fix(cli): survive agent-relay credential masking in session and workspace reads

[willwashburn]

agent-relay is adding credential masking to its CLI output (AgentWorkforce/relay#1380): cloud session --json masks accessToken unless --reveal-token, workspace active --json masks keys unless --reveal-secrets, and error messages redact embedded credentials. Three relayfile read paths depend on those raw values; this makes each robust across old and new agent-relay CLIs:

• cloudCredentialsFromAgentRelay() requests cloud session --json --reveal-token first and falls back to the plain form when the CLI rejects the flag as unknown. A masked accessToken is rejected with a clear error instead of being written to the credentials file (where it would 401 silently on every call).
• activeWorkspaceFromAgentRelay() requests workspace active --json --reveal-secrets with the same fallback.
• The messaging-only workspace classifier no longer requires the raw workspace key to be embedded in the resolver error text: when the error carries no usable key (redacting CLIs), it resolves the key from the canonical env vars or the shared workspace store at $AGENT_RELAY_HOME/~/.agentworkforce/relay/workspaces.json before validating against Relaycast.

Safe to merge before the agent-relay change lands; required before it ships.

Test run: full ./cmd/relayfile-cli suite green (110s), plus new tests for the reveal-token fallback, the masked-token guard, and the store-fallback classification.

🤖 Generated with Claude Code

Test isolation note

Commit 08c9c3a also isolates TestClassifyAgentRelayActiveWorkspaceErrorPreservesRegexMiss from the operator’s Agent Relay environment and workspaces.json. This is a pre-existing read-only test defect bundled here because it blocked verification of this PR: on a regex miss, the test could read a live host workspace key and forward it only to its loopback httptest.Server, producing credential exposure to the test process and machine-dependent results. The path never writes or mutates the host store.

[coderabbitai]

📝 Walkthrough

Walkthrough

Agent Relay credential and workspace resolution now requests unmasked secrets, supports older CLI fallbacks, rejects masked tokens, and recovers workspace keys from environment variables or the local workspace store when resolver errors are redacted.

Changes

Agent Relay resolution

Layer / File(s)	Summary
Cloud credential reveal compatibility cmd/relayfile-cli/main.go, cmd/relayfile-cli/main_test.go	Cloud sessions request revealed tokens, retry without the flag for older CLIs, reject masked tokens, and update credential-related test doubles and coverage.
Active workspace key recovery cmd/relayfile-cli/main.go, cmd/relayfile-cli/main_test.go	Active workspace lookup requests revealed secrets, validates extracted keys, falls back to environment variables or workspaces.json, and covers redacted resolver errors and CLI compatibility.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RelayfileCLI
  participant AgentRelay
  participant WorkspaceStore
  participant RelaycastValidation
  RelayfileCLI->>AgentRelay: Request revealed active workspace
  AgentRelay-->>RelayfileCLI: Workspace data or resolver error
  RelayfileCLI->>WorkspaceStore: Resolve fallback workspace key
  WorkspaceStore-->>RelayfileCLI: Return active workspace key
  RelayfileCLI->>RelaycastValidation: Validate workspace key
  RelaycastValidation-->>RelayfileCLI: Return classification

Loading

Possibly related PRs

• AgentWorkforce/relayfile#350: Updates related Agent Relay active-workspace error classification and test coverage.

Suggested reviewers: khaliqgant

Poem

A rabbit found a token bright,
And asked the relay to show its light.
Masked keys stayed safely out of sight,
Old flags hopped through fallback night.
Workspace clues now guide the way—
Through store and checks to dawn of day.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: making relayfile CLI reads survive masked agent-relay session and workspace output.
Description check	✅ Passed	The description is directly aligned with the patch, covering reveal-flag fallbacks, masked-token rejection, and workspace-store fallback.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/agent-relay-masked-session

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Relayfile Eval Review

Run: .relayfile/evals/runs/2026-07-30T01-59-04-579Z-HEAD-provider
Mode: provider
Git SHA: 3108462

Passed: 4 | Needs human: 0 | Reviewable: 0 | Missing output: 0 | Failed: 0 | Skipped: 0

Human Review Cases

No reviewable human-review cases captured Relayfile output.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

cmd/relayfile-cli/main_test.go (1)

2902-2943: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add legacy fallback coverage for workspace active.

These tests cover cloud session --reveal-token, but not workspace active --reveal-secrets returning unknown option and succeeding through the plain workspace active --json retry. This is a separate compatibility path.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/relayfile-cli/main_test.go` around lines 2902 - 2943, Add a test
alongside TestCloudCredentialsFallBackWhenRevealTokenUnsupported that makes the
fake agent reject workspace active --json --reveal-secrets with an
unknown-option error, then return valid credentials for workspace active --json.
Assert cloudCredentialsFromAgentRelay succeeds and preserves the returned access
token, covering the separate legacy workspace fallback path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/relayfile-cli/main.go`:
- Around line 1365-1368: Update the environment-key lookup loop in the resolver
to ignore masked or redacted values such as “rk_live_…redacted” before returning
a key. Only accept an actual usable live relay key, then continue to the store
fallback when the environment value is masked; preserve the existing precedence
among the listed environment variable names.

---

Nitpick comments:
In `@cmd/relayfile-cli/main_test.go`:
- Around line 2902-2943: Add a test alongside
TestCloudCredentialsFallBackWhenRevealTokenUnsupported that makes the fake agent
reject workspace active --json --reveal-secrets with an unknown-option error,
then return valid credentials for workspace active --json. Assert
cloudCredentialsFromAgentRelay succeeds and preserves the returned access token,
covering the separate legacy workspace fallback path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b071abd7-67d2-497f-b6b5-922895fe9dad

📥 Commits

Reviewing files that changed from the base of the PR and between 5bf5229 and 4846d23.

📒 Files selected for processing (2)

• cmd/relayfile-cli/main.go
• cmd/relayfile-cli/main_test.go