feat(cli-surface): expose @relayfile/sdk/relay-cli for agent-relay file

.gitignore

@@ -60,6 +60,12 @@ bin/
 !packages/mount-*/bin/.gitkeep
 packages/mount-*/bin/relayfile-mount
 
+# CLI platform packages: same arrangement as the mount packages above.
+!packages/cli-*/bin/
+!packages/cli-*/bin/.gitkeep
+packages/cli-*/bin/relayfile-cli
+packages/cli-*/bin/relayfile-cli.exe
+
 # Agent tool configs
 .factory/
 .gemini/

.trajectories/completed/2026-09/traj_3lyio30tipf8.json

@@ -0,0 +1,109 @@
+{
+  "id": "traj_3lyio30tipf8",
+  "version": 1,
+  "task": {
+    "title": "Fix four Devin findings on relayfile PR #507 (CLI surface)",
+    "source": {
+      "system": "plain",
+      "id": "PR-507"
+    }
+  },
+  "status": "completed",
+  "startedAt": "2026-09-18T06:29:04.757Z",
+  "completedAt": "2026-09-18T06:29:37.710Z",
+  "agents": [
+    {
+      "name": "default",
+      "role": "lead",
+      "joinedAt": "2026-09-18T06:29:15.251Z"
+    }
+  ],
+  "chapters": [
+    {
+      "id": "chap_s7t4qhsbqzyp",
+      "title": "Work",
+      "agentName": "default",
+      "startedAt": "2026-09-18T06:29:15.251Z",
+      "endedAt": "2026-09-18T06:29:37.710Z",
+      "events": [
+        {
+          "ts": 1789712955251,
+          "type": "decision",
+          "content": "Fix the go-run cwd bug by building then executing, in the shared resolver: Fix the go-run cwd bug by building then executing, in the shared resolver",
+          "raw": {
+            "question": "Fix the go-run cwd bug by building then executing, in the shared resolver",
+            "chosen": "Fix the go-run cwd bug by building then executing, in the shared resolver",
+            "alternatives": [],
+            "reasoning": "go run gives the launched program the go command's own working directory, and go only finds the module from the checkout. I verified both escape hatches fail: an absolute package path outside a module errors ('go.mod file not found'), and 'go -C <dir> run' hands the child that same dir. Building to a temp path (not the checkout's bin/, so a working tree is never written to) and spawning the binary with the caller's cwd is the only way to separate the two. Put it in resolve-binary.ts so the CLI shim and the mounted surface share one implementation."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1789712955373,
+          "type": "decision",
+          "content": "Declare listen's workspace positional on listen, dev and workspace status: Declare listen's workspace positional on listen, dev and workspace status",
+          "raw": {
+            "question": "Declare listen's workspace positional on listen, dev and workspace status",
+            "chosen": "Declare listen's workspace positional on listen, dev and workspace status",
+            "alternatives": [],
+            "reasoning": "runListen reads fs.Arg(0) as the workspace and dev forwards argv to it verbatim; the host builds its parser from the emitted spec, so an undeclared positional is a rejected-but-valid invocation. workspace status is the same bug, surfaced by the new AST guard rather than by the review."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1789712955516,
+          "type": "decision",
+          "content": "Give supervisor install flagSource runListen instead of deleting --interval: Give supervisor install flagSource runListen instead of deleting --interval",
+          "raw": {
+            "question": "Give supervisor install flagSource runListen instead of deleting --interval",
+            "chosen": "Give supervisor install flagSource runListen instead of deleting --interval",
+            "alternatives": [],
+            "reasoning": "The drift test exempted 'supervisor install' from the flag check (isPassThroughCommand) precisely because it declared options with no flagSource — that exemption is why --interval survived. Removing the exemption and pointing flagSource at runListen makes the table's claim checkable: supervisor install embeds its argv into ExecStart as 'relayfile listen ...', so its options are listen's options, no more and no less. Deleting --interval alone would have left it under-declaring the flags it really forwards."
+          },
+          "significance": "high"
+        },
+        {
+          "ts": 1789712960149,
+          "type": "decision",
+          "content": "Rejected finding 1 (binary stdout) as already fixed: Rejected finding 1 (binary stdout) as already fixed",
+          "raw": {
+            "question": "Rejected finding 1 (binary stdout) as already fixed",
+            "chosen": "Rejected finding 1 (binary stdout) as already fixed",
+            "alternatives": [],
+            "reasoning": "setEncoding was removed in af70448f on this same branch, before the review round. I mutation-checked the covering test (binary-output.test.ts) by reintroducing setEncoding: it fails on the 0xff 0xfe payload, so the guard is real, not vacuous. No change made."
+          },
+          "significance": "high"
+        }
+      ]
+    }
+  ],
+  "retrospective": {
+    "summary": "Fixed 3 of 4 Devin findings on PR #507 and rejected the 4th as already fixed on-branch. go-run now builds then executes so the child keeps the caller's cwd (shared by the mounted surface and the bin shim); listen/dev/workspace-status declare their workspace positional; supervisor install declares runListen's flags instead of a --interval runListen rejects. Closed both AST drift blind spots. Tests: vitest relay-cli 105 pass/0 fail (was 97), SDK-wide 416 pass/1 pre-existing fail (client.test.ts ErrorEvent, fails on the unmodified branch too); go ./cmd/relayfile-cli 386 pass/0 fail/8 skip (was 382); packages/cli 15 pass/0 fail (was 14).",
+    "approach": "Standard approach",
+    "confidence": 0.85
+  },
+  "commits": [
+    "c1751c42"
+  ],
+  "filesChanged": [
+    ".trajectories/active/traj_3lyio30tipf8.json",
+    ".trajectories/index.json",
+    "cmd/relayfile-cli/commandspec.go",
+    "cmd/relayfile-cli/commandspec_test.go",
+    "cmd/relayfile-cli/listen_test.go",
+    "packages/cli/scripts/run.js",
+    "packages/cli/scripts/run.test.js",
+    "packages/sdk/typescript/src/relay-cli/command-spec.json",
+    "packages/sdk/typescript/src/relay-cli/command-spec.test.ts",
+    "packages/sdk/typescript/src/relay-cli/go-run-cwd.test.ts",
+    "packages/sdk/typescript/src/relay-cli/index.ts",
+    "packages/sdk/typescript/src/relay-cli/resolve-binary.ts"
+  ],
+  "projectId": "AgentWorkforce/relayfile",
+  "tags": [],
+  "_trace": {
+    "startRef": "f89e95460932c136a3597a90d91a0994dbd9242c",
+    "endRef": "c1751c420e45219ce6267237b4afcc12ccde46e3",
+    "traceId": "6b84ebad-ca78-4851-8b0e-30fa7719192d"
+  }
+}

.trajectories/completed/2026-09/traj_3lyio30tipf8.md

@@ -0,0 +1,54 @@
+# Trajectory: Fix four Devin findings on relayfile PR #507 (CLI surface)
+
+> **Status:** ✅ Completed
+> **Task:** PR-507
+> **Confidence:** 85%
+> **Started:** September 17, 2026 at 11:29 PM
+> **Completed:** September 17, 2026 at 11:29 PM
+
+---
+
+## Summary
+
+Fixed 3 of 4 Devin findings on PR #507 and rejected the 4th as already fixed on-branch. go-run now builds then executes so the child keeps the caller's cwd (shared by the mounted surface and the bin shim); listen/dev/workspace-status declare their workspace positional; supervisor install declares runListen's flags instead of a --interval runListen rejects. Closed both AST drift blind spots. Tests: vitest relay-cli 105 pass/0 fail (was 97), SDK-wide 416 pass/1 pre-existing fail (client.test.ts ErrorEvent, fails on the unmodified branch too); go ./cmd/relayfile-cli 386 pass/0 fail/8 skip (was 382); packages/cli 15 pass/0 fail (was 14).
+
+**Approach:** Standard approach
+
+---
+
+## Key Decisions
+
+### Fix the go-run cwd bug by building then executing, in the shared resolver
+- **Chose:** Fix the go-run cwd bug by building then executing, in the shared resolver
+- **Reasoning:** go run gives the launched program the go command's own working directory, and go only finds the module from the checkout. I verified both escape hatches fail: an absolute package path outside a module errors ('go.mod file not found'), and 'go -C <dir> run' hands the child that same dir. Building to a temp path (not the checkout's bin/, so a working tree is never written to) and spawning the binary with the caller's cwd is the only way to separate the two. Put it in resolve-binary.ts so the CLI shim and the mounted surface share one implementation.
+
+### Declare listen's workspace positional on listen, dev and workspace status
+- **Chose:** Declare listen's workspace positional on listen, dev and workspace status
+- **Reasoning:** runListen reads fs.Arg(0) as the workspace and dev forwards argv to it verbatim; the host builds its parser from the emitted spec, so an undeclared positional is a rejected-but-valid invocation. workspace status is the same bug, surfaced by the new AST guard rather than by the review.
+
+### Give supervisor install flagSource runListen instead of deleting --interval
+- **Chose:** Give supervisor install flagSource runListen instead of deleting --interval
+- **Reasoning:** The drift test exempted 'supervisor install' from the flag check (isPassThroughCommand) precisely because it declared options with no flagSource — that exemption is why --interval survived. Removing the exemption and pointing flagSource at runListen makes the table's claim checkable: supervisor install embeds its argv into ExecStart as 'relayfile listen ...', so its options are listen's options, no more and no less. Deleting --interval alone would have left it under-declaring the flags it really forwards.
+
+### Rejected finding 1 (binary stdout) as already fixed
+- **Chose:** Rejected finding 1 (binary stdout) as already fixed
+- **Reasoning:** setEncoding was removed in af70448f on this same branch, before the review round. I mutation-checked the covering test (binary-output.test.ts) by reintroducing setEncoding: it fails on the 0xff 0xfe payload, so the guard is real, not vacuous. No change made.
+
+---
+
+## Chapters
+
+### 1. Work
+*Agent: default*
+
+- Fix the go-run cwd bug by building then executing, in the shared resolver: Fix the go-run cwd bug by building then executing, in the shared resolver
+- Declare listen's workspace positional on listen, dev and workspace status: Declare listen's workspace positional on listen, dev and workspace status
+- Give supervisor install flagSource runListen instead of deleting --interval: Give supervisor install flagSource runListen instead of deleting --interval
+- Rejected finding 1 (binary stdout) as already fixed: Rejected finding 1 (binary stdout) as already fixed
+
+---
+
+## Artifacts
+
+**Commits:** c1751c42
+**Files changed:** 12