fix(cli): pin relayflows dependency exactly

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - `agent-relay cloud whoami` prints the organization and workspace IDs alongside their names.
+- `agent-relay` pins `@relayflows/cli` exactly, so each Relay release resolves one reviewed workflow dependency tree instead of changing with later compatible Relayflows publishes.
 
 ## [11.3.1] - 2026-07-31
 

packages/cli/package.json

@@ -52,7 +52,7 @@
     "@agent-relay/utils": "11.3.1",
     "@modelcontextprotocol/sdk": "^1.23.0",
     "@relayfile/client": "^0.10.27",
-    "@relayflows/cli": "^1.0.1",
+    "@relayflows/cli": "1.0.1",
     "@xterm/headless": "^6.0.0",
     "commander": "^12.1.0",
     "dotenv": "^17.2.3",

packages/cli/src/cli/entrypoint.test.ts

@@ -124,4 +124,12 @@ describe('CLI entrypoints', () => {
 
     expect(packageJson.bin?.['agent-relay']).toBe('dist/cli/index.js');
   });
+
+  it('pins relayflows so an Agent Relay release has a reproducible workflow dependency tree', () => {
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8')) as {
+      dependencies?: Record<string, string>;
+    };
+
+    expect(packageJson.dependencies?.['@relayflows/cli']).toMatch(/^\d+\.\d+\.\d+$/);
+  });
 });