@foldrun/core 0.4.0 → 0.6.0

package/src/script-tools.ts

@@ -21,6 +21,8 @@ import { z } from "zod";
 import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
 import { runInContainer } from "./container.ts";
 import { hostSafeEnv } from "./host-env.ts";
+import { workspaceLinkEnv } from "./confine.ts";
+import { platform } from "./platform.ts";
 
 // A script's only clock is the `timeout:` its own tool.md declares. There
 // was a two-minute default and a ten-minute cap here; both were the
@@ -39,8 +41,9 @@ export interface ScriptSpec {
   args: Record<string, string>; // arg name → description
   interpreter?: string; // optional override, e.g. "python3", "bash"
   /** Seconds this script may run — for the crawl that legitimately takes
-   *  five minutes. Defaults to 120, capped at 600: a limit an author can
-   *  raise is a budget; one they can remove is a hang. */
+   *  five minutes. Unset means no platform clock; there was a two-minute
+   *  default and a ten-minute cap here and both were removed (see the note
+   *  above `timeoutFor`). */
   timeout?: number;
   /** The script itself, when the tool is a single markdown file with its
    *  code in a fenced block. Materialised to a file at call time — the
@@ -99,6 +102,15 @@ export function parseScripts(raw: unknown): ScriptSpec[] {
   return out;
 }
 
+/** Interpreter names that mean a language rather than a binary, and the
+ *  extension whose prepared interpreter serves them. */
+const GENERIC_INTERPRETER: Record<string, string> = {
+  python: ".py",
+  python3: ".py",
+  "/usr/bin/python3": ".py",
+  "/usr/bin/env python3": ".py",
+};
+
 // Pick how to execute a file when no interpreter is declared.
 //
 // Exported because the tool tester has to make the same choice, and used to
@@ -110,7 +122,18 @@ export function commandFor(
   abs: string,
   overrides: Record<string, string> = {},
 ): { cmd: string; args: string[] } {
-  if (spec.interpreter) return { cmd: spec.interpreter, args: [abs] };
+  if (spec.interpreter) {
+    // `interpreter: python3` names the language, not a particular binary, and
+    // it is how most tool files are written. Taken literally it ran the bare
+    // system python beside a venv built for this very tool, and the tool
+    // died on its first import ("No module named openpyxl") while the log
+    // above it said the runtime was cached. A generic python name is served
+    // by the prepared venv when there is one; a path or anything else is
+    // still obeyed as written.
+    const lang = GENERIC_INTERPRETER[spec.interpreter.trim()];
+    if (lang && overrides[lang]) return { cmd: overrides[lang], args: [abs] };
+    return { cmd: spec.interpreter, args: [abs] };
+  }
   const ext = path.extname(abs).toLowerCase();
   // A prepared runtime (venv, npm prefix) wins over the host interpreter.
   if (overrides[ext]) return { cmd: overrides[ext], args: [abs] };
@@ -211,12 +234,16 @@ export function runScript(
     // Container path: same command, executed inside an isolated container
     // with only the agent's directory (plus declared shared dirs) mounted.
     if (exec && exec.executor === "docker") {
+      // `workspace/…` is the workspace root on the host (the step's link)
+      // and in a run container; here there is no link, so each such
+      // argument is staged: copied in, pointed at, and copied back after.
+      const workspaceRoot = path.resolve(cwd, "..", "..");
+      const staged: { host: string; container: string }[] = [];
       const inContainer = (p: string) => {
-        if (p.startsWith(path.resolve(cwd))) return p.replace(path.resolve(cwd), "/workspace");
-        for (const [host, mount] of Object.entries(exec.mounts)) {
-          if (p.startsWith(host)) return p.replace(host, mount);
-        }
-        return p;
+        const w = stageWorkspaceArg(p, workspaceRoot);
+        if (!w) return containerPath(p, cwd, exec.mounts);
+        if (!staged.some((s) => s.host === w.host)) staged.push(w);
+        return w.container;
       };
       const argv = [
         // The interpreter inside the image, not the host's venv path.
@@ -228,6 +255,7 @@ export function runScript(
       runInContainer({
         agentDir: path.resolve(cwd),
         readOnly: exec.mounts,
+        staged,
         image: exec.image,
         argv,
         env,
@@ -247,7 +275,7 @@ export function runScript(
     // environment, which is the boundary, so nothing is lost there.
     const child = spawn(cmd, args, {
       cwd,
-      env: { ...hostSafeEnv(), ...env },
+      env: workspaceLinkEnv({ ...hostSafeEnv(), ...env }, cwd),
       timeout: timeoutFor(spec),
     });
     let out = "";
@@ -269,6 +297,39 @@ export function runScript(
   });
 }
 
+/**
+ * A host path as the script's container sees it: under the agent's own
+ * directory it is /workspace, under a mounted folder it is that mount, and
+ * anything else (an argument that only looks like a path) is left alone.
+ * Containment, not a text prefix: `<ws>/scripts-old/x.py` is not under
+ * `<ws>/scripts`. The longest mount wins, so a nested one is not shadowed.
+ */
+export function containerPath(p: string, agentDir: string, mounts: Record<string, string>): string {
+  if (!path.isAbsolute(p)) return p;
+  const under = (root: string) => {
+    const rel = path.relative(root, p);
+    return rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)) ? rel : null;
+  };
+  const own = under(path.resolve(agentDir));
+  if (own !== null) return path.posix.join("/workspace", own.split(path.sep).join("/"));
+  const hit = Object.entries(mounts)
+    .map(([host, mount]) => ({ mount, rel: under(path.resolve(host)), len: host.length }))
+    .filter((m) => m.rel !== null)
+    .sort((a, b) => b.len - a.len)[0];
+  return hit ? path.posix.join(hit.mount, hit.rel!.split(path.sep).join("/")) : p;
+}
+
+/** Where a `workspace/…` script argument is staged in a script container,
+ *  or null when it is not one (or climbs out of the workspace). */
+export function stageWorkspaceArg(arg: string, workspaceRoot: string): { host: string; container: string } | null {
+  if (arg !== "workspace" && !arg.startsWith("workspace/")) return null;
+  const rel = arg.slice("workspace".length).replace(/^\/+/, "");
+  const host = path.resolve(workspaceRoot, rel);
+  const within = path.relative(workspaceRoot, host);
+  if (within.startsWith("..") || path.isAbsolute(within)) return null;
+  return { host, container: path.posix.join("/workspace-root", within.split(path.sep).join("/")) };
+}
+
 export interface ExecutionContext {
   /** "docker" nests each script in its own container; "sandbox" spawns it
    *  directly inside the isolation the step already has. */
@@ -307,7 +368,17 @@ export function resolveRunPath(agentDir: string, run: string, libraryScripts: st
     return path.resolve(workspaceRoot, "tools", run.slice("workspace/tools/".length));
   }
   if (run.startsWith("account/tools/")) {
-    return path.resolve(libraryRoot, "tools", run.slice("account/tools/".length));
+    const rel = run.slice("account/tools/".length);
+    const own = path.resolve(libraryRoot, "tools", rel);
+    // A gallery tool nobody installed has no copy in the library. In a
+    // sandbox the gallery is laid down under the library, so the path above
+    // is it; a run on the host has no such merge, so it looks on the shelf.
+    const gallery = platform.galleryDir();
+    if (!fs.existsSync(own) && gallery) {
+      const shelf = path.resolve(gallery, "tools", rel);
+      if (fs.existsSync(shelf)) return shelf;
+    }
+    return own;
   }
   // Canonical prefixes, then the legacy spellings they replaced.
   for (const p of ["workspace/scripts/", "shared/"]) {

package/src/secret-files.ts

@@ -9,9 +9,12 @@
 // `"$PROD_VM" 'uptime'` or `"$STRIPE" /v1/charges` and never learns whether
 // it was key or password, one header or five.
 //
-// Everything lands in a per-run scratch directory inside the agent's own
+// Everything lands in a per-step scratch directory inside the agent's own
 // tree (so it crosses into a container with the workspace) but dot-prefixed
-// and never archived or copied back — it holds live credentials.
+// and never archived or copied back — it holds live credentials. Per step,
+// not per agent: two steps of one agent run in parallel on the in-process
+// path (a fan-out), and with one shared directory the first to finish
+// deleted the keys the other was still using.
 
 import fs from "node:fs";
 import path from "node:path";
@@ -33,10 +36,10 @@ function writeWrapper(dir: string, name: string, body: string): string {
 }
 
 /**
- * Turn any @file/@ssh/@api values in `env` into files under
- * `<agentDir>/.secret-files`, rewriting each to its path. Returns the
- * directory written (for cleanup) and the transformed env. Plain values
- * pass through untouched.
+ * Turn any @file/@ssh/@api values in `env` into files under a fresh
+ * `<agentDir>/.secret-files/step-XXXXXX`, rewriting each to its path.
+ * Returns the directory written (for cleanup) and the transformed env.
+ * Plain values pass through untouched.
  */
 export function materializeFileSecrets(
   agentDir: string,
@@ -47,8 +50,10 @@ export function materializeFileSecrets(
   );
   if (entries.length === 0) return { env, dir: null };
 
-  const dir = path.join(agentDir, ".secret-files");
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const parent = path.join(agentDir, ".secret-files");
+  fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+  const dir = fs.mkdtempSync(path.join(parent, "step-"));
+  fs.chmodSync(dir, 0o700);
   const out = { ...env };
   for (const [name, value] of entries) {
     // Lowercased name as the filename keeps it predictable without leaking
@@ -95,7 +100,14 @@ export function materializeFileSecrets(
   return { env: out, dir };
 }
 
-/** Best-effort removal of a materialised secret-files directory. */
+/** Best-effort removal of a materialised secret-files directory — this
+ *  step's own, and the shared parent once no other step is using it. */
 export function cleanupFileSecrets(dir: string | null) {
-  if (dir) fs.rmSync(dir, { recursive: true, force: true });
+  if (!dir) return;
+  fs.rmSync(dir, { recursive: true, force: true });
+  try {
+    fs.rmdirSync(path.dirname(dir));
+  } catch {
+    // another step's directory is still in there
+  }
 }

package/src/secret-health.ts

@@ -55,7 +55,26 @@ export interface SecretRecord {
   lastAccepted: string | null;
 }
 
-type HealthFile = Record<string, SecretRecord>;
+export type HealthFile = Record<string, SecretRecord>;
+
+/** One use to fold into a record. */
+export interface HealthUpdate {
+  key: string;
+  use: { host: string; status: number | null; at: string };
+}
+
+/**
+ * Where health is kept. A file per account by default — what the CLI and a
+ * single-box install use. The platform plugs in Postgres
+ * (setSecretHealthStore), where each use is one atomic upsert: two pods
+ * recording at once on a shared file was last-writer-wins, and a refusal
+ * could vanish.
+ */
+export interface SecretHealthStore {
+  apply(tenant: string, updates: HealthUpdate[]): Promise<void>;
+  read(tenant: string): Promise<HealthFile>;
+  forget(tenant: string, key: string): Promise<void>;
+}
 
 const healthFile = (tenant: string) => path.join(accountDir(tenant), "secret-health.json");
 
@@ -76,27 +95,51 @@ function write(tenant: string, data: HealthFile): void {
   fs.renameSync(tmp, file);
 }
 
+const fileStore: SecretHealthStore = {
+  async apply(tenant, updates) {
+    const data = read(tenant);
+    for (const { key, use } of updates) apply(data, key, use);
+    write(tenant, data);
+  },
+  async read(tenant) {
+    return read(tenant);
+  },
+  async forget(tenant, key) {
+    const data = read(tenant);
+    if (!(key in data)) return;
+    delete data[key];
+    write(tenant, data);
+  },
+};
+
+let store: SecretHealthStore = fileStore;
+
+/** The platform's store (Postgres), or back to files with null. */
+export function setSecretHealthStore(next: SecretHealthStore | null): void {
+  store = next ?? fileStore;
+}
+
 // Writes are queued and coalesced off the caller's path. The egress proxy
 // notes a use per secret per request, before it streams the response body,
 // and a synchronous read-modify-write of a JSON file there is latency on
 // every proxied call — "never blocks" has to be true, not aspirational.
 // One writer per process; the queue drains in order.
-const pending = new Map<string, { name: string; use: { host: string; status: number | null; at?: string } }[]>();
+const pending = new Map<string, HealthUpdate[]>();
 let draining = false;
 
 function drain(): void {
   if (draining) return;
   draining = true;
-  setImmediate(() => {
+  setImmediate(async () => {
     try {
-      for (const [tenant, uses] of pending) {
+      for (const [tenant, updates] of pending) {
         pending.delete(tenant);
-        const data = read(tenant);
-        for (const { name, use } of uses) apply(data, name, use);
-        write(tenant, data);
+        try {
+          await store.apply(tenant, updates);
+        } catch {
+          // best effort, always
+        }
       }
-    } catch {
-      // best effort, always
     } finally {
       draining = false;
       if (pending.size) drain();
@@ -140,7 +183,7 @@ export function noteSecretUse(
 ): void {
   if (!key) return;
   const list = pending.get(tenant) ?? [];
-  list.push({ name: key, use: { ...use, at: use.at ?? new Date().toISOString() } });
+  list.push({ key, use: { ...use, at: use.at ?? new Date().toISOString() } });
   pending.set(tenant, list);
   drain();
 }
@@ -157,15 +200,15 @@ export function flushSecretHealth(): Promise<void> {
 /** Everything known about this account's credentials, by name. Names the
  *  vault holds but nothing has used are simply absent, which is the honest
  *  answer: unused is not the same as broken. */
-export function secretHealth(tenant: string): HealthFile {
-  return read(tenant);
+export async function secretHealth(tenant: string): Promise<HealthFile> {
+  return store.read(tenant);
 }
 
 /** The credentials worth saying something about: refused the last time they
  *  were used. Sorted worst first — most consecutive refusals, then oldest
  *  last-success, which is the order someone would work through them. */
-export function failingSecrets(tenant: string): { name: string; record: SecretRecord }[] {
-  return Object.entries(read(tenant))
+export async function failingSecrets(tenant: string): Promise<{ name: string; record: SecretRecord }[]> {
+  return Object.entries(await store.read(tenant))
     .filter(([, r]) => r.last.outcome === "refused")
     .map(([name, record]) => ({ name, record }))
     .sort((a, b) => b.record.refusals - a.record.refusals || (a.record.lastAccepted ?? "").localeCompare(b.record.lastAccepted ?? ""));
@@ -173,13 +216,15 @@ export function failingSecrets(tenant: string): { name: string; record: SecretRe
 
 /** Drop what is known about a secret — for a delete, and for a rotation,
  *  where the old key's refusals say nothing about the new one. */
-export function forgetSecretHealth(tenant: string, name: string): void {
+export async function forgetSecretHealth(tenant: string, name: string): Promise<void> {
   try {
-    const data = read(tenant);
-    if (!(name in data)) return;
-    delete data[name];
-    write(tenant, data);
+    await store.forget(tenant, name);
   } catch {
     // best effort
   }
 }
+
+/** The account's file, for the platform's one-time import into its store. */
+export function readSecretHealthFile(tenant: string): HealthFile {
+  return read(tenant);
+}

package/src/secrets.ts

@@ -23,6 +23,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { dataRoot } from "./paths.ts";
 import { platform } from "./platform.ts";
+import { fetchUntrusted } from "./untrusted-fetch.ts";
 
 /**
  * GCM's auth tag, pinned to its full 16 bytes at every cipher call. Without
@@ -103,19 +104,80 @@ interface StoredSecret {
 type SecretsFile = Record<string, StoredSecret>;
 
 function read(tenant: string, workspace?: string): SecretsFile {
-  const f = secretsFile(tenant, workspace);
-  if (!fs.existsSync(f)) return {};
+  return readFile(secretsFile(tenant, workspace));
+}
+
+// ------------------------------------------------------------ safe writes
+//
+// A vault file is read, changed and written back. It was written in place,
+// with no lock: two saves at once kept one; a crash mid-write left half a
+// file, which is an account that cannot authenticate anything; and the boot
+// re-wrap ran in every pod at once through ONE shared temp name, so two pods
+// could interleave into it and rename a corrupt file into place.
+//
+// Now every change goes through mutateVaultFile: an exclusive lock file
+// (O_EXCL, which NFS 4.1 and EFS honour, so it holds across pods), the read
+// and the change under it, a temp file unique to this writer, and a rename —
+// atomic on the same filesystem, so a reader sees the old file or the new
+// one, never half. A lock older than LOCK_STALE_MS is a crashed holder.
+
+const LOCK_STALE_MS = 30_000;
+const LOCK_WAIT_MS = 10_000;
+const sleep = (ms: number) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+function readFile(file: string): SecretsFile {
+  if (!fs.existsSync(file)) return {};
   try {
-    return JSON.parse(fs.readFileSync(f, "utf8"));
+    return JSON.parse(fs.readFileSync(file, "utf8"));
   } catch {
     return {};
   }
 }
 
-function write(tenant: string, workspace: string | undefined, data: SecretsFile) {
-  const f = secretsFile(tenant, workspace);
-  fs.mkdirSync(path.dirname(f), { recursive: true });
-  fs.writeFileSync(f, JSON.stringify(data, null, 2), { mode: 0o600 });
+function lockVault(file: string): () => void {
+  const lock = `${file}.lock`;
+  const deadline = Date.now() + LOCK_WAIT_MS;
+  for (;;) {
+    try {
+      const fd = fs.openSync(lock, "wx", 0o600);
+      fs.writeSync(fd, `${process.pid}@${new Date().toISOString()}`);
+      fs.closeSync(fd);
+      return () => fs.rmSync(lock, { force: true });
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+      try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+          fs.rmSync(lock, { force: true }); // a holder that died; take it over
+          continue;
+        }
+      } catch {
+        continue; // released between the open and the stat
+      }
+      if (Date.now() > deadline) throw new Error("the vault is busy — another change is being saved; try again");
+      sleep(25);
+    }
+  }
+}
+
+/**
+ * Change one vault file safely: `change` gets what is stored now and returns
+ * the new contents, or null to leave the file untouched. Returns what is
+ * stored after.
+ */
+export function mutateVaultFile(file: string, change: (all: SecretsFile) => SecretsFile | null): SecretsFile {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const release = lockVault(file);
+  try {
+    const current = readFile(file);
+    const next = change(structuredClone(current));
+    if (next === null) return current;
+    const tmp = `${file}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    return next;
+  } finally {
+    release();
+  }
 }
 
 export const SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
@@ -132,13 +194,14 @@ export function setSecret(
   }
   if (value.length > 8192) throw new Error("secret too long");
   const sealed = encryptValue(tenant, value);
-  const all = read(tenant, workspace);
-  all[name] = {
-    ...sealed,
-    updatedAt: new Date().toISOString(),
-    ...(kind ? { kind } : {}),
-  };
-  write(tenant, workspace, all);
+  mutateVaultFile(secretsFile(tenant, workspace), (all) => {
+    all[name] = {
+      ...sealed,
+      updatedAt: new Date().toISOString(),
+      ...(kind ? { kind } : {}),
+    };
+    return all;
+  });
 }
 
 /**
@@ -242,9 +305,11 @@ export function getSecret(
 }
 
 export function deleteSecret(tenant: string, name: string, workspace?: string) {
-  const all = read(tenant, workspace);
-  delete all[name];
-  write(tenant, workspace, all);
+  mutateVaultFile(secretsFile(tenant, workspace), (all) => {
+    if (!(name in all)) return null;
+    delete all[name];
+    return all;
+  });
 }
 
 export interface SecretEntry {
@@ -368,48 +433,46 @@ export function rotateMasterKey(
   const unreadable: string[] = [];
 
   for (const { file } of secretFiles(tenant)) {
-    const all: SecretsFile = JSON.parse(fs.readFileSync(file, "utf8"));
-    const next: SecretsFile = {};
     let count = 0;
-
-    for (const [name, rec] of Object.entries(all)) {
-      // A record under the ACCOUNT's key is not under the install key, so
-      // rotating the install key must not touch it — re-encrypting it here
-      // with a key it was never sealed with is how a rotation would destroy a
-      // vault it was meant to protect. Rotating the install key now re-wraps
-      // the account keys instead, which is a handful of small values rather
-      // than every secret on the box.
-      if (rec.k === "tenant") {
-        next[name] = rec;
-        continue;
-      }
-      let plain: string;
-      try {
-        const d = crypto.createDecipheriv("aes-256-gcm", oldKey, Buffer.from(rec.iv, "base64"), GCM);
-        d.setAuthTag(Buffer.from(rec.tag, "base64"));
-        plain = Buffer.concat([d.update(Buffer.from(rec.data, "base64")), d.final()]).toString("utf8");
-      } catch {
-        unreadable.push(name);
-        next[name] = rec; // untouched
-        continue;
+    mutateVaultFile(file, (all) => {
+      const next: SecretsFile = {};
+      for (const [name, rec] of Object.entries(all)) {
+        // A record under the ACCOUNT's key is not under the install key, so
+        // rotating the install key must not touch it — re-encrypting it here
+        // with a key it was never sealed with is how a rotation would destroy a
+        // vault it was meant to protect. Rotating the install key now re-wraps
+        // the account keys instead, which is a handful of small values rather
+        // than every secret on the box.
+        if (rec.k === "tenant") {
+          next[name] = rec;
+          continue;
+        }
+        let plain: string;
+        try {
+          const d = crypto.createDecipheriv("aes-256-gcm", oldKey, Buffer.from(rec.iv, "base64"), GCM);
+          d.setAuthTag(Buffer.from(rec.tag, "base64"));
+          plain = Buffer.concat([d.update(Buffer.from(rec.data, "base64")), d.final()]).toString("utf8");
+        } catch {
+          unreadable.push(name);
+          next[name] = rec; // untouched
+          continue;
+        }
+        const iv = crypto.randomBytes(12);
+        const c = crypto.createCipheriv("aes-256-gcm", newKey, iv, GCM);
+        const enc = Buffer.concat([c.update(plain, "utf8"), c.final()]);
+        next[name] = {
+          iv: iv.toString("base64"),
+          tag: c.getAuthTag().toString("base64"),
+          data: enc.toString("base64"),
+          updatedAt: rec.updatedAt, // rotation is not an edit
+          // Kept: without it an oauth2 secret stops being refreshed after a
+          // rotation, and a file/ssh/api secret stops being materialised.
+          ...(rec.kind ? { kind: rec.kind } : {}),
+        };
+        count++;
       }
-      const iv = crypto.randomBytes(12);
-      const c = crypto.createCipheriv("aes-256-gcm", newKey, iv, GCM);
-      const enc = Buffer.concat([c.update(plain, "utf8"), c.final()]);
-      next[name] = {
-        iv: iv.toString("base64"),
-        tag: c.getAuthTag().toString("base64"),
-        data: enc.toString("base64"),
-        updatedAt: rec.updatedAt, // rotation is not an edit
-      };
-      count++;
-    }
-
-    // Write via a temp file in the same directory: a half-written secrets.json
-    // is an account that cannot authenticate anything.
-    const tmp = `${file}.rotating`;
-    fs.writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
-    fs.renameSync(tmp, file);
+      return next;
+    });
     rewritten.push({ file, secrets: count });
   }
 
@@ -487,12 +550,12 @@ async function exchange(config: OAuth2Config, cacheKey: string): Promise<string>
       client_secret: config.client_secret,
       ...(config.extra ?? {}),
     });
-    const res = await fetch(config.token_url, {
+    const res = await fetchUntrusted(config.token_url, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body: body.toString(),
       signal: AbortSignal.timeout(15_000),
-    });
+    }, { sameOrigin: true });
     const payload = (await res.json().catch(() => ({}))) as {
       access_token?: string;
       expires_in?: number;
@@ -638,7 +701,7 @@ async function exchangeServiceAccount(config: ServiceAccountConfig, cacheKey: st
     const signature = base64url(signer.sign(config.private_key));
     const jwt = `${header}.${claim}.${signature}`;
 
-    const res = await fetch(config.token_url, {
+    const res = await fetchUntrusted(config.token_url, {
       method: "POST",
       headers: { "content-type": "application/x-www-form-urlencoded" },
       body: new URLSearchParams({
@@ -646,7 +709,7 @@ async function exchangeServiceAccount(config: ServiceAccountConfig, cacheKey: st
         assertion: jwt,
       }).toString(),
       signal: AbortSignal.timeout(15_000),
-    });
+    }, { sameOrigin: true });
     const payload = (await res.json().catch(() => ({}))) as {
       access_token?: string;
       expires_in?: number;
@@ -801,33 +864,32 @@ export function rewrapTenantSecrets(tenant: string): { moved: number; unreadable
   const unreadable: string[] = [];
 
   for (const { file } of secretFiles(tenant)) {
-    const all: SecretsFile = JSON.parse(fs.readFileSync(file, "utf8"));
-    const plain = new Map<string, string>();
-    let pending = 0;
-
-    for (const [name, rec] of Object.entries(all)) {
-      if (rec.k === "tenant") continue; // already moved
-      const value = decrypt(tenant, rec);
-      if (value === null) {
-        unreadable.push(name);
-        continue;
+    // Under the vault's lock: every pod runs this at boot, and a save made
+    // between our read and our write must not be lost.
+    mutateVaultFile(file, (all) => {
+      const plain = new Map<string, string>();
+      const unreadableHere: string[] = [];
+      for (const [name, rec] of Object.entries(all)) {
+        if (rec.k === "tenant") continue; // already moved
+        const value = decrypt(tenant, rec);
+        if (value === null) {
+          unreadableHere.push(name);
+          continue;
+        }
+        plain.set(name, value);
       }
-      plain.set(name, value);
-      pending += 1;
-    }
-    // Nothing to do, or something could not be read — leave the file alone.
-    // A partial conversion is worse than none, because the half that moved is
-    // no longer openable by the key the other half still needs.
-    if (pending === 0 || unreadable.length) continue;
-
-    const next: SecretsFile = { ...all };
-    for (const [name, value] of plain) {
-      next[name] = { ...encryptValue(tenant, value), updatedAt: all[name].updatedAt, ...(all[name].kind ? { kind: all[name].kind } : {}) };
-    }
-    const tmp = `${file}.rewrap`;
-    fs.writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
-    fs.renameSync(tmp, file);
-    moved += pending;
+      unreadable.push(...unreadableHere);
+      // Nothing to do, or something in THIS file could not be read — leave it
+      // alone. A partial conversion is worse than none, because the half that
+      // moved is no longer openable by the key the other half still needs.
+      if (plain.size === 0 || unreadableHere.length) return null;
+      const next: SecretsFile = { ...all };
+      for (const [name, value] of plain) {
+        next[name] = { ...encryptValue(tenant, value), updatedAt: all[name].updatedAt, ...(all[name].kind ? { kind: all[name].kind } : {}) };
+      }
+      moved += plain.size;
+      return next;
+    });
   }
   return { moved, unreadable };
 }