sim 2.0.0 → 2.1.0-dev.28.1

package/dist/index.js

@@ -2403,7 +2403,7 @@ function removeSection(doc, name) {
 
 // src/config/profile.ts
 var DEFAULT_PROFILE = "default";
-var DEFAULT_ENDPOINT = "https://sim.ai";
+var DEFAULT_ENDPOINT = "https://www.sim.ai";
 var OUTPUT_FORMATS = ["table", "json", "yaml", "text"];
 
 class ProfileConfigError extends Error {
@@ -2466,8 +2466,18 @@ function deleteProfile(profile) {
     writeIni(credentialsPath(), credentialsDoc, true);
   return { config, credentials };
 }
-function normalizeEndpoint(endpoint) {
-  return endpoint.replace(/\/+$/, "");
+function normalizeEndpoint(endpoint, source) {
+  const trimmed = endpoint.replace(/\/+$/, "");
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new ProfileConfigError(`Invalid endpoint "${endpoint}" from ${source}. Use an absolute URL, e.g. ${DEFAULT_ENDPOINT} or http://localhost:3000`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new ProfileConfigError(`Unsupported endpoint scheme "${parsed.protocol.replace(/:$/, "")}" from ${source}. Use http or https, e.g. ${DEFAULT_ENDPOINT}`);
+  }
+  return trimmed;
 }
 function resolve(candidates, fallback, fallbackSource) {
   for (const [source, value] of candidates) {
@@ -2505,7 +2515,7 @@ function resolveProfile(overrides = {}) {
   }
   return {
     name,
-    endpoint: normalizeEndpoint(endpoint.value),
+    endpoint: normalizeEndpoint(endpoint.value, endpoint.source),
     apiKey: apiKey.value,
     workspaceId: workspaceId.value,
     output: output.value,
@@ -2517,6 +2527,65 @@ function resolveProfile(overrides = {}) {
     }
   };
 }
+// src/version.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+function readPackageVersion() {
+  const metadata = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
+    throw new Error("CLI package metadata is missing a valid version");
+  }
+  return metadata.version;
+}
+var CLI_VERSION = readPackageVersion();
+var USER_AGENT = `sim-cli/${CLI_VERSION} node/${process.versions.node} (${process.platform}; ${process.arch})`;
+
+// src/http/environment.ts
+var reported = new Set;
+function once(key, message) {
+  if (reported.has(key))
+    return;
+  reported.add(key);
+  process.stderr.write(`warning: ${message}
+`);
+}
+var PROXY_VARIABLES = ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy"];
+var PROXY_SUPPORT = { 22: 21, 24: 5 };
+var FIRST_SUPPORTED_MAJOR = 24;
+function runtimeCanProxy(version) {
+  const [major, minor] = version.replace(/^v/, "").split(".").map(Number);
+  if (!Number.isFinite(major) || !Number.isFinite(minor))
+    return false;
+  const firstSupportedMinor = PROXY_SUPPORT[major];
+  if (firstSupportedMinor !== undefined)
+    return minor >= firstSupportedMinor;
+  return major > FIRST_SUPPORTED_MAJOR;
+}
+function warnIfProxyIgnored(env2 = process.env, version = process.version) {
+  const variable = PROXY_VARIABLES.find((name) => env2[name]);
+  if (!variable)
+    return;
+  if (env2.NODE_USE_ENV_PROXY && runtimeCanProxy(version))
+    return;
+  once("proxy", runtimeCanProxy(version) ? `${variable} is set but Node only uses it when NODE_USE_ENV_PROXY=1. Re-run with NODE_USE_ENV_PROXY=1 to route through the proxy.` : `${variable} is set but Node ${version} cannot use it. Upgrade to Node 22.21 or 24.5 and set NODE_USE_ENV_PROXY=1 to route through the proxy.`);
+}
+var LOOPBACK = new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
+function isLoopback(hostname) {
+  return LOOPBACK.has(hostname) || hostname.endsWith(".localhost");
+}
+function warnIfKeyOverCleartext(endpoint, hasApiKey) {
+  if (!hasApiKey)
+    return;
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    return;
+  }
+  if (url.protocol !== "http:" || isLoopback(url.hostname))
+    return;
+  once("cleartext", `sending your API key to ${url.host} over http. Anything on the path can read it — use https unless this network is trusted.`);
+}
+
 // src/http/client.ts
 class SimApiError extends Error {
   status;
@@ -2539,13 +2608,28 @@ function buildUrl(endpoint, path, query) {
   }
   return url.toString();
 }
-function toApiError(status, raw) {
+var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+var MARKUP_PREFIX = /^\s*<(?:!doctype|html|\?xml)/i;
+var KEY_SCOPE_REFUSALS = new Set([
+  "WORKSPACE_KEY_OPERATION_NOT_PERMITTED",
+  "PRINCIPAL_KIND_NOT_PERMITTED"
+]);
+function toNonJsonError(url, status, contentType, raw) {
+  const type = contentType?.split(";")[0]?.trim().toLowerCase();
+  const isMarkup = type === "text/html" || type === "application/xhtml+xml" || MARKUP_PREFIX.test(raw);
+  const kind = isMarkup ? "HTML" : type && type !== "application/json" ? type : "a non-JSON response";
+  const text = raw.trim();
+  const keepSnippet = !isMarkup && text.length > 0 && text.length <= 200;
+  return new SimApiError(`${url} returned ${kind}, not JSON (HTTP ${status}) — check your endpoint.${keepSnippet ? ` Response: ${truncate(text, 200)}` : ""}`, status);
+}
+function toApiError(url, status, contentType, raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    const text = raw.trim();
-    return new SimApiError(text ? truncate(text, 300) : `Request failed with status ${status}`, status);
+    if (!raw.trim())
+      return new SimApiError(`Request failed with status ${status}`, status);
+    return toNonJsonError(url, status, contentType, raw);
   }
   const body = parsed;
   if (body.error && typeof body.error === "object") {
@@ -2561,8 +2645,79 @@ function toApiError(status, raw) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…`;
 }
+function namesKeyScopeRefusal(error) {
+  if (typeof error.code === "string" && KEY_SCOPE_REFUSALS.has(error.code))
+    return true;
+  const details = error.details;
+  if (!details || typeof details !== "object")
+    return false;
+  const code = details.code;
+  return typeof code === "string" && KEY_SCOPE_REFUSALS.has(code);
+}
+function isStrictPrefix(path, other) {
+  if (path.length >= other.length)
+    return false;
+  return path.every((segment, index) => segment === other[index]);
+}
+function rejectsAKeyThatValidated(issue, other) {
+  if (!issue.unrecognizedKeys || !isStrictPrefix(issue.path, other.path))
+    return false;
+  return issue.unrecognizedKeys.includes(other.path[issue.path.length]);
+}
+function dropUnionBranchNoise(issues) {
+  if (issues.length < 2)
+    return issues;
+  const kept = issues.filter((issue) => !issues.some((other) => rejectsAKeyThatValidated(issue, other)));
+  return kept.length > 0 ? kept : issues;
+}
+var DEFAULT_TIMEOUT_SECONDS = 3600;
+var MAX_TIMEOUT_MS = 2 ** 31 - 1;
+var RAISE_TIMEOUT_HINT = "Raise SIM_TIMEOUT_SECONDS, or set it to 0 to wait indefinitely.";
+function isRequestTimeout(error) {
+  return error instanceof DOMException && error.name === "TimeoutError";
+}
+function resolveTimeoutMs(env2 = process.env) {
+  const raw = env2.SIM_TIMEOUT_SECONDS;
+  if (raw === undefined || raw.trim() === "")
+    return DEFAULT_TIMEOUT_SECONDS * 1000;
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new SimApiError(`Invalid SIM_TIMEOUT_SECONDS "${raw}". Use a non-negative number of seconds, or 0 to disable.`, 0);
+  }
+  const ms = seconds === 0 ? 0 : Math.max(1, Math.round(seconds * 1000));
+  if (ms > MAX_TIMEOUT_MS) {
+    throw new SimApiError(`SIM_TIMEOUT_SECONDS "${raw}" is longer than Node can wait (${Math.floor(MAX_TIMEOUT_MS / 1000)}s). Use 0 to wait indefinitely.`, 0);
+  }
+  return ms;
+}
+function combineSignals(caller, timeout) {
+  if (!caller)
+    return timeout;
+  if (!timeout)
+    return caller;
+  if (typeof AbortSignal.any === "function")
+    return AbortSignal.any([caller, timeout]);
+  const controller = new AbortController;
+  for (const signal of [caller, timeout]) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      break;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), { once: true });
+  }
+  return controller.signal;
+}
+function debugEnabled(env2 = process.env) {
+  const raw = env2.SIM_DEBUG;
+  return raw !== undefined && raw !== "" && raw !== "0" && raw.toLowerCase() !== "false";
+}
+function traceRequest(method, url, status, startedAt) {
+  process.stderr.write(`${source_default.dim(`[sim] ${method} ${url} → ${status} ${Math.round(performance.now() - startedAt)}ms`)}
+`);
+}
 function formatApiErrorDetails(details) {
-  const issues = new Set;
+  const issues = [];
+  const seen = new Set;
   const visit = (value, parentPath = []) => {
     if (Array.isArray(value)) {
       value.forEach((item) => visit(item, parentPath));
@@ -2580,15 +2735,27 @@ function formatApiErrorDetails(details) {
     }
     if (typeof issue.message !== "string" || issue.message === "Invalid input")
       return;
-    issues.add(`${path.length > 0 ? path.join(".") : "request"}: ${issue.message}`);
+    const line = `${path.join(".")}: ${issue.message}`;
+    if (seen.has(line))
+      return;
+    seen.add(line);
+    issues.push({
+      path,
+      message: issue.message,
+      unrecognizedKeys: issue.code === "unrecognized_keys" && Array.isArray(issue.keys) ? issue.keys.map(String) : null
+    });
   };
   visit(details);
-  if (issues.size === 0)
+  if (issues.length === 0)
     return [`  details: ${truncate(JSON.stringify(details), 1000)}`];
-  const visible = [...issues].slice(0, 8);
-  const lines = ["  details:", ...visible.map((issue) => `    ${issue}`)];
-  if (issues.size > visible.length)
-    lines.push(`    … ${issues.size - visible.length} more issues`);
+  const kept = dropUnionBranchNoise(issues);
+  const visible = kept.slice(0, 8);
+  const lines = [
+    "  details:",
+    ...visible.map((issue) => `    ${issue.path.length > 0 ? issue.path.join(".") : "request"}: ${issue.message}`)
+  ];
+  if (kept.length > visible.length)
+    lines.push(`    … ${kept.length - visible.length} more issues`);
   return lines;
 }
 
@@ -2614,65 +2781,140 @@ class SimClient {
     return workspaceId;
   }
   async requestRaw(path, options = {}) {
+    return (await this.send(path, options)).response;
+  }
+  async request(path, options = {}) {
+    const { response, url } = await this.send(path, options);
+    const raw = await response.text();
+    if (!raw)
+      return;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      throw toNonJsonError(url, response.status, response.headers.get("content-type"), raw);
+    }
+  }
+  async send(path, options) {
     const apiKey = this.resolveApiKey(options.auth);
     const url = buildUrl(this.profile.endpoint, path, options.query);
     const hasBody = options.body !== undefined;
+    const method = options.method ?? "GET";
+    warnIfProxyIgnored();
+    warnIfKeyOverCleartext(this.profile.endpoint, Boolean(apiKey));
+    const timeoutMs = resolveTimeoutMs();
+    const timeout = timeoutMs > 0 ? AbortSignal.timeout(timeoutMs) : undefined;
+    const signal = combineSignals(options.signal, timeout);
+    const trace = debugEnabled();
+    const startedAt = performance.now();
     let response;
     try {
       response = await fetch(url, {
-        method: options.method ?? "GET",
+        method,
         headers: {
           ...apiKey ? { "x-api-key": apiKey } : {},
           accept: "application/json",
+          "user-agent": USER_AGENT,
           ...hasBody ? { "content-type": "application/json" } : {},
           ...options.headers
         },
         body: hasBody ? JSON.stringify(options.body) : undefined,
-        signal: options.signal
+        signal,
+        redirect: "manual"
       });
     } catch (cause) {
+      if (trace)
+        traceRequest(method, url, "failed", startedAt);
       if (options.signal?.aborted) {
         throw new SimApiError("Request cancelled.", 0);
       }
+      if (timeout?.aborted) {
+        throw new SimApiError(`${url} did not answer within ${timeoutMs / 1000}s. ${RAISE_TIMEOUT_HINT}`, 0);
+      }
       throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
     }
+    if (trace)
+      traceRequest(method, url, response.status, startedAt);
+    if (REDIRECT_STATUSES.has(response.status))
+      throw this.toRedirectError(url, path, response);
     if (!response.ok) {
       const raw = await response.text();
-      const error = toApiError(response.status, raw);
+      const error = toApiError(url, response.status, response.headers.get("content-type"), raw);
       if (response.status === 401) {
         error.message = `${error.message} — run: sim login --profile ${this.profile.name}`;
       }
+      if (namesKeyScopeRefusal(error)) {
+        error.message = `${error.message} — this operation needs a personal API key: sim login --profile ${this.profile.name}`;
+      }
       throw error;
     }
-    return response;
+    return { response, url };
   }
-  async request(path, options = {}) {
-    const response = await this.requestRaw(path, options);
-    const raw = await response.text();
-    if (!raw)
-      return;
-    return JSON.parse(raw);
+  toRedirectError(url, path, response) {
+    const location = response.headers.get("location")?.trim();
+    let target = null;
+    if (location) {
+      try {
+        target = new URL(location, url);
+      } catch {
+        target = null;
+      }
+    }
+    if (!target) {
+      return new SimApiError(`${url} answered HTTP ${response.status} with no usable redirect target. Check the endpoint for profile "${this.profile.name}".`, response.status);
+    }
+    const suggested = redirectEndpoint(this.profile.endpoint, path, target);
+    if (!suggested) {
+      return new SimApiError(`${url} redirected to ${target.href}. The CLI does not follow redirects, because a redirect can drop the request body and turn a write into a silent no-op.`, response.status);
+    }
+    return new SimApiError(`Endpoint redirected to ${suggested}. Run: sim configure --profile ${this.profile.name} --set-endpoint ${suggested}`, response.status);
   }
 }
+function redirectEndpoint(endpoint, requestPath, target) {
+  const prefix = target.pathname.endsWith(requestPath) ? target.pathname.slice(0, target.pathname.length - requestPath.length) : "";
+  const suggested = `${target.origin}${prefix}`.replace(/\/+$/, "");
+  return suggested === endpoint.replace(/\/+$/, "") ? null : suggested;
+}
+function pageProgress() {
+  let reported2 = false;
+  return {
+    advance: (fetched) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(`fetched ${fetched}…`)}\x1B[K`);
+    },
+    finish: () => {
+      if (reported2)
+        process.stderr.write("\r\x1B[K");
+    }
+  };
+}
 async function requestAllPages(client, path, options) {
   const { query, pageSize, limit: requestedLimit, ...requestOptions } = options;
   const limit = requestedLimit ?? Number.POSITIVE_INFINITY;
   if (limit <= 0)
     return [];
   const items = [];
+  const progress = pageProgress();
   let cursor = null;
-  do {
-    const page = await client.request(path, {
-      ...requestOptions,
-      query: {
-        ...query,
-        limit: Math.min(pageSize, limit - items.length),
-        cursor
-      }
-    });
-    items.push(...page.data);
-    cursor = page.nextCursor;
-  } while (cursor && items.length < limit);
+  try {
+    do {
+      const page = await client.request(path, {
+        ...requestOptions,
+        query: {
+          ...query,
+          limit: Math.min(pageSize, limit - items.length),
+          cursor
+        }
+      });
+      items.push(...page.data);
+      cursor = page.nextCursor;
+      if (cursor && items.length < limit)
+        progress.advance(items.length);
+    } while (cursor && items.length < limit);
+  } finally {
+    progress.finish();
+  }
   return items.slice(0, limit);
 }
 function resolvePath(template, params = {}) {
@@ -5894,7 +6136,7 @@ function duration(ms) {
   if (ms === null || ms === undefined)
     return EMPTY;
   if (ms < 1000)
-    return `${ms}ms`;
+    return `${Math.round(ms)}ms`;
   if (ms < 60000)
     return `${(ms / 1000).toFixed(1)}s`;
   return `${Math.floor(ms / 60000)}m${Math.round(ms % 60000 / 1000)}s`;
@@ -5914,17 +6156,18 @@ function oneLine(value) {
   return value.replace(/\s*[\r\n\t]+\s*/g, " ");
 }
 var MAX_CELL_WIDTH = 60;
-function clampCell(value) {
-  if (visibleWidth(value) <= MAX_CELL_WIDTH || value !== value.replace(ANSI_PATTERN, "")) {
+var MAX_RECORD_WIDTH = 160;
+function clamp(value, width) {
+  if (visibleWidth(value) <= width || value !== value.replace(ANSI_PATTERN, "")) {
     return value;
   }
-  return `${value.slice(0, MAX_CELL_WIDTH - 1)}…`;
+  return `${value.slice(0, width - 1)}…`;
 }
 function renderTable(rows, columns) {
   if (rows.length === 0)
     return source_default.dim("No results.");
   const headers = columns.map((column) => sanitize(column.header));
-  const cells = rows.map((row) => columns.map((column) => clampCell(oneLine(column.value(row)))));
+  const cells = rows.map((row) => columns.map((column) => clamp(oneLine(column.value(row)), MAX_CELL_WIDTH)));
   const widths = columns.map((_column, index) => Math.max(visibleWidth(headers[index]), ...cells.map((line) => visibleWidth(line[index]))));
   const header = headers.map((label, index) => source_default.dim(pad(label.toUpperCase(), widths[index]))).join("  ").trimEnd();
   const body = cells.map((line) => line.map((cell, index) => pad(cell, widths[index])).join("  ").trimEnd());
@@ -5970,13 +6213,10 @@ function printRecord(format, fields, raw) {
   }
   const width = Math.max(...safeFields.map(([label]) => visibleWidth(label)));
   for (const [label, value] of safeFields) {
-    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${oneLine(value)}`);
+    console.log(`${source_default.dim(pad(`${label}:`, width + 1))}  ${clamp(oneLine(value), MAX_RECORD_WIDTH)}`);
   }
 }
 
-// src/program.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-
 // ../../node_modules/commander/esm.mjs
 var import__ = __toESM(require_commander(), 1);
 var {
@@ -6009,6 +6249,8 @@ function sleep(ms) {
 var PAIRING_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
 var POLL_INTERVAL_MS = 2000;
 var POLL_TIMEOUT_MS = 15 * 60 * 1000;
+var APPROVAL_PATH = "/cli/auth";
+var POLL_PATH = "/api/cli/auth/poll";
 var RETRYABLE_POLL_STATUSES = new Set([409, 429, 500, 502, 503, 504]);
 function token() {
   return randomBytes(32).toString("base64url");
@@ -6027,14 +6269,30 @@ function createAuthRequest() {
   };
 }
 function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
-  const url = new URL("/cli/auth", endpoint);
-  url.searchParams.set("request", auth.request);
-  url.searchParams.set("challenge", auth.challenge);
-  url.searchParams.set("pairing", auth.pairing);
-  url.searchParams.set("scope", scope);
-  if (workspaceId)
-    url.searchParams.set("workspace", workspaceId);
-  return url.toString();
+  return buildUrl(endpoint, APPROVAL_PATH, {
+    request: auth.request,
+    challenge: auth.challenge,
+    pairing: auth.pairing,
+    scope,
+    workspace: workspaceId
+  });
+}
+function toRedirectError(endpoint, response) {
+  const location = response.headers.get("location")?.trim();
+  let target = null;
+  if (location) {
+    try {
+      target = new URL(location, endpoint);
+    } catch {
+      target = null;
+    }
+  }
+  if (!target) {
+    return new SimApiError(`${endpoint} answered the login poll with HTTP ${response.status} and no usable redirect target. Check the endpoint.`, response.status);
+  }
+  const refusal = `${endpoint} redirected the login poll to ${target.href}. The CLI does not follow redirects, because a redirect drops the request body and would carry the login secret to another origin.`;
+  const suggested = redirectEndpoint(endpoint, POLL_PATH, target);
+  return new SimApiError(suggested ? `${refusal} Re-run with --endpoint ${suggested}, or run: sim configure --set-endpoint ${suggested}` : refusal, response.status);
 }
 async function pollForKey(endpoint, auth, signal) {
   const deadline = Date.now() + POLL_TIMEOUT_MS;
@@ -6043,16 +6301,23 @@ async function pollForKey(endpoint, auth, signal) {
       throw new SimApiError("Login cancelled.", 0);
     let response = null;
     try {
-      response = await fetch(new URL("/api/cli/auth/poll", endpoint), {
+      response = await fetch(buildUrl(endpoint, POLL_PATH), {
         method: "POST",
-        headers: { "content-type": "application/json", accept: "application/json" },
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json",
+          "user-agent": USER_AGENT
+        },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
-        signal
+        signal,
+        redirect: "manual"
       });
     } catch {
       response = null;
     }
     if (response) {
+      if (REDIRECT_STATUSES.has(response.status))
+        throw toRedirectError(endpoint, response);
       const raw = await response.text();
       if (!response.ok) {
         if (!RETRYABLE_POLL_STATUSES.has(response.status)) {
@@ -6106,263 +6371,76 @@ function clientFrom(command) {
   return { client: new SimClient(profile), profile };
 }
 
-// src/commands/auth.ts
-function openBrowser(url) {
-  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
-  try {
-    const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {});
-    child.unref();
-  } catch {}
-}
-function presentAuthentication(source) {
-  switch (source) {
-    case "flag":
-      return { authenticated: true, source: "flag" };
-    case "env":
-      return { authenticated: true, source: "env" };
-    case "credentials":
-      return { authenticated: true, source: "credentials" };
-    case "unset":
-      return { authenticated: false, source: "unset" };
-    case "config":
-    case "default":
-      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
-  }
-}
-async function confirmProfileOverwrite(profileName) {
-  if (!process.stdin.isTTY) {
-    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
-  }
-  const prompt = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
-    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-  } finally {
-    prompt.close();
-  }
-}
-function loginCommand() {
-  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
-    const profile = profileFrom(command);
-    if (options.scope !== "platform" && options.scope !== "copilot") {
-      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
-    }
-    const scope = options.scope;
-    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
-      const confirmed = await confirmProfileOverwrite(profile.name);
-      if (!confirmed) {
-        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
-        return;
+// src/generated/v2-api.ts
+var V2_OPERATIONS = {
+  abortFileUpload: {
+    method: "DELETE",
+    path: "/api/v2/files/uploads/[uploadId]",
+    pathParams: ["uploadId"],
+    pathParamDocs: { uploadId: "Upload session identifier." },
+    responseMode: "json",
+    summary: "Abort File Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the upload session."
       }
     }
-    const auth = createAuthRequest();
-    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
-    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
-    console.log(`
-Pairing code: ${source_default.bold(auth.pairing)}`);
-    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
-`));
-    console.log(url);
-    if (options.browser)
-      openBrowser(url);
-    console.log(source_default.dim(`
-Waiting for approval…`));
-    const key = await pollForKey(profile.endpoint, auth);
-    if (key.scope !== scope) {
-      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+  },
+  abortKnowledgeDocumentUpload: {
+    method: "DELETE",
+    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
+    pathParams: ["id", "uploadId"],
+    pathParamDocs: {
+      id: "Unique knowledge base identifier.",
+      uploadId: "Upload session identifier returned when the upload was created."
+    },
+    responseMode: "json",
+    summary: "Abort Document Upload",
+    query: {
+      workspaceId: {
+        kind: "string",
+        required: true,
+        describe: "Workspace that owns the knowledge base."
+      }
     }
-    writeCredentialsProfile(profile.name, key.apiKey);
-    const settings = {
-      endpoint: profile.endpoint,
-      workspace: key.workspaceId ?? null
-    };
-    writeConfigProfile(profile.name, settings);
-    console.log(source_default.green(`
-✓ Logged in. Key stored in ${credentialsPath()}`));
-    if (key.workspaceBound && key.workspaceId) {
-      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
-    } else if (key.workspaceId) {
-      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
-    } else {
-      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+  },
+  addTableColumn: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/columns",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Column",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
+      column: { kind: "object", required: true, describe: "Column definition to add." }
     }
-  });
-}
-function logoutCommand() {
-  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
-    const profile = profileFrom(command);
-    if (options.all) {
-      const removed = deleteProfile(profile.name);
-      if (!removed.config && !removed.credentials) {
-        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
-        return;
-      }
-      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
-      return;
-    }
-    if (!readCredentialsProfile(profile.name).api_key) {
-      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
-      return;
-    }
-    writeCredentialsProfile(profile.name, null);
-    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
-    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
-  });
-}
-function whoamiCommand() {
-  return new Command("whoami").description("Show the resolved profile and where each setting came from").action((_options, command) => {
-    const profile = profileFrom(command);
-    const { sources } = profile;
-    const authentication = presentAuthentication(sources.apiKey);
-    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
-    printRecord(profile.output, [
-      ["Profile", profile.name],
-      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
-      [
-        "API key",
-        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
-      ],
-      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
-      ["Output", annotate(profile.output, sources.output)]
-    ], {
-      profile: profile.name,
-      endpoint: profile.endpoint,
-      workspaceId: profile.workspaceId,
-      output: profile.output,
-      authenticated: authentication.authenticated,
-      sources: {
-        endpoint: sources.endpoint,
-        authentication: authentication.source,
-        workspaceId: sources.workspaceId,
-        output: sources.output
-      }
-    });
-  });
-}
-function profilesCommand() {
-  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      console.log(source_default.dim("No profiles yet. Run: sim login"));
-      return;
-    }
-    const active = profileFrom(command).name;
-    for (const name of profiles) {
-      const marker = name === active ? source_default.green("*") : " ";
-      const hasKey = Boolean(readCredentialsProfile(name).api_key);
-      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
-    }
-  });
-}
-
-// src/commands/configure.ts
-function configureCommand() {
-  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
-    const profile = profileFrom(command);
-    const updates = {};
-    if (options.setEndpoint)
-      updates.endpoint = options.setEndpoint.replace(/\/+$/, "");
-    if (options.setWorkspace)
-      updates.workspace = options.setWorkspace;
-    if (options.setOutput) {
-      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
-        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
-      }
-      updates.output = options.setOutput;
-    }
-    for (const key of options.unset ?? []) {
-      if (!["endpoint", "workspace", "output"].includes(key)) {
-        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
-      }
-      updates[key] = null;
-    }
-    if (Object.keys(updates).length === 0) {
-      const current = readConfigProfile(profile.name);
-      if (Object.keys(current).length === 0) {
-        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
-        return;
-      }
-      for (const [key, value] of Object.entries(current)) {
-        console.log(`${source_default.dim(`${key}:`)} ${value}`);
-      }
-      return;
-    }
-    writeConfigProfile(profile.name, updates);
-    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
-  });
-}
-
-// src/generated/v2-api.ts
-var V2_OPERATIONS = {
-  abortFileUpload: {
-    method: "DELETE",
-    path: "/api/v2/files/uploads/[uploadId]",
-    pathParams: ["uploadId"],
-    pathParamDocs: { uploadId: "Upload session identifier." },
-    responseMode: "json",
-    summary: "Abort File Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the upload session."
-      }
-    }
-  },
-  abortKnowledgeDocumentUpload: {
-    method: "DELETE",
-    path: "/api/v2/knowledge/[id]/documents/uploads/[uploadId]",
-    pathParams: ["id", "uploadId"],
-    pathParamDocs: {
-      id: "Unique knowledge base identifier.",
-      uploadId: "Upload session identifier returned when the upload was created."
-    },
-    responseMode: "json",
-    summary: "Abort Document Upload",
-    query: {
-      workspaceId: {
-        kind: "string",
-        required: true,
-        describe: "Workspace that owns the knowledge base."
-      }
-    }
-  },
-  addTableColumn: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/columns",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Column",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Workspace that owns the table." },
-      column: { kind: "object", required: true, describe: "Column definition to add." }
-    }
-  },
-  addWorkflowGroup: {
-    method: "POST",
-    path: "/api/v2/tables/[tableId]/groups",
-    pathParams: ["tableId"],
-    pathParamDocs: { tableId: "Unique table identifier." },
-    responseMode: "json",
-    summary: "Add Workflow Group",
-    body: {
-      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
-      group: {
-        kind: "object",
-        required: true,
-        describe: "Workflow or enrichment producer definition."
-      },
-      outputColumns: {
-        kind: "array",
-        required: true,
-        describe: "Columns created for producer outputs."
-      },
-      autoRun: {
-        kind: "boolean",
-        default: false,
-        describe: "Whether to schedule existing rows after group creation."
+  },
+  addWorkflowGroup: {
+    method: "POST",
+    path: "/api/v2/tables/[tableId]/groups",
+    pathParams: ["tableId"],
+    pathParamDocs: { tableId: "Unique table identifier." },
+    responseMode: "json",
+    summary: "Add Workflow Group",
+    body: {
+      workspaceId: { kind: "string", required: true, describe: "Unique workspace identifier." },
+      group: {
+        kind: "object",
+        required: true,
+        describe: "Workflow or enrichment producer definition."
+      },
+      outputColumns: {
+        kind: "array",
+        required: true,
+        describe: "Columns created for producer outputs."
+      },
+      autoRun: {
+        kind: "boolean",
+        default: false,
+        describe: "Whether to schedule existing rows after group creation."
       }
     }
   },
@@ -7993,7 +8071,25 @@ var V2_OPERATIONS = {
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict results to files directly inside this folder. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
+        describe: "Restrict results to files inside this folder — its direct children, or its whole subtree when `recursive` is true. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
+      },
+      recursive: {
+        kind: "enum",
+        values: [
+          "true",
+          "1",
+          "yes",
+          "on",
+          "y",
+          "enabled",
+          "false",
+          "0",
+          "no",
+          "off",
+          "n",
+          "disabled"
+        ],
+        describe: "Whether the folder filter includes files in subfolders. Defaults to true when a search is set, false otherwise, so listing a folder shows that folder while searching one looks through everything in it. Ignored when no folder filter is set, which already spans the workspace. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       },
       scope: {
         kind: "enum",
@@ -8968,6 +9064,10 @@ var V2_OPERATIONS = {
         kind: "string",
         required: true,
         describe: "Write-only secret value. It is never returned."
+      },
+      description: {
+        kind: "string",
+        describe: "What the secret is for, shown to teammates. Workspace scope only — sending it for a personal secret is rejected. Omit it to leave an existing description untouched; send null or an empty string to clear one."
       }
     }
   },
@@ -9380,71 +9480,328 @@ var V2_OPERATIONS = {
   }
 };
 
-// src/runtime/request.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, readSync } from "node:fs";
-
-// src/contract/commands.ts
-var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
-var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
-var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
-var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
-var FOLDER_PATH_INPUT = {
-  describe: "Folder path; the leading / is optional"
-};
-var FOLDER_PATH_FLAG = {
-  ...FOLDER_PATH_INPUT,
-  name: "folder"
-};
-var FOLDER_DELETE_FLAGS = {
-  path: FOLDER_PATH_INPUT,
-  recursive: { boolean: true, describe: "Delete the folder and its descendants" }
-};
-var KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS = { id: "knowledgeBaseId" };
-var WORKFLOW_RUN_SCOPE = {
-  id: {
-    name: "workflow",
-    placeholder: "workflowId",
-    describe: "Workflow ID"
+// src/commands/auth.ts
+function openBrowser(url) {
+  const [command, args] = process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : [process.platform === "darwin" ? "open" : "xdg-open", [url]];
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+function presentAuthentication(source) {
+  switch (source) {
+    case "flag":
+      return { authenticated: true, source: "flag" };
+    case "env":
+      return { authenticated: true, source: "env" };
+    case "credentials":
+      return { authenticated: true, source: "credentials" };
+    case "unset":
+      return { authenticated: false, source: "unset" };
+    case "config":
+    case "default":
+      throw new SimApiError(`Unexpected API key source "${source}".`, 0);
   }
-};
-var FOLDER_LIST_COLUMNS = [
-  { header: "path" },
-  { header: "name" },
-  { header: "parent", path: "parentPath" },
-  { header: "updated", path: "updatedAt", format: "timestamp" }
-];
-function moveResource(command, resource) {
-  return {
-    command,
-    positionals: ["folderPath"],
-    requestFields: ["folderPath"],
-    describe: `Move a ${resource} to a folder`
-  };
 }
-var CLI_CONTRACT = {
-  createCredentialConnection: { hidden: true },
-  createServiceAccountCredential: { hidden: true },
-  getBillingStatus: {
-    command: "billing status",
-    allWorkspaces: true,
-    describe: "Show billing status and current-period credit usage",
-    fields: [
-      { header: "plan" },
-      { header: "status" },
-      { header: "workspace", path: "workspaceId" },
-      { header: "period start", path: "period.start", format: "timestamp" },
-      { header: "period end", path: "period.end", format: "timestamp" },
-      { header: "used credits", path: "credits.used" },
-      { header: "limit credits", path: "credits.limit" },
-      { header: "remaining credits", path: "credits.remaining" }
-    ]
-  },
-  listBillingLogs: {
-    command: "billing logs",
-    allWorkspaces: true,
-    describe: "List credit usage events",
-    flags: {
-      source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
+async function confirmProfileOverwrite(profileName) {
+  if (!process.stdin.isTTY) {
+    throw new SimApiError(`Profile "${profileName}" already exists. Re-run with --yes to overwrite it.`, 0);
+  }
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await prompt.question(`Profile "${profileName}" already exists. Replace its API key and login defaults? (y/N) `);
+    return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
+  } finally {
+    prompt.close();
+  }
+}
+function loginCommand() {
+  return new Command("login").description("Authorize this terminal and store an API key for the profile").option("--scope <scope>", "Key space to mint from: platform or copilot", "platform").option("--no-browser", "Print the URL instead of opening a browser").option("-y, --yes", "Overwrite an existing profile without prompting").action(async (options, command) => {
+    const profile = profileFrom(command);
+    if (options.scope !== "platform" && options.scope !== "copilot") {
+      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
+    }
+    const scope = options.scope;
+    if (readCredentialsProfile(profile.name).api_key && !options.yes) {
+      const confirmed = await confirmProfileOverwrite(profile.name);
+      if (!confirmed) {
+        console.log(source_default.dim("Login cancelled; the existing profile was not changed."));
+        return;
+      }
+    }
+    const auth = createAuthRequest();
+    const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
+    console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(profile.name)}`);
+    console.log(`
+Pairing code: ${source_default.bold(auth.pairing)}`);
+    console.log(source_default.dim(`Confirm this code matches what the browser shows before approving.
+`));
+    console.log(url);
+    if (options.browser)
+      openBrowser(url);
+    console.log(source_default.dim(`
+Waiting for approval…`));
+    const key = await pollForKey(profile.endpoint, auth);
+    if (key.scope !== scope) {
+      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+    }
+    writeCredentialsProfile(profile.name, key.apiKey);
+    const settings = {
+      endpoint: profile.endpoint,
+      workspace: key.workspaceId ?? null
+    };
+    writeConfigProfile(profile.name, settings);
+    console.log(source_default.green(`
+✓ Logged in. Key stored in ${credentialsPath()}`));
+    if (key.workspaceBound && key.workspaceId) {
+      console.log(source_default.dim(`  Workspace-scoped key — it can only reach ${key.workspaceId}.`));
+    } else if (key.workspaceId) {
+      console.log(source_default.dim(`  Personal key, defaulting to ${key.workspaceId}. Override per command with --workspace.`));
+    } else {
+      console.log(source_default.dim("  Personal key with no default workspace. Set one with: sim configure --set-workspace <id>"));
+    }
+  });
+}
+function logoutCommand() {
+  return new Command("logout").description("Remove the profile's stored API key").option("--all", "Remove the profile entirely, including its settings").action((options, command) => {
+    const profile = profileFrom(command);
+    if (options.all) {
+      const removed = deleteProfile(profile.name);
+      if (!removed.config && !removed.credentials) {
+        console.log(source_default.dim(`Nothing stored for profile "${profile.name}".`));
+        return;
+      }
+      console.log(source_default.green(`✓ Removed profile "${profile.name}".`));
+      return;
+    }
+    if (!readCredentialsProfile(profile.name).api_key) {
+      console.log(source_default.dim(`No stored key for profile "${profile.name}".`));
+      return;
+    }
+    writeCredentialsProfile(profile.name, null);
+    console.log(source_default.green(`✓ Removed the stored key for profile "${profile.name}".`));
+    console.log(source_default.dim("  The key itself is still active — revoke it in Settings → API keys."));
+  });
+}
+var CREDENTIAL_VERDICT_STATUSES = new Set([401, 403, 404]);
+var WHOAMI_EXIT_CODES = {
+  verified: 0,
+  disabled: 0,
+  unauthenticated: 1,
+  rejected: 1,
+  unreachable: 2,
+  "no-workspace": 2
+};
+async function verifyProfile(client, profile) {
+  if (!profile.apiKey) {
+    return {
+      status: "unauthenticated",
+      workspace: null,
+      detail: `no API key — run: sim login --profile ${profile.name}`
+    };
+  }
+  if (!profile.workspaceId) {
+    return {
+      status: "no-workspace",
+      workspace: null,
+      detail: `no workspace to check against — run: sim configure --profile ${profile.name} --set-workspace <id>`
+    };
+  }
+  const operation = V2_OPERATIONS.getWorkspace;
+  try {
+    const response = await client.request(resolvePath(operation.path, { workspaceId: profile.workspaceId }), { method: operation.method });
+    const { id, name, memberCount } = response.data;
+    return { status: "verified", workspace: { id, name, memberCount }, detail: null };
+  } catch (error) {
+    if (!(error instanceof SimApiError))
+      throw error;
+    return {
+      status: CREDENTIAL_VERDICT_STATUSES.has(error.status) ? "rejected" : "unreachable",
+      workspace: null,
+      detail: error.message
+    };
+  }
+}
+function presentVerification(verification) {
+  if (verification.status === "verified") {
+    const { name, memberCount } = verification.workspace;
+    const members = `${memberCount} ${memberCount === 1 ? "member" : "members"}`;
+    return `${source_default.green("✓")} ${safeOneLine(name)} · ${members}`;
+  }
+  const detail = safeOneLine(verification.detail);
+  switch (verification.status) {
+    case "rejected":
+      return `${source_default.red("✗")} ${detail}`;
+    case "unauthenticated":
+      return source_default.yellow(`not logged in — ${detail}`);
+    case "disabled":
+      return source_default.dim(detail);
+    default:
+      return source_default.yellow(`could not check — ${detail}`);
+  }
+}
+function whoamiCommand() {
+  return new Command("whoami").description("Show the resolved profile, where each setting came from, and whether it works").option("--no-verify", "Skip the API check and only print the resolved settings").action(async (options, command) => {
+    const { client, profile } = clientFrom(command);
+    const { sources } = profile;
+    const authentication = presentAuthentication(sources.apiKey);
+    const verification = options.verify ? await verifyProfile(client, profile) : { status: "disabled", workspace: null, detail: "not checked (--no-verify)" };
+    const annotate = (value, source) => source === "unset" ? source_default.dim("not set") : `${value} ${source_default.dim(`(${source})`)}`;
+    printRecord(profile.output, [
+      ["Profile", profile.name],
+      ["Endpoint", annotate(profile.endpoint, sources.endpoint)],
+      [
+        "API key",
+        authentication.authenticated ? annotate("configured", authentication.source) : source_default.yellow("not logged in")
+      ],
+      ["Workspace", annotate(profile.workspaceId ?? "", sources.workspaceId)],
+      ["Output", annotate(profile.output, sources.output)],
+      ["Verified", presentVerification(verification)]
+    ], {
+      profile: profile.name,
+      endpoint: profile.endpoint,
+      workspaceId: profile.workspaceId,
+      output: profile.output,
+      authenticated: authentication.authenticated,
+      sources: {
+        endpoint: sources.endpoint,
+        authentication: authentication.source,
+        workspaceId: sources.workspaceId,
+        output: sources.output
+      },
+      verification: {
+        status: verification.status,
+        workspace: verification.workspace,
+        detail: verification.detail
+      }
+    });
+    const exitCode = WHOAMI_EXIT_CODES[verification.status];
+    if (exitCode !== 0)
+      process.exitCode = exitCode;
+  });
+}
+function profilesCommand() {
+  return new Command("profiles").alias("profile").description("List the profiles defined in the config and credentials files").action((_options, command) => {
+    const profiles = listProfiles();
+    if (profiles.length === 0) {
+      console.log(source_default.dim("No profiles yet. Run: sim login"));
+      return;
+    }
+    const active = profileFrom(command).name;
+    for (const name of profiles) {
+      const marker = name === active ? source_default.green("*") : " ";
+      const hasKey = Boolean(readCredentialsProfile(name).api_key);
+      console.log(`${marker} ${name}${hasKey ? "" : source_default.dim("  (no key)")}`);
+    }
+  });
+}
+
+// src/commands/configure.ts
+function configureCommand() {
+  return new Command("configure").description("Set a profile's endpoint, default workspace, or output format").option("--set-endpoint <url>", "Sim deployment to talk to").option("--set-workspace <id>", "Default workspace for workspace-scoped commands").option("--set-output <format>", `Default output format (${OUTPUT_FORMATS.join(" | ")})`).option("--unset <key...>", "Remove settings (endpoint, workspace, output)").action((options, command) => {
+    const profile = profileFrom(command);
+    const updates = {};
+    if (options.setEndpoint) {
+      updates.endpoint = normalizeEndpoint(options.setEndpoint, "--set-endpoint");
+    }
+    if (options.setWorkspace)
+      updates.workspace = options.setWorkspace;
+    if (options.setOutput) {
+      if (!OUTPUT_FORMATS.includes(options.setOutput)) {
+        throw new SimApiError(`Unknown output format "${options.setOutput}". Use one of: ${OUTPUT_FORMATS.join(", ")}`, 0);
+      }
+      updates.output = options.setOutput;
+    }
+    for (const key of options.unset ?? []) {
+      if (!["endpoint", "workspace", "output"].includes(key)) {
+        throw new SimApiError(`Cannot unset "${key}". Use endpoint, workspace, or output.`, 0);
+      }
+      updates[key] = null;
+    }
+    if (Object.keys(updates).length === 0) {
+      const current = readConfigProfile(profile.name);
+      if (Object.keys(current).length === 0) {
+        console.log(source_default.dim(`No settings stored for profile "${profile.name}".`));
+        return;
+      }
+      for (const [key, value] of Object.entries(current)) {
+        console.log(`${source_default.dim(`${key}:`)} ${value}`);
+      }
+      return;
+    }
+    writeConfigProfile(profile.name, updates);
+    console.log(source_default.green(`✓ Updated profile "${profile.name}" in ${configPath()}`));
+  });
+}
+
+// src/runtime/request.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, readSync } from "node:fs";
+
+// src/contract/commands.ts
+var TABLE_NAME_HELP = "Identifier: letters, numbers, and underscores; cannot start with a number";
+var TABLE_FILTER_HELP = 'Predicate: {"all":[{"field":"status","op":"eq","value":"active"}]}; groups use all/any. Operators: eq, ne, gt, gte, lt, lte, in, nin, contains, ncontains, startsWith, endsWith, like, ilike, nlike, nilike, isEmpty, isNotEmpty, isNull, isNotNull';
+var TABLE_SORT_HELP = 'Ordered sort keys: [{"field":"createdAt","direction":"desc"}] (direction: asc or desc)';
+var CUSTOM_TOOL_SCHEMA_HELP = 'OpenAI function schema: {"type":"function","function":{"name":"...","parameters":{"type":"object","properties":{}}}}';
+var FOLDER_PATH_INPUT = {
+  describe: "Folder path as shown in the app; the leading / is optional",
+  folderPath: true
+};
+var FOLDER_PATH_FLAG = {
+  ...FOLDER_PATH_INPUT,
+  name: "folder"
+};
+var FOLDER_DELETE_FLAGS = {
+  path: FOLDER_PATH_INPUT,
+  recursive: { boolean: true, describe: "Delete the folder and its descendants" }
+};
+var KNOWLEDGE_BASE_PATH_ARGUMENT = { id: "knowledgeBaseId" };
+var WORKFLOW_RUN_SCOPE = {
+  id: {
+    name: "workflow",
+    placeholder: "workflowId",
+    describe: "Workflow ID"
+  }
+};
+var FOLDER_COLUMN = { header: "folder", path: "folderPath", format: "folder-path" };
+var FOLDER_LIST_COLUMNS = [
+  { header: "path", format: "folder-path" },
+  { header: "name" },
+  { header: "parent", path: "parentPath", format: "folder-path" },
+  { header: "updated", path: "updatedAt", format: "timestamp" }
+];
+function moveResource(command, resource) {
+  return {
+    command,
+    positionals: ["folderPath"],
+    requestFields: ["folderPath"],
+    describe: `Move a ${resource} to a folder`
+  };
+}
+var CLI_CONTRACT = {
+  createCredentialConnection: { hidden: true },
+  createServiceAccountCredential: { hidden: true },
+  getBillingStatus: {
+    command: "billing status",
+    allWorkspaces: true,
+    describe: "Show billing status and current-period credit usage",
+    fields: [
+      { header: "plan" },
+      { header: "status" },
+      { header: "workspace", path: "workspaceId" },
+      { header: "period start", path: "period.start", format: "timestamp" },
+      { header: "period end", path: "period.end", format: "timestamp" },
+      { header: "used credits", path: "credits.used" },
+      { header: "limit credits", path: "credits.limit" },
+      { header: "remaining credits", path: "credits.remaining" }
+    ]
+  },
+  listBillingLogs: {
+    command: "billing logs",
+    allWorkspaces: true,
+    describe: "List credit usage events",
+    flags: {
+      source: { describe: "Filter by usage source; sim-chat combines Copilot and workspace chat" },
       period: { describe: "Billing period" },
       startDate: { describe: "Custom period start (ISO 8601)" },
       endDate: { describe: "Custom period end (ISO 8601)" }
@@ -9480,7 +9837,7 @@ var CLI_CONTRACT = {
   bulkUpdateKnowledgeDocuments: {
     command: "knowledge documents batch-update",
     describe: "Enable or disable every matching document",
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     flags: {
       documentIds: { name: "document", list: true },
       selectAll: { boolean: true, describe: "Apply to every document in the knowledge base" }
@@ -9490,6 +9847,11 @@ var CLI_CONTRACT = {
     command: "workflows undeploy",
     describe: "Take a workflow out of deployment"
   },
+  getWorkflowDeployment: {
+    command: "workflows deployment status",
+    renamedFrom: ["workflows deployment list"],
+    describe: "Show a workflow’s current deployment"
+  },
   setSecret: { hidden: true },
   deleteTable: { confirm: "This deletes the table and all of its rows." },
   deleteTableRow: { confirm: "This deletes the row." },
@@ -9499,7 +9861,7 @@ var CLI_CONTRACT = {
   },
   deleteKnowledgeBase: { confirm: "This deletes the knowledge base and every document in it." },
   deleteKnowledgeDocument: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     confirm: "This deletes the document and its embeddings."
   },
   deleteFile: { confirm: "This archives the file." },
@@ -9529,7 +9891,10 @@ var CLI_CONTRACT = {
       workflowIds: { name: "workflow", list: true },
       folderPaths: { ...FOLDER_PATH_FLAG, list: true },
       triggers: { name: "trigger", list: true },
-      details: { describe: "Response detail level" },
+      details: {
+        requestDefault: "full",
+        describe: "Response detail level; full is requested by default to name each run’s workflow"
+      },
       includeTraceSpans: {
         boolean: true,
         describe: "Include trace spans in JSON or YAML output (implies full detail)"
@@ -9582,7 +9947,7 @@ var CLI_CONTRACT = {
     },
     itemsPath: "results",
     columns: [
-      { header: "score", path: "similarity" },
+      { header: "score", path: "similarity", format: "score" },
       { header: "document", path: "documentName" },
       { header: "chunk", path: "chunkIndex" },
       { header: "content" }
@@ -9656,7 +10021,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "rows", path: "rowCount" },
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
@@ -9666,7 +10031,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "deployed", path: "isDeployed", format: "bool" },
       { header: "runs", path: "runCount" },
       { header: "last run", path: "lastRunAt", format: "timestamp" }
@@ -9677,7 +10042,7 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "size", format: "bytes" },
       { header: "type" },
       { header: "uploaded by", path: "uploadedByEmail" },
@@ -9690,15 +10055,17 @@ var CLI_CONTRACT = {
     columns: [
       { header: "id" },
       { header: "name" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "docs", path: "docCount" },
       { header: "tokens", path: "tokenCount" },
       { header: "model", path: "embeddingModel" }
     ]
   },
-  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS },
+  getKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  updateKnowledgeDocument: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
+  listKnowledgeTags: { pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT },
   listKnowledgeDocuments: {
-    pathArgumentNames: KNOWLEDGE_DOCUMENT_PATH_ARGUMENTS,
+    pathArgumentNames: KNOWLEDGE_BASE_PATH_ARGUMENT,
     columns: [
       { header: "id" },
       { header: "filename" },
@@ -9742,12 +10109,24 @@ var CLI_CONTRACT = {
       { header: "updated", path: "updatedAt", format: "timestamp" }
     ]
   },
+  listCredentialProviders: {
+    columns: [
+      { header: "type" },
+      { header: "service", path: "serviceId" },
+      { header: "provider", path: "providerId" },
+      { header: "name" },
+      { header: "family", path: "providerFamily" },
+      { header: "available", format: "bool" },
+      { header: "description" }
+    ]
+  },
   listSecrets: {
     columns: [
       { header: "name" },
       { header: "scope" },
       { header: "role" },
-      { header: "updated", path: "updatedAt", format: "timestamp" }
+      { header: "updated", path: "updatedAt", format: "timestamp" },
+      { header: "description" }
     ]
   },
   getWorkspace: {
@@ -9813,7 +10192,7 @@ var CLI_CONTRACT = {
       { header: "name" },
       { header: "size", format: "bytes" },
       { header: "type" },
-      { header: "folder", path: "folderPath" },
+      FOLDER_COLUMN,
       { header: "uploaded by", path: "uploadedByEmail" },
       { header: "uploaded", path: "uploadedAt", format: "timestamp" },
       { header: "updated", path: "updatedAt", format: "timestamp" },
@@ -9840,6 +10219,11 @@ var CLI_CONTRACT = {
     command: "files rename",
     describe: "Rename a file"
   },
+  restoreFile: {
+    command: "files restore",
+    renamedFrom: ["files restore create"],
+    describe: "Restore an archived file"
+  },
   updateFileContent: {
     command: "files set-content",
     describe: "Replace a file’s contents",
@@ -9992,13 +10376,26 @@ var CLI_CONTRACT = {
     command: "tables rows find",
     describe: "Find rows matching a predicate",
     flags: {
-      q: { describe: "Value to find" },
+      q: { name: "query", renamedFrom: ["q"], describe: "Value to find" },
       predicate: { name: "filter", json: true, describe: TABLE_FILTER_HELP },
       sort: { json: true, describe: TABLE_SORT_HELP }
     },
     itemsPath: "matches",
     columns: [{ header: "ordinal" }, { header: "row", path: "rowId" }, { header: "column" }]
   },
+  queryRowsCount: {
+    command: "tables rows count",
+    renamedFrom: ["tables count create"],
+    describe: "Count rows matching a filter",
+    flags: {
+      predicate: {
+        name: "filter",
+        renamedFrom: ["predicate"],
+        json: true,
+        describe: TABLE_FILTER_HELP
+      }
+    }
+  },
   runTableColumn: {
     command: "tables columns run",
     describe: "Run a column’s workflow",
@@ -10216,7 +10613,7 @@ function readArgumentSource(raw, flagName) {
     }
   }
   try {
-    return { text: readFileSync2(path, "utf8"), from: ` (read from ${path})` };
+    return { text: readFileSync3(path, "utf8"), from: ` (read from ${path})` };
   } catch (error) {
     throw new SimApiError(`--${flagName} cannot read ${path}: ${error.message}`, 0);
   }
@@ -10251,6 +10648,26 @@ function readListValues(raw, flagName) {
     return trimmed;
   });
 }
+var PERCENT_ESCAPE = /%[0-9A-Fa-f]{2}/;
+var SUB_DELIMITERS = /[!'()*]/g;
+function encodeFolderPathSegment(name) {
+  if (name === ".")
+    return "%2E";
+  if (name === "..")
+    return "%2E%2E";
+  return encodeURIComponent(name).replace(SUB_DELIMITERS, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function encodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    if (!PERCENT_ESCAPE.test(segment))
+      return encodeFolderPathSegment(segment);
+    try {
+      return encodeFolderPathSegment(decodeURIComponent(segment));
+    } catch {
+      return encodeFolderPathSegment(segment);
+    }
+  }).join("/");
+}
 function pathHint(raw) {
   if (raw.startsWith("@") || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw))
     return "";
@@ -10260,7 +10677,7 @@ function coerce(raw, field, flag, flagName) {
   if (raw === undefined)
     return;
   if (flag.list) {
-    const values = readListValues(raw, flagName);
+    const values = readListValues(raw, flagName).map((value) => flag.folderPath ? encodeFolderPath(value) : value);
     return field.kind === "string" ? values.join(",") : values;
   }
   if (takesJson(field, flag)) {
@@ -10285,6 +10702,8 @@ function coerce(raw, field, flag, flagName) {
   if (choices && !choices.includes(String(raw))) {
     throw new SimApiError(`--${flagName} must be one of: ${choices.join(", ")}`, 0);
   }
+  if (flag.folderPath && typeof raw === "string")
+    return encodeFolderPath(raw);
   return raw;
 }
 function asQueryValue(value) {
@@ -10325,7 +10744,8 @@ function buildRequest(operation, positional, flags, workspaceId) {
         continue;
       const flagName = flagNameFor(operation, field);
       const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true;
-      const raw = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const provided = field === PROFILE_INJECTED_FIELD ? omitProfileWorkspace ? undefined : workspaceId : flags[camel(flagName)];
+      const raw = provided ?? flag.requestDefault;
       const value = coerce(raw ?? undefined, descriptor, flag, flagName);
       if (value === undefined) {
         if (descriptor.required) {
@@ -10498,6 +10918,15 @@ function countTraceSpans(value) {
 function at(row, path) {
   return path.split(".").reduce((value, key) => value && typeof value === "object" ? value[key] : undefined, row);
 }
+function decodeFolderPath(value) {
+  return value.split("/").map((segment) => {
+    try {
+      return decodeURIComponent(segment);
+    } catch {
+      return segment;
+    }
+  }).join("/");
+}
 function renderCell(value, format, options = {}) {
   switch (format) {
     case "timestamp":
@@ -10510,8 +10939,12 @@ function renderCell(value, format, options = {}) {
       return bool2(value);
     case "cost":
       return typeof value === "number" ? `$${value.toFixed(4)}` : text(null);
+    case "score":
+      return typeof value === "number" ? value.toFixed(4) : text(null);
     case "count":
       return Array.isArray(value) ? String(value.length) : text(null);
+    case "folder-path":
+      return typeof value === "string" ? text(decodeFolderPath(value)) : text(value);
     case "trace-count": {
       const count = countTraceSpans(value);
       return `${count} ${count === 1 ? "span" : "spans"}${options.expandedTrace ? "" : " (use --trace)"}`;
@@ -10522,10 +10955,42 @@ function renderCell(value, format, options = {}) {
       return sanitize(typeof value === "object" ? JSON.stringify(value) : String(value));
   }
 }
-var NESTED_CELL_WIDTH = 160;
-function recordCell(value) {
-  const rendered = renderCell(value, "auto");
-  return rendered.length > NESTED_CELL_WIDTH ? `${rendered.slice(0, NESTED_CELL_WIDTH)}…` : rendered;
+var TIMESTAMP_KEY = /(?:At|Date)$/;
+var DURATION_KEY = /Ms$|^duration/;
+var BYTES_KEY = /^size$|(?:Size|Bytes)$/;
+var BOOL_KEY = /^(?:is|has)[A-Z]/;
+var RATIO_KEY = /^(?:similarity|score)$|(?:Similarity|Score)$/;
+var FOLDER_PATH_KEY = /^(?:path|parentPath|folderPath)$/;
+var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}/;
+var RATIO_PRECISION = 4;
+function inferFormat(key, value) {
+  if (typeof value === "boolean")
+    return BOOL_KEY.test(key) ? "bool" : null;
+  if (typeof value === "string") {
+    if (FOLDER_PATH_KEY.test(key))
+      return "folder-path";
+    return TIMESTAMP_KEY.test(key) && ISO_TIMESTAMP.test(value) && !Number.isNaN(Date.parse(value)) ? "timestamp" : null;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return null;
+  if (DURATION_KEY.test(key))
+    return "duration";
+  if (BYTES_KEY.test(key))
+    return "bytes";
+  return null;
+}
+function inferredCell(key, value) {
+  if (typeof value === "number" && Number.isFinite(value) && RATIO_KEY.test(key)) {
+    return value.toFixed(RATIO_PRECISION);
+  }
+  return renderCell(value, inferFormat(key, value) ?? "auto");
+}
+function humanizeKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function inferHeader(key, format) {
+  const trimmed = format === "duration" || format === "bytes" ? key.replace(/(?:Ms|Bytes)$/, "") : format === "bool" ? key.replace(/^is(?=[A-Z])/, "") : key;
+  return humanizeKey(trimmed || key);
 }
 function columnsFrom(specs) {
   return specs.map((spec) => ({
@@ -10534,9 +10999,9 @@ function columnsFrom(specs) {
   }));
 }
 function fieldsFrom(data, specs, options = {}) {
-  return specs.flatMap((spec) => {
+  return specs.map((spec) => {
     const value = at(data, spec.path ?? spec.header);
-    return value === undefined ? [] : [[spec.header, renderCell(value, spec.format, options)]];
+    return [spec.header, value === undefined ? text(null) : renderCell(value, spec.format, options)];
   });
 }
 function inferColumns(rows, expand) {
@@ -10551,7 +11016,7 @@ function inferColumns(rows, expand) {
       if (value !== null && typeof value === "object")
         continue;
       seen.add(key);
-      paths.push({ path: key, header: key });
+      paths.push({ path: key, key, header: inferHeader(key, inferFormat(key, value)), owned: true });
     }
   }
   if (expand) {
@@ -10564,13 +11029,18 @@ function inferColumns(rows, expand) {
         if (nested.has(key))
           continue;
         nested.add(key);
-        paths.push({ path: `${expand}.${key}`, header: seen.has(key) ? `${expand}.${key}` : key });
+        paths.push({
+          path: `${expand}.${key}`,
+          key,
+          header: seen.has(key) ? `${expand}.${key}` : key,
+          owned: false
+        });
       }
     }
   }
-  return paths.map(({ path, header }) => ({
+  return paths.map(({ path, key, header, owned }) => ({
     header: sanitize(header),
-    value: (row) => renderCell(at(row, path), "auto")
+    value: (row) => owned ? inferredCell(key, at(row, path)) : renderCell(at(row, path), "auto")
   }));
 }
 function unwrapResource(data) {
@@ -10603,7 +11073,10 @@ function renderResult(operation, format, raw, spec, options = {}) {
     printList(format, data, spec.columns ? columnsFrom(spec.columns) : inferColumns(data, spec.expand));
     return;
   }
-  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [key, recordCell(value)]) : [];
+  const fields = spec.fields ? fieldsFrom(data, spec.fields, options) : data && typeof data === "object" ? Object.entries(data).map(([key, value]) => [
+    inferHeader(key, inferFormat(key, value)),
+    inferredCell(key, value)
+  ]) : [];
   printRecord(format, fields, data);
   if (spec.expandedTrace && options.expandedTrace) {
     const traceSpans = at(data, "traceSpans");
@@ -10716,7 +11189,7 @@ function attachCredentialCommands(program2) {
 }
 
 // src/commands/protocol/files-get.ts
-import { once } from "node:events";
+import { once as once2 } from "node:events";
 import { createWriteStream } from "node:fs";
 import { link, lstat, mkdtemp, readlink, rename, rm } from "node:fs/promises";
 import { dirname as dirname2, join as join2, resolve as resolve2 } from "node:path";
@@ -10731,6 +11204,9 @@ function printProtocolResult(format, result) {
 
 // src/commands/protocol/files-get.ts
 function writeFailure(path, error) {
+  if (isRequestTimeout(error)) {
+    return new SimApiError(`Downloading ${path} timed out. ${RAISE_TIMEOUT_HINT}`, 0);
+  }
   const code = error.code;
   if (code === "EEXIST") {
     return new SimApiError(`${path} already exists. Pass --force to overwrite it, or choose another output path.`, 0);
@@ -10821,7 +11297,7 @@ async function streamToStdout(body, output = process.stdout) {
       if (done)
         return;
       if (!output.write(value))
-        await once(output, "drain");
+        await once2(output, "drain");
     }
   } finally {
     reader.releaseLock();
@@ -11001,7 +11477,7 @@ async function finishUploadSession(client, workspaceId, session, path) {
 
 // src/commands/protocol/files-upload.ts
 function attachFileUpload(files) {
-  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Destination folder path (defaults to /)").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
+  files.command("upload").argument("<path>", "Local file to upload").description("Upload a file to the workspace").option("--folder <path>", "Folder path as shown in the app; defaults to the root folder").option("--name <name>", "Store it under a different name").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const { name, size } = await localFile(path, options.name);
@@ -11012,7 +11488,7 @@ function attachFileUpload(files) {
         name,
         contentType: contentTypeFor(name),
         size,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       }
     });
     const { session, uploadToken, transfer } = created.data;
@@ -11071,13 +11547,285 @@ function attachKnowledgeDocumentUpload(documents) {
     if (!completed.document) {
       throw new Error(`Knowledge upload ${session.id} completed without a document`);
     }
-    printProtocolResult(profile.output, {
-      id: completed.document.id,
-      knowledgeBaseId: completed.document.knowledgeBaseId,
-      name: completed.document.filename,
-      size: completed.document.fileSize,
-      status: completed.document.processingStatus
-    });
+    printProtocolResult(profile.output, {
+      id: completed.document.id,
+      knowledgeBaseId: completed.document.knowledgeBaseId,
+      name: completed.document.filename,
+      size: completed.document.fileSize,
+      status: completed.document.processingStatus
+    });
+  });
+}
+
+// src/commands/protocol/logs-follow.ts
+var DEFAULT_BACKLOG = 10;
+var DEFAULT_INTERVAL_SECONDS = 3;
+var MIN_INTERVAL_SECONDS = 0.1;
+var MAX_BACKOFF_MS = 30000;
+var POLL_PAGE_SIZE = 100;
+var MAX_PAGES_PER_POLL = 10;
+var MAX_REMEMBERED_RUNS = 5000;
+var MAX_CELL_WIDTH2 = 60;
+var WAIT_SLICE_MS = 250;
+var RETRYABLE_CLIENT_STATUSES = new Set([408, 425, 429]);
+var ERASE_LINE = `${String.fromCharCode(27)}[K`;
+function collect(value, previous) {
+  return [...previous, value];
+}
+function at2(row, path) {
+  return path.split(".").reduce((value, key) => value && typeof value === "object" ? value[key] : undefined, row);
+}
+function renderCell2(value, format) {
+  switch (format) {
+    case "timestamp":
+      return timestamp2(value);
+    case "duration":
+      return duration(value);
+    case "bytes":
+      return bytes(value);
+    case "bool":
+      return bool2(value);
+    case "cost":
+      return typeof value === "number" ? `$${value.toFixed(4)}` : text(null);
+    default:
+      return text(typeof value === "object" && value !== null ? JSON.stringify(value) : value);
+  }
+}
+var COLUMNS = (CLI_CONTRACT.listLogs?.columns ?? []).map((spec) => ({
+  header: spec.header,
+  value: (row) => renderCell2(at2(row, spec.path ?? spec.header), spec.format)
+}));
+function oneLine2(value) {
+  return value.replace(/\s*[\r\n\t]+\s*/g, " ");
+}
+function pad2(value, width) {
+  return value + " ".repeat(Math.max(0, width - visibleWidth(value)));
+}
+function clamp2(value, width) {
+  if (visibleWidth(value) <= width || visibleWidth(value) !== value.length)
+    return value;
+  return `${value.slice(0, Math.max(1, width - 1))}…`;
+}
+function createTableWriter() {
+  let widths = null;
+  return (rows) => {
+    const lines = rows.map((row) => COLUMNS.map((column) => oneLine2(column.value(row))));
+    if (!widths) {
+      widths = COLUMNS.map((column, index) => Math.min(MAX_CELL_WIDTH2, Math.max(visibleWidth(column.header), ...lines.map((line) => visibleWidth(line[index])))));
+      const header = widths;
+      console.log(source_default.dim(COLUMNS.map((column, index) => pad2(column.header.toUpperCase(), header[index])).join("  ").trimEnd()));
+    }
+    const locked = widths;
+    for (const line of lines) {
+      console.log(line.map((cell, index) => pad2(clamp2(cell, locked[index]), locked[index])).join("  ").trimEnd());
+    }
+  };
+}
+function createWriter(format) {
+  if (format === "json") {
+    return (rows) => {
+      for (const row of rows)
+        console.log(JSON.stringify(row));
+    };
+  }
+  if (format === "yaml") {
+    return (rows) => {
+      for (const row of rows) {
+        console.log(`---
+${dump(row, { lineWidth: 0, noRefs: true }).trimEnd()}`);
+      }
+    };
+  }
+  if (format === "text") {
+    return (rows) => {
+      if (rows.length > 0)
+        printList("text", rows, COLUMNS);
+    };
+  }
+  return createTableWriter();
+}
+function followStatus() {
+  let reported2 = false;
+  return {
+    note: (message) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(message)}${ERASE_LINE}`);
+    },
+    warn: (message) => {
+      if (reported2) {
+        reported2 = false;
+        process.stderr.write(`\r${ERASE_LINE}`);
+      }
+      process.stderr.write(`warning: ${message}
+`);
+    },
+    clear: () => {
+      if (!reported2)
+        return;
+      reported2 = false;
+      process.stderr.write(`\r${ERASE_LINE}`);
+    }
+  };
+}
+function watchForInterrupt() {
+  let stopped = false;
+  const stop = () => {
+    stopped = true;
+  };
+  process.on("SIGINT", stop);
+  process.on("SIGTERM", stop);
+  return {
+    interrupted: () => stopped,
+    dispose: () => {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+    }
+  };
+}
+async function waitFor(ms, interrupted) {
+  let remaining = ms;
+  while (remaining > 0 && !interrupted()) {
+    const step = Math.min(WAIT_SLICE_MS, remaining);
+    await sleep(step);
+    remaining -= step;
+  }
+}
+function isUnprinted(state, row) {
+  if (state.seen.has(row.runId))
+    return false;
+  return state.floor === null || row.startedAt >= state.floor;
+}
+function remember(state, rows) {
+  for (const row of rows)
+    state.seen.set(row.runId, row.startedAt);
+  let excess = state.seen.size - MAX_REMEMBERED_RUNS;
+  if (excess <= 0)
+    return;
+  for (const [runId, startedAt] of state.seen) {
+    if (excess <= 0)
+      break;
+    if (state.floor === null || startedAt > state.floor)
+      state.floor = startedAt;
+    state.seen.delete(runId);
+    excess -= 1;
+  }
+}
+async function collectUnprinted(client, path, query, state, pageSize, maxPages) {
+  const rows = [];
+  let cursor = null;
+  let truncated = false;
+  for (let page = 0;page < maxPages; page += 1) {
+    const response = await client.request(path, {
+      query: { ...query, limit: pageSize, cursor }
+    });
+    const page_rows = response?.data ?? [];
+    const unprinted = page_rows.filter((row) => isUnprinted(state, row));
+    rows.push(...unprinted);
+    cursor = response?.nextCursor ?? null;
+    if (!cursor || page_rows.length === 0 || unprinted.length < page_rows.length)
+      break;
+    if (page === maxPages - 1)
+      truncated = true;
+  }
+  return { rows, truncated };
+}
+function isTransient(error) {
+  if (!(error instanceof SimApiError))
+    return false;
+  if (error.status === 0 || error.status >= 500)
+    return true;
+  return RETRYABLE_CLIENT_STATUSES.has(error.status);
+}
+function nonNegativeInteger(raw, flag) {
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new SimApiError(`${flag} must be a non-negative integer`, 0);
+  }
+  return value;
+}
+function intervalMs(raw) {
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < MIN_INTERVAL_SECONDS) {
+    throw new SimApiError(`--interval must be at least ${MIN_INTERVAL_SECONDS} seconds`, 0);
+  }
+  return Math.round(seconds * 1000);
+}
+function inSeconds(ms) {
+  return Math.round(ms / 100) / 10;
+}
+function attachLogsFollow(logs) {
+  logs.command("follow").description("Watch runs as they arrive, printing each new run once").option("--workflow <id>", "Only follow runs of this workflow (repeatable)", collect, []).option("--folder <path>", "Only follow runs of workflows in this folder (repeatable)", collect, []).option("--trigger <type>", "Only follow runs with this trigger type (repeatable)", collect, []).addOption(new Option("--level <level>", "Only follow runs at this severity").choices([
+    ...V2_OPERATIONS.listLogs.query.level.values
+  ])).addOption(new Option("--details <level>", "Response detail level; full names each run’s workflow").choices([...V2_OPERATIONS.listLogs.query.details.values]).default("full")).option("-n, --lines <count>", "Recent runs to print before watching", String(DEFAULT_BACKLOG)).option("--interval <seconds>", "Seconds between polls", String(DEFAULT_INTERVAL_SECONDS)).addHelpText("after", `
+Each run prints once, when it is first seen, so its status is the status it had
+at that moment. With --output json every run is a JSON object on its own line
+(JSONL) rather than a member of an array, because a follow never ends and so can
+never close one; --output yaml emits a --- separated document stream. Progress
+and retries go to stderr, leaving stdout a clean stream of rows. Ctrl-C stops the
+follow.
+
+Examples:
+  $ sim logs follow --level error
+  $ sim logs follow --workflow wf_123 -n 0
+  $ sim --output json logs follow | jq -r '.runId'
+`).action(async (options, command) => {
+    const lines = nonNegativeInteger(options.lines, "--lines");
+    const delay = intervalMs(options.interval);
+    const { client, profile } = clientFrom(command);
+    const path = V2_OPERATIONS.listLogs.path;
+    const query = {
+      workspaceId: client.requireWorkspace(),
+      workflowIds: options.workflow?.length ? options.workflow.join(",") : undefined,
+      folderPaths: options.folder?.length ? options.folder.map(encodeFolderPath).join(",") : undefined,
+      triggers: options.trigger?.length ? options.trigger.join(",") : undefined,
+      level: options.level,
+      details: options.details,
+      order: "desc"
+    };
+    const write = createWriter(profile.output);
+    const status = followStatus();
+    const interrupt = watchForInterrupt();
+    const state = { seen: new Map, floor: null };
+    try {
+      const seed = await collectUnprinted(client, path, query, state, Math.max(lines, 1), 1);
+      remember(state, seed.rows);
+      state.floor = seed.rows.at(-1)?.startedAt ?? null;
+      if (seed.truncated && seed.rows.length < lines) {
+        status.warn(`asked for ${lines} earlier runs but a page holds ${seed.rows.length}; following from there — see sim logs list for more`);
+      }
+      write(lines > 0 ? seed.rows.slice(0, lines).reverse() : []);
+      let failures = 0;
+      while (!interrupt.interrupted()) {
+        await waitFor(failures === 0 ? delay : Math.min(delay * 2 ** failures, MAX_BACKOFF_MS), interrupt.interrupted);
+        if (interrupt.interrupted())
+          break;
+        let fresh;
+        try {
+          fresh = await collectUnprinted(client, path, query, state, POLL_PAGE_SIZE, MAX_PAGES_PER_POLL);
+        } catch (error) {
+          if (!isTransient(error))
+            throw error;
+          failures += 1;
+          const next = Math.min(delay * 2 ** failures, MAX_BACKOFF_MS);
+          status.note(`poll failed (${error.message}); retrying in ${inSeconds(next)}s…`);
+          continue;
+        }
+        failures = 0;
+        status.clear();
+        if (fresh.truncated) {
+          status.warn(`more than ${MAX_PAGES_PER_POLL * POLL_PAGE_SIZE} runs arrived at once; older ones were skipped — see sim logs list`);
+        }
+        if (fresh.rows.length === 0)
+          continue;
+        remember(state, fresh.rows);
+        write(fresh.rows.reverse());
+      }
+    } finally {
+      status.clear();
+      interrupt.dispose();
+    }
   });
 }
 
@@ -11114,15 +11862,22 @@ function addFieldOption(command, operation, field, descriptor) {
   const placeholder = takesList ? "<value...>" : wantsJson ? "<json|@file>" : "<value>";
   const choices = flag.choices ?? descriptor.values;
   const describe = `${documented}${takesList ? " (space-separated, or @path / @- with one value per line)" : wantsJson ? " (JSON, or @path / @- to read a file or stdin)" : ""}${descriptor.required ? " (required)" : ""}`;
+  const renamedFrom = flag.renamedFrom ?? [];
   const option = new Option(`${short}--${name} ${placeholder}`, describe);
   if (choices && !takesList)
     option.choices([...choices]);
   if (descriptor.default !== undefined && field !== "limit") {
     option.default(undefined, String(descriptor.default));
   }
-  if (descriptor.required)
+  if (descriptor.required && renamedFrom.length === 0)
     option.makeOptionMandatory();
   command.addOption(option);
+  for (const previous of renamedFrom) {
+    const retired = new Option(`--${previous} ${placeholder}`).hideHelp();
+    if (choices && !takesList)
+      retired.choices([...choices]);
+    command.addOption(retired);
+  }
 }
 function addOperationOptions(command, operation, commandSpec, operationSpec) {
   for (const param of operationSpec.pathParams) {
@@ -11158,16 +11913,19 @@ function addOperationOptions(command, operation, commandSpec, operationSpec) {
     }
   }
   if (commandSpec.confirm) {
-    command.option("-y, --yes", "Skip the confirmation");
+    command.option("-y, --yes", "Confirm this destructive operation (required)");
   }
 }
 
 // src/commands/protocol/resource-directory.ts
-var COLUMNS = [
+var COLUMNS2 = [
   { header: "kind", value: (entry) => text(entry.kind) },
   { header: "name", value: (entry) => text(entry.name) },
-  { header: "ref", value: (entry) => text(entry.ref) },
-  { header: "folder", value: (entry) => text(entry.folderPath) },
+  {
+    header: "ref",
+    value: (entry) => text(entry.kind === "folder" ? decodeFolderPath(entry.ref) : entry.ref)
+  },
+  { header: "folder", value: (entry) => text(decodeFolderPath(entry.folderPath)) },
   { header: "updated", value: (entry) => timestamp2(entry.updatedAt) }
 ];
 function operationPath(operation) {
@@ -11218,7 +11976,7 @@ function attachResourceDirectoryCommands(group, config) {
       throw new SimApiError("--limit must be a non-negative integer", 0);
     }
     const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const folderPath = path ?? "/";
+    const folderPath = encodeFolderPath(path ?? "/");
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     const [folders, resources] = await Promise.all([
@@ -11226,14 +11984,14 @@ function attachResourceDirectoryCommands(group, config) {
       listResources(client, config, workspaceId, folderPath, options.search, limit)
     ]);
     const entries = entriesFor(config, folders, resources);
-    printList(profile.output, entries.slice(0, limit), COLUMNS);
+    printList(profile.output, entries.slice(0, limit), COLUMNS2);
   });
   group.command("mkdir").argument("<path>", "Folder path to create; the leading / is optional").allowExcessArguments(false).description(`Create a ${config.kind} directory at a path`).action(async (path, _options, command) => {
     const { client, profile } = clientFrom(command);
     const operation = V2_OPERATIONS[config.createFolder];
     const result = await client.request(operation.path, {
       method: operation.method,
-      body: { workspaceId: client.requireWorkspace(), path }
+      body: { workspaceId: client.requireWorkspace(), path: encodeFolderPath(path) }
     });
     renderResult(config.createFolder, profile.output, result.data ?? result, {});
   });
@@ -11255,17 +12013,17 @@ function jsonFlag(raw, flagName, kind) {
 }
 async function watchImport(client, workspaceId, job) {
   let current = job;
-  let reported = -1;
+  let reported2 = -1;
   while (!IMPORT_SETTLED.has(current.status)) {
     await sleep2(IMPORT_POLL_MS);
     const next = await client.request(`/api/v2/tables/imports/${encodeURIComponent(current.id)}`, { query: { workspaceId } });
     current = next.data;
-    if (process.stderr.isTTY && current.rowsProcessed !== reported) {
-      reported = current.rowsProcessed;
-      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported} rows`)}\x1B[K`);
+    if (process.stderr.isTTY && current.rowsProcessed !== reported2) {
+      reported2 = current.rowsProcessed;
+      process.stderr.write(`\r${source_default.dim(`${current.status}… ${reported2} rows`)}\x1B[K`);
     }
   }
-  if (process.stderr.isTTY && reported >= 0)
+  if (process.stderr.isTTY && reported2 >= 0)
     process.stderr.write("\r\x1B[K");
   return current;
 }
@@ -11287,7 +12045,7 @@ function validateTargetOptions(options) {
   return intoExisting;
 }
 function attachTableImport(tables) {
-  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
+  tables.command("import").argument("[path]", "Local CSV file to import; omit when using --file-id").description("Import a CSV, into a new table by default").option("--name <name>", "Identifier for the new table: letters, numbers, and underscores; defaults to the sanitized file name").option("--table-id <id>", "Import into this existing table instead of creating one").addOption(new Option("--mode <append|replace>", "How to write into --table-id (default: append)").choices(["append", "replace"])).option("--folder <path>", "Folder path for the new table, as shown in the app").option("--file-id <id>", "Import a file already in the workspace instead of a local path").option("--mapping <json|@file>", "Column mapping (--table-id only)").option("--create-columns <json|@file>", "Columns to create (--table-id only)").option("--timezone <iana>", "Timezone for date parsing, e.g. America/New_York").option("--no-wait", "Return once the import is queued instead of watching it").action(async (path, options, command) => {
     const { client, profile } = clientFrom(command);
     const workspaceId = client.requireWorkspace();
     if (Boolean(path) === Boolean(options.fileId)) {
@@ -11312,7 +12070,7 @@ function attachTableImport(tables) {
       target = {
         type: "new",
         name,
-        ...options.folder !== undefined ? { folderPath: options.folder } : {}
+        ...options.folder !== undefined ? { folderPath: encodeFolderPath(options.folder) } : {}
       };
     }
     const started = await client.request(V2_OPERATIONS.createTableImport.path, {
@@ -11360,6 +12118,427 @@ function attachTableImport(tables) {
   });
 }
 
+// src/runtime/renamed.ts
+var warned = new Set;
+function warn(kind, from, to) {
+  const key = `${kind}:${from}`;
+  if (warned.has(key))
+    return;
+  warned.add(key);
+  process.stderr.write(`warning: ${kind} "${from}" has been renamed to "${to}". The old name still works.
+`);
+}
+function warnRenamedCommand(from, to) {
+  warn("command", `sim ${from}`, `sim ${to}`);
+}
+function warnRenamedFlag(from, to) {
+  warn("flag", `--${from}`, `--${to}`);
+}
+
+// src/runtime/execute.ts
+function cursorSlot(operationSpec) {
+  if (operationSpec.query && "cursor" in operationSpec.query)
+    return "query";
+  if (operationSpec.body && "cursor" in operationSpec.body)
+    return "body";
+  return null;
+}
+function foldRenamedFlags(operation, commandSpec, flags) {
+  for (const [field, flag] of Object.entries(commandSpec.flags ?? {})) {
+    if (!flag.renamedFrom?.length)
+      continue;
+    const current = flagNameFor(operation, field);
+    for (const previous of flag.renamedFrom) {
+      const supplied = flags[camel(previous)];
+      if (supplied === undefined)
+        continue;
+      if (flags[camel(current)] !== undefined) {
+        throw new SimApiError(`--${previous} is the former name of --${current}; pass one, not both`, 0);
+      }
+      warnRenamedFlag(previous, current);
+      flags[camel(current)] = supplied;
+    }
+  }
+}
+async function executeOperation(operation, commandSpec, operationSpec, invocation) {
+  const host = invocation[invocation.length - 1];
+  const inheritedFlags = host.optsWithGlobals();
+  const flags = {
+    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
+    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
+    ...invocation[invocation.length - 2]
+  };
+  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
+  const positional = invocation.slice(0, pathPositionalCount);
+  const requestFlags = { ...flags };
+  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
+    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
+  }
+  foldRenamedFlags(operation, commandSpec, requestFlags);
+  if (commandSpec.confirm && !requestFlags.yes) {
+    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
+  }
+  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
+    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
+  }
+  const { client, profile } = clientFrom(host);
+  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
+  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
+  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
+  const paging = cursorSlot(operationSpec);
+  if (paging) {
+    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
+    if (Number.isNaN(rawLimit) || rawLimit < 0) {
+      throw new SimApiError("--limit must be a non-negative number", 0);
+    }
+    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
+    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
+    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
+    const rows = [];
+    const progress = pageProgress();
+    let cursor = null;
+    try {
+      do {
+        const page = await client.request(request.path, {
+          method: operationSpec.method,
+          query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
+          body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
+        });
+        rows.push(...page.data);
+        cursor = page.nextCursor;
+        if (cursor && rows.length < limit)
+          progress.advance(rows.length);
+      } while (cursor && rows.length < limit);
+    } finally {
+      progress.finish();
+    }
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
+    return;
+  }
+  const result = await client.request(request.path, {
+    method: operationSpec.method,
+    query: request.query,
+    body: request.body
+  });
+  renderResult(operation, profile.output, result?.data ?? result, commandSpec, {
+    expandedTrace: requestFlags.trace === true
+  });
+}
+
+// src/commands/protocol/workflow-run-follow.ts
+var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
+var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
+var DONE_SENTINEL = "[DONE]";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(frame, key) {
+  const value = frame[key];
+  return typeof value === "string" ? value : null;
+}
+async function* sseData(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
+`);
+      buffer = done ? "" : lines.pop() ?? "";
+      for (const rawLine of lines) {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        if (!line.startsWith("data:"))
+          continue;
+        const payload = line.slice(5).startsWith(" ") ? line.slice(6) : line.slice(5);
+        if (payload.length > 0)
+          yield payload;
+      }
+      if (done)
+        return;
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+class Commentary {
+  sink;
+  atLineStart = true;
+  constructor(sink) {
+    this.sink = sink;
+  }
+  inline(text2) {
+    if (text2.length === 0)
+      return;
+    this.sink.write(text2);
+    this.atLineStart = text2.endsWith(`
+`);
+  }
+  line(text2) {
+    this.sink.write(`${this.atLineStart ? "" : `
+`}${text2}
+`);
+    this.atLineStart = true;
+  }
+  endLine() {
+    if (this.atLineStart)
+      return;
+    this.sink.write(`
+`);
+    this.atLineStart = true;
+  }
+}
+function toolNotice(frame) {
+  const name = safeOneLine(stringField(frame, "name") ?? "tool");
+  if (frame.phase === "start")
+    return source_default.dim(`→ ${name}`);
+  const status = stringField(frame, "status");
+  if (status && status !== "success")
+    return source_default.yellow(`✗ ${name} (${safeOneLine(status)})`);
+  return source_default.dim(`✓ ${name}`);
+}
+async function renderRunStream(body, options) {
+  const commentary = new Commentary(options.stderr);
+  let final = null;
+  for await (const payload of sseData(body)) {
+    let frame;
+    try {
+      frame = JSON.parse(payload);
+    } catch {
+      continue;
+    }
+    if (frame === DONE_SENTINEL)
+      break;
+    if (!isRecord(frame))
+      continue;
+    if (frame.event === undefined && typeof frame.chunk === "string") {
+      commentary.inline(sanitize(frame.chunk));
+      continue;
+    }
+    switch (frame.event) {
+      case "chunk_reset":
+        commentary.line(source_default.dim("… retracted; that turn resolved to tool calls"));
+        break;
+      case "thinking":
+        if (options.includeThinking && typeof frame.data === "string") {
+          commentary.inline(source_default.dim(sanitize(frame.data)));
+        }
+        break;
+      case "tool":
+        if (options.includeToolCalls)
+          commentary.line(toolNotice(frame));
+        break;
+      case "stream_error":
+        commentary.line(source_default.yellow(`warning: ${safeOneLine(stringField(frame, "error") ?? "stream read failed")}`));
+        break;
+      case "error":
+        commentary.endLine();
+        throw new SimApiError(safeOneLine(stringField(frame, "error") ?? "The workflow run failed."), 0);
+      case "final":
+        if (isRecord(frame.data))
+          final = frame.data;
+        break;
+      default:
+        break;
+    }
+  }
+  commentary.endLine();
+  if (!final) {
+    throw new SimApiError("The run stream ended before the workflow reported a result. The run may still be in progress — check: sim workflows runs list", 0);
+  }
+  return final;
+}
+async function followRun(workflowId, command) {
+  const flags = command.optsWithGlobals();
+  if (flags.async === true) {
+    throw new SimApiError("--follow streams a run as it happens and --async returns before it starts; pass one, not both", 0);
+  }
+  const includeThinking = flags.includeThinking === true;
+  const includeToolCalls = flags.includeToolCalls === true;
+  const negotiates = includeThinking || includeToolCalls;
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.executeWorkflow;
+  const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+  const response = await client.requestRaw(request.path, {
+    method: "POST",
+    query: request.query,
+    body: {
+      ...request.body ?? {},
+      stream: true,
+      ...includeThinking ? { includeThinking: true } : {},
+      ...includeToolCalls ? { includeToolCalls: true } : {}
+    },
+    headers: {
+      accept: "text/event-stream",
+      ...negotiates ? { [AGENT_STREAM_PROTOCOL_HEADER]: AGENT_STREAM_PROTOCOL_V1 } : {}
+    }
+  });
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.toLowerCase().includes("text/event-stream")) {
+    await response.body?.cancel();
+    throw new SimApiError(`${operation.path} answered ${contentType || "an unknown content type"} instead of an event stream. This deployment may predate streaming runs — re-run without --follow.`, response.status);
+  }
+  if (!response.body) {
+    throw new SimApiError("The run stream had no body.", response.status);
+  }
+  const final = await renderRunStream(response.body, {
+    includeThinking,
+    includeToolCalls,
+    stderr: process.stderr
+  });
+  renderResult("executeWorkflow", profile.output, final, CLI_CONTRACT.executeWorkflow ?? {});
+  if (final.success === false) {
+    throw new SimApiError(safeOneLine(typeof final.error === "string" ? final.error : "The workflow run failed."), 0);
+  }
+}
+function followOrDelegate(previous) {
+  return async (workflowId, _options, command) => {
+    const flags = command.optsWithGlobals();
+    if (flags.follow !== true) {
+      if (flags.includeThinking === true || flags.includeToolCalls === true) {
+        throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
+      }
+      if (previous) {
+        await previous(command.processedArgs);
+        return;
+      }
+      await executeOperation("executeWorkflow", CLI_CONTRACT.executeWorkflow ?? {}, V2_OPERATIONS.executeWorkflow, [workflowId, command.opts(), command]);
+      return;
+    }
+    await followRun(workflowId, command);
+  };
+}
+function attachWorkflowRunFollow(workflows) {
+  const run = workflows.commands.find((command) => command.name() === "run");
+  if (!run) {
+    throw new Error("workflows run must be registered before --follow can be attached to it");
+  }
+  const held = run._actionHandler;
+  const previous = typeof held === "function" ? held : null;
+  run.option("--follow", "Stream the run as it happens; progress on stderr, result on stdout. The stream reports only success and output, so the result omits the run id and timings a non-streaming run returns").option("--include-thinking", "Show model reasoning while following (requires --follow)").option("--include-tool-calls", "Show tool calls while following (requires --follow)").action(followOrDelegate(previous));
+}
+
+// src/commands/protocol/workflow-run-wait.ts
+var TERMINAL_STATUSES = new Set(["completed", "failed", "cancelled"]);
+var WAIT_EXIT_CODES = {
+  completed: 0,
+  failed: 1,
+  cancelled: 2,
+  paused: 3,
+  timeout: 4
+};
+var FIRST_POLL_DELAY_MS = 2000;
+var MAX_POLL_DELAY_MS = 15000;
+var POLL_BACKOFF_FACTOR = 2;
+var DEFAULT_WAIT_TIMEOUT_SECONDS = 3600;
+var WAIT_TIMEOUT_FLAG = "--wait-timeout <seconds>";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function optionalString(value) {
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function readRun(raw) {
+  const run = isRecord2(raw) && isRecord2(raw.data) ? raw.data : raw;
+  if (!isRecord2(run) || typeof run.status !== "string") {
+    throw new SimApiError("Run status response carried no status.", 0);
+  }
+  const paused = isRecord2(run.paused) ? run.paused : null;
+  return {
+    status: run.status,
+    pauseKind: paused ? optionalString(paused.pauseKind) : null,
+    resumeAt: paused ? optionalString(paused.resumeAt) : null,
+    contextId: paused ? optionalString(paused.contextId) : null
+  };
+}
+function classify(snapshot) {
+  if (snapshot.status === "paused")
+    return snapshot.pauseKind === "time" ? null : "paused";
+  if (!TERMINAL_STATUSES.has(snapshot.status))
+    return null;
+  return snapshot.status === "completed" ? "completed" : snapshot.status === "cancelled" ? "cancelled" : "failed";
+}
+function waitProgress() {
+  let reported2 = false;
+  return {
+    advance: (status, elapsedMs) => {
+      if (!process.stderr.isTTY)
+        return;
+      reported2 = true;
+      process.stderr.write(`\r${source_default.dim(`${status} — waiting ${Math.round(elapsedMs / 1000)}s…`)}\x1B[K`);
+    },
+    finish: () => {
+      if (!reported2)
+        return;
+      reported2 = false;
+      process.stderr.write("\r\x1B[K");
+    }
+  };
+}
+function parseWaitTimeout(raw) {
+  const seconds = Number(raw);
+  if (!Number.isFinite(seconds) || seconds < 0) {
+    throw new SimApiError(`Invalid ${WAIT_TIMEOUT_FLAG} "${raw}". Use a non-negative number of seconds, or 0 to wait indefinitely.`, 0);
+  }
+  return seconds;
+}
+function explain(outcome, runId, workflowId, snapshot) {
+  if (outcome === "completed")
+    return null;
+  if (outcome === "failed")
+    return `Run ${runId} failed.`;
+  if (outcome === "cancelled")
+    return `Run ${runId} was cancelled.`;
+  const context = snapshot.contextId ? ` --context ${snapshot.contextId}` : "";
+  return `Run ${runId} is paused waiting for input. Resume it: sim workflows runs resume ${runId} --workflow ${workflowId}${context}`;
+}
+function runSpec() {
+  return CLI_CONTRACT.getWorkflowRun ?? {};
+}
+function attachWorkflowRunWait(runs) {
+  runs.command("wait").argument("<runId>", V2_OPERATIONS.getWorkflowRun.pathParamDocs?.runId).description("Wait for a run to reach a terminal state, then show it").addOption(new Option("--workflow <workflowId>", "Workflow ID (required)").makeOptionMandatory()).addOption(new Option(WAIT_TIMEOUT_FLAG, `Give up after this many seconds, or 0 to wait indefinitely (default: ${DEFAULT_WAIT_TIMEOUT_SECONDS}). Bounds the whole wait; SIM_TIMEOUT_SECONDS bounds one request`)).action(async (runId, options, command) => {
+    const timeoutSeconds = options.waitTimeout === undefined ? DEFAULT_WAIT_TIMEOUT_SECONDS : parseWaitTimeout(options.waitTimeout);
+    const { client, profile } = clientFrom(command);
+    const operation = V2_OPERATIONS.getWorkflowRun;
+    const path = resolvePath(operation.path, { id: options.workflow, runId });
+    const startedAt = Date.now();
+    const deadline = timeoutSeconds === 0 ? Number.POSITIVE_INFINITY : startedAt + timeoutSeconds * 1000;
+    const progress = waitProgress();
+    let delayMs = FIRST_POLL_DELAY_MS;
+    try {
+      while (true) {
+        const raw = await client.request(path, { method: operation.method });
+        const snapshot = readRun(raw);
+        const outcome = classify(snapshot);
+        if (outcome) {
+          progress.finish();
+          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          const message = explain(outcome, runId, options.workflow, snapshot);
+          if (message)
+            console.error(source_default.red(message));
+          process.exitCode = WAIT_EXIT_CODES[outcome];
+          return;
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+          progress.finish();
+          renderResult("getWorkflowRun", profile.output, raw, runSpec());
+          console.error(source_default.red(`Timed out after ${timeoutSeconds}s waiting for run ${runId} (status: ${snapshot.status}${snapshot.resumeAt ? `, resuming at ${snapshot.resumeAt}` : ""}). Raise ${WAIT_TIMEOUT_FLAG}, or set it to 0 to wait indefinitely.`));
+          process.exitCode = WAIT_EXIT_CODES.timeout;
+          return;
+        }
+        progress.advance(snapshot.status, Date.now() - startedAt);
+        await sleep(Math.min(delayMs, remainingMs));
+        delayMs = Math.min(delayMs * POLL_BACKOFF_FACTOR, MAX_POLL_DELAY_MS);
+      }
+    } finally {
+      progress.finish();
+    }
+  });
+}
+
 // src/commands/protocol/index.ts
 function group(program2, name) {
   const existing = program2.commands.find((command) => command.name() === name);
@@ -11395,12 +12574,16 @@ function attachProtocolCommands(program2) {
     folders: "listTableFolders",
     createFolder: "createTableFolder"
   });
-  attachResourceDirectoryCommands(group(program2, "workflows"), {
+  const workflows = group(program2, "workflows");
+  attachResourceDirectoryCommands(workflows, {
     kind: "workflow",
     resources: "listWorkflows",
     folders: "listWorkflowFolders",
     createFolder: "createWorkflowFolder"
   });
+  attachWorkflowRunFollow(workflows);
+  attachWorkflowRunWait(group(workflows, "runs"));
+  attachLogsFollow(group(program2, "logs"));
 }
 
 // src/terminal/secret-input.ts
@@ -11481,7 +12664,8 @@ var SECRET_RESULT = {
     { header: "name" },
     { header: "scope" },
     { header: "role" },
-    { header: "updated", path: "updatedAt", format: "timestamp" }
+    { header: "updated", path: "updatedAt", format: "timestamp" },
+    { header: "description" }
   ]
 };
 function validateSecretValue(value) {
@@ -11492,7 +12676,16 @@ function validateSecretValue(value) {
   }
   return value;
 }
+function validateDescriptionScope(description, scope) {
+  if (description === undefined)
+    return;
+  if (scope === "personal") {
+    throw new SimApiError("--description is only supported for a workspace secret.", 0);
+  }
+  return description;
+}
 async function setSecret(name, options, command) {
+  const description = validateDescriptionScope(options.description, options.scope);
   const value = validateSecretValue(options.value ?? await promptSecret());
   const { client, profile } = clientFrom(command);
   const operation = V2_OPERATIONS.setSecret;
@@ -11501,7 +12694,8 @@ async function setSecret(name, options, command) {
     body: {
       workspaceId: client.requireWorkspace(),
       scope: options.scope,
-      value
+      value,
+      description
     }
   });
   renderResult("setSecret", profile.output, response.data, SECRET_RESULT);
@@ -11510,72 +12704,7 @@ function attachSecretCommands(program2) {
   const secrets = program2.commands.find((command) => command.name() === "secrets");
   if (!secrets)
     throw new Error("The generated secrets command group is missing");
-  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").action((name, options, command) => setSecret(name, options, command));
-}
-
-// src/runtime/execute.ts
-function cursorSlot(operationSpec) {
-  if (operationSpec.query && "cursor" in operationSpec.query)
-    return "query";
-  if (operationSpec.body && "cursor" in operationSpec.body)
-    return "body";
-  return null;
-}
-async function executeOperation(operation, commandSpec, operationSpec, invocation) {
-  const host = invocation[invocation.length - 1];
-  const inheritedFlags = host.optsWithGlobals();
-  const flags = {
-    ...inheritedFlags.workspace === undefined ? {} : { workspace: inheritedFlags.workspace },
-    ...inheritedFlags.allWorkspaces === undefined ? {} : { allWorkspaces: inheritedFlags.allWorkspaces },
-    ...invocation[invocation.length - 2]
-  };
-  const pathPositionalCount = operationSpec.pathParams.filter((param) => !commandSpec.pathFlags?.[param] && !isProfileWorkspacePath(commandSpec, param)).length;
-  const positional = invocation.slice(0, pathPositionalCount);
-  const requestFlags = { ...flags };
-  for (const [index, field] of (commandSpec.positionals ?? []).entries()) {
-    requestFlags[camel(flagNameFor(operation, field))] = invocation[pathPositionalCount + index];
-  }
-  if (commandSpec.confirm && !requestFlags.yes) {
-    throw new SimApiError(`${commandSpec.confirm} Re-run with --yes to confirm.`, 0);
-  }
-  if (commandSpec.allWorkspaces && requestFlags.allWorkspaces && requestFlags.workspace) {
-    throw new SimApiError("--all-workspaces cannot be combined with --workspace", 0);
-  }
-  const { client, profile } = clientFrom(host);
-  const hasWorkspaceField = Boolean(operationSpec.query && PROFILE_INJECTED_FIELD in operationSpec.query || operationSpec.body && PROFILE_INJECTED_FIELD in operationSpec.body);
-  const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
-  const request = buildRequest(operation, positional, requestFlags, hasWorkspaceField && !omitsWorkspace ? client.requireWorkspace() : profile.workspaceId);
-  const paging = cursorSlot(operationSpec);
-  if (paging) {
-    const rawLimit = Number.parseInt(String(requestFlags.limit ?? DEFAULT_LIMIT), 10);
-    if (Number.isNaN(rawLimit) || rawLimit < 0) {
-      throw new SimApiError("--limit must be a non-negative number", 0);
-    }
-    const limit = rawLimit === 0 ? Number.POSITIVE_INFINITY : rawLimit;
-    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
-    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
-    const rows = [];
-    let cursor = null;
-    do {
-      const page = await client.request(request.path, {
-        method: operationSpec.method,
-        query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
-        body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
-      });
-      rows.push(...page.data);
-      cursor = page.nextCursor;
-    } while (cursor && rows.length < limit);
-    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec);
-    return;
-  }
-  const result = await client.request(request.path, {
-    method: operationSpec.method,
-    query: request.query,
-    body: request.body
-  });
-  renderResult(operation, profile.output, result?.data ?? result, commandSpec, {
-    expandedTrace: requestFlags.trace === true
-  });
+  secrets.command("set").argument("<name>", "Secret name, as referenced in workflows").description("Create or replace a named secret").addOption(new Option("--scope <scope>", "Secret ownership scope").choices([...SECRET_SCOPES]).makeOptionMandatory()).option("--value <value>", "Secret value; visible to shell history when supplied directly").option("--description <description>", "What the secret is for, shown to teammates; workspace scope only. Omit to leave an existing description unchanged").action((name, options, command) => setSecret(name, options, command));
 }
 
 // src/runtime/build.ts
@@ -11693,6 +12822,19 @@ function configureOperation(command, operation, spec) {
 function buildLeaf(operation, spec, leafName) {
   return addMissingArgumentExample(configureOperation(new Command(leafName), operation, spec));
 }
+function addRenamedCommand(groups, operation, spec, from, to) {
+  const segments = from.split(" ");
+  const [groupName, ...rest] = segments;
+  if (rest.length === 0)
+    throw new Error(`${operation}.renamedFrom "${from}" must include a verb`);
+  let parent = groupFor(groups, groupName);
+  for (const segment of rest.slice(0, -1)) {
+    parent = nestedGroup(parent, segment, { hidden: true });
+  }
+  const leaf = buildLeaf(operation, spec, rest[rest.length - 1]);
+  leaf.hook("preAction", () => warnRenamedCommand(from, to));
+  parent.addCommand(leaf, { hidden: true });
+}
 function groupFor(groups, name) {
   const existing = groups.get(name);
   if (existing)
@@ -11708,12 +12850,12 @@ function resourceLabel(name) {
   const label = name.endsWith("s") ? name.slice(0, -1) : name;
   return label.replaceAll("-", " ");
 }
-function nestedGroup(parent, name) {
+function nestedGroup(parent, name, options = {}) {
   const existing = parent.commands.find((candidate) => candidate.name() === name);
   if (existing)
     return existing;
   const created = new Command(name).description(`Manage ${resourceLabel(parent.name())} ${name.replaceAll("-", " ")}`);
-  parent.addCommand(created);
+  parent.addCommand(created, { hidden: options.hidden });
   return created;
 }
 function addLeafCommand(groups, operation, spec, segments) {
@@ -11742,6 +12884,7 @@ function variantCommandSpec(spec, variant) {
 }
 function buildGeneratedCommands() {
   const groups = new Map;
+  const renamed = [];
   for (const operation of Object.keys(V2_OPERATIONS)) {
     const spec = CLI_CONTRACT[operation] ?? {};
     const operationSpec = V2_OPERATIONS[operation];
@@ -11764,6 +12907,12 @@ function buildGeneratedCommands() {
     for (const variant of spec.variants ?? []) {
       addLeafCommand(groups, operation, variantCommandSpec(spec, variant), variant.command.split(" "));
     }
+    for (const from of spec.renamedFrom ?? []) {
+      renamed.push({ operation, spec, from, to: segments.join(" ") });
+    }
+  }
+  for (const { operation, spec, from, to } of renamed) {
+    addRenamedCommand(groups, operation, spec, from, to);
   }
   return [...groups.values()].sort((a, b) => a.name().localeCompare(b.name()));
 }
@@ -11772,7 +12921,8 @@ function buildGeneratedCommands() {
 var PROGRAM_DESCRIPTION = "Talk to the Sim API from your terminal";
 var HELP_EPILOGUE = `
 Profiles work like the AWS CLI: settings live in ~/.sim/config, keys in
-~/.sim/credentials (0600). Select one with -P, --profile, or SIM_PROFILE.
+~/.sim/credentials (0600), or under SIM_CONFIG_DIR when it is set. Select one
+with -P, --profile, or SIM_PROFILE.
 
 Examples:
   $ sim login                                    Authorize the default profile
@@ -11786,18 +12936,11 @@ Examples:
   $ sim workflows import --workflow @wf.json
   $ sim whoami --profile dev
 `;
-function readPackageVersion() {
-  const metadata = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
-  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string") {
-    throw new Error("CLI package metadata is missing a valid version");
-  }
-  return metadata.version;
-}
 function buildProgram(options = {}) {
   const program2 = new Command;
   program2.name("sim").description(PROGRAM_DESCRIPTION);
   if (options.version !== false)
-    program2.version(readPackageVersion());
+    program2.version(CLI_VERSION);
   program2.option("-P, --profile <name>", "Profile to use (env: SIM_PROFILE)").option("--endpoint <url>", "Sim deployment to talk to (env: SIM_ENDPOINT)").option("-w, --workspace <id>", "Workspace to target (env: SIM_WORKSPACE)").addOption(new Option("--output <format>", "Output format for this command").choices([...OUTPUT_FORMATS]));
   program2.addCommand(loginCommand());
   program2.addCommand(logoutCommand());
@@ -11823,6 +12966,10 @@ async function main() {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       process.exit(1);
     }
+    if (isRequestTimeout(error)) {
+      console.error(source_default.red(`Error: the request timed out. ${RAISE_TIMEOUT_HINT}`));
+      process.exit(1);
+    }
     if (error instanceof SimApiError) {
       console.error(source_default.red(`Error: ${sanitize(error.message)}`));
       if (error.code)