Repository navigation
feat(api): agent identity on v2 meta, scoped CLI pairing keys, and v2 workspace rename - #9904
Merged
Merged
Conversation
… workspace rename
- GET /api/v2/meta adds keyId, userId, workspaceId and links {openapi, docs, mcp};
existing fields unchanged. The API catalog shares the same link source.
- CLI pairing login accepts --read-only and --expires-in <days>. The request rides
the approval URL, is shown on the approval card, is recorded with the approval
and applied at mint; the unauthenticated poll cannot set either. The poll echoes
access and expiresAt, and the CLI refuses to store a key that does not match
what was asked (an older server mints full access). The signed-out login bounce
now keeps scope, workspace, access and expiry instead of dropping them.
sim whoami shows the key's expiry and bound workspace.
- POST /api/v2/credentials/connections returns draftId. Opening a connection link
that is unknown, expired or another account's now explains to sign in as the
creating account, without saying which case applied.
- PATCH /api/v2/workspaces/{workspaceId} renames a workspace or changes its logo
through the existing workspaces.identity.update operation, widened to personal
API keys and OAuth tokens (api:write); Admin still required, workspace keys
still denied. Workspace update operations move into the operations registry.
- Regenerated OpenAPI, MCP catalog, CLI client and CLI docs.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
 [Medium impact] The PR appears safe to merge; no actionable issues remain from this review. SummaryThis PR adds credential identity and discovery links, read-only and expiring CLI pairing keys, and workspace name and logo updates.
Reviews (4) · Last reviewed commit: "fix(api): publish the workspace PATCH bo..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…ver hides a committed update
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 45 files
Reply with feedback, questions, or to request a fix.
Turn on auto-fix | Re-trigger cubic
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
… keys exactly
- PATCH /v2/workspaces/{id}: the body schema publishes minProperties 1, and
logoUrl is a pattern (root-relative path or https URL, protocol-relative
refused) instead of an unpublished refine.
- sim login refuses a minted key whose access or expiry differs from the
request in either direction, with the expiry checked against the requested
days within a clock tolerance.
- sim workspaces update --logo-url documents that clearing the logo goes
through the API or MCP.
Collaborator
Author
Collaborator
Author
|
@cubic-dev-ai review this PR |
Contributor
@waleedlatif1 I have started the AI code review. It will take a few minutes to complete. |
This was referenced Nov 11, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GET /api/v2/metanow reportskeyId,userId, the boundworkspaceId(workspace keys), andlinksto the OpenAPI document, API docs, and MCP server. No email. Existing fields unchanged.sim loginpairing can mint a read-only and/or expiring key (--read-only,--expires-in <days>). The request is shown on the approval card and applied from the approval server-side; the unauthenticated poll can't set it. The CLI refuses to store a key that doesn't match what was asked (protects against an older server that ignores the request).sim whoamishows key expiry and bound workspace. Defaults are unchanged.POST /api/v2/credentials/connectionsreturnsdraftId. A connection link opened by the wrong account (or expired) now says to sign in as the account that created it or make a new one, without revealing which case applied.PATCH /api/v2/workspaces/{workspaceId}for name and logo, via the narrowworkspaces.identity.updateoperation (the one Copilot already uses), widened to personal keys and OAuthapi:writewith Admin. Workspace keys stay denied; billing and personal-key policy stay session-only. Generatessim workspaces updateand the MCP tool.Test plan
sim login --method api-key --read-only --expires-in 30end to end