fix(cli): gate destructive table imports and fix follow-mode rendering

A `tables import --mode replace` empties the table before its first batch,
so the only warning was in the describe. It now confirms, and the wording
tells the truth per mode: cancelling a replace leaves a prefix of the new
file with the originals already gone, while an append re-adds its rows if
the file is imported twice. `--yes` skips the gate, and the gate runs
before the file is opened.

Import and export cancellation carried no describe at all; the import one
now confirms, the export one records why it deliberately does not.

Follow-mode output truncated cells to whatever the first row happened to
measure, so a longer status or workflow name arrived clipped with no
signal. Cells now clamp at a shared ceiling and pad to the lock, and the
log columns carry width floors so a short first page cannot pin a column
narrower than its own values.

Interrupting a staged download left the staging directory behind; it is
now removed on SIGINT and SIGTERM before the signal is re-raised.

`--select-output` without `--follow` selected from a response that does
not carry outputs, and said nothing. It is refused client-side, with a
separate message for `--async`. Its describe now names what the path
addresses.

`secrets set` always read a value, even when only metadata flags were
passed. Off a TTY that was an immediate refusal, so a metadata-only edit
exited 1 in CI for a value it was never asked for; on a TTY it stopped to
prompt, and the prompt rejects an empty entry, so there was no way to say
"leave the stored value alone" short of re-typing the secret. The read is
now skipped and the field omitted, which is what lets a metadata-only edit
run unattended. On a TTY, setting only a description no longer prompts.
Passing both spellings of the reveal flag is refused rather than silently
resolved.

Four mandatory hand-authored flags now say so, `billing logs` names its
key-type scope, and the dispatch list declares its columns.

Author: waleedlatif1

packages/sim-cli/src/commands/credentials.test.ts

@@ -156,6 +156,24 @@ describe('credential connection commands', () => {
     expect(help).not.toContain('--service-account-json')
   })
 
+  it('marks its mandatory flags required in the help it renders', () => {
+    // Commander enforces `requiredOption` but renders nothing to say so — the
+    // marker is literal text the generated flags carry, so a hand-written
+    // command is the one place a required flag can look optional.
+    const flat = (...names: string[]) =>
+      commandAt(...names)
+        .helpInformation()
+        .replace(/\s+/g, ' ')
+
+    expect(flat('credentials', 'create')).toContain(
+      'Name shown for the credential in Sim (required)'
+    )
+    expect(flat('credentials', 'create')).toContain('read a file or stdin) (required)')
+    expect(flat('credentials', 'connect')).toContain(
+      'Name shown for the new credential in Sim (required)'
+    )
+  })
+
   it('rejects missing and unsupported provider fields before creation', async () => {
     mockRequest.mockReset().mockResolvedValue({
       data: [

packages/sim-cli/src/commands/credentials.ts

@@ -193,10 +193,14 @@ export function attachCredentialCommands(program: Command): void {
     .command('create')
     .argument('<providerId>', 'Service-account provider to create a credential for')
     .description('Create a service-account credential using its discovered provider schema')
-    .requiredOption('--name <displayName>', 'Name shown for the credential in Sim')
+    // The `(required)` suffix is the marker the generated flags carry, and it
+    // is literal text rather than something commander renders — a hand-written
+    // mandatory option that omits it is the only kind of required flag whose
+    // help does not say so.
+    .requiredOption('--name <displayName>', 'Name shown for the credential in Sim (required)')
     .requiredOption(
       '--credentials <json|@file>',
-      'Provider credentials as JSON (or @path / @- to read a file or stdin)'
+      'Provider credentials as JSON (or @path / @- to read a file or stdin) (required)'
     )
     .option('--description <description>', 'Optional credential description')
     .option(
@@ -211,7 +215,7 @@ export function attachCredentialCommands(program: Command): void {
     .command('connect')
     .argument('<providerId>', 'OAuth provider to connect')
     .description('Create a short-lived link for connecting an OAuth provider')
-    .requiredOption('--name <displayName>', 'Name shown for the new credential in Sim')
+    .requiredOption('--name <displayName>', 'Name shown for the new credential in Sim (required)')
     .action(async (providerId: string, options: { name: string }, command: Command) =>
       createConnectionLink(command, { providerId, displayName: options.name })
     )

packages/sim-cli/src/commands/protocol/files-get.test.ts

@@ -3,6 +3,7 @@ import {
   existsSync,
   lstatSync,
   mkdtempSync,
+  readdirSync,
   readFileSync,
   rmSync,
   symlinkSync,
@@ -14,7 +15,12 @@ import { Writable } from 'node:stream'
 import { Command } from 'commander'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { buildGeneratedCommands } from '../../runtime/build'
-import { isTerminalSafeContentType, saveToFile, streamToFile } from './files-get'
+import {
+  isTerminalSafeContentType,
+  removeStagingOnSignal,
+  saveToFile,
+  streamToFile,
+} from './files-get'
 import { attachProtocolCommands } from './index'
 
 const { output, requestRaw } = vi.hoisted(() => ({
@@ -89,6 +95,62 @@ function program(): Command {
   return root
 }
 
+describe('an interrupted download', () => {
+  /** Staging directories left beside a destination, as `ls -a` shows them. */
+  function stagingDirectories(): string[] {
+    return readdirSync(dir).filter((entry) => entry.startsWith('.sim-download-'))
+  }
+
+  it('removes the staging directory and re-raises when a signal arrives', () => {
+    const staging = mkdtempSync(join(dir, '.sim-download-'))
+    writeFileSync(join(staging, 'payload'), 'partial')
+    // Injected: the real termination re-raises the signal, which would take the
+    // test runner down with it.
+    const terminate = vi.fn()
+    const dispose = removeStagingOnSignal(() => staging, terminate)
+
+    process.emit('SIGINT')
+    dispose()
+
+    expect(existsSync(staging)).toBe(false)
+    expect(terminate).toHaveBeenCalledWith('SIGINT')
+  })
+
+  it('watches for signals only while a download is staged', async () => {
+    const before = { int: process.listenerCount('SIGINT'), term: process.listenerCount('SIGTERM') }
+    let observed = 0
+    const body = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        observed = process.listenerCount('SIGINT')
+        controller.enqueue(new TextEncoder().encode('data'))
+        controller.close()
+      },
+    })
+
+    await saveToFile(body, join(dir, 'out.bin'), false)
+
+    expect(observed).toBe(before.int + 1)
+    expect(process.listenerCount('SIGINT')).toBe(before.int)
+    expect(process.listenerCount('SIGTERM')).toBe(before.term)
+  })
+
+  it('disposes the watch when the publish itself fails', async () => {
+    const target = join(dir, 'out.txt')
+    writeFileSync(target, 'precious')
+    const before = process.listenerCount('SIGINT')
+
+    await expect(saveToFile(bodyOf(['new']), target, false)).rejects.toThrow(/already exists/)
+
+    expect(process.listenerCount('SIGINT')).toBe(before)
+  })
+
+  it('leaves no staging directory behind on a completed download', async () => {
+    await saveToFile(bodyOf(['done']), join(dir, 'out.bin'), false)
+
+    expect(stagingDirectories()).toEqual([])
+  })
+})
+
 describe('streamToFile', () => {
   it('writes the body to disk', async () => {
     const target = join(dir, 'out.txt')

packages/sim-cli/src/commands/protocol/files-get.ts

@@ -1,5 +1,5 @@
 import { once } from 'node:events'
-import { createWriteStream, type WriteStream } from 'node:fs'
+import { createWriteStream, rmSync, type WriteStream } from 'node:fs'
 import { link, lstat, mkdtemp, readlink, rename, rm } from 'node:fs/promises'
 import { dirname, join, resolve } from 'node:path'
 import { Readable, type Writable } from 'node:stream'
@@ -89,13 +89,68 @@ export async function streamToFile(
   }
 }
 
+/** Signals that end the process while a download is staged beside its target. */
+const STAGE_SIGNALS: readonly NodeJS.Signals[] = ['SIGINT', 'SIGTERM']
+
+/**
+ * Ends the process by the signal that arrived, once our own handler has run.
+ *
+ * Installing a listener suppresses Node's default termination, so the handler
+ * has to terminate itself. Re-raising rather than `process.exit(130)` keeps the
+ * process dying *by signal*, so a wrapping shell still sees 130/143 and a
+ * `trap` still fires — the behaviour an interrupted download has today.
+ */
+function reRaise(signal: NodeJS.Signals): void {
+  process.removeAllListeners(signal)
+  process.kill(process.pid, signal)
+}
+
+/**
+ * Removes the staging directory when a signal ends the process.
+ *
+ * `saveStagedFile` cleans up in normal control flow, which a signal never
+ * reaches: the process is torn down mid-`pipeline`, so every Ctrl-C left
+ * another `.sim-download-*` holding a partial payload beside the destination.
+ * The removal is synchronous because the termination that follows gives an
+ * async `rm` no turn to run.
+ *
+ * Exported for its own test: driving it through a real interrupt would take the
+ * test runner down with it.
+ */
+export function removeStagingOnSignal(
+  stagingDirectory: () => string | null,
+  terminate: (signal: NodeJS.Signals) => void = reRaise
+): () => void {
+  const installed = STAGE_SIGNALS.map((signal) => {
+    const onSignal = () => {
+      const directory = stagingDirectory()
+      if (directory) {
+        try {
+          rmSync(directory, { recursive: true, force: true })
+        } catch {
+          // A staging directory we cannot remove is not worth masking the
+          // interrupt the caller asked for.
+        }
+      }
+      terminate(signal)
+    }
+    process.on(signal, onSignal)
+    return [signal, onSignal] as const
+  })
+
+  return () => {
+    for (const [signal, onSignal] of installed) process.off(signal, onSignal)
+  }
+}
+
 async function saveStagedFile(
   body: ReadableStream<Uint8Array>,
   target: string,
   force: boolean
 ): Promise<void> {
   let temporaryDirectory: string | null = null
   let failure: SimApiError | null = null
+  const disposeSignalCleanup = removeStagingOnSignal(() => temporaryDirectory)
 
   try {
     const publicationTarget = force ? await forcedPublicationTarget(target) : target
@@ -113,6 +168,10 @@ async function saveStagedFile(
     }
   } catch (error) {
     failure = normalizedWriteFailure(target, error)
+  } finally {
+    // Disposed on every path out, including the publish failure below: a
+    // handler left installed would outlive the directory it removes.
+    disposeSignalCleanup()
   }
 
   if (temporaryDirectory) {

packages/sim-cli/src/commands/protocol/logs-follow.test.ts

@@ -3,9 +3,10 @@
  */
 import { Command } from 'commander'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { CLI_CONTRACT } from '../../contract/commands'
 import { type ListLogsResponse, V2_OPERATIONS } from '../../generated/v2-api'
 import { SimApiError } from '../../http/client'
-import { attachLogsFollow, type LogRow } from './logs-follow'
+import { attachLogsFollow, type LogRow, MAX_CELL_WIDTH } from './logs-follow'
 
 const { mockRequest, mockSleep, profile } = vi.hoisted(() => ({
   mockRequest: vi.fn(),
@@ -236,6 +237,90 @@ describe('sim logs follow', () => {
     expect(stdout).toHaveLength(3)
   })
 
+  it('keeps a run id whole when the follow started with an empty backlog', async () => {
+    // `-n 0` seeds the writer with no rows, so the widths used to lock to the
+    // header labels — RUN is three characters, and a 36-character run id
+    // printed as `9f…`, uncopyable.
+    profile.output = 'table'
+    const runId = '9f5e9856-1801-4028-a85f-6e335e65d974'
+    const arrival = row(runId, '2026-08-17T10:00:01.000Z')
+    arrival.workflow = {
+      id: 'wf_1',
+      name: 'clitest-nightly-sync',
+      description: null,
+      deleted: false,
+    }
+    respondWith([page([]), page([arrival])])
+
+    await follow('-n', '0')
+
+    const printed = stdout.join('\n')
+    expect(printed).toContain(runId)
+    expect(printed).toContain('clitest-nightly-sync')
+    expect(printed).not.toContain('…')
+  })
+
+  it('lines an arriving row up with the header it printed before any rows', async () => {
+    // The floors are the half of this that keeps `-n 0` readable: without them
+    // the columns lock to their header labels, and every cell of the first real
+    // row overflows, so nothing below the header lines up for the life of the
+    // follow.
+    profile.output = 'table'
+    const arrival = row('9f5e9856-1801-4028-a85f-6e335e65d974', '2026-08-17T10:00:01.000Z')
+    respondWith([page([]), page([arrival])])
+
+    await follow('-n', '0')
+
+    const [header, printed] = stdout
+    expect(printed.indexOf('completed')).toBe(header.indexOf('STATUS'))
+    expect(printed.indexOf('Nightly sync')).toBe(header.indexOf('WORKFLOW'))
+    expect(printed.indexOf('9f5e9856')).toBe(header.indexOf('RUN'))
+  })
+
+  it('keeps a later row wider than the batch that locked the widths', async () => {
+    profile.output = 'table'
+    const first = row('run_1', '2026-08-17T10:00:01.000Z')
+    first.workflow = { id: 'wf_1', name: 'short', description: null, deleted: false }
+    const second = row('run_2', '2026-08-17T10:00:02.000Z')
+    second.workflow = {
+      id: 'wf_2',
+      name: 'a-considerably-longer-workflow-name',
+      description: null,
+      deleted: false,
+    }
+    respondWith([page([first]), page([second, first])])
+
+    await follow('-n', '1')
+
+    expect(stdout.join('\n')).toContain('a-considerably-longer-workflow-name')
+  })
+
+  it('still cuts a cell at the width one column may ever take', async () => {
+    profile.output = 'table'
+    const huge = 'x'.repeat(MAX_CELL_WIDTH + 40)
+    const arrival = row('run_1', '2026-08-17T10:00:01.000Z')
+    arrival.workflow = { id: 'wf_1', name: huge, description: null, deleted: false }
+    respondWith([page([]), page([arrival])])
+
+    await follow('-n', '0')
+
+    const printed = stdout.join('\n')
+    expect(printed).not.toContain(huge)
+    expect(printed).toContain(`${'x'.repeat(MAX_CELL_WIDTH - 1)}…`)
+  })
+
+  it('asks for no column floor wider than a column may render', () => {
+    // A floor above the cap is silently clamped, so an oversized spec would
+    // read as deliberate and do nothing.
+    const oversized = Object.entries(CLI_CONTRACT).flatMap(([operation, spec]) =>
+      [...(spec.columns ?? []), ...(spec.fields ?? [])]
+        .filter((column) => (column.minWidth ?? 0) > MAX_CELL_WIDTH)
+        .map((column) => `${operation}.${column.header}`)
+    )
+
+    expect(oversized).toEqual([])
+  })
+
   it('keeps rows on stdout and retry notices on stderr', async () => {
     Object.defineProperty(process.stderr, 'isTTY', { value: true, configurable: true })
     const first = row('run_1', '2026-08-17T10:00:01.000Z')