fix(deploy): harden CLI provenance and transient preflight

[miyaontherelay]

#163 deploy provenance hardening

Builds on the bundled dependency provenance landed in #280.

Closes #163.

What changed

• Compare the invoked wrapper with the nearest cwd-local agentworkforce wrapper; validate and select the local pair only when its wrapper is newer, otherwise validate the invoked pair, and import the exact CLI entry whose version was checked.
• Refuse a partial or version-skewed selected pair before executing nested CLI code, with sanitized copyable reinstall guidance.
• Reproduce the reported 4.1.25 global to 4.1.26 project selection using the real sibling-hoisted npm topology; cover nested/hoisted layouts, bare-CLI injection, numeric/prerelease SemVer ordering, partial installs, and paths containing spaces.
• Add selected CLI version/source and PATH/update guidance when an authored TypeScript or JavaScript persona fails.
• Retry transient fetch failures for idempotent integration catalog/status/list GETs with bounded backoff; never retry POST connect sessions or ordinary HTTP/auth responses.
• Preserve cli: default deploy mode to cloud #158 behavior with a regression proving non-interactive deploy without --mode reaches cloud mode.

#163 acceptance audit

• Transient catalog/status failure then success: resolver tests plus a deploy-level cloud preflight/launch regression.
• CI coverage for cloud preflight: included in the deploy suite.
• Stale/source guidance: selected CLI version, package source, PATH check, and copyable reinstall command.
• Non-interactive mode guidance: superseded by cli: default deploy mode to cloud #158 default-cloud behavior and regression-tested here.
• Nested stale binary: fixed wrappers compare the invoked pair with the nearest cwd-local wrapper, select a newer coherent local pair when present, and never import a mismatched selected pair.

Boundaries

An already-running pre-fix 4.1.25 wrapper cannot use this new resolver and must first be updated or reinstalled. The fixed wrapper performs no registry/latest lookup, so a coherently stale install with no newer discoverable local candidate cannot know about a future release.

Verification

• pnpm --filter agentworkforce test — 14 passed
• pnpm --filter @agentworkforce/deploy test — 249 passed
• focused compiled CLI suites — 103 passed in independent shadow review; deploy-command 18 passed locally
• node --test packages/runtime/dist/runner.test.js — 14 passed
• pnpm run build, pnpm run lint, and pnpm run typecheck — passed

The unfiltered CLI suite reaches an invoke replay test that also fails unchanged on the exact main baseline under this host's Node 25.8.1. The repository CI runs the patched Node 26 baseline and is required before merge.

[coderabbitai]

Warning

Review limit reached

@miyaontherelay, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dfed38fb-2e27-48b7-b06a-aa935fc24610

📥 Commits

Reviewing files that changed from the base of the PR and between 8e2679d and faf4e9b.

📒 Files selected for processing (13)

• packages/agentworkforce/CHANGELOG.md
• packages/agentworkforce/README.md
• packages/agentworkforce/bin/agentworkforce.js
• packages/agentworkforce/test/version.test.js
• packages/cli/CHANGELOG.md
• packages/cli/README.md
• packages/cli/src/deploy-command.test.ts
• packages/cli/src/deploy-command.ts
• packages/deploy/CHANGELOG.md
• packages/deploy/src/connect.test.ts
• packages/deploy/src/connect.ts
• packages/deploy/src/deploy.test.ts
• packages/deploy/src/deploy.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/wf-deploy-163-279

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces wrapper validation to prefer newer project-local agentworkforce installations over older global ones, adds transient network retry logic for idempotent cloud integration GET requests, and improves deploy failure reporting. The review feedback highlights several robustness improvements: handling ERR_PACKAGE_PATH_NOT_EXPORTED during package resolution to prevent unexpected crashes, wrapping synchronous file reading in formatDeployFailure with a try-catch block to avoid masking original errors, and making the HTTP method check case-insensitive when determining retry eligibility.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.