sim 2.0.0 → 2.1.0-dev.24.1

package/dist/index.js

@@ -2403,7 +2403,7 @@ function removeSection(doc, name) {
 
 // src/config/profile.ts
 var DEFAULT_PROFILE = "default";
-var DEFAULT_ENDPOINT = "https://sim.ai";
+var DEFAULT_ENDPOINT = "https://www.sim.ai";
 var OUTPUT_FORMATS = ["table", "json", "yaml", "text"];
 
 class ProfileConfigError extends Error {
@@ -2466,8 +2466,18 @@ function deleteProfile(profile) {
     writeIni(credentialsPath(), credentialsDoc, true);
   return { config, credentials };
 }
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "");
+function normalizeEndpoint(endpoint, source) {
+  const trimmed = endpoint.replace(/\/+$/, "");
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new ProfileConfigError(`Invalid endpoint "${endpoint}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new ProfileConfigError(`Unsupported endpoint scheme "${parsed.protocol.replace(/:$/, "")}" from ${source}. Use http or https, e.g. ${DEFAULT_ENDPOINT}`);
+  }
+  return trimmed;
 }
 function resolve(candidates, fallback, fallbackSource) {
   for (const [source, value] of candidates) {
@@ -2505,7 +2515,7 @@ function resolveProfile(overrides = {}) {
   }
   return {
     name,
-    endpoint: normalizeEndpoint(endpoint.value),
+    endpoint: normalizeEndpoint(endpoint.value, endpoint.source),
     apiKey: apiKey.value,
     workspaceId: workspaceId.value,
     output: output.value,
@@ -2517,6 +2527,65 @@ function resolveProfile(overrides = {}) {
     }
   };
 }
+// src/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+function readPackageVersion() {
+  const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
+    throw new Error("CLI package metadata is missing a valid version");
+  }
+  return metadata.version;
+}
+var CLI_VERSION = readPackageVersion();
+var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
+
+// src/http/environment.ts
+var reported = new Set;
+function once(key, message) {
+  if (reported.has(key))
+    return;
+  reported.add(key);
+  process.stderr.write(`warning: ${message}
+`);
+}
+var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var PROXY_SUPPORT = { 22: 21, 24: 5 };
+var FIRST_SUPPORTED_MAJOR = 24;
+function runtimeCanProxy(version) {
+  const [major, minor] = version.replace(/^v/, "").split(".").map(Number);
+  if (!Number.isFinite(major) || !Number.isFinite(minor))
+    return false;
+  const firstSupportedMinor = PROXY_SUPPORT[major];
+  if (firstSupportedMinor !== undefined)
+    return minor >= firstSupportedMinor;
+  return major > FIRST_SUPPORTED_MAJOR;
+}
+function warnIfProxyIgnored(env2 = process.env, version = process.version) {
+  const variable = PROXY_VARIABLES.find((name) => env2[name]);
+  if (!variable)
+    return;
+  if (env2.NODE_USE_ENV_PROXY && runtimeCanProxy(version))
+    return;
+  once("proxy", runtimeCanProxy(version) ? `${variable} is set but Node only uses it when NODE_USE_ENV_PROXY=1. Re-run with NODE_USE_ENV_PROXY=1 to route through the proxy.` : `${variable} is set but Node ${version} cannot use it. Upgrade to Node 22.21 or 24.5 and set NODE_USE_ENV_PROXY=1 to route through the proxy.`);
+}
+var LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
+function isLoopback(hostname) {
+  return LOOPBACK.has(hostname) || hostname.endsWith(".localhost");
+}
+function warnIfKeyOverCleartext(endpoint, hasApiKey) {
+  if (!hasApiKey)
+    return;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return;
+  }
+  if (url.protocol !== "http:" || isLoopback(url.hostname))
+    return;
+  once("cleartext", `sending your API key to ${url.host} over http. Anything on the path can read it — use https unless this network is trusted.`);
+}
+
 // src/http/client.ts
 class SimApiError extends Error {
   status;
@@ -2539,13 +2608,28 @@ function buildUrl(endpoint, path, query) {
   }
   return url.toString();
 }
-function toApiError(status, raw) {
+var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+var MARKUP_PREFIX = /^\s*<(?:!doctype|html|\?xml)/i;
+var KEY_SCOPE_REFUSALS = new Set([
+  "WORKSPACE_KEY_OPERATION_NOT_PERMITTED",
+  "PRINCIPAL_KIND_NOT_PERMITTED"
+]);
+function toNonJsonError(url, status, contentType, raw) {
+  const type = contentType?.split(";")[0]?.trim().toLowerCase();
+  const isMarkup = type === "text/html" || type === "application/xhtml+xml" || MARKUP_PREFIX.test(raw);
+  const kind = isMarkup ? "HTML" : type && type !== "application/json" ? type : "a non-JSON response";
+  const text = raw.trim();
+  const keepSnippet = !isMarkup && text.length > 0 && text.length <= 200;
+  return new SimApiError(`${url} returned ${kind}, not JSON (HTTP ${status}) — check your endpoint.${keepSnippet ? ` Response: ${truncate(text, 200)}` : ""}`, status);
+}
+function toApiError(url, status, contentType, raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    const text = raw.trim();
-    return new SimApiError(text ? truncate(text, 300) : `Request failed with status ${status}`, status);
+    if (!raw.trim())
+      return new SimApiError(`Request failed with status ${status}`, status);
+    return toNonJsonError(url, status, contentType, raw);
   }
   const body = parsed;
   if (body.error && typeof body.error === "object") {
@@ -2561,8 +2645,79 @@ function toApiError(status, raw) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…`;
 }
+function namesKeyScopeRefusal(error) {
+  if (typeof error.code === "string" && KEY_SCOPE_REFUSALS.has(error.code))
+    return true;
+  const details = error.details;
+  if (!details || typeof details !== "object")
+    return false;
+  const code = details.code;
+  return typeof code === "string" && KEY_SCOPE_REFUSALS.has(code);
+}
+function isStrictPrefix(path, other) {
+  if (path.length >= other.length)
+    return false;
+  return path.every((segment, index) => segment === other[index]);
+}
+function rejectsAKeyThatValidated(issue, other) {
+  if (!issue.unrecognizedKeys || !isStrictPrefix(issue.path, other.path))
+    return false;
+  return issue.unrecognizedKeys.includes(other.path[issue.path.length]);
+}
+function dropUnionBranchNoise(issues) {
+  if (issues.length < 2)
+    return issues;
+  const kept = issues.filter((issue) => !issues.some((other) => rejectsAKeyThatValidated(issue, other)));
+  return kept.length > 0 ? kept : issues;
+}
+var DEFAULT_TIMEOUT_SECONDS = 3600;
+var MAX_TIMEOUT_MS = 2 ** 31 - 1;
+var RAISE_TIMEOUT_HINT = "Raise SIM_TIMEOUT_SECONDS, or set it to 0 to wait indefinitely.";
+function isRequestTimeout(error) {
+  return error instanceof DOMException && error.name === "TimeoutError";
+}
+function resolveTimeoutMs(env2 = process.env) {
+  const raw = env2.SIM_TIMEOUT_SECONDS;
+  if (raw === undefined || raw.trim() === "")
+    return DEFAULT_TIMEOUT_SECONDS * 1000;
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new SimApiError(`Invalid SIM_TIMEOUT_SECONDS "${raw}". Use a non-negative number of seconds, or 0 to disable.`, 0);
+  }
+  const ms = seconds === 0 ? 0 : Math.max(1, Math.round(seconds * 1000));
+  if (ms > MAX_TIMEOUT_MS) {
+    throw new SimApiError(`SIM_TIMEOUT_SECONDS "${raw}" is longer than Node can wait (${Math.floor(MAX_TIMEOUT_MS / 1000)}s). Use 0 to wait indefinitely.`, 0);
+  }
+  return ms;
+}
+function combineSignals(caller, timeout) {
+  if (!caller)
+    return timeout;
+  if (!timeout)
+    return caller;
+  if (typeof AbortSignal.any === "function")
+    return AbortSignal.any([caller, timeout]);
+  const controller = new AbortController;
+  for (const signal of [caller, timeout]) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+function debugEnabled(env2 = process.env) {
+  const raw = env2.SIM_DEBUG;
+  return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
+}
+function traceRequest(method, url, status, startedAt) {
+  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+`);
+}
 function formatApiErrorDetails(details) {
-  const issues = new Set;
+  const issues = [];
+  const seen = new Set;
   const visit = (value, parentPath = []) => {
     if (Array.isArray(value)) {
       value.forEach((item) => visit(item, parentPath));
@@ -2580,15 +2735,27 @@ function formatApiErrorDetails(details) {
     }
     if (typeof issue.message !== "string" || issue.message === "Invalid input")
       return;
-    issues.add(`${path.length > 0 ? path.join(".") : "request"}: ${issue.message}`);
+    const line = `${path.join(".")}: ${issue.message}`;
+    if (seen.has(line))
+      return;
+    seen.add(line);
+    issues.push({
+      path,
+      message: issue.message,
+      unrecognizedKeys: issue.code === "unrecognized_keys" && Array.isArray(issue.keys) ? issue.keys.map(String) : null
+    });
   };
   visit(details);
-  if (issues.size === 0)
+  if (issues.length === 0)
     return [`  details: ${truncate(JSON.stringify(details), 1000)}`];
-  const visible = [...issues].slice(0, 8);
-  const lines = ["  details:", ...visible.map((issue) => `    ${issue}`)];
-  if (issues.size > visible.length)
-    lines.push(`    … ${issues.size - visible.length} more issues`);
+  const kept = dropUnionBranchNoise(issues);
+  const visible = kept.slice(0, 8);
+  const lines = [
+    "  details:",
+    ...visible.map((issue) => `    ${issue.path.length > 0 ? issue.path.join(".") : "request"}: ${issue.message}`)
+  ];
+  if (kept.length > visible.length)
+    lines.push(`    … ${kept.length - visible.length} more issues`);
   return lines;
 }
 
@@ -2614,65 +2781,140 @@ class SimClient {
     return workspaceId;
   }
   async requestRaw(path, options = {}) {
+    return (await this.send(path, options)).response;
+  }
+  async request(path, options = {}) {
+    const { response, url } = await this.send(path, options);
+    const raw = await response.text();
+    if (!raw)
+      return;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw toNonJsonError(url, response.status, response.headers.get("content-type"), raw);
+    }
+  }
+  async send(path, options) {
     const apiKey = this.resolveApiKey(options.auth);
     const url = buildUrl(this.profile.endpoint, path, options.query);
     const hasBody = options.body !== undefined;
+    const method = options.method ?? "GET";
+    warnIfProxyIgnored();
+    warnIfKeyOverCleartext(this.profile.endpoint, Boolean(apiKey));
+    const timeoutMs = resolveTimeoutMs();
+    const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
+    const signal = combineSignals(options.signal, timeout);
+    const trace = debugEnabled();
+    const startedAt = performance.now();
     let response;
     try {
       response = await fetch(url, {
-        method: options.method ?? "GET",
+        method,
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
+          "user-agent": USER_AGENT,
           ...hasBody ? { "content-type": "application/json" } : {},
           ...options.headers
         },
         body: hasBody ? JSON.stringify(options.body) : undefined,
-        signal: options.signal
+        signal,
+        redirect: "manual"
       });
     } catch (cause) {
+      if (trace)
+        traceRequest(method, url, "failed", startedAt);
       if (options.signal?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
+      if (timeout?.aborted) {
+        throw new SimApiError(`${url} did not answer within ${timeoutMs / 1000}s. ${RAISE_TIMEOUT_HINT}`, 0);
+      }
       throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
     }
+    if (trace)
+      traceRequest(method, url, response.status, startedAt);
+    if (REDIRECT_STATUSES.has(response.status))
+      throw this.toRedirectError(url, path, response);
     if (!response.ok) {
       const raw = await response.text();
-      const error = toApiError(response.status, raw);
+      const error = toApiError(url, response.status, response.headers.get("content-type"), raw);
       if (response.status === 401) {
         error.message = `${error.message} — run: sim login --profile ${this.profile.name}`;
       }
+      if (namesKeyScopeRefusal(error)) {
+        error.message = `${error.message} — this operation needs a personal API key: sim login --profile ${this.profile.name}`;
+      }
       throw error;
     }
-    return response;
+    return { response, url };
   }
-  async request(path, options = {}) {
-    const response = await this.requestRaw(path, options);
-    const raw = await response.text();
-    if (!raw)
-      return;
-    return JSON.parse(raw);
+  toRedirectError(url, path, response) {
+    const location = response.headers.get("location")?.trim();
+    let target = null;
+    if (location) {
+      try {
+        target = new URL(location, url);
+      } catch {
+        target = null;
+      }
+    }
+    if (!target) {
+      return new SimApiError(`${url} answered HTTP ${response.status} with no usable redirect target. Check the endpoint for profile "${this.profile.name}".`, response.status);
+    }
+    const suggested = redirectEndpoint(this.profile.endpoint, path, target);
+    if (!suggested) {
+      return new SimApiError(`${url} redirected to ${target.href}. The CLI does not follow redirects, because a redirect can drop the request body and turn a write into a silent no-op.`, response.status);
+    }
+    return new SimApiError(`Endpoint redirected to ${suggested}. Run: sim configure --profile ${this.profile.name} --set-endpoint ${suggested}`, response.status);
   }
 }
+function redirectEndpoint(endpoint, requestPath, target) {
+  const prefix = target.pathname.endsWith(requestPath) ? target.pathname.slice(0, target.pathname.length - requestPath.length) : "";
+  const suggested = `${target.origin}${prefix}`.replace(/\/+$/, "");
+  return suggested === endpoint.replace(/\/+$/, "") ? null : suggested;
+}
+function pageProgress() {
+  let reported2 = false;
+  return {
+    advance: (fetched) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+    },
+    finish: () => {
+      if (reported2)
+        process.stderr.write("\r\x1B[K");
+    }
+  };
+}
 async function requestAllPages(client, path, options) {
   const { query, pageSize, limit: requestedLimit, ...requestOptions } = options;
   const limit = requestedLimit ?? Number.POSITIVE_INFINITY;
   if (limit <= 0)
     return [];
   const items = [];
+  const progress = pageProgress();
   let cursor = null;
-  do {
-    const page = await client.request(path, {
-      ...requestOptions,
-      query: {
-        ...query,
-        limit: Math.min(pageSize, limit - items.length),
-        cursor
-      }
-    });
-    items.push(...page.data);
-    cursor = page.nextCursor;
-  } while (cursor && items.length < limit);
+  try {
+    do {
+      const page = await client.request(path, {
+        ...requestOptions,
+        query: {
+          ...query,
+          limit: Math.min(pageSize, limit - items.length),
+          cursor
+        }
+      });
+      items.push(...page.data);
+      cursor = page.nextCursor;
+      if (cursor && items.length < limit)
+        progress.advance(items.length);
+    } while (cursor && items.length < limit);
+  } finally {
+    progress.finish();
+  }
   return items.slice(0, limit);
 }
 function resolvePath(template, params = {}) {
@@ -5894,7 +6136,7 @@ function duration(ms) {
   if (ms === null || ms === undefined)
     return EMPTY;
   if (ms < 1000)
-    return `${ms}ms`;
+    return `${Math.round(ms)}ms`;
   if (ms < 60000)
     return `${(ms / 1000).toFixed(1)}s`;
   return `${Math.floor(ms / 60000)}m${Math.round(ms % 60000 / 1000)}s`;
@@ -5914,17 +6156,18 @@ function oneLine(value) {
   return value.replace(/\s*[\r\n\t]+\s*/g, " ");
 }
 var MAX_CELL_WIDTH = 60;
-function clampCell(value) {
-  if (visibleWidth(value) <= MAX_CELL_WIDTH || value !== value.replace(ANSI_PATTERN, "")) {
+var MAX_RECORD_WIDTH = 160;
+function clamp(value, width) {
+  if (visibleWidth(value) <= width || value !== value.replace(ANSI_PATTERN, "")) {
     return value;
   }
-  return `${value.slice(0, MAX_CELL_WIDTH - 1)}…`;
+  return `${value.slice(0, width - 1)}…`;
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
     return source_default.dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
-  const cells = rows.map((row) => columns.map((column) => clampCell(oneLine(column.value(row)))));
+  const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
   const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
@@ -5970,13 +6213,10 @@ function printRecord(format, fields, raw) {
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${oneLine(value)}`);
+    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
-// src/program.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-
 // ../../node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6009,6 +6249,8 @@ function sleep(ms) {
 var PAIRING_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 var POLL_INTERVAL_MS = 2000;
 var POLL_TIMEOUT_MS = 15 * 60 * 1000;
+var APPROVAL_PATH = "/cli/auth";
+var POLL_PATH = "/api/cli/auth/poll";
 var RETRYABLE_POLL_STATUSES = new Set([409, 429, 500, 502, 503, 504]);
 function token() {
   return randomBytes(32).toString("base64url");
@@ -6027,14 +6269,30 @@ function createAuthRequest() {
   };
 }
 function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
-  const url = new URL("/cli/auth", endpoint);
-  url.searchParams.set("request", auth.request);
-  url.searchParams.set("challenge", auth.challenge);
-  url.searchParams.set("pairing", auth.pairing);
-  url.searchParams.set("scope", scope);
-  if (workspaceId)
-    url.searchParams.set("workspace", workspaceId);
-  return url.toString();
+  return buildUrl(endpoint, APPROVAL_PATH, {
+    request: auth.request,
+    challenge: auth.challenge,
+    pairing: auth.pairing,
+    scope,
+    workspace: workspaceId
+  });
+}
+function toRedirectError(endpoint, response) {
+  const location = response.headers.get("location")?.trim();
+  let target = null;
+  if (location) {
+    try {
+      target = new URL(location, endpoint);
+    } catch {
+      target = null;
+    }
+  }
+  if (!target) {
+    return new SimApiError(`${endpoint} answered the login poll with HTTP ${response.status} and no usable redirect target. Check the endpoint.`, response.status);
+  }
+  const refusal = `${endpoint} redirected the login poll to ${target.href}. The CLI does not follow redirects, because a redirect drops the request body and would carry the login secret to another origin.`;
+  const suggested = redirectEndpoint(endpoint, POLL_PATH, target);
+  return new SimApiError(suggested ? `${refusal} Re-run with --endpoint ${suggested}, or run: sim configure --set-endpoint ${suggested}` : refusal, response.status);
 }
 async function pollForKey(endpoint, auth, signal) {
   const deadline = Date.now() + POLL_TIMEOUT_MS;
@@ -6043,16 +6301,23 @@ async function pollForKey(endpoint, auth, signal) {
       throw new SimApiError("Login cancelled.", 0);
     let response = null;
     try {
-      response = await fetch(new URL("/api/cli/auth/poll", endpoint), {
+      response = await fetch(buildUrl(endpoint, POLL_PATH), {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json" },
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          "user-agent": USER_AGENT
+        },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
-        signal
+        signal,
+        redirect: "manual"
       });
     } catch {
       response = null;
     }
     if (response) {
+      if (REDIRECT_STATUSES.has(response.status))
+        throw toRedirectError(endpoint, response);
       const raw = await response.text();
       if (!response.ok) {
         if (!RETRYABLE_POLL_STATUSES.has(response.status)) {
@@ -6106,263 +6371,76 @@ function clientFrom(command) {
   return { client: new SimClient(profile), profile };
 }
 
-// src/commands/auth.ts
-function openBrowser(url) {
-  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
-  try {
-    const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-function presentAuthentication(source) {
-  switch (source) {
-    case "flag":
-      return { authenticated: true, source: "flag" };
-    case "env":
-      return { authenticated: true, source: "env" };
-    case "credentials":
-      return { authenticated: true, source: "credentials" };
-    case "unset":
-      return { authenticated: false, source: "unset" };
-    case "config":
-    case "default":
-      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
-  }
-}
-async function confirmProfileOverwrite(profileName) {
-  if (!process.stdin.isTTY) {
-    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
-  }
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
-    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-  } finally {
-    prompt.close();
-  }
-}
-function loginCommand() {
-  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
-    const profile = profileFrom(command);
-    if (options.scope !== "platform" && options.scope !== "copilot") {
-      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
-    }
-    const scope = options.scope;
-    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
-      const confirmed = await confirmProfileOverwrite(profile.name);
-      if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
-        return;
+// src/generated/v2-api.ts
+var V2_OPERATIONS = {
+  abortFileUpload: {
+    method: "DELETE",
+    path: "/api/v2/files/uploads/[uploadId]",
+    pathParams: ["uploadId"],
+    pathParamDocs: { uploadId: "Upload session identifier." },
+    responseMode: "json",
+    summary: "Abort File Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the upload session."
       }
     }
-    const auth = createAuthRequest();
-    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
-    console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
-`));
-    console.log(url);
-    if (options.browser)
-      openBrowser(url);
-    console.log(source_default.dim(`
-Waiting for approval…`));
-    const key = await pollForKey(profile.endpoint, auth);
-    if (key.scope !== scope) {
-      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+  },
+  abortKnowledgeDocumentUpload: {
+    method: "DELETE",
+    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
+    pathParams: ["id", "uploadId"],
+    pathParamDocs: {
+      id: "Unique knowledge base identifier.",
+      uploadId: "Upload session identifier returned when the upload was created."
+    },
+    responseMode: "json",
+    summary: "Abort Document Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      }
     }
-    writeCredentialsProfile(profile.name, key.apiKey);
-    const settings = {
-      endpoint: profile.endpoint,
-      workspace: key.workspaceId ?? null
-    };
-    writeConfigProfile(profile.name, settings);
-    console.log(source_default.green(`
-✓ Logged in. Key stored in ${credentialsPath()}`));
-    if (key.workspaceBound && key.workspaceId) {
-      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
-    } else if (key.workspaceId) {
-      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
-    } else {
-      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+  },
+  addTableColumn: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/columns",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Column",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
+      column: { kind: "object", required: true, describe: "Column definition to add." }
     }
-  });
-}
-function logoutCommand() {
-  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
-    const profile = profileFrom(command);
-    if (options.all) {
-      const removed = deleteProfile(profile.name);
-      if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
-        return;
-      }
-      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
-      return;
-    }
-    if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
-      return;
-    }
-    writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
-    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
-  });
-}
-function whoamiCommand() {
-  return new Command("whoami").description("Show the resolved profile and where each setting came from").action((_options, command) => {
-    const profile = profileFrom(command);
-    const { sources } = profile;
-    const authentication = presentAuthentication(sources.apiKey);
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
-    printRecord(profile.output, [
-      ["Profile", profile.name],
-      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
-      [
-        "API key",
-        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
-      ],
-      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
-      ["Output", annotate(profile.output, sources.output)]
-    ], {
-      profile: profile.name,
-      endpoint: profile.endpoint,
-      workspaceId: profile.workspaceId,
-      output: profile.output,
-      authenticated: authentication.authenticated,
-      sources: {
-        endpoint: sources.endpoint,
-        authentication: authentication.source,
-        workspaceId: sources.workspaceId,
-        output: sources.output
-      }
-    });
-  });
-}
-function profilesCommand() {
-  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      console.log(source_default.dim("No profiles yet. Run: sim login"));
-      return;
-    }
-    const active = profileFrom(command).name;
-    for (const name of profiles) {
-      const marker = name === active ? source_default.green("*") : " ";
-      const hasKey = Boolean(readCredentialsProfile(name).api_key);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
-    }
-  });
-}
-
-// src/commands/configure.ts
-function configureCommand() {
-  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
-    const profile = profileFrom(command);
-    const updates = {};
-    if (options.setEndpoint)
-      updates.endpoint = options.setEndpoint.replace(/\/+$/, "");
-    if (options.setWorkspace)
-      updates.workspace = options.setWorkspace;
-    if (options.setOutput) {
-      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
-        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
-      }
-      updates.output = options.setOutput;
-    }
-    for (const key of options.unset ?? []) {
-      if (!["endpoint", "workspace", "output"].includes(key)) {
-        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
-      }
-      updates[key] = null;
-    }
-    if (Object.keys(updates).length === 0) {
-      const current = readConfigProfile(profile.name);
-      if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
-        return;
-      }
-      for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
-      }
-      return;
-    }
-    writeConfigProfile(profile.name, updates);
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
-  });
-}
-
-// src/generated/v2-api.ts
-var V2_OPERATIONS = {
-  abortFileUpload: {
-    method: "DELETE",
-    path: "/api/v2/files/uploads/[uploadId]",
-    pathParams: ["uploadId"],
-    pathParamDocs: { uploadId: "Upload session identifier." },
-    responseMode: "json",
-    summary: "Abort File Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the upload session."
-      }
-    }
-  },
-  abortKnowledgeDocumentUpload: {
-    method: "DELETE",
-    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
-    pathParams: ["id", "uploadId"],
-    pathParamDocs: {
-      id: "Unique knowledge base identifier.",
-      uploadId: "Upload session identifier returned when the upload was created."
-    },
-    responseMode: "json",
-    summary: "Abort Document Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the knowledge base."
-      }
-    }
-  },
-  addTableColumn: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/columns",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Column",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
-      column: { kind: "object", required: true, describe: "Column definition to add." }
-    }
-  },
-  addWorkflowGroup: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/groups",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Workflow Group",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
-      group: {
-        kind: "object",
-        required: true,
-        describe: "Workflow or enrichment producer definition."
-      },
-      outputColumns: {
-        kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
-      },
-      autoRun: {
-        kind: "boolean",
-        default: false,
-        describe: "Whether to schedule existing rows after group creation."
+  },
+  addWorkflowGroup: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/groups",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Workflow Group",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
+      group: {
+        kind: "object",
+        required: true,
+        describe: "Workflow or enrichment producer definition."
+      },
+      outputColumns: {
+        kind: "array",
+        required: true,
+        describe: "Columns created for producer outputs."
+      },
+      autoRun: {
+        kind: "boolean",
+        default: false,
+        describe: "Whether to schedule existing rows after group creation."
       }
     }
   },
@@ -8968,6 +9046,10 @@ var V2_OPERATIONS = {
         kind: "string",
         required: true,
         describe: "Write-only secret value. It is never returned."
+      },
+      description: {
+        kind: "string",
+        describe: "What the secret is for, shown to teammates. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave an existing description untouched; send null or an empty string to clear one."
       }
     }
   },
@@ -9380,88 +9462,345 @@ var V2_OPERATIONS = {
   }
 };
 
-// src/runtime/request.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readSync } from "node:fs";
-
-// src/contract/commands.ts
-var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
-var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
-var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
-var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
-var FOLDER_PATH_INPUT = {
-  describe: "Folder path; the leading / is optional"
-};
-var FOLDER_PATH_FLAG = {
-  ...FOLDER_PATH_INPUT,
-  name: "folder"
-};
-var FOLDER_DELETE_FLAGS = {
-  path: FOLDER_PATH_INPUT,
-  recursive: { boolean: true, describe: "Delete the folder and its descendants" }
-};
-var KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS = { id: "knowledgeBaseId" };
-var WORKFLOW_RUN_SCOPE = {
-  id: {
-    name: "workflow",
-    placeholder: "workflowId",
-    describe: "Workflow ID"
+// src/commands/auth.ts
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function presentAuthentication(source) {
+  switch (source) {
+    case "flag":
+      return { authenticated: true, source: "flag" };
+    case "env":
+      return { authenticated: true, source: "env" };
+    case "credentials":
+      return { authenticated: true, source: "credentials" };
+    case "unset":
+      return { authenticated: false, source: "unset" };
+    case "config":
+    case "default":
+      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
   }
-};
-var FOLDER_LIST_COLUMNS = [
-  { header: "path" },
-  { header: "name" },
-  { header: "parent", path: "parentPath" },
-  { header: "updated", path: "updatedAt", format: "timestamp" }
-];
-function moveResource(command, resource) {
-  return {
-    command,
-    positionals: ["folderPath"],
-    requestFields: ["folderPath"],
-    describe: `Move a ${resource} to a folder`
-  };
 }
-var CLI_CONTRACT = {
-  createCredentialConnection: { hidden: true },
-  createServiceAccountCredential: { hidden: true },
-  getBillingStatus: {
-    command: "billing status",
-    allWorkspaces: true,
-    describe: "Show billing status and current-period credit usage",
-    fields: [
-      { header: "plan" },
-      { header: "status" },
-      { header: "workspace", path: "workspaceId" },
-      { header: "period start", path: "period.start", format: "timestamp" },
-      { header: "period end", path: "period.end", format: "timestamp" },
-      { header: "used credits", path: "credits.used" },
-      { header: "limit credits", path: "credits.limit" },
-      { header: "remaining credits", path: "credits.remaining" }
-    ]
-  },
-  listBillingLogs: {
-    command: "billing logs",
-    allWorkspaces: true,
-    describe: "List credit usage events",
-    flags: {
-      source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
-      period: { describe: "Billing period" },
-      startDate: { describe: "Custom period start (ISO 8601)" },
-      endDate: { describe: "Custom period end (ISO 8601)" }
-    },
-    columns: [
-      { header: "at", path: "createdAt", format: "timestamp" },
-      { header: "workspace", path: "workspaceId" },
-      { header: "source" },
-      { header: "workflow", path: "workflow.name" },
-      { header: "credits", path: "creditCost" },
-      { header: "run", path: "runId" },
-      { header: "id" }
-    ]
-  },
-  deleteTableRows: {
-    command: "tables rows batch-delete",
-    describe: "Delete rows matching a filter, or an explicit list of ids",
+async function confirmProfileOverwrite(profileName) {
+  if (!process.stdin.isTTY) {
+    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
+    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+  } finally {
+    prompt.close();
+  }
+}
+function loginCommand() {
+  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
+    const profile = profileFrom(command);
+    if (options.scope !== "platform" && options.scope !== "copilot") {
+      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
+    }
+    const scope = options.scope;
+    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
+      const confirmed = await confirmProfileOverwrite(profile.name);
+      if (!confirmed) {
+        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        return;
+      }
+    }
+    const auth = createAuthRequest();
+    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
+    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
+    console.log(`
+Pairing code: ${source_default.bold(auth.pairing)}`);
+    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+`));
+    console.log(url);
+    if (options.browser)
+      openBrowser(url);
+    console.log(source_default.dim(`
+Waiting for approval…`));
+    const key = await pollForKey(profile.endpoint, auth);
+    if (key.scope !== scope) {
+      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+    }
+    writeCredentialsProfile(profile.name, key.apiKey);
+    const settings = {
+      endpoint: profile.endpoint,
+      workspace: key.workspaceId ?? null
+    };
+    writeConfigProfile(profile.name, settings);
+    console.log(source_default.green(`
+✓ Logged in. Key stored in ${credentialsPath()}`));
+    if (key.workspaceBound && key.workspaceId) {
+      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+    } else if (key.workspaceId) {
+      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+    } else {
+      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+    }
+  });
+}
+function logoutCommand() {
+  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
+    const profile = profileFrom(command);
+    if (options.all) {
+      const removed = deleteProfile(profile.name);
+      if (!removed.config && !removed.credentials) {
+        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
+        return;
+      }
+      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
+      return;
+    }
+    if (!readCredentialsProfile(profile.name).api_key) {
+      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
+      return;
+    }
+    writeCredentialsProfile(profile.name, null);
+    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
+    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+  });
+}
+var CREDENTIAL_VERDICT_STATUSES = new Set([401, 403, 404]);
+var WHOAMI_EXIT_CODES = {
+  verified: 0,
+  disabled: 0,
+  unauthenticated: 1,
+  rejected: 1,
+  unreachable: 2,
+  "no-workspace": 2
+};
+async function verifyProfile(client, profile) {
+  if (!profile.apiKey) {
+    return {
+      status: "unauthenticated",
+      workspace: null,
+      detail: `no API key — run: sim login --profile ${profile.name}`
+    };
+  }
+  if (!profile.workspaceId) {
+    return {
+      status: "no-workspace",
+      workspace: null,
+      detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`
+    };
+  }
+  const operation = V2_OPERATIONS.getWorkspace;
+  try {
+    const response = await client.request(resolvePath(operation.path, { workspaceId: profile.workspaceId }), { method: operation.method });
+    const { id, name, memberCount } = response.data;
+    return { status: "verified", workspace: { id, name, memberCount }, detail: null };
+  } catch (error) {
+    if (!(error instanceof SimApiError))
+      throw error;
+    return {
+      status: CREDENTIAL_VERDICT_STATUSES.has(error.status) ? "rejected" : "unreachable",
+      workspace: null,
+      detail: error.message
+    };
+  }
+}
+function presentVerification(verification) {
+  if (verification.status === "verified") {
+    const { name, memberCount } = verification.workspace;
+    const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
+    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+  }
+  const detail = safeOneLine(verification.detail);
+  switch (verification.status) {
+    case "rejected":
+      return `${source_default.red("✗")} ${detail}`;
+    case "unauthenticated":
+      return source_default.yellow(`not logged in — ${detail}`);
+    case "disabled":
+      return source_default.dim(detail);
+    default:
+      return source_default.yellow(`could not check — ${detail}`);
+  }
+}
+function whoamiCommand() {
+  return new Command("whoami").description("Show the resolved profile, where each setting came from, and whether it works").option("--no-verify", "Skip the API check and only print the resolved settings").action(async (options, command) => {
+    const { client, profile } = clientFrom(command);
+    const { sources } = profile;
+    const authentication = presentAuthentication(sources.apiKey);
+    const verification = options.verify ? await verifyProfile(client, profile) : { status: "disabled", workspace: null, detail: "not checked (--no-verify)" };
+    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    printRecord(profile.output, [
+      ["Profile", profile.name],
+      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
+      [
+        "API key",
+        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
+      ],
+      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
+      ["Output", annotate(profile.output, sources.output)],
+      ["Verified", presentVerification(verification)]
+    ], {
+      profile: profile.name,
+      endpoint: profile.endpoint,
+      workspaceId: profile.workspaceId,
+      output: profile.output,
+      authenticated: authentication.authenticated,
+      sources: {
+        endpoint: sources.endpoint,
+        authentication: authentication.source,
+        workspaceId: sources.workspaceId,
+        output: sources.output
+      },
+      verification: {
+        status: verification.status,
+        workspace: verification.workspace,
+        detail: verification.detail
+      }
+    });
+    const exitCode = WHOAMI_EXIT_CODES[verification.status];
+    if (exitCode !== 0)
+      process.exitCode = exitCode;
+  });
+}
+function profilesCommand() {
+  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
+    const profiles = listProfiles();
+    if (profiles.length === 0) {
+      console.log(source_default.dim("No profiles yet. Run: sim login"));
+      return;
+    }
+    const active = profileFrom(command).name;
+    for (const name of profiles) {
+      const marker = name === active ? source_default.green("*") : " ";
+      const hasKey = Boolean(readCredentialsProfile(name).api_key);
+      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
+    }
+  });
+}
+
+// src/commands/configure.ts
+function configureCommand() {
+  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
+    const profile = profileFrom(command);
+    const updates = {};
+    if (options.setEndpoint) {
+      updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
+    }
+    if (options.setWorkspace)
+      updates.workspace = options.setWorkspace;
+    if (options.setOutput) {
+      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
+        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
+      }
+      updates.output = options.setOutput;
+    }
+    for (const key of options.unset ?? []) {
+      if (!["endpoint", "workspace", "output"].includes(key)) {
+        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
+      }
+      updates[key] = null;
+    }
+    if (Object.keys(updates).length === 0) {
+      const current = readConfigProfile(profile.name);
+      if (Object.keys(current).length === 0) {
+        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        return;
+      }
+      for (const [key, value] of Object.entries(current)) {
+        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+      }
+      return;
+    }
+    writeConfigProfile(profile.name, updates);
+    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+  });
+}
+
+// src/runtime/request.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
+
+// src/contract/commands.ts
+var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
+var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
+var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
+var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
+var FOLDER_PATH_INPUT = {
+  describe: "Folder path as shown in the app; the leading / is optional",
+  folderPath: true
+};
+var FOLDER_PATH_FLAG = {
+  ...FOLDER_PATH_INPUT,
+  name: "folder"
+};
+var FOLDER_DELETE_FLAGS = {
+  path: FOLDER_PATH_INPUT,
+  recursive: { boolean: true, describe: "Delete the folder and its descendants" }
+};
+var KNOWLEDGE_BASE_PATH_ARGUMENT = { id: "knowledgeBaseId" };
+var WORKFLOW_RUN_SCOPE = {
+  id: {
+    name: "workflow",
+    placeholder: "workflowId",
+    describe: "Workflow ID"
+  }
+};
+var FOLDER_COLUMN = { header: "folder", path: "folderPath", format: "folder-path" };
+var FOLDER_LIST_COLUMNS = [
+  { header: "path", format: "folder-path" },
+  { header: "name" },
+  { header: "parent", path: "parentPath", format: "folder-path" },
+  { header: "updated", path: "updatedAt", format: "timestamp" }
+];
+function moveResource(command, resource) {
+  return {
+    command,
+    positionals: ["folderPath"],
+    requestFields: ["folderPath"],
+    describe: `Move a ${resource} to a folder`
+  };
+}
+var CLI_CONTRACT = {
+  createCredentialConnection: { hidden: true },
+  createServiceAccountCredential: { hidden: true },
+  getBillingStatus: {
+    command: "billing status",
+    allWorkspaces: true,
+    describe: "Show billing status and current-period credit usage",
+    fields: [
+      { header: "plan" },
+      { header: "status" },
+      { header: "workspace", path: "workspaceId" },
+      { header: "period start", path: "period.start", format: "timestamp" },
+      { header: "period end", path: "period.end", format: "timestamp" },
+      { header: "used credits", path: "credits.used" },
+      { header: "limit credits", path: "credits.limit" },
+      { header: "remaining credits", path: "credits.remaining" }
+    ]
+  },
+  listBillingLogs: {
+    command: "billing logs",
+    allWorkspaces: true,
+    describe: "List credit usage events",
+    flags: {
+      source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
+      period: { describe: "Billing period" },
+      startDate: { describe: "Custom period start (ISO 8601)" },
+      endDate: { describe: "Custom period end (ISO 8601)" }
+    },
+    columns: [
+      { header: "at", path: "createdAt", format: "timestamp" },
+      { header: "workspace", path: "workspaceId" },
+      { header: "source" },
+      { header: "workflow", path: "workflow.name" },
+      { header: "credits", path: "creditCost" },
+      { header: "run", path: "runId" },
+      { header: "id" }
+    ]
+  },
+  deleteTableRows: {
+    command: "tables rows batch-delete",
+    describe: "Delete rows matching a filter, or an explicit list of ids",
     flags: {
       rowIds: { name: "row", list: true },
       filter: { json: true, describe: TABLE_FILTER_HELP }
@@ -9480,7 +9819,7 @@ var CLI_CONTRACT = {
   bulkUpdateKnowledgeDocuments: {
     command: "knowledge documents batch-update",
     describe: "Enable or disable every matching document",
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     flags: {
       documentIds: { name: "document", list: true },
       selectAll: { boolean: true, describe: "Apply to every document in the knowledge base" }
@@ -9490,6 +9829,11 @@ var CLI_CONTRACT = {
     command: "workflows undeploy",
     describe: "Take a workflow out of deployment"
   },
+  getWorkflowDeployment: {
+    command: "workflows deployment status",
+    renamedFrom: ["workflows deployment list"],
+    describe: "Show a workflow’s current deployment"
+  },
   setSecret: { hidden: true },
   deleteTable: { confirm: "This deletes the table and all of its rows." },
   deleteTableRow: { confirm: "This deletes the row." },
@@ -9499,7 +9843,7 @@ var CLI_CONTRACT = {
   },
   deleteKnowledgeBase: { confirm: "This deletes the knowledge base and every document in it." },
   deleteKnowledgeDocument: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
   },
   deleteFile: { confirm: "This archives the file." },
@@ -9529,7 +9873,10 @@ var CLI_CONTRACT = {
       workflowIds: { name: "workflow", list: true },
       folderPaths: { ...FOLDER_PATH_FLAG, list: true },
       triggers: { name: "trigger", list: true },
-      details: { describe: "Response detail level" },
+      details: {
+        requestDefault: "full",
+        describe: "Response detail level; full is requested by default to name each run’s workflow"
+      },
       includeTraceSpans: {
         boolean: true,
         describe: "Include trace spans in JSON or YAML output (implies full detail)"
@@ -9582,7 +9929,7 @@ var CLI_CONTRACT = {
     },
     itemsPath: "results",
     columns: [
-      { header: "score", path: "similarity" },
+      { header: "score", path: "similarity", format: "score" },
       { header: "document", path: "documentName" },
       { header: "chunk", path: "chunkIndex" },
       { header: "content" }
@@ -9656,7 +10003,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "rows", path: "rowCount" },
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
@@ -9666,7 +10013,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "deployed", path: "isDeployed", format: "bool" },
       { header: "runs", path: "runCount" },
       { header: "last run", path: "lastRunAt", format: "timestamp" }
@@ -9677,7 +10024,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "size", format: "bytes" },
       { header: "type" },
       { header: "uploaded by", path: "uploadedByEmail" },
@@ -9690,15 +10037,17 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "docs", path: "docCount" },
       { header: "tokens", path: "tokenCount" },
       { header: "model", path: "embeddingModel" }
     ]
   },
-  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS },
+  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  updateKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  listKnowledgeTags: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
   listKnowledgeDocuments: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     columns: [
       { header: "id" },
       { header: "filename" },
@@ -9742,12 +10091,24 @@ var CLI_CONTRACT = {
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
   },
+  listCredentialProviders: {
+    columns: [
+      { header: "type" },
+      { header: "service", path: "serviceId" },
+      { header: "provider", path: "providerId" },
+      { header: "name" },
+      { header: "family", path: "providerFamily" },
+      { header: "available", format: "bool" },
+      { header: "description" }
+    ]
+  },
   listSecrets: {
     columns: [
       { header: "name" },
       { header: "scope" },
       { header: "role" },
-      { header: "updated", path: "updatedAt", format: "timestamp" }
+      { header: "updated", path: "updatedAt", format: "timestamp" },
+      { header: "description" }
     ]
   },
   getWorkspace: {
@@ -9813,7 +10174,7 @@ var CLI_CONTRACT = {
       { header: "name" },
       { header: "size", format: "bytes" },
       { header: "type" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "uploaded by", path: "uploadedByEmail" },
       { header: "uploaded", path: "uploadedAt", format: "timestamp" },
       { header: "updated", path: "updatedAt", format: "timestamp" },
@@ -9840,6 +10201,11 @@ var CLI_CONTRACT = {
     command: "files rename",
     describe: "Rename a file"
   },
+  restoreFile: {
+    command: "files restore",
+    renamedFrom: ["files restore create"],
+    describe: "Restore an archived file"
+  },
   updateFileContent: {
     command: "files set-content",
     describe: "Replace a file’s contents",
@@ -9992,13 +10358,26 @@ var CLI_CONTRACT = {
     command: "tables rows find",
     describe: "Find rows matching a predicate",
     flags: {
-      q: { describe: "Value to find" },
+      q: { name: "query", renamedFrom: ["q"], describe: "Value to find" },
       predicate: { name: "filter", json: true, describe: TABLE_FILTER_HELP },
       sort: { json: true, describe: TABLE_SORT_HELP }
     },
     itemsPath: "matches",
     columns: [{ header: "ordinal" }, { header: "row", path: "rowId" }, { header: "column" }]
   },
+  queryRowsCount: {
+    command: "tables rows count",
+    renamedFrom: ["tables count create"],
+    describe: "Count rows matching a filter",
+    flags: {
+      predicate: {
+        name: "filter",
+        renamedFrom: ["predicate"],
+        json: true,
+        describe: TABLE_FILTER_HELP
+      }
+    }
+  },
   runTableColumn: {
     command: "tables columns run",
     describe: "Run a column’s workflow",
@@ -10216,7 +10595,7 @@ function readArgumentSource(raw, flagName) {
     }
   }
   try {
-    return { text: readFileSync2(path, "utf8"), from: ` (read from ${path})` };
+    return { text: readFileSync3(path, "utf8"), from: ` (read from ${path})` };
   } catch (error) {
     throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}`, 0);
   }
@@ -10251,6 +10630,26 @@ function readListValues(raw, flagName) {
     return trimmed;
   });
 }
+var PERCENT_ESCAPE = /%[0-9A-Fa-f]{2}/;
+var SUB_DELIMITERS = /[!'()*]/g;
+function encodeFolderPathSegment(name) {
+  if (name === ".")
+    return "%2E";
+  if (name === "..")
+    return "%2E%2E";
+  return encodeURIComponent(name).replace(SUB_DELIMITERS, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function encodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    if (!PERCENT_ESCAPE.test(segment))
+      return encodeFolderPathSegment(segment);
+    try {
+      return encodeFolderPathSegment(decodeURIComponent(segment));
+    } catch {
+      return encodeFolderPathSegment(segment);
+    }
+  }).join("/");
+}
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
@@ -10260,7 +10659,7 @@ function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName);
+    const values = readListValues(raw, flagName).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (takesJson(field, flag)) {
@@ -10285,6 +10684,8 @@ function coerce(raw, field, flag, flagName) {
   if (choices && !choices.includes(String(raw))) {
     throw new SimApiError(`--${flagName} must be one of: ${choices.join(", ")}`, 0);
   }
+  if (flag.folderPath && typeof raw === "string")
+    return encodeFolderPath(raw);
   return raw;
 }
 function asQueryValue(value) {
@@ -10325,7 +10726,8 @@ function buildRequest(operation, positional, flags, workspaceId) {
         continue;
       const flagName = flagNameFor(operation, field);
       const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true;
-      const raw = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const provided = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const raw = provided ?? flag.requestDefault;
       const value = coerce(raw ?? undefined, descriptor, flag, flagName);
       if (value === undefined) {
         if (descriptor.required) {
@@ -10498,6 +10900,15 @@ function countTraceSpans(value) {
 function at(row, path) {
   return path.split(".").reduce((value, key) => value && typeof value === "object" ? value[key] : undefined, row);
 }
+function decodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return segment;
+    }
+  }).join("/");
+}
 function renderCell(value, format, options = {}) {
   switch (format) {
     case "timestamp":
@@ -10510,8 +10921,12 @@ function renderCell(value, format, options = {}) {
       return bool2(value);
     case "cost":
       return typeof value === "number" ? `$${value.toFixed(4)}` : text(null);
+    case "score":
+      return typeof value === "number" ? value.toFixed(4) : text(null);
     case "count":
       return Array.isArray(value) ? String(value.length) : text(null);
+    case "folder-path":
+      return typeof value === "string" ? text(decodeFolderPath(value)) : text(value);
     case "trace-count": {
       const count = countTraceSpans(value);
       return `${count} ${count === 1 ? "span" : "spans"}${options.expandedTrace ? "" : " (use --trace)"}`;
@@ -10522,10 +10937,42 @@ function renderCell(value, format, options = {}) {
       return sanitize(typeof value === "object" ? JSON.stringify(value) : String(value));
   }
 }
-var NESTED_CELL_WIDTH = 160;
-function recordCell(value) {
-  const rendered = renderCell(value, "auto");
-  return rendered.length > NESTED_CELL_WIDTH ? `${rendered.slice(0, NESTED_CELL_WIDTH)}…` : rendered;
+var TIMESTAMP_KEY = /(?:At|Date)$/;
+var DURATION_KEY = /Ms$|^duration/;
+var BYTES_KEY = /^size$|(?:Size|Bytes)$/;
+var BOOL_KEY = /^(?:is|has)[A-Z]/;
+var RATIO_KEY = /^(?:similarity|score)$|(?:Similarity|Score)$/;
+var FOLDER_PATH_KEY = /^(?:path|parentPath|folderPath)$/;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
+var RATIO_PRECISION = 4;
+function inferFormat(key, value) {
+  if (typeof value === "boolean")
+    return BOOL_KEY.test(key) ? "bool" : null;
+  if (typeof value === "string") {
+    if (FOLDER_PATH_KEY.test(key))
+      return "folder-path";
+    return TIMESTAMP_KEY.test(key) && ISO_TIMESTAMP.test(value) && !Number.isNaN(Date.parse(value)) ? "timestamp" : null;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return null;
+  if (DURATION_KEY.test(key))
+    return "duration";
+  if (BYTES_KEY.test(key))
+    return "bytes";
+  return null;
+}
+function inferredCell(key, value) {
+  if (typeof value === "number" && Number.isFinite(value) && RATIO_KEY.test(key)) {
+    return value.toFixed(RATIO_PRECISION);
+  }
+  return renderCell(value, inferFormat(key, value) ?? "auto");
+}
+function humanizeKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function inferHeader(key, format) {
+  const trimmed = format === "duration" || format === "bytes" ? key.replace(/(?:Ms|Bytes)$/, "") : format === "bool" ? key.replace(/^is(?=[A-Z])/, "") : key;
+  return humanizeKey(trimmed || key);
 }
 function columnsFrom(specs) {
   return specs.map((spec) => ({
@@ -10534,9 +10981,9 @@ function columnsFrom(specs) {
   }));
 }
 function fieldsFrom(data, specs, options = {}) {
-  return specs.flatMap((spec) => {
+  return specs.map((spec) => {
     const value = at(data, spec.path ?? spec.header);
-    return value === undefined ? [] : [[spec.header, renderCell(value, spec.format, options)]];
+    return [spec.header, value === undefined ? text(null) : renderCell(value, spec.format, options)];
   });
 }
 function inferColumns(rows, expand) {
@@ -10551,7 +10998,7 @@ function inferColumns(rows, expand) {
       if (value !== null && typeof value === "object")
         continue;
       seen.add(key);
-      paths.push({ path: key, header: key });
+      paths.push({ path: key, key, header: inferHeader(key, inferFormat(key, value)), owned: true });
     }
   }
   if (expand) {
@@ -10564,13 +11011,18 @@ function inferColumns(rows, expand) {
         if (nested.has(key))
           continue;
         nested.add(key);
-        paths.push({ path: `${expand}.${key}`, header: seen.has(key) ? `${expand}.${key}` : key });
+        paths.push({
+          path: `${expand}.${key}`,
+          key,
+          header: seen.has(key) ? `${expand}.${key}` : key,
+          owned: false
+        });
       }
     }
   }
-  return paths.map(({ path, header }) => ({
+  return paths.map(({ path, key, header, owned }) => ({
     header: sanitize(header),
-    value: (row) => renderCell(at(row, path), "auto")
+    value: (row) => owned ? inferredCell(key, at(row, path)) : renderCell(at(row, path), "auto")
   }));
 }
 function unwrapResource(data) {
@@ -10603,7 +11055,10 @@ function renderResult(operation, format, raw, spec, options = {}) {
     printList(format, data, spec.columns ? columnsFrom(spec.columns) : inferColumns(data, spec.expand));
     return;
   }
-  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [key, recordCell(value)]) : [];
+  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [
+    inferHeader(key, inferFormat(key, value)),
+    inferredCell(key, value)
+  ]) : [];
   printRecord(format, fields, data);
   if (spec.expandedTrace && options.expandedTrace) {
     const traceSpans = at(data, "traceSpans");
@@ -10716,7 +11171,7 @@ function attachCredentialCommands(program2) {
 }
 
 // src/commands/protocol/files-get.ts
-import { once } from "node:events";
+import { once as once2 } from "node:events";
 import { createWriteStream } from "node:fs";
 import { link, lstat, mkdtemp, readlink, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
@@ -10731,6 +11186,9 @@ function printProtocolResult(format, result) {
 
 // src/commands/protocol/files-get.ts
 function writeFailure(path, error) {
+  if (isRequestTimeout(error)) {
+    return new SimApiError(`Downloading ${path} timed out. ${RAISE_TIMEOUT_HINT}`, 0);
+  }
   const code = error.code;
   if (code === "EEXIST") {
     return new SimApiError(`${path} already exists. Pass --force to overwrite it, or choose another output path.`, 0);
@@ -10821,7 +11279,7 @@ async function streamToStdout(body, output = process.stdout) {
       if (done)
         return;
       if (!output.write(value))
-        await once(output, "drain");
+        await once2(output, "drain");
     }
   } finally {
     reader.releaseLock();
@@ -11001,7 +11459,7 @@ async function finishUploadSession(client, workspaceId, session, path) {
 
 // src/commands/protocol/files-upload.ts
 function attachFileUpload(files) {
-  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Destination folder path (defaults to /)").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
+  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Folder path as shown in the app; defaults to the root folder").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const { name, size } = await localFile(path, options.name);
@@ -11012,7 +11470,7 @@ function attachFileUpload(files) {
         name,
         contentType: contentTypeFor(name),
         size,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       }
     });
     const { session, uploadToken, transfer } = created.data;
@@ -11071,13 +11529,285 @@ function attachKnowledgeDocumentUpload(documents) {
     if (!completed.document) {
       throw new Error(`Knowledge upload ${session.id} completed without a document`);
     }
-    printProtocolResult(profile.output, {
-      id: completed.document.id,
-      knowledgeBaseId: completed.document.knowledgeBaseId,
-      name: completed.document.filename,
-      size: completed.document.fileSize,
-      status: completed.document.processingStatus
-    });
+    printProtocolResult(profile.output, {
+      id: completed.document.id,
+      knowledgeBaseId: completed.document.knowledgeBaseId,
+      name: completed.document.filename,
+      size: completed.document.fileSize,
+      status: completed.document.processingStatus
+    });
+  });
+}
+
+// src/commands/protocol/logs-follow.ts
+var DEFAULT_BACKLOG = 10;
+var DEFAULT_INTERVAL_SECONDS = 3;
+var MIN_INTERVAL_SECONDS = 0.1;
+var MAX_BACKOFF_MS = 30000;
+var POLL_PAGE_SIZE = 100;
+var MAX_PAGES_PER_POLL = 10;
+var MAX_REMEMBERED_RUNS = 5000;
+var MAX_CELL_WIDTH2 = 60;
+var WAIT_SLICE_MS = 250;
+var RETRYABLE_CLIENT_STATUSES = new Set([408, 425, 429]);
+var ERASE_LINE = `${String.fromCharCode(27)}[K`;
+function collect(value, previous) {
+  return [...previous, value];
+}
+function at2(row, path) {
+  return path.split(".").reduce((value, key) => value && typeof value === "object" ? value[key] : undefined, row);
+}
+function renderCell2(value, format) {
+  switch (format) {
+    case "timestamp":
+      return timestamp2(value);
+    case "duration":
+      return duration(value);
+    case "bytes":
+      return bytes(value);
+    case "bool":
+      return bool2(value);
+    case "cost":
+      return typeof value === "number" ? `$${value.toFixed(4)}` : text(null);
+    default:
+      return text(typeof value === "object" && value !== null ? JSON.stringify(value) : value);
+  }
+}
+var COLUMNS = (CLI_CONTRACT.listLogs?.columns ?? []).map((spec) => ({
+  header: spec.header,
+  value: (row) => renderCell2(at2(row, spec.path ?? spec.header), spec.format)
+}));
+function oneLine2(value) {
+  return value.replace(/\s*[\r\n\t]+\s*/g, " ");
+}
+function pad2(value, width) {
+  return value + " ".repeat(Math.max(0, width - visibleWidth(value)));
+}
+function clamp2(value, width) {
+  if (visibleWidth(value) <= width || visibleWidth(value) !== value.length)
+    return value;
+  return `${value.slice(0, Math.max(1, width - 1))}…`;
+}
+function createTableWriter() {
+  let widths = null;
+  return (rows) => {
+    const lines = rows.map((row) => COLUMNS.map((column) => oneLine2(column.value(row))));
+    if (!widths) {
+      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
+      const header = widths;
+      console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
+    }
+    const locked = widths;
+    for (const line of lines) {
+      console.log(line.map((cell, index) => pad2(clamp2(cell, locked[index]), locked[index])).join("  ").trimEnd());
+    }
+  };
+}
+function createWriter(format) {
+  if (format === "json") {
+    return (rows) => {
+      for (const row of rows)
+        console.log(JSON.stringify(row));
+    };
+  }
+  if (format === "yaml") {
+    return (rows) => {
+      for (const row of rows) {
+        console.log(`---
+${dump(row, { lineWidth: 0, noRefs: true }).trimEnd()}`);
+      }
+    };
+  }
+  if (format === "text") {
+    return (rows) => {
+      if (rows.length > 0)
+        printList("text", rows, COLUMNS);
+    };
+  }
+  return createTableWriter();
+}
+function followStatus() {
+  let reported2 = false;
+  return {
+    note: (message) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(message)}${ERASE_LINE}`);
+    },
+    warn: (message) => {
+      if (reported2) {
+        reported2 = false;
+        process.stderr.write(`\r${ERASE_LINE}`);
+      }
+      process.stderr.write(`warning: ${message}
+`);
+    },
+    clear: () => {
+      if (!reported2)
+        return;
+      reported2 = false;
+      process.stderr.write(`\r${ERASE_LINE}`);
+    }
+  };
+}
+function watchForInterrupt() {
+  let stopped = false;
+  const stop = () => {
+    stopped = true;
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+  return {
+    interrupted: () => stopped,
+    dispose: () => {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+    }
+  };
+}
+async function waitFor(ms, interrupted) {
+  let remaining = ms;
+  while (remaining > 0 && !interrupted()) {
+    const step = Math.min(WAIT_SLICE_MS, remaining);
+    await sleep(step);
+    remaining -= step;
+  }
+}
+function isUnprinted(state, row) {
+  if (state.seen.has(row.runId))
+    return false;
+  return state.floor === null || row.startedAt >= state.floor;
+}
+function remember(state, rows) {
+  for (const row of rows)
+    state.seen.set(row.runId, row.startedAt);
+  let excess = state.seen.size - MAX_REMEMBERED_RUNS;
+  if (excess <= 0)
+    return;
+  for (const [runId, startedAt] of state.seen) {
+    if (excess <= 0)
+      break;
+    if (state.floor === null || startedAt > state.floor)
+      state.floor = startedAt;
+    state.seen.delete(runId);
+    excess -= 1;
+  }
+}
+async function collectUnprinted(client, path, query, state, pageSize, maxPages) {
+  const rows = [];
+  let cursor = null;
+  let truncated = false;
+  for (let page = 0;page < maxPages; page += 1) {
+    const response = await client.request(path, {
+      query: { ...query, limit: pageSize, cursor }
+    });
+    const page_rows = response?.data ?? [];
+    const unprinted = page_rows.filter((row) => isUnprinted(state, row));
+    rows.push(...unprinted);
+    cursor = response?.nextCursor ?? null;
+    if (!cursor || page_rows.length === 0 || unprinted.length < page_rows.length)
+      break;
+    if (page === maxPages - 1)
+      truncated = true;
+  }
+  return { rows, truncated };
+}
+function isTransient(error) {
+  if (!(error instanceof SimApiError))
+    return false;
+  if (error.status === 0 || error.status >= 500)
+    return true;
+  return RETRYABLE_CLIENT_STATUSES.has(error.status);
+}
+function nonNegativeInteger(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new SimApiError(`${flag} must be a non-negative integer`, 0);
+  }
+  return value;
+}
+function intervalMs(raw) {
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < MIN_INTERVAL_SECONDS) {
+    throw new SimApiError(`--interval must be at least ${MIN_INTERVAL_SECONDS} seconds`, 0);
+  }
+  return Math.round(seconds * 1000);
+}
+function inSeconds(ms) {
+  return Math.round(ms / 100) / 10;
+}
+function attachLogsFollow(logs) {
+  logs.command("follow").description("Watch runs as they arrive, printing each new run once").option("--workflow <id>", "Only follow runs of this workflow (repeatable)", collect, []).option("--folder <path>", "Only follow runs of workflows in this folder (repeatable)", collect, []).option("--trigger <type>", "Only follow runs with this trigger type (repeatable)", collect, []).addOption(new Option("--level <level>", "Only follow runs at this severity").choices([
+    ...V2_OPERATIONS.listLogs.query.level.values
+  ])).addOption(new Option("--details <level>", "Response detail level; full names each run’s workflow").choices([...V2_OPERATIONS.listLogs.query.details.values]).default("full")).option("-n, --lines <count>", "Recent runs to print before watching", String(DEFAULT_BACKLOG)).option("--interval <seconds>", "Seconds between polls", String(DEFAULT_INTERVAL_SECONDS)).addHelpText("after", `
+Each run prints once, when it is first seen, so its status is the status it had
+at that moment. With --output json every run is a JSON object on its own line
+(JSONL) rather than a member of an array, because a follow never ends and so can
+never close one; --output yaml emits a --- separated document stream. Progress
+and retries go to stderr, leaving stdout a clean stream of rows. Ctrl-C stops the
+follow.
+
+Examples:
+  $ sim logs follow --level error
+  $ sim logs follow --workflow wf_123 -n 0
+  $ sim --output json logs follow | jq -r '.runId'
+`).action(async (options, command) => {
+    const lines = nonNegativeInteger(options.lines, "--lines");
+    const delay = intervalMs(options.interval);
+    const { client, profile } = clientFrom(command);
+    const path = V2_OPERATIONS.listLogs.path;
+    const query = {
+      workspaceId: client.requireWorkspace(),
+      workflowIds: options.workflow?.length ? options.workflow.join(",") : undefined,
+      folderPaths: options.folder?.length ? options.folder.map(encodeFolderPath).join(",") : undefined,
+      triggers: options.trigger?.length ? options.trigger.join(",") : undefined,
+      level: options.level,
+      details: options.details,
+      order: "desc"
+    };
+    const write = createWriter(profile.output);
+    const status = followStatus();
+    const interrupt = watchForInterrupt();
+    const state = { seen: new Map, floor: null };
+    try {
+      const seed = await collectUnprinted(client, path, query, state, Math.max(lines, 1), 1);
+      remember(state, seed.rows);
+      state.floor = seed.rows.at(-1)?.startedAt ?? null;
+      if (seed.truncated && seed.rows.length < lines) {
+        status.warn(`asked for ${lines} earlier runs but a page holds ${seed.rows.length}; following from there — see sim logs list for more`);
+      }
+      write(lines > 0 ? seed.rows.slice(0, lines).reverse() : []);
+      let failures = 0;
+      while (!interrupt.interrupted()) {
+        await waitFor(failures === 0 ? delay : Math.min(delay * 2 ** failures, MAX_BACKOFF_MS), interrupt.interrupted);
+        if (interrupt.interrupted())
+          break;
+        let fresh;
+        try {
+          fresh = await collectUnprinted(client, path, query, state, POLL_PAGE_SIZE, MAX_PAGES_PER_POLL);
+        } catch (error) {
+          if (!isTransient(error))
+            throw error;
+          failures += 1;
+          const next = Math.min(delay * 2 ** failures, MAX_BACKOFF_MS);
+          status.note(`poll failed (${error.message}); retrying in ${inSeconds(next)}s…`);
+          continue;
+        }
+        failures = 0;
+        status.clear();
+        if (fresh.truncated) {
+          status.warn(`more than ${MAX_PAGES_PER_POLL * POLL_PAGE_SIZE} runs arrived at once; older ones were skipped — see sim logs list`);
+        }
+        if (fresh.rows.length === 0)
+          continue;
+        remember(state, fresh.rows);
+        write(fresh.rows.reverse());
+      }
+    } finally {
+      status.clear();
+      interrupt.dispose();
+    }
   });
 }
 
@@ -11114,15 +11844,22 @@ function addFieldOption(command, operation, field, descriptor) {
   const placeholder = takesList ? "<value...>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}`;
+  const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (choices && !takesList)
     option.choices([...choices]);
   if (descriptor.default !== undefined && field !== "limit") {
     option.default(undefined, String(descriptor.default));
   }
-  if (descriptor.required)
+  if (descriptor.required && renamedFrom.length === 0)
     option.makeOptionMandatory();
   command.addOption(option);
+  for (const previous of renamedFrom) {
+    const retired = new Option(`--${previous} ${placeholder}`).hideHelp();
+    if (choices && !takesList)
+      retired.choices([...choices]);
+    command.addOption(retired);
+  }
 }
 function addOperationOptions(command, operation, commandSpec, operationSpec) {
   for (const param of operationSpec.pathParams) {
@@ -11158,16 +11895,19 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     }
   }
   if (commandSpec.confirm) {
-    command.option("-y, --yes", "Skip the confirmation");
+    command.option("-y, --yes", "Confirm this destructive operation (required)");
   }
 }
 
 // src/commands/protocol/resource-directory.ts
-var COLUMNS = [
+var COLUMNS2 = [
   { header: "kind", value: (entry) => text(entry.kind) },
   { header: "name", value: (entry) => text(entry.name) },
-  { header: "ref", value: (entry) => text(entry.ref) },
-  { header: "folder", value: (entry) => text(entry.folderPath) },
+  {
+    header: "ref",
+    value: (entry) => text(entry.kind === "folder" ? decodeFolderPath(entry.ref) : entry.ref)
+  },
+  { header: "folder", value: (entry) => text(decodeFolderPath(entry.folderPath)) },
   { header: "updated", value: (entry) => timestamp2(entry.updatedAt) }
 ];
 function operationPath(operation) {
@@ -11218,7 +11958,7 @@ function attachResourceDirectoryCommands(group, config) {
       throw new SimApiError("--limit must be a non-negative integer", 0);
     }
     const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const folderPath = path ?? "/";
+    const folderPath = encodeFolderPath(path ?? "/");
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const [folders, resources] = await Promise.all([
@@ -11226,14 +11966,14 @@ function attachResourceDirectoryCommands(group, config) {
       listResources(client, config, workspaceId, folderPath, options.search, limit)
     ]);
     const entries = entriesFor(config, folders, resources);
-    printList(profile.output, entries.slice(0, limit), COLUMNS);
+    printList(profile.output, entries.slice(0, limit), COLUMNS2);
   });
   group.command("mkdir").argument("<path>", "Folder path to create; the leading / is optional").allowExcessArguments(false).description(`Create a ${config.kind} directory at a path`).action(async (path, _options, command) => {
     const { client, profile } = clientFrom(command);
     const operation = V2_OPERATIONS[config.createFolder];
     const result = await client.request(operation.path, {
       method: operation.method,
-      body: { workspaceId: client.requireWorkspace(), path }
+      body: { workspaceId: client.requireWorkspace(), path: encodeFolderPath(path) }
     });
     renderResult(config.createFolder, profile.output, result.data ?? result, {});
   });
@@ -11255,17 +11995,17 @@ function jsonFlag(raw, flagName, kind) {
 }
 async function watchImport(client, workspaceId, job) {
   let current = job;
-  let reported = -1;
+  let reported2 = -1;
   while (!IMPORT_SETTLED.has(current.status)) {
     await sleep2(IMPORT_POLL_MS);
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
-    if (process.stderr.isTTY && current.rowsProcessed !== reported) {
-      reported = current.rowsProcessed;
-      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported} rows`)}\x1B[K`);
+    if (process.stderr.isTTY && current.rowsProcessed !== reported2) {
+      reported2 = current.rowsProcessed;
+      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported2} rows`)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported >= 0)
+  if (process.stderr.isTTY && reported2 >= 0)
     process.stderr.write("\r\x1B[K");
   return current;
 }
@@ -11287,7 +12027,7 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
@@ -11312,7 +12052,7 @@ function attachTableImport(tables) {
       target = {
         type: "new",
         name,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       };
     }
     const started = await client.request(V2_OPERATIONS.createTableImport.path, {
@@ -11360,6 +12100,427 @@ function attachTableImport(tables) {
   });
 }
 
+// src/runtime/renamed.ts
+var warned = new Set;
+function warn(kind, from, to) {
+  const key = `${kind}:${from}`;
+  if (warned.has(key))
+    return;
+  warned.add(key);
+  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+`);
+}
+function warnRenamedCommand(from, to) {
+  warn("command", `sim ${from}`, `sim ${to}`);
+}
+function warnRenamedFlag(from, to) {
+  warn("flag", `--${from}`, `--${to}`);
+}
+
+// src/runtime/execute.ts
+function cursorSlot(operationSpec) {
+  if (operationSpec.query && "cursor" in operationSpec.query)
+    return "query";
+  if (operationSpec.body && "cursor" in operationSpec.body)
+    return "body";
+  return null;
+}
+function foldRenamedFlags(operation, commandSpec, flags) {
+  for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
+    if (!flag.renamedFrom?.length)
+      continue;
+    const current = flagNameFor(operation, field);
+    for (const previous of flag.renamedFrom) {
+      const supplied = flags[camel(previous)];
+      if (supplied === undefined)
+        continue;
+      if (flags[camel(current)] !== undefined) {
+        throw new SimApiError(`--${previous} is the former name of --${current}; pass one, not both`, 0);
+      }
+      warnRenamedFlag(previous, current);
+      flags[camel(current)] = supplied;
+    }
+  }
+}
+async function executeOperation(operation, commandSpec, operationSpec, invocation) {
+  const host = invocation[invocation.length - 1];
+  const inheritedFlags = host.optsWithGlobals();
+  const flags = {
+    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
+    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
+    ...invocation[invocation.length - 2]
+  };
+  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
+  const positional = invocation.slice(0, pathPositionalCount);
+  const requestFlags = { ...flags };
+  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
+    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
+  }
+  foldRenamedFlags(operation, commandSpec, requestFlags);
+  if (commandSpec.confirm && !requestFlags.yes) {
+    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
+  }
+  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
+    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
+  }
+  const { client, profile } = clientFrom(host);
+  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
+  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
+  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const paging = cursorSlot(operationSpec);
+  if (paging) {
+    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
+    if (Number.isNaN(rawLimit) || rawLimit < 0) {
+      throw new SimApiError("--limit must be a non-negative number", 0);
+    }
+    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
+    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
+    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
+    const rows = [];
+    const progress = pageProgress();
+    let cursor = null;
+    try {
+      do {
+        const page = await client.request(request.path, {
+          method: operationSpec.method,
+          query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
+          body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
+        });
+        rows.push(...page.data);
+        cursor = page.nextCursor;
+        if (cursor && rows.length < limit)
+          progress.advance(rows.length);
+      } while (cursor && rows.length < limit);
+    } finally {
+      progress.finish();
+    }
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
+    return;
+  }
+  const result = await client.request(request.path, {
+    method: operationSpec.method,
+    query: request.query,
+    body: request.body
+  });
+  renderResult(operation, profile.output, result?.data ?? result, commandSpec, {
+    expandedTrace: requestFlags.trace === true
+  });
+}
+
+// src/commands/protocol/workflow-run-follow.ts
+var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
+var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
+var DONE_SENTINEL = "[DONE]";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(frame, key) {
+  const value = frame[key];
+  return typeof value === "string" ? value : null;
+}
+async function* sseData(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
+`);
+      buffer = done ? "" : lines.pop() ?? "";
+      for (const rawLine of lines) {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        if (!line.startsWith("data:"))
+          continue;
+        const payload = line.slice(5).startsWith(" ") ? line.slice(6) : line.slice(5);
+        if (payload.length > 0)
+          yield payload;
+      }
+      if (done)
+        return;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+class Commentary {
+  sink;
+  atLineStart = true;
+  constructor(sink) {
+    this.sink = sink;
+  }
+  inline(text2) {
+    if (text2.length === 0)
+      return;
+    this.sink.write(text2);
+    this.atLineStart = text2.endsWith(`
+`);
+  }
+  line(text2) {
+    this.sink.write(`${this.atLineStart ? "" : `
+`}${text2}
+`);
+    this.atLineStart = true;
+  }
+  endLine() {
+    if (this.atLineStart)
+      return;
+    this.sink.write(`
+`);
+    this.atLineStart = true;
+  }
+}
+function toolNotice(frame) {
+  const name = safeOneLine(stringField(frame, "name") ?? "tool");
+  if (frame.phase === "start")
+    return source_default.dim(`→ ${name}`);
+  const status = stringField(frame, "status");
+  if (status && status !== "success")
+    return source_default.yellow(`✗ ${name} (${safeOneLine(status)})`);
+  return source_default.dim(`✓ ${name}`);
+}
+async function renderRunStream(body, options) {
+  const commentary = new Commentary(options.stderr);
+  let final = null;
+  for await (const payload of sseData(body)) {
+    let frame;
+    try {
+      frame = JSON.parse(payload);
+    } catch {
+      continue;
+    }
+    if (frame === DONE_SENTINEL)
+      break;
+    if (!isRecord(frame))
+      continue;
+    if (frame.event === undefined && typeof frame.chunk === "string") {
+      commentary.inline(sanitize(frame.chunk));
+      continue;
+    }
+    switch (frame.event) {
+      case "chunk_reset":
+        commentary.line(source_default.dim("… retracted; that turn resolved to tool calls"));
+        break;
+      case "thinking":
+        if (options.includeThinking && typeof frame.data === "string") {
+          commentary.inline(source_default.dim(sanitize(frame.data)));
+        }
+        break;
+      case "tool":
+        if (options.includeToolCalls)
+          commentary.line(toolNotice(frame));
+        break;
+      case "stream_error":
+        commentary.line(source_default.yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
+        break;
+      case "error":
+        commentary.endLine();
+        throw new SimApiError(safeOneLine(stringField(frame, "error") ?? "The workflow run failed."), 0);
+      case "final":
+        if (isRecord(frame.data))
+          final = frame.data;
+        break;
+      default:
+        break;
+    }
+  }
+  commentary.endLine();
+  if (!final) {
+    throw new SimApiError("The run stream ended before the workflow reported a result. The run may still be in progress — check: sim workflows runs list", 0);
+  }
+  return final;
+}
+async function followRun(workflowId, command) {
+  const flags = command.optsWithGlobals();
+  if (flags.async === true) {
+    throw new SimApiError("--follow streams a run as it happens and --async returns before it starts; pass one, not both", 0);
+  }
+  const includeThinking = flags.includeThinking === true;
+  const includeToolCalls = flags.includeToolCalls === true;
+  const negotiates = includeThinking || includeToolCalls;
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.executeWorkflow;
+  const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+  const response = await client.requestRaw(request.path, {
+    method: "POST",
+    query: request.query,
+    body: {
+      ...request.body ?? {},
+      stream: true,
+      ...includeThinking ? { includeThinking: true } : {},
+      ...includeToolCalls ? { includeToolCalls: true } : {}
+    },
+    headers: {
+      accept: "text/event-stream",
+      ...negotiates ? { [AGENT_STREAM_PROTOCOL_HEADER]: AGENT_STREAM_PROTOCOL_V1 } : {}
+    }
+  });
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("text/event-stream")) {
+    await response.body?.cancel();
+    throw new SimApiError(`${operation.path} answered ${contentType || "an unknown content type"} instead of an event stream. This deployment may predate streaming runs — re-run without --follow.`, response.status);
+  }
+  if (!response.body) {
+    throw new SimApiError("The run stream had no body.", response.status);
+  }
+  const final = await renderRunStream(response.body, {
+    includeThinking,
+    includeToolCalls,
+    stderr: process.stderr
+  });
+  renderResult("executeWorkflow", profile.output, final, CLI_CONTRACT.executeWorkflow ?? {});
+  if (final.success === false) {
+    throw new SimApiError(safeOneLine(typeof final.error === "string" ? final.error : "The workflow run failed."), 0);
+  }
+}
+function followOrDelegate(previous) {
+  return async (workflowId, _options, command) => {
+    const flags = command.optsWithGlobals();
+    if (flags.follow !== true) {
+      if (flags.includeThinking === true || flags.includeToolCalls === true) {
+        throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
+      }
+      if (previous) {
+        await previous(command.processedArgs);
+        return;
+      }
+      await executeOperation("executeWorkflow", CLI_CONTRACT.executeWorkflow ?? {}, V2_OPERATIONS.executeWorkflow, [workflowId, command.opts(), command]);
+      return;
+    }
+    await followRun(workflowId, command);
+  };
+}
+function attachWorkflowRunFollow(workflows) {
+  const run = workflows.commands.find((command) => command.name() === "run");
+  if (!run) {
+    throw new Error("workflows run must be registered before --follow can be attached to it");
+  }
+  const held = run._actionHandler;
+  const previous = typeof held === "function" ? held : null;
+  run.option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+}
+
+// src/commands/protocol/workflow-run-wait.ts
+var TERMINAL_STATUSES = new Set(["completed", "failed", "cancelled"]);
+var WAIT_EXIT_CODES = {
+  completed: 0,
+  failed: 1,
+  cancelled: 2,
+  paused: 3,
+  timeout: 4
+};
+var FIRST_POLL_DELAY_MS = 2000;
+var MAX_POLL_DELAY_MS = 15000;
+var POLL_BACKOFF_FACTOR = 2;
+var DEFAULT_WAIT_TIMEOUT_SECONDS = 3600;
+var WAIT_TIMEOUT_FLAG = "--wait-timeout <seconds>";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalString(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function readRun(raw) {
+  const run = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  if (!isRecord2(run) || typeof run.status !== "string") {
+    throw new SimApiError("Run status response carried no status.", 0);
+  }
+  const paused = isRecord2(run.paused) ? run.paused : null;
+  return {
+    status: run.status,
+    pauseKind: paused ? optionalString(paused.pauseKind) : null,
+    resumeAt: paused ? optionalString(paused.resumeAt) : null,
+    contextId: paused ? optionalString(paused.contextId) : null
+  };
+}
+function classify(snapshot) {
+  if (snapshot.status === "paused")
+    return snapshot.pauseKind === "time" ? null : "paused";
+  if (!TERMINAL_STATUSES.has(snapshot.status))
+    return null;
+  return snapshot.status === "completed" ? "completed" : snapshot.status === "cancelled" ? "cancelled" : "failed";
+}
+function waitProgress() {
+  let reported2 = false;
+  return {
+    advance: (status, elapsedMs) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
+    },
+    finish: () => {
+      if (!reported2)
+        return;
+      reported2 = false;
+      process.stderr.write("\r\x1B[K");
+    }
+  };
+}
+function parseWaitTimeout(raw) {
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new SimApiError(`Invalid ${WAIT_TIMEOUT_FLAG} "${raw}". Use a non-negative number of seconds, or 0 to wait indefinitely.`, 0);
+  }
+  return seconds;
+}
+function explain(outcome, runId, workflowId, snapshot) {
+  if (outcome === "completed")
+    return null;
+  if (outcome === "failed")
+    return `Run ${runId} failed.`;
+  if (outcome === "cancelled")
+    return `Run ${runId} was cancelled.`;
+  const context = snapshot.contextId ? ` --context ${snapshot.contextId}` : "";
+  return `Run ${runId} is paused waiting for input. Resume it: sim workflows runs resume ${runId} --workflow ${workflowId}${context}`;
+}
+function runSpec() {
+  return CLI_CONTRACT.getWorkflowRun ?? {};
+}
+function attachWorkflowRunWait(runs) {
+  runs.command("wait").argument("<runId>", V2_OPERATIONS.getWorkflowRun.pathParamDocs?.runId).description("Wait for a run to reach a terminal state, then show it").addOption(new Option("--workflow <workflowId>", "Workflow ID (required)").makeOptionMandatory()).addOption(new Option(WAIT_TIMEOUT_FLAG, `Give up after this many seconds, or 0 to wait indefinitely (default: ${DEFAULT_WAIT_TIMEOUT_SECONDS}). Bounds the whole wait; SIM_TIMEOUT_SECONDS bounds one request`)).action(async (runId, options, command) => {
+    const timeoutSeconds = options.waitTimeout === undefined ? DEFAULT_WAIT_TIMEOUT_SECONDS : parseWaitTimeout(options.waitTimeout);
+    const { client, profile } = clientFrom(command);
+    const operation = V2_OPERATIONS.getWorkflowRun;
+    const path = resolvePath(operation.path, { id: options.workflow, runId });
+    const startedAt = Date.now();
+    const deadline = timeoutSeconds === 0 ? Number.POSITIVE_INFINITY : startedAt + timeoutSeconds * 1000;
+    const progress = waitProgress();
+    let delayMs = FIRST_POLL_DELAY_MS;
+    try {
+      while (true) {
+        const raw = await client.request(path, { method: operation.method });
+        const snapshot = readRun(raw);
+        const outcome = classify(snapshot);
+        if (outcome) {
+          progress.finish();
+          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          const message = explain(outcome, runId, options.workflow, snapshot);
+          if (message)
+            console.error(source_default.red(message));
+          process.exitCode = WAIT_EXIT_CODES[outcome];
+          return;
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+          progress.finish();
+          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          console.error(source_default.red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
+          process.exitCode = WAIT_EXIT_CODES.timeout;
+          return;
+        }
+        progress.advance(snapshot.status, Date.now() - startedAt);
+        await sleep(Math.min(delayMs, remainingMs));
+        delayMs = Math.min(delayMs * POLL_BACKOFF_FACTOR, MAX_POLL_DELAY_MS);
+      }
+    } finally {
+      progress.finish();
+    }
+  });
+}
+
 // src/commands/protocol/index.ts
 function group(program2, name) {
   const existing = program2.commands.find((command) => command.name() === name);
@@ -11395,12 +12556,16 @@ function attachProtocolCommands(program2) {
     folders: "listTableFolders",
     createFolder: "createTableFolder"
   });
-  attachResourceDirectoryCommands(group(program2, "workflows"), {
+  const workflows = group(program2, "workflows");
+  attachResourceDirectoryCommands(workflows, {
     kind: "workflow",
     resources: "listWorkflows",
     folders: "listWorkflowFolders",
     createFolder: "createWorkflowFolder"
   });
+  attachWorkflowRunFollow(workflows);
+  attachWorkflowRunWait(group(workflows, "runs"));
+  attachLogsFollow(group(program2, "logs"));
 }
 
 // src/terminal/secret-input.ts
@@ -11481,7 +12646,8 @@ var SECRET_RESULT = {
     { header: "name" },
     { header: "scope" },
     { header: "role" },
-    { header: "updated", path: "updatedAt", format: "timestamp" }
+    { header: "updated", path: "updatedAt", format: "timestamp" },
+    { header: "description" }
   ]
 };
 function validateSecretValue(value) {
@@ -11492,7 +12658,16 @@ function validateSecretValue(value) {
   }
   return value;
 }
+function validateDescriptionScope(description, scope) {
+  if (description === undefined)
+    return;
+  if (scope === "personal") {
+    throw new SimApiError("--description is only supported for a workspace secret.", 0);
+  }
+  return description;
+}
 async function setSecret(name, options, command) {
+  const description = validateDescriptionScope(options.description, options.scope);
   const value = validateSecretValue(options.value ?? await promptSecret());
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.setSecret;
@@ -11501,7 +12676,8 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value
+      value,
+      description
     }
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
@@ -11510,72 +12686,7 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").action((name, options, command) => setSecret(name, options, command));
-}
-
-// src/runtime/execute.ts
-function cursorSlot(operationSpec) {
-  if (operationSpec.query && "cursor" in operationSpec.query)
-    return "query";
-  if (operationSpec.body && "cursor" in operationSpec.body)
-    return "body";
-  return null;
-}
-async function executeOperation(operation, commandSpec, operationSpec, invocation) {
-  const host = invocation[invocation.length - 1];
-  const inheritedFlags = host.optsWithGlobals();
-  const flags = {
-    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
-    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
-    ...invocation[invocation.length - 2]
-  };
-  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
-  const positional = invocation.slice(0, pathPositionalCount);
-  const requestFlags = { ...flags };
-  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
-    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
-  }
-  if (commandSpec.confirm && !requestFlags.yes) {
-    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
-  }
-  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
-    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
-  }
-  const { client, profile } = clientFrom(host);
-  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
-  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
-  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
-  const paging = cursorSlot(operationSpec);
-  if (paging) {
-    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
-    if (Number.isNaN(rawLimit) || rawLimit < 0) {
-      throw new SimApiError("--limit must be a non-negative number", 0);
-    }
-    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
-    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
-    const rows = [];
-    let cursor = null;
-    do {
-      const page = await client.request(request.path, {
-        method: operationSpec.method,
-        query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
-        body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
-      });
-      rows.push(...page.data);
-      cursor = page.nextCursor;
-    } while (cursor && rows.length < limit);
-    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
-    return;
-  }
-  const result = await client.request(request.path, {
-    method: operationSpec.method,
-    query: request.query,
-    body: request.body
-  });
-  renderResult(operation, profile.output, result?.data ?? result, commandSpec, {
-    expandedTrace: requestFlags.trace === true
-  });
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").action((name, options, command) => setSecret(name, options, command));
 }
 
 // src/runtime/build.ts
@@ -11693,6 +12804,19 @@ function configureOperation(command, operation, spec) {
 function buildLeaf(operation, spec, leafName) {
   return addMissingArgumentExample(configureOperation(new Command(leafName), operation, spec));
 }
+function addRenamedCommand(groups, operation, spec, from, to) {
+  const segments = from.split(" ");
+  const [groupName, ...rest] = segments;
+  if (rest.length === 0)
+    throw new Error(`${operation}.renamedFrom "${from}" must include a verb`);
+  let parent = groupFor(groups, groupName);
+  for (const segment of rest.slice(0, -1)) {
+    parent = nestedGroup(parent, segment, { hidden: true });
+  }
+  const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
+  leaf.hook("preAction", () => warnRenamedCommand(from, to));
+  parent.addCommand(leaf, { hidden: true });
+}
 function groupFor(groups, name) {
   const existing = groups.get(name);
   if (existing)
@@ -11708,12 +12832,12 @@ function resourceLabel(name) {
   const label = name.endsWith("s") ? name.slice(0, -1) : name;
   return label.replaceAll("-", " ");
 }
-function nestedGroup(parent, name) {
+function nestedGroup(parent, name, options = {}) {
   const existing = parent.commands.find((candidate) => candidate.name() === name);
   if (existing)
     return existing;
   const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
-  parent.addCommand(created);
+  parent.addCommand(created, { hidden: options.hidden });
   return created;
 }
 function addLeafCommand(groups, operation, spec, segments) {
@@ -11742,6 +12866,7 @@ function variantCommandSpec(spec, variant) {
 }
 function buildGeneratedCommands() {
   const groups = new Map;
+  const renamed = [];
   for (const operation of Object.keys(V2_OPERATIONS)) {
     const spec = CLI_CONTRACT[operation] ?? {};
     const operationSpec = V2_OPERATIONS[operation];
@@ -11764,6 +12889,12 @@ function buildGeneratedCommands() {
     for (const variant of spec.variants ?? []) {
       addLeafCommand(groups, operation, variantCommandSpec(spec, variant), variant.command.split(" "));
     }
+    for (const from of spec.renamedFrom ?? []) {
+      renamed.push({ operation, spec, from, to: segments.join(" ") });
+    }
+  }
+  for (const { operation, spec, from, to } of renamed) {
+    addRenamedCommand(groups, operation, spec, from, to);
   }
   return [...groups.values()].sort((a, b) => a.name().localeCompare(b.name()));
 }
@@ -11772,7 +12903,8 @@ function buildGeneratedCommands() {
 var PROGRAM_DESCRIPTION = "Talk to the Sim API from your terminal";
 var HELP_EPILOGUE = `
 Profiles work like the AWS CLI: settings live in ~/.sim/config, keys in
-~/.sim/credentials (0600). Select one with -P, --profile, or SIM_PROFILE.
+~/.sim/credentials (0600), or under SIM_CONFIG_DIR when it is set. Select one
+with -P, --profile, or SIM_PROFILE.
 
 Examples:
   $ sim login                                    Authorize the default profile
@@ -11786,18 +12918,11 @@ Examples:
   $ sim workflows import --workflow @wf.json
   $ sim whoami --profile dev
 `;
-function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
-}
 function buildProgram(options = {}) {
   const program2 = new Command;
   program2.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
-    program2.version(readPackageVersion());
+    program2.version(CLI_VERSION);
   program2.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
   program2.addCommand(loginCommand());
   program2.addCommand(logoutCommand());
@@ -11823,6 +12948,10 @@ async function main() {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       process.exit(1);
     }
+    if (isRequestTimeout(error)) {
+      console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+      process.exit(1);
+    }
     if (error instanceof SimApiError) {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       if (error.code)