sim 2.1.8-preview.102.1 → 2.1.8-preview.96.1

package/README.md

@@ -33,27 +33,16 @@ Sign in to the default profile:
 sim login
 ```
 
-With no `--method`, the CLI prefers OAuth when the server offers it and a local
-browser callback is possible. It selects API-key pairing for remote terminals
-or servers without OAuth. Use `sim login --method oauth` to require OAuth;
-if the server does not offer it, login fails without creating an API key.
-
-OAuth login opens Sim in your browser, asks you to approve the requested access,
+The CLI opens Sim in your browser, asks you to approve the requested access,
 and receives the one-time authorization code on a loopback callback. It stores
 a short-lived OAuth login that renews automatically and can be revoked under
-**Settings → General → Authorized apps**. Choose a default workspace afterward with
+**Settings → Authorized apps**. Choose a default workspace afterward with
 `sim configure --set-workspace <id>`.
 
-Use `--no-browser` with either method to print the approval URL without opening
-it. OAuth still needs the browser to reach the CLI's loopback callback. Over SSH
-or in a container without port forwarding, use
-`sim login --method api-key --no-browser` to approve from another device and
-create a permanent personal API key. `--method api-key` creates a new key;
-set `SIM_API_KEY` to supply an existing one.
-
-Pairing requires a server that supports `platform` API keys. Upgrade older
-deployments that only issue `copilot` keys before login; they are not compatible
-with the platform CLI. OAuth discovery does not check pairing compatibility.
+Use `sim login --no-browser` to print the OAuth URL without opening it. The
+browser must still be able to reach the CLI's loopback callback. Over SSH or in
+a container without port forwarding, use `sim login --browserless`; that
+pairing-code fallback creates a permanent personal API key instead.
 
 Check the active profile and verify that its endpoint, credential, and workspace
 work together:
@@ -220,26 +209,11 @@ will consume the result, and `text` for tab-separated shell output:
 
 ```bash
 sim workflows list --output json
-sim logs list --output json | jq -r '.data[].runId'
+sim logs list --output json | jq -r '.[].runId'
 SIM_OUTPUT=yaml sim tables get <tableId>
 sim configure --set-output json
 ```
 
-Paginated lists return `{ "data": [...], "nextCursor": "..." }` in JSON and YAML.
-`nextCursor` is `null` when no pages remain. Resource lists and directory `ls`
-fetch every page by default; use `--limit N` to cap them. Table rows (including
-queries), logs, audit/billing events, workflow runs/versions, and knowledge
-documents/chunks keep a default limit of 100. Use `--limit 0` to fetch every page
-of those datasets, or pass the returned `nextCursor` to `--cursor` to continue
-with another bounded result. Keep the same resource, filters, and sort order
-when resuming; stop when `nextCursor` is `null`. Results accumulate in memory
-before printing, so large datasets need an explicit limit or filter.
-
-```bash
-sim tables rows list <tableId> --limit 100 --output json
-sim tables rows list <tableId> --limit 100 --cursor "$nextCursor" --output json
-```
-
 JSON-valued options accept inline JSON, a file prefixed with `@`, or stdin with
 `@-`:
 

package/dist/index.js

@@ -4460,22 +4460,6 @@ function toApiError(url, status, contentType, raw) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…`;
 }
-function transportErrorMessage(error) {
-  const messages = [];
-  const seen = new Set;
-  let current = error;
-  while (current && typeof current === "object" && messages.length < 4 && !seen.has(current)) {
-    seen.add(current);
-    const candidate = current;
-    const message = typeof candidate.message === "string" ? truncate(candidate.message.replace(/\s+/g, " ").trim(), 300) : "";
-    const code = typeof candidate.code === "string" ? candidate.code : "";
-    const detail = `${message}${code && !message.includes(code) ? ` (${code})` : ""}`;
-    if (detail && messages.at(-1) !== detail)
-      messages.push(detail);
-    current = candidate.cause;
-  }
-  return messages.join(": ") || "Unknown network error";
-}
 function namesKeyScopeRefusal(error) {
   if (typeof error.code === "string" && KEY_SCOPE_REFUSALS.has(error.code))
     return true;
@@ -4699,7 +4683,7 @@ class SimClient {
       if (timeout?.aborted) {
         throw new SimApiError(`${url} did not answer within ${timeoutMs / 1000}s. ${RAISE_TIMEOUT_HINT}`, 0);
       }
-      throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${transportErrorMessage(cause)}`, 0);
+      throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
     }
     if (trace)
       traceRequest(method, url, response.status, startedAt);
@@ -4763,21 +4747,15 @@ function pageProgress() {
     }
   };
 }
-function assertCursorAdvances(cursor, seenCursors) {
-  if (cursor === null)
-    return;
-  if (seenCursors.has(cursor)) {
-    throw new SimApiError("The API returned a repeated pagination cursor; cannot continue.", 0);
-  }
-  seenCursors.add(cursor);
-}
 async function requestAllPages(client, path, options) {
+  return (await requestPages(client, path, options)).items;
+}
+async function requestPages(client, path, options) {
   const { query, pageSize, limit: requestedLimit, ...requestOptions } = options;
   const limit = requestedLimit ?? Number.POSITIVE_INFINITY;
   if (limit <= 0)
-    return [];
+    return { items: [], truncated: false };
   const items = [];
-  const seenCursors = new Set;
   const progress = pageProgress();
   let cursor = null;
   try {
@@ -4790,7 +4768,6 @@ async function requestAllPages(client, path, options) {
           cursor
         }
       });
-      assertCursorAdvances(page.nextCursor, seenCursors);
       items.push(...page.data);
       cursor = page.nextCursor;
       if (cursor && items.length < limit)
@@ -4799,7 +4776,7 @@ async function requestAllPages(client, path, options) {
   } finally {
     progress.finish();
   }
-  return items.slice(0, limit);
+  return { items: items.slice(0, limit), truncated: cursor !== null || items.length > limit };
 }
 function resolvePath(template, params = {}) {
   return template.replace(/\[([^\]]+)\]/g, (_match, key) => {
@@ -8163,12 +8140,12 @@ function createAuthRequest() {
     pairing: pairingCode()
   };
 }
-function buildApprovalUrl(endpoint, auth, workspaceId) {
+function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
   return buildUrl(endpoint, APPROVAL_PATH, {
     request: auth.request,
     challenge: auth.challenge,
     pairing: auth.pairing,
-    scope: "platform",
+    scope,
     workspace: workspaceId
   });
 }
@@ -8474,7 +8451,7 @@ function listenForCallback(server, expectedState, completionUrl, signal, timeout
     const onAbort = () => finish({ ok: false, error: new SimApiError("Login cancelled.", 0) });
     const timer = setTimeout(() => finish({
       ok: false,
-      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --method api-key if this terminal's browser cannot reach it.`, 0)
+      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --browserless if this terminal's browser cannot reach it.`, 0)
     }), timeoutMs);
     signal?.addEventListener("abort", onAbort, { once: true });
     server.on("request", (request, response) => {
@@ -8723,7 +8700,6 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Apply Workflow Operations",
-    workspaceKeyUnsupported: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -8812,7 +8788,7 @@ var V2_OPERATIONS = {
       },
       folderPaths: {
         kind: "string",
-        describe: "Comma-separated folder paths whose contents are included recursively. Up to 100 paths; resolved files share the 100-file download limit. Unknown paths are rejected."
+        describe: "Folder paths to include with all their descendants, comma-separated. At most 100 entries, and the files they resolve to count against the same 100-file download ceiling. A path that matches no folder is rejected rather than ignored."
       }
     }
   },
@@ -9471,7 +9447,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["streamable-http"],
         default: "streamable-http",
-        describe: "Transport protocol. Defaults to `streamable-http` on creation."
+        describe: "Transport used to communicate with the server. Applied server-side as `streamable-http` when omitted on create."
       },
       url: {
         kind: "string",
@@ -9490,17 +9466,17 @@ var V2_OPERATIONS = {
       timeout: {
         kind: "integer",
         default: 30000,
-        describe: "Per-request timeout in milliseconds. Defaults to 30000 on creation."
+        describe: "Per-request timeout in milliseconds. Applied server-side as 30000 when omitted on create."
       },
       retries: {
         kind: "integer",
         default: 3,
-        describe: "Number of retries per request. Defaults to 3 on creation."
+        describe: "Number of retries per request. Applied server-side as 3 when omitted on create."
       },
       enabled: {
         kind: "boolean",
         default: true,
-        describe: "Whether workflows can use the server's tools. Defaults to true on creation."
+        describe: "Whether the server tools are available to workflows. Applied server-side as true when omitted on create."
       },
       oauthClientId: {
         kind: "string",
@@ -10398,7 +10374,7 @@ var V2_OPERATIONS = {
       input: {
         kind: "object",
         default: {},
-        describe: "Tool arguments keyed by published parameter IDs. For `user-only` parameters, a whole-value `{{VAR_NAME}}` reference resolves a workspace environment variable. Other values pass through unchanged."
+        describe: "Arguments for the tool, keyed by the parameter ids the tool catalog publishes for it. A parameter whose visibility is `user-only` also accepts an environment-variable reference written as the whole value, `{{VAR_NAME}}`, resolved server-side against the workspace environment; any other value is sent verbatim."
       },
       credentialId: {
         kind: "string",
@@ -10433,7 +10409,7 @@ var V2_OPERATIONS = {
       },
       executionTimeoutSeconds: {
         kind: "integer",
-        describe: "Maximum duration of an asynchronous run, in seconds, capped by the plan's execution timeout. Requires `async: true`; otherwise returns `400`."
+        describe: "Requested server-side timeout for an asynchronous run, in seconds. An upper bound, not the effective timeout: the run uses the smaller of this value and the plan's execution timeout, so requesting more than the plan allows silently yields the plan timeout. Rejected with `400` unless `async` is true."
       },
       stream: {
         kind: "boolean",
@@ -10442,7 +10418,7 @@ var V2_OPERATIONS = {
       },
       selectedOutputs: {
         kind: "array",
-        describe: "Output references for streaming: `<blockName>.<outputPath>` or `<childWorkflowId>.<blockName>.<outputPath>`, using normalized block names. Child references apply to every invocation. Requires `stream: true` and rejects synchronous or async requests. Use `selectedOutputs` with Get Workflow Run to narrow an existing run."
+        describe: "Block output references to include in a streamed response. Use `<blockName>.<outputPath>` for the executed workflow or `<childWorkflowId>.<blockName>.<outputPath>` for a child workflow; block names are normalized workflow reference names. Selecting a child workflow applies to every invocation of it. Requires `stream: true` — it shapes the streamed envelope only, so it is rejected on a sync request and when `async` is true. To narrow a finished run, pass `selectedOutputs` to the run resource instead."
       },
       includeThinking: {
         kind: "boolean",
@@ -10466,7 +10442,7 @@ var V2_OPERATIONS = {
     headers: {
       "x-run-id": {
         kind: "string",
-        describe: "Run ID for API-key or OAuth callers; ignored for anonymous requests. Reuse it after an uncertain response: a claimed ID returns `409` with `RUN_ID_CONFLICT`, without replaying results. Check Get Workflow Run, but `404` can persist while the ID remains claimed and does not establish whether execution started. Do not automatically restart with a fresh or omitted ID; either can start another run."
+        describe: 'Caller-supplied run identifier, available only to API-key callers. A one-shot uniqueness claim, NOT an idempotency key: reusing a value fails with `409` and `error.details.code: "RUN_ID_CONFLICT"` rather than replaying the original result. To retry safely, send a fresh value per attempt, or omit the header and let the server allocate one.'
       },
       "x-sim-via": {
         kind: "string",
@@ -10690,7 +10666,7 @@ var V2_OPERATIONS = {
       },
       folderPaths: {
         kind: "string",
-        describe: "Comma-separated workflow folder paths, including descendants. Up to 100 paths. Unknown folder paths contribute no matches."
+        describe: "Comma-separated workflow folder paths to include. At most 100 entries. A path covers its whole subtree. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       triggers: {
         kind: "string",
@@ -10712,7 +10688,7 @@ var V2_OPERATIONS = {
       segmentCount: {
         kind: "integer",
         default: 72,
-        describe: "Number of time buckets, up to 500. Exactly this many are returned, each at least one minute wide. Short windows extend past the requested end and include empty trailing buckets."
+        describe: "Number of equal time buckets to divide the window into, from 1 to 500. Exactly this many buckets are always returned. Buckets are never narrower than one minute, so on a short window the series extends past the end of the window rather than being compressed, and the trailing buckets are empty."
       }
     }
   },
@@ -11168,7 +11144,7 @@ var V2_OPERATIONS = {
       source: {
         kind: "enum",
         values: ["builtin", "custom"],
-        describe: "Restrict to built-in blocks or this workspace's deployed custom blocks."
+        describe: "Restrict to shipped blocks or to this workspace’s deployed custom blocks."
       },
       sortBy: {
         kind: "enum",
@@ -11367,7 +11343,7 @@ var V2_OPERATIONS = {
       },
       parentPath: {
         kind: "string",
-        describe: "Restrict results to direct children of this parent path. Unknown folder paths contribute no matches."
+        describe: "Restrict results to direct children of this parent path. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -11429,7 +11405,7 @@ var V2_OPERATIONS = {
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict files to this folder, including subfolders when `recursive` is true. Unknown folder paths contribute no matches."
+        describe: "Restrict results to files inside this folder — its direct children, or its whole subtree when `recursive` is true. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       recursive: {
         kind: "enum",
@@ -11447,7 +11423,7 @@ var V2_OPERATIONS = {
           "n",
           "disabled"
         ],
-        describe: "Include subfolders in the folder filter. Defaults to true when searching and false otherwise. Ignored without a folder filter."
+        describe: "Whether the folder filter includes files in subfolders. Defaults to true when a search is set, false otherwise, so listing a folder shows that folder while searching one looks through everything in it. Ignored when no folder filter is set, which already spans the workspace. The listed spellings are the whole accepted vocabulary and are case-sensitive; any other value is rejected."
       },
       scope: {
         kind: "enum",
@@ -11498,11 +11474,11 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["active", "archived"],
         default: "active",
-        describe: "Lifecycle scope: active or archived knowledge bases. Use Restore Knowledge Base to recover archived entries. Folder paths resolve only active folders, so filtering by an archived folder returns no matches."
+        describe: "Which lifecycle set to list: `active` (default) for live knowledge bases, `archived` for knowledge bases a `DELETE` archived and `POST /knowledge/{knowledgeBaseId}/restore` can bring back. `folderPath` resolves against active folders only, so pairing it with `scope=archived` returns an empty page when the containing folder was archived too."
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict results to knowledge bases in this folder. Unknown folder paths contribute no matches."
+        describe: "Restrict results to knowledge bases in this folder. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -11722,7 +11698,7 @@ var V2_OPERATIONS = {
       },
       parentPath: {
         kind: "string",
-        describe: "Restrict results to direct children of this parent path. Unknown folder paths contribute no matches."
+        describe: "Restrict results to direct children of this parent path. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -11873,7 +11849,7 @@ var V2_OPERATIONS = {
       },
       folderPaths: {
         kind: "string",
-        describe: "Comma-separated workflow folder paths, including descendants. Up to 100 paths. Unknown folder paths contribute no matches."
+        describe: "Comma-separated workflow folder paths to include. At most 100 entries. A path covers its whole subtree, so `/prod` also selects runs in `/prod/nested`. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       }
     }
   },
@@ -11932,7 +11908,7 @@ var V2_OPERATIONS = {
       },
       refresh: {
         kind: "boolean",
-        describe: "Refresh tools using your credentials. Otherwise results may reuse another workspace member's recent discovery and omit newly added tools."
+        describe: "Bypass the short-lived per-workspace tool cache and reconnect under your own credentials. A cached result reflects whichever workspace member last ran discovery, so this is the only way to pick up a tool added since then; it costs a live round trip."
       }
     }
   },
@@ -12110,7 +12086,7 @@ var V2_OPERATIONS = {
       },
       parentPath: {
         kind: "string",
-        describe: "Restrict results to direct children of this parent path. Unknown folder paths contribute no matches."
+        describe: "Restrict results to direct children of this parent path. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -12174,7 +12150,7 @@ var V2_OPERATIONS = {
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict results to tables in this folder. Unknown folder paths contribute no matches."
+        describe: "Restrict results to tables in this folder. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -12276,7 +12252,7 @@ var V2_OPERATIONS = {
       },
       parentPath: {
         kind: "string",
-        describe: "Restrict results to direct children of this parent path. Unknown folder paths contribute no matches."
+        describe: "Restrict results to direct children of this parent path. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       search: {
         kind: "string",
@@ -12411,7 +12387,7 @@ var V2_OPERATIONS = {
       },
       folderPath: {
         kind: "string",
-        describe: "Restrict results to workflows in this folder path. Unknown folder paths contribute no matches."
+        describe: "Restrict results to workflows in this folder path. A path that names no folder narrows the result to nothing, so the response is an empty page rather than an error."
       },
       deployedOnly: {
         kind: "boolean",
@@ -12718,7 +12694,6 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Create or Replace Workflow Chat Deployment",
-    workspaceKeyUnsupported: true,
     body: {
       identifier: {
         kind: "string",
@@ -12771,7 +12746,6 @@ var V2_OPERATIONS = {
     pathParamDocs: { workflowId: "Unique workflow identifier." },
     responseMode: "json",
     summary: "Replace Workflow State",
-    workspaceKeyUnsupported: true,
     query: {
       dryRun: {
         kind: "boolean",
@@ -13458,7 +13432,7 @@ var V2_OPERATIONS = {
         kind: "enum",
         values: ["streamable-http"],
         default: "streamable-http",
-        describe: "Transport protocol. Defaults to `streamable-http` on creation."
+        describe: "Transport used to communicate with the server. Applied server-side as `streamable-http` when omitted on create."
       },
       url: {
         kind: "string",
@@ -13476,17 +13450,17 @@ var V2_OPERATIONS = {
       timeout: {
         kind: "integer",
         default: 30000,
-        describe: "Per-request timeout in milliseconds. Defaults to 30000 on creation."
+        describe: "Per-request timeout in milliseconds. Applied server-side as 30000 when omitted on create."
       },
       retries: {
         kind: "integer",
         default: 3,
-        describe: "Number of retries per request. Defaults to 3 on creation."
+        describe: "Number of retries per request. Applied server-side as 3 when omitted on create."
       },
       enabled: {
         kind: "boolean",
         default: true,
-        describe: "Whether workflows can use the server's tools. Defaults to true on creation."
+        describe: "Whether the server tools are available to workflows. Applied server-side as true when omitted on create."
       },
       oauthClientId: {
         kind: "string",
@@ -13970,12 +13944,12 @@ function addProfileCommand() {
     console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
-async function chooseLoginFlow(profile, options) {
+async function chooseLoginFlow(profile, options, scope) {
   requireSecureEndpoint(profile.endpoint);
-  if (options.method === "api-key")
+  if (options.browserless || scope === "copilot")
     return "handoff";
-  if (options.method === undefined && isLikelyRemoteSession() && options.callbackPort === undefined) {
-    console.log(source_default.dim(`This looks like a remote session; using the pairing code to create a personal API key. To use OAuth, forward a port and pass --method oauth --callback-port <port>.
+  if (isLikelyRemoteSession() && options.callbackPort === undefined) {
+    console.log(source_default.dim(`This looks like a remote session, so the browser on this machine cannot finish an OAuth login; using the pairing code instead. Forward a port and pass --callback-port <port> to sign in through the browser anyway.
 `));
     return "handoff";
   }
@@ -13984,10 +13958,7 @@ async function chooseLoginFlow(profile, options) {
     throw new SimApiError(`Could not reach ${profile.endpoint}. Check the endpoint.`, 0);
   }
   if (status === "unavailable") {
-    if (options.method === "oauth") {
-      throw new SimApiError(`${profile.endpoint} does not offer OAuth sign-in. Enable OAuth on the server or explicitly choose sim login --method api-key.`, 0);
-    }
-    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code to create a personal API key.
+    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code instead.
 `));
     return "handoff";
   }
@@ -14053,24 +14024,28 @@ Waiting for you to approve in the browser…`));
     try {
       await revokeToken(profile.endpoint, tokens.refreshToken);
     } catch (revocationError) {
-      console.log(source_default.yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → General → Authorized apps.`));
+      console.log(source_default.yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → Authorized apps.`));
     }
     throw error;
   }
   console.log(source_default.green(`
 ✓ Logged in. Login stored in ${credentialsPath()}`));
-  console.log(source_default.dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → General → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
+  console.log(source_default.dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
   if (!profile.workspaceId) {
     console.log(source_default.dim("  No default workspace. Set one with: sim configure --set-workspace <id>"));
   }
 }
 function loginCommand() {
-  return new Command("login").description("Sign in through the browser and store the login for the profile").addOption(new Option("--method <method>", "Credential to obtain: oauth requires OAuth support; api-key creates a permanent key through pairing (auto-selects when omitted)").choices(["oauth", "api-key"])).option("--no-browser", "Print the approval URL without opening it (either login method)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
+  return new Command("login").description("Sign in through the browser and store the login for the profile").option("--scope <scope>", 'Key space for the pairing-code handoff; only "copilot" changes anything, and it forces that flow', "platform").option("--no-browser", "Print the URL instead of opening a browser").option("--browserless", "Use the pairing-code handoff for a terminal whose browser cannot reach it (SSH, containers)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
       throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Run: sim login --profile ${redact(authProfile)}`, 0);
     }
+    if (options.scope !== "platform" && options.scope !== "copilot") {
+      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
+    }
+    const scope = options.scope;
     const snapshot = readLoginProfileSnapshot(profile.name);
     const storedCredential = snapshot.credential;
     if (storedCredential?.kind === "oauth") {
@@ -14084,13 +14059,13 @@ function loginCommand() {
       }
     }
     const callbackPort = parseCallbackPort(options.callbackPort);
-    const loginFlow = await chooseLoginFlow(profile, options);
+    const loginFlow = await chooseLoginFlow(profile, options, scope);
     if (loginFlow === "handoff") {
       if (options.readOnly) {
-        throw new SimApiError("API-key login cannot issue a read-only login. Use --method oauth, or drop --read-only.", 0);
+        throw new SimApiError("The pairing-code handoff cannot issue a read-only login; it mints a full API key. Drop --read-only, or sign in through the browser.", 0);
       }
       if (callbackPort !== undefined) {
-        throw new SimApiError("API-key login has no local callback, so --callback-port does not apply. Use --method oauth, or drop --callback-port.", 0);
+        throw new SimApiError("The pairing-code handoff has no local callback, so --callback-port does not apply. Drop it, or sign in through the browser.", 0);
       }
     }
     await withProfileLoginLease(profile.name, async () => {
@@ -14099,13 +14074,13 @@ function loginCommand() {
         await loginWithOAuth(profile, options, callbackPort, snapshot);
         return;
       }
-      await loginWithHandoff(profile, options, snapshot);
+      await loginWithHandoff(profile, options, scope, snapshot);
     });
   });
 }
-async function loginWithHandoff(profile, options, expected) {
+async function loginWithHandoff(profile, options, scope, expected) {
   const auth = createAuthRequest();
-  const url = buildApprovalUrl(profile.endpoint, auth, profile.workspaceId ?? undefined);
+  const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
   console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
   console.log(`
 Pairing code: ${source_default.bold(auth.pairing)}`);
@@ -14118,8 +14093,8 @@ Pairing code: ${source_default.bold(auth.pairing)}`);
 Waiting for approval…`));
   const key = await pollForKey(profile.endpoint, auth);
   try {
-    if (key.scope !== "platform") {
-      throw new SimApiError(`Server issued a ${key.scope} key, but the CLI requires a platform API key. Update the Sim deployment and try again.`, 0);
+    if (key.scope !== scope) {
+      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
     }
     const settings = {
       endpoint: profile.endpoint,
@@ -14180,7 +14155,7 @@ async function revokeStoredOAuth(credential) {
     await revokeToken(endpoint, credential.refreshToken);
     console.log(source_default.dim("  Signed out of Sim; every token from this login was revoked."));
   } catch (error) {
-    console.log(source_default.yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → General → Authorized apps.`));
+    console.log(source_default.yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → Authorized apps.`));
   }
 }
 function logoutCommand() {
@@ -16082,30 +16057,7 @@ function buildRequest(operation, positional, flags, workspaceId) {
 }
 
 // src/runtime/options.ts
-var DEFAULT_PAGE_SIZE = 100;
-var COMPLETE_LIST_OPERATIONS = new Set([
-  "listBlocks",
-  "listChatDeployments",
-  "listCredentials",
-  "listCustomTools",
-  "listFiles",
-  "listKnowledgeBases",
-  "listKnowledgeConnectors",
-  "listMcpServers",
-  "listSandboxes",
-  "listSecrets",
-  "listSkillEditors",
-  "listSkills",
-  "listTables",
-  "listTools",
-  "listWorkflowMcpServers",
-  "listWorkflows",
-  "listWorkspaceMembers",
-  "listWorkspaces"
-]);
-function defaultListLimit(operation) {
-  return COMPLETE_LIST_OPERATIONS.has(operation) ? 0 : 100;
-}
+var DEFAULT_LIMIT = 100;
 function describeField(flag, descriptor, name, field) {
   return flag.describe ?? descriptor.describe ?? `Set ${name.replaceAll("-", " ") || field}`;
 }
@@ -16118,21 +16070,15 @@ function withoutWireVocabulary(documented) {
 }
 var NON_PAGINATED_LIMIT_HINT = " (caps a --filter match only; omit it to act on every match, and note 0 is not accepted)";
 function addFieldOption(command, operation, field, descriptor, slot, paginates, capsAFilter) {
-  if (field === PROFILE_INJECTED_FIELD)
-    return;
-  if (field === "cursor") {
-    if (paginates && defaultListLimit(operation) > 0) {
-      command.option("--cursor <value>", "Continue from nextCursor returned by a previous result");
-    }
+  if (field === PROFILE_INJECTED_FIELD || field === "cursor")
     return;
-  }
   const flag = flagSpecFor(operation, field);
   if (flag.omit)
     return;
   const name = flagNameFor(operation, field);
   const short = flag.short ? `-${flag.short}, ` : "";
   if (paginates && field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer")) {
-    command.option("--limit <n>", "Maximum items to return (0 for everything)", String(defaultListLimit(operation)));
+    command.option("--limit <n>", "Maximum items to return (0 for everything)", String(DEFAULT_LIMIT));
     return;
   }
   const documented = `${describeField(flag, descriptor, name, field)}${capsAFilter && field === "limit" && (descriptor.kind === "number" || descriptor.kind === "integer") ? NON_PAGINATED_LIMIT_HINT : ""}`;
@@ -16492,10 +16438,11 @@ function unwrapResource(data) {
   const [, value] = entries[0];
   return value && typeof value === "object" && !Array.isArray(value) ? value : data;
 }
-function renderPage(format, page, spec, envelope) {
+function renderPage(format, rows, spec, envelope, options = {}) {
   writePageNote(spec, envelope);
   writeEnvelopeTruncation(envelope);
-  printList(format, page.data, spec.columns ? columnsFrom(spec.columns) : inferColumns(page.data, spec.expand), page);
+  writeCursorTruncation(rows.length, options.truncated === true);
+  printList(format, rows, spec.columns ? columnsFrom(spec.columns) : inferColumns(rows, spec.expand));
 }
 function writePageNote(spec, envelope) {
   if (!spec.pageNote)
@@ -16540,6 +16487,12 @@ function writeEnvelopeTruncation(envelope) {
 `));
   }
 }
+function writeCursorTruncation(count, truncated) {
+  if (!truncated)
+    return;
+  process.stderr.write(source_default.dim(`showing the first ${count}; more results exist — re-run with --limit 0 for all
+`));
+}
 function renderResult(operation, format, raw, spec, options = {}, envelope) {
   writeEnvelopeTruncation(envelope);
   if (spec.document) {
@@ -16676,8 +16629,8 @@ function bulkFailureMessage(operation, payload, body) {
 var EXCLUSIVE_CAP_FIELDS = {
   deleteTableRows: { cap: "limit", ids: "rowIds" }
 };
-function readPagedLimit(raw, operation) {
-  const text = String(raw ?? defaultListLimit(operation)).trim();
+function readPagedLimit(raw) {
+  const text = String(raw ?? DEFAULT_LIMIT).trim();
   const value = text === "" ? Number.NaN : Number(text);
   if (!Number.isInteger(value) || value < 0) {
     throw new SimApiError("--limit must be a whole number of 0 or more (0 for everything)", 0);
@@ -16752,33 +16705,24 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
   const omitsWorkspace = commandSpec.allWorkspaces && requestFlags.allWorkspaces === true;
   const needsWorkspace = (hasWorkspaceField || commandSpec.profileWorkspacePath === true) && !omitsWorkspace;
   const paging = cursorSlot(operationSpec);
-  const pagedLimit = paging ? readPagedLimit(requestFlags.limit, operation) : 0;
+  const pagedLimit = paging ? readPagedLimit(requestFlags.limit) : 0;
   const request = buildRequest(operation, positional, requestFlags, needsWorkspace ? client.requireWorkspace() : profile.workspaceId);
   if (paging) {
-    const initialCursor = request[paging]?.cursor;
-    if (initialCursor !== undefined && (typeof initialCursor !== "string" || initialCursor.trim() === "")) {
-      throw new SimApiError("--cursor must be a non-empty string", 0);
-    }
     const limit = pagedLimit === 0 ? Number.POSITIVE_INFINITY : pagedLimit;
+    const pageSize = Math.min(Number.isFinite(limit) ? limit : DEFAULT_LIMIT, DEFAULT_LIMIT);
+    const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
     const rows = [];
-    const seenCursors = new Set(initialCursor ? [initialCursor] : []);
     const progress = pageProgress();
-    let cursor = initialCursor ?? null;
+    let cursor = null;
     let envelope;
     try {
       do {
-        const pageSize = Math.min(DEFAULT_PAGE_SIZE, limit - rows.length);
-        const pageLimit = "limit" in (operationSpec[paging] ?? {}) ? { limit: pageSize } : {};
         const page = await client.request(request.path, {
           method: operationSpec.method,
           headers: request.headers,
           query: paging === "query" ? { ...request.query, ...pageLimit, cursor } : request.query,
           body: paging === "body" ? { ...request.body ?? {}, ...pageLimit, ...cursor ? { cursor } : {} } : request.body
         });
-        if (page.data.length > pageSize) {
-          throw new SimApiError(`The API returned ${page.data.length} items for a page limit of ${pageSize}; nextCursor would skip unreturned items.`, 0);
-        }
-        assertCursorAdvances(page.nextCursor, seenCursors);
         envelope = foldPageEnvelope(envelope, page);
         rows.push(...page.data);
         cursor = page.nextCursor;
@@ -16788,7 +16732,7 @@ async function executeOperation(operation, commandSpec, operationSpec, invocatio
     } finally {
       progress.finish();
     }
-    renderPage(profile.output, { data: rows, nextCursor: cursor }, commandSpec, envelope);
+    renderPage(profile.output, Number.isFinite(limit) ? rows.slice(0, limit) : rows, commandSpec, envelope, { truncated: Boolean(cursor) });
     return;
   }
   const result = await client.request(request.path, {
@@ -17296,47 +17240,6 @@ function attachCredentialCommands(program) {
   credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description(describeOperation(V2_OPERATIONS.createCredentialConnection, "Create a short-lived link for reconnecting an OAuth credential")).action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
 }
 
-// src/http/ndjson.ts
-async function* readNdjson(body, protocol) {
-  if (!body) {
-    throw new SimApiError(`${protocol} ended without a response body`, 0);
-  }
-  const reader = body.getReader();
-  const decoder = new TextDecoder;
-  let buffer = "";
-  const parse = (line) => {
-    const trimmed = line.trim();
-    if (!trimmed)
-      return;
-    try {
-      return JSON.parse(trimmed);
-    } catch {
-      throw new SimApiError(`${protocol} returned malformed data`, 0);
-    }
-  };
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
-      const lines = buffer.split(`
-`);
-      buffer = done ? "" : lines.pop() ?? "";
-      for (const line of lines) {
-        const event = parse(line);
-        if (event !== undefined)
-          yield event;
-      }
-      if (done)
-        return;
-    }
-  } finally {
-    reader.cancel().catch(() => {
-      return;
-    });
-    reader.releaseLock();
-  }
-}
-
 // src/commands/protocol/result.ts
 function printProtocolResult(format, result) {
   const fields = Object.entries(result).map(([key, value]) => [key, text(value)]);
@@ -17344,28 +17247,72 @@ function printProtocolResult(format, result) {
 }
 
 // src/commands/protocol/chat.ts
+function parseChatStreamLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed)
+    return;
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    throw new SimApiError("Chat stream returned malformed data", 0);
+  }
+}
 async function readChatStream(response, onChunk) {
-  for await (const value of readNdjson(response.body, "Chat stream")) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-      throw new SimApiError("Chat stream returned an unknown event", 0);
-    }
-    const event = value;
-    if (event.type === "heartbeat")
-      continue;
+  if (!response.body) {
+    throw new SimApiError("Chat stream ended without a response body", 0);
+  }
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  let finalResult;
+  const processLine = (line) => {
+    const event = parseChatStreamLine(line);
+    if (!event || event.type === "heartbeat")
+      return false;
     if (event.type === "chunk") {
       if (event.content)
         onChunk(sanitize(event.content));
-      continue;
+      return false;
     }
     if (event.type === "error") {
       throw new SimApiError(event.error || "Chat request failed", 0);
     }
     if (event.type === "final") {
-      return event.data;
+      finalResult = event.data;
+      return true;
     }
     throw new SimApiError("Chat stream returned an unknown event", 0);
+  };
+  try {
+    let ended = false;
+    while (!ended) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
+`);
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (processLine(line)) {
+          ended = true;
+          break;
+        }
+      }
+    }
+    if (!ended) {
+      buffer += decoder.decode();
+      processLine(buffer);
+    }
+    if (!finalResult) {
+      throw new SimApiError("Chat stream ended without a final result", 0);
+    }
+    return finalResult;
+  } finally {
+    reader.cancel().catch(() => {
+      return;
+    });
   }
-  throw new SimApiError("Chat stream ended without a final result", 0);
 }
 function ignoreBrokenPipe(stream) {
   const onError = (error) => {
@@ -18140,11 +18087,11 @@ async function listResources(client, config, workspaceId, folderPath, search, li
   const paginated = "cursor" in V2_OPERATIONS[config.resources].query;
   if (!paginated) {
     const page = await client.request(path, { query });
-    return page.data.slice(0, limit);
+    return { items: page.data.slice(0, limit), truncated: page.data.length > limit };
   }
-  return requestAllPages(client, path, {
+  return requestPages(client, path, {
     query,
-    pageSize: DEFAULT_PAGE_SIZE,
+    pageSize: DEFAULT_LIMIT,
     limit
   });
 }
@@ -18174,7 +18121,7 @@ function entriesFor(config, folders, resources) {
   ].sort((left, right) => left.name.localeCompare(right.name) || left.kind.localeCompare(right.kind));
 }
 function attachResourceDirectoryCommands(group, config) {
-  group.command("ls").argument("[path]", "Folder path to list; defaults to the root folder").allowExcessArguments(false).description(`List ${config.kind} resources and child folders together`).option("--search <text>", "Filter folders and resources by name").addOption(new Option("--limit <n>", "Maximum combined items to return (0 for everything)").default("0")).action(async (path, options, command) => {
+  group.command("ls").argument("[path]", "Folder path to list; defaults to the root folder").allowExcessArguments(false).description(`List ${config.kind} resources and child folders together`).option("--search <text>", "Filter folders and resources by name").addOption(new Option("--limit <n>", "Maximum combined items to return (0 for everything)").default(String(DEFAULT_LIMIT))).action(async (path, options, command) => {
     const rawLimit = Number(options.limit);
     if (!Number.isSafeInteger(rawLimit) || rawLimit < 0) {
       throw new SimApiError("--limit must be a whole number of 0 or more (0 for everything)", 0);
@@ -18187,8 +18134,9 @@ function attachResourceDirectoryCommands(group, config) {
       listFolders(client, config.folders, workspaceId, folderPath, options.search),
       listResources(client, config, workspaceId, folderPath, options.search, limit)
     ]);
-    const entries = entriesFor(config, folders, resources);
+    const entries = entriesFor(config, folders, resources.items);
     const shown = entries.slice(0, limit);
+    writeCursorTruncation(shown.length, resources.truncated || entries.length > limit);
     printList(profile.output, shown, COLUMNS2);
   });
   group.command("mkdir").argument("<path>", "Folder path to create; the leading / is optional").allowExcessArguments(false).description(`Create a ${config.kind} directory at a path`).action(async (path, _options, command) => {
@@ -18355,7 +18303,6 @@ function attachTableImport(tables) {
 // src/commands/protocol/workflow-run-follow.ts
 var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
 var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
-var WORKFLOW_RESULT_STREAM_CONTENT_TYPE = "application/x-ndjson";
 var DONE_SENTINEL = "[DONE]";
 function resolveWorkflowRunSelection(flags) {
   const manual = flags.manual === true;
@@ -18407,59 +18354,6 @@ function stringField(frame, key) {
   const value = frame[key];
   return typeof value === "string" ? value : null;
 }
-async function readWorkflowResult(response) {
-  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
-  if (!contentType.includes(WORKFLOW_RESULT_STREAM_CONTENT_TYPE)) {
-    let envelope;
-    try {
-      envelope = await response.json();
-    } catch {
-      throw new SimApiError(`Workflow run returned malformed JSON${contentType ? ` as ${contentType}` : ""}`, response.status);
-    }
-    if (!isRecord(envelope)) {
-      throw new SimApiError("Workflow run returned an invalid result envelope", response.status);
-    }
-    return isRecord(envelope.data) ? envelope.data : envelope;
-  }
-  for await (const value of readNdjson(response.body, "Workflow result stream")) {
-    if (!isRecord(value) || typeof value.type !== "string") {
-      throw new SimApiError("Workflow result stream returned an unknown event", response.status);
-    }
-    if (value.type === "heartbeat")
-      continue;
-    if (value.type === "error") {
-      throw new SimApiError(safeOneLine(typeof value.error === "string" ? value.error : "Workflow run failed"), typeof value.status === "number" ? value.status : 0, typeof value.code === "string" ? value.code : null);
-    }
-    if (value.type === "final" && isRecord(value.data))
-      return value.data;
-    throw new SimApiError("Workflow result stream returned an unknown event", response.status);
-  }
-  throw new SimApiError("Workflow result stream ended without a final result", response.status);
-}
-async function runWithResultStream(workflowId, command) {
-  const flags = command.optsWithGlobals();
-  const { client, profile } = clientFrom(command);
-  const operation = V2_OPERATIONS.executeWorkflow;
-  const commandSpec = CLI_CONTRACT.executeWorkflow ?? {};
-  try {
-    const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
-    const response = await client.requestRaw(request.path, {
-      method: operation.method,
-      query: request.query,
-      body: request.body,
-      headers: { ...request.headers, accept: WORKFLOW_RESULT_STREAM_CONTENT_TYPE }
-    });
-    const payload = await readWorkflowResult(response);
-    renderResult("executeWorkflow", profile.output, payload, commandSpec, {
-      expandedTrace: flags.trace === true
-    });
-    const failure = runFailureMessage("executeWorkflow", payload);
-    if (failure)
-      throw new SimApiError(failure, 0);
-  } catch (error) {
-    throw retypeApiError(error, "executeWorkflow", commandSpec, operation);
-  }
-}
 async function* sseData(body) {
   const reader = body.getReader();
   const decoder = new TextDecoder;
@@ -18631,10 +18525,6 @@ function followOrDelegate(previous) {
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
       }
-      if (flags.async !== true) {
-        await runWithResultStream(workflowId, command);
-        return;
-      }
       if (previous) {
         await previous(command.processedArgs);
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.8-preview.102.1",
+  "version": "2.1.8-preview.96.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {