From 86745fc2d5e89da2fa1578ccfdd6422f18d550a3 Mon Sep 17 00:00:00 2001
From: Khaliq <khaliq@agentrelay.com>
Date: Tue, 4 Aug 2026 19:58:08 +0200
Subject: [PATCH] fix(cli): avoid Agent Relay lookup for saved token workspace

loadDelegatedCredentialsForRequest invoked the real agent-relay CLI
for credential discovery before checking whether a saved token
workspace already had usable delegated credentials, blocking in
exec.Cmd.Wait. When a token-derived workspace value is empty and
legacy delegated credentials already satisfy the requested scopes,
use them directly instead of shelling out.

Fixes #389.

Verified independently:
- go test ./cmd/relayfile-cli/... -run TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted -v -count=1 (0.04s, was ~6s before)
- go test ./cmd/relayfile-cli/... -count=1
---
 cmd/relayfile-cli/main.go      |  9 +++++++++
 cmd/relayfile-cli/main_test.go | 10 ++++++++++
 2 files changed, 19 insertions(+)

diff --git a/cmd/relayfile-cli/main.go b/cmd/relayfile-cli/main.go
index 9f0aa45b..efaf0f57 100644
--- a/cmd/relayfile-cli/main.go
+++ b/cmd/relayfile-cli/main.go
@@ -9859,6 +9859,15 @@ func loadDelegatedCredentials(path string) (delegatedauth.Bundle, string, error)
 }
 
 func loadDelegatedCredentialsForRequest(path, workspaceValue string, scopes []string) (delegatedauth.Bundle, string, error) {
+	if explicitPath, ok := explicitDelegatedCredentialsPath(path); ok {
+		return loadDelegatedCredentials(explicitPath)
+	}
+	if strings.TrimSpace(workspaceValue) == "" {
+		legacyBundle, legacyPath, legacyErr := loadDelegatedCredentials(delegatedCredentialsPath())
+		if legacyErr == nil && delegatedBundleSatisfiesRequestedScopes(legacyBundle, scopes) {
+			return legacyBundle, legacyPath, nil
+		}
+	}
 	canonicalWorkspaceValue, canonicalWorkspaceOK := canonicalWorkspaceShardValueStatus(workspaceValue)
 	if !canonicalWorkspaceOK && strings.TrimSpace(workspaceValue) != "" {
 		fmt.Fprintf(os.Stderr, "warning: delegated credential workspace %q was not uniquely resolved in %s; using raw workspace shard and probing alias shards\n", canonicalWorkspaceValue, workspacesPath())
diff --git a/cmd/relayfile-cli/main_test.go b/cmd/relayfile-cli/main_test.go
index 71b4e9c2..455fd6a6 100644
--- a/cmd/relayfile-cli/main_test.go
+++ b/cmd/relayfile-cli/main_test.go
@@ -1278,6 +1278,13 @@ func TestReadPrintsRemoteFileContent(t *testing.T) {
 func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
 	t.Setenv("HOME", t.TempDir())
 	clearRelayfileEnv(t)
+	agentRelayLog := filepath.Join(t.TempDir(), "agent-relay.log")
+	t.Setenv("AGENT_RELAY_LOG", agentRelayLog)
+	installFakeAgentRelay(t, `
+printf '%s\n' "$*" >> "$AGENT_RELAY_LOG"
+echo "unexpected agent-relay call: $*" >&2
+exit 2
+`)
 
 	token := testJWTWithWorkspace("ws_token")
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1306,6 +1313,9 @@ func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
 	if got := stdout.String(); got != "ok\n" {
 		t.Fatalf("unexpected file content: %q", got)
 	}
+	if _, err := os.Stat(agentRelayLog); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("read with a token workspace unexpectedly called agent-relay: %v", err)
+	}
 }
 
 func TestReadDecodesBase64Content(t *testing.T) {