@cairnkeep/cli 2.24.0 → 2.26.0

package/mcp-memory-server/package.json

@@ -58,14 +58,14 @@
         "check:context-pack-retrieval": "node scripts/smoke-context-pack-retrieval.mjs",
         "check:context-pack-v216-compat": "node scripts/smoke-context-pack-v216-compat.mjs",
         "check:context-usage": "node scripts/smoke-context-usage.mjs",
-        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs",
+        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs && node scripts/smoke-provider-config-flow.mjs",
         "check:anythingllm-workspace": "node scripts/smoke-anythingllm-workspace.mjs && node scripts/smoke-anythingllm-workspace-mcp.mjs",
         "check:retrieval-benchmark": "node scripts/smoke-retrieval-benchmark.mjs && node scripts/run-retrieval-benchmark.mjs --check",
         "benchmark:retrieval": "npm run build && node scripts/run-retrieval-benchmark.mjs",
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
         "check:okf": "node scripts/smoke-okf.mjs",
         "check:playbook": "node scripts/smoke-playbook.mjs",
-        "check:security-assurance": "node scripts/smoke-security-assurance.mjs",
+        "check:security-assurance": "node scripts/smoke-security-fixture-order.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
         "test:smoke": "npm run build && node scripts/run-smoke-suite.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.24.0",
+    "version": "2.26.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/cairn-cli.mjs

@@ -21,6 +21,7 @@ const NODE_COMMANDS = new Map([
   ["evidence", "work-evidence-cli.js"],
   ["playbook", "playbook-cli.js"],
   ["security", "security-cli.js"],
+  ["team", "team-cli.js"],
 ]);
 
 const POSIX_COMMANDS = new Map([
@@ -61,6 +62,7 @@ Usage:
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
   cairn security doctor [--project PATH] [--json]
+  cairn team <connect|disconnect|init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|doctor|backup|restore|memory-delete>
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]
@@ -94,6 +96,11 @@ export async function main(argv) {
     return;
   }
 
+  if (command === 'team' && (['connect', 'disconnect'].includes(args[0]) || (args[0] === 'doctor' && args.includes('--client')))) {
+    const { runTeamConnection } = await import('./team-connect.mjs');
+    process.exitCode = await runTeamConnection(args);
+    return;
+  }
   const nodeEntry = NODE_COMMANDS.get(command);
   if (nodeEntry) {
     // Preserve the historical dispatcher contract: child Node resolution comes

package/scripts/completion.sh

@@ -13,7 +13,7 @@ _cairn_complete() {
   COMPREPLY=()
   current=${COMP_WORDS[COMP_CWORD]}
   previous=${COMP_WORDS[COMP_CWORD-1]:-}
-  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
+  commands="bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help"
   if (( COMP_CWORD == 1 )); then
     COMPREPLY=( $(compgen -W "$commands" -- "$current") )
     return
@@ -27,6 +27,7 @@ _cairn_complete() {
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
     security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
+    team) COMPREPLY=( $(compgen -W "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root --connection --client --url --token-file --harness --access --apply --yes" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -100,6 +101,7 @@ _cairn() {
     'sync-omp:install the oh-my-pi memory extension'
     'doctor:check runtime dependencies and endpoints'
     'security:audit local security posture'
+    'team:operate opt-in reviewed team continuity'
     'trajectory:inspect and prune local session trajectories'
     'artifact:inspect, delete, and prune local artifacts'
     'evidence:inspect and manage local Git-linked work evidence'
@@ -132,6 +134,7 @@ _cairn() {
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
     security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
+    team) _values 'team command' connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--apply[apply plan]' '--yes[confirm plan]' '--client[client diagnostics]' '--url[team URL]:value:' '--token-file[private credential file]:file:_files' '--harness[team adapters]:value:' '--access[tool profile]:value:(read-only full)' '--connection[private connection file]:file:_files' '--project-root[team option]:value:' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -196,8 +199,8 @@ EOF
   fish)
     sed "s/__CAIRN_HARNESSES__/$harnesses/g" <<'EOF'
 complete -c cairn -f
-for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
-complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
+for command in bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help
+complete -c cairn -n "not __fish_seen_subcommand_from bootstrap setup memory-server sync sync-pi sync-kimi sync-omp doctor security team trajectory artifact evidence playbook capabilities mcp-tools pack proposals notes eval skill graph memory audit-timer uninstall completion version help" -a $command
 end
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l apply
 complete -c cairn -n "__fish_seen_subcommand_from sync" -l live-root -r
@@ -219,6 +222,31 @@ complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
 complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
 complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from security" -l json
+complete -c cairn -n "__fish_seen_subcommand_from team" -a "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l organization -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l data -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l project -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l roles -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l class -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l expires-at -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l output -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l input -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l confirm -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l port -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l key -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l query -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l proposal -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l decision -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l revision -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l project-root -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l connection -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l client
+complete -c cairn -n "__fish_seen_subcommand_from team" -l url -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l token-file -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l harness -r -a "claude opencode qwen codex"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l access -r -a "read-only full"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l apply
+complete -c cairn -n "__fish_seen_subcommand_from team" -l yes
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/lib/team-retention.mjs

@@ -0,0 +1,29 @@
+import { existsSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, join, resolve, sep } from 'node:path';
+
+function canonical(path) {
+  const absolute = resolve(path);
+  if (existsSync(absolute)) return realpathSync(absolute);
+  const parent = dirname(absolute);
+  return parent === absolute ? absolute : join(canonical(parent), basename(absolute));
+}
+
+/** Uninstall never grants permission to purge the separate team store. */
+export function assertUninstallRetainsTeam(targets, env = process.env, home = homedir()) {
+  const stores = new Set([join(home, '.cairnkeep', 'team'), join(home, '.cairnkeep', 'team-clients'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
+  const normalized = path => {
+    const value = canonical(path);
+    return process.platform === 'win32' ? value.toLowerCase() : value;
+  };
+  for (const team of stores) {
+    if (!existsSync(resolve(team))) continue;
+    const protectedPath = normalized(team);
+    for (const target of targets) {
+      const path = normalized(target);
+      if (path === protectedPath || protectedPath.startsWith(path.endsWith(sep) ? path : `${path}${sep}`)) {
+        throw new Error('Uninstall refused: a removal target contains team data. Retain it, or relocate the team store with an explicitly verified backup first.');
+      }
+    }
+  }
+}

package/scripts/team-connect.mjs

@@ -0,0 +1,366 @@
+import { chmodSync, closeSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import { dirname, join, resolve, parse, relative, isAbsolute, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline/promises';
+import { readStableFile, assertFileUnchanged } from './lib/stable-file.mjs';
+import { selectManyPrompt, selectOnePrompt, supportsTerminalPrompts } from './terminal-prompts.mjs';
+import { readStableJson } from '../mcp-memory-server/dist/stable-file.js';
+import { hardenPrivatePath } from '../mcp-memory-server/dist/platform-security.js';
+import { prepareTeamPrivateDirectory, TeamError } from '../mcp-memory-server/dist/team-store.js';
+import { validateTeamConnection, readTeamConnection, connectionToken, connectionDoctor, TeamClientError } from '../mcp-memory-server/dist/team-client.js';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const NAME = 'cairn-team-memory';
+const MAX = 1024 * 1024;
+// Four before/after 1 MiB files, base64 encoded, plus bounded metadata.
+const MAX_RECEIPT = 16 * MAX;
+const ADAPTERS = Object.freeze({ claude: '.mcp.json', opencode: 'opencode.json', qwen: '.qwen/settings.json', codex: '.codex/config.toml' });
+const HELP = `cairn team connect — opt-in, project-local team MCP (personal memory unchanged)
+
+  cairn team connect [--project-root PATH] [--url URL --organization ID --project ID --token-file FILE --harness claude,opencode,qwen,codex] [--access read-only|full] [--apply --yes]
+  cairn team disconnect [--project-root PATH] [--apply --yes]
+  cairn team doctor --client [--project-root PATH]
+
+CAIRN_TEAM=1 is required. Without --apply a complete command is a no-write plan.
+Interactive connect asks for missing choices and confirms before applying.
+Credentials remain in owner-only files OUTSIDE source trees. No token values are
+stored in harness config. Existing team entries/unsupported syntax fail closed.
+Doctor checks authenticated reader access, not production admission. Disconnect
+keeps credentials/backups; restart existing harness sessions or ask the operator
+to revoke a credential for immediate denial. See docs/team-onboarding.md.
+`;
+class ConnectionError extends Error {}
+function fail(message) { throw new ConnectionError(message); }
+function enabled() { if (process.env.CAIRN_TEAM !== '1') fail('Team disabled. Opt in explicitly with CAIRN_TEAM=1.'); }
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+function info(path) { try { return lstatSync(path); } catch (error) { if (error.code === 'ENOENT') return null; throw error; } }
+function safeAncestors(path) {
+  let cursor = resolve(path);
+  while (true) {
+    const stat = info(cursor);
+    if (stat && (!stat.isDirectory() || stat.isSymbolicLink()
+      || (process.platform !== 'win32' && (stat.mode & 0o022) !== 0 && !(stat.mode & 0o1000)))) fail('Team configuration has an unsafe directory ancestor.');
+    if (cursor === dirname(cursor)) break;
+    cursor = dirname(cursor);
+  }
+}
+function locations(projectRoot, home = homedir()) {
+  const target = realpathSync(resolve(projectRoot));
+  if (target === parse(target).root || /[\x00-\x1f\x7f]/.test(target)) fail('Invalid team project root.');
+  safeAncestors(target);
+  const targetInfo = lstatSync(target);
+  if (process.platform !== 'win32' && ((targetInfo.mode & 0o022) !== 0 || (typeof process.getuid === 'function' && targetInfo.uid !== process.getuid()))) fail('Team project directory must be owned by this user and not writable by other users.');
+  const state = join(realpathSync(resolve(home)), '.cairnkeep', 'team-clients', hash(target));
+  safeAncestors(state);
+  return { target, state, connectionFile: join(state, 'connection.json'), receiptFile: join(state, 'receipt.json') };
+}
+function snapshot(path, maxBytes = MAX) {
+  if (!info(path)) return null;
+  const current = readStableFile(path, { label: 'Harness configuration', maxBytes });
+  if (process.platform !== 'win32' && (current.stat.mode & 0o022)) fail('Harness configuration must not be writable by other users.');
+  return current;
+}
+function object(value) { return value && typeof value === 'object' && !Array.isArray(value); }
+// Refuse duplicate object keys, including escaped spellings. JSON.parse alone
+// would silently discard a preexisting MCP entry hidden behind a duplicate key.
+function parseConfig(text) {
+  let offset = 0;
+  const ws = () => { while (/\s/.test(text[offset] ?? '') && offset < text.length) offset++; };
+  function string() {
+    const start = offset++;
+    while (offset < text.length) { const ch = text[offset++]; if (ch === '\\') offset++; else if (ch === '"') return JSON.parse(text.slice(start, offset)); }
+    fail('Harness configuration contains invalid JSON.');
+  }
+  function value(depth = 0) {
+    if (depth > 100) fail('Harness configuration is nested too deeply.');
+    ws();
+    if (text[offset] === '"') { string(); return; }
+    if (text[offset] === '{') {
+      offset++; ws(); const keys = new Set(); if (text[offset] === '}') { offset++; return; }
+      while (offset < text.length) {
+        ws(); if (text[offset] !== '"') fail('Harness configuration requires strict JSON (not JSONC).');
+        const key = string(); if (keys.has(key)) fail('Harness configuration has duplicate JSON keys.'); keys.add(key);
+        ws(); if (text[offset++] !== ':') fail('Harness configuration contains invalid JSON.');
+        value(depth + 1); ws(); const ch = text[offset++]; if (ch === '}') return; if (ch !== ',') break;
+      }
+      fail('Harness configuration contains invalid JSON.');
+    }
+    if (text[offset] === '[') {
+      offset++; ws(); if (text[offset] === ']') { offset++; return; }
+      while (offset < text.length) { value(depth + 1); ws(); const ch = text[offset++]; if (ch === ']') return; if (ch !== ',') break; }
+      fail('Harness configuration contains invalid JSON.');
+    }
+    const match = /^(?:true|false|null|-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?)/.exec(text.slice(offset));
+    if (!match) fail('Harness configuration contains invalid JSON.'); offset += match[0].length;
+  }
+  value(); ws(); if (offset !== text.length) fail('Harness configuration requires strict JSON.');
+  const parsed = JSON.parse(text); if (!object(parsed)) fail('Harness configuration must be a JSON object.'); return parsed;
+}
+function text(bytes) { return new TextDecoder('utf-8', { fatal: true }).decode(bytes); }
+function entryFor(harness, connectionFile) {
+  const args = [join(ROOT, 'bin', 'cairn'), 'team', 'mcp', '--connection', connectionFile];
+  return harness === 'opencode'
+    ? { type: 'local', command: [process.execPath, ...args], environment: { CAIRN_TEAM: '1' }, enabled: true }
+    : { command: process.execPath, args, env: { CAIRN_TEAM: '1' } };
+}
+function jsonAdd(bytes, harness, entry) {
+  const parsed = bytes ? parseConfig(text(bytes)) : {};
+  const field = harness === 'opencode' ? 'mcp' : 'mcpServers';
+  if (Object.hasOwn(parsed, field) && !object(parsed[field])) fail('Harness MCP configuration must be an object.');
+  if (Object.hasOwn(parsed[field] ?? {}, NAME)) fail('Existing team MCP entry is not owned by this connection; preserve it and resolve manually.');
+  parsed[field] = { ...parsed[field], [NAME]: entry };
+  return Buffer.from(`${JSON.stringify(parsed, null, 2)}\n`);
+}
+function tomlBlock(entry, nonce) {
+  return `\n# BEGIN cairnkeep team ${nonce}\n[mcp_servers.${NAME}]\ncommand = ${JSON.stringify(entry.command)}\nargs = ${JSON.stringify(entry.args)}\n[mcp_servers.${NAME}.env]\nCAIRN_TEAM = "1"\n# END cairnkeep team ${nonce}\n`;
+}
+function receiptAt(loc) {
+  if (!info(loc.receiptFile)) return null;
+  const receipt = readStableJson(loc.receiptFile, { label: 'Team connection receipt', maxBytes: MAX_RECEIPT, private: true });
+  if (!object(receipt) || receipt.schema_version !== 1 || receipt.project_root !== loc.target
+    || typeof receipt.connection_digest !== 'string' || !/^[a-f0-9]{64}$/.test(receipt.connection_digest)
+    || !['preparing', 'connected', 'disconnecting'].includes(receipt.status) || !Array.isArray(receipt.files) || receipt.files.length < 1 || receipt.files.length > 4
+    || new Set(receipt.files.map(row => row.harness)).size !== receipt.files.length) fail('Invalid team connection receipt.');
+  for (const row of receipt.files) {
+    if (!object(row) || !Object.hasOwn(ADAPTERS, row.harness) || row.path !== ADAPTERS[row.harness]
+      || !(row.before === null || (typeof row.before === 'string' && row.before.length <= 1.4 * MAX))
+      || typeof row.after !== 'string' || row.after.length > 1.4 * MAX
+      || !Number.isInteger(row.mode) || row.mode < 0 || row.mode > 0o777
+      || (row.harness === 'codex' ? typeof row.block !== 'string' : !object(row.entry))) fail('Invalid team connection receipt.');
+  }
+  return receipt;
+}
+export function planTeamConnection(options) {
+  enabled();
+  const loc = locations(options.projectRoot ?? process.cwd(), options.home);
+  const connection = validateTeamConnection({ schema_version: 1, project_root: loc.target, organization: options.organization,
+    project: options.project, url: options.url, token_file: resolve(options.tokenFile ?? ''), access: options.access ?? 'read-only' });
+  if (!options.tokenFile) fail('A private token-file reference is required.');
+  // Do not embed a credential path from this source tree into project config.
+  const tokenRelative = relative(loc.target, realpathSync(connection.token_file));
+  if (tokenRelative === '' || (!isAbsolute(tokenRelative) && tokenRelative.split(sep)[0] !== '..')) fail('Keep the credential file outside the project source tree.');
+  connectionToken(connection);
+  const harnesses = options.harnesses;
+  if (!Array.isArray(harnesses) || !harnesses.length || harnesses.length > 4 || new Set(harnesses).size !== harnesses.length
+    || harnesses.some(h => !Object.hasOwn(ADAPTERS, h))) fail('Unsupported or duplicate team harness; choose claude, opencode, qwen or codex.');
+  const prior = receiptAt(loc);
+  if (prior) {
+    const currentConnection = readTeamConnection(loc.connectionFile);
+    if (prior.status !== 'connected' || JSON.stringify(currentConnection) !== JSON.stringify(connection)
+      || [...harnesses].sort().join() !== prior.files.map(r => r.harness).sort().join()) fail('Team connection already exists or is incomplete; doctor/disconnect before changing it.');
+    for (const row of prior.files) {
+      const current = snapshot(join(loc.target, row.path));
+      if (!current || !current.bytes.equals(Buffer.from(row.after, 'base64'))) fail('Team harness configuration changed; resolve drift before reconnecting.');
+    }
+    return { ...loc, connection, files: prior.files, unchanged: true };
+  }
+  if (info(loc.connectionFile)) fail('Incomplete team connection; inspect private recovery state before retrying.');
+  const nonce = randomUUID();
+  const files = harnesses.map(harness => {
+    const path = ADAPTERS[harness]; const destination = join(loc.target, path); safeAncestors(dirname(destination));
+    if (harness === 'opencode' && info(join(loc.target, 'opencode.jsonc'))) fail('OpenCode JSONC exists; no automatic edits. Use a separate supported configuration.');
+    const current = snapshot(destination); const bytes = current?.bytes ?? null;
+    const entry = entryFor(harness, loc.connectionFile);
+    let after, block;
+    if (harness === 'codex') {
+      // Do not attempt to reinterpret arbitrary operator TOML or equivalent
+      // quoted/inline tables. A conservative collision check preserves it.
+      if (bytes && text(bytes).includes(NAME)) fail('Existing team MCP TOML entry must be resolved manually.');
+      if (bytes && /(?:^|\n)\s*(?:"mcp_servers"|'mcp_servers'|mcp_servers)\s*=/.test(text(bytes))) fail('Inline MCP TOML configuration is unsupported; preserve it and configure manually.');
+      block = tomlBlock(entry, nonce); after = Buffer.concat([bytes ?? Buffer.alloc(0), Buffer.from(block)]);
+    } else after = jsonAdd(bytes, harness, entry);
+    if (after.length > MAX) fail('Harness configuration exceeds the 1 MiB limit.');
+    return { harness, path, before: bytes?.toString('base64') ?? null, after: after.toString('base64'), mode: current ? current.stat.mode & 0o777 : 0o600, ...(block ? { block } : { entry }), expected: current?.stat ?? null };
+  });
+  return { ...loc, connection, files, unchanged: false };
+}
+function makeParents(target, directory) {
+  const segments = directory.slice(target.length).split(/[\\/]/).filter(Boolean);
+  let cursor = target;
+  for (const segment of segments) { cursor = join(cursor, segment); if (!info(cursor)) { mkdirSync(cursor, { mode: 0o700 }); hardenPrivatePath(cursor); } safeAncestors(cursor); }
+}
+// Like the setup writer, this has a point-in-time drift check, not an OS CAS.
+// The private state lock serializes Cairnkeep writers. Owner-controlled config
+// directories are required; hostile same-identity processes are out of scope.
+function publish(path, bytes, mode, expected = null) {
+  safeAncestors(dirname(path));
+  const parent = lstatSync(dirname(path));
+  const temporary = join(dirname(path), `.cairn-team-${randomUUID()}.tmp`);
+  let fd;
+  try {
+    fd = openSync(temporary, 'wx', mode); writeFileSync(fd, bytes); fsyncSync(fd); closeSync(fd); fd = undefined;
+    hardenPrivatePath(temporary);
+    if (process.platform !== 'win32') chmodSync(temporary, mode);
+    assertFileUnchanged(path, expected, 'Team configuration');
+    const now = lstatSync(dirname(path));
+    if (parent.dev !== now.dev || parent.ino !== now.ino || now.isSymbolicLink()) fail('Team configuration parent changed.');
+    if (expected) renameSync(temporary, path);
+    else linkSync(temporary, path); // exclusive destination; never replace a competing new file
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    if (info(temporary)) unlinkSync(temporary);
+  }
+}
+function lockPath(loc) { return `${loc.state}.operation.lock`; }
+function lock(loc) {
+  // Keep the lock outside the directory we atomically archive on disconnect.
+  // Native Windows cannot rename a directory containing an open lock handle.
+  prepareTeamPrivateDirectory(dirname(loc.state), true);
+  const path = lockPath(loc);
+  let fd;
+  try { fd = openSync(path, 'wx', 0o600); }
+  catch { fail('Team connection is locked or interrupted. Check running operations before manually clearing operation.lock; see recovery guide.'); }
+  try { hardenPrivatePath(path); } catch (error) { closeSync(fd); unlinkSync(path); throw error; }
+  try { prepareTeamPrivateDirectory(loc.state, true); }
+  catch (error) { closeSync(fd); unlinkSync(path); throw error; }
+  let released = false;
+  return (location = path) => { if (released) return; released = true; closeSync(fd); unlinkSync(location); };
+}
+export async function applyTeamConnection(plan, hooks = {}) {
+  enabled();
+  const loc = locations(plan.target, dirname(dirname(dirname(plan.state))));
+  if (loc.state !== plan.state || loc.connectionFile !== plan.connectionFile) fail('Invalid team connection plan.');
+  if (plan.unchanged) { await connectionDoctor(plan.connection); return { connected: true, unchanged: true, connection_file: loc.connectionFile }; }
+  const unlock = lock(loc);
+  try {
+    if (receiptAt(loc) || info(loc.connectionFile)) fail('Team connection changed; inspect recovery state.');
+    const connection = validateTeamConnection(plan.connection); connectionToken(connection);
+    // Verify access before writing anything except our private lock directory.
+    const identity = await connectionDoctor(connection);
+    if (identity.credential_class !== 'workload') fail('Team harness connection requires a workload credential; keep human reviewer credentials outside agent configuration.');
+    for (const row of plan.files) assertFileUnchanged(join(loc.target, row.path), row.expected, 'Harness configuration');
+    const connectionBytes = Buffer.from(`${JSON.stringify(connection)}\n`);
+    const receipt = { schema_version: 1, project_root: loc.target, status: 'preparing', connection_digest: hash(connectionBytes), files: plan.files.map(({ expected, ...row }) => row) };
+    publish(loc.receiptFile, Buffer.from(`${JSON.stringify(receipt)}\n`), 0o600);
+    publish(loc.connectionFile, connectionBytes, 0o600);
+    for (const row of plan.files) {
+      await hooks.beforeWrite?.(row);
+      const destination = join(loc.target, row.path); makeParents(loc.target, dirname(destination));
+      publish(destination, Buffer.from(row.after, 'base64'), row.mode, row.expected);
+    }
+    const current = snapshot(loc.receiptFile, MAX_RECEIPT);
+    publish(loc.receiptFile, Buffer.from(`${JSON.stringify({ ...receipt, status: 'connected' })}\n`), 0o600, current.stat);
+    return { connected: true, unchanged: false, connection_file: loc.connectionFile, access: connection.access };
+  } finally { unlock(); }
+}
+function removal(row, current, disconnecting = false) {
+  const before = row.before === null ? null : Buffer.from(row.before, 'base64');
+  if (!current) { if (before === null) return undefined; fail('Team configuration changed or is missing; resolve drift before disconnect.'); }
+  if (before?.equals(current.bytes)) return undefined; // interrupted connect did not publish this file
+  if (current.bytes.equals(Buffer.from(row.after, 'base64'))) return before;
+  if (row.harness === 'codex') {
+    const contents = text(current.bytes);
+    if (disconnecting && !contents.includes(NAME)) return undefined;
+    if (contents.split(row.block).length !== 2) fail('Owned team TOML block changed; resolve drift before disconnect.');
+    return Buffer.from(contents.replace(row.block, ''));
+  }
+  const parsed = parseConfig(text(current.bytes)); const field = row.harness === 'opencode' ? 'mcp' : 'mcpServers';
+  if (disconnecting && (!Object.hasOwn(parsed, field) || (object(parsed[field]) && !Object.hasOwn(parsed[field], NAME)))) return undefined;
+  if (!object(parsed[field]) || JSON.stringify(parsed[field][NAME]) !== JSON.stringify(row.entry)) fail('Owned team MCP entry changed; resolve drift before disconnect.');
+  delete parsed[field][NAME];
+  const original = before ? parseConfig(text(before)) : {};
+  if (Object.keys(parsed[field]).length === 0 && !Object.hasOwn(original, field)) delete parsed[field];
+  return Buffer.from(`${JSON.stringify(parsed, null, 2)}\n`);
+}
+export async function disconnectTeamConnection(options) {
+  enabled(); const loc = locations(options.projectRoot ?? process.cwd(), options.home);
+  const unlock = options.dryRun ? () => {} : lock(loc);
+  try {
+    const receipt = receiptAt(loc); if (!receipt) fail('No managed team connection for this project.');
+    // Preflight EVERY file before removing any entry. Drift never authorizes
+    // wholesale backup restore over newly edited personal/unrelated MCP config.
+    const changes = receipt.files.map(row => {
+      const destination = join(loc.target, row.path); safeAncestors(dirname(destination));
+      const current = snapshot(destination); return { row, destination, current, bytes: removal(row, current, receipt.status === 'disconnecting') };
+    });
+    if (options.dryRun) return { planned: true, disconnect: true, project_root: loc.target, files: receipt.files.map(row => row.path) };
+    const receiptSnapshot = snapshot(loc.receiptFile, MAX_RECEIPT);
+    publish(loc.receiptFile, Buffer.from(`${JSON.stringify({ ...receipt, status: 'disconnecting' })}\n`), 0o600, receiptSnapshot.stat);
+    for (const { row, destination, current, bytes } of changes) {
+      if (bytes === undefined) continue;
+      await options.beforeWrite?.(row);
+      assertFileUnchanged(destination, current.stat, 'Harness configuration');
+      if (bytes === null) unlinkSync(destination);
+      else publish(destination, bytes, row.mode, current.stat);
+    }
+    // Keep private backups, but retire the active connection path so new
+    // harness launches cannot reuse it accidentally. Existing processes need
+    // restart or server-side revocation; disconnect does not revoke a token.
+    const archive = `${loc.state}.disconnected-${randomUUID()}`;
+    renameSync(loc.state, archive);
+    unlock();
+    return { disconnected: true, credentials_retained: true, backups_retained: true };
+  } finally { unlock(); }
+}
+function argsFor(args) {
+  const flags = {}; const values = new Set(['project-root', 'url', 'organization', 'project', 'token-file', 'harness', 'access']);
+  for (let index = 1; index < args.length; index++) {
+    const name = args[index].slice(2);
+    if (!args[index].startsWith('--') || Object.hasOwn(flags, name)) fail('Unknown or duplicate team connection option.');
+    if (['apply', 'yes', 'client'].includes(name)) flags[name] = true;
+    else if (values.has(name) && args[index + 1] && !args[index + 1].startsWith('--')) flags[name] = args[++index];
+    else fail('Unknown or missing team connection option.');
+  }
+  return flags;
+}
+export async function runTeamConnection(args, streams = {}) {
+  const input = streams.input ?? process.stdin, output = streams.output ?? process.stdout, error = streams.error ?? process.stderr;
+  let prompt;
+  try {
+    if (args.includes('--help') || args.includes('-h')) { output.write(HELP); return 0; }
+    enabled();
+    const flags = argsFor(args); const command = args[0];
+    const allowed = command === 'connect' ? ['project-root', 'url', 'organization', 'project', 'token-file', 'harness', 'access', 'apply', 'yes']
+      : command === 'disconnect' ? ['project-root', 'apply', 'yes'] : command === 'doctor' ? ['project-root', 'client'] : [];
+    if (!allowed.length || Object.keys(flags).some(key => !allowed.includes(key))) fail('Invalid team connection command or option.');
+    const options = { projectRoot: flags['project-root'] ?? process.cwd(), home: streams.home };
+    if (command === 'doctor') {
+      if (!flags.client) fail('Use team doctor --client for connection diagnostics.');
+      const loc = locations(options.projectRoot, options.home); const receipt = receiptAt(loc);
+      if (!receipt || receipt.status !== 'connected' || info(lockPath(loc))) fail('No completed, unlocked team connection; inspect recovery state.');
+      for (const row of receipt.files) {
+        const current = snapshot(join(loc.target, row.path));
+        if (!current || removal(row, current) === undefined) fail('Managed team entry is missing; reconnect or inspect recovery state.');
+      }
+      const connection = readTeamConnection(loc.connectionFile);
+      output.write(`${JSON.stringify(await connectionDoctor(connection), null, 2)}\n`); return 0;
+    }
+    const interactive = Boolean(input.isTTY && output.isTTY);
+    const wizard = command === 'connect' && interactive && ['url', 'organization', 'project', 'token-file', 'harness'].some(key => !flags[key]);
+    const question = async message => {
+      prompt ??= createInterface({ input, output });
+      return (await prompt.question(message)).trim();
+    };
+    const confirm = async () => {
+      prompt?.close(); prompt = undefined;
+      if (supportsTerminalPrompts(input, output)) return (await selectOnePrompt({ input, output, message: 'Apply team connection plan?', choices: [{ value: 'no', label: 'No, cancel' }, { value: 'yes', label: 'Yes, apply' }], initialValue: 'no' })) === 'yes';
+      return ['y', 'yes'].includes((await question('Apply team connection plan? [y/N] ')).toLowerCase());
+    };
+    let plan;
+    if (command === 'connect') {
+      const get = async (name, message) => flags[name] ?? (interactive ? await question(message) : fail(`Missing --${name}; use team connect --help.`));
+      Object.assign(options, { url: await get('url', 'Team URL (loopback HTTP or HTTPS): '), organization: await get('organization', 'Organization ID: '), project: await get('project', 'Team project ID: '), tokenFile: await get('token-file', 'Private credential file (outside source tree): '), access: flags.access ?? 'read-only' });
+      if (flags.harness) options.harnesses = flags.harness.split(',');
+      else if (supportsTerminalPrompts(input, output)) {
+        prompt?.close(); prompt = undefined;
+        options.harnesses = await selectManyPrompt({ input, output, message: 'Add team MCP to project harnesses', choices: Object.keys(ADAPTERS).map(value => ({ value, label: value })) });
+      } else options.harnesses = (await get('harness', 'Harnesses (claude,opencode,qwen,codex): ')).split(',');
+      prompt?.close(); prompt = undefined;
+      plan = planTeamConnection(options);
+      output.write(`${JSON.stringify({ planned: true, project_root: plan.target, project: plan.connection.project, organization: plan.connection.organization, access: plan.connection.access, files: plan.files.map(row => row.path), personal_memory: 'unchanged' }, null, 2)}\n`);
+    } else output.write(`${JSON.stringify(await disconnectTeamConnection({ ...options, dryRun: true }), null, 2)}\n`);
+    const apply = flags.apply || wizard;
+    if (!apply) return 0;
+    if (!flags.yes && !(interactive && await confirm())) fail('Team connection cancelled. No harness configuration changed.');
+    const result = command === 'connect' ? await applyTeamConnection(plan) : await disconnectTeamConnection(options);
+    output.write(`${JSON.stringify(result, null, 2)}\n`); return 0;
+  } catch (cause) {
+    const messages = { unauthorized: 'Team credential rejected (expired, revoked or unknown). Ask the operator to issue a fresh private credential file.', denied: 'Team project access denied. Check organization/project IDs and explicit reader membership with the operator.', integrity: 'Team service unavailable or response invalid. Check the tunnel/TLS, server version and operator status; no personal-memory fallback is used.', invalid: 'Team request rejected. Verify connection fields and upgrade the team API to a version supporting connection-check (2.26 or newer).' };
+    const message = cause instanceof TeamError ? (messages[cause.code] ?? cause.message)
+      : cause instanceof ConnectionError || cause instanceof TeamClientError ? cause.message
+        : 'Team connection failed safely; no credential or configuration content is logged.';
+    error.write(`${message}\nRecovery: cairn team doctor --client --project-root PATH; see docs/team-onboarding.md.\n`); return cause?.status ?? 1;
+  } finally { prompt?.close(); if (typeof input.pause === 'function') input.pause(); }
+}

package/scripts/test-ci-sharding.sh

@@ -17,6 +17,10 @@ assert.equal(flattened.length, smokeChecks.length);
 assert.equal(new Set(flattened).size, smokeChecks.length);
 assert.deepEqual([...flattened].sort(), smokeChecks.map(({ name }) => name).sort());
 assert.ok(plan.every(({ checks }) => checks.length > 0));
+const teamContracts = ['team', 'team-review', 'team-http', 'team-mcp', 'team-restore', 'team-cli', 'team-onboarding'];
+for (const name of teamContracts) assert.ok(flattened.includes(name), `missing team contract: ${name}`);
+assert.ok(plan.every(({ checks }) => checks.some(({ name }) => teamContracts.includes(name))),
+  'native ACL-heavy team contracts must be distributed across all Windows shards');
 const weights = plan.map(({ weight }) => weight);
 assert.ok(Math.max(...weights) - Math.min(...weights) <= 5,
   `native Windows shards are imbalanced: ${weights.join(", ")}`);

package/scripts/test-codeql-cohort.mjs

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import { validateCodeqlCohort } from './verify-security-baseline.mjs';
+
+const sha = 'a'.repeat(40), other = 'b'.repeat(40);
+const workflows = [
+  { jobs: { scan: { steps: [{ uses: `github/codeql-action/init@${sha}` }, { uses: `github/codeql-action/analyze@${sha}` }] } } },
+  { jobs: { score: { steps: [{ uses: `github/codeql-action/upload-sarif@${sha}` }] } } },
+];
+const dependabot = { version: 2, updates: [{ 'package-ecosystem': 'github-actions', directory: '/', groups: { 'codeql-action': { patterns: ['github/codeql-action/*'] } } }] };
+validateCodeqlCohort(workflows, dependabot);
+assert.throws(() => validateCodeqlCohort([], dependabot), /cohort/);
+assert.throws(() => validateCodeqlCohort(workflows.slice(0, 1), dependabot), /missing upload-sarif/);
+assert.throws(() => validateCodeqlCohort(workflows, {}), /group/);
+const duplicateUpdates = structuredClone(dependabot);
+duplicateUpdates.updates.push(structuredClone(dependabot.updates[0]));
+assert.throws(() => validateCodeqlCohort(workflows, duplicateUpdates), /group/);
+for (let index = 0; index < 3; index++) {
+  const changed = structuredClone(workflows);
+  const target = index < 2 ? changed[0].jobs.scan.steps[index] : changed[1].jobs.score.steps[0];
+  target.uses = target.uses.replace(sha, other);
+  assert.throws(() => validateCodeqlCohort(changed, dependabot), /same.*commit|cohort/);
+}
+const unpinned = structuredClone(workflows);
+unpinned[0].jobs.scan.steps[0].uses = 'github/codeql-action/init@v4';
+assert.throws(() => validateCodeqlCohort(unpinned, dependabot), /pinned|commit/);
+for (const mutate of [
+  value => { delete value.updates[0].groups; },
+  value => { value.updates[0].groups['codeql-action'].patterns = ['github/codeql-action/init']; },
+  value => { value.updates[0].groups['codeql-action']['exclude-patterns'] = ['github/codeql-action/analyze']; },
+  value => { value.updates[0].groups['codeql-action']['update-types'] = ['patch']; },
+]) {
+  const changed = structuredClone(dependabot); mutate(changed);
+  assert.throws(() => validateCodeqlCohort(workflows, changed), /group|cohort/);
+}
+console.log('PASS: CodeQL same-commit cohort and grouped dependency-update mutation controls');

package/scripts/test-completion.sh

@@ -17,6 +17,14 @@ eval_flags='--task-set --adapter --output --repetitions --seed --json --yes --di
 skill_commands='harvest list show review propose evaluate apply rollback'
 for shell in bash zsh fish; do
   grep -q 'capabilities' "$tmp/$shell"
+  grep -q 'team' "$tmp/$shell"
+  grep -q 'credential create set remove issue revoke' "$tmp/$shell"
+  for team_command in connect disconnect init project member credential serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete; do
+    grep -qF "$team_command" "$tmp/$shell"
+  done
+  for team_flag in connection client url token-file harness access apply yes; do
+    grep -q -- "--$team_flag\|-l $team_flag" "$tmp/$shell"
+  done
   grep -q 'list.*status.*enable.*disable.*reset.*logging\|list status enable disable reset logging' "$tmp/$shell"
   grep -q -- '--json\|-l json' "$tmp/$shell"
   for capability_id in $capability_ids; do
@@ -152,6 +160,9 @@ for shell in bash zsh fish; do
   fi
 done
 "$ROOT/bin/cairn" completion powershell >"$tmp/powershell"
+grep -qF "'team'" "$tmp/powershell"
+grep -qF "'credential','create','set','remove','issue','revoke'" "$tmp/powershell"
+grep -qF "'memory-delete'" "$tmp/powershell"
 grep -qF "'protocol'" "$tmp/powershell"
 grep -qF "'--trajectory'" "$tmp/powershell"
 grep -qF "'--codex-jsonl'" "$tmp/powershell"

package/scripts/test-package-install.sh

@@ -60,6 +60,16 @@ env -u CAIRN_NOTE_DISTILLATION cairn notes --help >/dev/null \
   || fail "installed package omitted the notes command"
 
 installed_root="$tmp/prefix/lib/node_modules/@cairnkeep/cli"
+cairn team --help >"$tmp/installed-team-help"
+grep -qF 'experimental token-first team continuity' "$tmp/installed-team-help" || fail "installed package omitted team preview"
+node "$ROOT/scripts/test-team-installed.mjs" "$installed_root" || fail "installed team onboarding failed"
+CAIRN_TEAM=1 cairn team init --organization demo-org --data "$tmp/installed-team" >"$tmp/team-init.json"
+CAIRN_TEAM=1 cairn team project create alpha --data "$tmp/installed-team" >/dev/null
+CAIRN_TEAM=1 cairn team backup --data "$tmp/installed-team" --output "$tmp/team-snapshot.json" >"$tmp/team-backup.json"
+snapshot_digest=$(node -p 'require(process.argv[1]).snapshot_digest' "$tmp/team-backup.json")
+CAIRN_TEAM=1 cairn team restore --input "$tmp/team-snapshot.json" --confirm "$snapshot_digest" --data "$tmp/installed-team-restored" >"$tmp/team-restore.json"
+CAIRN_TEAM=1 cairn team doctor --data "$tmp/installed-team-restored" >"$tmp/team-doctor.json"
+node -e 'if(!require(process.argv[1]).credentials_revoked||!require(process.argv[2]).ok)process.exit(1)' "$tmp/team-restore.json" "$tmp/team-doctor.json" || fail "installed team restore contract failed"
 cairn skill --help >"$tmp/installed-skill-help"
 cmp -s "$tmp/source-skill-help" "$tmp/installed-skill-help" || \
   fail "source and installed skill help differ"