fix(cli): pin relayflows dependency exactly

[willwashburn]

Summary

• replace the @relayflows/cli caret range with the exact version already resolved by this repository (1.0.1)
• add a regression requiring a plain SemVer dependency
• record the install-reproducibility change in the pending Minor changelog

Companion to AgentWorkforce/relayflows#25 and AgentWorkforce/relayflows#27.

Security sequencing

This pin is a reproducibility control, not the leak remediation by itself. Every currently published Relayflows version checked, including 1.0.1, contains the first-run observer-key leak. The leak closes only after the Relayflows fix is reviewed and published, followed by an explicit bump of this pin to that safe release. Until then, this PR must not be described as an all-clear.

The installed tree on the machine that runs Agent Relay must be checked after that bump, dependencies included. A clean package tarball cannot establish closure because npm pack omits node_modules.

Verification

• clean npm ci accepts the exact package/lock declaration
• npx vitest run packages/cli/src/cli/entrypoint.test.ts — 5/5 passed
• npm run build:core && npm run build:cli
• git diff --check

No packages were published and no release was created.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e4762258-8361-41ab-a363-45c37fe98c35

📥 Commits

Reviewing files that changed from the base of the PR and between 73c7cf1 and dd8a0d4.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• CHANGELOG.md
• packages/cli/package.json
• packages/cli/src/cli/entrypoint.test.ts

---

📝 Walkthrough

Walkthrough

The CLI package now pins @relayflows/cli to 1.0.1. A test verifies exact semantic-version pinning. The changelog documents the release-level pinning policy.

Changes

CLI dependency pinning

Layer / File(s)	Summary
Pin dependency and validate metadata packages/cli/package.json, packages/cli/src/cli/entrypoint.test.ts, CHANGELOG.md	@relayflows/cli changes from ^1.0.1 to 1.0.1. A test verifies the exact version format. The changelog records the pinning policy.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: khaliqgant

Poem

A rabbit pins the version tight,
No drifting hops from day to night.
The test checks every dotted sign,
The changelog marks the release line.
Exact paws, exact trail, exact design.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pin-relayflows-cli

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.