feat(cli): sim CLI with AWS-style profiles and a platform key exchange

Adds `packages/sim-cli` (`@sim/cli`, bin `sim`) and extends the existing CLI key
handoff so it can mint the credential the public API actually accepts.

The handoff already existed but only minted *copilot* keys, which do not
authenticate `/api/v1` or `/api/v2` — those want a Sim platform key. The
approval now carries a `scope`:

- `copilot` (the default, so terminals built against the original flow are
  unaffected) mints as before
- `platform` mints a Sim API key: workspace-scoped when the approver is a
  workspace admin, personal otherwise

Scope and workspace are fixed at *approval*, not at poll: the poll is
unauthenticated by necessity, so the browser is the only moment a human is
present to consent and the only place a permission can be checked. The poll
echoes back what was granted rather than what was asked for, so the CLI cannot
file a copilot key under a platform profile and fail later with an opaque 401.

Picking a workspace and scoping a key to it are kept separate. The terminal has
no key yet, so it cannot list workspaces — the browser picker is the only place
that choice can be made, and the pick comes back as the profile's default
whether or not the key is bound to it. Otherwise a non-admin would pick a
workspace by name and then have to go find its id by hand.

Personal-key creation moves into `lib/api-key/orchestration` so the settings
route and the exchange share one issuer.

Profiles work like the AWS CLI: `~/.sim/config` for settings (`[profile dev]`),
`~/.sim/credentials` for keys at 0600 (`[dev]`), selected via `--profile` /
`SIM_PROFILE`. Each setting resolves flag → env → file → default, and
`sim whoami` reports the winning source so a surprising value is explainable.
CI can skip login entirely with `SIM_API_KEY` + `SIM_WORKSPACE`.

Commands cover the v2 surface pulled in earlier: workflows, logs, files, and
knowledge, with `--output json` passing the API's own shapes through for `jq`.
`sim tables` is deliberately absent — that surface is still in flux.

The v2 routes were authored a month ago and had fallen behind their services:
`checkActorUsageLimits(userId, workspaceId)` → the billing-attribution flow
(which also restores correct payer attribution for workspace keys on KB upload
and search), `processDocumentsWithQueue` gained a required argument, and the
deploy/rollback param objects had stale fields. Caught by a cold type-check —
an incremental run had reported these files clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EsThUPqZXjwuuyRjBbmVkj

Author: 2 people

apps/sim/app/api/cli/auth/approve/route.test.ts

@@ -5,11 +5,13 @@ import { createHash } from 'node:crypto'
 import { createMockRequest } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockGetSession, mockCreateApproval, mockEnforceUserRateLimit } = vi.hoisted(() => ({
-  mockGetSession: vi.fn(),
-  mockCreateApproval: vi.fn(),
-  mockEnforceUserRateLimit: vi.fn(),
-}))
+const { mockGetSession, mockCreateApproval, mockEnforceUserRateLimit, mockGetPermissions } =
+  vi.hoisted(() => ({
+    mockGetSession: vi.fn(),
+    mockCreateApproval: vi.fn(),
+    mockEnforceUserRateLimit: vi.fn(),
+    mockGetPermissions: vi.fn(),
+  }))
 
 vi.mock('@/lib/auth', () => ({
   auth: { api: { getSession: vi.fn() } },
@@ -24,6 +26,10 @@ vi.mock('@/lib/core/rate-limiter', () => ({
   enforceUserRateLimit: mockEnforceUserRateLimit,
 }))
 
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetPermissions,
+}))
+
 import { POST } from '@/app/api/cli/auth/approve/route'
 
 const REQUEST = 'a'.repeat(43)
@@ -35,6 +41,7 @@ describe('POST /api/cli/auth/approve', () => {
     mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
     mockEnforceUserRateLimit.mockResolvedValue(null)
     mockCreateApproval.mockResolvedValue(undefined)
+    mockGetPermissions.mockResolvedValue('admin')
   })
 
   it('records the approval for the signed-in user', async () => {
@@ -43,7 +50,112 @@ describe('POST /api/cli/auth/approve', () => {
     )
     expect(response.status).toBe(200)
     await expect(response.json()).resolves.toEqual({ ok: true })
-    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE)
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE, {
+      scope: 'copilot',
+      workspaceId: undefined,
+      workspaceBound: false,
+    })
+  })
+
+  it('defaults to the copilot scope so pre-scope terminals keep working', async () => {
+    await POST(createMockRequest('POST', { request: REQUEST, challenge: CHALLENGE }))
+    expect(mockCreateApproval).toHaveBeenCalledWith(
+      'user-1',
+      REQUEST,
+      CHALLENGE,
+      expect.objectContaining({ scope: 'copilot' })
+    )
+  })
+
+  it('records a workspace binding when the approver is a workspace admin', async () => {
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'platform',
+        workspaceId: 'ws-1',
+        bindKeyToWorkspace: true,
+      })
+    )
+    expect(response.status).toBe(200)
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE, {
+      scope: 'platform',
+      workspaceId: 'ws-1',
+      workspaceBound: true,
+    })
+  })
+
+  it("records a non-admin's pick as a default without binding the key to it", async () => {
+    mockGetPermissions.mockResolvedValue('write')
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'platform',
+        workspaceId: 'ws-1',
+      })
+    )
+    expect(response.status).toBe(200)
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE, {
+      scope: 'platform',
+      workspaceId: 'ws-1',
+      workspaceBound: false,
+    })
+  })
+
+  it('refuses to bind a key to a workspace the approver is not admin of', async () => {
+    mockGetPermissions.mockResolvedValue('write')
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'platform',
+        workspaceId: 'ws-1',
+        bindKeyToWorkspace: true,
+      })
+    )
+    expect(response.status).toBe(403)
+    expect(mockCreateApproval).not.toHaveBeenCalled()
+  })
+
+  it('refuses a workspace the approver is not a member of', async () => {
+    mockGetPermissions.mockResolvedValue(null)
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'platform',
+        workspaceId: 'ws-1',
+      })
+    )
+    expect(response.status).toBe(404)
+    expect(mockCreateApproval).not.toHaveBeenCalled()
+  })
+
+  it('refuses bindKeyToWorkspace with no workspaceId', async () => {
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'platform',
+        bindKeyToWorkspace: true,
+      })
+    )
+    expect(response.status).toBe(400)
+    expect(mockCreateApproval).not.toHaveBeenCalled()
+  })
+
+  it('refuses a workspace binding on the copilot scope', async () => {
+    const response = await POST(
+      createMockRequest('POST', {
+        request: REQUEST,
+        challenge: CHALLENGE,
+        scope: 'copilot',
+        workspaceId: 'ws-1',
+      })
+    )
+    expect(response.status).toBe(400)
+    expect(mockCreateApproval).not.toHaveBeenCalled()
   })
 
   it('rejects an unauthenticated caller', async () => {
@@ -59,7 +171,7 @@ describe('POST /api/cli/auth/approve', () => {
     await POST(
       createMockRequest('POST', { request: REQUEST, challenge: CHALLENGE, userId: 'attacker' })
     )
-    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE)
+    expect(mockCreateApproval).toHaveBeenCalledWith('user-1', REQUEST, CHALLENGE, expect.anything())
   })
 
   it('rejects a malformed challenge', async () => {

apps/sim/app/api/cli/auth/approve/route.ts

@@ -6,6 +6,7 @@ import { getSession } from '@/lib/auth'
 import { createApproval } from '@/lib/cli-auth/approval-store'
 import { enforceUserRateLimit } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
 
 const logger = createLogger('CliAuthApproveAPI')
 
@@ -16,6 +17,10 @@ const logger = createLogger('CliAuthApproveAPI')
  * The approving user comes from the session and nothing else — a client-supplied
  * user id here would let any caller approve a request redeemable for someone
  * else's key. No key is generated until the CLI polls.
+ *
+ * Workspace binding is authorized here rather than at poll time: the poll is
+ * unauthenticated by necessity, so it has no session to check a permission
+ * against. Approving is the only moment a human is present.
  */
 export const POST = withRouteHandler(async (request: NextRequest) => {
   const session = await getSession()
@@ -29,8 +34,56 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
   const parsed = await parseRequest(approveCliAuthContract, request, {})
   if (!parsed.success) return parsed.response
 
-  await createApproval(session.user.id, parsed.data.body.request, parsed.data.body.challenge)
-  logger.info('Recorded CLI authorization approval', { userId: session.user.id })
+  const { request: requestId, challenge, scope, workspaceId, bindKeyToWorkspace } = parsed.data.body
+
+  if ((workspaceId || bindKeyToWorkspace) && scope !== 'platform') {
+    return NextResponse.json(
+      { error: 'workspaceId is only valid for the platform scope' },
+      { status: 400 }
+    )
+  }
+
+  if (bindKeyToWorkspace && !workspaceId) {
+    return NextResponse.json(
+      { error: 'bindKeyToWorkspace requires a workspaceId' },
+      { status: 400 }
+    )
+  }
+
+  if (workspaceId) {
+    const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+
+    // Reading the workspace at all requires membership. Without this, the
+    // terminal could be handed the id of a workspace the approver cannot see —
+    // harmless for the key, but it would silently become the profile default and
+    // every later command would 403 with no explanation.
+    if (!permission) {
+      return NextResponse.json({ error: 'Workspace not found' }, { status: 404 })
+    }
+
+    // Minting a workspace key is an admin action wherever else it is offered;
+    // the terminal is not a lower bar. Rejected outright rather than downgraded
+    // to a personal key, so the CLI never quietly stores a different credential
+    // than the browser said it would.
+    if (bindKeyToWorkspace && permission !== 'admin') {
+      return NextResponse.json(
+        { error: 'Workspace admin permission is required to issue a workspace API key' },
+        { status: 403 }
+      )
+    }
+  }
+
+  await createApproval(session.user.id, requestId, challenge, {
+    scope,
+    workspaceId,
+    workspaceBound: bindKeyToWorkspace,
+  })
+  logger.info('Recorded CLI authorization approval', {
+    userId: session.user.id,
+    scope,
+    workspaceId: workspaceId ?? null,
+    workspaceBound: bindKeyToWorkspace,
+  })
 
   return NextResponse.json({ ok: true })
 })