@@ -631,10 +631,11 @@ custom_nodes:
 
 Discovery commands can attach a `knowledge` block to their `--json` output: which
 model a name refers to, whether it is deprecated, ranked picks per capability,
-and known pitfalls. It is **off unless you point the CLI at a bundle**, so a
-default install never emits the block.
+and known pitfalls. A signed-in install (`comfy cloud login`) fetches the bundle
+from the cloud knowledge channel on its own. Signed out, the fetch fails quietly
+and no block is emitted unless a bundle is already cached.
 
-Turn it on with either of:
+Point the CLI at a different bundle with either of:
 
 ```
 export COMFY_KNOWLEDGE_URL=https://.../knowledge.json   # fetched and cached
@@ -655,8 +656,8 @@ Turn it off again:
 export COMFY_KNOWLEDGE_DISABLE=1
 ```
 
-Clearing `COMFY_KNOWLEDGE_URL` is *not* an off switch. Once a bundle is cached it
-keeps being served, stale or not. `COMFY_KNOWLEDGE_DISABLE` suppresses envelope
+Signing out is *not* an off switch. Once a bundle is cached it keeps being
+served, stale or not. `COMFY_KNOWLEDGE_DISABLE` suppresses envelope
 enrichment outright; the `comfy knowledge` verbs keep working under it, since
 those are you asking for the bundle directly.
 
@@ -683,9 +684,9 @@ comfy tracking disable
 When tracking is on, we use Mixpanel to understand usage patterns and know where
 to prioritize our efforts.
 
-**One event carries text you typed.** If a curated knowledge bundle is configured
-— it is not by default, and needs `COMFY_KNOWLEDGE_URL` or `COMFY_KNOWLEDGE_FILE`
-— then `comfy nodes search`, `comfy templates ls`, `comfy generate schema`,
+**One event carries text you typed.** If a curated knowledge bundle is loaded
+(a signed-in install fetches one on its own), then `comfy nodes search`,
+`comfy templates ls`, `comfy generate schema`,
 `comfy generate list` and `comfy models search` send the search terms you typed
 and which curated entries they matched. This tells us what people look for and fail
 to find. It needs both the bundle and your tracking consent, so with either one
 
@@ -25,7 +25,7 @@
 import typer
 from rich import markup as rich_markup
 
-from comfy_cli import tracking
+from comfy_cli import knowledge, tracking
 from comfy_cli.auth import store
 from comfy_cli.cloud import CLIENT_ID, CLIENT_NAME, CONFIG_KEY_BASE_URL, get_base_url, get_resource_url, get_scopes
 from comfy_cli.cloud.oauth import OAuthError, run_login
@@ -134,6 +134,10 @@ def _on_url(url: str) -> None:
         expires_at=result.tokens.expires_at,
     )
 
+    # Fill the knowledge cache while the user is online and freshly signed
+    # in, so the cache-only attach path has a bundle on a brand-new install.
+    knowledge.refresh_if_stale()
+
     if renderer.is_pretty():
         from comfy_cli.output.branding import welcome_banner
 
 
@@ -24,11 +24,10 @@
 
 
 def _env_context() -> dict[str, Any]:
-    url = os.environ.get(knowledge.ENV_URL, "").strip()
     return {
         "env_file": os.environ.get(knowledge.ENV_FILE, "").strip() or None,
         # Userinfo, query and fragment can carry a token; the path still shows which bundle is configured.
-        "url": tracking._scrub_value(url) if url else None,
+        "url": tracking._scrub_value(knowledge.bundle_url()),
         "ttl_seconds": knowledge.ttl_seconds(),
         "cache_path": str(knowledge.cache_paths()[0]),
     }
@@ -42,13 +41,22 @@ def _text(value: Any) -> str | None:
     return value if isinstance(value, str) else None
 
 
+_UNAVAILABLE_HINTS = {
+    knowledge.REASON_SIGNED_OUT: "sign in with `comfy cloud login` so the bundle can be fetched, or set COMFY_KNOWLEDGE_FILE to a knowledge.json",
+    knowledge.REASON_FETCH_FAILED: "check COMFY_KNOWLEDGE_URL, or set COMFY_KNOWLEDGE_FILE to a knowledge.json",
+    knowledge.REASON_ENV_FILE: "check the COMFY_KNOWLEDGE_FILE path",
+}
+
+
 def _require_bundle(renderer) -> knowledge.Bundle:
     bundle = knowledge.load_bundle()
     if bundle is None:
+        reason = knowledge.last_reason()
+        hint = _UNAVAILABLE_HINTS.get(reason, "set COMFY_KNOWLEDGE_FILE to a knowledge.json")
         renderer.error(
             code="knowledge_unavailable",
-            message="no knowledge bundle is loaded",
-            hint="set COMFY_KNOWLEDGE_FILE to a knowledge.json, or COMFY_KNOWLEDGE_URL to fetch one; see `comfy knowledge status`",
+            message=f"no knowledge bundle is loaded: {reason}",
+            hint=f"{hint}; see `comfy knowledge status`",
         )
         raise typer.Exit(code=1)
     return bundle
@@ -59,7 +67,10 @@ def _require_bundle(renderer) -> knowledge.Bundle:
 def status_cmd(
     refresh: Annotated[
         bool,
-        typer.Option("--refresh", help="Re-fetch from COMFY_KNOWLEDGE_URL, ignoring the cache TTL."),
+        typer.Option(
+            "--refresh",
+            help="Reload the bundle, ignoring the cache TTL (re-reads COMFY_KNOWLEDGE_FILE when set, else re-fetches).",
+        ),
     ] = False,
 ):
     renderer = get_renderer()
 
@@ -3,7 +3,8 @@
 The bundle (``knowledge.json`` + optional ``manifest.json``) is produced by
 the curated knowledge bundle repo. It reaches this process by one of three routes,
 tried in order: an explicit ``COMFY_KNOWLEDGE_FILE``, the per-user cache, or a
-fetch from ``COMFY_KNOWLEDGE_URL``. A missing or broken bundle is a normal
+fetch from ``COMFY_KNOWLEDGE_URL``, which defaults to the knowledge channel
+under the cloud base URL. A missing or broken bundle is a normal
 state: every entry point here returns ``None`` rather than raising, and nothing
 is written to stdout or stderr. :func:`attach` is how discovery commands add a
 capped ``knowledge`` block to their payload; it is fail-open for the same reason.
@@ -39,6 +40,7 @@
 ENV_URL = "COMFY_KNOWLEDGE_URL"
 ENV_TTL = "COMFY_KNOWLEDGE_TTL"
 ENV_DISABLE = "COMFY_KNOWLEDGE_DISABLE"
+DEFAULT_URL_PATH = "/api/knowledge/knowledge.json"
 DEFAULT_TTL_SECONDS = 24 * 60 * 60
 FETCH_TIMEOUT_SECONDS = 10.0
 MAX_BUNDLE_BYTES = 16 * 1024 * 1024
@@ -77,8 +79,11 @@
 MIN_SINGLE_TOKEN_CHARS = 4
 
 REASON_ENV_FILE = "COMFY_KNOWLEDGE_FILE is set but could not be loaded"
-REASON_NO_URL = "no cache and COMFY_KNOWLEDGE_URL is not set"
-REASON_FETCH_FAILED = "fetch failed and no cached bundle exists"
+REASON_SIGNED_OUT = (
+    "fetch from the cloud knowledge channel failed and no cached bundle exists; "
+    "the usual cause is being signed out (run `comfy cloud login`)"
+)
+REASON_FETCH_FAILED = "fetch from COMFY_KNOWLEDGE_URL failed and no cached bundle exists"
 
 
 @dataclass(frozen=True)
@@ -137,11 +142,27 @@ def ttl_seconds() -> float:
     return max(ttl, 0.0) if math.isfinite(ttl) else DEFAULT_TTL_SECONDS
 
 
+def default_url() -> str:
+    """``knowledge.json`` under the cloud base URL, derived on every call.
+
+    Never stored: :func:`_http_get` attaches credentials only under
+    ``get_base_url()``, which resolves per invocation, so a remembered
+    production URL would silently fetch unauthenticated for anyone pointed at
+    another environment.
+    """
+    return get_base_url().rstrip("/") + DEFAULT_URL_PATH
+
+
+def bundle_url() -> str:
+    """``COMFY_KNOWLEDGE_URL`` when set, else :func:`default_url`."""
+    return os.environ.get(ENV_URL, "").strip() or default_url()
+
+
 def load_bundle(*, force_fetch: bool = False, cache_only: bool = False) -> Bundle | None:
     """Return the indexed bundle, or ``None`` when no usable bundle exists.
 
     Memoized per process; ``force_fetch=True`` re-runs the load and skips the
-    cache TTL gate so a fetch happens whenever ``COMFY_KNOWLEDGE_URL`` is set.
+    cache TTL gate so a fetch happens unless ``COMFY_KNOWLEDGE_FILE`` is set.
     ``cache_only=True`` never touches the network: env file, then any cache
     (fresh or stale), else ``None``. The memo is shared, except that a
     cache-only miss is not memoized so a later full load can still fetch.
@@ -315,17 +336,17 @@ def _load(*, force_fetch: bool, cache_only: bool = False) -> tuple[Bundle | None
         if bundle is not None:
             return bundle, None
 
-    url = os.environ.get(ENV_URL, "").strip()
-    if url and not cache_only:
-        bundle = _fetch(url, knowledge_path, manifest_path)
+    explicit_url = os.environ.get(ENV_URL, "").strip()
+    if not cache_only:
+        bundle = _fetch(explicit_url or default_url(), knowledge_path, manifest_path)
         if bundle is not None:
             return bundle, None
 
     source = "cache" if fresh else "stale-cache"
     bundle = _load_file(knowledge_path, manifest_path, source=source, stale=not fresh)
     if bundle is not None:
         return bundle, None
-    return None, (REASON_FETCH_FAILED if url else REASON_NO_URL)
+    return None, (REASON_FETCH_FAILED if explicit_url else REASON_SIGNED_OUT)
 
 
 def _cache_is_fresh(path: Path) -> bool:
@@ -390,7 +411,9 @@ def _http_get(url: str) -> bytes:
     if url.startswith(get_base_url().rstrip("/") + "/"):
         from comfy_cli.target import resolve_target
 
-        opened = authed_urlopen(url, resolve_target(where="cloud"), timeout=FETCH_TIMEOUT_SECONDS)
+        # Best-effort background fetch: a spurious refresh failure must not log the user out.
+        target = resolve_target(where="cloud", allow_clear=False)
+        opened = authed_urlopen(url, target, timeout=FETCH_TIMEOUT_SECONDS)
     else:
         req = urllib.request.Request(url, headers={"User-Agent": "comfy-cli"})
         opened = plain_urlopen(req, timeout=FETCH_TIMEOUT_SECONDS)
@@ -922,9 +945,9 @@ def attach(
     exactly as it was.
 
     ``COMFY_KNOWLEDGE_DISABLE`` suppresses the block entirely. A cached bundle
-    keeps being read once it exists, stale or not, so clearing
-    ``COMFY_KNOWLEDGE_URL`` is not an off switch and this is. Following
-    ``DO_NOT_TRACK``, any value but empty or ``"0"`` disables.
+    keeps being read once it exists, stale or not, and the default URL means a
+    signed-in install fetches one without being asked, so this is the only off
+    switch. Following ``DO_NOT_TRACK``, any value but empty or ``"0"`` disables.
     """
     try:
         disable = os.environ.get(ENV_DISABLE, "")
 
@@ -13,7 +13,7 @@
     "as_of": { "type": ["string", "null"], "description": "ISO-8601 UTC timestamp: file mtime (status) or the capability's as_of, null when the capability has none (pick)." },
     "path": { "type": "string", "description": "File the bundle bytes were read from (status)." },
     "env_file": { "type": ["string", "null"], "description": "Value of COMFY_KNOWLEDGE_FILE (status)." },
-    "url": { "type": ["string", "null"], "description": "Value of COMFY_KNOWLEDGE_URL with userinfo, query and fragment removed (status)." },
+    "url": { "type": ["string", "null"], "description": "URL a fetch uses: COMFY_KNOWLEDGE_URL, else knowledge.json under the cloud base URL; userinfo, query and fragment removed (status)." },
     "ttl_seconds": { "type": "number", "description": "Cache TTL in effect (status)." },
     "cache_path": { "type": "string", "description": "Where a fetched bundle is cached (status)." },
     "counts": {
 
@@ -51,7 +51,12 @@ def url(self, *parts: str) -> str:
 
 
 def resolve_target(
-    *, where: str | None, host: str | None = None, port: int | None = None, config: Any = None
+    *,
+    where: str | None,
+    host: str | None = None,
+    port: int | None = None,
+    config: Any = None,
+    allow_clear: bool = True,
 ) -> Target:
     """Pick a Target based on ``--where`` plus host/port (for local).
 
@@ -60,6 +65,10 @@ def resolve_target(
     auto-detect (``cloud`` if credentials exist, else ``local``).
     The ``config`` arg is honored if passed; otherwise
     we instantiate a ``ConfigManager`` to read the persisted key.
+
+    ``allow_clear=False`` is forwarded to :func:`resolve_cloud_credential` so a
+    best-effort background caller cannot wipe the stored session on a failed
+    token refresh.
     """
     from comfy_cli import where as where_module
 
@@ -92,7 +101,7 @@ def resolve_target(
         # when the token isn't near expiry (no network), and the client/loader
         # still force-refresh *reactively* on a server 401 as a backstop.
         base_url = get_base_url()
-        cred = resolve_cloud_credential(purpose="cloud", base_url=base_url, refresh=True)
+        cred = resolve_cloud_credential(purpose="cloud", base_url=base_url, refresh=True, allow_clear=allow_clear)
         token = cred.value if cred is not None and cred.kind == "oauth" else None
         api_key = cred.value if cred is not None and cred.kind == "api_key" else None
 
 
@@ -57,6 +57,52 @@ def _no_tracking(monkeypatch):
     monkeypatch.setattr("comfy_cli.tracking.track_event", lambda *a, **k: None)
 
 
+@pytest.fixture(autouse=True)
+def _knowledge_warm(monkeypatch):
+    """Record the post-login knowledge warm instead of fetching a bundle."""
+    calls: list[None] = []
+    monkeypatch.setattr(command.knowledge, "refresh_if_stale", lambda: calls.append(None))
+    return calls
+
+
+def test_login_warms_the_knowledge_cache_after_saving_the_session(monkeypatch, capsys, _knowledge_warm):
+    order: list[str] = []
+
+    def fake_run_login(**kwargs):
+        kwargs["on_url_ready"](_AUTHORIZE_URL)
+        return _login_result()
+
+    real_save = command.store.save_cloud_session
+
+    def save_then_record(**kwargs):
+        order.append("save")
+        return real_save(**kwargs)
+
+    monkeypatch.setattr(command, "run_login", fake_run_login)
+    monkeypatch.setattr(command.store, "save_cloud_session", save_then_record)
+    monkeypatch.setattr(command.knowledge, "refresh_if_stale", lambda: order.append("warm"))
+    set_renderer(Renderer(mode=OutputMode.JSON, command="cloud login", version="test"))
+
+    command.login_cmd(no_browser=True, timeout=300)
+
+    assert order == ["save", "warm"]
+    assert _parse_lines(capsys.readouterr().out)[-1]["ok"] is True
+
+
+def test_login_timeout_does_not_warm_the_knowledge_cache(monkeypatch, _knowledge_warm):
+    def fake_run_login(**kwargs):
+        kwargs["on_url_ready"](_AUTHORIZE_URL)
+        raise oauth.OAuthError("timed out")
+
+    monkeypatch.setattr(command, "run_login", fake_run_login)
+    set_renderer(Renderer(mode=OutputMode.JSON, command="cloud login", version="test"))
+
+    with pytest.raises(typer.Exit):
+        command.login_cmd(no_browser=True, timeout=1)
+
+    assert _knowledge_warm == []
+
+
 def test_json_login_emits_login_url_event_before_envelope(monkeypatch, capsys):
     """`comfy --json cloud login --no-browser` streams a `login_url` event
     (carrying the authorize URL) ahead of the final, session-redacted envelope."""