@cairnkeep/cli 2.24.0 → 2.26.0

package/scripts/test-phase18-capability-lifecycle.sh

@@ -215,8 +215,8 @@ NODE
   local first_pid=$!
   run_capability "$project" disable security.audit >"$tmp/concurrent-two.out" 2>&1 &
   local second_pid=$!
-  wait "$first_pid" || fail "first concurrent mutation failed"
-  wait "$second_pid" || fail "second concurrent mutation failed"
+  wait "$first_pid" || { cat "$tmp/concurrent-one.out" >&2; fail "first concurrent mutation failed"; }
+  wait "$second_pid" || { cat "$tmp/concurrent-two.out" >&2; fail "second concurrent mutation failed"; }
   node - "$config_path" <<'NODE'
 const fs = require("fs");
 const value = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));

package/scripts/test-security-baseline.sh

@@ -2,3 +2,4 @@
 set -euo pipefail
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 node "$ROOT/scripts/verify-security-baseline.mjs"
+node "$ROOT/scripts/test-codeql-cohort.mjs"

package/scripts/test-team-docs.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$ROOT"
+lesson=docs/learning/lessons/L29-team-continuity.md
+video=docs/learning/video-scripts/V29-team-continuity.md
+for doc in docs/team.md "$lesson" "$video"; do
+  [[ -f "$doc" ]]
+  grep -qi 'preview' "$doc"
+  grep -qi 'independent.*review' "$doc"
+  grep -qi 'pilot' "$doc"
+  if ! grep -qF '2.25.0' "$doc"; then
+    echo "Missing team preview release compatibility: $doc" >&2
+    exit 1
+  fi
+  if grep -qiE 'unreleased|feature-branch preview|released Cairnkeep CLI does not include' "$doc"; then
+    echo 'Released team preview guidance must not claim the feature is absent' >&2
+    exit 1
+  fi
+done
+[[ -f docs/team-pilot.md ]]
+[[ -f docs/team-onboarding.md ]]
+for doc in docs/team.md docs/team-pilot.md "$lesson" "$video"; do
+  grep -qF 'team-onboarding.md' "$doc"
+done
+for heading in 'Choose the right workflow' 'Operator handoff' 'Reader quick-check' 'Contributor and reviewer' 'Deployment readiness'; do
+  grep -qF "$heading" docs/team-onboarding.md
+done
+grep -qF 'not production admission' docs/team-onboarding.md
+grep -qF 'no real-data deployment is authorized' docs/team-onboarding.md
+grep -qF 'team-pilot.md' docs/team.md
+grep -qF 'team-pilot.md' "$lesson"
+grep -qF 'team-pilot.md' "$video"
+grep -qF 'not production admission' docs/team-pilot.md
+grep -qF 'reviewer.token' docs/team-pilot.md
+if grep -qF 'released 2.22.5 baseline' docs/README.md || grep -qF 'Cairnkeep 2.22.5 baseline' "$lesson"; then
+  echo 'Team guidance must not pin an obsolete released baseline' >&2
+  exit 1
+fi
+grep -q '^\*\*Status:\*\* Brief' "$lesson"
+grep -q '^## Acceptance criteria$' "$lesson"
+grep -q '^## Privacy and trust boundary$' "$lesson"
+grep -qF 'L29-team-continuity.md' docs/learning/README.md
+grep -qF 'L29-team-continuity.md' docs/learning/tracks/operator.md
+grep -qF '`cairn team`' docs/learning/CURRICULUM-MAP.md
+for command in connect disconnect init project member credential serve mcp proposals proposal-show propose review search read audit doctor backup restore memory-delete; do
+  node mcp-memory-server/dist/team-cli.js --help | grep -q "cairn team $command"
+done
+node mcp-memory-server/dist/team-cli.js --help | grep -qF 'member remove SUBJECT --project ID'
+for doc in docs/team.md "$lesson" "$video"; do
+  grep -qF 'cairn team member remove' "$doc"
+done
+for guide in operating storage privacy-and-data-flow security-assurance harness-compatibility agents; do
+  grep -qF 'team.md' "docs/$guide.md"
+done
+for control in team team-review team-http team-mcp team-restore team-cli team-onboarding; do
+  grep -qF "smoke-$control.mjs" "$lesson"
+  [[ -f "mcp-memory-server/scripts/smoke-$control.mjs" ]]
+done
+node scripts/test-team-pilot.mjs
+echo 'PASS: team preview reference, source controls, admission boundary, learning and video routing'

package/scripts/test-team-installed.mjs

@@ -0,0 +1,51 @@
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdtempSync, mkdirSync, readFileSync, writeFileSync, rmSync, existsSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+// The caller passes the ACTUAL installed package, never a source-relative dist.
+const root = resolve(process.argv[2]);
+const { openTeamStore } = await import(pathToFileURL(join(root, 'mcp-memory-server/dist/team-store.js')));
+const { createTeamHttpServer } = await import(pathToFileURL(join(root, 'mcp-memory-server/dist/team-http.js')));
+const { hardenPrivatePath } = await import(pathToFileURL(join(root, 'mcp-memory-server/dist/platform-security.js')));
+const exec = promisify(execFile);
+const base = realpathSync(mkdtempSync(join(tmpdir(), 'cairn-installed-team-'))); hardenPrivatePath(base);
+const project = join(base, 'project with spaces'); mkdirSync(project, { mode: 0o700 }); hardenPrivatePath(project);
+const home = join(base, 'home'); mkdirSync(home, { mode: 0o700 }); hardenPrivatePath(home);
+const data = join(base, 'store');
+process.env.CAIRN_TEAM = '1'; process.env.CAIRN_TEAM_HTTP = '1';
+let store, server;
+try {
+  store = await openTeamStore(data, { create: true, organization: 'trial-org' });
+  await store.admin({ operation: 'project-create', project: 'trial-project' });
+  await store.admin({ operation: 'member-set', subject: 'reader', project: 'trial-project', roles: ['reader'] });
+  const credential = await store.issue({ subject: 'reader', credential_class: 'workload', expires_at: new Date(Date.now() + 3600000).toISOString() });
+  const tokenFile = join(base, 'reader.token'); writeFileSync(tokenFile, credential.token, { mode: 0o600 }); hardenPrivatePath(tokenFile);
+  const original = '{"mcpServers":{"cairn-memory":{"command":"personal-unchanged"},"other":{"command":"other-unchanged"}}}\n';
+  const config = join(project, '.mcp.json'); writeFileSync(config, original, { mode: 0o600 });
+  server = createTeamHttpServer(store); await new Promise(r => server.listen(0, '127.0.0.1', r));
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('CAIRN_')));
+  Object.assign(env, { HOME: home, USERPROFILE: home, CAIRN_TEAM: '1' });
+  const run = args => exec(process.execPath, [join(root, 'bin/cairn'), 'team', ...args], { env, cwd: base, timeout: process.platform === 'win32' ? 120000 : 30000, maxBuffer: 32768 });
+  const args = ['connect', '--project-root', project, '--organization', 'trial-org', '--project', 'trial-project', '--url', `http://127.0.0.1:${server.address().port}`, '--token-file', tokenFile, '--harness', 'claude'];
+  assert.match((await run(['connect', '--help'])).stdout, /no-write plan/);
+  const plan = await run(args); assert.equal(JSON.parse(plan.stdout).planned, true);
+  assert.equal(readFileSync(config, 'utf8'), original, 'installed no-apply preserves exact bytes');
+  await run([...args, '--apply', '--yes']);
+  const doctor = await run(['doctor', '--client', '--project-root', project]);
+  assert.equal(JSON.parse(doctor.stdout).ok, true);
+  assert.equal(doctor.stdout.includes(credential.token), false);
+  assert.equal(existsSync(join(home, '.cairnkeep/team')), false, 'client diagnostics open no administrator store');
+  await run(['disconnect', '--project-root', project]);
+  assert.ok(JSON.parse(readFileSync(config, 'utf8')).mcpServers['cairn-team-memory'], 'disconnect plan is read-only');
+  await run(['disconnect', '--project-root', project, '--apply', '--yes']);
+  assert.equal(readFileSync(config, 'utf8'), original, 'installed disconnect restores exact untouched original');
+  assert.equal(readFileSync(tokenFile, 'utf8'), credential.token);
+  console.log('PASS: actual installed team plan/connect/client doctor/disconnect, preserved MCPs and no admin store');
+} finally {
+  if (server) await new Promise(r => { server.close(r); server.closeAllConnections(); });
+  await store?.close(); rmSync(base, { recursive: true, force: true });
+}

package/scripts/test-team-pilot.mjs

@@ -0,0 +1,101 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { execFile, spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { readStableFile } from './lib/stable-file.mjs';
+
+if (process.platform === 'win32') {
+  console.log('SKIP: isolated pilot Bash recipe is Linux/macOS; native CLI controls run separately');
+  process.exit(0);
+}
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const guide = readFileSync(join(root, 'docs/team-pilot.md'), 'utf8');
+const blocks = [...guide.matchAll(/<!-- team-pilot-setup:start -->\s*```sh\n([\s\S]*?)```\s*<!-- team-pilot-setup:end -->/g)];
+assert.equal(blocks.length, 1, 'exactly one maintained executable setup block');
+const onboarding = readFileSync(join(root, 'docs/team-onboarding.md'), 'utf8');
+const readerBlocks = [...onboarding.matchAll(/<!-- team-reader-check:start -->\s*```sh\n([\s\S]*?)```\s*<!-- team-reader-check:end -->/g)];
+assert.equal(readerBlocks.length, 1, 'exactly one maintained reader check');
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+const productionPaths = ['.codex/config.toml', '.claude.json', '.qwen/settings.json',
+  '.qwen/trustedFolders.json', '.config/opencode/opencode.json'];
+const fingerprint = () => productionPaths.map(name => {
+  const path = join(homedir(), name);
+  return existsSync(path) ? hash(readFileSync(path)) : null;
+});
+const before = fingerprint();
+const base = mkdtempSync(join(tmpdir(), 'cairn-team-pilot-doc-'));
+const pilot = join(base, 'new lab');
+const environment = { PATH: process.env.PATH, LANG: 'C.UTF-8',
+  TEAM_CAIRN: join(root, 'bin/cairn'), TEAM_PILOT_DIR: pilot };
+try {
+  const readToken = name => readStableFile(join(pilot, name), {
+    label: 'Pilot credential', maxBytes: 256, privateMode: 0o600,
+  }).bytes;
+  const execute = () => spawnSync('bash', ['-c', blocks[0][1]], {
+    cwd: base, env: environment, encoding: 'utf8', timeout: 120000,
+  });
+  const result = execute();
+  assert.equal(result.error, undefined);
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(statSync(pilot).mode & 0o777, 0o700);
+  const files = ['author.token', 'reader.token', 'reviewer.token'];
+  const hashes = files.map(name => {
+    const bytes = readToken(name);
+    const token = bytes.toString('utf8').trim();
+    assert.equal(result.stdout.includes(token), false, 'credential never appears in setup output');
+    assert.equal(result.stderr.includes(token), false);
+    return hash(bytes);
+  });
+  assert.equal(new Set(hashes).size, 3, 'separate credentials, not a shared token');
+  assert.equal(existsSync(join(pilot, 'author-workspace/reviewer.token')), false);
+  assert.equal(existsSync(join(pilot, 'reader-workspace/reviewer.token')), false);
+  const retry = execute();
+  assert.notEqual(retry.status, 0, 'existing lab must not be reused or overwritten');
+  assert.deepEqual(files.map(name => hash(readToken(name))), hashes);
+  const previousTeam = process.env.CAIRN_TEAM;
+  let store, server;
+  try {
+    process.env.CAIRN_TEAM = '1';
+    const { openTeamStore } = await import('../mcp-memory-server/dist/team-store.js');
+    const { createTeamHttpServer } = await import('../mcp-memory-server/dist/team-http.js');
+    store = await openTeamStore(join(pilot, 'store'));
+    const previousHttp = process.env.CAIRN_TEAM_HTTP;
+    try {
+      process.env.CAIRN_TEAM_HTTP = '1';
+      server = createTeamHttpServer(store);
+    } finally {
+      if (previousHttp === undefined) delete process.env.CAIRN_TEAM_HTTP;
+      else process.env.CAIRN_TEAM_HTTP = previousHttp;
+    }
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    const readerEnvironment = { ...environment, TEAM_PILOT_URL: `http://127.0.0.1:${server.address().port}` };
+    // Asynchronous child execution lets the parent serve the real API request.
+    const runReader = (extra = '', env = readerEnvironment) => promisify(execFile)('bash', ['-c', readerBlocks[0][1] + extra], {
+      cwd: base, env, timeout: 30000, maxBuffer: 16384,
+    });
+    const reader = await runReader();
+    assert.deepEqual(JSON.parse(reader.stdout), [], 'reader lists no unapproved content');
+    for (const name of files) {
+      const token = readToken(name).toString('utf8').trim();
+      assert.equal((reader.stdout + reader.stderr).includes(token), false);
+    }
+    await assert.rejects(runReader('\nteam_pilot_reader proposals\n'), error => error.code === 1 && /denied/.test(error.stderr));
+    const { TEAM_PILOT_URL, ...missingUrl } = readerEnvironment;
+    await assert.rejects(runReader('', missingUrl), error => error.code !== 0 && /TEAM_PILOT_URL/.test(error.stderr));
+    assert.deepEqual(files.map(name => hash(readToken(name))), hashes, 'reader check does not rewrite credentials');
+  } finally {
+    if (server) { server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); }
+    await store?.close();
+    if (previousTeam === undefined) delete process.env.CAIRN_TEAM;
+    else process.env.CAIRN_TEAM = previousTeam;
+  }
+  assert.deepEqual(fingerprint(), before, 'production harness configurations unchanged');
+  console.log('PASS: documented real reader request, server role denial, required inputs and credential preservation');
+  console.log('PASS: documented pilot setup, isolated identities, private credentials, no token output and no overwrite');
+} finally {
+  rmSync(base, { recursive: true, force: true });
+}

package/scripts/uninstall.sh

@@ -91,6 +91,18 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
+# Refuse an overlapping purge before any harness files or registrations change.
+purge_targets=()
+[[ $PURGE_MEMORY -eq 1 ]] && purge_targets+=("$STORE_DIR")
+[[ $PURGE_PACKS -eq 1 ]] && purge_targets+=("$PACK_DIR")
+if [[ $PURGE_MEMORY -eq 1 ]]; then
+  for project in "${PROJECTS[@]}"; do purge_targets+=("$project/.agentfs"); done
+fi
+if [[ ${#purge_targets[@]} -gt 0 ]]; then
+  command -v node >/dev/null 2>&1 || { echo 'Uninstall purge requires Node to verify team-data retention.' >&2; exit 1; }
+  node "$CAIRN_ROOT/scripts/verify-team-retention.mjs" "${purge_targets[@]}" || exit 1
+fi
+
 # ---- backup bundle -----------------------------------------------------------
 # Timestamp comes from the runtime clock on the user's machine.
 BACKUP_DIR="$HOME/.cairnkeep-uninstall-$(date +%Y%m%d-%H%M%S)"
@@ -197,6 +209,7 @@ echo "  Pi live root: $PI_LIVE_ROOT"
 echo "  Kimi root:    $KIMI_LIVE_ROOT"
 echo "  memory store: $STORE_DIR ($([[ $PURGE_MEMORY -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
 echo "  context packs: $PACK_DIR ($([[ $PURGE_PACKS -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
+echo "  team data: retained (separate operator-managed store; no team purge option)"
 [[ ${#PROJECTS[@]} -gt 0 ]] && echo "  projects:     ${PROJECTS[*]}"
 
 if [[ $DRY_RUN -eq 0 && $ASSUME_YES -eq 0 ]]; then

package/scripts/verify-security-baseline.mjs

@@ -33,6 +33,25 @@ function walk(value, visit, path = "workflow") {
     }
 }
 
+export function validateCodeqlCohort(workflows, dependabot) {
+    const references = [];
+    for (const workflow of workflows) walk(workflow, (key, value) => {
+        if (key === "uses" && typeof value === "string" && value.startsWith("github/codeql-action/")) {
+            assert.match(value, /^github\/codeql-action\/[^@\s]+@[a-f0-9]{40}$/, "CodeQL actions must be pinned to a full commit");
+            references.push(value);
+        }
+    });
+    assert.ok(references.length > 0, "CodeQL cohort is missing");
+    assert.equal(new Set(references.map(value => value.split("@")[1])).size, 1, "CodeQL cohort must use the same commit across workflows");
+    for (const action of ["init", "analyze", "upload-sarif"]) {
+        assert.ok(references.some(value => value.startsWith(`github/codeql-action/${action}@`)), `CodeQL cohort is missing ${action}`);
+    }
+    const updates = dependabot?.updates?.filter(update => update["package-ecosystem"] === "github-actions" && update.directory === "/") ?? [];
+    assert.equal(updates.length, 1, "CodeQL cohort requires one root GitHub Actions update group");
+    const group = updates[0].groups?.["codeql-action"];
+    assert.deepEqual(group, { patterns: ["github/codeql-action/*"] }, "CodeQL dependency group must cover the entire cohort without exclusions or update-type restrictions");
+}
+
 function validateWorkflow(name, workflow) {
     assert.ok(workflow && typeof workflow === "object" && !Array.isArray(workflow), `${name} is not a workflow mapping`);
     assert.ok(workflow.permissions && typeof workflow.permissions === "object" && !Array.isArray(workflow.permissions), `${name} must have an explicit workflow permission mapping`);
@@ -123,6 +142,7 @@ for (const [index, [fixture, expected]] of maliciousFixtures.entries()) {
 
 for (const { name, workflow } of sources) validateWorkflow(name, workflow);
 validatePublicationPermissions(publish);
+validateCodeqlCohort(sources.map(source => source.workflow), parse(readFileSync(join(root, ".github", "dependabot.yml"), "utf8")));
 
 const security = sources.find(({ name }) => name === "security.yml")?.text ?? "";
 assert.match(security, /github\/codeql-action\/init@[a-f0-9]{40}/);

package/scripts/verify-team-retention.mjs

@@ -0,0 +1,3 @@
+import { assertUninstallRetainsTeam } from './lib/team-retention.mjs';
+try { assertUninstallRetainsTeam(process.argv.slice(2)); }
+catch (error) { console.error(error.message); process.exitCode = 1; }

package/scripts/windows-platform.mjs

@@ -27,6 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { HARNESS_IDS, harnessProjectAssets } from "./harness-registry.mjs";
 import { reconcilePlaybookInstructions, removePlaybookInstructions } from "./playbook-instructions.mjs";
 import { readStableFile, readStableText, readStableJson } from "./lib/stable-file.mjs";
+import { assertUninstallRetainsTeam } from "./lib/team-retention.mjs";
 
 const BOOTSTRAP_FILES = [
   ["env.example.template", ".ai/env.example"],
@@ -695,6 +696,8 @@ function uninstallWindows(root, args) {
   if (options.has("--purge-memory")) targets.push(resolve(expandHome(process.env.CAIRN_AGENTFS_BASE_DIR || join(homedir(), ".cairnkeep"))));
   if (options.has("--purge-packs")) targets.push(resolve(expandHome(process.env.CAIRN_PACK_BASE_DIR || join(homedir(), ".cairnkeep", "packs"))));
   const candidates = [...new Set(targets)].filter(existsSync);
+  assertUninstallRetainsTeam(candidates);
+  console.log('team data: retained (separate operator-managed store; no team purge option)');
   const existing = candidates.filter((target) => !candidates.some((parent) => parent !== target && target.toLowerCase().startsWith(`${parent.toLowerCase()}${sep}`)));
   if (dryRun) { for (const target of existing) console.log(`would remove: ${target}`); return; }
   const backup = join(homedir(), "cairnkeep-uninstall-backups", new Date().toISOString().replace(/[:.]/g, "-"));
@@ -770,14 +773,15 @@ export function powershellCompletion() {
   const harnesses = HARNESS_IDS.map((id) => `'${id}'`).join(",");
   return `Register-ArgumentCompleter -Native -CommandName cairn -ScriptBlock {
   param($wordToComplete, $commandAst, $cursorPosition)
-  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','security','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
+  $commands = 'bootstrap','setup','memory-server','sync','sync-pi','sync-kimi','doctor','security','team','trajectory','artifact','evidence','playbook','capabilities','mcp-tools','pack','proposals','notes','eval','skill','graph','memory','audit-timer','uninstall','completion','version','help'
   $setup = '--git','--harness','--memory','--policy','--yes','--json','init','existing','none',${harnesses},'local'
   $playbook = 'list','status','init','set','enable','disable','reset','check','record','receipts','instructions','doctor','minimal','balanced','strict','must','should','may','off','start','finish','install','remove','context.recall','context.explore','work.plan','verify.tests','review.repository','review.security','docs.update','learning.capture','--project','--json','--enforce','--complexity','--familiarity','--risk','--public-change','--changed','--change-type','--completed','--skipped','--failed','--actor','--actor-kind','--session','--policy','--decision','--event','--action','--outcome','--reason'
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
   $security = 'doctor','--project','--json'
+  $team = 'connect','disconnect','init','project','member','credential','create','set','remove','issue','revoke','serve','mcp','list','read','search','history','propose','proposals','proposal-show','review','audit','doctor','backup','restore','memory-delete','--organization','--data','--project','--roles','--class','--expires-at','--output','--input','--confirm','--port','--key','--query','--proposal','--decision','--revision','--project-root','--connection','--client','--url','--token-file','--harness','--access','--apply','--yes'
   $evaluation = 'validate','run','ablate','report','prune','delete','protocol','--task-set','--adapter','--output','--repetitions','--seed','--yes','--json','--disable','--experiment','--older-than-days','--dry-run','--trajectory','--codex-jsonl','--capture-authorized'
-  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
+  $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+team(?:\\s|$)') { $team } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {
     [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_)
   }