@cairnkeep/cli 2.26.0 → 2.27.0

package/scripts/test-completion.sh

@@ -19,10 +19,10 @@ for shell in bash zsh fish; do
   grep -q 'capabilities' "$tmp/$shell"
   grep -q 'team' "$tmp/$shell"
   grep -q 'credential create set remove issue revoke' "$tmp/$shell"
-  for team_command in connect disconnect init project member credential serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete; do
+  for team_command in connect disconnect init project member credential serve mcp list read search history propose proposals proposal-show review audit doctor backup restore memory-delete audit-export audit-verify audit-archive; do
     grep -qF "$team_command" "$tmp/$shell"
   done
-  for team_flag in connection client url token-file harness access apply yes; do
+  for team_flag in connection client url token-file harness access apply yes backup previous read-only page-size cursor; do
     grep -q -- "--$team_flag\|-l $team_flag" "$tmp/$shell"
   done
   grep -q 'list.*status.*enable.*disable.*reset.*logging\|list status enable disable reset logging' "$tmp/$shell"
@@ -163,6 +163,9 @@ done
 grep -qF "'team'" "$tmp/powershell"
 grep -qF "'credential','create','set','remove','issue','revoke'" "$tmp/powershell"
 grep -qF "'memory-delete'" "$tmp/powershell"
+for value in audit-export audit-verify audit-archive --backup --previous --read-only --page-size --cursor; do
+  grep -qF -- "'$value'" "$tmp/powershell"
+done
 grep -qF "'protocol'" "$tmp/powershell"
 grep -qF "'--trajectory'" "$tmp/powershell"
 grep -qF "'--codex-jsonl'" "$tmp/powershell"

package/scripts/test-release-cache.mjs

@@ -0,0 +1,16 @@
+import assert from 'node:assert/strict';
+import { npmVerificationCommands } from './verify-published-release.mjs';
+const commands = npmVerificationCommands('/private/disposable/install', '1.2.3');
+assert.equal(commands.length, 2);
+for (const args of commands) {
+  assert.equal(args[args.indexOf('--cache') + 1], '/private/disposable/install/.verification-cache');
+  assert(args.includes('--prefer-online'));
+  assert(args.includes('--prefer-offline=false'));
+  assert(args.includes('--offline=false'));
+  assert.equal(args[args.indexOf('--registry') + 1], 'https://registry.npmjs.org');
+}
+assert.equal(commands[0][0], 'install');
+assert(commands[0].includes('@cairnkeep/cli@1.2.3'));
+assert(commands[0].includes('--ignore-scripts'));
+assert.deepEqual(commands[1].slice(0, 2), ['audit', 'signatures']);
+console.log('PASS: disposable online npm verification retains signature audit and exact version');

package/scripts/test-security-baseline.sh

@@ -3,3 +3,6 @@ set -euo pipefail
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 node "$ROOT/scripts/verify-security-baseline.mjs"
 node "$ROOT/scripts/test-codeql-cohort.mjs"
+node "$ROOT/scripts/test-release-cache.mjs"
+node "$ROOT/scripts/test-smoke-timings.mjs"
+node "$ROOT/scripts/test-team-lab-env.mjs"

package/scripts/test-smoke-timings.mjs

@@ -0,0 +1,19 @@
+import assert from 'node:assert/strict';
+import { runSmokeChecks, smokeChecks } from '../mcp-memory-server/scripts/run-smoke-suite.mjs';
+const output = [], calls = [];
+let tick = 0;
+const result = runSmokeChecks(smokeChecks.slice(0, 3), {
+  spawn: (_command, args) => { calls.push(args); return { status: calls.length === 2 ? 9 : 0 }; },
+  now: () => (tick += 10), write: value => output.push(value),
+});
+assert.equal(result, 9);
+assert.equal(calls.length, 2);
+const timings = output.filter(value => value.startsWith('SMOKE_TIMING ')).map(value => JSON.parse(value.slice(13)));
+assert.equal(timings.length, 2);
+assert.deepEqual(timings.map(row => row.status), [0, 9]);
+assert(timings.every(row => row.duration_ms === 10 && row.schema_version === 1));
+assert.deepEqual(Object.keys(timings[0]).sort(), ['duration_ms','name','schema_version','status']);
+const errors=[];
+assert.throws(()=>runSmokeChecks(smokeChecks.slice(0,1),{spawn:()=>{throw Error('synthetic spawn failure');},write:value=>errors.push(value),now:()=>0}));
+assert.equal(JSON.parse(errors.find(value=>value.startsWith('SMOKE_TIMING ')).slice(13)).status,1);
+console.log('PASS: smoke timings preserve execution order, early failure, status and payload-free output');

package/scripts/test-team-docs.sh

@@ -43,9 +43,24 @@ grep -q '^## Privacy and trust boundary$' "$lesson"
 grep -qF 'L29-team-continuity.md' docs/learning/README.md
 grep -qF 'L29-team-continuity.md' docs/learning/tracks/operator.md
 grep -qF '`cairn team`' docs/learning/CURRICULUM-MAP.md
-for command in connect disconnect init project member credential serve mcp proposals proposal-show propose review search read audit doctor backup restore memory-delete; do
+for command in connect disconnect init project member credential serve mcp proposals proposal-show propose review search read audit doctor backup restore memory-delete audit-export audit-verify audit-archive; do
   node mcp-memory-server/dist/team-cli.js --help | grep -q "cairn team $command"
 done
+for doc in docs/team.md docs/team-onboarding.md "$lesson" "$video"; do
+  grep -qF 'team-operations.md' "$doc"
+done
+for term in '2.27.0' 'audit-verify' 'audit-archive' 'read-only' 'capacity' 'schema' 'synthetic' 'integrity'; do
+  grep -qiF "$term" docs/team-operations.md
+done
+if grep -qiE 'next-minor|source-only|next.minor source feature' docs/team-operations.md; then
+  echo 'Released team operations must not be described as source-only' >&2
+  exit 1
+fi
+if grep -qiE 'no audit archival/compaction command|currently has no pagination' docs/team.md; then
+  echo 'Team reference must describe released paging and archival' >&2
+  exit 1
+fi
+grep -qF 'One successful segment check is not a claim' docs/team-operations.md
 node mcp-memory-server/dist/team-cli.js --help | grep -qF 'member remove SUBJECT --project ID'
 for doc in docs/team.md "$lesson" "$video"; do
   grep -qF 'cairn team member remove' "$doc"

package/scripts/test-team-installed.mjs

@@ -44,6 +44,17 @@ try {
   await run(['disconnect', '--project-root', project, '--apply', '--yes']);
   assert.equal(readFileSync(config, 'utf8'), original, 'installed disconnect restores exact untouched original');
   assert.equal(readFileSync(tokenFile, 'utf8'), credential.token);
+  Object.assign(env,{CAIRN_TEAM_URL:`http://127.0.0.1:${server.address().port}`,CAIRN_TEAM_ORGANIZATION:'trial-org',CAIRN_TEAM_TOKEN_FILE:tokenFile});
+  assert.deepEqual(JSON.parse((await run(['list','--project','trial-project','--page-size','1'])).stdout),{items:[],next_cursor:null});
+  await new Promise(r=>{server.close(r);server.closeAllConnections();});server=undefined;
+  const backup=join(base,'backup.json'),archive=join(base,'audit.json');
+  await run(['backup','--data',data,'--read-only','--output',backup]);
+  const exported=JSON.parse((await run(['audit-export','--data',data,'--backup',backup,'--output',archive])).stdout);
+  const archival=['audit-archive','--data',data,'--backup',backup,'--input',archive,'--confirm',exported.archive_digest];
+  assert.equal(JSON.parse((await run(archival)).stdout).applied,false);
+  assert.equal(JSON.parse((await run([...archival,'--apply'])).stdout).applied,true);
+  assert.equal(JSON.parse((await run(['doctor','--data',data])).stdout).capacity.checkpoint.archive_digest,exported.archive_digest);
+  assert(existsSync(backup) && existsSync(archive));
   console.log('PASS: actual installed team plan/connect/client doctor/disconnect, preserved MCPs and no admin store');
 } finally {
   if (server) await new Promise(r => { server.close(r); server.closeAllConnections(); });

package/scripts/test-team-lab-env.mjs

@@ -0,0 +1,9 @@
+import assert from 'node:assert/strict';
+import {teamLabEnvironment} from '../mcp-memory-server/scripts/team-lab-env.mjs';
+const env=teamLabEnvironment('/private/lab',{CAIRN_TEAM:'1'},{Path:'system-path',SYSTEMROOT:'windows-root',ComSpec:'system-shell',WINDIR:'windows-dir',PATHEXT:'.EXE',PSModulePath:'system-modules',LOCALAPPDATA:'os-local',USERDOMAIN:'os-domain',CAIRN_TEAM_BASE_DIR:'production',CAIRN_LLM_API_KEY:'secret',PROVIDER_API_KEY:'secret',HOME:'real-home'});
+assert.equal(env.PATH,'system-path');assert.equal(env.SystemRoot,'windows-root');assert.equal(env.ComSpec,'system-shell');assert.equal(env.WINDIR,'windows-dir');assert.equal(env.PATHEXT,'.EXE');
+assert.equal(env.PSModulePath,'system-modules');assert.equal(env.LOCALAPPDATA,'os-local');assert.equal(env.USERDOMAIN,'os-domain');
+for(const key of ['HOME','USERPROFILE','TEMP','TMP'])assert.equal(env[key],'/private/lab');
+assert.equal(env.CAIRN_TEAM,'1');
+for(const key of ['CAIRN_TEAM_BASE_DIR','CAIRN_LLM_API_KEY','PROVIDER_API_KEY'])assert.equal(env[key],undefined);
+console.log('PASS: isolated team lab keeps Windows bootstrap variables, not production stores or provider secrets');

package/scripts/test-team-operations.mjs

@@ -0,0 +1,31 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {teamLabEnvironment} from '../mcp-memory-server/scripts/team-lab-env.mjs';
+
+const lab=mkdtempSync(join(tmpdir(),'cairn-team-endurance-contract-'));
+try {
+  const script=resolve('mcp-memory-server/scripts/run-team-continuity-soak.mjs');
+  const out=join(lab,'report.json');
+  const env=teamLabEnvironment(lab);
+  const run=(args,enabled=false)=>spawnSync(process.execPath,[script,...args],{env:{...env,...(enabled?{CAIRN_TEAM_SOAK:'1'}:{})},encoding:'utf8',timeout:60000,maxBuffer:1024*1024});
+  assert.equal(run(['--help']).status,0);
+  assert.notEqual(run(['--out',out]).status,0,'endurance must be explicitly enabled');
+  assert.equal(existsSync(out),false);
+  const result=run(['--cycles','24','--duration-ms','0','--out',out],true);
+  assert.equal(result.status,0,result.stderr);
+  const report=JSON.parse(readFileSync(out,'utf8'));
+  assert.equal(report.result,'PASS');assert.equal(report.cycles,24);
+  assert.equal(report.agent_identities,2);assert.equal(report.api_process_restart_verified,true);
+  assert.equal(report.unclean_restart_verified,true);assert.equal(report.restores,1);assert.equal(report.audit_archives,1);
+  assert(report.credential_rotations>=2);assert(report.revocations_verified>=4);
+  for(const name of ['human_consent_claim','model_quality_claim','native_harness_ui_verified','production_configuration_changed'])assert.equal(report[name],false);
+  assert.equal(report.synthetic_only,true);assert.equal(report.paid_model_calls,0);
+  const bytes=readFileSync(out);
+  assert.notEqual(run(['--cycles','4','--duration-ms','0','--out',out],true).status,0,'reports are exclusive and cannot overwrite evidence');
+  assert.deepEqual(readFileSync(out),bytes);
+  assert.equal(existsSync(join(lab,'.cairnkeep')),false,'synthetic test must not create a real user store');
+  console.log('PASS: opt-in synthetic endurance, two MCP processes, API crash/restart, rotation, archive/restore and exclusive reports');
+} finally {rmSync(lab,{recursive:true,force:true});}

package/scripts/test-team-operations.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$ROOT"
+node scripts/test-team-operations.mjs

package/scripts/verify-published-release.mjs

@@ -65,6 +65,14 @@ async function bytesFrom(url, maxBytes, headers = {}, blobRedirects = false) {
 const parse = bytes => JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
 const digest = bytes => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
 
+export function npmVerificationCommands(prefix, version) {
+  const fresh = ['--cache', join(prefix, '.verification-cache'), '--prefer-online', '--prefer-offline=false', '--offline=false', '--registry', 'https://registry.npmjs.org'];
+  return [
+    ['install', '--prefix', prefix, `@cairnkeep/cli@${version}`, '--ignore-scripts', '--no-audit', '--no-fund', ...fresh],
+    ['audit', 'signatures', '--prefix', prefix, ...fresh],
+  ];
+}
+
 async function main(args) {
   if (args.length === 1 && ["--help", "-h"].includes(args[0])) { console.log(usage); return; }
   const options = optionsFrom(args);
@@ -95,12 +103,13 @@ async function main(args) {
       tarball: async url => bytesFrom(url, 64 * 1024 * 1024),
       verifyNpm: async tarball => {
         const prefix = join(scratch, "npm");
-        run(npm, ["install", "--prefix", prefix, `@cairnkeep/cli@${expected.version}`, "--ignore-scripts", "--no-audit", "--no-fund", "--registry", "https://registry.npmjs.org"]);
+        const [install, audit] = npmVerificationCommands(prefix, expected.version);
+        run(npm, install);
         const lock = parse(readStableFile(join(prefix, "package-lock.json"), { label: "Verification install lock", maxBytes: 8 * 1024 * 1024 }).bytes);
         if (lock.packages?.["node_modules/@cairnkeep/cli"]?.integrity !== `sha512-${createHash("sha512").update(tarball).digest("base64")}`) {
           throw new Error("Release verification failed: audited package/candidate binding.");
         }
-        const audited = run(npm, ["audit", "signatures", "--prefix", prefix, "--registry", "https://registry.npmjs.org"]);
+        const audited = run(npm, audit);
         return /[1-9][0-9]* packages have verified registry signatures/.test(audited)
           && /[1-9][0-9]* packages have verified attestations/.test(audited);
       },

package/scripts/windows-platform.mjs

@@ -779,7 +779,7 @@ export function powershellCompletion() {
   $pack = 'init','lock','validate','install','import-okf','validate-okf','export-okf','list','show','remove','enable','disable','update','skills','approve-skill','revoke-skill','doctor','--repair','--project','--project-id','--json'
   $proposals = 'create','list','show','apply','doctor','--session','--scope','--model','--category','--project','--json'
   $security = 'doctor','--project','--json'
-  $team = 'connect','disconnect','init','project','member','credential','create','set','remove','issue','revoke','serve','mcp','list','read','search','history','propose','proposals','proposal-show','review','audit','doctor','backup','restore','memory-delete','--organization','--data','--project','--roles','--class','--expires-at','--output','--input','--confirm','--port','--key','--query','--proposal','--decision','--revision','--project-root','--connection','--client','--url','--token-file','--harness','--access','--apply','--yes'
+  $team = 'connect','disconnect','init','project','member','credential','create','set','remove','issue','revoke','serve','mcp','list','read','search','history','propose','proposals','proposal-show','review','audit','audit-export','audit-verify','audit-archive','doctor','backup','restore','memory-delete','--backup','--previous','--page-size','--cursor','--read-only','--organization','--data','--project','--roles','--class','--expires-at','--output','--input','--confirm','--port','--key','--query','--proposal','--decision','--revision','--project-root','--connection','--client','--url','--token-file','--harness','--access','--apply','--yes'
   $evaluation = 'validate','run','ablate','report','prune','delete','protocol','--task-set','--adapter','--output','--repetitions','--seed','--yes','--json','--disable','--experiment','--older-than-days','--dry-run','--trajectory','--codex-jsonl','--capture-authorized'
   $candidates = if ($commandAst.ToString() -match '^\\s*cairn\\s+setup(?:\\s|$)') { $setup } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+team(?:\\s|$)') { $team } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+playbook(?:\\s|$)') { $playbook } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+pack(?:\\s|$)') { $pack } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+proposals(?:\\s|$)') { $proposals } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+security(?:\\s|$)') { $security } elseif ($commandAst.ToString() -match '^\\s*cairn\\s+eval(?:\\s|$)') { $evaluation } else { $commands }
   $candidates | Where-Object { $_ -like "$wordToComplete*" } | ForEach-Object {