improvement(sim-cli): commands reach the API only through the operations they declare

[waleedlatif1]

Summary

• The command inventory marks a command mothershipUnavailable when Sim refuses a Mothership caller any operation the command calls. About 20 hand-written commands (files upload, tables import, logs follow, workflows runs wait, credentials connect, files ls/mkdir, secrets set, profiles add, …) called SimClient by path and declared nothing, so the inventory saw them as calling nothing. Consumers that rely only on that flag could show a refused command as runnable.
• Instead of a hand-kept list plus a "must declare" test, declaring is now the only way a command reaches the API:
  • callsOperations(command, ops) (or apiCommand(parent, name, ops)) records the declaration and returns connect().
  • connect() hands back an OperationClient typed to exactly those operations.
  • Each call names its operation, and the route and method come from the operation table. A call to an undeclared operation does not compile, and the generic path used by the generated handler is refused at runtime.
• Generated commands declare in configureOperation: their own operation, plus getWorkspaceOperation when --wait can poll a workspace operation. Commands layered onto a generated leaf (workflows run --follow, workflows runs get --select-output) connect through that declaration, typed to the operations they use.
• runsOperation folds into the declaration ({ runs }). BuiltRequest carries path params instead of a pre-resolved path. Upload sessions name their parts, complete and abort operations instead of building paths. clientFrom is reached only through connect, and a test keeps raw SimClient/clientFrom use confined to the wrappers.
• The only inventory change: profiles add is now mothershipUnavailable: true. It lists workspaces (GET /api/v2/workspaces), which Mothership is refused. No other undeclared command calls a refused route.
• Command names, flags, output and wire requests are unchanged. Each call sends the same method and path as before. Calls that relied on the default GET now pass it explicitly.
• Not covered: login and logout call the OAuth and device-flow routes, which are not v2 operations, so the inventory cannot describe them.

Type of Change

• Bug fix

Testing

• reference.test.ts: profiles add is flagged Mothership-unavailable. This fails on staging.
• called-operations.test.ts: an undeclared operation is refused before any request, a declared one is routed and encoded from the table, and no module outside the wrappers builds a raw client.
• I diffed the inventory over all 318 commands against staging. Only profiles add changed.
• packages/sim-cli: type-check and vitest (478 passed). Root: bun run test, bun run lint, bun run type-check, check:audits (58), check:cli-docs, docs-manifest:check, block-registry check.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 10, 2026 2:54am UTC

[cubic-dev-ai]

All reported issues were addressed across 31 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; both earlier test findings are addressed.

Summary

Commands now declare the operations they call and use OperationClient to send them. Routes and methods come from V2_OPERATIONS.

• Commands can call only the API operations they declare.
• Profile, credential, and secret commands list the API calls they make.
• Protocol commands name the API operations behind their requests.
• Uploads and table imports name each operation in their transfer.
• Workflow commands declare the API calls they use to run and wait.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Command declares operations] --> B[connect]
  B --> C[OperationClient]
  C --> D{Operation declared?}
  D -->|No| E[Reject before request]
  D -->|Yes| F[Read route and method from V2_OPERATIONS]
  F --> G[SimClient sends request]
  A --> H[Command inventory]

Loading

_{Reviews (3) · Last reviewed commit: "test(sim-cli): assert directory requests..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 31 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 31 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}