From dd8a0d401a0971ccce5b7a06486545d68fe44df5 Mon Sep 17 00:00:00 2001
From: relay <relay@agentrelay.com>
Date: Sun, 2 Aug 2026 07:36:46 -0400
Subject: [PATCH] fix(cli): pin relayflows dependency exactly

---
 CHANGELOG.md                            | 1 +
 package-lock.json                       | 2 +-
 packages/cli/package.json               | 2 +-
 packages/cli/src/cli/entrypoint.test.ts | 8 ++++++++
 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab1518025..507d27081 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - `agent-relay cloud whoami` prints the organization and workspace IDs alongside their names.
+- `agent-relay` pins `@relayflows/cli` exactly, so each Relay release resolves one reviewed workflow dependency tree instead of changing with later compatible Relayflows publishes.
 
 ## [11.3.1] - 2026-07-31
 
diff --git a/package-lock.json b/package-lock.json
index 4488930f3..fae2c6be2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13591,7 +13591,7 @@
         "@agent-relay/utils": "11.2.0",
         "@modelcontextprotocol/sdk": "^1.23.0",
         "@relayfile/client": "^0.10.27",
-        "@relayflows/cli": "^1.0.1",
+        "@relayflows/cli": "1.0.1",
         "@xterm/headless": "^6.0.0",
         "commander": "^12.1.0",
         "dotenv": "^17.2.3",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 196bad0d1..e0172f02b 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -52,7 +52,7 @@
     "@agent-relay/utils": "11.3.1",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "@relayfile/client": "^0.10.27",
-    "@relayflows/cli": "^1.0.1",
+    "@relayflows/cli": "1.0.1",
     "@xterm/headless": "^6.0.0",
     "commander": "^12.1.0",
     "dotenv": "^17.2.3",
diff --git a/packages/cli/src/cli/entrypoint.test.ts b/packages/cli/src/cli/entrypoint.test.ts
index fd202246b..15c8f600a 100644
--- a/packages/cli/src/cli/entrypoint.test.ts
+++ b/packages/cli/src/cli/entrypoint.test.ts
@@ -124,4 +124,12 @@ describe('CLI entrypoints', () => {
 
     expect(packageJson.bin?.['agent-relay']).toBe('dist/cli/index.js');
   });
+
+  it('pins relayflows so an Agent Relay release has a reproducible workflow dependency tree', () => {
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8')) as {
+      dependencies?: Record<string, string>;
+    };
+
+    expect(packageJson.dependencies?.['@relayflows/cli']).toMatch(/^\d+\.\d+\.\d+$/);
+  });
 });