fix(auth): stabilize sandbox token bootstrap

Serialize the supervisor's first sandbox JWT acquisition so concurrent startup clients reuse the process-wide token slot instead of racing into duplicate K8s ServiceAccount bootstrap exchanges.

Set XDG_STATE_HOME inside Docker e2e's host-visible workdir. GitHub Actions container jobs talk to the host Docker daemon, so driver-owned sandbox JWT bind mounts must resolve from a path visible on both sides.

Verification: mise run pre-commit; OPENSHELL_E2E_DOCKER_TEST=bypass_detection OPENSHELL_SUPERVISOR_IMAGE=openshell/supervisor:dev-25-g15a2a59fb-dirty e2e/rust/e2e-docker.sh; local helm dev deploy plus sandbox log check showed one K8s token exchange line.

Author: TaylorMutch

crates/openshell-sandbox/src/grpc_client.rs

@@ -66,6 +66,11 @@ static TOKEN_SLOT: OnceLock<TokenSlot> = OnceLock::new();
 /// Source used to acquire the process-wide token slot.
 static TOKEN_SOURCE: OnceLock<TokenSource> = OnceLock::new();
 
+/// Serializes the first token acquisition. Several supervisor subsystems
+/// connect during startup; without this guard they can all observe an empty
+/// [`TOKEN_SLOT`] and perform duplicate K8s bootstrap exchanges.
+static TOKEN_INIT_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
 /// One-shot guard so the renewal loop spawns at most once per process.
 static REFRESH_SPAWNED: OnceLock<()> = OnceLock::new();
 
@@ -183,15 +188,7 @@ async fn build_plain_channel(endpoint: &str) -> Result<Channel> {
 /// spawned once per process via [`REFRESH_SPAWNED`].
 async fn connect_channel(endpoint: &str) -> Result<AuthedChannel> {
     let channel = build_plain_channel(endpoint).await?;
-    let (slot, source) = if let Some(existing) = TOKEN_SLOT.get() {
-        let source = TOKEN_SOURCE.get().copied().unwrap_or(TokenSource::Env);
-        (existing.clone(), source)
-    } else {
-        let acquired = acquire_sandbox_token(endpoint, &channel).await?;
-        let slot = install_token_slot(&acquired.token)?;
-        let _ = TOKEN_SOURCE.set(acquired.source);
-        (slot, acquired.source)
-    };
+    let (slot, source) = token_slot(endpoint, &channel).await?;
     let plain_channel = channel.clone();
     let intercepted = InterceptedService::new(channel, AuthInterceptor::new(slot.clone()));
     if REFRESH_SPAWNED.set(()).is_ok() {
@@ -204,6 +201,25 @@ async fn connect_channel(endpoint: &str) -> Result<AuthedChannel> {
     Ok(intercepted)
 }
 
+async fn token_slot(endpoint: &str, plain_channel: &Channel) -> Result<(TokenSlot, TokenSource)> {
+    if let Some(existing) = TOKEN_SLOT.get() {
+        let source = TOKEN_SOURCE.get().copied().unwrap_or(TokenSource::Env);
+        return Ok((existing.clone(), source));
+    }
+
+    let _guard = TOKEN_INIT_LOCK.lock().await;
+
+    if let Some(existing) = TOKEN_SLOT.get() {
+        let source = TOKEN_SOURCE.get().copied().unwrap_or(TokenSource::Env);
+        return Ok((existing.clone(), source));
+    }
+
+    let acquired = acquire_sandbox_token(endpoint, plain_channel).await?;
+    let slot = install_token_slot(&acquired.token)?;
+    let _ = TOKEN_SOURCE.set(acquired.source);
+    Ok((slot, acquired.source))
+}
+
 /// Resolve the sandbox JWT used to authenticate every outbound RPC.
 ///
 /// `endpoint` is logged on errors but never used for transport here; the

e2e/with-docker-gateway.sh

@@ -78,6 +78,10 @@ DOCKER_SUPERVISOR_ARGS=()
 # Isolate CLI/SDK gateway metadata from the developer's real config.
 export XDG_CONFIG_HOME="${WORKDIR}/config"
 export XDG_DATA_HOME="${WORKDIR}/data"
+# Docker e2e runs in a GitHub Actions container while talking to the host
+# Docker daemon. Keep gateway state in the host-visible workdir so driver-owned
+# bind mounts, including sandbox JWT files, resolve on both sides.
+export XDG_STATE_HOME="${WORKDIR}/state"
 
 cleanup() {
   local exit_code=$?
@@ -394,7 +398,7 @@ PKI_DIR="${WORKDIR}/pki"
 e2e_generate_pki "${GATEWAY_BIN}" "${PKI_DIR}"
 
 HOST_PORT=$(e2e_pick_port)
-STATE_DIR="${WORKDIR}/state"
+STATE_DIR="${XDG_STATE_HOME}"
 mkdir -p "${STATE_DIR}"
 JWT_DIR="${STATE_DIR}/jwt"