fix(sim-cli): version reads lazily with an embedded-host fallback

version.ts read package.json at import time; hosts that bundle the CLI into
a different layout (the server's embedded CLI, Trigger.dev workers) have no
manifest at the relative path, and the import-time throw took the whole
Trigger.dev task graph down (dev deploy failure). Reads are now lazy and
fall back to a sentinel; the published binary still reports its real version
(smoke-tested in the publish lane). Also: workflow lint as an agent-cli
command — the Go copilot's virtual lint.json, served by the same engine both
graph writes publish.

Claude-Session: https://claude.ai/code/session_01CgaxNAaeD3taGdghbXn17w

Author: Sg312

apps/sim/lib/mothership/tools/handlers/agent-cli/agent-cli.test.ts

@@ -1,7 +1,30 @@
 /**
  * @vitest-environment node
  */
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
+
+const { buildWorkflowLintReport } = vi.hoisted(() => ({
+  buildWorkflowLintReport: vi.fn().mockResolvedValue({
+    sources: ['block-1'],
+    sinks: ['block-2'],
+    orphanBlocks: [],
+    emptyOutgoingPorts: [],
+    invalidBranchPorts: [],
+    invalidConnectionTargets: [],
+    fieldIssues: [
+      {
+        blockId: 'block-2',
+        blockName: 'Summarize emails',
+        missingRequiredFields: ['model'],
+        inactiveModeValues: [],
+      },
+    ],
+    unresolvedReferences: [],
+  }),
+}))
+
+vi.mock('@/lib/workflows/editing/lint-report', () => ({ buildWorkflowLintReport }))
+
 import {
   agentCliHelpSection,
   executeAgentCliCommand,
@@ -22,6 +45,7 @@ const WORKFLOW_STATE = {
 function runtimeWith(responses: Record<string, unknown>): AgentCliRuntime {
   return {
     workspaceId: 'ws-1',
+    userId: 'user-1',
     client: {
       request: async <T>(path: string): Promise<T> => {
         const hit = responses[path]
@@ -133,6 +157,24 @@ describe('workflow grep', () => {
     expect(result.stdout).toContain('Email digest (wf-1).blocks.block-2.name: Summarize emails')
   })
 
+  it('lints a workflow through the shared engine with the caller scoped as subject', async () => {
+    const match = matchAgentCliCommand(['workflow', 'lint', 'wf-1'])
+    const result = await executeAgentCliCommand(
+      match!,
+      runtimeWith({ [EXPORT_PATH]: exportResponse })
+    )
+    expect(result.stderr).toBe('')
+    expect(result.exitCode).toBe(0)
+    const report = JSON.parse(result.stdout)
+    expect(report.fieldIssues).toHaveLength(1)
+    expect(report.summary.length).toBeGreaterThan(0)
+    expect(buildWorkflowLintReport).toHaveBeenCalledWith(expect.anything(), {
+      workflowId: 'wf-1',
+      workspaceId: 'ws-1',
+      subjectUserId: 'user-1',
+    })
+  })
+
   it('surfaces execution errors as a failed result, never a throw', async () => {
     const match = matchAgentCliCommand(['workflow', 'grep', 'wf-missing', 'x'])
     const result = await executeAgentCliCommand(match!, runtimeWith({}))

apps/sim/lib/mothership/tools/handlers/agent-cli/commands/lint.ts

@@ -0,0 +1,39 @@
+import type { WorkflowState } from '@sim/workflow-types/workflow'
+import { fetchWorkflowState } from '@/lib/mothership/tools/handlers/agent-cli/commands/workflow-views'
+import {
+  type AgentCliCommand,
+  agentCliFail,
+  agentCliOk,
+} from '@/lib/mothership/tools/handlers/agent-cli/types'
+import { formatWorkflowLintMessage, hasWorkflowLintIssues } from '@/lib/workflows/editing/lint'
+import { buildWorkflowLintReport } from '@/lib/workflows/editing/lint-report'
+
+/**
+ * The Go copilot served this as the virtual `workflows/{path}/lint.json` VFS
+ * file; here it is a command. Authorization rides the v2 export fetch (a user
+ * who cannot read the workflow gets the 403 there); the report itself is the
+ * same engine both graph writes publish, so a lint here can never disagree
+ * with what an edit would have reported.
+ */
+export const workflowLintCommand: AgentCliCommand = {
+  path: ['workflow', 'lint'],
+  summary: 'Validate one workflow: orphans, unwired ports, missing fields, unresolved references',
+  usage: 'workflow lint <workflowId>',
+  async execute(rest, runtime) {
+    const workflowId = rest[0]
+    if (!workflowId) return agentCliFail('Usage: sim workflow lint <workflowId>')
+    const state = await fetchWorkflowState(runtime, workflowId)
+    // double-cast-allowed: the v2 export's `state` is the serialized WorkflowState;
+    // the lint engine reads it structurally (blocks/edges only)
+    const graph = state as unknown as Pick<WorkflowState, 'blocks' | 'edges'>
+    const report = await buildWorkflowLintReport(graph, {
+      workflowId,
+      workspaceId: runtime.workspaceId,
+      subjectUserId: runtime.userId,
+    })
+    const summary = hasWorkflowLintIssues(report)
+      ? formatWorkflowLintMessage(report)
+      : 'No lint issues found.'
+    return agentCliOk(JSON.stringify({ summary, ...report }, null, 2))
+  },
+}

apps/sim/lib/mothership/tools/handlers/agent-cli/index.ts

@@ -2,6 +2,7 @@ import {
   workflowGrepCommand,
   workflowsGrepCommand,
 } from '@/lib/mothership/tools/handlers/agent-cli/commands/grep'
+import { workflowLintCommand } from '@/lib/mothership/tools/handlers/agent-cli/commands/lint'
 import {
   workflowBlocksCommand,
   workflowEdgesCommand,
@@ -22,6 +23,7 @@ const AGENT_CLI_COMMANDS: readonly AgentCliCommand[] = [
   workflowBlocksCommand,
   workflowEdgesCommand,
   workflowGrepCommand,
+  workflowLintCommand,
   workflowsGrepCommand,
 ]
 

apps/sim/lib/mothership/tools/handlers/agent-cli/types.ts

@@ -18,6 +18,8 @@ export interface AgentCliClient {
 export interface AgentCliRuntime {
   client: AgentCliClient
   workspaceId: string
+  /** The human the command acts as — reference resolution and grants scope to them. */
+  userId: string
 }
 
 export interface AgentCliResult {

apps/sim/lib/mothership/tools/handlers/sim-cli.ts

@@ -56,6 +56,7 @@ export async function executeSimCli(
     ? await executeAgentCliCommand(agentMatch, {
         client: createEmbeddedClient(identity),
         workspaceId: context.workspaceId,
+        userId: context.userId,
       })
     : await runEmbeddedCli(args, identity)
   if (!agentMatch && isRootHelpInvocation(args) && result.exitCode === 0) {

packages/sim-cli/src/auth/device-flow.ts

@@ -1,7 +1,7 @@
 import { createHash, randomBytes, randomInt } from 'node:crypto'
 import { sleep } from '../helpers'
 import { buildUrl, REDIRECT_STATUSES, redirectEndpoint, SimApiError } from '../http/client'
-import { USER_AGENT } from '../version'
+import { userAgent } from '../version'
 
 /**
  * The terminal half of the CLI key handoff.
@@ -193,7 +193,7 @@ export async function pollForKey(
         headers: {
           'content-type': 'application/json',
           accept: 'application/json',
-          'user-agent': USER_AGENT,
+          'user-agent': userAgent(),
         },
         body: JSON.stringify({ request: auth.request, verifier: auth.pollSecret }),
         signal,

packages/sim-cli/src/http/client.test.ts

@@ -2,7 +2,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest'
 import { CLI_CONTRACT } from '../contract/commands'
 import { V2_OPERATIONS, type V2OperationName } from '../generated/v2-api'
 import { sleep } from '../helpers'
-import { USER_AGENT } from '../version'
+import { userAgent } from '../version'
 import {
   formatApiErrorDetails,
   redirectEndpoint,
@@ -496,10 +496,10 @@ describe('request identity', () => {
     await client().request('/api/v2/workflows')
 
     const headers = fetchMock.mock.calls[0][1].headers as Record<string, string>
-    expect(headers['user-agent']).toBe(USER_AGENT)
-    expect(USER_AGENT).toMatch(/^sim-cli\/\d+\.\d+\.\d+/)
-    expect(USER_AGENT).toContain(`node/${process.versions.node}`)
-    expect(USER_AGENT).toContain(process.platform)
+    expect(headers['user-agent']).toBe(userAgent())
+    expect(userAgent()).toMatch(/^sim-cli\/\d+\.\d+\.\d+/)
+    expect(userAgent()).toContain(`node/${process.versions.node}`)
+    expect(userAgent()).toContain(process.platform)
   })
 })
 

packages/sim-cli/src/http/client.ts

@@ -1,6 +1,6 @@
 import chalk from 'chalk'
 import type { ResolvedProfile } from '../config/index'
-import { USER_AGENT } from '../version'
+import { userAgent } from '../version'
 import { warnIfKeyOverCleartext, warnIfProxyIgnored } from './environment'
 
 /**
@@ -511,7 +511,7 @@ export class SimClient {
         headers: {
           ...(apiKey ? { 'x-api-key': apiKey } : {}),
           accept: 'application/json',
-          'user-agent': USER_AGENT,
+          'user-agent': userAgent(),
           ...(hasBody ? { 'content-type': 'application/json' } : {}),
           ...options.headers,
         },

packages/sim-cli/src/program.test.ts

@@ -4,7 +4,7 @@
 import type { Command } from 'commander'
 import { describe, expect, it } from 'vitest'
 import { buildProgram } from './program'
-import { CLI_VERSION } from './version'
+import { cliVersion } from './version'
 
 /** Parses argv against a program whose output and exits are captured, not taken. */
 async function parse(argv: string[]): Promise<{ out: string; code: string | null }> {
@@ -34,7 +34,7 @@ describe('the root version flag', () => {
   it('still reports the version on its own', async () => {
     const { out, code } = await parse(['--version'])
 
-    expect(out.trim()).toBe(CLI_VERSION)
+    expect(out.trim()).toBe(cliVersion())
     expect(code).toBe('commander.version')
   })
 
@@ -47,14 +47,14 @@ describe('the root version flag', () => {
   it('refuses a value instead of answering for a subcommand', async () => {
     const { out, code } = await parse(['workflows', 'rollback', 'wf_1', '--version', '1'])
 
-    expect(out).not.toContain(CLI_VERSION)
+    expect(out).not.toContain(cliVersion())
     expect(code).toBe('commander.error')
   })
 
   it('refuses the same value written with an equals sign', async () => {
     const { out, code } = await parse(['workflows', 'rollback', 'wf_1', '--version=1'])
 
-    expect(out).not.toContain(CLI_VERSION)
+    expect(out).not.toContain(cliVersion())
     expect(code).toBe('commander.error')
   })
 
@@ -65,15 +65,15 @@ describe('the root version flag', () => {
   it('refuses the bare flag typed against a subcommand', async () => {
     const { out, code } = await parse(['workflows', 'rollback', 'wf_1', '--version'])
 
-    expect(out).not.toContain(CLI_VERSION)
+    expect(out).not.toContain(cliVersion())
     expect(code).toBe('commander.error')
   })
 
   /** A root option's value is not the command name, even when it looks like one. */
   it('still reports the version after a root option', async () => {
     const { out, code } = await parse(['--profile', 'workflows', '--version'])
 
-    expect(out.trim()).toBe(CLI_VERSION)
+    expect(out.trim()).toBe(cliVersion())
     expect(code).toBe('commander.version')
   })
 

packages/sim-cli/src/program.ts

@@ -10,7 +10,7 @@ import {
   buildGeneratedCommands,
   refuseHelpAfterUnknownCommand,
 } from './runtime/build'
-import { CLI_VERSION } from './version'
+import { cliVersion } from './version'
 
 /** Root program description, shared by `--help` and the generated docs. */
 export const PROGRAM_DESCRIPTION = 'Talk to the Sim API from your terminal'
@@ -105,7 +105,11 @@ function addVersionOption(program: Command): void {
       'error: --version reports the Sim CLI version and takes no value. A command that acts on a deployment version reads it from --to-version.'
     )
   })
-  program.version(CLI_VERSION, '-V, --version [none]', 'output the version number (takes no value)')
+  program.version(
+    cliVersion(),
+    '-V, --version [none]',
+    'output the version number (takes no value)'
+  )
 }
 
 /**