fix(claude-relay-plugin): stop printing workspace keys, use observer tokens - #89
Open
willwashburn wants to merge 1 commit into
Open
fix(claude-relay-plugin): stop printing workspace keys, use observer tokens#89willwashburn wants to merge 1 commit into
willwashburn wants to merge 1 commit into
Conversation
…tokens The three pattern skills each mandated printing the raw workspace key in an observer URL — "Do not print a placeholder — print the real URL the user can click. This is mandatory." A workspace key is an administrative credential; a URL query string is the worst place to put one. They also required the key be copied into every worker prompt. That is unnecessary: `create_workspace` and `set_workspace_key` both pin the workspace to the project, and the relay MCP server a `relay-worker` subagent starts resolves that pin on its own. The mandate put an admin credential into N prompts and N transcripts to achieve nothing. - Step 3 now calls `get_observer_url`, which mints a scoped, expiring, read-only token. Requires the tool added in AgentWorkforce/relay#1422. - Worker prompts no longer carry the workspace key; the worker agent definition and SubagentStart hook now say the workspace is inherited and that a key must never be printed or requested. - The three skills' shared setup steps are now byte-identical, and all three carry the worker/stage tracking table and the "do not self-release" instruction that only relay-team had. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jmke9G9s7ftrN49opNmdx1
📝 WalkthroughWalkthroughRelay startup and coordination instructions no longer distribute workspace keys. Workers inherit the pinned workspace, register before relay operations, and report registration failures. Fan-out, team, and pipeline workflows now define observer access, worker tracking, handoffs, and completion reporting. ChangesRelay workspace protocol
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7413ebfaea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - Use relay MCP tools (`send_dm`, `post_message`, `check_inbox`) to communicate with workers after they're running. | ||
| - Use `subagent_type: "relay-worker"`. Only `relay-worker` subagents get the Agent Relay MCP server, the inbox-polling hooks, and the worker protocol. Other subagent types (`researcher`, `general-purpose`, …) cannot talk over the relay. | ||
| - Run workers in **background mode** (`run_in_background: true`) so they work concurrently. | ||
| - Workers inherit the workspace automatically — the relay MCP server resolves the workspace pinned to this project. **Do not put the workspace key in a worker prompt.** It is an administrative credential, and copying it into N prompts puts it in N transcripts. If a worker reports no workspace, fix the pin (step 2) rather than pasting the key. |
There was a problem hiding this comment.
When two Claude sessions run relay teams from the same project checkout, this project-scoped pin becomes a shared last-writer-wins credential: if either lead creates or selects another workspace before the other lead spawns a worker, that worker resolves the newer pin and registers in the wrong workspace. The previous per-worker key handoff kept concurrent runs isolated; replace it with a secret-safe run/session-scoped handoff rather than making the project pin the worker's sole workspace selector.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh`:
- Around line 10-20: Define registration failure handling in
plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh lines 10-20: state that
register_agent must succeed before any later relay calls, and on “Workspace key
not configured” return the failure through the Agent result or another explicit
channel without retrying. Update
plugins/claude-relay-plugin/agents/relay-worker/agent.md lines 9-10 with the
same exact rule and remove generic retry behavior for registration step 1; later
relay calls remain invalid until registration succeeds.
In `@plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md`:
- Line 32: Update the opening fenced examples to include the text language
identifier in plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md:32,
plugins/claude-relay-plugin/skills/relay-team/SKILL.md:31, and
plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md:31 and :45, changing
each fence to use text.
In `@plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md`:
- Around line 44-54: Update the later-stage worker prompt in the stage-spawning
instructions to require every worker to finish with a DONE message containing a
handoff artifact, matching the stage 1 requirement. For the final stage,
additionally require the handoff to include final evidence that the overall task
is complete.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b07914f6-d0d0-44d3-9e45-3cf20d46ff8a
📒 Files selected for processing (5)
plugins/claude-relay-plugin/agents/relay-worker/agent.mdplugins/claude-relay-plugin/hooks/subagent-bootstrap.shplugins/claude-relay-plugin/skills/relay-fanout/SKILL.mdplugins/claude-relay-plugin/skills/relay-pipeline/SKILL.mdplugins/claude-relay-plugin/skills/relay-team/SKILL.md
Comment on lines
+10
to
+20
| 1. Call \`register_agent(name: "$AGENT_NAME", type: "agent")\` to register with the relay. | ||
| The workspace is already pinned to this project, so the relay MCP server resolves it | ||
| for you — you do NOT need a workspace key, and must never print or ask for one. | ||
| If this fails with "Workspace key not configured", report that to your lead. | ||
| 2. Call \`check_inbox(as: "$AGENT_NAME")\` to get your task assignment. | ||
| 3. Send an ACK to your lead via \`send_dm(as: "$AGENT_NAME")\` when you understand the task. | ||
| 4. When finished, send a DONE message with a concise completion summary via \`send_dm(as: "$AGENT_NAME")\` before stopping. | ||
|
|
||
| IMPORTANT: Include \`as: "$AGENT_NAME"\` on EVERY relay tool call to ensure correct message attribution. | ||
|
|
||
| Do NOT skip steps 1-2. Without them you cannot send or receive messages. | ||
| Do NOT skip step 1. Without it you cannot send or receive messages. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Tracked files of interest:"
git ls-files | awk '
/plugins\/claude-relay-plugin\/hooks\/subagent-bootstrap\.sh$/ ||
/plugins\/claude-relay-plugin\/agents\/relay-worker\/agent\.md$/ ||
/plugins\/claude-relay-plugin.*agent.*\.md$/ ||
/plugins\/claude-relay-plugin.*\.sh$/
' | sort
echo
echo "subagent-bootstrap.sh relevant lines:"
if [ -f plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh ]; then
nl -ba plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh | sed -n '1,80p'
else
echo "missing plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh"
fi
echo
echo "relay-worker agent.md relevant lines:"
if [ -f plugins/claude-relay-plugin/agents/relay-worker/agent.md ]; then
nl -ba plugins/claude-relay-plugin/agents/relay-worker/agent.md | sed -n '1,80p'
else
echo "missing plugins/claude-relay-plugin/agents/relay-worker/agent.md"
fi
echo
echo "Search for register_agent and workspace key failure wording:"
rg -n 'register_agent|Workspace key not configured|get_observer_url|Agent result|AgentResult|report|lead|retry' plugins/claude-relay-plugin || trueRepository: AgentWorkforce/skills
Length of output: 696
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "subagent-bootstrap.sh lines:"
awk 'NR>=1 && NR<=120 { printf "%5d\t%s\n", NR, $0 }' plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh
echo
echo "relay-worker agent.md lines:"
awk 'NR>=1 && NR<=120 { printf "%5d\t%s\n", NR, $0 }' plugins/claude-relay-plugin/agents/relay-worker/agent.md
echo
echo "Search for register_agent and workspace key failure wording:"
grep -RInE 'register_agent|Workspace key not configured|get_observer_url|Agent result|AgentResult|report|lead|retry' plugins/claude-relay-plugin || trueRepository: AgentWorkforce/skills
Length of output: 15454
Define the out-of-band failure path for registration failures.
register_agent must succeed before relay messaging. If it fails with "Workspace key not configured", return the failure through the Agent result or another explicit channel. Do not retry after the first failure, despite the later steps 1-2 fail, retry once rule.
plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh#L10-L13: define the channel and state that later relay calls are invalid until registration succeeds.plugins/claude-relay-plugin/agents/relay-worker/agent.md#L9-L15: use the same exact rule and remove the generic retry behavior for step 1.
📍 Affects 2 files
plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh#L10-L20(this comment)plugins/claude-relay-plugin/agents/relay-worker/agent.md#L9-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh` around lines 10 -
20, Define registration failure handling in
plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh lines 10-20: state that
register_agent must succeed before any later relay calls, and on “Workspace key
not configured” return the failure through the Agent result or another explicit
channel without retrying. Update
plugins/claude-relay-plugin/agents/relay-worker/agent.md lines 9-10 with the
same exact rule and remove generic retry behavior for registration step 1; later
relay calls remain invalid until registration succeeds.
| 5. Pick the worker count from the task shape. Prefer 2–8, and stay low enough that you can still track every ACK and DONE. | ||
| 6. Partition the work into independent units — each with its own files, target, or scope boundary, and no shared intermediate state. | ||
| 7. Spawn one worker per unit with the Agent tool: | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language identifiers to the fenced examples.
markdownlint-cli2 reports MD040 for these opening fences. Add text or the actual syntax language after each opening fence.
plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md#L32-L32: change the opening fence to```text.plugins/claude-relay-plugin/skills/relay-team/SKILL.md#L31-L31: change the opening fence to```text.plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md#L31-L31: change the opening fence to```text.plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md#L45-L45: change the opening fence to```text.
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 32-32: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
📍 Affects 3 files
plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md#L32-L32(this comment)plugins/claude-relay-plugin/skills/relay-team/SKILL.md#L31-L31plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md#L31-L31plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md#L45-L45
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md` at line 32, Update
the opening fenced examples to include the text language identifier in
plugins/claude-relay-plugin/skills/relay-fanout/SKILL.md:32,
plugins/claude-relay-plugin/skills/relay-team/SKILL.md:31, and
plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md:31 and :45, changing
each fence to use text.
Source: Linters/SAST tools
Comment on lines
+44
to
54
| 8. For each later stage, spawn a worker carrying the original task context, the upstream DONE summary and handoff artifact, and any files, decisions, or constraints the earlier stages produced: | ||
| ``` | ||
| Agent( | ||
| subagent_type: "relay-worker", | ||
| prompt: "You are relay-stage-2. Your lead is relay-lead. | ||
| Workspace key: <the actual key>. | ||
| CRITICAL: On every relay tool call, include as: \"relay-stage-2\". Without as, your messages can be attributed to another agent. | ||
| CRITICAL: pass as: \"relay-stage-2\" on every relay tool call. | ||
| Previous stage completed: [DONE summary from stage 1]. | ||
| Your task: [stage 2 scope using stage 1 output]. | ||
| Files: [relevant files]." | ||
| Your task: [stage 2 scope, using stage 1's output]. | ||
| Files: [relevant files]. | ||
| Do NOT release yourself when done — stay idle in case the stage needs a fix." | ||
| ) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files matching SKILL.md in relay-pipeline:"
fd -a 'SKILL\.md$' . | sed 's#^\./##' | grep 'plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md' || true
echo
echo "Relevant section:"
sed -n '1,140p' plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md
echo
echo "Search for handoff/DONE/evidence in skill files:"
rg -n "handoff|handoff artifact|DONE|final evidence|relay-stage|subagent_type|release|DM your lead" plugins/claude-relay-plugin/skills/relay-pipeline -SRepository: AgentWorkforce/skills
Length of output: 8051
Require a handoff artifact from every later stage.
Stage 1 enforces DONE with a handoff, but the later-stage worker prompt does not require the same final DONE message. Add the handoff requirement for later workers and require final evidence when the worker is the last stage.
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 45-45: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md` around lines 44 -
54, Update the later-stage worker prompt in the stage-spawning instructions to
require every worker to finish with a DONE message containing a handoff
artifact, matching the stage 1 requirement. For the final stage, additionally
require the handoff to include final evidence that the overall task is complete.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 5 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md">
<violation number="1" location="plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md:40">
P1: The new "Do NOT release yourself when done — stay idle" instruction conflicts with this skill's foreground mode. The pipeline spawns each stage with the Agent tool in foreground (blocking), and step 7 makes the lead wait for stage 1's DONE via check_inbox before spawning stage 2. If the stage worker stays idle instead of returning, the foreground Agent call never releases control, so the lead can never run check_inbox or spawn the next stage — the pipeline stalls after stage 1. This guidance is correct for team/fanout (background workers), but in a foreground pipeline the worker must release when done.</violation>
<violation number="2" location="plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md:52">
P2: The stage 1 spawn template requires the worker to send a DONE message containing the handoff artifact, but the later-stage (stage 2+) template dropped this requirement — it only tells the worker not to self-release, without specifying what the final DONE message must contain. Downstream stages (and the final stage in particular) need an explicit handoff/evidence requirement so the lead isn't left validating an undefined deliverable.</violation>
</file>
<file name="plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh">
<violation number="1" location="plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh:11">
P2: The new registration-failure guidance says to "report that to your lead" on a 'Workspace key not configured' failure, but registration is a prerequisite for any relay messaging (send_dm/check_inbox). Since the worker can't message its lead over relay until it's registered, this instruction needs an explicit out-of-band failure channel (e.g., surfacing the failure via the Agent tool's result) rather than relying on relay messaging that hasn't been established yet.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| Files: [relevant files]. | ||
| When done, send your lead a DONE message with: [handoff artifact description]." | ||
| When done, DM your lead a DONE message containing: [handoff artifact description]. | ||
| Do NOT release yourself when done — stay idle in case the stage needs a fix." |
There was a problem hiding this comment.
P1: The new "Do NOT release yourself when done — stay idle" instruction conflicts with this skill's foreground mode. The pipeline spawns each stage with the Agent tool in foreground (blocking), and step 7 makes the lead wait for stage 1's DONE via check_inbox before spawning stage 2. If the stage worker stays idle instead of returning, the foreground Agent call never releases control, so the lead can never run check_inbox or spawn the next stage — the pipeline stalls after stage 1. This guidance is correct for team/fanout (background workers), but in a foreground pipeline the worker must release when done.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md, line 40:
<comment>The new "Do NOT release yourself when done — stay idle" instruction conflicts with this skill's foreground mode. The pipeline spawns each stage with the Agent tool in foreground (blocking), and step 7 makes the lead wait for stage 1's DONE via check_inbox before spawning stage 2. If the stage worker stays idle instead of returning, the foreground Agent call never releases control, so the lead can never run check_inbox or spawn the next stage — the pipeline stalls after stage 1. This guidance is correct for team/fanout (background workers), but in a foreground pipeline the worker must release when done.</comment>
<file context>
@@ -11,57 +11,55 @@ $ARGUMENTS
Files: [relevant files].
- When done, send your lead a DONE message with: [handoff artifact description]."
+ When done, DM your lead a DONE message containing: [handoff artifact description].
+ Do NOT release yourself when done — stay idle in case the stage needs a fix."
)
```
</file context>
Comment on lines
+52
to
+53
| Files: [relevant files]. | ||
| Do NOT release yourself when done — stay idle in case the stage needs a fix." |
There was a problem hiding this comment.
P2: The stage 1 spawn template requires the worker to send a DONE message containing the handoff artifact, but the later-stage (stage 2+) template dropped this requirement — it only tells the worker not to self-release, without specifying what the final DONE message must contain. Downstream stages (and the final stage in particular) need an explicit handoff/evidence requirement so the lead isn't left validating an undefined deliverable.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At plugins/claude-relay-plugin/skills/relay-pipeline/SKILL.md, line 52:
<comment>The stage 1 spawn template requires the worker to send a DONE message containing the handoff artifact, but the later-stage (stage 2+) template dropped this requirement — it only tells the worker not to self-release, without specifying what the final DONE message must contain. Downstream stages (and the final stage in particular) need an explicit handoff/evidence requirement so the lead isn't left validating an undefined deliverable.</comment>
<file context>
@@ -11,57 +11,55 @@ $ARGUMENTS
- Your task: [stage 2 scope using stage 1 output].
- Files: [relevant files]."
+ Your task: [stage 2 scope, using stage 1's output].
+ Files: [relevant files].
+ Do NOT release yourself when done — stay idle in case the stage needs a fix."
)
</file context>
Suggested change
| Files: [relevant files]. | |
| Do NOT release yourself when done — stay idle in case the stage needs a fix." | |
| Files: [relevant files]. | |
| When done, DM your lead a DONE message containing: [handoff artifact description, or final deliverable/evidence if this is the last stage]. | |
| Do NOT release yourself when done — stay idle in case the stage needs a fix." |
| 4. Send an ACK to your lead via \`send_dm(as: "$AGENT_NAME")\` when you understand the task. | ||
| 5. When finished, send a DONE message with a concise completion summary via \`send_dm(as: "$AGENT_NAME")\` before stopping. | ||
| 1. Call \`register_agent(name: "$AGENT_NAME", type: "agent")\` to register with the relay. | ||
| The workspace is already pinned to this project, so the relay MCP server resolves it |
There was a problem hiding this comment.
P2: The new registration-failure guidance says to "report that to your lead" on a 'Workspace key not configured' failure, but registration is a prerequisite for any relay messaging (send_dm/check_inbox). Since the worker can't message its lead over relay until it's registered, this instruction needs an explicit out-of-band failure channel (e.g., surfacing the failure via the Agent tool's result) rather than relying on relay messaging that hasn't been established yet.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At plugins/claude-relay-plugin/hooks/subagent-bootstrap.sh, line 11:
<comment>The new registration-failure guidance says to "report that to your lead" on a 'Workspace key not configured' failure, but registration is a prerequisite for any relay messaging (send_dm/check_inbox). Since the worker can't message its lead over relay until it's registered, this instruction needs an explicit out-of-band failure channel (e.g., surfacing the failure via the Agent tool's result) rather than relying on relay messaging that hasn't been established yet.</comment>
<file context>
@@ -7,13 +7,15 @@ AGENT_NAME="${RELAY_AGENT_NAME:-the assigned subagent name}"
-4. Send an ACK to your lead via \`send_dm(as: "$AGENT_NAME")\` when you understand the task.
-5. When finished, send a DONE message with a concise completion summary via \`send_dm(as: "$AGENT_NAME")\` before stopping.
+1. Call \`register_agent(name: "$AGENT_NAME", type: "agent")\` to register with the relay.
+ The workspace is already pinned to this project, so the relay MCP server resolves it
+ for you — you do NOT need a workspace key, and must never print or ask for one.
+ If this fails with "Workspace key not configured", report that to your lead.
</file context>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The three pattern skills (
relay-team,relay-fanout,relay-pipeline) each carried this instruction, verbatim, at step 3:That is a workspace admin key in a URL query string, mandated. It is also the exact thing AgentWorkforce/relay#1380 is trying to stop, and it directly contradicts the Codex and Gemini plugins in the relay repo, which say never to construct an observer URL from a workspace key.
They also each required the key be copied into every worker prompt ("You must include the workspace key in the prompt"). That turns out to be unnecessary:
create_workspaceandset_workspace_keyboth callpersistWorkspaceSession, which pins the workspace to the project (packages/cli/src/cli/lib/workspace-session.ts:37).relay-workersubagent getsmcpServers: ["agent-relay"], and that server'soptionsFromEnv()falls back toresolveWorkspaceSessionKey()— the project pin (packages/cli/src/cli/agent-relay-mcp.ts:1042).So the worker already resolves the workspace on its own. The mandate was putting an administrative credential into N prompts and N transcripts to achieve nothing.
Changes
get_observer_url, which mints a scoped, expiring, read-only token and returns a URL built from it. Depends on feat(cli): addagent-relay observerto mint read-only follow-along links relay#1422, which adds that tool — worth merging after it.relay-workeragent definition and theSubagentStarthook now say the workspace is inherited from the project pin, that a key must never be printed or requested, and what to do if registration fails (report to the lead, don't ask for the key).relay-teamhad. That omission was a real bug — a worker that self-releases after DONE breaks the review→fix loop.Some incidental tightening came with the rewrite (the "How spawning works" preamble was near-identical boilerplate in all three); the pattern-specific guidance — worker counts, foreground vs background, handoff artifacts — is unchanged.
Not addressed here
Real deduplication needs a decision I'd rather not make unilaterally. The three skills are
disable-model-invocation: trueslash-command entry points, and Claude Code has no include primitive for sharing text between sibling skills. The options are a build step that generates the three from one source, or collapsing them into one skill with a pattern argument (which changes/relay-fanoutinto/relay-team fanout). This repo has no rootpackage.jsonand no CI workflows, so an enforced drift check has nowhere to run today. For now the shared blocks are identical by hand.This is part of a series from a review of the Agent Relay skills and plugins across
relay,skills, andagentrelay.com.Test Plan
bash -non the modified hook, plus executed it withRELAY_AGENT_NAME=worker-1and verified the rendered outputdiffof the step 1–3 block)real key,actual key,Workspace key: <) — none leftpersistWorkspaceSession→optionsFromEnv→resolveWorkspaceSessionKeyin the relay CLI source/relay-teamwith a live workspace — not run; no credentials in this environment. Worth confirming a spawned worker registers with no key in its prompt before mergeScreenshots
n/a
Generated by Claude Code