fix(docs): tell the reader which key a command needs, and stop the ids contradicting the CLI

Around sixty v2 operations refuse a workspace API key, and the CLI's help said
nothing about it - the caller found out from a 403 after the request went out.
The restriction is already stated in the API spec, so the generator now reads it
from there and the command description carries it. The sentinel sentences are
imported from the spec's own constants rather than copied, so a reword cannot
silently unmark every command, and the test pins the count as well as named
operations because a reword confined to one family would otherwise slip past.

The generated reference also rendered an empty default as a sentence pointing at
nothing - "Defaults to ." - for every repeatable filter. Omitted now, while
false and zero still render, which is the trap that shape of check usually
walks into.

The hand-written guides used a workflow-shaped id for workflows that the CLI's
own help says never names one, and five other families were equally wrong. All
of them now match the scheme the CLI declares, consistently per entity across
pages, with the shared ones taken from that help text so the two read as one
voice.

The page documenting every flag was linked from nowhere; both landing links
pointed at the overview instead. And the generator's test file was absent from
the hand-maintained list CI runs, so its guards never executed.

Author: waleedlatif1

apps/docs/content/docs/en/cli/authentication.mdx

@@ -24,7 +24,7 @@ https://www.sim.ai/cli/auth?request=…&scope=platform
 Waiting for approval…
 
 ✓ Logged in. Key stored in /Users/you/.sim/credentials
-  Personal key, defaulting to ws_abc123. Override per command with --workspace.
+  Personal key, defaulting to 2f6d0b1c-8a34-4d92-b7e5-31c8a0f45d67. Override per command with --workspace.
 ```
 
 There is no loopback listener, so this works over SSH and inside containers.
@@ -47,7 +47,7 @@ profile's default `workspace`; it does **not** restrict the key to that
 workspace. Target another workspace the key can reach with `--workspace`:
 
 ```bash
-sim workflows list --workspace ws_other
+sim workflows list --workspace 9b4c7e02-1d58-4f36-a0c9-6e2b85df413a
 ```
 
 `sim login --workspace <id>` preselects a workspace in the picker, and
@@ -58,7 +58,7 @@ a workspace profile:
 
 ```bash
 sim workspaces list
-sim profile add acme --workspace ws_acme
+sim profile add acme --workspace 7e2d9c14-6b83-4a55-8f01-c4d3e9a76b28
 sim --profile acme whoami
 ```
 
@@ -108,9 +108,9 @@ config file:
 
 ```bash
 export SIM_API_KEY="sim_…"
-export SIM_WORKSPACE="ws_abc123"
+export SIM_WORKSPACE="2f6d0b1c-8a34-4d92-b7e5-31c8a0f45d67"
 
-sim workflows run wf_7Yb2 --input '{"source":"nightly"}' --output json
+sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --input '{"source":"nightly"}' --output json
 ```
 
 Create the key in Sim under **Settings → API keys**. Store it as a secret in your
@@ -130,7 +130,7 @@ jobs:
         with:
           node-version: '20'
       - run: npm install -g sim
-      - run: sim workflows run wf_7Yb2 --output json
+      - run: sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --output json
         env:
           SIM_API_KEY: ${{ secrets.SIM_API_KEY }}
           SIM_WORKSPACE: ${{ vars.SIM_WORKSPACE }}
@@ -151,8 +151,8 @@ sim workflows list --profile prod
 Use workspace profiles when one personal key should target several workspaces:
 
 ```bash
-sim profile add marketing --workspace ws_marketing
-sim profile add support --workspace ws_support
+sim profile add marketing --workspace c3a70e58-9f21-4d6b-b842-05e7f19c6a3d
+sim profile add support --workspace e0d94b17-3c62-45af-9718-b6a2c8035f4e
 
 sim workflows list --profile marketing
 sim workflows list --profile support

apps/docs/content/docs/en/cli/configuration.mdx

@@ -28,14 +28,14 @@ sim profiles     # list them; * marks the active one
 Add a profile for another workspace without creating or copying an API key:
 
 ```bash
-sim profile add acme --workspace ws_acme
+sim profile add acme --workspace 7e2d9c14-6b83-4a55-8f01-c4d3e9a76b28
 ```
 
 ## Setting defaults
 
 ```bash
 sim configure --set-endpoint http://localhost:3000 --profile dev
-sim configure --set-workspace ws_local --profile dev
+sim configure --set-workspace 5c81f3a6-0e27-4b94-8d15-a7f60c39b2e8 --profile dev
 sim configure --set-output json
 ```
 
@@ -76,16 +76,16 @@ repo:
 ```ini title="~/.sim/config"
 [default]
 endpoint = https://www.sim.ai
-workspace = ws_abc123
+workspace = 2f6d0b1c-8a34-4d92-b7e5-31c8a0f45d67
 output = table
 
 [profile dev]
 endpoint = http://localhost:3000
-workspace = ws_local
+workspace = 5c81f3a6-0e27-4b94-8d15-a7f60c39b2e8
 
 [profile acme]
 auth_profile = default
-workspace = ws_acme
+workspace = 7e2d9c14-6b83-4a55-8f01-c4d3e9a76b28
 ```
 
 Keys live in `~/.sim/credentials`, written `0600`:
@@ -132,17 +132,17 @@ filesystem at all.
 Workspace-scoped commands need a workspace:
 
 ```bash
-sim tables list --workspace ws_other
-sim configure --set-workspace ws_abc123
-export SIM_WORKSPACE=ws_abc123
+sim tables list --workspace 9b4c7e02-1d58-4f36-a0c9-6e2b85df413a
+sim configure --set-workspace 2f6d0b1c-8a34-4d92-b7e5-31c8a0f45d67
+export SIM_WORKSPACE=2f6d0b1c-8a34-4d92-b7e5-31c8a0f45d67
 ```
 
 For a reusable selection, create a workspace profile backed by the current
 stored login:
 
 ```bash
 sim workspaces list
-sim profile add acme --workspace ws_acme
+sim profile add acme --workspace 7e2d9c14-6b83-4a55-8f01-c4d3e9a76b28
 sim --profile acme tables list
 ```
 

apps/docs/content/docs/en/cli/index.mdx

@@ -77,17 +77,17 @@ sim workflows list
 ```
 
 ```
-ID      NAME           FOLDER     DEPLOYED  RUNS  LAST RUN
-wf_7Yb2 Refund triage  /Support   yes       412   2026-08-15 14:02:11
-wf_9Kd4 Weekly digest  /Reporting no        18    2026-08-11 09:00:04
+ID                                    NAME           FOLDER     DEPLOYED  RUNS  LAST RUN
+3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8  Refund triage  /Support   yes       412   2026-08-15 14:02:11
+b8c0d247-9e13-4a86-97f5-2ad4e1638c09  Weekly digest  /Reporting no        18    2026-08-11 09:00:04
 ```
 </Step>
 
 <Step>
 ### Run one
 
 ```bash
-sim workflows run wf_7Yb2 --input '{"ticketId":"T-4821"}'
+sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --input '{"ticketId":"T-4821"}'
 ```
 
 A workflow must be deployed before it can be run. Deploy from the editor, or
@@ -106,8 +106,8 @@ sim <resource> [sub-resource] <verb> [arguments] [options]
 
 ```bash
 sim workflows list
-sim tables rows query tbl_123 --limit 50
-sim knowledge documents upload kb_123 ./handbook.pdf
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --limit 50
+sim knowledge documents upload 4c1b7f60-2d55-4a3e-9c18-70b6ea2f9d31 ./handbook.pdf
 ```
 
 Resource groups are plural, and each also accepts its singular spelling —
@@ -146,8 +146,10 @@ sim tables rows query --help
 | [`workflow-mcp-servers`](/cli/workflow-mcp-servers) | Publish workflows as MCP tools for outside agents |
 | [`meta`](/cli/meta) | Check what this API supports and which limits apply |
 
-The [command reference](/cli/commands) documents every subcommand, argument, and
-flag, and is generated from the CLI itself.
+The [command overview](/cli/commands) has the global options and the commands
+that take no resource; the [complete reference](/cli/reference) documents every
+subcommand, argument, and flag on one page. Both are generated from the CLI
+itself.
 
 ## Where to go next
 
@@ -156,4 +158,5 @@ flag, and is generated from the CLI itself.
 - [Output formats](/cli/output) — `table`, `json`, `yaml`, and `text`, and when to use each
 - [Scripting](/cli/scripting) — piping, file inputs, exit codes, and automation recipes
 - [Troubleshooting](/cli/troubleshooting) — what each error means, and how to resolve it
-- [Command reference](/cli/commands) — every command, argument, and flag
+- [Command overview](/cli/commands) — global options, the command groups, and the commands that take no resource
+- [Complete reference](/cli/reference) — every command, argument, and flag on a single page

apps/docs/content/docs/en/cli/output.mdx

@@ -15,7 +15,7 @@ Every command renders through the same four formats.
 Select one per command, save it to the profile, or set it in the environment:
 
 ```bash
-sim tables get tbl_123 --output json
+sim tables get tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --output json
 sim configure --set-output json
 SIM_OUTPUT=yaml sim logs list > logs.yaml
 ```
@@ -47,14 +47,14 @@ An absent value is an em-dash in `table` and an empty field in `text`.
 with span inputs, outputs, errors, timing, and cost:
 
 ```bash
-sim logs get run_123 --trace
+sim logs get 9c4f0b7e-2d81-4a35-b6e9-70f1c8a2d543 --trace
 ```
 
 `json` and `yaml` always carry the complete response, so `--trace` is a no-op
 there:
 
 ```bash
-sim logs get run_123 --output json | jq '.traceSpans'
+sim logs get 9c4f0b7e-2d81-4a35-b6e9-70f1c8a2d543 --output json | jq '.traceSpans'
 ```
 
 ## Exceptions
@@ -66,6 +66,6 @@ configuration, not API data.
 so that it round-trips through `import`:
 
 ```bash
-sim workflows export wf_123 > wf.json
+sim workflows export 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 > wf.json
 sim workflows import --workflow @wf.json
 ```

apps/docs/content/docs/en/cli/scripting.mdx

@@ -14,7 +14,7 @@ to read stdin.
 
 ```bash
 sim workflows import --workflow @wf.json
-sim tables rows query tbl_123 --filter @filter.json
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --filter @filter.json
 cat wf.json | sim workflows import --workflow @-
 ```
 
@@ -24,9 +24,9 @@ Primitive lists take space-separated values. With `@`, the file supplies one
 value per line:
 
 ```bash
-sim files mv --file-ids file_1 file_2 --to Archive
+sim files mv --file-ids wf_3Qm8ZtLpR2yVnKd7BsXwC wf_5Hn1JvTqW9xUcMb4RzPgL --to Archive
 sim files mv --file-ids @file-ids.txt --to Archive
-printf 'file_1\nfile_2\n' | sim files mv --file-ids @- --to Archive
+printf 'wf_3Qm8ZtLpR2yVnKd7BsXwC\nwf_5Hn1JvTqW9xUcMb4RzPgL\n' | sim files mv --file-ids @- --to Archive
 ```
 
 Arrays of objects stay JSON.
@@ -37,7 +37,7 @@ Arrays of objects stay JSON.
 groups of `{field, op, value}` conditions, nestable.
 
 ```bash
-sim tables rows query tbl_123 \
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 \
   --filter '{"all":[{"field":"status","op":"eq","value":"open"},
                     {"field":"score","op":"gt","value":10}]}' \
   --limit 50
@@ -50,7 +50,7 @@ Operators: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`, `in`, `nin`, `contains`,
 `--sort` is also JSON, an ordered list of keys:
 
 ```bash
-sim tables rows query tbl_123 --sort '[{"field":"createdAt","direction":"desc"}]'
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --sort '[{"field":"createdAt","direction":"desc"}]'
 ```
 
 ## Pagination
@@ -68,8 +68,8 @@ Deletions require an explicit selector **and** `--yes`. There is no "delete
 everything" default:
 
 ```bash
-sim tables rows batch-delete tbl_123 --row row_1 row_2 --yes
-sim files delete file_123 --yes
+sim tables rows batch-delete tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --row row_2f81c0a94db54e6f8a13c7e0526bd94a row_6b3e59d0af1c42d7b80e94f3a271c568 --yes
+sim files delete wf_8Kd2NpVrY6zTfQa3XwBmS --yes
 ```
 
 Without `--yes` the command explains what it would have destroyed and stops.
@@ -92,7 +92,7 @@ Errors print one line to stderr, prefixed `Error:`, plus the API's error code an
 validation details when it supplies them. Failures are safe to branch on:
 
 ```bash
-if ! sim workflows run wf_7Yb2 --output json > result.json; then
+if ! sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --output json > result.json; then
   echo "run failed" >&2
   exit 1
 fi
@@ -121,17 +121,17 @@ esac
 produce are simply omitted:
 
 ```bash
-sim workflows run wf_7Yb2 --select-output agent_1.content --output json
+sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --select-output agent_1.content --output json
 ```
 
 ## Polling a long run
 
 Start the run asynchronously, then poll its status:
 
 ```bash
-run_id=$(sim workflows run wf_7Yb2 --async --output json | jq -r '.runId')
+run_id=$(sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --async --output json | jq -r '.runId')
 
-until sim workflows runs get "$run_id" --workflow wf_7Yb2 --output json \
+until sim workflows runs get "$run_id" --workflow 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --output json \
   | jq -e '.status | IN("completed","failed","cancelled")' > /dev/null; do
   sleep 5
 done
@@ -169,9 +169,9 @@ export SIM_API_KEY="${SIM_API_KEY:?missing}"
 export SIM_WORKSPACE="${SIM_WORKSPACE:?missing}"
 export SIM_OUTPUT=json
 
-run_id=$(sim workflows run wf_7Yb2 --input '{"source":"nightly"}' | jq -r '.runId')
+run_id=$(sim workflows run 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 --input '{"source":"nightly"}' | jq -r '.runId')
 
-if [ "$(sim workflows runs get "$run_id" --workflow wf_7Yb2 | jq -r '.status')" != "completed" ]; then
+if [ "$(sim workflows runs get "$run_id" --workflow 3a9e21d8-5f47-4c0b-b2ea-91d7c6034ef8 | jq -r '.status')" != "completed" ]; then
   sim logs get "$run_id" >&2
   exit 1
 fi

apps/docs/content/docs/en/cli/troubleshooting.mdx

@@ -53,8 +53,8 @@ Your shell consumed the quotes. Wrap the whole value in single quotes, or read i
 from a file:
 
 ```bash
-sim tables rows query tbl_123 --filter '{"all":[{"field":"status","op":"eq","value":"open"}]}'
-sim tables rows query tbl_123 --filter @filter.json
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --filter '{"all":[{"field":"status","op":"eq","value":"open"}]}'
+sim tables rows query tbl_9f3c1a05d4b7426e8c2f0917ab35de64 --filter @filter.json
 ```
 
 ## A value looks truncated
@@ -63,7 +63,7 @@ sim tables rows query tbl_123 --filter @filter.json
 switch to a machine format to see it in full:
 
 ```bash
-sim logs get run_123 --output json
+sim logs get 9c4f0b7e-2d81-4a35-b6e9-70f1c8a2d543 --output json
 ```
 
 ## `sim files get` refuses to print to the terminal
@@ -72,8 +72,8 @@ Writing arbitrary binary to an interactive terminal can corrupt it, so non-text
 content has to go to a file or a pipe:
 
 ```bash
-sim files get file_123 -o ./image.png
-sim files get file_123 | shasum
+sim files get wf_8Kd2NpVrY6zTfQa3XwBmS -o ./image.png
+sim files get wf_8Kd2NpVrY6zTfQa3XwBmS | shasum
 ```
 
 ## A stored output format is invalid

package.json

@@ -19,7 +19,7 @@
     "test:icon-path-precision": "bunx vitest run scripts/check-icon-path-precision.test.ts",
     "test:tool-registry-boundary": "bunx vitest run scripts/check-tool-registry-boundary.test.ts",
     "test:tool-request-boundary": "bunx vitest run scripts/check-tool-request-boundary.test.ts",
-    "test:generators": "bunx vitest run scripts/generate-v2-cli-api.test.ts scripts/generate-docs.test.ts",
+    "test:generators": "bunx vitest run scripts/generate-v2-cli-api.test.ts scripts/generate-cli-docs.test.ts scripts/generate-docs.test.ts",
     "format": "turbo run format",
     "format:check": "turbo run format:check",
     "lint": "turbo run lint",