sim 2.0.0-preview.16.1 → 2.0.0-preview.18.1

package/README.md

@@ -57,6 +57,11 @@ Each setting resolves independently, first match wins:
 | --- | --- |
 | 1 | Command-line flag (`--endpoint`, `--workspace`, `--output`) |
 | 2 | Environment (`SIM_ENDPOINT`, `SIM_API_KEY`, `SIM_WORKSPACE`, `SIM_OUTPUT`) |
+
+`SIM_TIMEOUT_SECONDS` bounds each request (default `3600`, `0` waits
+indefinitely) and `SIM_DEBUG=1` traces requests to stderr. Node ignores
+`HTTPS_PROXY` unless `NODE_USE_ENV_PROXY=1` is also set, on Node 22.21+ or
+24.5+; the CLI warns when a proxy is configured but will not be used.
 | 3 | `~/.sim/config` / `~/.sim/credentials` for the selected profile |
 | 4 | Built-in default (`https://www.sim.ai`, `table`) |
 

package/dist/index.js

@@ -2539,6 +2539,53 @@ function readPackageVersion() {
 var CLI_VERSION = readPackageVersion();
 var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
 
+// src/http/environment.ts
+var reported = new Set;
+function once(key, message) {
+  if (reported.has(key))
+    return;
+  reported.add(key);
+  process.stderr.write(`warning: ${message}
+`);
+}
+var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var PROXY_SUPPORT = { 22: 21, 24: 5 };
+var FIRST_SUPPORTED_MAJOR = 24;
+function runtimeCanProxy(version) {
+  const [major, minor] = version.replace(/^v/, "").split(".").map(Number);
+  if (!Number.isFinite(major) || !Number.isFinite(minor))
+    return false;
+  const firstSupportedMinor = PROXY_SUPPORT[major];
+  if (firstSupportedMinor !== undefined)
+    return minor >= firstSupportedMinor;
+  return major > FIRST_SUPPORTED_MAJOR;
+}
+function warnIfProxyIgnored(env2 = process.env, version = process.version) {
+  const variable = PROXY_VARIABLES.find((name) => env2[name]);
+  if (!variable)
+    return;
+  if (env2.NODE_USE_ENV_PROXY && runtimeCanProxy(version))
+    return;
+  once("proxy", runtimeCanProxy(version) ? `${variable} is set but Node only uses it when NODE_USE_ENV_PROXY=1. Re-run with NODE_USE_ENV_PROXY=1 to route through the proxy.` : `${variable} is set but Node ${version} cannot use it. Upgrade to Node 22.21 or 24.5 and set NODE_USE_ENV_PROXY=1 to route through the proxy.`);
+}
+var LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
+function isLoopback(hostname) {
+  return LOOPBACK.has(hostname) || hostname.endsWith(".localhost");
+}
+function warnIfKeyOverCleartext(endpoint, hasApiKey) {
+  if (!hasApiKey)
+    return;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return;
+  }
+  if (url.protocol !== "http:" || isLoopback(url.hostname))
+    return;
+  once("cleartext", `sending your API key to ${url.host} over http. Anything on the path can read it — use https unless this network is trusted.`);
+}
+
 // src/http/client.ts
 class SimApiError extends Error {
   status;
@@ -2623,6 +2670,51 @@ function dropUnionBranchNoise(issues) {
   const kept = issues.filter((issue) => !issues.some((other) => rejectsAKeyThatValidated(issue, other)));
   return kept.length > 0 ? kept : issues;
 }
+var DEFAULT_TIMEOUT_SECONDS = 3600;
+var MAX_TIMEOUT_MS = 2 ** 31 - 1;
+var RAISE_TIMEOUT_HINT = "Raise SIM_TIMEOUT_SECONDS, or set it to 0 to wait indefinitely.";
+function isRequestTimeout(error) {
+  return error instanceof DOMException && error.name === "TimeoutError";
+}
+function resolveTimeoutMs(env2 = process.env) {
+  const raw = env2.SIM_TIMEOUT_SECONDS;
+  if (raw === undefined || raw.trim() === "")
+    return DEFAULT_TIMEOUT_SECONDS * 1000;
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new SimApiError(`Invalid SIM_TIMEOUT_SECONDS "${raw}". Use a non-negative number of seconds, or 0 to disable.`, 0);
+  }
+  const ms = seconds === 0 ? 0 : Math.max(1, Math.round(seconds * 1000));
+  if (ms > MAX_TIMEOUT_MS) {
+    throw new SimApiError(`SIM_TIMEOUT_SECONDS "${raw}" is longer than Node can wait (${Math.floor(MAX_TIMEOUT_MS / 1000)}s). Use 0 to wait indefinitely.`, 0);
+  }
+  return ms;
+}
+function combineSignals(caller, timeout) {
+  if (!caller)
+    return timeout;
+  if (!timeout)
+    return caller;
+  if (typeof AbortSignal.any === "function")
+    return AbortSignal.any([caller, timeout]);
+  const controller = new AbortController;
+  for (const signal of [caller, timeout]) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+function debugEnabled(env2 = process.env) {
+  const raw = env2.SIM_DEBUG;
+  return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
+}
+function traceRequest(method, url, status, startedAt) {
+  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+`);
+}
 function formatApiErrorDetails(details) {
   const issues = [];
   const seen = new Set;
@@ -2706,10 +2798,18 @@ class SimClient {
     const apiKey = this.resolveApiKey(options.auth);
     const url = buildUrl(this.profile.endpoint, path, options.query);
     const hasBody = options.body !== undefined;
+    const method = options.method ?? "GET";
+    warnIfProxyIgnored();
+    warnIfKeyOverCleartext(this.profile.endpoint, Boolean(apiKey));
+    const timeoutMs = resolveTimeoutMs();
+    const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
+    const signal = combineSignals(options.signal, timeout);
+    const trace = debugEnabled();
+    const startedAt = performance.now();
     let response;
     try {
       response = await fetch(url, {
-        method: options.method ?? "GET",
+        method,
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
@@ -2718,15 +2818,22 @@ class SimClient {
           ...options.headers
         },
         body: hasBody ? JSON.stringify(options.body) : undefined,
-        signal: options.signal,
+        signal,
         redirect: "manual"
       });
     } catch (cause) {
+      if (trace)
+        traceRequest(method, url, "failed", startedAt);
       if (options.signal?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
+      if (timeout?.aborted) {
+        throw new SimApiError(`${url} did not answer within ${timeoutMs / 1000}s. ${RAISE_TIMEOUT_HINT}`, 0);
+      }
       throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
     }
+    if (trace)
+      traceRequest(method, url, response.status, startedAt);
     if (REDIRECT_STATUSES.has(response.status))
       throw this.toRedirectError(url, path, response);
     if (!response.ok) {
@@ -2768,16 +2875,16 @@ function redirectEndpoint(endpoint, requestPath, target) {
   return suggested === endpoint.replace(/\/+$/, "") ? null : suggested;
 }
 function pageProgress() {
-  let reported = false;
+  let reported2 = false;
   return {
     advance: (fetched) => {
       if (!process.stderr.isTTY)
         return;
-      reported = true;
+      reported2 = true;
       process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
     },
     finish: () => {
-      if (reported)
+      if (reported2)
         process.stderr.write("\r\x1B[K");
     }
   };
@@ -8939,6 +9046,10 @@ var V2_OPERATIONS = {
         kind: "string",
         required: true,
         describe: "Write-only secret value. It is never returned."
+      },
+      description: {
+        kind: "string",
+        describe: "What the secret is for, shown to teammates. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave an existing description untouched; send null or an empty string to clear one."
       }
     }
   },
@@ -9996,7 +10107,8 @@ var CLI_CONTRACT = {
       { header: "name" },
       { header: "scope" },
       { header: "role" },
-      { header: "updated", path: "updatedAt", format: "timestamp" }
+      { header: "updated", path: "updatedAt", format: "timestamp" },
+      { header: "description" }
     ]
   },
   getWorkspace: {
@@ -11059,7 +11171,7 @@ function attachCredentialCommands(program2) {
 }
 
 // src/commands/protocol/files-get.ts
-import { once } from "node:events";
+import { once as once2 } from "node:events";
 import { createWriteStream } from "node:fs";
 import { link, lstat, mkdtemp, readlink, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
@@ -11074,6 +11186,9 @@ function printProtocolResult(format, result) {
 
 // src/commands/protocol/files-get.ts
 function writeFailure(path, error) {
+  if (isRequestTimeout(error)) {
+    return new SimApiError(`Downloading ${path} timed out. ${RAISE_TIMEOUT_HINT}`, 0);
+  }
   const code = error.code;
   if (code === "EEXIST") {
     return new SimApiError(`${path} already exists. Pass --force to overwrite it, or choose another output path.`, 0);
@@ -11164,7 +11279,7 @@ async function streamToStdout(body, output = process.stdout) {
       if (done)
         return;
       if (!output.write(value))
-        await once(output, "drain");
+        await once2(output, "drain");
     }
   } finally {
     reader.releaseLock();
@@ -11608,17 +11723,17 @@ function jsonFlag(raw, flagName, kind) {
 }
 async function watchImport(client, workspaceId, job) {
   let current = job;
-  let reported = -1;
+  let reported2 = -1;
   while (!IMPORT_SETTLED.has(current.status)) {
     await sleep2(IMPORT_POLL_MS);
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
-    if (process.stderr.isTTY && current.rowsProcessed !== reported) {
-      reported = current.rowsProcessed;
-      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported} rows`)}\x1B[K`);
+    if (process.stderr.isTTY && current.rowsProcessed !== reported2) {
+      reported2 = current.rowsProcessed;
+      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported2} rows`)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported >= 0)
+  if (process.stderr.isTTY && reported2 >= 0)
     process.stderr.write("\r\x1B[K");
   return current;
 }
@@ -11834,7 +11949,8 @@ var SECRET_RESULT = {
     { header: "name" },
     { header: "scope" },
     { header: "role" },
-    { header: "updated", path: "updatedAt", format: "timestamp" }
+    { header: "updated", path: "updatedAt", format: "timestamp" },
+    { header: "description" }
   ]
 };
 function validateSecretValue(value) {
@@ -11845,7 +11961,16 @@ function validateSecretValue(value) {
   }
   return value;
 }
+function validateDescriptionScope(description, scope) {
+  if (description === undefined)
+    return;
+  if (scope === "personal") {
+    throw new SimApiError("--description is only supported for a workspace secret.", 0);
+  }
+  return description;
+}
 async function setSecret(name, options, command) {
+  const description = validateDescriptionScope(options.description, options.scope);
   const value = validateSecretValue(options.value ?? await promptSecret());
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.setSecret;
@@ -11854,7 +11979,8 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value
+      value,
+      description
     }
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
@@ -11863,7 +11989,7 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").action((name, options, command) => setSecret(name, options, command));
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").action((name, options, command) => setSecret(name, options, command));
 }
 
 // src/runtime/renamed.ts
@@ -12232,6 +12358,10 @@ async function main() {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       process.exit(1);
     }
+    if (isRequestTimeout(error)) {
+      console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+      process.exit(1);
+    }
     if (error instanceof SimApiError) {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       if (error.code)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.0.0-preview.16.1",
+  "version": "2.0.0-preview.18.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {