diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
deleted file mode 100644
index 5eef3cc7e1a..00000000000
--- a/.github/workflows/publish-cli.yml
+++ /dev/null
@@ -1,107 +0,0 @@
-name: publish-cli
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'packages/cli/**'
-
-permissions:
-  contents: read
-
-# A newer push waits for the running publish rather than racing its version check.
-concurrency:
-  group: publish-cli-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  build:
-    name: build
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 15
-    outputs:
-      version: ${{ steps.package_version.outputs.version }}
-      exists: ${{ steps.version_check.outputs.exists }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          persist-credentials: false
-
-      - name: Setup workspace
-        uses: ./.github/actions/setup
-        with:
-          provider: ${{ vars.CI_PROVIDER }}
-          node-version: '22'
-
-      - name: Build package
-        working-directory: packages/cli
-        run: bun run build
-
-      - name: Get package version
-        id: package_version
-        working-directory: packages/cli
-        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
-
-      - name: Check if version already exists
-        id: version_check
-        env:
-          VERSION: ${{ steps.package_version.outputs.version }}
-        run: |
-          if npm view "simstudio@$VERSION" version &> /dev/null; then
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      # Bun packs because it rewrites `workspace:` ranges to real versions,
-      # which `npm pack` would publish verbatim.
-      - name: Pack package
-        if: steps.version_check.outputs.exists == 'false'
-        working-directory: packages/cli
-        run: bun pm pack --ignore-scripts --filename "$RUNNER_TEMP/package.tgz" --quiet
-
-      - name: Upload package
-        if: steps.version_check.outputs.exists == 'false'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: package
-          path: ${{ runner.temp }}/package.tgz
-          if-no-files-found: error
-          retention-days: 1
-
-      - name: Log skipped publish
-        if: steps.version_check.outputs.exists == 'true'
-        env:
-          VERSION: ${{ steps.package_version.outputs.version }}
-        run: echo "Skipped publishing because version $VERSION already exists on npm"
-
-  # npm trusted publishing trades this job's OIDC token for a short-lived npm
-  # credential, so no npm token is stored anywhere. npm accepts the token only
-  # from GitHub-hosted runners, and only this job can mint one: it runs no
-  # repository code, it publishes the tarball the build job packed. npm runs no
-  # lifecycle scripts for a tarball, so nothing is rebuilt here, and provenance
-  # is attached automatically.
-  publish:
-    name: publish
-    needs: build
-    if: needs.build.outputs.exists == 'false'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      id-token: write
-    steps:
-      # Node 24 bundles npm 11.5.1+, which trusted publishing requires.
-      - name: Setup Node
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
-        with:
-          node-version: '24'
-
-      - name: Download package
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: package
-          path: ${{ runner.temp }}
-
-      - name: Publish to npm
-        run: npm publish "$RUNNER_TEMP/package.tgz" --access public
diff --git a/.github/workflows/publish-sim-cli.yml b/.github/workflows/publish-sim-cli.yml
index 2d87aa6bd92..8146da78d87 100644
--- a/.github/workflows/publish-sim-cli.yml
+++ b/.github/workflows/publish-sim-cli.yml
@@ -106,6 +106,16 @@ jobs:
             echo "tag=$TAG"
           } >> "$GITHUB_OUTPUT"
 
+      # `./embed` and the `#sim-cli/*` imports point at TypeScript source, which
+      # only the monorepo's own Next.js app consumes (it transpiles the package).
+      # The tarball ships `dist` alone, so published they would be dead entry
+      # points; the smoke test below fails on any export that does not exist.
+      - name: Drop source-only entry points
+        working-directory: packages/sim-cli
+        run: |
+          jq 'del(.imports, .exports["./embed"])' package.json > "$RUNNER_TEMP/package.json"
+          mv "$RUNNER_TEMP/package.json" package.json
+
       # Bun packs because it rewrites `workspace:` ranges to real versions,
       # which `npm pack` would publish verbatim. The smoke test below and the
       # publish job both use this one tarball, so what was tested is what ships.
@@ -126,6 +136,20 @@ jobs:
           SMOKE_DIR="$(mktemp -d "$RUNNER_TEMP/sim-cli-smoke.XXXXXX")"
           tar -xzf "$RUNNER_TEMP/package.tgz" -C "$SMOKE_DIR"
           test "$("$SMOKE_DIR/package/dist/index.js" --version)" = "$VERSION"
+          node -e '
+            const fs = require("node:fs")
+            const path = require("node:path")
+            const root = path.join(process.argv[1], "package")
+            const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"))
+            const targets = Object.values(pkg.exports ?? {}).flatMap((entry) =>
+              typeof entry === "string" ? [entry] : Object.values(entry)
+            )
+            const missing = targets.filter((target) => !fs.existsSync(path.join(root, target)))
+            if (missing.length > 0) {
+              console.error("Exports point at files the tarball does not contain: " + missing.join(", "))
+              process.exit(1)
+            }
+          ' "$SMOKE_DIR"
 
       - name: Verify version is unpublished
         env:
diff --git a/biome.json b/biome.json
index 85fa1db5758..9dc657a52b0 100644
--- a/biome.json
+++ b/biome.json
@@ -167,7 +167,6 @@
         "**/*.spec.ts",
         "apps/desktop/e2e/**",
         "apps/sim/vitest.setup.ts",
-        "packages/cli/**",
         "packages/sim-cli/**",
         "packages/sim-setup/**",
         "packages/db/script-migrations/**",
diff --git a/bun.lock b/bun.lock
index 5fc97ab72f8..a7968ebc050 100644
--- a/bun.lock
+++ b/bun.lock
@@ -567,22 +567,6 @@
         "typescript": "^7.0.2",
       },
     },
-    "packages/cli": {
-      "name": "simstudio",
-      "version": "0.1.19",
-      "bin": {
-        "simstudio": "dist/index.js",
-      },
-      "dependencies": {
-        "chalk": "5.6.2",
-        "commander": "^11.1.0",
-      },
-      "devDependencies": {
-        "@sim/tsconfig": "workspace:*",
-        "@types/node": "24.19.2",
-        "typescript": "^7.0.2",
-      },
-    },
     "packages/db": {
       "name": "@sim/db",
       "version": "0.1.0",
@@ -4334,7 +4318,6 @@
 
     "simple-update-notifier": ["simple-update-notifier@2.0.0", "", { "dependencies": { "semver": "^7.5.3" } }, "sha512-a2B9Y0KlNXl9u/vsW6sTIu9vGEpfKu2wRV6l1H3XEas/0gUIzGzBoP/IouTcUQbm9JWZLH3COxyn03TYlFax6w=="],
 
-    "simstudio": ["simstudio@workspace:packages/cli"],
 
     "simstudio-ts-sdk": ["simstudio-ts-sdk@workspace:packages/ts-sdk"],
 
diff --git a/knip.jsonc b/knip.jsonc
index 9490adf34c9..48d5bdd9482 100644
--- a/knip.jsonc
+++ b/knip.jsonc
@@ -144,7 +144,6 @@
       "ignoreIssues": { "components/icons.tsx": ["exports", "types", "duplicates"] }
     },
     "apps/pii": { "includeEntryExports": false },
-    "packages/cli": { "includeEntryExports": false },
     "packages/db": {
       "includeEntryExports": false,
       "entry": [
diff --git a/packages/cli/README.md b/packages/cli/README.md
deleted file mode 100644
index cddcfe564d4..00000000000
--- a/packages/cli/README.md
+++ /dev/null
@@ -1,57 +0,0 @@
-# Sim CLI
-
-Sim CLI allows you to run [Sim](https://sim.ai) using Docker with a single command.
-
-## Installation
-
-To install the Sim CLI globally, use:
-
-```bash
-npm install -g simstudio
-```
-
-## Usage
-
-To start Sim, simply run:
-
-```bash
-simstudio
-```
-
-### Options
-
-- `-p, --port <port>`: Specify the port to run Sim on (default: 3000).
-- `--no-pull`: Skip pulling the latest Docker images.
-
-## Requirements
-
-- Docker must be installed and running on your machine.
-
-## Data and secrets
-
-Everything lives under `~/.simstudio`:
-
-- `data/postgres` — the database volume.
-- `secrets.env` — secrets generated for this install on first run, then reused.
-
-Keep `secrets.env`. `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` decrypt data already stored in the
-database, so replacing them leaves that data unreadable. Back the file up alongside `data/`.
-
-You can supply your own values by editing it. The format is `KEY=value`, one per line, with `#`
-for comments — quotes are not interpreted, so leave them off.
-
-| Key | Requirement |
-|---|---|
-| `ENCRYPTION_KEY`, `API_ENCRYPTION_KEY` | exactly 64 hex characters (`openssl rand -hex 32`) |
-| `BETTER_AUTH_SECRET`, `INTERNAL_API_SECRET` | at least 32 characters, otherwise free-form |
-
-A value that does not meet its requirement is regenerated on the next run. When that replaces
-something you had set, the CLI says so and copies the previous file to `secrets.env.bak-<time>`.
-
-## Contributing
-
-Contributions are welcome! Please open an issue or submit a pull request.
-
-## License
-
-This project is licensed under the Apache-2.0 License. 
\ No newline at end of file
diff --git a/packages/cli/package.json b/packages/cli/package.json
deleted file mode 100644
index 3975d34a98c..00000000000
--- a/packages/cli/package.json
+++ /dev/null
@@ -1,55 +0,0 @@
-{
-  "name": "simstudio",
-  "version": "0.1.19",
-  "description": "Sim CLI - Run Sim with a single command",
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
-  },
-  "bin": {
-    "simstudio": "dist/index.js"
-  },
-  "scripts": {
-    "build": "tsc",
-    "type-check": "tsc --noEmit",
-    "lint": "biome check --write --unsafe .",
-    "lint:check": "biome check .",
-    "format": "biome format --write .",
-    "format:check": "biome format .",
-    "prepublishOnly": "bun run build"
-  },
-  "files": [
-    "dist"
-  ],
-  "keywords": [
-    "simstudio",
-    "ai",
-    "workflow",
-    "cli",
-    "agent",
-    "automation",
-    "docker"
-  ],
-  "author": "Sim",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/simstudioai/sim.git",
-    "directory": "packages/cli"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "dependencies": {
-    "chalk": "5.6.2",
-    "commander": "^11.1.0"
-  },
-  "devDependencies": {
-    "@sim/tsconfig": "workspace:*",
-    "@types/node": "24.19.2",
-    "typescript": "^7.0.2"
-  }
-}
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
deleted file mode 100644
index 83b606afee8..00000000000
--- a/packages/cli/src/index.ts
+++ /dev/null
@@ -1,433 +0,0 @@
-#!/usr/bin/env node
-
-import { execSync, spawn } from 'child_process'
-import { randomBytes } from 'crypto'
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  writeFileSync,
-} from 'fs'
-import { homedir } from 'os'
-import { join } from 'path'
-import { createInterface } from 'readline'
-import chalk from 'chalk'
-import { Command } from 'commander'
-
-const NETWORK_NAME = 'simstudio-network'
-const DB_CONTAINER = 'simstudio-db'
-const MIGRATIONS_CONTAINER = 'simstudio-migrations'
-const REALTIME_CONTAINER = 'simstudio-realtime'
-const APP_CONTAINER = 'simstudio-app'
-const DEFAULT_PORT = '3000'
-
-const CONFIG_DIR = join(homedir(), '.simstudio')
-const SECRETS_PATH = join(CONFIG_DIR, 'secrets.env')
-const DATA_DIR = join(CONFIG_DIR, 'data')
-
-const SECRET_KEYS = [
-  'BETTER_AUTH_SECRET',
-  'ENCRYPTION_KEY',
-  'API_ENCRYPTION_KEY',
-  'INTERNAL_API_SECRET',
-] as const
-
-/**
- * `ENCRYPTION_KEY` and `API_ENCRYPTION_KEY` are read as raw AES-256 material, so the app
- * requires exactly 64 hex characters and throws on anything else. The rest are HMAC secrets
- * of no fixed shape, needing only 32 characters — holding those to the hex form would
- * silently replace a perfectly good secret an operator chose.
- *
- * Placeholders are rejected at any length: the repository publishes example values longer
- * than the 32-character minimum, so a copied `.env.example` would otherwise pass as real.
- *
- * Mirrors `isUsableSecret` in `packages/sim-setup/src/env-files.ts`.
- */
-const AES_KEY_PATTERN = /^[0-9a-f]{64}$/i
-const AES_SECRET_KEYS = new Set<string>(['ENCRYPTION_KEY', 'API_ENCRYPTION_KEY'])
-const MIN_SECRET_LENGTH = 32
-const PLACEHOLDER_VALUES = new Set([
-  'dev-secret-at-least-32-characters-long',
-  'dev-encryption-key-at-least-32-chars',
-  'dev-internal-api-secret-min-32-chars',
-])
-
-function isPlaceholder(value: string): boolean {
-  return PLACEHOLDER_VALUES.has(value) || value.startsWith('your_') || value.startsWith('your-')
-}
-
-function isUsableSecret(key: string, value: string | undefined): boolean {
-  if (!value || isPlaceholder(value)) return false
-  return AES_SECRET_KEYS.has(key) ? AES_KEY_PATTERN.test(value) : value.length >= MIN_SECRET_LENGTH
-}
-
-/**
- * Per-install secrets, generated on first run and reused afterwards.
- *
- * They have to persist: `ENCRYPTION_KEY` decrypts credentials already stored in the
- * Postgres volume under `~/.simstudio/data`, so minting a fresh one each launch would
- * leave that data permanently unreadable. Only a value that fails its own requirement is
- * replaced.
- *
- * Regenerating one key rewrites the whole file, so the write goes to a temp file and is
- * renamed into place: a plain write truncates first, and a crash mid-write would strand a
- * still-valid `ENCRYPTION_KEY` and orphan the data it protects. Discarding a value that was
- * already there is the one destructive case, so the file is copied aside first and the
- * replacement is reported rather than logged as a routine generation.
- *
- * The file is read the way Docker reads an env file — `KEY=value`, no quote or escape
- * handling — so that what the CLI accepts and what a container would receive cannot diverge.
- *
- * Permissions are reasserted on every run: `writeFileSync`'s `mode` applies only when it
- * creates the file, so a file left by an earlier run — or one the user created — would
- * otherwise keep whatever mode it already had and stay readable by other local accounts.
- */
-function resolveSecrets(): Record<string, string> {
-  const secrets: Record<string, string> = {}
-
-  if (existsSync(SECRETS_PATH)) {
-    for (const line of readFileSync(SECRETS_PATH, 'utf8').split('\n')) {
-      if (line.trimStart().startsWith('#')) continue
-      const separator = line.indexOf('=')
-      if (separator > 0) secrets[line.slice(0, separator).trim()] = line.slice(separator + 1).trim()
-    }
-  }
-
-  const unusable = SECRET_KEYS.filter((key) => !isUsableSecret(key, secrets[key]))
-  if (unusable.length === 0) {
-    chmodSync(SECRETS_PATH, 0o600)
-    return secrets
-  }
-
-  const discarded = unusable.filter((key) => secrets[key] !== undefined)
-  for (const key of unusable) secrets[key] = randomBytes(32).toString('hex')
-
-  mkdirSync(CONFIG_DIR, { recursive: true })
-
-  if (discarded.length > 0) {
-    const backup = `${SECRETS_PATH}.bak-${new Date().toISOString().replace(/[:.]/g, '-')}`
-    copyFileSync(SECRETS_PATH, backup)
-    const losesData = discarded.some((key) => AES_SECRET_KEYS.has(key))
-    console.log(
-      chalk.yellow(
-        `⚠️  Replaced unusable ${discarded.join(', ')} in ${SECRETS_PATH}` +
-          (losesData ? ', so data encrypted with the previous value can no longer be read' : '') +
-          `. The previous file is saved at ${backup}.`
-      )
-    )
-  }
-
-  const contents = SECRET_KEYS.map((key) => `${key}=${secrets[key]}`).join('\n')
-  const pending = `${SECRETS_PATH}.tmp`
-  writeFileSync(pending, `${contents}\n`, { mode: 0o600 })
-  renameSync(pending, SECRETS_PATH)
-  chmodSync(SECRETS_PATH, 0o600)
-
-  if (discarded.length < unusable.length) {
-    console.log(chalk.gray(`🔑 Generated local secrets in ${SECRETS_PATH}`))
-  }
-
-  return secrets
-}
-
-const program = new Command()
-
-program.name('simstudio').description('Run Sim using Docker').version('0.1.0')
-
-program
-  .option('-p, --port <port>', 'Port to run Sim on', DEFAULT_PORT)
-  .option('-y, --yes', 'Skip interactive prompts and use defaults')
-  .option('--no-pull', 'Skip pulling the latest Docker images')
-
-function isDockerRunning(): Promise<boolean> {
-  return new Promise((resolve) => {
-    const docker = spawn('docker', ['info'])
-
-    docker.on('close', (code) => {
-      resolve(code === 0)
-    })
-  })
-}
-
-async function runCommand(command: string[]): Promise<boolean> {
-  return new Promise((resolve) => {
-    const process = spawn(command[0], command.slice(1), { stdio: 'inherit' })
-    process.on('error', () => {
-      resolve(false)
-    })
-    process.on('close', (code) => {
-      resolve(code === 0)
-    })
-  })
-}
-
-async function ensureNetworkExists(): Promise<boolean> {
-  try {
-    const networks = execSync('docker network ls --format "{{.Name}}"').toString()
-    if (!networks.includes(NETWORK_NAME)) {
-      console.log(chalk.blue(`🔄 Creating Docker network '${NETWORK_NAME}'...`))
-      return await runCommand(['docker', 'network', 'create', NETWORK_NAME])
-    }
-    return true
-  } catch (error) {
-    console.error('Failed to check networks:', error)
-    return false
-  }
-}
-
-async function pullImage(image: string): Promise<boolean> {
-  console.log(chalk.blue(`🔄 Pulling image ${image}...`))
-  return await runCommand(['docker', 'pull', image])
-}
-
-async function stopAndRemoveContainer(name: string): Promise<void> {
-  try {
-    execSync(`docker stop ${name} 2>/dev/null || true`)
-    execSync(`docker rm ${name} 2>/dev/null || true`)
-  } catch (_error) {
-    // Ignore errors, container might not exist
-  }
-}
-
-async function cleanupExistingContainers(): Promise<void> {
-  console.log(chalk.blue('🧹 Cleaning up any existing containers...'))
-  await stopAndRemoveContainer(APP_CONTAINER)
-  await stopAndRemoveContainer(DB_CONTAINER)
-  await stopAndRemoveContainer(MIGRATIONS_CONTAINER)
-  await stopAndRemoveContainer(REALTIME_CONTAINER)
-}
-
-async function main() {
-  const options = program.parse().opts()
-
-  console.log(chalk.blue('🚀 Starting Sim...'))
-
-  // An install holding a database but no secrets file predates per-install secrets. Both
-  // reads must happen before Docker creates the volume directory on a first run.
-  const upgradingExistingInstall =
-    existsSync(join(DATA_DIR, 'postgres')) && !existsSync(SECRETS_PATH)
-
-  // Resolved before any container starts so a filesystem problem here does not leave a
-  // half-started stack behind.
-  let secrets: Record<string, string>
-  try {
-    secrets = resolveSecrets()
-  } catch (error) {
-    console.error(chalk.red(`❌ Could not prepare ${SECRETS_PATH}`))
-    console.error(chalk.red(`   ${error instanceof Error ? error.message : String(error)}`))
-    console.error(chalk.yellow('   Check that you own the file and it is readable and writable.'))
-    process.exit(1)
-  }
-
-  // Check if Docker is installed and running
-  const dockerRunning = await isDockerRunning()
-  if (!dockerRunning) {
-    console.error(
-      chalk.red('❌ Docker is not running or not installed. Please start Docker and try again.')
-    )
-    process.exit(1)
-  }
-
-  // Use port from options, with 3000 as default
-  const port = options.port
-
-  // Pull latest images if not skipped
-  if (options.pull) {
-    await pullImage('ghcr.io/simstudioai/simstudio:latest')
-    await pullImage('ghcr.io/simstudioai/migrations:latest')
-    await pullImage('ghcr.io/simstudioai/realtime:latest')
-    await pullImage('pgvector/pgvector:pg17')
-  }
-
-  // Ensure Docker network exists
-  if (!(await ensureNetworkExists())) {
-    console.error(chalk.red('❌ Failed to create Docker network'))
-    process.exit(1)
-  }
-
-  // Clean up any existing containers
-  await cleanupExistingContainers()
-
-  // Create data directory
-  const dataDir = DATA_DIR
-  if (!existsSync(dataDir)) {
-    try {
-      mkdirSync(dataDir, { recursive: true })
-    } catch (_error) {
-      console.error(chalk.red(`❌ Failed to create data directory: ${dataDir}`))
-      process.exit(1)
-    }
-  }
-
-  // Start PostgreSQL container
-  console.log(chalk.blue('🔄 Starting PostgreSQL database...'))
-  const dbSuccess = await runCommand([
-    'docker',
-    'run',
-    '-d',
-    '--name',
-    DB_CONTAINER,
-    '--network',
-    NETWORK_NAME,
-    '-e',
-    'POSTGRES_USER=postgres',
-    '-e',
-    'POSTGRES_PASSWORD=postgres',
-    '-e',
-    'POSTGRES_DB=simstudio',
-    '-v',
-    `${dataDir}/postgres:/var/lib/postgresql/data`,
-    'pgvector/pgvector:pg17',
-  ])
-
-  if (!dbSuccess) {
-    console.error(chalk.red('❌ Failed to start PostgreSQL'))
-    process.exit(1)
-  }
-
-  // Wait for PostgreSQL to be ready
-  console.log(chalk.blue('⏳ Waiting for PostgreSQL to be ready...'))
-  let pgReady = false
-  for (let i = 0; i < 30; i++) {
-    try {
-      execSync(`docker exec ${DB_CONTAINER} pg_isready -U postgres`)
-      pgReady = true
-      break
-    } catch (_error) {
-      await new Promise((resolve) => setTimeout(resolve, 1000))
-    }
-  }
-
-  if (!pgReady) {
-    console.error(chalk.red('❌ PostgreSQL failed to become ready'))
-    process.exit(1)
-  }
-
-  // Run migrations
-  console.log(chalk.blue('🔄 Running database migrations...'))
-  const migrationsSuccess = await runCommand([
-    'docker',
-    'run',
-    '--rm',
-    '--name',
-    MIGRATIONS_CONTAINER,
-    '--network',
-    NETWORK_NAME,
-    '-e',
-    `DATABASE_URL=postgresql://postgres:postgres@${DB_CONTAINER}:5432/simstudio`,
-    'ghcr.io/simstudioai/migrations:latest',
-    'bun',
-    'run',
-    'db:migrate',
-  ])
-
-  if (!migrationsSuccess) {
-    console.error(chalk.red('❌ Failed to run migrations'))
-    process.exit(1)
-  }
-
-  // Start the realtime server
-  console.log(chalk.blue('🔄 Starting Realtime Server...'))
-  const realtimeSuccess = await runCommand([
-    'docker',
-    'run',
-    '-d',
-    '--name',
-    REALTIME_CONTAINER,
-    '--network',
-    NETWORK_NAME,
-    '-p',
-    '3002:3002',
-    '-e',
-    `DATABASE_URL=postgresql://postgres:postgres@${DB_CONTAINER}:5432/simstudio`,
-    '-e',
-    `BETTER_AUTH_URL=http://localhost:${port}`,
-    '-e',
-    `NEXT_PUBLIC_APP_URL=http://localhost:${port}`,
-    '-e',
-    `BETTER_AUTH_SECRET=${secrets.BETTER_AUTH_SECRET}`,
-    '-e',
-    `INTERNAL_API_SECRET=${secrets.INTERNAL_API_SECRET}`,
-    'ghcr.io/simstudioai/realtime:latest',
-  ])
-
-  if (!realtimeSuccess) {
-    console.error(chalk.red('❌ Failed to start Realtime Server'))
-    process.exit(1)
-  }
-
-  // Start the main application
-  console.log(chalk.blue('🔄 Starting Sim...'))
-  const appSuccess = await runCommand([
-    'docker',
-    'run',
-    '-d',
-    '--name',
-    APP_CONTAINER,
-    '--network',
-    NETWORK_NAME,
-    '-p',
-    `${port}:3000`,
-    '-e',
-    `DATABASE_URL=postgresql://postgres:postgres@${DB_CONTAINER}:5432/simstudio`,
-    '-e',
-    `BETTER_AUTH_URL=http://localhost:${port}`,
-    '-e',
-    `NEXT_PUBLIC_APP_URL=http://localhost:${port}`,
-    '-e',
-    `BETTER_AUTH_SECRET=${secrets.BETTER_AUTH_SECRET}`,
-    '-e',
-    `ENCRYPTION_KEY=${secrets.ENCRYPTION_KEY}`,
-    '-e',
-    // Without this the app stores workspace API keys in plain text. Adding it is safe on an
-    // existing install: values that predate it lack the encrypted shape and are read as-is.
-    `API_ENCRYPTION_KEY=${secrets.API_ENCRYPTION_KEY}`,
-    '-e',
-    `INTERNAL_API_SECRET=${secrets.INTERNAL_API_SECRET}`,
-    'ghcr.io/simstudioai/simstudio:latest',
-  ])
-
-  if (!appSuccess) {
-    console.error(chalk.red('❌ Failed to start Sim'))
-    process.exit(1)
-  }
-
-  console.log(chalk.green(`✅ Sim is now running at ${chalk.bold(`http://localhost:${port}`)}`))
-
-  if (upgradingExistingInstall) {
-    console.log(
-      chalk.yellow('ℹ️  This install now has its own secrets, so any earlier sign-in has expired.')
-    )
-  }
-  console.log(
-    chalk.yellow(
-      `🛑 To stop all containers, run: ${chalk.bold('docker stop simstudio-app simstudio-db simstudio-realtime')}`
-    )
-  )
-
-  // Handle Ctrl+C
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  })
-
-  rl.on('SIGINT', async () => {
-    console.log(chalk.yellow('\n🛑 Stopping Sim...'))
-
-    // Stop containers
-    await stopAndRemoveContainer(APP_CONTAINER)
-    await stopAndRemoveContainer(DB_CONTAINER)
-    await stopAndRemoveContainer(REALTIME_CONTAINER)
-
-    console.log(chalk.green('✅ Sim has been stopped'))
-    process.exit(0)
-  })
-}
-
-main().catch((error) => {
-  console.error(chalk.red('❌ An error occurred:'), error)
-  process.exit(1)
-})
diff --git a/packages/cli/tsconfig.json b/packages/cli/tsconfig.json
deleted file mode 100644
index dd8c62518df..00000000000
--- a/packages/cli/tsconfig.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "extends": "@sim/tsconfig/library-build.json",
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "nodenext",
-    "moduleResolution": "nodenext",
-    "outDir": "./dist",
-    "rootDir": "./src"
-  },
-  "include": ["src/**/*"],
-  "exclude": ["node_modules", "dist"]
-}
diff --git a/packages/sim-setup/THIRD_PARTY_LICENSES b/packages/sim-setup/THIRD_PARTY_LICENSES
index 8212679762c..45c815c678b 100644
--- a/packages/sim-setup/THIRD_PARTY_LICENSES
+++ b/packages/sim-setup/THIRD_PARTY_LICENSES
@@ -9,6 +9,19 @@ Copyright (c) 2016-present Vercel, Inc.
 chalk
 Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
 
+fast-string-truncated-width and fast-string-width
+Copyright (c) 2024-present Fabio Spampinato
+
+fast-wrap-ansi
+Copyright (c) 2025 James Garbutt
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+ipaddr.js
+Copyright (C) 2011-2017 whitequark <whitequark@whitequark.org>
+
+sisteransi
+Copyright (c) 2018 Terkel Gjervig Nielsen
+
 The dependencies above are licensed under the MIT License:
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
diff --git a/packages/sim-setup/src/db.ts b/packages/sim-setup/src/db.ts
index 2eadc6b6bb3..774b5e169e1 100644
--- a/packages/sim-setup/src/db.ts
+++ b/packages/sim-setup/src/db.ts
@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process'
-import { DB_CONTAINER, type Detection } from './detect'
+import { DB_CONTAINER, type Detection, LOOPBACK_HOST } from './detect'
 import { ensureDocker } from './docker'
 import { generateSecret } from './env-files'
 import { SetupError } from './errors'
@@ -18,7 +18,7 @@ const AUTH_FAILURE = /password authentication failed/i
  * would fail a password that is actually correct.
  */
 function buildDsn(password: string, hostPort: string | number): string {
-  return `postgresql://postgres:${encodeURIComponent(password)}@localhost:${hostPort}/simstudio`
+  return `postgresql://postgres:${encodeURIComponent(password)}@${LOOPBACK_HOST}:${hostPort}/simstudio`
 }
 
 export function docker(args: string[]): void {
@@ -266,7 +266,7 @@ async function startManagedContainer(detection: Detection): Promise<string> {
     '-e',
     'POSTGRES_DB=simstudio',
     '-p',
-    `${hostPort}:5432`,
+    `${LOOPBACK_HOST}:${hostPort}:5432`,
     'pgvector/pgvector:pg17',
   ])
   const spin = p.spinner()
diff --git a/packages/sim-setup/src/detect.ts b/packages/sim-setup/src/detect.ts
index 6df723367bb..08df75e464c 100644
--- a/packages/sim-setup/src/detect.ts
+++ b/packages/sim-setup/src/detect.ts
@@ -8,6 +8,51 @@ export const MANAGED_LABEL = 'managed-by=sim-setup'
 export const DB_CONTAINER = 'sim-postgres'
 export const REDIS_CONTAINER = 'sim-redis'
 
+/**
+ * The only host address the managed containers publish on. Docker's default
+ * (`-p port:port`) listens on every interface and its rules bypass the host
+ * firewall, which would expose a password-less Redis to the network. Clients
+ * use this literal rather than `localhost`, which can resolve to `::1`.
+ */
+export const LOOPBACK_HOST = '127.0.0.1'
+
+/**
+ * Whether a container publishes `containerPort` beyond `LOOPBACK_HOST`, read from
+ * its static config so a stopped container answers too. Containers created
+ * before managed ports were bound to loopback report an empty `HostIp`.
+ */
+function publishedBeyondLoopback(container: string, containerPort: string): boolean {
+  const out = commandOutput('docker', [
+    'inspect',
+    container,
+    '--format',
+    `{{json (index .HostConfig.PortBindings "${containerPort}")}}`,
+  ])
+  if (!out) return false
+  try {
+    const bindings = JSON.parse(out) as { HostIp?: string }[] | null
+    return (bindings ?? []).some((binding) => binding.HostIp !== LOOPBACK_HOST)
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Managed containers that an earlier sim-setup published on every interface.
+ * They are reported, not recreated: Redis holds live realtime sessions and the
+ * Postgres URL may name its own database, so replacing either is the user's call.
+ */
+export function exposedManagedContainers(detection: Detection): string[] {
+  const exposed: string[] = []
+  if (detection.dbContainer?.managed && publishedBeyondLoopback(DB_CONTAINER, '5432/tcp')) {
+    exposed.push(DB_CONTAINER)
+  }
+  if (detection.redisContainer?.managed && publishedBeyondLoopback(REDIS_CONTAINER, '6379/tcp')) {
+    exposed.push(REDIS_CONTAINER)
+  }
+  return exposed
+}
+
 const SHELL_LLM_KEYS = [
   'OPENAI_API_KEY',
   'ANTHROPIC_API_KEY',
@@ -34,7 +79,7 @@ export interface Detection {
 
 export function portOpen(port: number, timeoutMs = 500): Promise<boolean> {
   return new Promise((resolve) => {
-    const socket = net.connect({ port, host: '127.0.0.1' })
+    const socket = net.connect({ port, host: LOOPBACK_HOST })
     const done = (result: boolean) => {
       socket.destroy()
       resolve(result)
diff --git a/packages/sim-setup/src/env-files.test.ts b/packages/sim-setup/src/env-files.test.ts
index 6a9b57e4aa9..5872a23356a 100644
--- a/packages/sim-setup/src/env-files.test.ts
+++ b/packages/sim-setup/src/env-files.test.ts
@@ -20,6 +20,22 @@ describe('upsertEnv', () => {
       )
     ).toThrow('Duplicate active RESEND_API_KEY entries')
   })
+
+  it.each(['ab #cd', 'a#b', '  padded ', "'starts-with-quote", "it's #1"])(
+    'reads back %j exactly as it was written',
+    (value) => {
+      expect(parseEnv(upsertEnv('', 'SECRET', value)).get('SECRET')).toBe(value)
+    }
+  )
+
+  it('writes an ordinary value without quotes', () => {
+    const dsn = 'postgresql://postgres:p%23w@127.0.0.1:5432/simstudio'
+    expect(upsertEnv('', 'DATABASE_URL', dsn)).toBe(`DATABASE_URL=${dsn}\n`)
+  })
+
+  it('refuses a value that would spill onto a second line', () => {
+    expect(() => upsertEnv('', 'SECRET', 'first\nINJECTED=1')).toThrow('line break')
+  })
 })
 
 describe('reconcileEnvContent', () => {
diff --git a/packages/sim-setup/src/env-files.ts b/packages/sim-setup/src/env-files.ts
index 686f4e6bf6d..331afb90092 100644
--- a/packages/sim-setup/src/env-files.ts
+++ b/packages/sim-setup/src/env-files.ts
@@ -88,6 +88,23 @@ export function readEnvFile(target: EnvTarget): EnvFile {
   return { target, path: filePath, exists, content, vars: parseEnv(content) }
 }
 
+/**
+ * Quotes a value only when `#`, edge whitespace, or a leading quote would change
+ * it for `parseValue`, Next's dotenv, Bun, or Docker Compose. Single quotes are
+ * preferred because all four read them literally.
+ */
+function formatEnvValue(key: string, value: string): string {
+  if (/[\r\n]/.test(value)) {
+    throw new Error(`${key} cannot be written to an environment file: it contains a line break`)
+  }
+  if (value === value.trim() && !value.includes('#') && !/^["'`]/.test(value)) return value
+  if (!value.includes("'")) return `'${value}'`
+  if (!/["\\$`]/.test(value)) return `"${value}"`
+  throw new Error(
+    `${key} cannot be written to an environment file: it mixes quotes with a # or edge whitespace`
+  )
+}
+
 /**
  * Sets a key in env-file content: replaces the active line, uncomments a
  * commented-out line, or appends. Returns the new content.
@@ -102,7 +119,7 @@ export function upsertEnv(content: string, key: string, value: string): string {
   }
   const activeIdx = activeIndexes[0] ?? -1
   const idx = activeIdx !== -1 ? activeIdx : lines.findIndex((l) => commentedRe.test(l))
-  const newLine = `${key}=${value}`
+  const newLine = `${key}=${formatEnvValue(key, value)}`
   if (idx === -1) {
     const trailing = lines.length > 0 && lines[lines.length - 1] === ''
     if (trailing) lines.splice(lines.length - 1, 0, newLine)
diff --git a/packages/sim-setup/src/lifecycle.ts b/packages/sim-setup/src/lifecycle.ts
index 53f781edc1f..3e38df95c7f 100644
--- a/packages/sim-setup/src/lifecycle.ts
+++ b/packages/sim-setup/src/lifecycle.ts
@@ -601,22 +601,24 @@ async function reset(install: Install | null): Promise<void> {
     p.log.info('Reset cancelled.')
     return
   }
-  if (install?.kind === 'compose') {
-    const backup = archiveFile(path.join(install.dir, '.env'))
-    if (backup) p.log.step(`Archived ${backup}`)
-  } else {
-    for (const target of ['sim', 'realtime', 'db', 'root'] as const) {
-      const backup = archiveEnvFile(target)
-      if (backup) p.log.step(`Archived ${backup}`)
-    }
-  }
+  // Tear down before archiving: Compose reads the required secrets from `.env`
+  // even for `down`, and a failed teardown should leave the config in place.
   if (install?.kind === 'compose') {
     dockerRun(composeArgs(install, 'down', '-v'), 'docker compose down -v failed', install.dir)
     p.log.step('Containers and volumes removed')
   } else if (install?.kind === 'dev') {
     const names = managedNames(install)
-    if (names.length) spawnSync('docker', ['rm', '-f', ...names], { cwd: ROOT, stdio: 'ignore' })
-    spawnSync('docker', ['volume', 'rm', POSTGRES_VOLUME], { cwd: ROOT, stdio: 'ignore' })
+    if (names.length) dockerRun(['rm', '-f', ...names], 'docker rm failed')
+    // A volume that never existed is already reset; only one that survives is a failure.
+    const removal = spawnSync('docker', ['volume', 'rm', POSTGRES_VOLUME], { encoding: 'utf8' })
+    if (
+      removal.status !== 0 &&
+      spawnSync('docker', ['volume', 'inspect', POSTGRES_VOLUME], { stdio: 'ignore' }).status === 0
+    ) {
+      throw new SetupError(
+        `could not remove the ${POSTGRES_VOLUME} volume: ${removal.stderr.trim()}`
+      )
+    }
     p.log.step('Managed containers and Postgres volume removed')
   } else if (install?.kind === 'k8s') {
     const uninstall = spawnSync(
@@ -624,11 +626,9 @@ async function reset(install: Install | null): Promise<void> {
       ['uninstall', K8S_RELEASE, '--kube-context', install.context, '-n', K8S_NAMESPACE],
       { stdio: 'inherit' }
     )
-    // Env files are already archived, so a failed uninstall leaves a live release
-    // with no local config — the worst thing to do is call that a success.
     if (uninstall.status !== 0) {
       throw new SetupError(
-        `env files were archived, but helm uninstall failed — the ${K8S_RELEASE} release is still running.`,
+        `helm uninstall failed — the ${K8S_RELEASE} release is still running and your env files were left in place.`,
         [
           `retry: ${theme.command(`helm uninstall ${K8S_RELEASE} --kube-context ${shq(install.context)} -n ${K8S_NAMESPACE}`)}`,
           `check the release: ${theme.command(`helm status ${K8S_RELEASE} --kube-context ${shq(install.context)} -n ${K8S_NAMESPACE}`)}`,
@@ -637,6 +637,15 @@ async function reset(install: Install | null): Promise<void> {
     }
     p.log.step(`Uninstalled ${K8S_RELEASE}`)
   }
+  if (install?.kind === 'compose') {
+    const backup = archiveFile(path.join(install.dir, '.env'))
+    if (backup) p.log.step(`Archived ${backup}`)
+  } else {
+    for (const target of ['sim', 'realtime', 'db', 'root'] as const) {
+      const backup = archiveEnvFile(target)
+      if (backup) p.log.step(`Archived ${backup}`)
+    }
+  }
   p.note(`start fresh with ${theme.command('npx sim-setup')}`, 'Reset complete')
 }
 
diff --git a/packages/sim-setup/src/modes/dev.ts b/packages/sim-setup/src/modes/dev.ts
index 3fa36b7ae8e..6f0dd0663eb 100644
--- a/packages/sim-setup/src/modes/dev.ts
+++ b/packages/sim-setup/src/modes/dev.ts
@@ -4,7 +4,7 @@ import { truncate } from '@sim/utils/string'
 import { EMAIL_SETUP, JOBS_SETUP, STORAGE_SETUP } from '../capability-config'
 import { promptCapabilitySetup, stageCapabilitySetupTransition } from '../capability-setup'
 import { resolveDatabase } from '../db'
-import type { Detection } from '../detect'
+import { type Detection, exposedManagedContainers, LOOPBACK_HOST } from '../detect'
 import { ROOT, readEnvFile, reconcileEnvValues, writeEnvValues } from '../env-files'
 import { SetupError } from '../errors'
 import { pgProbe } from '../probes'
@@ -75,6 +75,12 @@ export async function runDevMode(
   detection: Detection,
   quick: boolean
 ): Promise<{ startNow: boolean; script: string }> {
+  const exposed = exposedManagedContainers(detection)
+  if (exposed.length > 0) {
+    p.log.warn(
+      `${exposed.join(' and ')} ${exposed.length > 1 ? 'publish their ports' : 'publishes its port'} on every network interface (created by an earlier sim-setup). To keep ${exposed.length > 1 ? 'them' : 'it'} on ${LOOPBACK_HOST}, stop the app, run ${theme.command('npx sim-setup down')} (data is kept), then re-run ${theme.command('npx sim-setup')}.`
+    )
+  }
   const sim = readEnvFile('sim')
   const dsn = await resolveDatabase(detection, sim.vars.get('DATABASE_URL'))
   const secrets = collectSecrets(sim)
diff --git a/packages/sim-setup/src/redis.ts b/packages/sim-setup/src/redis.ts
index 329c31e799c..26bbdc81c1c 100644
--- a/packages/sim-setup/src/redis.ts
+++ b/packages/sim-setup/src/redis.ts
@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process'
 import { docker } from './db'
-import { type Detection, REDIS_CONTAINER } from './detect'
+import { type Detection, LOOPBACK_HOST, REDIS_CONTAINER } from './detect'
 import { ensureDocker } from './docker'
 import { SetupError } from './errors'
 import { redisPing, waitFor } from './probes'
@@ -18,7 +18,7 @@ function managedRedisUrl(): string | null {
   const result = spawnSync('docker', ['port', REDIS_CONTAINER, '6379/tcp'], { encoding: 'utf8' })
   if (result.status !== 0) return null
   const port = result.stdout.trim().split('\n')[0]?.split(':').pop()
-  return port ? `redis://localhost:${port}` : null
+  return port ? `redis://${LOOPBACK_HOST}:${port}` : null
 }
 
 async function pingWithSpinner(url: string, label: string): Promise<boolean> {
@@ -31,7 +31,7 @@ async function pingWithSpinner(url: string, label: string): Promise<boolean> {
 
 async function startManagedRedis(detection: Detection): Promise<string> {
   const hostPort = detection.redisPortOpen ? 6380 : 6379
-  const url = `redis://localhost:${hostPort}`
+  const url = `redis://${LOOPBACK_HOST}:${hostPort}`
   // A prior sim-redis (unhealthy, or bound to a stale port) would collide on the
   // name. Unlike Postgres this container has no data volume, so removing it
   // loses nothing — no prompt needed. `rm -f` is a no-op when none exists.
@@ -44,7 +44,7 @@ async function startManagedRedis(detection: Detection): Promise<string> {
     '--label',
     'managed-by=sim-setup',
     '-p',
-    `${hostPort}:6379`,
+    `${LOOPBACK_HOST}:${hostPort}:6379`,
     'redis:7-alpine',
   ])
   const spin = p.spinner()
diff --git a/scripts/check-utils-enforcement.test.ts b/scripts/check-utils-enforcement.test.ts
index 94727e6e5ba..d3a26503a61 100644
--- a/scripts/check-utils-enforcement.test.ts
+++ b/scripts/check-utils-enforcement.test.ts
@@ -15,7 +15,7 @@ describe('helper-source exemptions', () => {
   })
 
   it('still applies browser-runtime rules to allowlisted files', () => {
-    expect(descriptions('packages/cli/src/index.ts', ES2023)).toHaveLength(1)
+    expect(descriptions('packages/ts-sdk/src/index.ts', ES2023)).toHaveLength(1)
   })
 
   it('lets @sim/utils use the primitive its helper replaces', () => {
diff --git a/scripts/check-utils-enforcement.ts b/scripts/check-utils-enforcement.ts
index eb034d6d05e..e2ef380ee3d 100644
--- a/scripts/check-utils-enforcement.ts
+++ b/scripts/check-utils-enforcement.ts
@@ -38,9 +38,8 @@ const UTILS_SOURCE = 'packages/utils/src/'
 
 /** Other files allowed to use the underlying primitives. */
 const ALLOWLISTED_FILES = new Set([
-  // Published standalone CLIs: `@sim/utils` is private, so they carry local
+  // Published standalone SDK: `@sim/utils` is private, so it carries local
   // copies rather than a dependency that only resolves inside the monorepo.
-  'packages/cli/src/index.ts',
   'packages/ts-sdk/src/index.ts',
   // CJS bundle — cannot use ES module imports
   'apps/sim/lib/execution/isolated-vm-worker.cjs',