Fix spawned broker and CLI env separation

[khaliqgant]

Summary

• pass Pear’s native broker to spawned workers through BROKER_BINARY_PATH
• reserve AGENT_RELAY_BIN for a distinct executable that proves the agent-relay cloud session capability
• omit AGENT_RELAY_BIN entirely when no valid capability-probed CLI exists; never emit an empty-string override
• preserve AGENT_RELAY_BIN as a legacy Pear broker input only when no explicit BROKER_BINARY_PATH is configured

Root cause

Pear injected the native agent-relay-broker path into spawned worker AGENT_RELAY_BIN. Relayfile defines that variable as the external Agent Relay CLI used to refresh delegated cloud credentials. When a delegated token expired, Relayfile therefore ran agent-relay-broker cloud session and could not re-mint the credential even though a compatible Agent Relay CLI was available.

An empty-string replacement is also incorrect: it emits an explicit override instead of allowing downstream PATH/default discovery. The spawned environment now contains AGENT_RELAY_BIN only for a distinct executable whose help output proves the cloud-session command contract.

Regression coverage

Red-first Step 2 proof on the rebased branch failed exactly as expected: the native-broker case received "" where the new assertion expected undefined; the valid CLI companion test remained green.

The final tests prove both sides:

• a native broker inherited through the legacy variable is exposed to workers only as BROKER_BINARY_PATH; the spawned env does not own an AGENT_RELAY_BIN property and reads it as undefined
• an intentional, distinct Agent Relay CLI override is preserved byte-for-byte after the cloud-session capability check
• Windows npm .cmd CLI wrappers are capability-probed through shell dispatch, with stdout and stderr combined independently of exit status

Composition

Rebased onto Pear main 02c5cc2a, which includes #397 and published AgentWorkforce 4.1.16 consumption. The Workforce broker-first precedence and this Pear env separation now validate together.

Local validation

• real npm ci in the worktree; node_modules is not a symlink
• focused spawn-env tests: 2 passed
• npm run verify:mcp-resources-drift
• npm run lint
• npm run typecheck
• npm test: 128 passed
• npx vitest run: 35 files, 527 passed
• npm run build
• git diff --check

All green locally. Hosted checks and reviewers are monitored before final signoff.

[coderabbitai]

Warning

Review limit reached

@khaliqgant, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fab8bc83-fe8f-43a7-b54e-128ab1f0417e

📥 Commits

Reviewing files that changed from the base of the PR and between 02c5cc2 and 114dd8f.

📒 Files selected for processing (3)

• src/main/broker-binary.ts
• src/main/broker.test.ts
• src/main/broker.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/spawned-cli-broker-env

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a new environment variable, BROKER_BINARY_PATH, to separate the native broker binary path from the external Agent Relay CLI (AGENT_RELAY_BIN), preventing conflicts where the broker was incorrectly invoked for cloud session operations. It also adds capability checks to verify if the configured AGENT_RELAY_BIN supports cloud sessions. The review feedback correctly identifies a potential execution failure on Windows when calling execFile on CLI wrappers without shell: true, and suggests combining stdout and stderr to make the CLI capability check more robust.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: be0663af87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".