feat(cli): add shared workspace profiles

Author: TheodoreSpeaks

apps/docs/content/docs/en/cli/authentication.mdx

@@ -53,6 +53,20 @@ sim workflows list --workspace ws_other
 `sim login --workspace <id>` preselects a workspace in the picker, and
 re-logging into an existing profile preselects the one already configured.
 
+To save another workspace without minting or copying another personal key, add
+a workspace profile:
+
+```bash
+sim workspaces list
+sim profile add acme --workspace ws_acme
+sim --profile acme whoami
+```
+
+The new profile stores `auth_profile = default` and its own workspace. Omit
+`--workspace` in an interactive terminal to choose from the workspaces the
+active key can access; scripts must provide the workspace ID explicitly. The
+picker is capped at 1,000 entries and asks for an explicit ID above that.
+
 ## Checking who you are
 
 ```bash
@@ -76,6 +90,12 @@ sim logout           # remove the stored key
 sim logout --all     # remove the profile entirely, including its settings
 ```
 
+A workspace profile that shares authentication cannot remove the shared key.
+Remove only that local profile with `sim logout --all --profile <name>`, or log
+out of the authentication profile named by the error message. Removing an
+authentication profile entirely is refused until its workspace profiles are
+removed, so it cannot leave dangling references.
+
 <Callout type="warn">
 `sim logout` removes the key from disk but does **not** revoke it. Revoke keys in
 Sim under **Settings → API keys**.
@@ -116,9 +136,9 @@ jobs:
           SIM_WORKSPACE: ${{ vars.SIM_WORKSPACE }}
 ```
 
-## Several accounts at once
+## Several accounts and workspaces
 
-Each profile holds one identity and one set of defaults:
+Use separate logins for separate identities or deployments:
 
 ```bash
 sim login --profile dev --endpoint http://localhost:3000
@@ -128,6 +148,16 @@ sim workflows list --profile dev
 sim workflows list --profile prod
 ```
 
+Use workspace profiles when one personal key should target several workspaces:
+
+```bash
+sim profile add marketing --workspace ws_marketing
+sim profile add support --workspace ws_support
+
+sim workflows list --profile marketing
+sim workflows list --profile support
+```
+
 See [Configuration](/cli/configuration) for how profiles are stored and resolved.
 
 ## Self-hosted and non-production deployments

apps/docs/content/docs/en/cli/commands.mdx

@@ -30,6 +30,7 @@ These apply to every command, and may be written before or after it.
 
 | Group | Description |
 | --- | --- |
+| [`sim profiles`](/cli/profiles) | List profiles or add a workspace profile that shares a stored login |
 | [`sim audit-logs`](/cli/audit-logs) | Manage audit logs |
 | [`sim billing`](/cli/billing) | Manage billing |
 | [`sim credentials`](/cli/credentials) | Manage credentials |
@@ -94,14 +95,6 @@ sim whoami [options]
 
 </CommandTable>
 
-## List the profiles defined in the config and credentials files
-
-```bash
-sim profiles
-```
-
-Also available as `sim profile`.
-
 ## Set a profile's endpoint, default workspace, or output format
 
 ```bash

apps/docs/content/docs/en/cli/configuration.mdx

@@ -9,8 +9,10 @@ for a single command.
 
 ## Profiles
 
-A profile is one identity plus one set of defaults, in the style of the AWS CLI.
-Select one with `-P`, `--profile`, or `SIM_PROFILE`:
+A profile selects one set of defaults, in the style of the AWS CLI. It normally
+uses its same-named stored identity, but a workspace profile can share another
+profile's identity through `auth_profile`. Select one with `-P`, `--profile`, or
+`SIM_PROFILE`:
 
 ```bash
 sim workflows list --profile dev
@@ -23,6 +25,12 @@ The profile is named `default` when you do not pick one.
 sim profiles     # list them; * marks the active one
 ```
 
+Add a profile for another workspace without creating or copying an API key:
+
+```bash
+sim profile add acme --workspace ws_acme
+```
+
 ## Setting defaults
 
 ```bash
@@ -51,7 +59,7 @@ Each setting resolves independently, and the first match wins:
 | --- | --- |
 | 1 | Command-line flag — `--endpoint`, `--workspace`, `--output` |
 | 2 | Environment — `SIM_ENDPOINT`, `SIM_API_KEY`, `SIM_WORKSPACE`, `SIM_OUTPUT` |
-| 3 | `~/.sim/config` and `~/.sim/credentials`, for the selected profile |
+| 3 | `~/.sim/config` for the selected profile and `~/.sim/credentials` for its `auth_profile`, when set |
 | 4 | Built-in default — `https://www.sim.ai` and `table` |
 
 `sim whoami` prints the winning source for each setting:
@@ -74,6 +82,10 @@ output = table
 [profile dev]
 endpoint = http://localhost:3000
 workspace = ws_local
+
+[profile acme]
+auth_profile = default
+workspace = ws_acme
 ```
 
 Keys live in `~/.sim/credentials`, written `0600`:
@@ -89,6 +101,10 @@ api_key = sim_…
 Section naming follows the AWS convention: `[profile dev]` in config, `[dev]` in
 credentials. The `default` profile is `[default]` in both.
 
+`auth_profile` references one direct profile and shares only its endpoint and
+API key; workspace and output remain local. References cannot be chained, and a
+shared profile cannot also set its own endpoint or API key.
+
 ## Environment variables
 
 | Variable | Effect |
@@ -121,6 +137,19 @@ sim configure --set-workspace ws_abc123
 export SIM_WORKSPACE=ws_abc123
 ```
 
+For a reusable selection, create a workspace profile backed by the current
+stored login:
+
+```bash
+sim workspaces list
+sim profile add acme --workspace ws_acme
+sim --profile acme tables list
+```
+
+When `--workspace` is omitted in a terminal, `profile add` presents an
+interactive picker, capped at 1,000 entries. It refuses environment-only keys
+and endpoint overrides because those values would disappear in another shell.
+
 `sim billing status`, `sim billing logs`, and `sim audit-logs list` accept
 `--all-workspaces` to drop the filter instead. It cannot be combined with
 `--workspace`.

apps/docs/content/docs/en/cli/meta.json

@@ -11,6 +11,7 @@
     "troubleshooting",
     "---Commands---",
     "commands",
+    "profiles",
     "audit-logs",
     "billing",
     "credentials",

apps/docs/content/docs/en/cli/profiles.mdx

@@ -0,0 +1,42 @@
+---
+title: Profiles
+description: List profiles or add a workspace profile that shares a stored login — every subcommand, argument, and flag
+---
+
+import { CommandTable } from '@/components/ui/command-table'
+
+`sim profiles` is also spelled `sim profile`.
+
+Every command below also accepts the [global options](/cli/commands#global-options).
+
+## List configured profiles
+
+```bash
+sim profiles list
+```
+
+## Add a workspace profile that shares the active stored login
+
+```bash
+sim profiles add <name> [options]
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `name` | Yes | Name for the new profile |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `-w, --workspace <id>` | No | Existing workspace to use; omit for an interactive picker. |
+
+</CommandTable>

apps/docs/content/docs/en/cli/reference.mdx

@@ -80,16 +80,6 @@ sim whoami [options]
 
 </CommandTable>
 
-## sim profiles
-
-List the profiles defined in the config and credentials files
-
-```bash
-sim profiles
-```
-
-Also available as `sim profile`.
-
 ## sim configure
 
 Set a profile's endpoint, default workspace, or output format
@@ -111,6 +101,46 @@ sim configure [options]
 
 </CommandTable>
 
+## sim profiles
+
+Also spelled `sim profile`.
+
+### sim profiles list
+
+List configured profiles
+
+```bash
+sim profiles list
+```
+
+### sim profiles add
+
+Add a workspace profile that shares the active stored login
+
+```bash
+sim profiles add <name> [options]
+```
+
+**Arguments**
+
+<CommandTable>
+
+| Argument | Required | Description |
+| --- | --- | --- |
+| `name` | Yes | Name for the new profile |
+
+</CommandTable>
+
+**Options**
+
+<CommandTable>
+
+| Option | Required | Description |
+| --- | --- | --- |
+| `-w, --workspace <id>` | No | Existing workspace to use; omit for an interactive picker. |
+
+</CommandTable>
+
 ## sim audit-logs
 
 Also spelled `sim audit-log`.

packages/sim-cli/README.md

@@ -12,9 +12,9 @@ Full documentation: **https://docs.sim.ai/cli**
 
 ## Profiles
 
-Profiles work like the AWS CLI: one identity and one set of defaults per named
-profile, selected with `-P`, `--profile`, or `SIM_PROFILE`. This is what lets you keep
-production and a local dev stack side by side without re-authenticating.
+Profiles work like the AWS CLI and are selected with `-P`, `--profile`, or
+`SIM_PROFILE`. A profile normally owns one identity and one set of defaults; a
+workspace profile can instead share a stored identity through `auth_profile`.
 
 Non-secret settings live in `~/.sim/config`:
 
@@ -27,6 +27,10 @@ output = table
 [profile dev]
 endpoint = http://localhost:3000
 workspace = ws_local
+
+[profile acme]
+auth_profile = default
+workspace = ws_acme
 ```
 
 Keys live in `~/.sim/credentials`, written `0600`:
@@ -45,7 +49,8 @@ The section-naming asymmetry — `[profile dev]` in config, `[dev]` in credentia
 ```bash
 sim configure --set-endpoint http://localhost:3000 --profile dev
 sim configure --set-workspace ws_local --profile dev
-sim profiles          # list them; * marks the active one
+sim profiles                                      # list them; * marks the active one
+sim profile add acme --workspace ws_acme          # share the active stored login
 sim whoami            # resolved values, where each came from, and whether they work
 ```
 
@@ -62,7 +67,7 @@ Each setting resolves independently, first match wins:
 indefinitely) and `SIM_DEBUG=1` traces requests to stderr. Node ignores
 `HTTPS_PROXY` unless `NODE_USE_ENV_PROXY=1` is also set, on Node 22.21+ or
 24.5+; the CLI warns when a proxy is configured but will not be used.
-| 3 | `~/.sim/config` / `~/.sim/credentials` for the selected profile |
+| 3 | `~/.sim/config` for the selected profile and credentials for its `auth_profile`, when set |
 | 4 | Built-in default (`https://www.sim.ai`, `table`) |
 
 Formats are listed under [Output formats](#output-formats).
@@ -112,8 +117,11 @@ the key can access.
 `sim login --workspace <id>` preselects a workspace in the picker, and an
 existing profile's workspace preselects itself on re-login.
 
-`sim logout` removes the stored key. It does not revoke it — do that in
-Settings → API keys.
+`sim logout` removes the stored key. A shared workspace profile cannot remove
+its authentication profile's key; use `sim logout --all --profile <name>` to
+remove only the workspace profile. An authentication profile cannot be removed
+entirely while workspace profiles reference it. Logging out does not revoke a
+key — do that in Settings → API keys.
 
 ## Commands
 
@@ -147,6 +155,7 @@ sim logs get <runId>
 sim audit-logs list --organization <organizationId> [--all-workspaces]
 sim audit-logs get <id> --organization <organizationId>
 
+sim workspaces list
 sim workspaces get
 sim workspaces members