sim 2.1.8-preview.97.1 → 2.1.8-preview.99.1

package/README.md

@@ -33,16 +33,27 @@ Sign in to the default profile:
 sim login
 ```
 
-The CLI opens Sim in your browser, asks you to approve the requested access,
+With no `--method`, the CLI prefers OAuth when the server offers it and a local
+browser callback is possible. It selects API-key pairing for remote terminals
+or servers without OAuth. Use `sim login --method oauth` to require OAuth;
+if the server does not offer it, login fails without creating an API key.
+
+OAuth login opens Sim in your browser, asks you to approve the requested access,
 and receives the one-time authorization code on a loopback callback. It stores
 a short-lived OAuth login that renews automatically and can be revoked under
 **Settings → General → Authorized apps**. Choose a default workspace afterward with
 `sim configure --set-workspace <id>`.
 
-Use `sim login --no-browser` to print the OAuth URL without opening it. The
-browser must still be able to reach the CLI's loopback callback. Over SSH or in
-a container without port forwarding, use `sim login --browserless`; that
-pairing-code fallback creates a permanent personal API key instead.
+Use `--no-browser` with either method to print the approval URL without opening
+it. OAuth still needs the browser to reach the CLI's loopback callback. Over SSH
+or in a container without port forwarding, use
+`sim login --method api-key --no-browser` to approve from another device and
+create a permanent personal API key. `--method api-key` creates a new key;
+set `SIM_API_KEY` to supply an existing one.
+
+Pairing requires a server that supports `platform` API keys. Upgrade older
+deployments that only issue `copilot` keys before login; they are not compatible
+with the platform CLI. OAuth discovery does not check pairing compatibility.
 
 Check the active profile and verify that its endpoint, credential, and workspace
 work together:

package/dist/index.js

@@ -4460,6 +4460,22 @@ function toApiError(url, status, contentType, raw) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…`;
 }
+function transportErrorMessage(error) {
+  const messages = [];
+  const seen = new Set;
+  let current = error;
+  while (current && typeof current === "object" && messages.length < 4 && !seen.has(current)) {
+    seen.add(current);
+    const candidate = current;
+    const message = typeof candidate.message === "string" ? truncate(candidate.message.replace(/\s+/g, " ").trim(), 300) : "";
+    const code = typeof candidate.code === "string" ? candidate.code : "";
+    const detail = `${message}${code && !message.includes(code) ? ` (${code})` : ""}`;
+    if (detail && messages.at(-1) !== detail)
+      messages.push(detail);
+    current = candidate.cause;
+  }
+  return messages.join(": ") || "Unknown network error";
+}
 function namesKeyScopeRefusal(error) {
   if (typeof error.code === "string" && KEY_SCOPE_REFUSALS.has(error.code))
     return true;
@@ -4683,7 +4699,7 @@ class SimClient {
       if (timeout?.aborted) {
         throw new SimApiError(`${url} did not answer within ${timeoutMs / 1000}s. ${RAISE_TIMEOUT_HINT}`, 0);
       }
-      throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${cause.message}`, 0);
+      throw new SimApiError(`Could not reach ${this.profile.endpoint}: ${transportErrorMessage(cause)}`, 0);
     }
     if (trace)
       traceRequest(method, url, response.status, startedAt);
@@ -8140,12 +8156,12 @@ function createAuthRequest() {
     pairing: pairingCode()
   };
 }
-function buildApprovalUrl(endpoint, auth, scope, workspaceId) {
+function buildApprovalUrl(endpoint, auth, workspaceId) {
   return buildUrl(endpoint, APPROVAL_PATH, {
     request: auth.request,
     challenge: auth.challenge,
     pairing: auth.pairing,
-    scope,
+    scope: "platform",
     workspace: workspaceId
   });
 }
@@ -8451,7 +8467,7 @@ function listenForCallback(server, expectedState, completionUrl, signal, timeout
     const onAbort = () => finish({ ok: false, error: new SimApiError("Login cancelled.", 0) });
     const timer = setTimeout(() => finish({
       ok: false,
-      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --browserless if this terminal's browser cannot reach it.`, 0)
+      error: new SimApiError(`Timed out after ${Math.round(timeoutMs / 60000)} minutes waiting for the browser. Run sim login again, or use --method api-key if this terminal's browser cannot reach it.`, 0)
     }), timeoutMs);
     signal?.addEventListener("abort", onAbort, { once: true });
     server.on("request", (request, response) => {
@@ -13944,12 +13960,12 @@ function addProfileCommand() {
     console.log(source_default.dim(`  Try: sim --profile ${safeOneLine(profileName)} whoami`));
   });
 }
-async function chooseLoginFlow(profile, options, scope) {
+async function chooseLoginFlow(profile, options) {
   requireSecureEndpoint(profile.endpoint);
-  if (options.browserless || scope === "copilot")
+  if (options.method === "api-key")
     return "handoff";
-  if (isLikelyRemoteSession() && options.callbackPort === undefined) {
-    console.log(source_default.dim(`This looks like a remote session, so the browser on this machine cannot finish an OAuth login; using the pairing code instead. Forward a port and pass --callback-port <port> to sign in through the browser anyway.
+  if (options.method === undefined && isLikelyRemoteSession() && options.callbackPort === undefined) {
+    console.log(source_default.dim(`This looks like a remote session; using the pairing code to create a personal API key. To use OAuth, forward a port and pass --method oauth --callback-port <port>.
 `));
     return "handoff";
   }
@@ -13958,7 +13974,10 @@ async function chooseLoginFlow(profile, options, scope) {
     throw new SimApiError(`Could not reach ${profile.endpoint}. Check the endpoint.`, 0);
   }
   if (status === "unavailable") {
-    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code instead.
+    if (options.method === "oauth") {
+      throw new SimApiError(`${profile.endpoint} does not offer OAuth sign-in. Enable OAuth on the server or explicitly choose sim login --method api-key.`, 0);
+    }
+    console.log(source_default.dim(`${profile.endpoint} does not offer OAuth sign-in; using the pairing code to create a personal API key.
 `));
     return "handoff";
   }
@@ -14036,16 +14055,12 @@ Waiting for you to approve in the browser…`));
   }
 }
 function loginCommand() {
-  return new Command("login").description("Sign in through the browser and store the login for the profile").option("--scope <scope>", 'Key space for the pairing-code handoff; only "copilot" changes anything, and it forces that flow', "platform").option("--no-browser", "Print the URL instead of opening a browser").option("--browserless", "Use the pairing-code handoff for a terminal whose browser cannot reach it (SSH, containers)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
+  return new Command("login").description("Sign in through the browser and store the login for the profile").addOption(new Option("--method <method>", "Credential to obtain: oauth requires OAuth support; api-key creates a permanent key through pairing (auto-selects when omitted)").choices(["oauth", "api-key"])).option("--no-browser", "Print the approval URL without opening it (either login method)").option("--read-only", "Ask only for permission to read, never to change anything").option("--callback-port <port>", "Pin the local port the browser returns to").option("-y, --yes", "Overwrite an existing API-key profile without prompting").action(async (options, command) => {
     const profile = profileFrom(command, { allowUnknownProfile: true });
     const authProfile = resolveAuthenticationProfileName(profile.name);
     if (authProfile !== profile.name) {
       throw new SimApiError(`Profile "${redact(profile.name)}" shares authentication with "${redact(authProfile)}". Run: sim login --profile ${redact(authProfile)}`, 0);
     }
-    if (options.scope !== "platform" && options.scope !== "copilot") {
-      throw new SimApiError(`Unknown scope "${options.scope}". Use platform or copilot.`, 0);
-    }
-    const scope = options.scope;
     const snapshot = readLoginProfileSnapshot(profile.name);
     const storedCredential = snapshot.credential;
     if (storedCredential?.kind === "oauth") {
@@ -14059,13 +14074,13 @@ function loginCommand() {
       }
     }
     const callbackPort = parseCallbackPort(options.callbackPort);
-    const loginFlow = await chooseLoginFlow(profile, options, scope);
+    const loginFlow = await chooseLoginFlow(profile, options);
     if (loginFlow === "handoff") {
       if (options.readOnly) {
-        throw new SimApiError("The pairing-code handoff cannot issue a read-only login; it mints a full API key. Drop --read-only, or sign in through the browser.", 0);
+        throw new SimApiError("API-key login cannot issue a read-only login. Use --method oauth, or drop --read-only.", 0);
       }
       if (callbackPort !== undefined) {
-        throw new SimApiError("The pairing-code handoff has no local callback, so --callback-port does not apply. Drop it, or sign in through the browser.", 0);
+        throw new SimApiError("API-key login has no local callback, so --callback-port does not apply. Use --method oauth, or drop --callback-port.", 0);
       }
     }
     await withProfileLoginLease(profile.name, async () => {
@@ -14074,13 +14089,13 @@ function loginCommand() {
         await loginWithOAuth(profile, options, callbackPort, snapshot);
         return;
       }
-      await loginWithHandoff(profile, options, scope, snapshot);
+      await loginWithHandoff(profile, options, snapshot);
     });
   });
 }
-async function loginWithHandoff(profile, options, scope, expected) {
+async function loginWithHandoff(profile, options, expected) {
   const auth = createAuthRequest();
-  const url = buildApprovalUrl(profile.endpoint, auth, scope, profile.workspaceId ?? undefined);
+  const url = buildApprovalUrl(profile.endpoint, auth, profile.workspaceId ?? undefined);
   console.log(`Signing in to ${source_default.bold(profile.endpoint)} as profile ${source_default.bold(safeOneLine(profile.name))}`);
   console.log(`
 Pairing code: ${source_default.bold(auth.pairing)}`);
@@ -14093,8 +14108,8 @@ Pairing code: ${source_default.bold(auth.pairing)}`);
 Waiting for approval…`));
   const key = await pollForKey(profile.endpoint, auth);
   try {
-    if (key.scope !== scope) {
-      throw new SimApiError(`Server issued a ${key.scope} key but this profile needs a ${scope} key. Update the Sim deployment, or run: sim login --scope ${key.scope}`, 0);
+    if (key.scope !== "platform") {
+      throw new SimApiError(`Server issued a ${key.scope} key, but the CLI requires a platform API key. Update the Sim deployment and try again.`, 0);
     }
     const settings = {
       endpoint: profile.endpoint,
@@ -17240,6 +17255,47 @@ function attachCredentialCommands(program) {
   credentials.command("reconnect").argument("<credentialId>", "Existing OAuth credential to re-authorize").description(describeOperation(V2_OPERATIONS.createCredentialConnection, "Create a short-lived link for reconnecting an OAuth credential")).action((credentialId, _options, command) => createConnectionLink(command, { credentialId }));
 }
 
+// src/http/ndjson.ts
+async function* readNdjson(body, protocol) {
+  if (!body) {
+    throw new SimApiError(`${protocol} ended without a response body`, 0);
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  const parse = (line) => {
+    const trimmed = line.trim();
+    if (!trimmed)
+      return;
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+      throw new SimApiError(`${protocol} returned malformed data`, 0);
+    }
+  };
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
+      const lines = buffer.split(`
+`);
+      buffer = done ? "" : lines.pop() ?? "";
+      for (const line of lines) {
+        const event = parse(line);
+        if (event !== undefined)
+          yield event;
+      }
+      if (done)
+        return;
+    }
+  } finally {
+    reader.cancel().catch(() => {
+      return;
+    });
+    reader.releaseLock();
+  }
+}
+
 // src/commands/protocol/result.ts
 function printProtocolResult(format, result) {
   const fields = Object.entries(result).map(([key, value]) => [key, text(value)]);
@@ -17247,72 +17303,28 @@ function printProtocolResult(format, result) {
 }
 
 // src/commands/protocol/chat.ts
-function parseChatStreamLine(line) {
-  const trimmed = line.trim();
-  if (!trimmed)
-    return;
-  try {
-    return JSON.parse(trimmed);
-  } catch {
-    throw new SimApiError("Chat stream returned malformed data", 0);
-  }
-}
 async function readChatStream(response, onChunk) {
-  if (!response.body) {
-    throw new SimApiError("Chat stream ended without a response body", 0);
-  }
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder;
-  let buffer = "";
-  let finalResult;
-  const processLine = (line) => {
-    const event = parseChatStreamLine(line);
-    if (!event || event.type === "heartbeat")
-      return false;
+  for await (const value of readNdjson(response.body, "Chat stream")) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new SimApiError("Chat stream returned an unknown event", 0);
+    }
+    const event = value;
+    if (event.type === "heartbeat")
+      continue;
     if (event.type === "chunk") {
       if (event.content)
         onChunk(sanitize(event.content));
-      return false;
+      continue;
     }
     if (event.type === "error") {
       throw new SimApiError(event.error || "Chat request failed", 0);
     }
     if (event.type === "final") {
-      finalResult = event.data;
-      return true;
+      return event.data;
     }
     throw new SimApiError("Chat stream returned an unknown event", 0);
-  };
-  try {
-    let ended = false;
-    while (!ended) {
-      const { done, value } = await reader.read();
-      if (done)
-        break;
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split(`
-`);
-      buffer = lines.pop() ?? "";
-      for (const line of lines) {
-        if (processLine(line)) {
-          ended = true;
-          break;
-        }
-      }
-    }
-    if (!ended) {
-      buffer += decoder.decode();
-      processLine(buffer);
-    }
-    if (!finalResult) {
-      throw new SimApiError("Chat stream ended without a final result", 0);
-    }
-    return finalResult;
-  } finally {
-    reader.cancel().catch(() => {
-      return;
-    });
   }
+  throw new SimApiError("Chat stream ended without a final result", 0);
 }
 function ignoreBrokenPipe(stream) {
   const onError = (error) => {
@@ -18303,6 +18315,7 @@ function attachTableImport(tables) {
 // src/commands/protocol/workflow-run-follow.ts
 var AGENT_STREAM_PROTOCOL_HEADER = "x-sim-stream-protocol";
 var AGENT_STREAM_PROTOCOL_V1 = "agent-events-v1";
+var WORKFLOW_RESULT_STREAM_CONTENT_TYPE = "application/x-ndjson";
 var DONE_SENTINEL = "[DONE]";
 function resolveWorkflowRunSelection(flags) {
   const manual = flags.manual === true;
@@ -18354,6 +18367,59 @@ function stringField(frame, key) {
   const value = frame[key];
   return typeof value === "string" ? value : null;
 }
+async function readWorkflowResult(response) {
+  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+  if (!contentType.includes(WORKFLOW_RESULT_STREAM_CONTENT_TYPE)) {
+    let envelope;
+    try {
+      envelope = await response.json();
+    } catch {
+      throw new SimApiError(`Workflow run returned malformed JSON${contentType ? ` as ${contentType}` : ""}`, response.status);
+    }
+    if (!isRecord(envelope)) {
+      throw new SimApiError("Workflow run returned an invalid result envelope", response.status);
+    }
+    return isRecord(envelope.data) ? envelope.data : envelope;
+  }
+  for await (const value of readNdjson(response.body, "Workflow result stream")) {
+    if (!isRecord(value) || typeof value.type !== "string") {
+      throw new SimApiError("Workflow result stream returned an unknown event", response.status);
+    }
+    if (value.type === "heartbeat")
+      continue;
+    if (value.type === "error") {
+      throw new SimApiError(safeOneLine(typeof value.error === "string" ? value.error : "Workflow run failed"), typeof value.status === "number" ? value.status : 0, typeof value.code === "string" ? value.code : null);
+    }
+    if (value.type === "final" && isRecord(value.data))
+      return value.data;
+    throw new SimApiError("Workflow result stream returned an unknown event", response.status);
+  }
+  throw new SimApiError("Workflow result stream ended without a final result", response.status);
+}
+async function runWithResultStream(workflowId, command) {
+  const flags = command.optsWithGlobals();
+  const { client, profile } = clientFrom(command);
+  const operation = V2_OPERATIONS.executeWorkflow;
+  const commandSpec = CLI_CONTRACT.executeWorkflow ?? {};
+  try {
+    const request = buildRequest("executeWorkflow", [workflowId], flags, profile.workspaceId);
+    const response = await client.requestRaw(request.path, {
+      method: operation.method,
+      query: request.query,
+      body: request.body,
+      headers: { ...request.headers, accept: WORKFLOW_RESULT_STREAM_CONTENT_TYPE }
+    });
+    const payload = await readWorkflowResult(response);
+    renderResult("executeWorkflow", profile.output, payload, commandSpec, {
+      expandedTrace: flags.trace === true
+    });
+    const failure = runFailureMessage("executeWorkflow", payload);
+    if (failure)
+      throw new SimApiError(failure, 0);
+  } catch (error) {
+    throw retypeApiError(error, "executeWorkflow", commandSpec, operation);
+  }
+}
 async function* sseData(body) {
   const reader = body.getReader();
   const decoder = new TextDecoder;
@@ -18525,6 +18591,10 @@ function followOrDelegate(previous) {
       if (flags.includeThinking === true || flags.includeToolCalls === true) {
         throw new SimApiError("--include-thinking and --include-tool-calls describe a stream; add --follow", 0);
       }
+      if (flags.async !== true) {
+        await runWithResultStream(workflowId, command);
+        return;
+      }
       if (previous) {
         await previous(command.processedArgs);
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim",
-  "version": "2.1.8-preview.97.1",
+  "version": "2.1.8-preview.99.1",
   "description": "Sim CLI - talk to the Sim API from your terminal",
   "type": "module",
   "bin": {