@cairnkeep/cli 2.25.0 → 2.27.0

package/mcp-memory-server/dist/team-store.js

@@ -3,6 +3,10 @@ import { closeSync, constants, existsSync, lstatSync, mkdirSync, mkdtempSync, op
 import { basename, dirname, isAbsolute, join, parse, resolve } from 'node:path';
 import { z } from 'zod';
 import { hardenPrivatePath, privatePathIsSafe } from './platform-security.js';
+import { TeamError } from './team-errors.js';
+export { TeamError } from './team-errors.js';
+import { teamAuditCheckpointSchema, verifyTeamAuditRows, verifyTeamAuditArchive } from './team-audit.js';
+import { teamPageSchema, pageTeamItems } from './team-pages.js';
 const id = z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/);
 const roles = z.array(z.enum(['reader', 'contributor', 'reviewer', 'maintainer', 'auditor'])).max(5);
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
@@ -22,20 +26,21 @@ const adminSchema = z.discriminatedUnion('operation', [
     z.object({ operation: z.literal('credential-revoke'), credential: z.string().uuid() }).strict(),
     z.object({ operation: z.literal('memory-delete'), project: id, key: memoryKey, confirm: digest }).strict(),
 ]);
-const auditEntrySchema = z.object({ schema_version: z.literal(1), sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), subject: id, credential_class: z.enum(['human', 'workload', 'local-os']), operation: z.enum(['project-create', 'member-set', 'credential-revoke', 'credential-issue', 'memory-delete', 'list', 'audit', 'read', 'history', 'search', 'propose', 'proposals', 'proposal-show', 'review', 'snapshot', 'restore']), result: z.enum(['accepted', 'denied', 'conflict', 'invalid']), object_digest: digest.nullable(), previous_digest: digest.nullable(), request_id: z.string().uuid(), at: date }).strict();
-const snapshotSchema = z.object({ schema_version: z.literal(1), organization: id, records: z.array(z.object({ organization: id, project: id.or(z.literal('')), kind: z.enum(['project', 'member', 'credential', 'proposal', 'review', 'revision', 'head']), id: z.string().min(1).max(128), value: z.unknown() }).strict()).max(32768), audit: z.array(z.object({ sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), value: z.string().max(4096), digest }).strict()).max(100000), digest }).strict();
+const legacySnapshotSchema = z.object({ schema_version: z.literal(1), organization: id, records: z.array(z.object({ organization: id, project: id.or(z.literal('')), kind: z.enum(['project', 'member', 'credential', 'proposal', 'review', 'revision', 'head']), id: z.string().min(1).max(128), value: z.unknown() }).strict()).max(32768), audit: z.array(z.object({ sequence: z.number().int().positive(), organization: id, project: id.or(z.literal('')), value: z.string().max(4096), digest }).strict()).max(100000), digest }).strict();
+const snapshotSchema = z.discriminatedUnion('schema_version', [legacySnapshotSchema, legacySnapshotSchema.extend({ schema_version: z.literal(2), audit_checkpoint: teamAuditCheckpointSchema })]);
 const MAX_RECORD_BYTES = 16 * 1024 * 1024;
 const MAX_AUDIT_BYTES = 16 * 1024 * 1024;
 export const TEAM_SNAPSHOT_MAX_BYTES = 64 * 1024 * 1024;
 const requestBase = { organization: id, project: id };
 const requestSchema = z.discriminatedUnion('operation', [
-    z.object({ ...requestBase, operation: z.literal('list') }).strict(),
-    z.object({ ...requestBase, operation: z.literal('audit') }).strict(),
-    z.object({ ...requestBase, operation: z.literal('search'), query: z.string().min(1).max(256) }).strict(),
+    z.object({ ...requestBase, operation: z.literal('connection-check') }).strict(),
+    z.object({ ...requestBase, operation: z.literal('list'), page: teamPageSchema.optional() }).strict(),
+    z.object({ ...requestBase, operation: z.literal('audit'), page: teamPageSchema.optional() }).strict(),
+    z.object({ ...requestBase, operation: z.literal('search'), page: teamPageSchema.optional(), query: z.string().min(1).max(256) }).strict(),
     z.object({ ...requestBase, operation: z.literal('read'), key: memoryKey, revision: digest.optional() }).strict(),
-    z.object({ ...requestBase, operation: z.literal('history'), key: memoryKey }).strict(),
+    z.object({ ...requestBase, operation: z.literal('history'), page: teamPageSchema.optional(), key: memoryKey }).strict(),
     z.object({ ...requestBase, operation: z.literal('propose'), ...proposalInput.shape }).strict(),
-    z.object({ ...requestBase, operation: z.literal('proposals') }).strict(),
+    z.object({ ...requestBase, operation: z.literal('proposals'), page: teamPageSchema.optional() }).strict(),
     z.object({ ...requestBase, operation: z.literal('proposal-show'), proposal_id: z.string().uuid() }).strict(),
     z.object({ ...requestBase, operation: z.literal('review'), proposal_id: z.string().uuid(), confirm: digest, decision: z.enum(['approve', 'reject']) }).strict(),
 ]);
@@ -54,13 +59,6 @@ async function immediate(db, operation) {
         throw error;
     }
 }
-export class TeamError extends Error {
-    code;
-    constructor(code) {
-        super(`Team ${code}.`);
-        this.code = code;
-    }
-}
 export function teamDigest(text) { return createHash('sha256').update(text).digest('hex'); }
 function checkedProposal(input) {
     const value = valid(proposalSchema, input);
@@ -171,18 +169,7 @@ export function verifyTeamSnapshot(input) {
                 }
             }
         }
-        let previous = null;
-        let sequence = 0;
-        let auditBytes = 0;
-        for (const row of snapshot.audit) {
-            const entry = valid(auditEntrySchema, JSON.parse(row.value));
-            auditBytes += Buffer.byteLength(row.value);
-            if (row.organization !== snapshot.organization || row.sequence !== ++sequence || entry.sequence !== sequence || entry.previous_digest !== previous || entry.organization !== row.organization || entry.project !== row.project || row.digest !== teamDigest(row.value))
-                throw new Error();
-            previous = row.digest;
-        }
-        if (auditBytes > MAX_AUDIT_BYTES + 256 * 1024)
-            throw new Error();
+        verifyTeamAuditRows(snapshot.organization, snapshot.audit, snapshot.schema_version === 2 ? snapshot.audit_checkpoint : null);
         return snapshot;
     }
     catch {
@@ -300,7 +287,7 @@ export class TeamStore {
                     return options.organization;
                 });
                 const version = await db.prepare('SELECT value FROM team_meta WHERE id = ?').get('schema_version');
-                if (version?.value !== '1')
+                if (!['1', '2'].includes(String(version?.value)))
                     throw new TeamError('integrity');
                 const store = new TeamStore(agent, org, root);
                 store.harden();
@@ -367,8 +354,9 @@ export class TeamStore {
     async appendAudit(project, subject, credentialClass, operation, result, objectDigest = null) {
         const db = this.agent.getDatabase();
         const last = await db.prepare('SELECT sequence,digest FROM team_audit ORDER BY sequence DESC LIMIT 1').get();
-        const sequence = valid(z.number().int().nonnegative(), last?.sequence ?? 0) + 1;
-        const entry = { schema_version: 1, sequence, organization: this.organization, project, subject, credential_class: credentialClass, operation, result, object_digest: objectDigest, previous_digest: last?.digest ?? null, request_id: randomUUID(), at: new Date().toISOString() };
+        const checkpoint = this.auditCheckpoint();
+        const sequence = valid(z.number().int().nonnegative(), last?.sequence ?? checkpoint?.sequence ?? 0) + 1;
+        const entry = { schema_version: 1, sequence, organization: this.organization, project, subject, credential_class: credentialClass, operation, result, object_digest: objectDigest, previous_digest: last?.digest ?? checkpoint?.digest ?? null, request_id: randomUUID(), at: new Date().toISOString() };
         const value = JSON.stringify(entry);
         const size = db.prepare('SELECT count(*) AS entries,coalesce(sum(length(CAST(value AS BLOB))),0) AS bytes FROM team_audit').get();
         // Reserve bounded space for local revocation/recovery after a client's
@@ -459,9 +447,14 @@ export class TeamStore {
                 const project = valid(projectSchema, await this.get('project', request.project, request.project));
                 let result;
                 let objectDigest = null;
-                if (request.operation === 'audit') {
-                    const rows = await this.agent.getDatabase().prepare('SELECT value,digest FROM team_audit WHERE organization=? AND project=? ORDER BY sequence DESC LIMIT 100').all(this.organization, request.project);
-                    result = rows.map(row => ({ ...JSON.parse(sqlText(row.value)), digest: row.digest }));
+                if (request.operation === 'connection-check') {
+                    result = { schema_version: 1, organization: this.organization, project: request.project,
+                        subject: credential.subject, credential_id: credential.id, credential_class: credential.credential_class,
+                        expires_at: credential.expires_at, roles: member.roles };
+                }
+                else if (request.operation === 'audit') {
+                    const rows = await this.agent.getDatabase().prepare('SELECT value,digest FROM team_audit WHERE organization=? AND project=? ORDER BY sequence DESC' + (request.page ? '' : ' LIMIT 100')).all(this.organization, request.project);
+                    result = (request.page ? rows : rows.slice(0, 100)).map(row => ({ ...JSON.parse(sqlText(row.value)), digest: row.digest }));
                 }
                 else if (request.operation === 'propose') {
                     const { organization: _org, project: _project, operation: _op, ...rawInput } = request;
@@ -525,7 +518,7 @@ export class TeamStore {
                         result = proposal;
                     }
                     else {
-                        result = await Promise.all(visible.slice(0, 100).map(async (proposal) => ({ id: proposal.id, digest: proposal.digest, key: proposal.input.key, subject: proposal.subject, expires_at: proposal.input.expires_at, status: (await this.get('review', request.project, proposal.id)) ? 'reviewed' : 'pending' })));
+                        result = await Promise.all(visible.slice(0, request.page ? undefined : 100).map(async (proposal) => ({ id: proposal.id, digest: proposal.digest, key: proposal.input.key, subject: proposal.subject, expires_at: proposal.input.expires_at, status: (await this.get('review', request.project, proposal.id)) ? 'reviewed' : 'pending' })));
                     }
                 }
                 else if (request.operation === 'read') {
@@ -541,17 +534,29 @@ export class TeamStore {
                     }
                 }
                 else if (request.operation === 'history') {
-                    result = (await this.rows('revision', request.project)).map(row => checkedRevision(row.value)).filter(revision => revision.key === request.key).sort((a, b) => b.created_at.localeCompare(a.created_at) || a.revision_digest.localeCompare(b.revision_digest)).slice(0, 100).map(({ value: _value, ...metadata }) => metadata);
+                    result = (await this.rows('revision', request.project)).map(row => checkedRevision(row.value)).filter(revision => revision.key === request.key).sort((a, b) => b.created_at.localeCompare(a.created_at) || a.revision_digest.localeCompare(b.revision_digest)).slice(0, request.page ? undefined : 100).map(({ value: _value, ...metadata }) => metadata);
                 }
                 else {
                     const heads = await this.rows('head', request.project);
                     const revisions = await Promise.all(heads.map(async (head) => checkedRevision(await this.get('revision', request.project, valid(digest, head.value)))));
                     if (request.operation === 'search') {
                         const needle = request.query.toLowerCase();
-                        result = revisions.filter(revision => `${revision.key}\n${revision.value}`.toLowerCase().includes(needle)).slice(0, 10).map(revision => this.presentRevision(revision));
+                        result = revisions.filter(revision => `${revision.key}\n${revision.value}`.toLowerCase().includes(needle)).slice(0, request.page ? undefined : 10).map(revision => this.presentRevision(revision));
                     }
                     else
-                        result = revisions.slice(0, 100).map(({ value: _value, ...metadata }) => metadata);
+                        result = revisions.slice(0, request.page ? undefined : 100).map(({ value: _value, ...metadata }) => metadata);
+                }
+                if ('page' in request && request.page) {
+                    if (!Array.isArray(result) || (request.operation === 'search' && request.page.size > 10))
+                        throw new TeamError('invalid');
+                    const db = this.agent.getDatabase();
+                    let secret = db.prepare('SELECT value FROM team_meta WHERE id=?').get('pagination-secret')?.value;
+                    if (!secret) {
+                        secret = randomBytes(32).toString('hex');
+                        db.prepare('INSERT INTO team_meta(id,value) VALUES(?,?)').run('pagination-secret', secret);
+                    }
+                    const scope = JSON.stringify([this.organization, request.project, credential.id, credential.subject, credential.credential_class, member.roles, project.policy_revision, request.operation, 'key' in request ? request.key : null, 'query' in request ? request.query : null, request.page.size, this.auditCheckpoint()?.archive_digest ?? null]);
+                    result = pageTeamItems(result, valid(digest, secret), scope, request.page, request.operation === 'audit');
                 }
                 await this.appendAudit(request.project, credential.subject, credential.credential_class, request.operation, 'accepted', objectDigest);
                 return result;
@@ -577,12 +582,68 @@ export class TeamStore {
         const db = this.agent.getDatabase();
         const records = db.prepare('SELECT organization,project,kind,id,value FROM team_records ORDER BY organization,project,kind,id').all().map(row => ({ organization: sqlText(row.organization), project: sqlText(row.project), kind: sqlText(row.kind), id: sqlText(row.id), value: JSON.parse(sqlText(row.value)) }));
         const audit = db.prepare('SELECT sequence,organization,project,value,digest FROM team_audit ORDER BY sequence').all();
-        const body = { schema_version: 1, organization: this.organization, records, audit };
+        const checkpoint = this.auditCheckpoint();
+        const body = checkpoint ? { schema_version: 2, organization: this.organization, records, audit, audit_checkpoint: checkpoint } : { schema_version: 1, organization: this.organization, records, audit };
         return verifyTeamSnapshot({ ...body, digest: teamDigest(JSON.stringify(body)) });
     }
-    async snapshot() {
+    auditCheckpoint() {
+        const db = this.agent.getDatabase();
+        const version = db.prepare('SELECT value FROM team_meta WHERE id=?').get('schema_version')?.value;
+        const row = db.prepare('SELECT value FROM team_meta WHERE id=?').get('audit-checkpoint');
+        if (version === '1' && !row)
+            return null;
+        if (version !== '2' || !row)
+            throw new TeamError('integrity');
+        try {
+            return teamAuditCheckpointSchema.parse(JSON.parse(sqlText(row.value)));
+        }
+        catch {
+            throw new TeamError('integrity');
+        }
+    }
+    capacity() {
+        const db = this.agent.getDatabase();
+        const usage = (table, limit, bytesLimit) => {
+            const row = db.prepare(`SELECT count(*) AS entries,coalesce(sum(length(CAST(value AS BLOB))),0) AS bytes FROM ${table}`).get();
+            const entries = Number(row?.entries), bytes = Number(row?.bytes);
+            return { entries, bytes, limit, bytes_limit: bytesLimit, remaining_entries: Math.max(0, limit - entries), remaining_bytes: Math.max(0, bytesLimit - bytes), status: entries >= limit || bytes >= bytesLimit ? 'exhausted' : entries >= limit * 0.8 || bytes >= bytesLimit * 0.8 ? 'near-limit' : 'available' };
+        };
+        return { records: usage('team_records', 32768, MAX_RECORD_BYTES), audit: usage('team_audit', 99000, MAX_AUDIT_BYTES), local_audit_reserve: { entries: 1000, bytes: 256 * 1024 }, checkpoint: this.auditCheckpoint() };
+    }
+    async exportAudit(input) {
+        const backup = verifyTeamSnapshot(input);
+        return this.transaction(async () => {
+            const current = this.collectSnapshot();
+            if (current.digest !== backup.digest)
+                throw new TeamError('conflict');
+            const body = { schema_version: 1, organization: this.organization, backup_digest: backup.digest, previous_checkpoint: this.auditCheckpoint(), entries: current.audit };
+            return verifyTeamAuditArchive({ ...body, digest: teamDigest(JSON.stringify(body)) });
+        });
+    }
+    async archiveAudit(input, backupInput, confirm, apply = false) {
+        const archive = verifyTeamAuditArchive(input), backup = verifyTeamSnapshot(backupInput);
+        if (archive.digest !== confirm || archive.organization !== this.organization || archive.backup_digest !== backup.digest)
+            throw new TeamError('conflict');
         return this.transaction(async () => {
-            await this.appendAudit('', 'local-operator', 'local-os', 'snapshot', 'accepted');
+            const current = this.collectSnapshot();
+            if (current.digest !== backup.digest || JSON.stringify(current.audit) !== JSON.stringify(archive.entries) || JSON.stringify(this.auditCheckpoint()) !== JSON.stringify(archive.previous_checkpoint))
+                throw new TeamError('conflict');
+            const last = archive.entries[archive.entries.length - 1];
+            if (apply) {
+                const db = this.agent.getDatabase();
+                const checkpoint = { sequence: last.sequence, digest: last.digest, archive_digest: archive.digest, backup_digest: backup.digest, previous_archive_digest: archive.previous_checkpoint?.archive_digest ?? null };
+                db.prepare('INSERT INTO team_meta(id,value) VALUES(?,?) ON CONFLICT(id) DO UPDATE SET value=excluded.value').run('audit-checkpoint', JSON.stringify(checkpoint));
+                db.prepare('UPDATE team_meta SET value=? WHERE id=?').run('2', 'schema_version');
+                db.exec('DELETE FROM team_audit');
+                await this.appendAudit('', 'local-operator', 'local-os', 'audit-archive', 'accepted', archive.digest);
+            }
+            return { applied: apply, events: archive.entries.length, archive_digest: archive.digest, backup_digest: backup.digest, last_sequence: last.sequence };
+        });
+    }
+    async snapshot(options = {}) {
+        return this.transaction(async () => {
+            if (options.audit !== false)
+                await this.appendAudit('', 'local-operator', 'local-os', 'snapshot', 'accepted');
             return this.collectSnapshot();
         });
     }
@@ -593,7 +654,7 @@ export class TeamStore {
             const snapshot = this.collectSnapshot();
             // Report only a count. Never select a restore, expose paths or delete remnants.
             const remnants = readdirSync(dirname(this.root)).filter(name => name.startsWith('.team-restore-') || name === `.${basename(this.root)}.restore.lock`).length;
-            return { ok: true, records: snapshot.records.length, audit_events: snapshot.audit.length, digest: snapshot.digest, temporary_remnants: remnants };
+            return { ok: true, records: snapshot.records.length, audit_events: snapshot.audit.length, digest: snapshot.digest, temporary_remnants: remnants, capacity: this.capacity() };
         });
     }
     static async restore(root, input, confirm) {
@@ -629,6 +690,10 @@ export class TeamStore {
                     const value = row.kind === 'credential' ? { ...valid(credentialSchema, row.value), revoked: true } : row.value;
                     db.prepare('INSERT INTO team_records(organization,project,kind,id,value) VALUES(?,?,?,?,?)').run(row.organization, row.project, row.kind, row.id, JSON.stringify(value));
                 }
+                if (snapshot.schema_version === 2) {
+                    db.prepare('UPDATE team_meta SET value=? WHERE id=?').run('2', 'schema_version');
+                    db.prepare('INSERT INTO team_meta(id,value) VALUES(?,?)').run('audit-checkpoint', JSON.stringify(snapshot.audit_checkpoint));
+                }
                 for (const row of snapshot.audit)
                     db.prepare('INSERT INTO team_audit(sequence,organization,project,value,digest) VALUES(?,?,?,?,?)').run(row.sequence, row.organization, row.project, row.value, row.digest);
                 await store.appendAudit('', 'local-operator', 'local-os', 'restore', 'accepted', snapshot.digest);

package/mcp-memory-server/package.json

@@ -58,14 +58,14 @@
         "check:context-pack-retrieval": "node scripts/smoke-context-pack-retrieval.mjs",
         "check:context-pack-v216-compat": "node scripts/smoke-context-pack-v216-compat.mjs",
         "check:context-usage": "node scripts/smoke-context-usage.mjs",
-        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs",
+        "check:domain-retrieval": "node scripts/smoke-domain-retrieval.mjs && node scripts/smoke-provider-config-flow.mjs",
         "check:anythingllm-workspace": "node scripts/smoke-anythingllm-workspace.mjs && node scripts/smoke-anythingllm-workspace-mcp.mjs",
         "check:retrieval-benchmark": "node scripts/smoke-retrieval-benchmark.mjs && node scripts/run-retrieval-benchmark.mjs --check",
         "benchmark:retrieval": "npm run build && node scripts/run-retrieval-benchmark.mjs",
         "check:work-evidence": "node scripts/smoke-work-evidence.mjs",
         "check:okf": "node scripts/smoke-okf.mjs",
         "check:playbook": "node scripts/smoke-playbook.mjs",
-        "check:security-assurance": "node scripts/smoke-security-assurance.mjs",
+        "check:security-assurance": "node scripts/smoke-security-fixture-order.mjs",
         "check:notes": "npm run build && npm run check:note-signatures && npm run check:note-distillation && npm run check:note-enrichment",
         "test": "npm run test:smoke",
         "test:smoke": "npm run build && node scripts/run-smoke-suite.mjs",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@cairnkeep/cli",
-    "version": "2.25.0",
+    "version": "2.27.0",
     "description": "A durable, harness-agnostic memory + context layer for coding agents and MCP clients.",
     "license": "Apache-2.0",
     "type": "module",

package/scripts/cairn-cli.mjs

@@ -62,7 +62,7 @@ Usage:
   cairn evidence <list|show|delete|prune|doctor>
   cairn playbook <list|status|init|set|enable|disable|reset|check|record|receipts|instructions|doctor>
   cairn security doctor [--project PATH] [--json]
-  cairn team <init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|doctor|backup|restore|memory-delete>
+  cairn team <connect|disconnect|init|project|member|credential|serve|mcp|list|read|search|history|propose|proposals|proposal-show|review|audit|audit-export|audit-verify|audit-archive|doctor|backup|restore|memory-delete>
   cairn memory <path|export|import>
   cairn audit-timer [--on-calendar SPEC] [--para-root PATH] [--render-only DIR]
   cairn uninstall [--dry-run] [--yes] [--purge-memory] [--purge-packs] [PROJECT ...]
@@ -96,6 +96,11 @@ export async function main(argv) {
     return;
   }
 
+  if (command === 'team' && (['connect', 'disconnect'].includes(args[0]) || (args[0] === 'doctor' && args.includes('--client')))) {
+    const { runTeamConnection } = await import('./team-connect.mjs');
+    process.exitCode = await runTeamConnection(args);
+    return;
+  }
   const nodeEntry = NODE_COMMANDS.get(command);
   if (nodeEntry) {
     // Preserve the historical dispatcher contract: child Node resolution comes

package/scripts/completion.sh

@@ -27,7 +27,7 @@ _cairn_complete() {
     sync-omp) COMPREPLY=( $(compgen -W "--apply --live-root" -- "$current") ) ;;
     doctor) COMPREPLY=( $(compgen -W "--repair" -- "$current") ) ;;
     security) COMPREPLY=( $(compgen -W "doctor --project --json" -- "$current") ) ;;
-    team) COMPREPLY=( $(compgen -W "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root" -- "$current") ) ;;
+    team) COMPREPLY=( $(compgen -W "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit audit-export audit-verify audit-archive doctor backup restore memory-delete --backup --previous --page-size --cursor --read-only --organization --data --project --roles --class --expires-at --output --input --confirm --port --key --query --proposal --decision --revision --project-root --connection --client --url --token-file --harness --access --apply --yes" -- "$current") ) ;;
     trajectory) COMPREPLY=( $(compgen -W "list show prune --json --dry-run" -- "$current") ) ;;
     artifact) COMPREPLY=( $(compgen -W "list show delete prune --kind --session --json --dry-run --include-protected" -- "$current") ) ;;
     evidence) COMPREPLY=( $(compgen -W "list show delete prune doctor --status --json --dry-run --repair" -- "$current") ) ;;
@@ -134,7 +134,7 @@ _cairn() {
     sync-omp) _arguments '--apply[apply changes]' '--live-root[omp agent root]:directory:_files -/' ;;
     doctor) _arguments '--repair[repair trajectory metadata and indexes]' ;;
     security) _values 'security command' doctor '--project[project root]:directory:_files -/' '--json[emit JSON]' ;;
-    team) _values 'team command' init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--project-root[team option]:value:' ;;
+    team) _values 'team command' connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit audit-export audit-verify audit-archive doctor backup restore memory-delete '--previous[previous archive segment]:file:_files' '--backup[verified backup file]:file:_files' '--page-size[page bound]:value:' '--cursor[continuation]:value:' '--read-only[observe-only backup]' '--organization[team option]:value:' '--data[team option]:value:' '--project[team option]:value:' '--roles[team option]:value:' '--class[team option]:value:' '--expires-at[team option]:value:' '--output[team option]:value:' '--input[team option]:value:' '--confirm[team option]:value:' '--port[team option]:value:' '--key[team option]:value:' '--query[team option]:value:' '--proposal[team option]:value:' '--decision[team option]:value:' '--revision[team option]:value:' '--apply[apply plan]' '--yes[confirm plan]' '--client[client diagnostics]' '--url[team URL]:value:' '--token-file[private credential file]:file:_files' '--harness[team adapters]:value:' '--access[tool profile]:value:(read-only full)' '--connection[private connection file]:file:_files' '--project-root[team option]:value:' ;;
     trajectory) _values 'trajectory command' list show prune ;;
     artifact)
       case $words[3] in
@@ -222,7 +222,12 @@ complete -c cairn -n "__fish_seen_subcommand_from doctor" -l repair
 complete -c cairn -n "__fish_seen_subcommand_from security" -a "doctor"
 complete -c cairn -n "__fish_seen_subcommand_from security" -l project -r
 complete -c cairn -n "__fish_seen_subcommand_from security" -l json
-complete -c cairn -n "__fish_seen_subcommand_from team" -a "init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete"
+complete -c cairn -n "__fish_seen_subcommand_from team" -a "connect disconnect init project member credential create set remove issue revoke serve mcp list read search history propose proposals proposal-show review audit audit-export audit-verify audit-archive doctor backup restore memory-delete"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l previous -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l backup -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l page-size -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l cursor -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l read-only
 complete -c cairn -n "__fish_seen_subcommand_from team" -l organization -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l data -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l project -r
@@ -239,6 +244,14 @@ complete -c cairn -n "__fish_seen_subcommand_from team" -l proposal -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l decision -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l revision -r
 complete -c cairn -n "__fish_seen_subcommand_from team" -l project-root -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l connection -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l client
+complete -c cairn -n "__fish_seen_subcommand_from team" -l url -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l token-file -r
+complete -c cairn -n "__fish_seen_subcommand_from team" -l harness -r -a "claude opencode qwen codex"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l access -r -a "read-only full"
+complete -c cairn -n "__fish_seen_subcommand_from team" -l apply
+complete -c cairn -n "__fish_seen_subcommand_from team" -l yes
 complete -c cairn -n "__fish_seen_subcommand_from trajectory" -a "list show prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact" -a "list show delete prune"
 complete -c cairn -n "__fish_seen_subcommand_from artifact; and __fish_seen_subcommand_from list" -l kind -r

package/scripts/lib/team-retention.mjs

@@ -11,7 +11,7 @@ function canonical(path) {
 
 /** Uninstall never grants permission to purge the separate team store. */
 export function assertUninstallRetainsTeam(targets, env = process.env, home = homedir()) {
-  const stores = new Set([join(home, '.cairnkeep', 'team'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
+  const stores = new Set([join(home, '.cairnkeep', 'team'), join(home, '.cairnkeep', 'team-clients'), ...(env.CAIRN_TEAM_BASE_DIR ? [env.CAIRN_TEAM_BASE_DIR] : [])]);
   const normalized = path => {
     const value = canonical(path);
     return process.platform === 'win32' ? value.toLowerCase() : value;