@cairnkeep/cli 2.25.0 → 2.26.0

package/docs/team-onboarding.md

@@ -0,0 +1,226 @@
+# Team preview: a small, explicit handoff
+
+For Cairnkeep 2.25.0 or newer. This is **not production admission**;
+no real-data deployment is authorized by following this guide.
+
+## Choose the right workflow
+
+For your own context across sessions, folders and harnesses, keep ordinary
+`cairn-memory`. You already have that continuity; you do not need a team store.
+Use the team preview when another person should retrieve **selected, reviewed
+project decisions**. Personal memory stays separate. An overlay upgrade does
+not enroll anyone, start a team service or enable sharing.
+
+| Person | Responsibility | Keep separate |
+|---|---|---|
+| Operator | Private service, memberships, credentials and recovery | Deployment consent |
+| Reader / coding client | Own workload token and explicit project | Human-review token |
+| Contributor | Select/redact and propose exact text with consent | Publication authority |
+| Human reviewer | Inspect actual proposal, approve/reject its digest | Agent workspace |
+
+## Operator handoff
+
+For an explicitly approved **synthetic** rehearsal, follow the
+[isolated pilot setup](team-pilot.md#1-prepare-a-private-lab), then start its
+foreground loopback service. The tested recipe refuses an existing lab and
+preserves personal MCP settings. Do not use production paths.
+
+Give each participant a connection card: verified CLI version/path; loopback
+or authenticated-tunnel URL; organization/project IDs; their individual private
+workload-token file and expiry; disposable workspace; revocation contact.
+For this lab the IDs are `trial-org` and `trial-project`.
+
+Transfer tokens privately, never through chat, Git, arguments or recordings.
+Keep the reviewer token outside agent workspaces. Same-OS-owner processes are
+not mutually isolated; use separate accounts/machines when that is required.
+
+## Reader quick-check
+
+In a separate Bash terminal on Linux/macOS, set the operator's paths and URL:
+
+```sh
+TEAM_CAIRN=/absolute/path/to/verified-checkout/bin/cairn
+TEAM_PILOT_DIR=/absolute/private/new-team-pilot
+TEAM_PILOT_URL=http://127.0.0.1:17955
+```
+
+This block makes one read request. It does not create storage, issue credentials,
+start a service or edit a harness. Expect `[]` before any human publication.
+Stop on connection/authorization failure; never fall back to personal memory.
+
+<!-- team-reader-check:start -->
+```sh
+set -e
+: "${TEAM_CAIRN:?Set the verified CLI path}"
+: "${TEAM_PILOT_DIR:?Set the private lab directory}"
+: "${TEAM_PILOT_URL:?Set the loopback or authenticated-tunnel URL}"
+team_pilot_reader() {
+  env -i PATH="$PATH" CAIRN_TEAM=1 \
+    CAIRN_TEAM_URL="$TEAM_PILOT_URL" CAIRN_TEAM_ORGANIZATION=trial-org \
+    CAIRN_TEAM_TOKEN_FILE="$TEAM_PILOT_DIR/reader.token" \
+    "$TEAM_CAIRN" team "$@" --project trial-project
+}
+team_pilot_reader list
+```
+<!-- team-reader-check:end -->
+
+On native Windows, use equivalent explicit environment settings and
+`cairn team list --project trial-project` from [the reference](team.md).
+
+Add **only an additional**, disposable `cairn-team-memory` stdio entry:
+the verified command, arguments `team mcp --project-root WORKSPACE`, and the
+same four `CAIRN_TEAM*` settings above. For a reader, also set
+`CAIRN_TEAM_MCP_TOOL_PROFILE=read-only`. Merge into the isolated harness profile;
+never replace `cairn-memory` or its entire configuration. See
+[connection semantics](team.md#harness-connection).
+Each tool call names `trial-project`; cwd and display names grant no access.
+The MCP profile restricts tools; server membership independently restricts data.
+
+<a id="guided-connection-next-release--matching-source-checkout"></a>
+
+## Guided connection (2.26 or newer)
+
+The original preview and reader card above work on 2.25.0. The guided commands
+below require both the client **and team API** at 2.26.0 or newer. They do not
+change ordinary `cairn setup`, personal memory or the preview's
+production-admission boundary.
+
+After the operator supplies a **workload reader** credential, opt in explicitly:
+
+```sh
+CAIRN_TEAM=1 cairn team connect --project-root /absolute/project
+```
+
+The wizard asks for URL, organization/project IDs, a private credential-file
+path and harness checkboxes. Its default tool profile is read-only. It displays
+the planned files and asks before applying. Cancellation returns to the shell.
+For automation, supply every choice; without `--apply` this only plans:
+
+```sh
+CAIRN_TEAM=1 cairn team connect --project-root /absolute/project \
+  --url http://127.0.0.1:17955 --organization trial-org --project trial-project \
+  --token-file /absolute/private/reader.token --harness claude,opencode
+# Repeat the same command with --apply --yes to connect.
+CAIRN_TEAM=1 cairn team doctor --client --project-root /absolute/project
+```
+
+Never pass a token value. Keep the credential file outside this project's
+source tree and owner-only (POSIX 0600; native Windows private ACL). URLs must
+be loopback HTTP or HTTPS, without credentials, query, fragment or path prefix.
+Use the operator's encrypted authenticated tunnel, not a public unauthenticated
+listener. The command authenticates reader access before changing a harness.
+It refuses human-class credentials: the operator must issue a workload token
+for the agent, keeping human review credentials in the separate human terminal.
+
+| Harness choice | Project-local file | Additional entry |
+|----------------|--------------------|------------------|
+| `claude` | `.mcp.json` | `mcpServers.cairn-team-memory` |
+| `opencode` | `opencode.json` | `mcp.cairn-team-memory` |
+| `qwen` | `.qwen/settings.json` | `mcpServers.cairn-team-memory` |
+| `codex` | `.codex/config.toml` | marked `mcp_servers.cairn-team-memory` block |
+
+No global harness file is written. Existing unrelated entries are preserved;
+an existing team entry, duplicate JSON keys, JSONC or unsupported inline TOML
+causes refusal rather than replacement. OpenCode `opencode.jsonc` is not edited.
+Pi/OMP/Kimi use the manual bridge recipe; this wizard does not claim automated
+configuration for them. Harness-native trust/enablement prompts still apply.
+Adapter regression uses real SDK stdio calls, not live model/harness UI sessions.
+
+The generated entry invokes the verified Node/CLI paths with a private
+`--connection` file. It pins the server project even if the harness starts in
+another folder; each tool call still names that ID. It does not grant server
+membership. Contributors can explicitly select `--access full` to expose
+proposal creation, still subject to existing profile/capability restrictions
+and server authorization. Human review/admin tools never become available.
+Changing connection settings requires disconnect/reconnect; credentials may be
+rotated in place without a harness restart because the bridge rereads the file.
+
+### Client diagnosis and recovery
+
+Client doctor verifies the active managed entries and private credential file,
+then makes one authenticated `connection-check` request. It reports the current
+subject, credential ID/class/expiry, project and roles, **not** memory text,
+proposals, token values or environment snapshots. The service appends its normal
+value-free audit event. It opens no local administrator store and cannot issue
+credentials, grant membership or repair permissions. Wrong org/project, missing
+reader membership and expired/revoked credentials require the operator; failed
+team access never falls back to personal memory. Check the tunnel/TLS and API
+version on connection failure. Store doctor remains `team doctor --data DIR`.
+
+```sh
+CAIRN_TEAM=1 cairn team disconnect --project-root /absolute/project
+# Inspect the no-write plan, then:
+CAIRN_TEAM=1 cairn team disconnect --project-root /absolute/project --apply --yes
+```
+
+Disconnect removes only unchanged owned entries. It restores exact original
+bytes when nothing else changed; otherwise it preserves unrelated edits and
+refuses an altered team entry. It keeps the token and private backups. Restart
+existing harness sessions; disconnect is **not revocation**. The operator must
+revoke a credential/remove membership for immediate denial in running sessions.
+
+Connection records and original configuration snapshots are private under
+`~/.cairnkeep/team-clients/<canonical-project-path-sha256>/`. Backups may include
+secrets already present in your original MCP config: never commit or publish
+them; use separately encrypted backups as appropriate. No token content is
+copied from its file. Disconnected records are retained in uniquely named
+`.disconnected-*` siblings. Uninstall/purge refuses to delete this retained state.
+
+A per-project exclusive `<project-path-hash>.operation.lock` beside the state
+directory serializes Cairnkeep writers and stays held while state is archived,
+including on native Windows. A failed
+multi-file connect keeps its recovery record in `preparing`; the bridge refuses
+startup until **all** entries are written and activation is committed. Run
+disconnect to undo an interrupted operation after checking for configuration
+drift. An interrupted disconnect is likewise resumable. Do not restore a whole
+backup over newer unrelated edits. If the process crashed holding its lock,
+first verify no connection/disconnection process is running, preserve the state
+directory, then manually remove **only that project's** sibling `.operation.lock` and
+retry disconnect. The tool never guesses that a live lock is stale.
+
+Configuration directories must be owned/trusted and not writable by other users.
+Each configuration is bounded to 1 MiB and the four-file recovery record to
+16 MiB, including both original/new bytes and base64 overhead.
+Links and unsafe files are rejected. Writers use bounded descriptor-first reads,
+exclusive creation and atomic replacement with a final drift check. This is not
+an OS compare-and-swap against a hostile process running as your own identity;
+stop concurrent editor writes before applying. No root-directory or global
+configuration target, automatic permission changes to existing directories,
+automatic enrollment or background synchronization is introduced.
+
+## Contributor and reviewer
+
+Contributors get their **own** workload credential and explicit contributor
+membership. Start with one synthetic decision; select/redact exact text and
+confirm its value digest using the [proposal reference](team.md#harness-connection).
+There is no automatic personal-memory import.
+
+In the separate human terminal, inspect `proposal-show`, then approve/reject
+the actual stored bytes with their proposal digest. Never hand a human token
+to a model. Automated tests of human-class tokens are not human consent.
+Restart a reader in another folder: the approved decision/provenance must match;
+unrelated-project access and revoked credentials must fail. Follow the
+[pilot checks and cleanup](team-pilot.md#4-exercise-the-actual-review-boundary).
+Native trials require separately authorized providers; no model purchase or
+subscription use is authorized by this guide.
+
+## Deployment readiness
+
+Before requesting a real-data pilot, record an owner and evidence for:
+
+- **Purpose:** project IDs, participants, data classes, one continuity use case,
+  explicit exclusions and a stop date.
+- **Consent:** selected-data approval, independent production security review
+  and deployment authorization. Mark absent decisions pending; tests supply none.
+- **Access:** least-privilege roles, individual expiring tokens, separate human
+  review, authenticated tunnel/TLS, private storage and trusted host ownership.
+- **Operation:** named operator, revocation/offboarding contact, storage/audit
+  capacity, encrypted backup retention and a rehearsed fresh-only restore.
+  Restored credentials are revoked; reissue and activation remain explicit.
+- **Acceptance/rollback:** continuity across clients/folders, denied/unapproved
+  content hidden, immediate revocation and unchanged personal config hashes.
+  Stop the separate service and remove only its additional client entry to
+  withdraw access; preserve agreed private evidence.
+
+Until these decisions are explicitly approved, stay in the disposable synthetic
+lab. No automatic production transition follows the rehearsal.

package/docs/team-pilot.md

@@ -11,6 +11,8 @@ The pilot runs beside existing personal memory: a new private store, expiring
 credentials, a separate loopback port and additional isolated client profiles.
 It never imports a personal store or replaces an existing MCP registration.
 Use synthetic project decisions, not employer, personal or customer data.
+For a shorter role-by-role route and reader connection card, see
+[Team onboarding](team-onboarding.md). It does not grant deployment consent.
 
 ## 1. Prepare a private lab
 

package/docs/team.md

@@ -20,6 +20,8 @@ Sharing changes visibility: inspect and redact the selected text first.
 For a trial alongside unchanged personal memory, use the
 [isolated pilot guide](team-pilot.md). It keeps stores, credentials, ports and
 client profiles separate and distinguishes actual human review from rehearsal.
+Start with the [role-based handoff](team-onboarding.md) for operator, coding
+client and human-reviewer tasks, a tested reader check and readiness checklist.
 
 ## Trust boundary
 
@@ -78,6 +80,15 @@ OIDC/SSO and standards-compliant remote MCP HTTP authorization are deferred.
 
 ## Harness connection
 
+Cairnkeep 2.26.0 (both client and team API) adds
+the opt-in [guided connection and recovery workflow](team-onboarding.md#guided-connection-next-release--matching-source-checkout):
+`cairn team connect`, `cairn team doctor --client` and `cairn team disconnect`.
+It adds only a dedicated project-local entry, defaults to read-only, references
+a private token file and pins the server project. No global MCP replacement or
+personal upload occurs. The manual environment recipe below remains supported
+on 2.25.0. The diagnostics API returns only authenticated project/credential
+metadata and records a value-free audit event, not memory text.
+
 Set `CAIRN_TEAM_URL`, `CAIRN_TEAM_ORGANIZATION` and `CAIRN_TEAM_TOKEN_FILE` in the
 local harness environment, alongside `CAIRN_TEAM=1`. Tokens are file-only.
 The URL may be loopback HTTP through a tunnel or HTTPS, without embedded

package/examples/eval/bundled-fake.json

@@ -1 +1 @@
-{"identifier":"cairn-offline-fake-v1","package_version":"2.25.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}
+{"identifier":"cairn-offline-fake-v1","package_version":"2.26.0","schema_version":1,"task_set_digest":"13e95379f35839593047ec34521a65a8fa3ab92bd3993bca9dc8bf5c4a9ff36f"}

package/mcp-memory-server/dist/capability-config.js

@@ -222,7 +222,18 @@ async function acquireLock(lockPath) {
         catch (error) {
             if (error.code !== "EEXIST")
                 throw error;
-            const info = await lstat(lockPath);
+            let info;
+            try {
+                info = await lstat(lockPath);
+            }
+            catch (inspectionError) {
+                // The current writer may release its lock after our mkdir
+                // reports contention but before inspection. Only disappearance
+                // admits another bounded acquisition attempt, never ownership.
+                if (inspectionError.code === 'ENOENT')
+                    continue;
+                throw inspectionError;
+            }
             if (info.isSymbolicLink() || !info.isDirectory()) {
                 throw new Error("Capability configuration lock is unsafe.");
             }

package/mcp-memory-server/dist/team-cli.js

@@ -7,6 +7,7 @@ import { hardenPrivatePath } from './platform-security.js';
 import { openTeamStore, restoreTeamSnapshot, verifyTeamSnapshot, prepareTeamPrivateDirectory, TEAM_SNAPSHOT_MAX_BYTES, TeamError } from './team-store.js';
 import { createTeamHttpServer, teamRequest } from './team-http.js';
 import { createTeamMcpServer, teamClientToken } from './team-mcp.js';
+import { readTeamConnection, connectionToken } from './team-client.js';
 const HELP = `cairn team — experimental token-first team continuity (default off)
 
 CAIRN_TEAM=1 is required. Personal memory is never uploaded.
@@ -18,7 +19,10 @@ CAIRN_TEAM=1 is required. Personal memory is never uploaded.
   cairn team credential issue SUBJECT --class human|workload --expires-at ISO --output FILE [--data DIR]
   cairn team credential revoke ID [--data DIR]
   cairn team serve [--data DIR] [--port PORT]  # requires CAIRN_TEAM_HTTP=1; loopback only
-  cairn team mcp [--project-root PATH]        # local stdio MCP; no review/admin tools
+  cairn team connect [--project-root PATH] [--url URL --organization ID --project ID --token-file FILE --harness LIST] [--access read-only|full] [--apply --yes]
+  cairn team disconnect [--project-root PATH] [--apply --yes]
+  cairn team doctor --client [--project-root PATH]
+  cairn team mcp [--project-root PATH | --connection FILE] # local stdio MCP; no review/admin tools
   cairn team list --project ID
   cairn team proposals --project ID
   cairn team audit --project ID             # scoped, value-free metadata
@@ -41,7 +45,7 @@ deployment-specific approved real-data pilot remain admission gates. See docs/te
 function parse(args) {
     const words = [];
     const flags = {};
-    const known = new Set(['data', 'organization', 'project', 'roles', 'class', 'expires-at', 'output', 'port', 'project-root', 'key', 'revision', 'query', 'proposal', 'input', 'confirm', 'decision']);
+    const known = new Set(['data', 'organization', 'project', 'roles', 'class', 'expires-at', 'output', 'port', 'project-root', 'key', 'revision', 'query', 'proposal', 'input', 'confirm', 'decision', 'connection']);
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
         if (arg.startsWith('--')) {
@@ -81,7 +85,7 @@ async function main(args) {
     const allowed = {
         init: ['data', 'organization'], project: ['data'], member: subcommand === 'remove' ? ['data', 'project'] : ['data', 'project', 'roles'],
         credential: subcommand === 'issue' ? ['data', 'class', 'expires-at', 'output'] : ['data'],
-        serve: ['data', 'port'], mcp: ['project-root'], doctor: ['data'], backup: ['data', 'output'],
+        serve: ['data', 'port'], mcp: ['project-root', 'connection'], doctor: ['data'], backup: ['data', 'output'],
         restore: ['data', 'input', 'confirm'], 'memory-delete': ['data', 'project', 'key', 'confirm'],
         list: ['project'], proposals: ['project'], audit: ['project'], read: ['project', 'key', 'revision'],
         history: ['project', 'key'], search: ['project', 'query'], 'proposal-show': ['project', 'proposal'],
@@ -99,8 +103,14 @@ async function main(args) {
         if (command === 'mcp') {
             if (words.length !== 1)
                 throw new TeamError('invalid');
-            teamClientToken(); // validate private credential before startup
-            const server = await createTeamMcpServer({ url: process.env.CAIRN_TEAM_URL ?? '', organization: process.env.CAIRN_TEAM_ORGANIZATION ?? '', token: () => teamClientToken(), projectRoot: flags['project-root'] });
+            if (flags.connection && flags['project-root'])
+                throw new TeamError('invalid');
+            const connection = flags.connection ? readTeamConnection(resolve(flags.connection)) : undefined;
+            const token = connection ? () => connectionToken(connection) : () => teamClientToken();
+            token(); // validate private credential before startup
+            const server = await createTeamMcpServer(connection
+                ? { url: connection.url, organization: connection.organization, project: connection.project, readOnly: connection.access === 'read-only', token, projectRoot: connection.project_root }
+                : { url: process.env.CAIRN_TEAM_URL ?? '', organization: process.env.CAIRN_TEAM_ORGANIZATION ?? '', token, projectRoot: flags['project-root'] });
             await server.connect(new StdioServerTransport());
             return;
         }

package/mcp-memory-server/dist/team-client.js

@@ -0,0 +1,71 @@
+import { dirname, isAbsolute, join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { readStableJson, readStableFile } from './stable-file.js';
+import { teamClientToken } from './team-mcp.js';
+import { teamRequest, validateTeamUrl } from './team-http.js';
+import { TeamError } from './team-store.js';
+const id = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
+const path = z.string().min(1).max(4096).refine(value => isAbsolute(value) && !/[\x00-\x1f\x7f]/.test(value));
+const schema = z.object({
+    schema_version: z.literal(1), project_root: path,
+    organization: id, project: id, url: z.string().max(4096), token_file: path,
+    access: z.enum(['read-only', 'full']),
+}).strict();
+export class TeamClientError extends Error {
+}
+export function validateTeamConnection(value) {
+    const result = schema.safeParse(value);
+    if (!result.success)
+        throw new TeamClientError('Team connection fields are invalid; check organization/project IDs, absolute paths and access profile.');
+    try {
+        validateTeamUrl(result.data.url);
+    }
+    catch {
+        throw new TeamClientError('Team connection URL must be loopback HTTP or HTTPS without credentials, query, fragment or path prefix.');
+    }
+    return result.data;
+}
+export function readTeamConnection(path) {
+    const { bytes } = readStableFile(path, { label: 'Team connection', maxBytes: 32768, private: true });
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new TeamClientError('Team connection contains invalid UTF-8 or JSON.');
+    }
+    const connection = validateTeamConnection(value);
+    const receipt = readStableJson(join(dirname(path), 'receipt.json'), { label: 'Team connection activation', maxBytes: 16 * 1024 * 1024, private: true });
+    if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)
+        || receipt.schema_version !== 1
+        || receipt.status !== 'connected'
+        || receipt.project_root !== connection.project_root)
+        throw new TeamClientError('Team connection is incomplete or disconnected; inspect recovery state.');
+    if (receipt.connection_digest !== createHash('sha256').update(bytes).digest('hex'))
+        throw new TeamClientError('Team connection activation changed; inspect recovery state.');
+    return connection;
+}
+export function connectionToken(connection) {
+    try {
+        return teamClientToken({ CAIRN_TEAM_TOKEN_FILE: connection.token_file });
+    }
+    catch {
+        throw new TeamClientError('Team credential file is unsafe or unreadable; use an owner-only file issued by the operator.');
+    }
+}
+/** Authenticate and check reader membership without retrieving memory or proposals.
+ * Expiry and roles come from the service, never from guesses about opaque tokens. */
+export async function connectionDoctor(connection) {
+    connection = validateTeamConnection(connection);
+    const token = connectionToken(connection);
+    const result = await teamRequest(connection.url, token, { organization: connection.organization, project: connection.project, operation: 'connection-check' });
+    const metadata = z.object({ schema_version: z.literal(1), organization: id, project: id,
+        subject: id, credential_id: z.string().uuid(), credential_class: z.enum(['human', 'workload']),
+        expires_at: z.iso.datetime(), roles: z.array(z.enum(['reader', 'contributor', 'reviewer', 'maintainer', 'auditor'])).max(5),
+    }).strict().safeParse(result);
+    if (!metadata.success || metadata.data.organization !== connection.organization || metadata.data.project !== connection.project
+        || !metadata.data.roles.includes('reader') || Date.parse(metadata.data.expires_at) <= Date.now())
+        throw new TeamError('integrity');
+    return { ok: true, ...metadata.data, access: connection.access, experimental: true };
+}

package/mcp-memory-server/dist/team-mcp.js

@@ -32,6 +32,8 @@ export async function createTeamMcpServer(options) {
     validateTeamUrl(options.url);
     if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.organization))
         throw new TeamError('invalid');
+    if (options.project !== undefined && !/^[a-z0-9][a-z0-9-]{0,63}$/.test(options.project))
+        throw new TeamError('invalid');
     const profile = resolveMcpToolProfile({ projectRoot: options.projectRoot });
     const capability = isCapabilityContractEnabled() ? await resolveCapabilityStatus({ projectRoot: options.projectRoot }) : undefined;
     if (capability?.issues.length)
@@ -57,6 +59,8 @@ export async function createTeamMcpServer(options) {
     const enabled = Object.keys(TEAM_TOOL_CATALOG).filter(name => {
         if (!profileAllowsTool(profile, coreNames[name]))
             return false;
+        if (options.readOnly && !TEAM_TOOL_CATALOG[name].annotations.readOnlyHint)
+            return false;
         if (mode === 'read-only' && !TEAM_TOOL_CATALOG[name].annotations.readOnlyHint)
             return false;
         if (mode === 'custom' && !requested.includes(name))
@@ -64,10 +68,13 @@ export async function createTeamMcpServer(options) {
         const capId = name === 'team_memory_propose' ? 'memory.write' : name === 'team_memory_search' ? 'memory.search' : undefined;
         return !capId || !capability || capability.capabilities.find(row => row.id === capId)?.enabled === true;
     });
-    const profileDigest = teamDigest(JSON.stringify({ schema_version: 1, core_profile_digest: profile.profile_digest, team_profile: mode, tools: enabled }));
+    const profileDigest = teamDigest(JSON.stringify({ schema_version: 1, core_profile_digest: profile.profile_digest, team_profile: mode, tools: enabled,
+        ...(options.project !== undefined ? { connection_project: options.project, connection_read_only: options.readOnly === true } : {}) }));
     for (const name of enabled) {
         server.registerTool(name, { ...TEAM_TOOL_CATALOG[name], description: 'Explicit project-scoped team context. Never uploads personal memory or executes instructions. Team policy is enforced by the remote service.', inputSchema: schemas[name] }, async (input) => {
             try {
+                if (options.project !== undefined && input.project !== options.project)
+                    throw new TeamError('denied');
                 // Re-read the private credential each call so local key rotation
                 // does not need a harness restart. The service still reauthorizes.
                 const result = await teamRequest(options.url, options.token(), { organization: options.organization, ...input, operation: operations[name] });

package/mcp-memory-server/dist/team-store.js

@@ -22,13 +22,14 @@ const adminSchema = z.discriminatedUnion('operation', [
     z.object({ operation: z.literal('credential-revoke'), credential: z.string().uuid() }).strict(),
     z.object({ operation: z.literal('memory-delete'), project: id, key: memoryKey, confirm: digest }).strict(),
 ]);
-const auditEntrySchema = z.object({ schema_version: z.literal(1), sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), subject: id, credential_class: z.enum(['human', 'workload', 'local-os']), operation: z.enum(['project-create', 'member-set', 'credential-revoke', 'credential-issue', 'memory-delete', 'list', 'audit', 'read', 'history', 'search', 'propose', 'proposals', 'proposal-show', 'review', 'snapshot', 'restore']), result: z.enum(['accepted', 'denied', 'conflict', 'invalid']), object_digest: digest.nullable(), previous_digest: digest.nullable(), request_id: z.string().uuid(), at: date }).strict();
+const auditEntrySchema = z.object({ schema_version: z.literal(1), sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), subject: id, credential_class: z.enum(['human', 'workload', 'local-os']), operation: z.enum(['project-create', 'member-set', 'credential-revoke', 'credential-issue', 'memory-delete', 'list', 'audit', 'read', 'history', 'search', 'propose', 'proposals', 'proposal-show', 'review', 'snapshot', 'restore', 'connection-check']), result: z.enum(['accepted', 'denied', 'conflict', 'invalid']), object_digest: digest.nullable(), previous_digest: digest.nullable(), request_id: z.string().uuid(), at: date }).strict();
 const snapshotSchema = z.object({ schema_version: z.literal(1), organization: id, records: z.array(z.object({ organization: id, project: id.or(z.literal('')), kind: z.enum(['project', 'member', 'credential', 'proposal', 'review', 'revision', 'head']), id: z.string().min(1).max(128), value: z.unknown() }).strict()).max(32768), audit: z.array(z.object({ sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), value: z.string().max(4096), digest }).strict()).max(100000), digest }).strict();
 const MAX_RECORD_BYTES = 16 * 1024 * 1024;
 const MAX_AUDIT_BYTES = 16 * 1024 * 1024;
 export const TEAM_SNAPSHOT_MAX_BYTES = 64 * 1024 * 1024;
 const requestBase = { organization: id, project: id };
 const requestSchema = z.discriminatedUnion('operation', [
+    z.object({ ...requestBase, operation: z.literal('connection-check') }).strict(),
     z.object({ ...requestBase, operation: z.literal('list') }).strict(),
     z.object({ ...requestBase, operation: z.literal('audit') }).strict(),
     z.object({ ...requestBase, operation: z.literal('search'), query: z.string().min(1).max(256) }).strict(),
@@ -459,7 +460,12 @@ export class TeamStore {
                 const project = valid(projectSchema, await this.get('project', request.project, request.project));
                 let result;
                 let objectDigest = null;
-                if (request.operation === 'audit') {
+                if (request.operation === 'connection-check') {
+                    result = { schema_version: 1, organization: this.organization, project: request.project,
+                        subject: credential.subject, credential_id: credential.id, credential_class: credential.credential_class,
+                        expires_at: credential.expires_at, roles: member.roles };
+                }
+                else if (request.operation === 'audit') {
                     const rows = await this.agent.getDatabase().prepare('SELECT value,digest FROM team_audit WHERE organization=? AND project=? ORDER BY sequence DESC LIMIT 100').all(this.organization, request.project);
                     result = rows.map(row => ({ ...JSON.parse(sqlText(row.value)), digest: row.digest }));
                 }

package/mcp-memory-server/package.json

@@ -58,14 +58,14 @@
         "check:context-pack-retrieval": "node scripts/smoke-context-pack-retrieval.mjs",
         "check:context-pack-v216-compat": "node scripts/smoke-context-pack-v216-compat.mjs",
         "check:context-usage": "node scripts/smoke-context-usage.mjs",
-        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs",
+        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs && node scripts/smoke-provider-config-flow.mjs",
         "check:anythingllm-workspace": "node scripts/smoke-anythingllm-workspace.mjs && node scripts/smoke-anythingllm-workspace-mcp.mjs",
         "check:retrieval-benchmark": "node scripts/smoke-retrieval-benchmark.mjs && node scripts/run-retrieval-benchmark.mjs --check",
         "benchmark:retrieval": "npm run build && node scripts/run-retrieval-benchmark.mjs",
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
         "check:okf": "node scripts/smoke-okf.mjs",
         "check:playbook": "node scripts/smoke-playbook.mjs",
-        "check:security-assurance": "node scripts/smoke-security-assurance.mjs",
+        "check:security-assurance": "node scripts/smoke-security-fixture-order.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
         "test:smoke": "npm run build && node scripts/run-smoke-suite.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.25.0",
+    "version": "2.26.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/cairn-cli.mjs

@@ -62,7 +62,7 @@ Usage:
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
   cairn security doctor [--project PATH] [--json]
-  cairn team <init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|doctor|backup|restore|memory-delete>
+  cairn team <connect|disconnect|init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|doctor|backup|restore|memory-delete>
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]
@@ -96,6 +96,11 @@ export async function main(argv) {
     return;
   }
 
+  if (command === 'team' && (['connect', 'disconnect'].includes(args[0]) || (args[0] === 'doctor' && args.includes('--client')))) {
+    const { runTeamConnection } = await import('./team-connect.mjs');
+    process.exitCode = await runTeamConnection(args);
+    return;
+  }
   const nodeEntry = NODE_COMMANDS.get(command);
   if (nodeEntry) {
     // Preserve the historical dispatcher contract: child Node resolution comes

package/scripts/completion.sh

@@ -27,7 +27,7 @@ _cairn_complete() {
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
     security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
-    team) COMPREPLY=( $(compgen -W "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root" -- "$current") ) ;;
+    team) COMPREPLY=( $(compgen -W "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root --connection --client --url --token-file --harness --access --apply --yes" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -134,7 +134,7 @@ _cairn() {
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
     security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
-    team) _values 'team command' init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--project-root[team option]:value:' ;;
+    team) _values 'team command' connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--apply[apply plan]' '--yes[confirm plan]' '--client[client diagnostics]' '--url[team URL]:value:' '--token-file[private credential file]:file:_files' '--harness[team adapters]:value:' '--access[tool profile]:value:(read-only full)' '--connection[private connection file]:file:_files' '--project-root[team option]:value:' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -222,7 +222,7 @@ complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
 complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
 complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from security" -l json
-complete -c cairn -n "__fish_seen_subcommand_from team" -a "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete"
+complete -c cairn -n "__fish_seen_subcommand_from team" -a "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete"
 complete -c cairn -n "__fish_seen_subcommand_from team" -l organization -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l data -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l project -r
@@ -239,6 +239,14 @@ complete -c cairn -n "__fish_seen_subcommand_from team" -l proposal -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l decision -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l revision -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l project-root -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l connection -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l client
+complete -c cairn -n "__fish_seen_subcommand_from team" -l url -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l token-file -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l harness -r -a "claude opencode qwen codex"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l access -r -a "read-only full"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l apply
+complete -c cairn -n "__fish_seen_subcommand_from team" -l yes
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/lib/team-retention.mjs

@@ -11,7 +11,7 @@ function canonical(path) {
 
 /** Uninstall never grants permission to purge the separate team store. */
 export function assertUninstallRetainsTeam(targets, env = process.env, home = homedir()) {
-  const stores = new Set([join(home, '.cairnkeep', 'team'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
+  const stores = new Set([join(home, '.cairnkeep', 'team'), join(home, '.cairnkeep', 'team-clients'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
   const normalized = path => {
     const value = canonical(path);
     return process.platform === 'win32' ? value.toLowerCase() : value;