 @@ exit 0
     assert.equal(existsSync(logPath), true, "the sync log must be preserved");
   });
 
-  it("verifies the landed mode before handing the script to a detached process", () => {
+  /**
+   * The gating test for the mode check: it runs the check rather than reading
+   * it. The launcher is mutated back to the pre-fix creation mode (`umask 022`
+   * in place of `umask 077`), which is the exact regression the check exists to
+   * catch, and then executed — so a check that is present in the generated text
+   * but broken at runtime fails here instead of passing a string match.
+   */
+  it("refuses to launch, at runtime, when the script does not land at 0600", async (t) => {
+    if (!statSupported()) {
+      t.skip("no stat -c/-f available; the launcher tolerates an unknown mode");
+      return;
+    }
+    const runId = "sec30-refuse";
+    const { scriptPath, exitPath, pidPath, logPath } = runPaths(t, runId);
+    const { binDir, root, release } = blockingFakeMount(t);
+
     const launcher = buildRelayfileMountInitialSyncBackgroundShell(
-      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
-      { runId: "sec30-order" },
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+      },
+      { runId },
     );
-    assert.match(
+    const defective = launcher.replace(
+      "(umask 077 && cat > ",
+      "(umask 022 && cat > ",
+    );
+    assert.notEqual(
+      defective,
       launcher,
-      /\(umask 077 && cat > /,
-      "the mode must be constrained at creation, not by a chmod after the " +
-        "write, which would leave a readable window",
+      "the mode must be constrained at creation by `umask 077`, not by a " +
+        "chmod after the write, which would leave a readable window",
+    );
+
+    const result = launch(defective, binDir);
+
+    assert.notEqual(
+      result.status,
+      0,
+      "a script that landed group/world readable must abort the launch",
+    );
+    assert.match(
+      result.stderr ?? "",
+      /is mode 644, not 600; refusing to launch/,
+      "expected the refusal to name the mode that actually landed",
+    );
+    assert.equal(
+      existsSync(scriptPath),
+      false,
+      "the readable script must be removed, not left in /tmp",
+    );
+    // Nothing may have been handed to a detached process: no pid, no log, no
+    // exit sentinel, because the sync never started.
+    assert.equal(existsSync(pidPath), false, "a sync was started anyway");
+    assert.equal(existsSync(logPath), false, "a sync was started anyway");
+    assert.equal(
+      await waitFor(() => existsSync(exitPath), { timeoutMs: 500 }),
+      false,
+      "a sync was started anyway",
+    );
+
+    // Nothing should be holding the fake mount, but release it the way the
+    // other launching tests do so a surprise child cannot outlive the test.
+    release();
+  });
+
+  it("constrains the mode at creation rather than by a chmod after the write", () => {
+    // Fast unit alongside the executing test above: creation order is a
+    // property of the generated text, and a chmod-after-write would leave a
+    // readable window that a mode assertion on the finished file cannot see.
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId: "sec30-order" },
     );
+    assert.match(launcher, /\(umask 077 && cat > /);
     const verifyAt = launcher.indexOf("relayfile_initial_sync_mode=");
     const launchAt = launcher.indexOf("nohup sh -c");
     assert.ok(verifyAt > 0, "expected a post-write mode verification");

From ad7fc6f7e0f6bbf5ef2e0d9210c858796d7ed612 Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Tue, 25 Aug 2026 04:19:03 +0200
Subject: [PATCH 3/3] fix(mount): keep the initial-sync completion window out
 of the failure path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removing the generated script after the sync is done with it — the credential
fix in f7188bc — put a fork+exec between reaping the child and publishing its
exit status. Inside that interval the pid file names a dead process, so the
status probe's dead-PID heuristic reported `exit 127`, and the orchestrator
turns that into `Failed initial relayfile sync` for a sync that exited 0. The
window existed before (an `echo` builtin stood in it); this PR widened it to a
`rm`, which is where it became reachable in practice.

A false failure on a healthy mount is worse than the cosmetic issue it looks
like: every consumer of that status learns to distrust it.

- The runner marks the completion window the instant `wait` returns, via a
  bare `: >` redirection so no fork stands between the reap and the mark, and
  before the `rm` that now lives inside the window.
- The status probe reports in-progress while that marker exists and the exit
  sentinel does not, instead of falling through to the dead-PID check. Script
  removal stays strictly before the exit sentinel, so a poller that has seen
  completion still cannot race back and read the script.
- The pre-run sweep clears a stale marker, or a previous run's marker would
  make this run's dead-PID check unreachable.
- If the runner is itself killed inside the window the sync now stalls to the
  caller's deadline rather than reporting 127. An honest "did not finish"
  beats a false failure on the healthy path, which is the only path that
  reaches this window.

Tests. The must-fire wedges the real runner open inside the window with an
`rm` that performs the removal and then blocks, confirms the state is genuinely
the window (child reaped, script gone, pid file present, no exit sentinel), and
polls the real probe throughout. With the probe branch removed it fails on the
first poll with `probe reported {"state":"exited","exitCode":127} inside the
completion window`. Must-not-fire: the same on-disk state without the marker
still reports 127, and a sync whose mount really fails still reports failure
end to end — both pass in either state.

Refs AgentWorkforce/sandbox#30

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Session-Id: 39f5e60a-56d3-46fd-95d8-8f82f024eba2
---
 src/mount-script.test.ts | 217 +++++++++++++++++++++++++++++++++++++++
 src/mount-script.ts      |  39 ++++++-
 2 files changed, 253 insertions(+), 3 deletions(-)

diff --git a/src/mount-script.test.ts b/src/mount-script.test.ts
index 12f9e0d..a32a90a 100644
--- a/src/mount-script.test.ts
+++ b/src/mount-script.test.ts
@@ -19,11 +19,15 @@ import {
   buildRelayfileMountFlushShell,
   buildRelayfileMountInitialSyncShell,
   buildRelayfileMountInitialSyncBackgroundShell,
+  buildRelayfileMountInitialSyncStatusShell,
   buildRelayfileMountPathArgsShell,
   buildRelayfileMountShellTemplate,
+  parseRelayfileMountInitialSyncStatus,
+  type RelayfileMountInitialSyncStatus,
   RELAYFILE_INITIAL_SYNC_EXIT_PATH,
   RELAYFILE_INITIAL_SYNC_LOG_PATH,
   RELAYFILE_INITIAL_SYNC_PID_PATH,
+  RELAYFILE_INITIAL_SYNC_REAPED_PATH,
   RELAYFILE_INITIAL_SYNC_SCRIPT_PATH,
 } from "./mount-script.js";
 
@@ -809,12 +813,14 @@ describe("detached initial-sync script credential hygiene (sandbox#30)", () => {
     exitPath: string;
     logPath: string;
     pidPath: string;
+    reapedPath: string;
   } {
     const paths = {
       scriptPath: `${RELAYFILE_INITIAL_SYNC_SCRIPT_PATH}.${runId}`,
       exitPath: `${RELAYFILE_INITIAL_SYNC_EXIT_PATH}.${runId}`,
       logPath: `${RELAYFILE_INITIAL_SYNC_LOG_PATH}.${runId}`,
       pidPath: `${RELAYFILE_INITIAL_SYNC_PID_PATH}.${runId}`,
+      reapedPath: `${RELAYFILE_INITIAL_SYNC_REAPED_PATH}.${runId}`,
     };
     t.after(() => {
       for (const path of Object.values(paths)) {
@@ -1099,6 +1105,217 @@ exit 0
     release();
   });
 
+  /**
+   * A relayfile-mount stand-in that exits immediately with a chosen status, so
+   * the runner reaches its completion window straight away.
+   */
+  function instantFakeMount(
+    t: TestContext,
+    exitCode: number,
+  ): { binDir: string; root: string } {
+    const root = mkdtempSync(join(tmpdir(), "sandbox-sec30-window-"));
+    t.after(() => rmSync(root, { recursive: true, force: true }));
+    const binDir = join(root, "bin");
+    const mkdir = spawnSync("mkdir", ["-p", binDir]);
+    assert.equal(mkdir.status, 0, mkdir.stderr?.toString());
+    const fakeMount = join(binDir, "relayfile-mount");
+    writeFileSync(fakeMount, `#!/bin/sh\nexit ${exitCode}\n`);
+    chmodSync(fakeMount, 0o755);
+    return { binDir, root };
+  }
+
+  /**
+   * Wedge the runner open inside its completion window. The runner removes the
+   * generated script between reaping the child and publishing the exit
+   * sentinel; a `rm` that performs the removal and then blocks holds that
+   * window open for as long as the test needs, so the window is observed
+   * rather than raced for.
+   *
+   * Only the runner's own `rm -f <script>` is intercepted: the launcher's
+   * pre-run sweep passes five paths, and the sync script's idle-marker removal
+   * names a different file.
+   */
+  function installHoldingRm(
+    binDir: string,
+    scriptPath: string,
+    enteredPath: string,
+    releasePath: string,
+  ): void {
+    const rm = join(binDir, "rm");
+    writeFileSync(
+      rm,
+      `#!/bin/sh
+if [ "$#" -eq 2 ] && [ "$2" = '${scriptPath}' ]; then
+  /bin/rm -f "$2"
+  : > '${enteredPath}'
+  attempts=0
+  while [ ! -f '${releasePath}' ] && [ "$attempts" -lt 400 ]; do
+    attempts=$((attempts + 1))
+    sleep 0.05
+  done
+  exit 0
+fi
+exec /bin/rm "$@"
+`,
+    );
+    chmodSync(rm, 0o755);
+  }
+
+  /** Run the real status probe the way the orchestrator's poll loop does. */
+  function probeStatus(runId: string): RelayfileMountInitialSyncStatus {
+    const probe = spawnSync(
+      "/bin/sh",
+      ["-c", buildRelayfileMountInitialSyncStatusShell({ runId })],
+      { encoding: "utf8" },
+    );
+    assert.equal(probe.status, 0, probe.stderr);
+    return parseRelayfileMountInitialSyncStatus(probe.stdout);
+  }
+
+  /**
+   * Removing the script after the sync is done with it (the credential fix
+   * above) put a fork+exec between reaping the child and publishing its exit
+   * status. Inside that interval the pid file names a dead process, so the
+   * probe's dead-PID heuristic called a healthy sync a crash — `exit 127`,
+   * which `startMount` turns into a failed mount. Reported by CodeRabbit on
+   * PR #39.
+   *
+   * This must-fire holds the window open and polls the real probe inside it.
+   * Before the completion marker it fails on the first poll.
+   */
+  it("does not report a failure inside the completion window", async (t) => {
+    const runId = "sec30-window";
+    const { scriptPath, exitPath, reapedPath, pidPath } = runPaths(t, runId);
+    const { binDir, root } = instantFakeMount(t, 0);
+    const enteredPath = join(root, "rm-entered");
+    const releasePath = join(root, "rm-release");
+    installHoldingRm(binDir, scriptPath, enteredPath, releasePath);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+
+    assert.equal(
+      await waitFor(() => existsSync(enteredPath)),
+      true,
+      "the runner never reached the script removal",
+    );
+
+    // Confirm this really is the window before asserting anything about it:
+    // child reaped, script gone, exit status not yet published.
+    assert.equal(existsSync(reapedPath), true, "the window was never marked");
+    assert.equal(existsSync(scriptPath), false, "the script was not removed");
+    assert.equal(existsSync(pidPath), true, "the pid file is what misleads the probe");
+    assert.equal(existsSync(exitPath), false, "the exit sentinel landed too early");
+
+    for (let poll = 0; poll < 25; poll += 1) {
+      const status = probeStatus(runId);
+      assert.deepEqual(
+        status,
+        { state: "running" },
+        `probe reported ${JSON.stringify(status)} inside the completion ` +
+          "window; startMount turns a non-zero exit here into a failed mount " +
+          "for a sync that is finishing normally",
+      );
+      await sleep(10);
+    }
+
+    assert.equal(
+      existsSync(exitPath),
+      false,
+      "the window closed on its own, so those polls proved nothing",
+    );
+
+    writeFileSync(releasePath, "go");
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "the exit sentinel never landed after the window closed",
+    );
+    assert.deepEqual(probeStatus(runId), { state: "exited", exitCode: 0 });
+  });
+
+  /**
+   * The must-not-fire. Same on-disk state as the window above, minus the
+   * completion marker: a sync whose runner died without ever publishing an
+   * exit status is still a failure, and the marker must not soften that.
+   */
+  it("still reports a failure for a sync that died before completion", (t) => {
+    const runId = "sec30-died";
+    const { pidPath, reapedPath } = runPaths(t, runId);
+    // Above both Linux's default pid_max and macOS's, so it names no process
+    // on any host and cannot be reused out from under the assertion.
+    writeFileSync(pidPath, "4194305\n");
+
+    assert.deepEqual(
+      probeStatus(runId),
+      { state: "exited", exitCode: 127 },
+      "a dead sync with no exit status must still read as a failure",
+    );
+
+    // The marker is the only difference between the two states.
+    writeFileSync(reapedPath, "");
+    assert.deepEqual(probeStatus(runId), { state: "running" });
+  });
+
+  it("still reports a genuinely failed sync as a failure end to end", async (t) => {
+    const runId = "sec30-failed";
+    const { exitPath } = runPaths(t, runId);
+    const { binDir, root } = instantFakeMount(t, 3);
+
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      {
+        ...BASE,
+        localDir: join(root, "workspace"),
+        stateDir: join(root, "state"),
+        credsFilePath: join(root, "creds.json"),
+        tokenIngress: "creds-file",
+      },
+      { runId },
+    );
+    const result = launch(launcher, binDir);
+    assert.equal(result.status, 0, result.stderr);
+    assert.equal(
+      await waitFor(() => existsSync(exitPath)),
+      true,
+      "the exit sentinel never landed",
+    );
+
+    const status = probeStatus(runId);
+    assert.equal(status.state, "exited");
+    assert.notEqual(
+      status.state === "exited" ? status.exitCode : 0,
+      0,
+      "a sync whose mount failed must not be reported as a success",
+    );
+  });
+
+  it("clears a stale completion marker before a new run", (t) => {
+    // A marker left by a previous run would make this run's dead-PID check
+    // unreachable, so the launcher's pre-run sweep has to take it.
+    const runId = "sec30-stale";
+    const { reapedPath } = runPaths(t, runId);
+    const launcher = buildRelayfileMountInitialSyncBackgroundShell(
+      { ...BASE, credsFilePath: "/etc/relayfile/creds.json" },
+      { runId },
+    );
+    const sweep = launcher.split("\n").find((line) => line.startsWith("rm -f "));
+    assert.ok(sweep, "expected a pre-run sweep");
+    assert.ok(
+      sweep.includes(reapedPath),
+      "the pre-run sweep must clear a stale completion marker",
+    );
+  });
+
   it("constrains the mode at creation rather than by a chmod after the write", () => {
     // Fast unit alongside the executing test above: creation order is a
     // property of the generated text, and a chmod-after-write would leave a
diff --git a/src/mount-script.ts b/src/mount-script.ts
index 8d5faee..98641b3 100644
--- a/src/mount-script.ts
+++ b/src/mount-script.ts
@@ -294,6 +294,16 @@ export const RELAYFILE_INITIAL_SYNC_SCRIPT_PATH = "/tmp/relayfile-initial-sync.s
 export const RELAYFILE_INITIAL_SYNC_EXIT_PATH = "/tmp/relayfile-initial-sync.exit";
 export const RELAYFILE_INITIAL_SYNC_LOG_PATH = "/tmp/relayfile-initial-sync.log";
 export const RELAYFILE_INITIAL_SYNC_PID_PATH = "/tmp/relayfile-initial-sync.pid";
+/**
+ * Written by the runner the instant `wait` returns — after the child has been
+ * reaped, before the exit sentinel is published. It marks the completion
+ * window: the runner knows the exit status but has not written it yet, so the
+ * child PID is already dead while the sync is in fact finishing normally. The
+ * status probe treats this as in-progress, otherwise its dead-PID heuristic
+ * reports a false exit 127 on a perfectly healthy sync.
+ */
+export const RELAYFILE_INITIAL_SYNC_REAPED_PATH =
+  "/tmp/relayfile-initial-sync.reaped";
 
 export type RelayfileMountInitialSyncRunOptions = {
   runId?: string;
@@ -338,6 +348,10 @@ export function buildRelayfileMountInitialSyncBackgroundShell(
     RELAYFILE_INITIAL_SYNC_PID_PATH,
     runOptions.runId,
   );
+  const reapedPath = relayfileInitialSyncPath(
+    RELAYFILE_INITIAL_SYNC_REAPED_PATH,
+    runOptions.runId,
+  );
   const syncShell = buildRelayfileMountInitialSyncShell(opts);
   const runner = [
     "if command -v setsid >/dev/null 2>&1; then",
@@ -349,16 +363,23 @@ export function buildRelayfileMountInitialSyncBackgroundShell(
     `echo "$relayfile_initial_sync_pid" > ${shellQuote(pidPath)};`,
     "relayfile_initial_sync_status=0;",
     'wait "$relayfile_initial_sync_pid" || relayfile_initial_sync_status=$?;',
+    // Claim the completion window before anything else runs in it. From here
+    // the child PID is dead but the exit status is not yet published, and the
+    // status probe would otherwise read that dead PID as a crash. `:` is a
+    // shell builtin, so this is a bare redirection — no fork stands between
+    // `wait` returning and the window being marked.
+    `: > ${shellQuote(reapedPath)};`,
     // Shred the generated script the moment the sync is done with it, and do
     // it BEFORE the exit sentinel lands: a poller that sees the sentinel must
-    // never be able to race back and read the script. The log, pid and exit
-    // sentinels survive — they are the non-secret failure diagnostics.
+    // never be able to race back and read the script. `rm` is a fork+exec and
+    // sits entirely inside the window marked above. The log, pid, reaped and
+    // exit sentinels survive — they are the non-secret failure diagnostics.
     `rm -f ${shellQuote(scriptPath)};`,
     `echo "$relayfile_initial_sync_status" > ${shellQuote(exitPath)}`,
   ].join(" ");
   return [
     "set -e",
-    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)}`,
+    `rm -f ${shellQuote(scriptPath)} ${shellQuote(exitPath)} ${shellQuote(logPath)} ${shellQuote(pidPath)} ${shellQuote(reapedPath)}`,
     // The script can carry a credential (see `tokenIngress`), so it must never
     // exist group/world-readable for even an instant. `umask 077` in a subshell
     // constrains the mode at creation — a chmod after the write would leave a
@@ -401,9 +422,21 @@ export function buildRelayfileMountInitialSyncStatusShell(
     RELAYFILE_INITIAL_SYNC_PID_PATH,
     runOptions.runId,
   );
+  const reapedPath = relayfileInitialSyncPath(
+    RELAYFILE_INITIAL_SYNC_REAPED_PATH,
+    runOptions.runId,
+  );
   return [
     `if [ -f ${shellQuote(exitPath)} ]; then`,
     `echo "${RELAYFILE_INITIAL_SYNC_EXIT_MARKER}$(cat ${shellQuote(exitPath)})";`,
+    // The completion window: the child is reaped, the exit sentinel is on its
+    // way. Report in-progress rather than falling through to the dead-PID
+    // check below, which would call a healthy sync a crash. If the runner is
+    // itself killed inside this window the sync stalls to the caller's
+    // deadline instead — an honest "did not finish" beats a false failure on
+    // the healthy path, which is the only path this window is reached on.
+    `elif [ -f ${shellQuote(reapedPath)} ]; then`,
+    `echo ${RELAYFILE_INITIAL_SYNC_RUNNING_MARKER};`,
     `elif [ -f ${shellQuote(pidPath)} ]; then`,
     `relayfile_initial_sync_pid=$(cat ${shellQuote(pidPath)} 2>/dev/null || true);`,
     'case "$relayfile_initial_sync_pid" in',