From 988c02fb385f16bd0d7205d8de5ac7551587eca4 Mon Sep 17 00:00:00 2001
From: Antonio Mancini <an.manc25@gmail.com>
Date: Sat, 10 Oct 2026 14:20:52 +0200
Subject: [PATCH] fix(setup): open the run lock read-only so a root-owned lock
 doesn't block user runs

A lock file left by a root run (e.g. first-boot unit) is 0644 root:root, so
opening it for writing as the normal user failed with 'Permission denied'.
flock works on a read-only fd; create the file only if it is missing.

Claude-Session: https://claude.ai/code/session_01YMswzE32ygHazBu8EfzsdV
---
 bin/agbox | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/bin/agbox b/bin/agbox
index 3a0071f..1f747c7 100755
--- a/bin/agbox
+++ b/bin/agbox
@@ -121,8 +121,11 @@ preflight() {
   os_is_supported || log_warn "$OS_PRETTY is not tested; continuing anyway"
 
   # One agbox at a time (e.g. first-boot unit vs. a manual run).
-  if has_cmd flock && [[ -w /run/lock ]]; then
-    exec {_lock_fd}>/run/lock/agbox.lock
+  # Open read-only: the lock file may belong to another user (root's first-boot
+  # run), and protected_regular forbids O_CREAT on it in the sticky /run/lock.
+  local lock=/run/lock/agbox.lock
+  if has_cmd flock && [[ -w /run/lock ]] && { [[ -e $lock ]] || : >"$lock"; } 2>/dev/null; then
+    exec {_lock_fd}<"$lock"
     flock -n "$_lock_fd" || die "another agbox run is in progress"
   fi
 }