#1274 Resolve the right workspace key for CLI commands in a project directory

Summary

Fixes the class of bug where agent-relay fleet nodes (and other SDK-backed commands) showed the wrong roster because they resolved the machine-global active workspace key instead of the workspace the current directory's broker actually joined. Three related changes:

• --wk shorthand for --workspace-key on every SDK-backed command (fleet nodes, workspace, integration, webhook, …) and on up/node up. It's folded into workspaceKey by a preAction hook so all downstream readers see one canonical option; an explicit --workspace-key still wins. (Commander v12 can't alias two long flags to one attribute, hence the fold.)
• up records the workspace it joins. agent-relay up writes the workspace key it joined — passed via --workspace-key/--wk or auto-minted — into the project data dir (.agentworkforce/relay/workspace-key.json, git-excluded, 0o600, same posture as connection.json). SDK-backed commands run in that directory resolve that key ahead of the global active workspace, so fleet nodes/node … reflect the broker's real workspace. An explicit --workspace-key/--wk or RELAY_WORKSPACE_KEY/RELAY_API_KEY still overrides it.
  • Precedence: flag → RELAY_WORKSPACE_KEY/RELAY_API_KEY → project broker key (this CWD) → global active store.
• fleet nodes warns when the key was inferred from that project record. The note goes to stderr (stdout JSON stays clean), so a stale broker workspace is explainable rather than silent. resolveWorkspaceKeyWithSource was added to report the resolution source (flag | env | project | store).

Resolution stays synchronous — no async refactor across the command surface — and keeps working after the broker stops.

Test Plan

• Tests added/updated
  • --wk fold on SDK commands (fleet.test.ts) and on up/node up (core.test.ts), incl. explicit-flag-wins.
  • Project-key store round-trip, malformed/blank handling, 0o600 (project-workspace-key.test.ts).
  • resolveWorkspaceKey/resolveWorkspaceKeyWithSource precedence + source reporting (sdk-client.test.ts).
  • fleet nodes warn-on-project-source / no-warn-on-explicit-key (fleet.test.ts).
• Manual testing completed — logic is unit-covered; a full run against a live Relaycast workspace wasn't possible from this environment.

Note: one unrelated suite (node-definition-loader.test.ts) fails identically on main in a fresh clone (jiti importing an example needs the workspace packages built); it's not touched here.

Screenshots

N/A — CLI flag + stderr note.

🤖 Generated with Claude Code

---

Generated by Claude Code