@thinkingai/ae-cli 6.0.53 → 6.0.54

package/skills/ae-analysis/references/system_query_monitor_overview.md

@@ -12,6 +12,8 @@ ae-cli system query-monitor overview --company-id <company-id> --cluster-names '
 
 Capability id: `system.query_monitor.overview`.
 
+Selected project IDs and space codes must belong to the supplied company. A different company's scope is rejected before chart data is read.
+
 The response uses `ok`, `data`, and `meta`. Treat empty `data` as success when `ok=true`; preserve `request_id` and `invocation_id` when present.
 
 ## Parameters

package/skills/ae-analysis/references/system_query_task_cancel.md

@@ -13,6 +13,8 @@ ae-cli system query-task cancel --company-id <company-id> --task-id <task-id> --
 
 Capability id: `system.query_task.cancel`.
 
+The task must belong to `--company-id` by project or workspace. A foreign-company or missing task ID is rejected before cancellation.
+
 Run `--dry-run` first, summarize the affected target and impact, then wait for explicit user confirmation before rerunning the unchanged command with global `--yes`.
 
 The response uses `ok`, `data`, and `meta`. Treat empty `data` as success when `ok=true`; preserve `request_id` and `invocation_id` when present.

package/skills/ae-analysis/references/system_query_task_export.md

@@ -12,6 +12,10 @@ ae-cli system query-task export --company-id <company_id> --start-time '2026-07-
 
 Capability id: `system.query_task.export`.
 
+Selected project IDs and space codes must belong to the supplied company. A different company's scope is rejected before an export is submitted.
+
+The time range has the same completion-time semantics as [`query-task list`](system_query_task_list.md): inclusive boundary seconds, including milliseconds within the end second, and a maximum 31-day window. The CSV `start_time` is task initiation time, not the timestamp used for range filtering.
+
 If the required filter mappings are unknown, call `ae-cli system query-task options --company-id <company_id>` once. Reuse verified mappings within the same company/project scope; do not guess filter codes or cluster names.
 
 Use `--output` to wait and download the completed artifact. If interrupted, resume with `ae-cli analysis run wait --run-id <run_id> --output <file>` using the same export response. See [`run_wait.md`](run_wait.md).
@@ -25,8 +29,8 @@ The response uses `ok`, `data`, and `meta`. Empty task data is a successful expo
 | Parameter | Required | Description |
 |---|---|---|
 | `--company-id` | Yes | Company ID. |
-| `--start-time` | Yes | Inclusive range start in `yyyy-MM-dd HH:mm:ss`. |
-| `--end-time` | Yes | Inclusive range end in `yyyy-MM-dd HH:mm:ss`. |
+| `--start-time` | Yes | Inclusive completion-time range start in `yyyy-MM-dd HH:mm:ss`. |
+| `--end-time` | Yes | Inclusive completion-time range end, including the entire second, in `yyyy-MM-dd HH:mm:ss`. |
 | `--status-codes` | Yes | Non-empty task status-code JSON array. |
 | `--content-codes` | Yes | Non-empty query content-code JSON array. |
 | `--task-type-codes` | Yes | Non-empty query task-type-code JSON array. |

package/skills/ae-analysis/references/system_query_task_get.md

@@ -12,6 +12,8 @@ ae-cli system query-task get --company-id <company-id> --task-id <task-id>
 
 Capability id: `system.query_task.get`.
 
+The task must belong to `--company-id` by project or workspace. A foreign-company or missing task ID is rejected before details are read.
+
 The response uses `ok`, `data`, and `meta`. Treat empty `data` as success when `ok=true`; preserve `request_id` and `invocation_id` when present.
 
 ## Parameters

package/skills/ae-analysis/references/system_query_task_list.md

@@ -1,6 +1,6 @@
 # system query-task list
 
-Use when the user needs to list query-monitor tasks within a mandatory bounded time range.
+Use when the user needs historical query logs within a mandatory bounded time range. For the realtime monitoring tab, use `ae-cli system query-task realtime-list` instead.
 
 Do not use it outside the system query-task operation or with fields absent from the inspected capability schema.
 
@@ -14,6 +14,10 @@ Capability id: `system.query_task.list`.
 
 If the required filter mappings are unknown, call `ae-cli system query-task options --company-id <company_id>` once. Reuse verified mappings within the same company/project scope; do not guess filter codes or cluster names.
 
+Project IDs and workspace codes must belong to `--company-id`; foreign-company values are rejected before querying. The global system-project ID `-1` cannot be selected as a company-scoped project.
+
+The range filters query **completion time**, not the returned `start_time` (task initiation time). Both boundary seconds are inclusive, including milliseconds within the end second. A task started before the window can appear if it completed inside it. Compare list and export using the same completion-time window; do not reject rows solely because `start_time` is outside it. The range must not exceed 31 days.
+
 The response uses `ok`, `data`, and `meta`. Treat empty `data` as success when `ok=true`; preserve `request_id` and `invocation_id` when present.
 
 ## Parameters
@@ -21,8 +25,8 @@ The response uses `ok`, `data`, and `meta`. Treat empty `data` as success when `
 | Parameter | Required | Description |
 |---|---|---|
 | `--company-id` | Yes | Company ID. |
-| `--start-time` | Yes | Inclusive lower bound in `yyyy-MM-dd HH:mm:ss`. |
-| `--end-time` | Yes | Inclusive upper bound in `yyyy-MM-dd HH:mm:ss`. |
+| `--start-time` | Yes | Inclusive completion-time lower bound in `yyyy-MM-dd HH:mm:ss`. |
+| `--end-time` | Yes | Inclusive completion-time upper bound, including the entire second, in `yyyy-MM-dd HH:mm:ss`. |
 | `--project-ids` | Conditional | Non-empty project IDs or space codes are required. |
 | `--space-codes` | Conditional | Non-empty space codes or project IDs are required. |
 | `--status-codes` | Yes | Task status-code JSON array. |

package/skills/ae-analysis/references/system_query_task_options.md

@@ -1,6 +1,6 @@
 # system query-task options
 
-Use before query-task list or export to discover every valid filter value exposed by the current environment.
+Use before query-task list, realtime-list, or export to discover valid filter values exposed by the current environment.
 
 Command:
 
@@ -18,7 +18,7 @@ The response maps:
 - `projects[].project_id` and `workspaces[].space_code` to display names.
 - `clusters[].cluster_name` to its query engine metadata.
 
-Use the returned codes and names unchanged in `query-task list` or `query-task export`. Do not infer codes from UI labels or examples.
+Project and workspace options are limited to `--company-id`; status, content, task type, and cluster codes remain discoverable. Use the returned codes and names unchanged in `query-task list`, `query-task realtime-list`, or `query-task export`. Discovery does not authorize a project or workspace; execution still checks company ownership. Do not infer codes from UI labels or examples.
 
 ## Parameters
 

package/skills/ae-analysis/references/system_query_task_realtime_list.md

@@ -0,0 +1,15 @@
+# system query-task realtime-list
+
+Use for a one-time snapshot of the Query Monitor **Realtime Query** tab. The existing `query-task list` command is for historical **Query Logs** and requires a fixed start/end range. Do not substitute one for the other.
+
+```bash
+ae-cli system query-task realtime-list --company-id <company_id> --project-ids '[123]' --cluster-names '["cluster-a"]' --duration-minutes 30 --limit 100
+```
+
+Capability ID: `system.query_task.realtime_list`. Run `ae-cli system query-task options --company-id <company_id>` first if IDs, status codes, or cluster names are unknown. Discovery does not grant access; a project or workspace outside the company is rejected during execution.
+
+The global system-project ID `-1` cannot be selected as a company-scoped project. System tasks tied to a company workspace remain visible through that workspace where applicable.
+
+Provide at least one non-empty `--project-ids` or `--space-codes` JSON array, and a non-empty `--cluster-names` JSON array. `--duration-minutes` defaults to 30 (range 1–30). Optional `--status-codes` filters task states. `--limit` defaults to 100 (maximum 200). This command does not poll or cancel tasks.
+
+The response contains `items`, `limit`, `has_more`, and `snapshot_at`. `has_more` means the bounded snapshot has additional matching rows, not a full historical count. Task rows omit credentials, user identity tokens, internal SQL gateway selection, and SQL text. To inspect one task, use `query-task get`; cancel remains a separate high-risk operation requiring confirmation.

package/skills/ae-analysis/references/user_tag_models.md

@@ -62,6 +62,8 @@ From a fixed date through today:
 
 ## SQL tag
 
+Return one row per distinct analysis-subject ID, with the tag value in the second column; a list tag requires a native SQL `ARRAY(varchar)` value, not a JSON string or repeated scalar rows. The server infers the tag type from that column, so do not add `selectType`; aggregate repeated subjects in the SQL itself, for example with `array_agg(DISTINCT CAST(value AS varchar))` and `GROUP BY` the subject ID.
+
 ```json
 {"type":"sql","sql":"SELECT \"#user_id\", 'payer' AS tag_value FROM hive.ta.v_event_1 WHERE ${PartDate:partdate} AND \"$part_event\"='pay'","params":[{"name":"partdate","type":"part_date","recent_day":"1-7"}]}
 ```

package/skills/ae-analysis/scripts/project-semantic-knowledge-wiki/build-empty-skeleton.mjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { normalizeSourceForHash } from './precompiled-source.mjs';
+
+const args = Object.fromEntries(process.argv.slice(2).reduce((pairs, part, index, all) => {
+  if (part.startsWith('--') && all[index + 1] && !all[index + 1].startsWith('--')) {
+    pairs.push([part.slice(2), all[index + 1]]);
+  }
+  return pairs;
+}, []));
+const packageRoot = path.resolve(required('asset-package'));
+const outputRoot = path.resolve(required('output'));
+const descriptor = readJson(path.join(packageRoot, '.asset-package.json'));
+const manifest = readJson(path.join(packageRoot, 'manifest.json'));
+const projectId = Number(descriptor.project_id ?? manifest.project_id);
+const projectName = String(args['project-name'] || descriptor.project_name || manifest.project_name || '')
+  .replace(/\s+/g, ' ').trim();
+const snapshotHash = String(descriptor.snapshot_hash ?? manifest.snapshot_hash ?? '');
+const scope = String(descriptor.asset_scope ?? manifest.asset_scope ?? '');
+const policy = descriptor.filter_policy ?? manifest.filter_policy ?? {};
+if (String(descriptor.schema_version ?? manifest.schema_version) !== '3.0'
+    || descriptor.truncated === true || manifest.truncated === true
+    || scope !== 'governed' || policy.authenticated_entry_assets_only !== true
+    || policy.dependency_closure !== true || !Number.isSafeInteger(projectId) || projectId < 1
+    || !projectName || !/^[0-9a-f]{64}$/i.test(snapshotHash)) {
+  throw new Error('A complete governed schema 3.0 package with valid project identity is required.');
+}
+for (const name of ['dashboard-catalog', 'report-catalog', 'metric-catalog']) {
+  if (readJsonl(path.join(packageRoot, 'indexes', `${name}.jsonl`)).length) {
+    throw new Error(`The ${name} is not empty; use the normal semantic Wiki builder.`);
+  }
+}
+if (readJsonl(path.join(packageRoot, 'sources', 'adopted-personal-semantics.jsonl')).length) {
+  throw new Error('Adopted personal semantics are present; the empty skeleton is not applicable.');
+}
+if (fs.existsSync(outputRoot)) throw new Error('Output already exists.');
+const flatRoot = path.join(outputRoot, 'flat');
+fs.mkdirSync(flatRoot, { recursive: true });
+const namespace = `pskb-p${projectId}`;
+const facts = [
+  ['index', 'index', 'index.md', `# ${projectName} project semantic knowledge base\n\n- Project overview: project identity and current evidence boundary.\n- Shared project knowledge: no verified shared facts yet.\n- Business domains: none established from governed sources yet.\n- Event and asset catalog: no certified entry assets yet.\n- Governance and provenance: source scope and update policy.\n\nThis is an empty knowledge skeleton. It does not establish business facts or authorize use of uncertified assets.\n`],
+  ['wiki-project-overview', 'wiki-page', 'wiki/project-overview.md', `# Project overview\n\nProject: ${projectName} (ID ${projectId}). Business positioning, audience, objects, relationships, and decision paths are not established by the current governed sources. Add verified project material before using this knowledge base for business conclusions.\n`],
+  ['common-index', 'common', 'wiki/common/index.md', '# Shared project knowledge\n\nNo verified project-wide knowledge is available yet. Human-authored material may be added under the project and business source directories with provenance and scope.\n'],
+  ['domain-index', 'domain', 'wiki/domains/index.md', '# Business domains\n\nNo business domain is established by the current governed sources. Do not infer domains from project names or unverified assets.\n'],
+  ['asset-index-index', 'asset-index', 'wiki/asset-index/index.md', '# Event and asset catalog\n\nNo certified entry asset is available in this governed snapshot. Do not switch to all visible assets without an explicit user request.\n'],
+  ['governance-index', 'governance', 'wiki/governance/index.md', `# Governance and provenance\n\nProject ID: ${projectId}. Source scope: governed. Certified entry assets: 0. Adopted personal semantics: 0. Business facts remain unknown until verified sources are added. A later refresh must replace this empty-source state when governed evidence becomes available and preserve unrelated human sources.\n`],
+];
+const refreshState = {
+  schema_version: '1.0',
+  empty_skeleton: true,
+  semantic_project_id: projectId,
+  source_snapshot_hash: snapshotHash,
+};
+facts.push(['refresh-state', 'refresh-state', 'refresh-state.md',
+  `# Project semantic refresh state\n\n<!-- pskb_refresh_state_base64\n${Buffer.from(JSON.stringify(refreshState)).toString('base64url')}\n-->\n`]);
+const sources = facts.map(([stem, sourceKind, sourcePath, content]) => {
+  const file = `${namespace}-${stem}.md`;
+  fs.writeFileSync(path.join(flatRoot, file), content);
+  return {
+    display_name: file, file, namespace, snapshot_hash: snapshotHash,
+    source_kind: sourceKind, asset_type: null, asset_key: null,
+    title: content.split('\n')[0].replace(/^# /, ''), source_path: sourcePath,
+    content_hash: createHash('sha256').update(normalizeSourceForHash(content)).digest('hex'),
+    semantic_plan_fragment_refs: [],
+  };
+});
+fs.writeFileSync(path.join(flatRoot, 'kb-upload-manifest.json'), JSON.stringify({
+  schema_version: '1.0',
+  manifest_kind: 'ae_project_semantic_kb_upload_sources',
+  navigation_taxonomy_version: 'empty-skeleton-1.0',
+  namespace,
+  semantic_project_id: projectId,
+  project_name: projectName,
+  snapshot_hash: snapshotHash,
+  semantic_plan_state: { schema_version: null, plan_hash: null, fragment_count: 0, fragments: [] },
+  source_count: sources.length,
+  sources,
+}, null, 2));
+const packager = path.join(import.meta.dirname, 'package-wiki-source-zip.mjs');
+const archive = path.join(outputRoot, 'empty-skeleton.zip');
+const tree = path.join(outputRoot, 'source-tree');
+const sourceManifest = path.join(outputRoot, 'source-tree-manifest.json');
+execFileSync(process.execPath, [packager, '--source-dir', flatRoot, '--tree-output', tree,
+  '--manifest-output', sourceManifest, '--output', archive, '--embed-refresh-state-baseline'], {
+  stdio: 'pipe',
+});
+process.stdout.write(JSON.stringify({
+  project_id: projectId, project_name: projectName, archive,
+  source_tree: tree, manifest: sourceManifest, source_count: sources.length,
+}, null, 2) + '\n');
+
+function required(name) {
+  if (!args[name]) throw new Error(`--${name} is required.`);
+  return args[name];
+}
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+function readJsonl(file) {
+  const rows = fs.readFileSync(file, 'utf8').split(/\r?\n/).filter(Boolean).map((line) => JSON.parse(line));
+  return rows.filter((row) => row.record_type !== 'header');
+}