fix(cli): bound integration control-plane auth latency

[khaliqgant]

Summary

• honor RELAYFILE_CLOUD_TOKEN in relayfile integration list, which backs control-plane provider status
• retain Agent Relay session discovery as the fallback when no explicit token is supplied
• bound optional runtime-status enrichment to two seconds so a slow data plane cannot consume the caller deadline

Live reproduction

The branch-built local Agent Relay CLI initially failed integration subscribe at GET /v1/integrations/provider-status after 10 seconds. Relayfile spent ~12 seconds on repeated Agent Relay credential discovery; after explicit token handoff it still measured ~9.7 seconds because optional runtime enrichment waited on the data plane. With this branch plus the Relay CLI request-budget fix, the same command provisioned the scoped binding and server-side webhook subscription successfully.

Verification

• focused integration-list regression tests: passed
• go test ./cmd/relayfile-cli -count=1: passed (71.1s)
• git diff --check: passed

No production deploy was run.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d3a56000-3fe7-4d56-bd86-cbdfc5465e23

📥 Commits

Reviewing files that changed from the base of the PR and between ecf33cf and 7b8b4f1.

📒 Files selected for processing (3)

• cmd/relayfile-cli/control_plane_test.go
• cmd/relayfile-cli/main.go
• cmd/relayfile-cli/main_test.go

---

📝 Walkthrough

Walkthrough

The integration list command now supports Cloud token input and inherited-token refresh. It preserves the selected Cloud API URL during retries. Optional runtime sync-status enrichment now has a two-second deadline. Tests and the changelog cover the changes.

Changes

Integration list behavior

Layer / File(s)	Summary
Cloud credential resolution and retry cmd/relayfile-cli/main.go, cmd/relayfile-cli/main_test.go	The command accepts --cloud-token and resolves Cloud credentials from explicit or environment input. An inherited token refreshes once after an authentication error without changing the selected Cloud API URL. Tests verify authorization, retry behavior, and session request handling.
Bounded runtime status overlay cmd/relayfile-cli/main.go, cmd/relayfile-cli/main_test.go, cmd/relayfile-cli/control_plane_test.go, packages/cli/CHANGELOG.md	The optional sync-status request uses a two-second context deadline. Tests verify bounded completion, Cloud status preservation, and Cloud-token authorization for provider status. The changelog records the updates.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant CloudAPI
  participant AgentRelay
  CLI->>CloudAPI: Request integrations with resolved credentials
  CloudAPI-->>CLI: Authentication error for inherited token
  CLI->>AgentRelay: Refresh Cloud token from session
  AgentRelay-->>CLI: Return refreshed token
  CLI->>CloudAPI: Retry at selected Cloud API URL

Loading

Possibly related issues

• integration list ignores --cloud-token flag, always falls back to relay binary exec relay#1481 — The change adds Cloud-token resolution for integration list, which matches the issue objective.

Possibly related PRs

• AgentWorkforce/relayfile#274 — Both changes extend the Cloud and delegated-token authentication flow in cmd/relayfile-cli/main.go.
• AgentWorkforce/relayfile#380 — Both changes modify Cloud credential resolution and access-token refresh handling.

Suggested reviewers: willwashburn

Poem

A rabbit passes tokens through,
Keeps the Cloud endpoint in view.
A two-second clock guards the call,
Fresh status answers, or none at all.
The integration list hops away—
Secure and bounded today. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CLI fix that bounds control-plane authentication latency, which is a primary change in the pull request.
Description check	✅ Passed	The description directly explains Cloud-token handling, session fallback, runtime-status timeouts, and verification for the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/integration-control-plane-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/CHANGELOG.md`:
- Line 11: Update the changelog entry to claim only the implemented
RELAYFILE_CLOUD_TOKEN support in relayfile integration list; remove the
unimplemented local integration control plane claim unless equivalent
implementation and tests are added.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 05d37e97-bf11-4741-af2c-5bd69a51c3a1

📥 Commits

Reviewing files that changed from the base of the PR and between 7f95516 and ecf33cf.

📒 Files selected for processing (3)

• cmd/relayfile-cli/main.go
• cmd/relayfile-cli/main_test.go
• packages/cli/CHANGELOG.md

[github-actions]

Relayfile Eval Review

Run: .relayfile/evals/runs/2026-08-12T07-10-41-563Z-HEAD-provider
Mode: provider
Git SHA: 2f0758b

Passed: 4 | Needs human: 0 | Reviewable: 0 | Missing output: 0 | Failed: 0 | Skipped: 0

Human Review Cases

No reviewable human-review cases captured Relayfile output.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ecf33cff20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>