@thinkingai/ae-cli 6.0.56 → 6.0.58

package/README.md

@@ -17,7 +17,6 @@ The CLI is designed around:
 - Node.js 20 or later.
 - macOS, Linux, or native Windows (PowerShell / Command Prompt); WSL is optional.
 - Access to the npm registry for CLI installation.
-- Access to GitHub only when the bundled Skills source cannot be used.
 
 ## Installation
 
@@ -30,7 +29,7 @@ npx @thinkingai/ae-cli@latest install
 npx @thinkingai/ae-cli@latest install --format json
 ```
 
-The installer checks Node.js 20+, installs and verifies the CLI, then installs matching Skills globally in `~/.agents/skills`, writing the shared files once before automatically distributing copies to clients that need their own directory. No Agent selection is needed; Codex and Cursor can share these Skills even when installed later. `--dry-run`, `--format json`, and optional `--host <AE_HOST>` are supported. Unrelated project-only client warnings are hidden after successful verification; missing files and YAML errors remain failures. Being logged out is not an installation failure. See the [installation guide](./cli-installation-guide.md).
+The installer checks Node.js 20+, installs and verifies the CLI, then uses the bundled Skills tool to install matching global Skills for supported clients. First installation includes all bundled Skills when no business state has been confirmed. `--dry-run`, `--format json`, and optional `--host <AE_HOST>` are supported. Being logged out is not an installation failure. See the [installation guide](./cli-installation-guide.md).
 
 The Skills teach supported coding Agents, including Claude Code, Codex, Cursor, and similar tools, how to discover and call `ae-cli`.
 
@@ -51,6 +50,10 @@ ae-cli auth status
 
 Use the AE URL supplied by your AgenticEngine administrator. If no Host is configured, `ae-cli` guides existing customers to obtain that URL first. Only users without an AgenticEngine environment are directed to [request a trial](https://thinkingai.cn/request-demo).
 
+Business-based command filtering and Skill selection apply only to local CLI use by external Agents; built-in TE Agent sandboxes keep the complete command and Skill sets. After successful login, the CLI filters `--help` and capability discovery by the active environment’s enabled businesses and synchronizes managed global Skills. Analysis remains available by default. Run `ae-cli config refresh` after enabling a business to fetch its state and restore its Skills. Switching the active environment or account synchronizes again; a one-off `--host` query does not change global Skills.
+
+Only explicitly disabled businesses are removed. Older servers, missing states, and network failures do not trigger removal. Legacy client links to a verified, unmodified managed shared Skill are migrated automatically; other modified or unrecognized copies are preserved and reported. Start a new Agent session after synchronization; existing conversation context is retained.
+
 ## Environment-Bound Updates
 
 Each AE environment returns the exact `aeCliVersion` it expects. Use the unified update command to install that CLI version and its matching Skills:
@@ -64,9 +67,9 @@ Updates use the same global Skills installation and verification as `install`. O
 
 Automatic synchronization runs during normal commands after login; host version checks are cached for up to one hour. `ae-cli update --host <AE_HOST>` checks immediately. After a downgrade, future updates run the older CLI's own updater, including its historical limitations. To use the new installer logic while following an older host, run `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`; the target remains the host-required version.
 
-`ae-cli update` installs the exact version required by the active host rather than npm `latest`. It synchronizes Skills from the installed npm package first and uses the matching GitHub tag only as a fallback.
+`ae-cli update` installs the exact version required by the active host rather than npm `latest`. Skills are synchronized from the verified target package; modified or unrecognized copies are preserved and reported.
 
-Starting with the `6.0.37` and `6.1.9` release lines, ordinary business commands can automatically upgrade or downgrade the CLI to the host-required version, including switching from `6.0.x` to `6.1.x`. Automatic synchronization requires stable `major.minor.patch` versions at both ends; development and other nonstandard versions are skipped. After a successful synchronization, the old process exits with `AE_CLI_VERSION_SYNCED`; re-run the original command so it executes with the new CLI and Skills. Installation failures are reported without replacing the business command's JSON output.
+Starting with the `6.0.37` and `6.1.9` release lines, ordinary business commands can automatically upgrade or downgrade the CLI to the host-required version, including switching from `6.0.x` to `6.1.x`. Automatic synchronization requires stable `major.minor.patch` versions at both ends; development and other nonstandard versions are skipped. After successful synchronization, the new CLI automatically executes the original command once and returns its result and exit code. Arguments, piped input, working directory, and confirmation behavior are preserved. If the new CLI cannot start, `AE_CLI_VERSION_SYNCED` asks you to re-run manually; an executed command is never retried automatically. Installation failures are reported without replacing the business command's JSON output.
 
 Useful controls:
 
@@ -157,6 +160,8 @@ The table covers every current root command individually. Use `ae-cli --help` fo
 | Agent platform | `automation` | Automation configuration, execution, history, and results |
 <!-- root-command-surface:end -->
 
+Review collected analysis questions with `ae-cli analysis scenario list --project-id 1 --days 7`. The `ae-analysis` Skill can deduplicate questions and assess badcases with concise, evidence-based reasons. See the [scenario review guide](skills/ae-analysis/references/scenario_list.md). Answers can include elapsed time; use `ae-cli analysis scenario get --help` to query linked command execution details.
+
 Evaluation commands follow the current AE Host in personal terminals and sandboxes; use `--host` to select another host. Evaluation requests use the HTTP or HTTPS scheme configured for that AE Host, consistent with other AE commands. Legacy `--endpoint` and `AE_EVAL_BASE_URL` values may only match the current AE Host; other values fail before credentials are sent. Remove these settings and use `--host` to select a host. Outside a sandbox, export `AE_EVAL_ACCESS_TOKEN` with a platform session token; sandboxes can obtain a session automatically. See [endpoint and authentication rules](skills/ae-evaluation/SKILL.md#endpoint-and-authentication).
 
 ## Capability Gateway
@@ -266,6 +271,9 @@ JSON flags generally accept inline JSON, `@file`, a file path, or `-` for stdin.
 
 ## Knowledge Bases
 
+Use `ae-cli kb candidate changes --name <name> --candidate <id>` to review changed sources, Wiki and Index before approving a company compilation. See [Publication previews](skills/ae-kb/references/publication.md) for entry details and bounded text diffs.
+For large approval previews, use `kb candidate changes --group wiki --search payment --offset 0 --limit 50`. The first successful compilation publishes automatically; later company KB updates require approval.
+
 Manage the server-side knowledge-base lifecycle:
 
 ```bash

package/README.zh.md

@@ -17,7 +17,6 @@ CLI 的核心设计包括：
 - Node.js 20 或更高版本。
 - 支持 macOS、Linux 和原生 Windows（PowerShell / CMD），无需安装 WSL。
 - 安装 CLI 时能够访问 npm 仓库。
-- 内置 Skills 来源不可用时，能够访问 GitHub。
 
 ## 安装
 
@@ -34,7 +33,7 @@ npx @thinkingai/ae-cli@latest install
 npx @thinkingai/ae-cli@latest install --format json
 ```
 
-安装器检查 Node.js 20+、安装并验证 CLI，再将同版本 Skills 全局安装到 `~/.agents/skills`，公共文件只写入一次，再自动向需要独立目录的客户端分发副本，无需选择 Agent；之后安装的 Codex、Cursor 也可共享这些 Skills。支持 `--dry-run`、`--format json` 和可选的 `--host <AE_HOST>`。验证成功后不显示无关的项目级客户端告警；文件缺失和 YAML 错误仍判为失败。未登录不算安装失败。详见[安装指南](./cli-installation-guide.md)。
+安装器检查 Node.js 20+、安装并验证 CLI，再通过内置的 Skills 工具向支持的客户端安装同版本全局 Skills。首次安装且尚无已确认业务状态时安装全量内置 Skills。支持 `--dry-run`、`--format json` 和可选的 `--host <AE_HOST>`。未登录不算安装失败。详见[安装指南](./cli-installation-guide.md)。
 
 Skills 会帮助 Claude Code、Codex、Cursor 等编码 Agent 理解、发现并调用 `ae-cli`。
 
@@ -55,6 +54,10 @@ ae-cli auth status
 
 请使用 AgenticEngine 管理员提供的 AE 地址。未配置 Host 时，`ae-cli` 会先引导已有客户向管理员获取地址；只有确认尚无 AgenticEngine 环境的用户，才会看到[申请试用](https://thinkingai.cn/request-demo)入口。
 
+按业务过滤命令和剪裁 Skills 仅适用于外部 Agent 使用的本机 CLI；TE Agent 内置沙箱始终保留完整命令与全部 Skills。登录成功后，CLI 按当前环境已开通的业务过滤 `--help` 和能力发现，并同步受管的全局 Skills；分析能力默认保留。后续开通业务时，执行 `ae-cli config refresh` 即可重新获取状态并补装对应 Skills。切换活动环境或账号会重新同步；单次 `--host` 查询不改变全局 Skills。
+
+仅明确关闭的业务会被移除；旧服务端、缺失状态或网络失败不会触发删除。指向已核验、未修改的受管共享 Skill 的客户端历史链接会自动迁移；其他用户修改和来源不明的副本保留并报告。同步后请新开 Agent 会话，已有会话的上下文不会被撤回。
+
 ## 环境版本同步
 
 每个 AE 环境都会返回其要求的精确 `aeCliVersion`。使用统一更新命令安装对应版本的 CLI 和 Skills：
@@ -68,9 +71,9 @@ ae-cli update --dry-run
 
 自动同步在登录后的普通命令中触发，集群版本检查最长缓存 1 小时；`ae-cli update --host <AE_HOST>` 可立即查询。降级后，后续更新由旧版 CLI 自身执行，也受旧版实现限制。需要用新安装逻辑匹配旧集群时，可运行 `npx @thinkingai/ae-cli@latest update --host <AE_HOST>`，目标仍是集群要求的版本。
 
-`ae-cli update` 安装当前 Host 要求的精确版本，不依赖 npm `latest`。更新时优先从已安装的 npm 包同步 Skills，本地来源失败后才回退到对应的 GitHub tag。
+`ae-cli update` 安装当前 Host 要求的精确版本，不依赖 npm `latest`。Skills 从已验证的目标包同步；用户修改或来源不明的副本会保留并报告。
 
-从 `6.0.37` 和 `6.1.9` 维护线开始，普通业务命令可以自动升级或降级到环境要求的版本，包括从 `6.0.x` 切换到 `6.1.x`。自动同步要求本地和目标均为 `主版本.次版本.补丁号` 格式的正式版本，开发版等不规则版本会跳过。同步成功后，旧进程会返回 `AE_CLI_VERSION_SYNCED`；重新执行原命令，即可使用新的 CLI 和 Skills。安装失败会给出提示，但不会用安装输出污染业务命令的 JSON 结果。
+从 `6.0.37` 和 `6.1.9` 维护线开始，普通业务命令可以自动升级或降级到环境要求的版本，包括从 `6.0.x` 切换到 `6.1.x`。自动同步要求本地和目标均为 `主版本.次版本.补丁号` 格式的正式版本，开发版等不规则版本会跳过。同步成功后，新版 CLI 会自动执行原命令一次，并返回该命令的结果和退出码；参数、管道输入、工作目录和确认行为保持不变。如果新版 CLI 无法启动，会返回 `AE_CLI_VERSION_SYNCED` 并提示手动重跑；已经执行的命令不会自动重试。安装失败会给出提示，但不会用安装输出污染业务命令的 JSON 结果。
 
 常用控制方式：
 
@@ -161,6 +164,8 @@ ae-cli capability list --domain analysis --jq '.data.capabilities[] | .id'
 | Agent 平台 | `automation` | 自动化配置、执行、历史和结果 |
 <!-- root-command-surface:end -->
 
+使用 `ae-cli analysis scenario list --project-id 1 --days 7` 查询已采集的分析问题，由 `ae-analysis` Skill 指导 Agent 去重、判断 badcase 并简要说明原因和证据。详见[分析问题复盘指南](skills/ae-analysis/references/scenario_list.md)。 回答可附带耗时；使用 `ae-cli analysis scenario get --help` 查看关联命令执行明细的查询方式。
+
 评测命令在普通终端和沙箱中均跟随当前 AE Host，可通过 `--host` 切换。评测请求沿用该 AE Host 配置的 HTTP 或 HTTPS 协议，与其他 AE 命令一致。旧 `--endpoint` 和 `AE_EVAL_BASE_URL` 只能与当前 AE Host 一致，其他值会在发送凭证前报错；请移除这些配置，统一使用 `--host` 切换。沙箱外需设置 `AE_EVAL_ACCESS_TOKEN` 平台 session token，沙箱内可自动获取会话。详见 [地址与鉴权规则](skills/ae-evaluation/SKILL.md#endpoint-and-authentication)。
 
 ## Capability Gateway
@@ -270,6 +275,9 @@ JSON 参数通常支持内联 JSON、`@file`、文件路径或通过 `-` 从 std
 
 ## 知识库
 
+公司知识库编译审批前，可用 `ae-cli kb candidate changes --name <name> --candidate <id>` 查看数据源、Wiki 和 Index 的变化。条目详情和文本差异用法见[审批预览](skills/ae-kb/references/publication.md)。
+审批变化较多时，可用 `kb candidate changes --group wiki --search payment --offset 0 --limit 50` 分页检索；首次成功编译自动发布，后续公司知识库更新进入审批。
+
 管理服务端知识库生命周期：
 
 ```bash

package/bin/ae-cli.js

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
+import { readFileSync } from 'node:fs';
 if (Number(process.versions.node.split('.')[0]) < 20) {
   console.error('AE CLI requires Node.js 20 or later. Select a supported Node.js runtime and rerun.');
   process.exitCode = 1;
+} else if (process.argv.length === 3 && process.argv[2] === '--runtime-capabilities') {
+  // Keep discovery independent of application imports and credential initialization.
+  const capabilities = JSON.parse(readFileSync(new URL('./runtime-capabilities.json', import.meta.url), 'utf8'));
+  process.stdout.write(JSON.stringify(capabilities) + '\n');
 } else {
   await import('../dist/index.js');
 }

package/bin/runtime-capabilities.json

@@ -0,0 +1,5 @@
+{
+  "protocol": "ae-cli-runtime-capabilities",
+  "version": 1,
+  "features": ["kb_read_context_v1"]
+}

package/cli-installation-guide.md

@@ -20,13 +20,13 @@ Node.js 20 or later, npm, and npx must be available. The installer does not chan
 
 The running package determines the exact CLI version to install. The global executable is verified with `ae-cli --version`; PATH problems include the verified absolute path. Local npm links are protected by a small guard. Other installation conflicts use normal npm errors; the installer does not migrate existing installations.
 
-Skills are installed globally in `~/.agents/skills`. The shared files are installed once, then the Skills tool automatically distributes copies to detected clients that require their own directory. Shared-directory targets are skipped during distribution. Existing per-Skill links are replaced with copies when needed. Codex and Cursor support this shared directory, so installing Cursor later does not require a separate copy of the Skills. A client that only reads its own directory may need the same install command run again after that client is installed. User-global installation does not promise availability in remote/cloud clients or for every future client.
+The pinned Skills tool resolves supported global client directories, including the shared `~/.agents/skills` directory. AE does not maintain a separate client path table. A client that only reads its own directory may need the same install command run again after that client is installed. Project-only clients, unknown clients, remote/cloud clients, and manually imported Skills are outside automatic global synchronization. Overlapping source directories and unverified links are protected rather than replaced.
 
 The external tool is pinned to `skills@1.5.12` to preserve Node 20 support and skip copying a Skill onto its own source directory. The installer does not maintain its own Agent catalog, ask users to select clients, or select clients based on the invoking AI. Unrelated user Skills are retained.
 
 ## Verification and output
 
-The installed CLI package's `skills/` directory defines the expected Skills and contents at runtime, including for historical packages without an installer or generated manifest. A failed shared-directory installation can retry the exact release tag `ThinkingAIAgenticEngine/ae-cli#v<CLI_VERSION>`; it never falls back to the default branch. Missing or invalid bundled Skills are reported rather than guessing the expected set from another version. Client distribution failures do not trigger a source download retry. If the local source and fallback both fail, the top-level error retains the first cause, and `skills.attempts` records both attempts with their stage, source, cause, and failures.
+The verified target CLI package's complete `skills/` directory defines the expected contents, including for historical packages without an installer or generated manifest. The synchronizer uses this source for installation and restoration. Missing or invalid package sources, modified copies, ownership conflicts, and tool failures are reported; they do not trigger an unrestricted remote installation retry. `skills.attempts` retains the attempted source and failure details.
 
 Verification parses YAML/frontmatter and compares expected files in the shared global directory with the target package. Merely finding a directory, an `ae-*` name, or an exit code of zero is insufficient. Failures reported by the pinned tool for supported clients are also treated as failures, even when shared files exist.
 
@@ -37,6 +37,12 @@ Verification parses YAML/frontmatter and compares expected files in the shared g
 
 `--format json` emits one report on stdout. Progress goes to stderr; raw subprocess logs are not forwarded. Reports include `ok`, `dry_run`, `cli.package/version/path/verified`, `skills.directory/expected_count/installed_count/missing/source/version/failures/attempts`, `auth.host/authenticated`, and `next_steps`. Counts refer to unique Skills in the global directory. Use `--format table` for a human summary. Dry runs make no subprocess calls or installation/configuration writes.
 
+`install --dry-run --format json` returns that report directly, with a root-level `commands` array. `update --dry-run --format json` keeps the command envelope (`ok` and `data`); its `data` includes `action`, `dryRun`, `target`, optional `host`, `commands`, and `skillsSources`.
+
+Each `commands` array describes the current installation plan; `skillsSources` lists the current source choices. Array lengths and contents can change with the installer. Automation should run the complete `install` or `update` command, check its exit code and `ok`, and inspect the installation report. Do not depend on fixed array indexes or execute individual entries as a replacement for the installer.
+
+The managed synchronizer uses the verified package source. Replaying historical GitHub fallback or `skills add --copy` commands would bypass business selection and copy protection.
+
 ## Host and login
 
 `--host` is optional. It delegates status checks to the existing auth command; it does not independently save credentials or change the active host. Being logged out does not make a verified installation fail.
@@ -54,6 +60,21 @@ ae-cli auth status --host <AE_HOST>
 
 Never print, copy, or manually save any token.
 
+## Business selection after login
+
+First installation without confirmed business state installs all bundled Skills. After successful login, `config refresh`, an account switch, or an active-environment switch, config determines the optional business selection. Analysis and foundation Skills remain available. Only pristine managed copies of explicitly disabled businesses are removed; enabled businesses are restored from the package. Unknown states preserve existing copies. Installation, update, and automatic version synchronization reuse this selection, so an upgrade does not restore disabled Skills.
+
+```bash
+ae-cli config refresh
+ae-cli config show
+```
+
+The global selection follows one active local environment. An explicit `--host` refresh reads that environment's config without changing global Skills, even when its URL matches the active host. External-token and sandbox invocations do not manage local global Skills. Failed config or Skill synchronization does not revoke successful authentication. Partial synchronization reports protected or failed paths; resolve the reported conflict and retry. Existing copies are adopted once only when they exactly match a known package source. No regular backup is needed because the CLI package retains the complete resources.
+
+Older Skills installations may have created client links to the shared global directory. The synchronizer migrates an existing same-name link only when its destination is a managed shared Skill whose contents still match both its ownership record and the installed package. A confirmed disabled business removes the verified links before its shared copy; an enabled business replaces them with managed copies. Unknown business states leave links unchanged. Custom targets, modified shared contents, and links to package sources remain protected.
+
+Start a new Agent session after synchronization. Descriptions already loaded into a conversation cannot be withdrawn.
+
 ## Host-compatible upgrades and downgrades
 
 ```bash
@@ -73,7 +94,7 @@ To use the newer installer while still respecting the current host version, incl
 npx @thinkingai/ae-cli@latest update --host <AE_HOST>
 ```
 
-The newer command orchestrates the work; the installed target remains the host-required version. Required package versions and fallback tags must be published and accessible. Global CLI installation follows one target at a time; switching between differently versioned hosts can switch that installation again.
+The newer command orchestrates the work; the installed target remains the host-required version. Required package versions must be published and accessible. Global CLI installation follows one target at a time; switching between differently versioned hosts can switch that installation again.
 
 ## Advanced manual troubleshooting
 

package/dist/{auth-U7MNUUEF.js → auth-A5OO4VS4.js}

@@ -1,4 +1,8 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  invalidateBusinessSkillSynchronization,
+  refreshEnvironmentAfterLogin
+} from "./chunk-K2Z7QHDR.js";
 import {
   MultiselectCancelled,
   promptSingleSelect
@@ -9,13 +13,15 @@ import {
 } from "./chunk-6ZIQV5GW.js";
 import {
   resolveHost
-} from "./chunk-P6VFCH3P.js";
+} from "./chunk-2F64AZYH.js";
 import {
-  getLocalCliPackageInfo,
   printError,
-  printOutput,
+  printOutput
+} from "./chunk-WMDO53YK.js";
+import {
+  getLocalCliPackageInfo,
   runHostCompatCheck
-} from "./chunk-ELCR235M.js";
+} from "./chunk-GBSACKFB.js";
 import {
   CliTokenValidationUnavailableError,
   CredentialStoreUnreadableError,
@@ -31,19 +37,19 @@ import {
   saveCredential,
   updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-P7KL7IOH.js";
+} from "./chunk-SOSFRU3O.js";
 import {
   getFallbackCliToken,
   loadConfig,
   saveConfig
-} from "./chunk-LMCYSVVA.js";
+} from "./chunk-4PSTYEG5.js";
 import {
   ExternalCliTokenError,
   PermissionError,
   logger,
   normalizeUrl,
   readExternalCliToken
-} from "./chunk-ZW4VMY5H.js";
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -351,6 +357,7 @@ function promptHiddenCliToken() {
   });
 }
 function activateHostAfterLogin(host, explicitHostOverride) {
+  invalidateBusinessSkillSynchronization();
   if (!explicitHostOverride) return;
   const normalized = normalizeUrl(host);
   const config = loadConfig();
@@ -428,12 +435,15 @@ async function switchActiveAccount(program, opts) {
     }
   }
   try {
+    invalidateBusinessSkillSynchronization();
     const selected = activateCredential(host, account);
     clearCliTokenCache(host);
+    const environment = await refreshEnvironmentAfterLogin(host);
     await printOutput({
       host,
       active: true,
-      account: accountOutput(selected.account)
+      account: accountOutput(selected.account),
+      ...environment ? { environment } : {}
     }, program.opts().format || "json");
   } catch (error) {
     if (error instanceof CredentialStoreUnreadableError) throw error;
@@ -457,6 +467,7 @@ async function persistDeviceTokens(host, tokens, options = {}) {
   }
   let saved;
   try {
+    invalidateBusinessSkillSynchronization();
     saved = saveCredential(host, {
       cliToken,
       ...validation.account ? { account: validation.account } : {},
@@ -475,6 +486,7 @@ async function persistManualCliToken(host, cliToken, options = {}) {
   const validation = await validateCliTokenOnServer(host, cliToken);
   let saved;
   try {
+    invalidateBusinessSkillSynchronization();
     saved = saveCredential(host, {
       cliToken,
       ...validation.account ? { account: validation.account } : {},
@@ -552,8 +564,9 @@ function registerAuth(program) {
         const tokens2 = await pollDeviceFlow(teClaudeBase, opts.deviceCode, {}, emit);
         const saved2 = await persistDeviceTokens(host, tokens2, { add: opts.add });
         activateHostAfterLogin(host, explicitHost);
+        const environment2 = await refreshEnvironmentAfterLogin(host);
         emit("Login successful! CLI token saved securely.");
-        await printOutput(loginSummary(host, saved2), format);
+        await printOutput({ ...loginSummary(host, saved2), ...environment2 ? { environment: environment2 } : {} }, format);
         return;
       }
       if (opts.wait === false) {
@@ -572,8 +585,9 @@ function registerAuth(program) {
       const tokens = await runDeviceFlow(teClaudeBase, { noBrowser }, emit);
       const saved = await persistDeviceTokens(host, tokens, { add: opts.add });
       activateHostAfterLogin(host, explicitHost);
+      const environment = await refreshEnvironmentAfterLogin(host);
       emit("Login successful! CLI token saved securely.");
-      await printOutput(loginSummary(host, saved), format);
+      await printOutput({ ...loginSummary(host, saved), ...environment ? { environment } : {} }, format);
     } catch (error) {
       if (error instanceof CredentialStoreUnreadableError) throw error;
       if (error instanceof DeviceFlowUnsupportedError) {
@@ -616,9 +630,10 @@ function registerAuth(program) {
     try {
       const saved = await persistManualCliToken(host, cliToken, { add: opts.add });
       activateHostAfterLogin(host, explicitHost);
+      const environment = await refreshEnvironmentAfterLogin(host);
       process.stderr.write(`[ae-cli] CLI token verified and saved securely for ${host}
 `);
-      await printOutput(manualTokenSummary(host, saved), program.opts().format || "json");
+      await printOutput({ ...manualTokenSummary(host, saved), ...environment ? { environment } : {} }, program.opts().format || "json");
     } catch (error) {
       if (error instanceof CredentialStoreUnreadableError) throw error;
       if (error instanceof PermissionError) {
@@ -730,18 +745,21 @@ function registerAuth(program) {
       process.exit(1);
     }
     clearCliTokenCache(host);
+    invalidateBusinessSkillSynchronization();
     if (opts.all) {
       clearAllCredentials(host);
       await printOutput({ cleared: true, all: true, host }, program.opts().format || "json");
       return;
     }
     const result = removeActiveCredential(host);
+    const environment = result.active ? await refreshEnvironmentAfterLogin(host) : void 0;
     await printOutput({
       cleared: !!result.removed,
       all: false,
       host,
       remaining_accounts: listCredentials(host).length,
-      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {}
+      ...result.active?.account ? { active_account: accountOutput(result.active.account) } : {},
+      ...environment ? { environment } : {}
     }, program.opts().format || "json");
   });
 }

package/dist/{automation-K32V2NKP.js → automation-FD2QZUP6.js}

@@ -1,22 +1,22 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   resolveWorkspaceTarget
-} from "./chunk-UUD5RB36.js";
+} from "./chunk-E25OSZLJ.js";
 import {
   currentAgentSpaceId
 } from "./chunk-RK6GLDGI.js";
-import "./chunk-JJJIP2XQ.js";
+import "./chunk-VDICGXCY.js";
 import {
   TeAgentApiError,
   deleteFromMainApp,
   getFromMainApp,
   patchToMainApp,
   postToMainApp
-} from "./chunk-2UWS5CUP.js";
+} from "./chunk-JSBLCLFE.js";
 import "./chunk-Y74WTIKJ.js";
-import "./chunk-P7KL7IOH.js";
-import "./chunk-LMCYSVVA.js";
-import "./chunk-ZW4VMY5H.js";
+import "./chunk-SOSFRU3O.js";
+import "./chunk-4PSTYEG5.js";
+import "./chunk-Z3Q2AEIN.js";
 
 // src/commands/automation/index.ts
 import { randomUUID } from "crypto";

package/dist/{capability-VV7RHB3B.js → capability-SKI4GHF4.js}

@@ -9,9 +9,6 @@ import {
   listRegisteredCapabilityDomains,
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
-import {
-  resolveHost
-} from "./chunk-P6VFCH3P.js";
 import {
   CapabilityGatewayError,
   dryRunCapabilityWithEnvelope,
@@ -20,25 +17,34 @@ import {
   inspectCapabilityWithEnvelope,
   listCapabilitiesWithEnvelope,
   validateCapabilityWithEnvelope
-} from "./chunk-MXV3PYC3.js";
+} from "./chunk-UYJMEHAF.js";
+import {
+  resolveHost
+} from "./chunk-2F64AZYH.js";
 import {
   printError,
   printOutput,
   withOutputMetadata
-} from "./chunk-ELCR235M.js";
+} from "./chunk-WMDO53YK.js";
 import "./chunk-Y74WTIKJ.js";
+import {
+  assertBusinessEnabled,
+  businessForCapability,
+  readBusinessConfigForExecution,
+  readCurrentBusinessConfig
+} from "./chunk-GBSACKFB.js";
 import {
   CredentialStoreUnreadableError,
   SecureStoreAuthError
-} from "./chunk-P7KL7IOH.js";
+} from "./chunk-SOSFRU3O.js";
 import {
-  safeJsonParse
-} from "./chunk-LMCYSVVA.js";
+  parseJsonRequest
+} from "./chunk-4PSTYEG5.js";
 import {
   CliValidationError,
   ExternalCliTokenError,
   PermissionError
-} from "./chunk-ZW4VMY5H.js";
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";
@@ -82,7 +88,7 @@ function resolveCapabilityGatewayDomain(capabilityId, domainOverride) {
   }
   return resolveGatewayDomain(cliDomain, findGatewayDomain(cliDomain) ?? cliDomain);
 }
-function resolveCapabilityListDomain(cliDomain) {
+function resolveCapabilityListDomain(cliDomain, businesses = {}) {
   if (!cliDomain) {
     throw new CapabilityCommandValidationError(
       "Cannot determine the capability domain.",
@@ -91,7 +97,10 @@ function resolveCapabilityListDomain(cliDomain) {
   }
   const gatewayDomain = findGatewayDomain(cliDomain);
   if (gatewayDomain === void 0) {
-    const registeredDomains = listRegisteredCapabilityDomains();
+    const registeredDomains = listRegisteredCapabilityDomains().filter((domain) => {
+      const business = businessForCapability(domain);
+      return !business || businesses[business] !== false;
+    });
     const registeredHint = registeredDomains.length > 0 ? `Registered domains: ${registeredDomains.join(", ")}.` : "No capability domains are registered in this ae-cli process.";
     throw new CapabilityCommandValidationError(
       `Capability domain '${cliDomain}' is not registered.`,
@@ -135,10 +144,12 @@ function normalizeCapabilityList(value) {
     return item !== null && typeof item === "object" && typeof item.id === "string";
   });
 }
-function filterCapabilities(capabilities, domain, query) {
+function filterCapabilities(capabilities, domain, query, businesses = {}) {
   const prefixes = listCapabilityDiscoveryPrefixes(domain);
   const terms = query?.trim().toLowerCase().split(/\s+/).filter(Boolean) ?? [];
   return capabilities.filter((capability) => {
+    const business = businessForCapability(capability.id);
+    if (business && businesses[business] === false) return false;
     if (RETIRED_CAPABILITY_REPLACEMENTS[capability.id.toLowerCase()]) {
       return false;
     }
@@ -161,12 +172,12 @@ function parseCapabilityInput(raw) {
   let parsed;
   try {
     if (trimmed === "-") {
-      parsed = safeJsonParse(readFileSync(0, "utf8"));
+      parsed = parseJsonRequest(readFileSync(0, "utf8"));
     } else if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-      parsed = safeJsonParse(trimmed);
+      parsed = parseJsonRequest(trimmed);
     } else {
       const path = trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
-      parsed = safeJsonParse(readFileSync(path, "utf8"));
+      parsed = parseJsonRequest(readFileSync(path, "utf8"));
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -200,11 +211,16 @@ function registerCapability(program) {
   });
   capability.command("list").description("List capability summaries in a domain").requiredOption("--domain <domain>", "Capability namespace, such as analysis or metadata").option("--project-id <project-id>", "Filter by project membership, permissions, and enabled features").action(async (opts) => {
     await executeAndPrint(program, async (host) => {
-      const gatewayDomain = resolveCapabilityListDomain(opts.domain);
+      const business = businessForCapability(opts.domain);
+      const businesses = business ? await readBusinessConfigForExecution(host) : readCurrentBusinessConfig(host);
+      const gatewayDomain = resolveCapabilityListDomain(opts.domain, businesses);
       const projectId = parseOptionalProjectId(opts.projectId);
+      if (business && businesses[business] === false) {
+        return { domain: opts.domain, count: 0, capabilities: [], warning: `The '${business}' business is not enabled for the current environment.` };
+      }
       const envelope = await listCapabilitiesWithEnvelope(host, gatewayDomain, projectId);
       const catalog = normalizeCapabilityList(envelope.data);
-      const capabilities = filterCapabilities(catalog, opts.domain);
+      const capabilities = filterCapabilities(catalog, opts.domain, void 0, businesses);
       const warning = emptyCapabilityCatalogWarning(catalog);
       return withOutputMetadata({
         domain: opts.domain,
@@ -219,11 +235,16 @@ function registerCapability(program) {
   );
   capability.command("search").description("Search capability IDs and descriptions in a domain").argument("<query>", "Case-insensitive search terms").requiredOption("--domain <domain>", "Capability namespace, such as analysis or metadata").option("--project-id <project-id>", "Filter by project membership, permissions, and enabled features").action(async (query, opts) => {
     await executeAndPrint(program, async (host) => {
-      const gatewayDomain = resolveCapabilityListDomain(opts.domain);
+      const business = businessForCapability(opts.domain);
+      const businesses = business ? await readBusinessConfigForExecution(host) : readCurrentBusinessConfig(host);
+      const gatewayDomain = resolveCapabilityListDomain(opts.domain, businesses);
       const projectId = parseOptionalProjectId(opts.projectId);
+      if (business && businesses[business] === false) {
+        return { domain: opts.domain, query, count: 0, capabilities: [], warning: `The '${business}' business is not enabled for the current environment.` };
+      }
       const envelope = await listCapabilitiesWithEnvelope(host, gatewayDomain, projectId);
       const catalog = normalizeCapabilityList(envelope.data);
-      const capabilities = filterCapabilities(catalog, opts.domain, query);
+      const capabilities = filterCapabilities(catalog, opts.domain, query, businesses);
       const warning = emptyCapabilityCatalogWarning(catalog);
       return withOutputMetadata({
         domain: opts.domain,
@@ -240,6 +261,7 @@ function registerCapability(program) {
   capability.command("inspect").description("Inspect one capability schema, risk, auth, and output metadata").argument("<capability-id>", "Capability ID, such as analysis.report.list").option("--domain <domain>", "Override the capability namespace used for gateway routing").option("--project-id <project-id>", "Check availability in a project before returning metadata").action(async (capabilityId, opts) => {
     await executeAndPrint(program, async (host) => {
       assertCapabilityIsNotRetired(capabilityId);
+      await assertCapabilityBusinessEnabled(capabilityId, host);
       const gatewayDomain = resolveCapabilityGatewayDomain(capabilityId, opts.domain);
       return gatewayOutput(await inspectCapabilityWithEnvelope(host, gatewayDomain, capabilityId, parseOptionalProjectId(opts.projectId)), host);
     });
@@ -252,6 +274,7 @@ function registerCapability(program) {
   ).argument("<capability-id>", "Capability ID, such as metadata.data_table.sql_write").option("--domain <domain>", "Override the capability namespace used for gateway routing").option("--input <json-or-path>", "Input JSON object, file path, @<path>, or - for stdin").action(async (capabilityId, opts) => {
     await executeAndPrint(program, async (host) => {
       assertCapabilityIsNotRetired(capabilityId);
+      await assertCapabilityBusinessEnabled(capabilityId, host);
       const gatewayDomain = resolveCapabilityGatewayDomain(capabilityId, opts.domain);
       return gatewayOutput(await validateCapabilityWithEnvelope(host, gatewayDomain, capabilityId, parseCapabilityInput(opts.input)), host);
     });
@@ -275,6 +298,7 @@ Examples:
   ).argument("<capability-id>", "Capability ID, such as analysis.query.export").option("--domain <domain>", "Override the capability namespace used for gateway routing").option("--input <json-or-path>", "Input JSON object, file path, @<path>, or - for stdin").action(async (capabilityId, opts) => {
     await executeAndPrint(program, async (host) => {
       assertCapabilityIsNotRetired(capabilityId);
+      await assertCapabilityBusinessEnabled(capabilityId, host);
       const gatewayDomain = resolveCapabilityGatewayDomain(capabilityId, opts.domain);
       return gatewayOutput(await dryRunCapabilityWithEnvelope(host, gatewayDomain, capabilityId, parseCapabilityInput(opts.input)), host);
     });
@@ -288,6 +312,7 @@ Examples:
   capability.command("run").description("Execute one capability by ID").argument("<capability-id>", "Capability ID, such as analysis.report.list").option("--domain <domain>", "Override the capability namespace used for gateway routing").option("--input <json-or-path>", "Input JSON object, file path, @<path>, or - for stdin").action(async (capabilityId, opts) => {
     await executeAndPrint(program, async (host, globalOpts) => {
       assertCapabilityIsNotRetired(capabilityId);
+      await assertCapabilityBusinessEnabled(capabilityId, host);
       const gatewayDomain = resolveCapabilityGatewayDomain(capabilityId, opts.domain);
       const input = parseCapabilityInput(opts.input);
       if (globalOpts.validate && globalOpts.dryRun) {
@@ -323,6 +348,9 @@ Examples:
   ae-cli capability run analysis.dashboard.list --input input.json`
   );
 }
+async function assertCapabilityBusinessEnabled(capabilityId, host) {
+  await assertBusinessEnabled(businessForCapability(capabilityId), host);
+}
 function gatewayOutput(envelope, host) {
   return withOutputMetadata(withPageUrl(envelope.data, host), envelope.meta);
 }
@@ -375,7 +403,7 @@ function printCapabilityError(error, host) {
     return;
   }
   if (error instanceof PermissionError) {
-    printError("permission", error.message, void 0, error.code);
+    printError("permission", error.message, error.hint, error.code);
     return;
   }
   if (error instanceof CapabilityGatewayError) {

package/dist/{chunk-P6VFCH3P.js → chunk-2F64AZYH.js}

@@ -1,10 +1,10 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   getActiveHost
-} from "./chunk-LMCYSVVA.js";
+} from "./chunk-4PSTYEG5.js";
 import {
   normalizeUrl
-} from "./chunk-ZW4VMY5H.js";
+} from "./chunk-Z3Q2AEIN.js";
 
 // src/core/auth.ts
 function resolveHost(hostOverride) {