@thinkingai/ae-cli 6.1.23 → 6.1.25

package/README.md

@@ -127,7 +127,7 @@ The table covers every current root command individually. Use `ae-cli --help` fo
 | Engage | `engage-workbench` | Engage workbench and to-do management |
 | Engage | `engage-query` | Engage queries, asynchronous exports, and artifact management |
 | DataOps | `dataops_repo` | Data-warehouse and data-source management |
-| DataOps | `dataops_datatable` | Data-table lifecycle management |
+| DataOps | `dataops_datatable` | Table/view lifecycle management, including recycling, recycle-bin discovery, and permanent deletion |
 | DataOps | `dataops_flow` | Development flows, scheduling, and backfill-job management |
 | DataOps | `dataops_ide` | IDE queries and result downloads |
 | DataOps | `dataops_integration` | Data-integration task management |
@@ -177,6 +177,10 @@ For scripts and agents, use the non-interactive subcommands:
 ```bash
 ae-cli auth login --host https://host-a.example.com
 ae-cli auth status --host https://host-a.example.com
+# Import a CLI token copied from External Access Management (hidden prompt)
+ae-cli auth set-token --host https://host-a.example.com
+# Non-interactive input for local scripts or tests
+printf '%s' "$AE_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
 # For the uncommon case where one Host needs multiple accounts
 ae-cli auth login --host https://host-a.example.com --add
 ae-cli auth list --host https://host-a.example.com
@@ -196,6 +200,8 @@ ae-cli config remove pre-production --yes
 
 A regular `auth login` keeps the simple one-Host/one-account behavior and replaces credentials for that Host; use `--add` only when other accounts must be retained. `auth status` reports CLI-token state only. A new backend can also provide account identity and expiration; when an older backend does not support `/validate`, the CLI preserves the historical behavior of trusting the stored CLI token and omits `account` instead of returning null fields.
 
+`auth set-token` is for local use with a `cli_` token copied from External Access Management. It prompts without echo by default; `--token-stdin` supports non-interactive local testing. The CLI validates the token against the target Host before replacing the stored credential, encrypts it in the existing per-Host vault, and never includes the value in command output. Add `--add` to retain other accounts for the same Host.
+
 The new CLI persists only CLI tokens, never access or refresh tokens. Multiple accounts live in an encrypted V1 vault while the active account is projected into the historical file shape for automatic downgrades. When the CLI upgrades again, it reconciles login, switch, or logout changes made by the old CLI.
 
 Login uses a cross-platform device-code flow. Use `--no-browser` when the environment cannot open a browser.

package/README.zh.md

@@ -131,7 +131,7 @@ ae-cli capability list --domain analysis --jq '.data.capabilities[] | .id'
 | 运营 | `engage-workbench` | 运营工作台和待办管理 |
 | 运营 | `engage-query` | 运营查询、异步导出和产物管理 |
 | DataOps | `dataops_repo` | 数仓和数据源管理 |
-| DataOps | `dataops_datatable` | 数据表生命周期管理 |
+| DataOps | `dataops_datatable` | 表/视图生命周期管理，包括回收、查询回收站与彻底删除 |
 | DataOps | `dataops_flow` | 开发流程、调度和补数作业管理 |
 | DataOps | `dataops_ide` | IDE 查询及结果下载 |
 | DataOps | `dataops_integration` | 数据集成任务管理 |
@@ -181,6 +181,10 @@ Gateway 命令遵循 [Capability 命令收录规则](docs/capability-command-adm
 ```bash
 ae-cli auth login --host https://host-a.example.com
 ae-cli auth status --host https://host-a.example.com
+# 导入从“外部访问管理”复制的 CLI Token（隐藏输入）
+ae-cli auth set-token --host https://host-a.example.com
+# 本地脚本或测试使用非交互输入
+printf '%s' "$AE_CLI_TOKEN" | ae-cli auth set-token --host https://host-a.example.com --token-stdin
 # 少量需要同一 Host 多账号的场景
 ae-cli auth login --host https://host-a.example.com --add
 ae-cli auth list --host https://host-a.example.com
@@ -200,6 +204,8 @@ ae-cli config remove pre-production --yes
 
 普通 `auth login` 保持一个 Host 一个账号的简单语义，并替换该 Host 已保存的账号；仅在需要时使用 `--add` 保留其他账号。`auth status` 只展示 CLI Token 状态；新版后端可同时返回账号和到期时间，旧版后端不支持 `/validate` 时仍按历史行为信任本地 CLI Token，且不会输出含 null 字段的 `account`。
 
+`auth set-token` 用于在本地导入从“外部访问管理”复制的 `cli_` Token。默认使用不回显的隐藏输入，`--token-stdin` 支持本地测试等非交互场景。CLI 会先向目标 Host 校验 Token，再替换本地凭证，并写入现有的按 Host 加密凭据库；命令输出不会包含 Token。需要保留同一 Host 的其他账号时增加 `--add`。
+
 新版 CLI 只持久化 CLI Token，不保存 access token 或 refresh token。多账号保存在加密的 V1 凭据文件中，同时维护旧文件格式的当前账号投影，保证 CLI 自动降级后仍可登录；再次升级时会合并旧 CLI 对投影的登录、切换或退出变更。
 
 登录使用跨平台设备码流程。当前环境无法打开浏览器时，可使用 `--no-browser`。

package/dist/{auth-XZNXFRJS.js → auth-LHM7NQPR.js}

@@ -12,16 +12,18 @@ import {
 } from "./chunk-E2JKXMVO.js";
 import {
   resolveHost
-} from "./chunk-JOCDD4ON.js";
+} from "./chunk-N4BLPJC7.js";
 import {
   printError,
   printOutput,
   runHostCompatCheck
-} from "./chunk-DX5CDO34.js";
+} from "./chunk-BW7JUDEI.js";
 import {
   CliTokenValidationUnavailableError,
+  CredentialStoreUnreadableError,
   SecureStoreAuthError,
   activateCredential,
+  assertCredentialsReadable,
   clearAllCredentials,
   clearCliTokenCache,
   getActiveCredential,
@@ -31,17 +33,17 @@ import {
   saveCredential,
   updateCredentialMetadata,
   validateCliTokenOnServer
-} from "./chunk-7XGFSUOM.js";
+} from "./chunk-DU72X2IO.js";
 import {
   getFallbackCliToken,
   loadConfig,
   normalizeUrl,
   saveConfig
-} from "./chunk-7FTTULED.js";
+} from "./chunk-IG3DYEIR.js";
 import {
   PermissionError,
   logger
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/core/device-auth.ts
 import { execFileSync } from "child_process";
@@ -277,12 +279,77 @@ async function validateExistingCliToken(host, cliToken) {
       logger.warn(`auth status: ${error.message}; trusting the stored CLI token for compatibility`);
       return { valid: true, trusted: true, details: {} };
     }
+    if (error instanceof PermissionError) {
+      printError("permission", error.message, error.hint, error.code);
+      process.exitCode = 1;
+      return { valid: false, trusted: false, details: {} };
+    }
     if (!(error instanceof SecureStoreAuthError)) throw error;
-    printError("auth", error.message);
+    printError(
+      "auth",
+      error.message,
+      `Run: ae-cli auth logout --host ${host}, then ae-cli auth login --host ${host}`
+    );
     process.exitCode = 1;
     return { valid: false, trusted: false, details: {} };
   }
 }
+async function readCliTokenFromStdin() {
+  let value = "";
+  process.stdin.setEncoding("utf8");
+  for await (const chunk of process.stdin) value += chunk;
+  return value.trim();
+}
+function promptHiddenCliToken() {
+  const stdin = process.stdin;
+  const stderr = process.stderr;
+  if (!stdin.isTTY || !stderr.isTTY) {
+    return Promise.reject(new Error(
+      "Interactive CLI token input requires a TTY. Pipe the token and add --token-stdin."
+    ));
+  }
+  return new Promise((resolve, reject) => {
+    let value = "";
+    let settled = false;
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    stderr.write("CLI token: ");
+    function cleanup() {
+      if (settled) return;
+      settled = true;
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.removeListener("data", onData);
+      stderr.write("\n");
+    }
+    function onData(chunk) {
+      for (const key of chunk) {
+        if (key === "\r" || key === "\n") {
+          cleanup();
+          resolve(value.trim());
+          return;
+        }
+        if (key === "" || key === "\x1B") {
+          cleanup();
+          reject(new Error("CLI token input cancelled."));
+          return;
+        }
+        if (key === "") {
+          cleanup();
+          resolve(value.trim());
+          return;
+        }
+        if (key === "\x7F" || key === "\b") {
+          value = value.slice(0, -1);
+          continue;
+        }
+        if (key >= " ") value += key;
+      }
+    }
+    stdin.on("data", onData);
+  });
+}
 function activateHostAfterLogin(host, explicitHostOverride) {
   if (!explicitHostOverride) return;
   const normalized = normalizeUrl(host);
@@ -369,11 +436,13 @@ async function switchActiveAccount(program, opts) {
       account: accountOutput(selected.account)
     }, program.opts().format || "json");
   } catch (error) {
+    if (error instanceof CredentialStoreUnreadableError) throw error;
     printError("auth", error.message);
     process.exitCode = 1;
   }
 }
 async function persistDeviceTokens(host, tokens, options = {}) {
+  assertCredentialsReadable(host);
   const cliToken = await mintCliToken(host, tokens.access_token);
   let validation = {};
   try {
@@ -401,6 +470,24 @@ async function persistDeviceTokens(host, tokens, options = {}) {
   await runHostCompatCheck(getLocalCliPackageInfo(), host);
   return saved;
 }
+async function persistManualCliToken(host, cliToken, options = {}) {
+  assertCredentialsReadable(host);
+  const validation = await validateCliTokenOnServer(host, cliToken);
+  let saved;
+  try {
+    saved = saveCredential(host, {
+      cliToken,
+      ...validation.account ? { account: validation.account } : {},
+      ...validation.cliTokenExpiresAt ? { cliTokenExpiresAt: validation.cliTokenExpiresAt } : {}
+    }, options);
+  } catch (error) {
+    clearCliTokenCache(host);
+    throw error;
+  }
+  clearCliTokenCache(host);
+  await runHostCompatCheck(getLocalCliPackageInfo(), host);
+  return saved;
+}
 function loginSummary(host, credential) {
   return {
     authenticated: true,
@@ -408,13 +495,30 @@ function loginSummary(host, credential) {
     ...credential.account ? { account: accountOutput(credential.account) } : {}
   };
 }
+function manualTokenSummary(host, credential) {
+  return {
+    authenticated: true,
+    host,
+    source: "manual-cli-token",
+    ...credential.account ? { account: accountOutput(credential.account) } : {},
+    cli_token: {
+      status: "valid",
+      ...credential.cliTokenExpiresAt ? { expires_at: credential.cliTokenExpiresAt } : {}
+    }
+  };
+}
 function resolveLoginTeClaudeBase(host) {
   const base = host.replace(/\/+$/, "");
   const basePath = process.env.TE_CLAUDE_BASE_PATH || "/agent";
   return base.endsWith(basePath) ? base : base + basePath;
 }
 function registerAuth(program) {
-  const auth = program.command("auth").description("Manage authentication or switch the active account interactively").action(async () => {
+  const auth = program.command("auth").description("Manage authentication or switch the active account interactively").hook("preAction", (_command, actionCommand) => {
+    if (["login", "set-token"].includes(actionCommand.name())) {
+      const host = resolveAuthHost(program, actionCommand.opts());
+      if (host) assertCredentialsReadable(host);
+    }
+  }).action(async () => {
     await switchActiveAccount(program, {});
   });
   auth.command("login").description("Log in to AE; by default replaces this host credentials, --add keeps existing accounts").option("--host <url>", HOST_OPTION_DESC).option("--add", "Add another account for the host and keep existing accounts").option("--no-browser", "Do not auto-open the browser; only print the authorization URL").option("--no-wait", "Print device authorization data and exit; resume with --device-code").option("--device-code <code>", "Resume a split-flow login with the given device code").action(async (opts) => {
@@ -465,6 +569,7 @@ function registerAuth(program) {
       emit("Login successful! CLI token saved securely.");
       await printOutput(loginSummary(host, saved), format);
     } catch (error) {
+      if (error instanceof CredentialStoreUnreadableError) throw error;
       if (error instanceof DeviceFlowUnsupportedError) {
         printError("auth", error.message, "Upgrade the AE server to a version that supports device login.");
         process.exit(1);
@@ -477,6 +582,59 @@ function registerAuth(program) {
       process.exit(1);
     }
   });
+  auth.command("set-token").description("Validate and securely store a CLI token copied from External Access Management").option("--host <url>", HOST_OPTION_DESC).option("--token-stdin", "Read the CLI token from stdin instead of prompting").option("--add", "Add another account for the host and keep existing accounts").action(async (opts) => {
+    const explicitHost = getExplicitAuthHostOverride(program, opts);
+    const host = resolveAuthHost(program, opts);
+    if (!host) {
+      printError("config", "No AE host configured.", missingAeHostHint());
+      process.exitCode = 1;
+      return;
+    }
+    let cliToken;
+    try {
+      cliToken = opts.tokenStdin ? await readCliTokenFromStdin() : await promptHiddenCliToken();
+    } catch (error) {
+      printError("validation", error.message);
+      process.exitCode = 1;
+      return;
+    }
+    if (!/^cli_\S+$/.test(cliToken)) {
+      printError(
+        "validation",
+        "Invalid CLI token format.",
+        "Copy a current CLI token from External Access Management; the value must start with cli_."
+      );
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      const saved = await persistManualCliToken(host, cliToken, { add: opts.add });
+      activateHostAfterLogin(host, explicitHost);
+      process.stderr.write(`[ae-cli] CLI token verified and saved securely for ${host}
+`);
+      await printOutput(manualTokenSummary(host, saved), program.opts().format || "json");
+    } catch (error) {
+      if (error instanceof CredentialStoreUnreadableError) throw error;
+      if (error instanceof PermissionError) {
+        printError("permission", error.message, error.hint, error.code);
+      } else if (error instanceof SecureStoreAuthError) {
+        printError(
+          "auth",
+          error.message,
+          "Copy a current CLI token from External Access Management and try again."
+        );
+      } else if (error instanceof CliTokenValidationUnavailableError) {
+        printError(
+          "api",
+          error.message,
+          "Verify the AE host and deployment, then retry. The token was not saved."
+        );
+      } else {
+        printError("api", error.message);
+      }
+      process.exitCode = 1;
+    }
+  });
   auth.command("status").description("Show the active CLI-token authentication status for a host").option("--host <url>", HOST_OPTION_DESC).action(async (opts) => {
     const host = resolveAuthHost(program, opts);
     if (!host) {
@@ -569,6 +727,8 @@ export {
   activateHostAfterLogin,
   buildAccountSelectionItems,
   persistDeviceTokens,
+  persistManualCliToken,
+  promptHiddenCliToken,
   registerAuth,
   resolveLoginTeClaudeBase
 };

package/dist/{capability-FYTU3X6L.js → capability-SJI5KOCK.js}

@@ -11,7 +11,7 @@ import {
   inspectCapabilityWithEnvelope,
   listCapabilitiesWithEnvelope,
   validateCapabilityWithEnvelope
-} from "./chunk-HFGZGYCG.js";
+} from "./chunk-QYXDJOLA.js";
 import {
   findGatewayDomain,
   listCapabilityDiscoveryPrefixes,
@@ -20,23 +20,24 @@ import {
 } from "./chunk-KPQY44JQ.js";
 import {
   resolveHost
-} from "./chunk-JOCDD4ON.js";
+} from "./chunk-N4BLPJC7.js";
 import {
   printError,
   printOutput,
   withOutputMetadata
-} from "./chunk-DX5CDO34.js";
+} from "./chunk-BW7JUDEI.js";
 import "./chunk-Y74WTIKJ.js";
 import {
+  CredentialStoreUnreadableError,
   SecureStoreAuthError
-} from "./chunk-7XGFSUOM.js";
+} from "./chunk-DU72X2IO.js";
 import {
   safeJsonParse
-} from "./chunk-7FTTULED.js";
+} from "./chunk-IG3DYEIR.js";
 import {
   CliValidationError,
   PermissionError
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/commands/capability/index.ts
 import * as readline from "readline";
@@ -367,6 +368,10 @@ function printCapabilityError(error, host) {
     );
     return;
   }
+  if (error instanceof CredentialStoreUnreadableError) {
+    printError("config", error.message, error.hint, error.code);
+    return;
+  }
   if (error instanceof SecureStoreAuthError) {
     printError("auth", error.message, "Run: ae-cli auth login");
     return;

package/dist/{chunk-CCS66K4K.js → chunk-2FJM4HRV.js}

@@ -3,16 +3,16 @@ import {
   dryRunCapability,
   executeCapabilityWithEnvelope,
   validateCapability
-} from "./chunk-HFGZGYCG.js";
+} from "./chunk-QYXDJOLA.js";
 import {
   resolveGatewayDomain
 } from "./chunk-KPQY44JQ.js";
 import {
   withOutputMetadata
-} from "./chunk-DX5CDO34.js";
+} from "./chunk-BW7JUDEI.js";
 import {
   CliValidationError
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/core/definition-intent.ts
 import { createHash } from "crypto";

package/dist/{chunk-57RRFUEZ.js → chunk-5XRQ3CZR.js}

@@ -1,17 +1,17 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   CapabilityGatewayError
-} from "./chunk-HFGZGYCG.js";
+} from "./chunk-QYXDJOLA.js";
 import {
   SecureStoreAuthError,
   getCliToken
-} from "./chunk-7XGFSUOM.js";
+} from "./chunk-DU72X2IO.js";
 import {
   safeJsonParse
-} from "./chunk-7FTTULED.js";
+} from "./chunk-IG3DYEIR.js";
 import {
   PermissionError
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/core/mcp-access.ts
 function buildUrl(host, path, params = {}) {

package/dist/{chunk-EQ255HKO.js → chunk-7WZACOAI.js}

@@ -5,14 +5,14 @@ import {
   require_node,
   require_process_nextick_args,
   require_util
-} from "./chunk-V2NUHPXF.js";
+} from "./chunk-GK7WDY7E.js";
 import {
   __commonJS,
   __esm,
   __export,
   __require,
   __toCommonJS
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // node_modules/readdir-glob/node_modules/minimatch/lib/path.js
 var require_path = __commonJS({

package/dist/{chunk-DX5CDO34.js → chunk-BW7JUDEI.js}

@@ -1,16 +1,16 @@
 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   peekCliToken
-} from "./chunk-7XGFSUOM.js";
+} from "./chunk-DU72X2IO.js";
 import {
   getActiveHost,
   getConfigDir,
   isAeSandboxRuntime,
   normalizeUrl
-} from "./chunk-7FTTULED.js";
+} from "./chunk-IG3DYEIR.js";
 import {
   logger
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-YVGXGTD6.js";
 
 // src/core/version-sync.ts
 import { spawnSync } from "child_process";
@@ -579,31 +579,91 @@ function autoSyncDirection(current, expected) {
   return "switch";
 }
 
-// src/core/compat-check.ts
+// src/core/feature-config.ts
+import crypto from "crypto";
 import fs2 from "fs";
 import path2 from "path";
+var FEATURE_TTL_MS = 24 * 60 * 60 * 1e3;
+var UNAVAILABLE_TTL_MS = 5 * 60 * 1e3;
+function cachePath() {
+  return path2.join(getConfigDir(), "feature-config.json");
+}
+function cacheKey(host, token) {
+  const fingerprint = crypto.createHash("sha256").update(token).digest("hex");
+  return `${normalizeUrl(host)}#${fingerprint}`;
+}
+function readStore() {
+  try {
+    const value = JSON.parse(fs2.readFileSync(cachePath(), "utf8"));
+    return value?.entries && typeof value.entries === "object" ? value : { entries: {} };
+  } catch {
+    return { entries: {} };
+  }
+}
+function writeStore(store) {
+  const target = cachePath();
+  const temp = `${target}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
+  try {
+    fs2.mkdirSync(path2.dirname(target), { recursive: true });
+    fs2.writeFileSync(temp, JSON.stringify(store), { encoding: "utf8", mode: 384 });
+    fs2.renameSync(temp, target);
+    fs2.chmodSync(target, 384);
+  } catch {
+    try {
+      fs2.rmSync(temp, { force: true });
+    } catch {
+    }
+  }
+}
+function remember(host, token, entry) {
+  const store = readStore();
+  store.entries[cacheKey(host, token)] = entry;
+  writeStore(store);
+}
+function rememberKbAutoDiscoveryFeature(host, token, enabled) {
+  remember(host, token, { enabled, available: true, fetchedAt: Date.now() });
+}
+async function resolveKbAutoDiscoveryFeature(host, token, fetchRemote) {
+  const entry = readStore().entries[cacheKey(host, token)];
+  const ttl = entry?.available ? FEATURE_TTL_MS : UNAVAILABLE_TTL_MS;
+  if (entry && Date.now() >= entry.fetchedAt && Date.now() - entry.fetchedAt < ttl) {
+    return { enabled: entry.enabled, source: entry.available ? "cache" : "unavailable" };
+  }
+  const remote = await fetchRemote().catch(() => null);
+  if (!remote) {
+    remember(host, token, { enabled: false, available: false, fetchedAt: Date.now() });
+    return { enabled: false, source: "unavailable" };
+  }
+  const enabled = remote.projectSemanticKbAutoDiscovery === true;
+  remember(host, token, { enabled, available: true, fetchedAt: Date.now() });
+  return { enabled, source: "remote" };
+}
+
+// src/core/compat-check.ts
+import fs3 from "fs";
+import path3 from "path";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 3e3;
 var CLI_CONFIG_PATH = "/v1/ta/cli/config";
 function cacheFilePath() {
-  return path2.join(getConfigDir(), "compat-check.json");
+  return path3.join(getConfigDir(), "compat-check.json");
 }
-function readStore() {
+function readStore2() {
   try {
     const file = cacheFilePath();
-    if (!fs2.existsSync(file)) return { hosts: {} };
-    const raw = JSON.parse(fs2.readFileSync(file, "utf8"));
+    if (!fs3.existsSync(file)) return { hosts: {} };
+    const raw = JSON.parse(fs3.readFileSync(file, "utf8"));
     if (!raw || typeof raw !== "object" || !raw.hosts) return { hosts: {} };
     return raw;
   } catch {
     return { hosts: {} };
   }
 }
-function writeStore(store) {
+function writeStore2(store) {
   try {
     const dir = getConfigDir();
-    if (!fs2.existsSync(dir)) fs2.mkdirSync(dir, { recursive: true });
-    fs2.writeFileSync(cacheFilePath(), JSON.stringify(store, null, 2));
+    if (!fs3.existsSync(dir)) fs3.mkdirSync(dir, { recursive: true });
+    fs3.writeFileSync(cacheFilePath(), JSON.stringify(store, null, 2));
   } catch {
   }
 }
@@ -663,7 +723,8 @@ async function fetchCliConfig(host, cliToken) {
     const aeCliVersion = versions.aeCliVersion ?? versions.ae_cli_version ?? null;
     return {
       clusterVersion: clusterVersion?.trim() || null,
-      aeCliVersion: aeCliVersion?.trim() || null
+      aeCliVersion: aeCliVersion?.trim() || null,
+      ...typeof data.features?.projectSemanticKbAutoDiscovery === "boolean" ? { projectSemanticKbAutoDiscovery: data.features.projectSemanticKbAutoDiscovery } : {}
     };
   } catch {
     return null;
@@ -684,7 +745,7 @@ function getPendingUpdateNotice() {
   return pendingUpdateNotice;
 }
 function getCachedCompatForHost(host) {
-  return readStore().hosts[hostKey(host)];
+  return readStore2().hosts[hostKey(host)];
 }
 function formatCapabilityMissCompatHint(host) {
   if (shouldSkipCompatCheck()) return void 0;
@@ -725,7 +786,7 @@ function setUpdateNotice(pkg, expected, cluster, verdict, state, stage, message)
 async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   const token = peekCliToken(host);
   if (!token) return { status: "continue" };
-  const store = readStore();
+  const store = readStore2();
   const key = hostKey(host);
   const existing = store.hosts[key];
   let expected = existing?.expectedVersion;
@@ -733,6 +794,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   let fetchedAt = existing?.lastFetchedAt;
   if (isStale(existing)) {
     const remote = await fetchCliConfig(host, token);
+    if (remote) rememberKbAutoDiscoveryFeature(host, token, remote.projectSemanticKbAutoDiscovery ?? false);
     if (!remote?.aeCliVersion) {
       return { status: "continue" };
     }
@@ -747,7 +809,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
       lastFetchedAt: fetchedAt,
       lastNotifiedAt: existing?.lastNotifiedAt
     };
-    writeStore(store);
+    writeStore2(store);
   }
   if (!expected) return { status: "continue" };
   let verdict = evaluateCompat(pkg.version, expected, cluster);
@@ -770,6 +832,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   const canAutoSync = allowAutoSync && isPublicAeCliPackage(pkg.name) && isAutoSyncTargetEligible(expected);
   if (canAutoSync) {
     const confirmed = await fetchCliConfig(host, token);
+    if (confirmed) rememberKbAutoDiscoveryFeature(host, token, confirmed.projectSemanticKbAutoDiscovery ?? false);
     if (confirmed?.aeCliVersion) {
       expected = confirmed.aeCliVersion;
       cluster = confirmed.clusterVersion ?? cluster ?? "";
@@ -783,7 +846,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
         lastFetchedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
       store.hosts[key] = entry;
-      writeStore(store);
+      writeStore2(store);
       if (verdict.kind === "ok" && !pendingSkills) {
         pendingHostCompatNotice = void 0;
         pendingUpdateNotice = void 0;
@@ -823,7 +886,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
           setUpdateNotice(pkg, expected, cluster || "", verdict, state, result.stage, failure);
           entry.lastNotifiedAt = (/* @__PURE__ */ new Date()).toISOString();
           store.hosts[key] = entry;
-          writeStore(store);
+          writeStore2(store);
           return { status: "continue" };
         }
       }
@@ -837,7 +900,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
     pendingHostCompatNotice = void 0;
     pendingUpdateNotice = void 0;
     store.hosts[key] = entry;
-    writeStore(store);
+    writeStore2(store);
     return { status: "continue" };
   }
   setUpdateNotice(
@@ -852,7 +915,7 @@ async function refreshAndMaybeNotify(host, pkg, allowAutoSync) {
   printNotice(notice);
   entry.lastNotifiedAt = (/* @__PURE__ */ new Date()).toISOString();
   store.hosts[key] = entry;
-  writeStore(store);
+  writeStore2(store);
   return { status: "continue" };
 }
 async function runHostCompatCheck(pkg, hostOverride, argv = process.argv) {
@@ -1044,6 +1107,8 @@ export {
   buildVersionInstallPlan,
   friendlyVersionSyncFailure,
   installVersion,
+  resolveKbAutoDiscoveryFeature,
+  shouldSkipAutoSync,
   fetchCliConfig,
   getCachedCompatForHost,
   formatCapabilityMissCompatHint,