fix(mount): sync before starting daemon

[kjgbot]

Summary

• complete the detached one-shot Relayfile initial sync before starting the long-lived mount daemon
• add a command-order regression proving the daemon cannot hold the per-root lease while the one-shot runs
• prepare the explicit patch version 0.1.10 in both manifests, following the repository's release workflow contract

Why

Published @agent-relay/sandbox 0.1.9 starts the daemon first and then launches relayfile-mount --once. Both supervisors acquire the same per-root mount lease, so the one-shot can exit before readiness while the daemon owns the lease. Cloud's vendored orchestrator already uses the safe inverse ordering and documents this lease requirement, but packages/web/lib/fleet/sandbox-bridge.ts consumes this published package.

Production evidence on 2026-08-24: after Cloud deployed sandbox 0.1.9/exact-layout support successfully, a fresh mounted Daytona fleet spawn still failed with an opaque 500 after about 29 seconds. A fresh --no-sandbox-relayfile control succeeded through provisioning, roster liveness, Claude spawn, and canonical cross-node drive attach, isolating the remaining fault to mount provisioning. Cloud PR AgentWorkforce/cloud#3140 deployed the safe phase code successfully. A post-deploy fresh mounted probe returned exact phase relayfile_mount_invoked_exited, confirming this invocation/exited path; the failed attempt enrolled no fleet node.

Regression proof

The new test fails under the 0.1.9 ordering because the daemon command precedes the initial-sync exit probe. On this head:

• full suite: 773 total / 764 pass / 9 skip / 0 fail
• typecheck: pass
• package build/smoke: pass
• git diff --check: pass
• exact diff/security review: command generation and credential ingress are unchanged; only process order, one regression, and the explicit version fields change

Release

Do not publish until this PR is proven, reviewed, green, and merged. The manual publish workflow owns npm publication and the v0.1.10 tag.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 65c8ae8f-4f39-4a50-ad78-a3053675f4aa

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kjgbot]

Production confirmation after Cloud PR3140 deployed successfully (Deploy 32765044199): official Relay 11.8.3 fresh mounted spawn daytona-teleport-phase-0824-b8e2 returned exact safe failure: 503 Relayfile mount was invoked and exited before becoming ready. The same environment already passed the fresh no-mount Daytona control through roster liveness, Claude spawn, and canonical cross-node attach. This confirms the published 0.1.9 daemon-before-one-shot lease conflict path that this PR reverses. No fleet node was enrolled for the failed mounted attempt.

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}