sim 2.1.8-preview.96.1 → 2.1.8-preview.98.1

package/README.md

@@ -33,16 +33,27 @@ Sign in to the default profile:
 sim login
 ```
 
-The CLI opens Sim in your browser, asks you to approve the requested access,
+With no `--method`, the CLI prefers OAuth when the server offers it and a local
+browser callback is possible. It selects API-key pairing for remote terminals
+or servers without OAuth. Use `sim login --method oauth` to require OAuth;
+if the server does not offer it, login fails without creating an API key.
+
+OAuth login opens Sim in your browser, asks you to approve the requested access,
 and receives the one-time authorization code on a loopback callback. It stores
 a short-lived OAuth login that renews automatically and can be revoked under
-**Settings → Authorized apps**. Choose a default workspace afterward with
+**Settings → General → Authorized apps**. Choose a default workspace afterward with
 `sim configure --set-workspace <id>`.
 
-Use `sim login --no-browser` to print the OAuth URL without opening it. The
-browser must still be able to reach the CLI's loopback callback. Over SSH or in
-a container without port forwarding, use `sim login --browserless`; that
-pairing-code fallback creates a permanent personal API key instead.
+Use `--no-browser` with either method to print the approval URL without opening
+it. OAuth still needs the browser to reach the CLI's loopback callback. Over SSH
+or in a container without port forwarding, use
+`sim login --method api-key --no-browser` to approve from another device and
+create a permanent personal API key. `--method api-key` creates a new key;
+set `SIM_API_KEY` to supply an existing one.
+
+Pairing requires a server that supports `platform` API keys. Upgrade older
+deployments that only issue `copilot` keys before login; they are not compatible
+with the platform CLI. OAuth discovery does not check pairing compatibility.
 
 Check the active profile and verify that its endpoint, credential, and workspace
 work together:

package/dist/index.js

@@ -8140,12 +8140,12 @@ function createAuthRequest() {
     pairing: pairingCode()
   };
 }
-function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
+function buildApprovalUrl(endpoint, auth, workspaceId) {
   return buildUrl(endpoint, APPROVAL_PATH, {
     request: auth.request,
     challenge: auth.challenge,
     pairing: auth.pairing,
-    scope,
+    scope: "platform",
     workspace: workspaceId
   });
 }
@@ -8451,7 +8451,7 @@ function listenForCallback(server, expectedState, completionUrl, signal, timeout
     const onAbort = () => finish({ ok: false, error: new SimApiError("Login cancelled.", 0) });
     const timer = setTimeout(() => finish({
       ok: false,
-      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --browserless if this terminal's browser cannot reach it.`, 0)
+      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --method api-key if this terminal's browser cannot reach it.`, 0)
     }), timeoutMs);
     signal?.addEventListener("abort", onAbort, { once: true });
     server.on("request", (request, response) => {
@@ -13944,12 +13944,12 @@ function addProfileCommand() {
     console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
-async function chooseLoginFlow(profile, options, scope) {
+async function chooseLoginFlow(profile, options) {
   requireSecureEndpoint(profile.endpoint);
-  if (options.browserless || scope === "copilot")
+  if (options.method === "api-key")
     return "handoff";
-  if (isLikelyRemoteSession() && options.callbackPort === undefined) {
-    console.log(source_default.dim(`This looks like a remote session, so the browser on this machine cannot finish an OAuth login; using the pairing code instead. Forward a port and pass --callback-port <port> to sign in through the browser anyway.
+  if (options.method === undefined && isLikelyRemoteSession() && options.callbackPort === undefined) {
+    console.log(source_default.dim(`This looks like a remote session; using the pairing code to create a personal API key. To use OAuth, forward a port and pass --method oauth --callback-port <port>.
 `));
     return "handoff";
   }
@@ -13958,7 +13958,10 @@ async function chooseLoginFlow(profile, options, scope) {
     throw new SimApiError(`Could not reach ${profile.endpoint}. Check the endpoint.`, 0);
   }
   if (status === "unavailable") {
-    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code instead.
+    if (options.method === "oauth") {
+      throw new SimApiError(`${profile.endpoint} does not offer OAuth sign-in. Enable OAuth on the server or explicitly choose sim login --method api-key.`, 0);
+    }
+    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code to create a personal API key.
 `));
     return "handoff";
   }
@@ -14024,28 +14027,24 @@ Waiting for you to approve in the browser…`));
     try {
       await revokeToken(profile.endpoint, tokens.refreshToken);
     } catch (revocationError) {
-      console.log(source_default.yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → Authorized apps.`));
+      console.log(source_default.yellow(`Could not revoke the uncommitted login (${safeOneLine(getErrorMessage(revocationError))}). Revoke Sim CLI in Settings → General → Authorized apps.`));
     }
     throw error;
   }
   console.log(source_default.green(`
 ✓ Logged in. Login stored in ${credentialsPath()}`));
-  console.log(source_default.dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
+  console.log(source_default.dim(grantsWriteAccess(tokens.scope) ? "  Renews itself; revoke it any time in Settings → General → Authorized apps, or with: sim logout" : "  Read-only login — commands that change anything will be refused."));
   if (!profile.workspaceId) {
     console.log(source_default.dim("  No default workspace. Set one with: sim configure --set-workspace <id>"));
   }
 }
 function loginCommand() {
-  return new Command("login").description("Sign in through the browser and store the login for the profile").option("--scope <scope>", 'Key space for the pairing-code handoff; only "copilot" changes anything, and it forces that flow', "platform").option("--no-browser", "Print the URL instead of opening a browser").option("--browserless", "Use the pairing-code handoff for a terminal whose browser cannot reach it (SSH, containers)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
+  return new Command("login").description("Sign in through the browser and store the login for the profile").addOption(new Option("--method <method>", "Credential to obtain: oauth requires OAuth support; api-key creates a permanent key through pairing (auto-selects when omitted)").choices(["oauth", "api-key"])).option("--no-browser", "Print the approval URL without opening it (either login method)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
       throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Run: sim login --profile ${redact(authProfile)}`, 0);
     }
-    if (options.scope !== "platform" && options.scope !== "copilot") {
-      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
-    }
-    const scope = options.scope;
     const snapshot = readLoginProfileSnapshot(profile.name);
     const storedCredential = snapshot.credential;
     if (storedCredential?.kind === "oauth") {
@@ -14059,13 +14058,13 @@ function loginCommand() {
       }
     }
     const callbackPort = parseCallbackPort(options.callbackPort);
-    const loginFlow = await chooseLoginFlow(profile, options, scope);
+    const loginFlow = await chooseLoginFlow(profile, options);
     if (loginFlow === "handoff") {
       if (options.readOnly) {
-        throw new SimApiError("The pairing-code handoff cannot issue a read-only login; it mints a full API key. Drop --read-only, or sign in through the browser.", 0);
+        throw new SimApiError("API-key login cannot issue a read-only login. Use --method oauth, or drop --read-only.", 0);
       }
       if (callbackPort !== undefined) {
-        throw new SimApiError("The pairing-code handoff has no local callback, so --callback-port does not apply. Drop it, or sign in through the browser.", 0);
+        throw new SimApiError("API-key login has no local callback, so --callback-port does not apply. Use --method oauth, or drop --callback-port.", 0);
       }
     }
     await withProfileLoginLease(profile.name, async () => {
@@ -14074,13 +14073,13 @@ function loginCommand() {
         await loginWithOAuth(profile, options, callbackPort, snapshot);
         return;
       }
-      await loginWithHandoff(profile, options, scope, snapshot);
+      await loginWithHandoff(profile, options, snapshot);
     });
   });
 }
-async function loginWithHandoff(profile, options, scope, expected) {
+async function loginWithHandoff(profile, options, expected) {
   const auth = createAuthRequest();
-  const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
+  const url = buildApprovalUrl(profile.endpoint, auth, profile.workspaceId ?? undefined);
   console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
   console.log(`
 Pairing code: ${source_default.bold(auth.pairing)}`);
@@ -14093,8 +14092,8 @@ Pairing code: ${source_default.bold(auth.pairing)}`);
 Waiting for approval…`));
   const key = await pollForKey(profile.endpoint, auth);
   try {
-    if (key.scope !== scope) {
-      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+    if (key.scope !== "platform") {
+      throw new SimApiError(`Server issued a ${key.scope} key, but the CLI requires a platform API key. Update the Sim deployment and try again.`, 0);
     }
     const settings = {
       endpoint: profile.endpoint,
@@ -14155,7 +14154,7 @@ async function revokeStoredOAuth(credential) {
     await revokeToken(endpoint, credential.refreshToken);
     console.log(source_default.dim("  Signed out of Sim; every token from this login was revoked."));
   } catch (error) {
-    console.log(source_default.yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → Authorized apps.`));
+    console.log(source_default.yellow(`  Could not revoke the login on ${displayEndpoint} (${safeOneLine(getErrorMessage(error))}). Revoke it in Settings → General → Authorized apps.`));
   }
 }
 function logoutCommand() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.8-preview.96.1",
+  "version": "2.1.8-preview.98.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {