feat(sim-cli): publish which CLI commands Mothership is refused, from the route admission rule

[waleedlatif1]

Summary

• The CLI command inventory (the JSON the Mothership worker builds its agent grammar from) now marks each command Mothership cannot run with mothershipUnavailable: true. The worker hides those commands instead of keeping its own hand-written list, which had already drifted: whoami and meta status were shown in chat and then refused on every call.
• The flag comes from the same rule admission runs. copilotRouteAudience is pulled out of copilotRequestPrincipal. The copilot route inventory test evaluates it for every v2 route and also invokes each raw route handler once (chat, workflow execute, resume) with admission recorded, and writes the refused routes to copilot-refused-routes.json as a file snapshot, which replaces the inline snapshot. print-command-inventory.ts reads that file.
• Hand-written commands now declare the v2 operations they call with callsOperations, so the inventory can judge them as well. whoami declares getMeta and getWorkspace, files versions download declares downloadFileVersion, and sim chat declares chat. Generated commands still map to their operation by path.
• Backward-compatible. The field is optional, and it is absent when every call is admitted or the command calls no known operation. A consumer that ignores it behaves as before.
• When a change to a use case's delegation changes the refused set, refresh the snapshot with vitest run -u lib/api/server/routes/copilot-route-inventory.test.ts. That is the same workflow the inline snapshot needed.

Type of Change

• New feature

Testing

• packages/sim-cli/src/contract/reference.test.ts runs the real inventory producer:
  • meta status, whoami, files versions download and chat are flagged;
  • workspaces get, workspaces invitations create, files get and workflows run are not;
  • it fails without the generator change.
• apps/sim/lib/api/server/routes/ (12 files, 325 tests).
• packages/sim-cli (52 files, 475 tests).
• bun run lint, bun run check:audits (58 audits) and bun run type-check.
• Root bun run test: everything passed except 3 @sim/app tests that hit the 10s timeout under a concurrent load. Each of the three passes when rerun on its own.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 9, 2026 5:35am UTC

[cubic-dev-ai]

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue remains.

Summary

The CLI inventory now marks commands that Mothership cannot run, using the same audience rule as route admission.

• Hand-written commands declare the operations they call.
• The latest change includes raw route handlers and marks chat as unavailable.
• The earlier unnumbered finding about chat is fully addressed.
• No new actionable issues were found. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Route operation and use case] --> B[copilotRouteAudience]
  B --> C[Request admission]
  B --> D[Refused route snapshot]
  E[Command operation declarations] --> F[CLI inventory producer]
  D --> F
  F --> G[mothershipUnavailable flag]

Loading

_{Reviews (2) · Last reviewed commit: "fix(sim-cli): inventory raw-route admiss..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 10 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}