fix(cli): pin relayflows dependency exactly

[willwashburn]

Summary

• replace the @relayflows/cli caret range with the exact version already resolved by this repository (1.0.1)
• add a regression requiring a plain SemVer dependency
• record the install-reproducibility change in the pending Minor changelog

Companion to AgentWorkforce/relayflows#25 and AgentWorkforce/relayflows#27.

Security sequencing

This pin is a reproducibility control, not the leak remediation by itself. Every currently published Relayflows version checked, including 1.0.1, contains the first-run observer-key leak. The leak closes only after the Relayflows fix is reviewed and published, followed by an explicit bump of this pin to that safe release. Until then, this PR must not be described as an all-clear.

The installed tree on the machine that runs Agent Relay must be checked after that bump, dependencies included. A clean package tarball cannot establish closure because npm pack omits node_modules.

Verification

• clean npm ci accepts the exact package/lock declaration
• npx vitest run packages/cli/src/cli/entrypoint.test.ts — 5/5 passed
• npm run build:core && npm run build:cli
• git diff --check

No packages were published and no release was created.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ab08c9f-f2c4-4abb-babc-d399909e657a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}