Fix GitLab setup and approval resume in mounted CLI surfaces
agent-relay flows still consumes SDK2.0.62, which lacks the GitLab setup/refusal fixes and the canonical approval/repository-resume contract. The standalone Relayfile installer also retains an older cache key. Consume the released Flows SDK2.0.65 and Relayfile SDK^0.10.77 in both the npm manifests and standalone installer, so the mounted commands expose the released behavior.
Update the npm10 lockfile, refresh the standalone cache identities, and add a base/head acceptance case using real published package installations. The case checks the metadata-file option and exercises the mounted Flows command against a closed Cloud transport for selection/ingress refusals. The changelog records the fixes under Unreleased-Patch after finalized17.2.0.
Validation at exact 0f7119d22cb6f365e3236fc858bfba7dbcbfd68e: fresh real npm ci, own-worktree package resolution, typecheck, four suites/73 tests, diff check, and base/head acceptance pass. The base observes Flows2.0.62 with both refusal cases failing; the head observes2.0.65 and both pass. Both fresh installations resolve Relayfile0.10.77. Literal commands/output are posted in the evidence comment. Independent exact-head review is complete with no blocker: https://github.com/AgentWorkforce/relay/pull/2089#issuecomment-6692868444 . Hosted CI is running at the same formatted head after reopening the PR; the formatter bot push had not triggered those checks.
Upstream Flows2.0.65 and Relayfile0.10.77 are public. All five Flows registry artifacts and source identity were independently verified. The isolated original-quoting-syntax test with public2.0.65 (literal evidence: https://github.com/AgentWorkforce/flows/pull/706#issuecomment-6692795598) completed all seven hosted steps: scoped clone, Claude edit, content check, approval/resume, push, helper comment and completion. GitLab shows exactly one proof file/commit/comment and unchanged main. This is isolated Owner-role project-token evidence, not a Nabis customer run or Developer-role403/group-token acceptance.
No merge or Relay release is dispatched by this PR author; the mounted-consumer release follows human merge.
RelayFlow Proof
- Change type:
bugfix - RelayFlow case:
gitlab-released-product-pins