@cairnkeep/cli 2.24.0 → 2.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.24.0",
+    "version": "2.25.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/cairn-cli.mjs

@@ -21,6 +21,7 @@ const NODE_COMMANDS = new Map([
   ["evidence", "work-evidence-cli.js"],
   ["playbook", "playbook-cli.js"],
   ["security", "security-cli.js"],
+  ["team", "team-cli.js"],
 ]);
 
 const POSIX_COMMANDS = new Map([
@@ -61,6 +62,7 @@ Usage:
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
   cairn security doctor [--project PATH] [--json]
+  cairn team <init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|doctor|backup|restore|memory-delete>
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]

package/scripts/completion.sh

@@ -13,7 +13,7 @@ _cairn_complete() {
   COMPREPLY=()
   current=${COMP_WORDS[COMP_CWORD]}
   previous=${COMP_WORDS[COMP_CWORD-1]:-}
-  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
+  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
   if (( COMP_CWORD == 1 )); then
     COMPREPLY=( $(compgen -W "$commands" -- "$current") )
     return
@@ -27,6 +27,7 @@ _cairn_complete() {
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
     security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
+    team) COMPREPLY=( $(compgen -W "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -100,6 +101,7 @@ _cairn() {
     'sync-omp:install the oh-my-pi memory extension'
     'doctor:check runtime dependencies and endpoints'
     'security:audit local security posture'
+    'team:operate opt-in reviewed team continuity'
     'trajectory:inspect and prune local session trajectories'
     'artifact:inspect, delete, and prune local artifacts'
     'evidence:inspect and manage local Git-linked work evidence'
@@ -132,6 +134,7 @@ _cairn() {
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
     security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
+    team) _values 'team command' init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--project-root[team option]:value:' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -196,8 +199,8 @@ EOF
   fish)
     sed "s/__CAIRN_HARNESSES__/$harnesses/g" <<'EOF'
 complete -c cairn -f
-for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
-complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
+for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
+complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
 end
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l apply
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l live-root -r
@@ -219,6 +222,23 @@ complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
 complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
 complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from security" -l json
+complete -c cairn -n "__fish_seen_subcommand_from team" -a "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l organization -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l data -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l project -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l roles -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l class -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l expires-at -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l output -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l input -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l confirm -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l port -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l key -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l query -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l proposal -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l decision -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l revision -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l project-root -r
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/lib/team-retention.mjs

@@ -0,0 +1,29 @@
+import { existsSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+
+function canonical(path) {
+  const absolute = resolve(path);
+  if (existsSync(absolute)) return realpathSync(absolute);
+  const parent = dirname(absolute);
+  return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
+}
+
+/** Uninstall never grants permission to purge the separate team store. */
+export function assertUninstallRetainsTeam(targets, env = process.env, home = homedir()) {
+  const stores = new Set([join(home, '.cairnkeep', 'team'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
+  const normalized = path => {
+    const value = canonical(path);
+    return process.platform === 'win32' ? value.toLowerCase() : value;
+  };
+  for (const team of stores) {
+    if (!existsSync(resolve(team))) continue;
+    const protectedPath = normalized(team);
+    for (const target of targets) {
+      const path = normalized(target);
+      if (path === protectedPath || protectedPath.startsWith(path.endsWith(sep) ? path : `${path}${sep}`)) {
+        throw new Error('Uninstall refused: a removal target contains team data. Retain it, or relocate the team store with an explicitly verified backup first.');
+      }
+    }
+  }
+}

package/scripts/test-ci-sharding.sh

@@ -17,6 +17,10 @@ assert.equal(flattened.length, smokeChecks.length);
 assert.equal(new Set(flattened).size, smokeChecks.length);
 assert.deepEqual([...flattened].sort(), smokeChecks.map(({ name }) => name).sort());
 assert.ok(plan.every(({ checks }) => checks.length > 0));
+const teamContracts = ['team', 'team-review', 'team-http', 'team-mcp', 'team-restore', 'team-cli'];
+for (const name of teamContracts) assert.ok(flattened.includes(name), `missing team contract: ${name}`);
+assert.ok(plan.every(({ checks }) => checks.some(({ name }) => teamContracts.includes(name))),
+  'native ACL-heavy team contracts must be distributed across all Windows shards');
 const weights = plan.map(({ weight }) => weight);
 assert.ok(Math.max(...weights) - Math.min(...weights) <= 5,
   `native Windows shards are imbalanced: ${weights.join(", ")}`);

package/scripts/test-completion.sh

@@ -17,6 +17,11 @@ eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --di
 skill_commands='harvest list show review propose evaluate apply rollback'
 for shell in bash zsh fish; do
   grep -q 'capabilities' "$tmp/$shell"
+  grep -q 'team' "$tmp/$shell"
+  grep -q 'credential create set remove issue revoke' "$tmp/$shell"
+  for team_command in init project member credential serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete; do
+    grep -qF "$team_command" "$tmp/$shell"
+  done
   grep -q 'list.*status.*enable.*disable.*reset.*logging\|list status enable disable reset logging' "$tmp/$shell"
   grep -q -- '--json\|-l json' "$tmp/$shell"
   for capability_id in $capability_ids; do
@@ -152,6 +157,9 @@ for shell in bash zsh fish; do
   fi
 done
 "$ROOT/bin/cairn" completion powershell >"$tmp/powershell"
+grep -qF "'team'" "$tmp/powershell"
+grep -qF "'credential','create','set','remove','issue','revoke'" "$tmp/powershell"
+grep -qF "'memory-delete'" "$tmp/powershell"
 grep -qF "'protocol'" "$tmp/powershell"
 grep -qF "'--trajectory'" "$tmp/powershell"
 grep -qF "'--codex-jsonl'" "$tmp/powershell"

package/scripts/test-package-install.sh

@@ -60,6 +60,15 @@ env -u CAIRN_NOTE_DISTILLATION cairn notes --help >/dev/null \
   || fail "installed package omitted the notes command"
 
 installed_root="$tmp/prefix/lib/node_modules/@cairnkeep/cli"
+cairn team --help >"$tmp/installed-team-help"
+grep -qF 'experimental token-first team continuity' "$tmp/installed-team-help" || fail "installed package omitted team preview"
+CAIRN_TEAM=1 cairn team init --organization demo-org --data "$tmp/installed-team" >"$tmp/team-init.json"
+CAIRN_TEAM=1 cairn team project create alpha --data "$tmp/installed-team" >/dev/null
+CAIRN_TEAM=1 cairn team backup --data "$tmp/installed-team" --output "$tmp/team-snapshot.json" >"$tmp/team-backup.json"
+snapshot_digest=$(node -p 'require(process.argv[1]).snapshot_digest' "$tmp/team-backup.json")
+CAIRN_TEAM=1 cairn team restore --input "$tmp/team-snapshot.json" --confirm "$snapshot_digest" --data "$tmp/installed-team-restored" >"$tmp/team-restore.json"
+CAIRN_TEAM=1 cairn team doctor --data "$tmp/installed-team-restored" >"$tmp/team-doctor.json"
+node -e 'if(!require(process.argv[1]).credentials_revoked||!require(process.argv[2]).ok)process.exit(1)' "$tmp/team-restore.json" "$tmp/team-doctor.json" || fail "installed team restore contract failed"
 cairn skill --help >"$tmp/installed-skill-help"
 cmp -s "$tmp/source-skill-help" "$tmp/installed-skill-help" || \
   fail "source and installed skill help differ"

package/scripts/test-team-docs.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$ROOT"
+lesson=docs/learning/lessons/L29-team-continuity.md
+video=docs/learning/video-scripts/V29-team-continuity.md
+for doc in docs/team.md "$lesson" "$video"; do
+  [[ -f "$doc" ]]
+  grep -qi 'preview' "$doc"
+  grep -qi 'independent.*review' "$doc"
+  grep -qi 'pilot' "$doc"
+  if ! grep -qF '2.25.0' "$doc"; then
+    echo "Missing team preview release compatibility: $doc" >&2
+    exit 1
+  fi
+  if grep -qiE 'unreleased|feature-branch preview|released Cairnkeep CLI does not include' "$doc"; then
+    echo 'Released team preview guidance must not claim the feature is absent' >&2
+    exit 1
+  fi
+done
+[[ -f docs/team-pilot.md ]]
+grep -qF 'team-pilot.md' docs/team.md
+grep -qF 'team-pilot.md' "$lesson"
+grep -qF 'team-pilot.md' "$video"
+grep -qF 'not production admission' docs/team-pilot.md
+grep -qF 'reviewer.token' docs/team-pilot.md
+if grep -qF 'released 2.22.5 baseline' docs/README.md || grep -qF 'Cairnkeep 2.22.5 baseline' "$lesson"; then
+  echo 'Team guidance must not pin an obsolete released baseline' >&2
+  exit 1
+fi
+grep -q '^\*\*Status:\*\* Brief' "$lesson"
+grep -q '^## Acceptance criteria$' "$lesson"
+grep -q '^## Privacy and trust boundary$' "$lesson"
+grep -qF 'L29-team-continuity.md' docs/learning/README.md
+grep -qF 'L29-team-continuity.md' docs/learning/tracks/operator.md
+grep -qF '`cairn team`' docs/learning/CURRICULUM-MAP.md
+for command in init project member credential serve mcp proposals proposal-show propose review search read audit doctor backup restore memory-delete; do
+  node mcp-memory-server/dist/team-cli.js --help | grep -q "cairn team $command"
+done
+node mcp-memory-server/dist/team-cli.js --help | grep -qF 'member remove SUBJECT --project ID'
+for doc in docs/team.md "$lesson" "$video"; do
+  grep -qF 'cairn team member remove' "$doc"
+done
+for guide in operating storage privacy-and-data-flow security-assurance harness-compatibility agents; do
+  grep -qF 'team.md' "docs/$guide.md"
+done
+for control in team team-review team-http team-mcp team-restore team-cli; do
+  grep -qF "smoke-$control.mjs" "$lesson"
+  [[ -f "mcp-memory-server/scripts/smoke-$control.mjs" ]]
+done
+node scripts/test-team-pilot.mjs
+echo 'PASS: team preview reference, source controls, admission boundary, learning and video routing'

package/scripts/test-team-pilot.mjs

@@ -0,0 +1,59 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readStableFile } from './lib/stable-file.mjs';
+
+if (process.platform === 'win32') {
+  console.log('SKIP: isolated pilot Bash recipe is Linux/macOS; native CLI controls run separately');
+  process.exit(0);
+}
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const guide = readFileSync(join(root, 'docs/team-pilot.md'), 'utf8');
+const blocks = [...guide.matchAll(/<!-- team-pilot-setup:start -->\s*```sh\n([\s\S]*?)```\s*<!-- team-pilot-setup:end -->/g)];
+assert.equal(blocks.length, 1, 'exactly one maintained executable setup block');
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+const productionPaths = ['.codex/config.toml', '.claude.json', '.qwen/settings.json',
+  '.qwen/trustedFolders.json', '.config/opencode/opencode.json'];
+const fingerprint = () => productionPaths.map(name => {
+  const path = join(homedir(), name);
+  return existsSync(path) ? hash(readFileSync(path)) : null;
+});
+const before = fingerprint();
+const base = mkdtempSync(join(tmpdir(), 'cairn-team-pilot-doc-'));
+const pilot = join(base, 'new lab');
+const environment = { PATH: process.env.PATH, LANG: 'C.UTF-8',
+  TEAM_CAIRN: join(root, 'bin/cairn'), TEAM_PILOT_DIR: pilot };
+try {
+  const readToken = name => readStableFile(join(pilot, name), {
+    label: 'Pilot credential', maxBytes: 256, privateMode: 0o600,
+  }).bytes;
+  const execute = () => spawnSync('bash', ['-c', blocks[0][1]], {
+    cwd: base, env: environment, encoding: 'utf8', timeout: 120000,
+  });
+  const result = execute();
+  assert.equal(result.error, undefined);
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(statSync(pilot).mode & 0o777, 0o700);
+  const files = ['author.token', 'reader.token', 'reviewer.token'];
+  const hashes = files.map(name => {
+    const bytes = readToken(name);
+    const token = bytes.toString('utf8').trim();
+    assert.equal(result.stdout.includes(token), false, 'credential never appears in setup output');
+    assert.equal(result.stderr.includes(token), false);
+    return hash(bytes);
+  });
+  assert.equal(new Set(hashes).size, 3, 'separate credentials, not a shared token');
+  assert.equal(existsSync(join(pilot, 'author-workspace/reviewer.token')), false);
+  assert.equal(existsSync(join(pilot, 'reader-workspace/reviewer.token')), false);
+  const retry = execute();
+  assert.notEqual(retry.status, 0, 'existing lab must not be reused or overwritten');
+  assert.deepEqual(files.map(name => hash(readToken(name))), hashes);
+  assert.deepEqual(fingerprint(), before, 'production harness configurations unchanged');
+  console.log('PASS: documented pilot setup, isolated identities, private credentials, no token output and no overwrite');
+} finally {
+  rmSync(base, { recursive: true, force: true });
+}

package/scripts/uninstall.sh

@@ -91,6 +91,18 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# Refuse an overlapping purge before any harness files or registrations change.
+purge_targets=()
+[[ $PURGE_MEMORY -eq 1 ]] && purge_targets+=("$STORE_DIR")
+[[ $PURGE_PACKS -eq 1 ]] && purge_targets+=("$PACK_DIR")
+if [[ $PURGE_MEMORY -eq 1 ]]; then
+  for project in "${PROJECTS[@]}"; do purge_targets+=("$project/.agentfs"); done
+fi
+if [[ ${#purge_targets[@]} -gt 0 ]]; then
+  command -v node >/dev/null 2>&1 || { echo 'Uninstall purge requires Node to verify team-data retention.' >&2; exit 1; }
+  node "$CAIRN_ROOT/scripts/verify-team-retention.mjs" "${purge_targets[@]}" || exit 1
+fi
+
 # ---- backup bundle -----------------------------------------------------------
 # Timestamp comes from the runtime clock on the user's machine.
 BACKUP_DIR="$HOME/.cairnkeep-uninstall-$(date +%Y%m%d-%H%M%S)"
@@ -197,6 +209,7 @@ echo "  Pi live root: $PI_LIVE_ROOT"
 echo "  Kimi root:    $KIMI_LIVE_ROOT"
 echo "  memory store: $STORE_DIR ($([[ $PURGE_MEMORY -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
 echo "  context packs: $PACK_DIR ($([[ $PURGE_PACKS -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
+echo "  team data: retained (separate operator-managed store; no team purge option)"
 [[ ${#PROJECTS[@]} -gt 0 ]] && echo "  projects:     ${PROJECTS[*]}"
 
 if [[ $DRY_RUN -eq 0 && $ASSUME_YES -eq 0 ]]; then

package/scripts/verify-team-retention.mjs

@@ -0,0 +1,3 @@
+import { assertUninstallRetainsTeam } from './lib/team-retention.mjs';
+try { assertUninstallRetainsTeam(process.argv.slice(2)); }
+catch (error) { console.error(error.message); process.exitCode = 1; }

package/scripts/windows-platform.mjs

@@ -27,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { HARNESS_IDS, harnessProjectAssets } from "./harness-registry.mjs";
 import { reconcilePlaybookInstructions, removePlaybookInstructions } from "./playbook-instructions.mjs";
 import { readStableFile, readStableText, readStableJson } from "./lib/stable-file.mjs";
+import { assertUninstallRetainsTeam } from "./lib/team-retention.mjs";
 
 const BOOTSTRAP_FILES = [
   ["env.example.template", ".ai/env.example"],
@@ -695,6 +696,8 @@ function uninstallWindows(root, args) {
   if (options.has("--purge-memory")) targets.push(resolve(expandHome(process.env.CAIRN_AGENTFS_BASE_DIR || join(homedir(), ".cairnkeep"))));
   if (options.has("--purge-packs")) targets.push(resolve(expandHome(process.env.CAIRN_PACK_BASE_DIR || join(homedir(), ".cairnkeep", "packs"))));
   const candidates = [...new Set(targets)].filter(existsSync);
+  assertUninstallRetainsTeam(candidates);
+  console.log('team data: retained (separate operator-managed store; no team purge option)');
   const existing = candidates.filter((target) => !candidates.some((parent) => parent !== target && target.toLowerCase().startsWith(`${parent.toLowerCase()}${sep}`)));
   if (dryRun) { for (const target of existing) console.log(`would remove: ${target}`); return; }
   const backup = join(homedir(), "cairnkeep-uninstall-backups", new Date().toISOString().replace(/[:.]/g, "-"));
@@ -770,14 +773,15 @@ export function powershellCompletion() {
   const harnesses = HARNESS_IDS.map((id) => `'${id}'`).join(",");
   return `Register-ArgumentCompleter -Native -CommandName cairn -ScriptBlock {
   param($wordToComplete, $commandAst, $cursorPosition)
-  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','security','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
+  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','security','team','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
   $setup = '--git','--harness','--memory','--policy','--yes','--json','init','existing','none',${harnesses},'local'
   $playbook = 'list','status','init','set','enable','disable','reset','check','record','receipts','instructions','doctor','minimal','balanced','strict','must','should','may','off','start','finish','install','remove','context.recall','context.explore','work.plan','verify.tests','review.repository','review.security','docs.update','learning.capture','--project','--json','--enforce','--complexity','--familiarity','--risk','--public-change','--changed','--change-type','--completed','--skipped','--failed','--actor','--actor-kind','--session','--policy','--decision','--event','--action','--outcome','--reason'
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
   $security = 'doctor','--project','--json'
+  $team = 'init','project','member','credential','create','set','remove','issue','revoke','serve','mcp','list','read','search','history','propose','proposals','proposal-show','review','audit','doctor','backup','restore','memory-delete','--organization','--data','--project','--roles','--class','--expires-at','--output','--input','--confirm','--port','--key','--query','--proposal','--decision','--revision','--project-root'
   $evaluation = 'validate','run','ablate','report','prune','delete','protocol','--task-set','--adapter','--output','--repetitions','--seed','--yes','--json','--disable','--experiment','--older-than-days','--dry-run','--trajectory','--codex-jsonl','--capture-authorized'
-  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
+  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+team(?:\\s|$)') { $team } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
   }