wayfind 2.0.44 → 2.0.46

package/BOOTSTRAP_PROMPT.md

@@ -27,6 +27,9 @@ Once both steps complete:
 6. Ask me if I want to set up team context (/wayfind:init-team) for shared journals,
    digests, and product state
 7. Let me know that anonymous usage telemetry is enabled by default (set TEAM_CONTEXT_TELEMETRY=false to opt out)
+8. If I'm joining an existing team, check if there's a container_endpoint in my
+   context.json — if so, my MCP server will automatically proxy semantic search
+   to the team's container. No extra setup needed.
 ```
 
 ---
@@ -36,10 +39,12 @@ Once both steps complete:
 The CLI install creates:
 - `~/.claude/memory/` and `~/.claude/memory/journal/`
 - `~/.claude/global-state.md` (your persistent index)
+- `~/.claude/team-context/context.json` (team registry for multi-team support)
 
 The plugin provides:
 - SessionStart and Stop hooks (context loading, decision extraction)
 - Slash commands: `/wayfind:init-memory`, `/wayfind:init-team`, `/wayfind:journal`, `/wayfind:doctor`, `/wayfind:standup`
+- MCP server (`wayfind-mcp`) — registered automatically, gives any MCP-compatible AI tool access to your team's context
 
 After the paste, Claude will walk you through filling in your preferences. From
 then on, every session in every repo will start with full context of where you
@@ -100,6 +105,27 @@ Claude will create `.claude/team-state.md` (shared) and `.claude/personal-state.
 
 ---
 
+## Container deployment (for teams)
+
+One team member (the team owner) runs a Docker container that provides:
+- Slack bot, automated digests, signal connectors
+- Semantic search API for the whole team's content
+- API key auto-rotation (daily, committed to team-context repo)
+
+Other team members don't need Docker — their local MCP server automatically
+proxies search queries to the container via the shared API key.
+
+```bash
+wayfind deploy --team <teamId>           # Scaffold config
+# Edit deploy/.env with your Anthropic key
+cd deploy && docker compose up -d        # Start container
+wayfind deploy set-endpoint http://your-hostname:3141 --team <teamId>  # Set endpoint for team
+```
+
+Team members pull the team-context repo to get the API key and endpoint config.
+
+---
+
 ## For Cursor users
 
 ```
@@ -117,11 +143,11 @@ https://github.com/usewayfind/wayfind
 
 To install a specific version:
 ```
-npm install -g wayfind@2.0.15
+npm install -g wayfind@2.0.45
 wayfind init
 ```
 
 Or via the shell installer with a pinned version:
 ```
-WAYFIND_VERSION=v2.0.15 bash <(curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh)
+WAYFIND_VERSION=v2.0.45 bash <(curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh)
 ```

package/README.md

@@ -145,12 +145,26 @@ wayfind pull --all        # All configured channels
 | `wayfind journal sync` | Sync journals to team repo |
 | `wayfind onboard <repo>` | Generate onboarding context pack |
 | `wayfind deploy init` | Scaffold Docker deployment |
+| `wayfind deploy --team <id>` | Scaffold per-team Docker deployment |
+| `wayfind deploy set-endpoint <url>` | Set container endpoint for team search |
+| `wayfind deploy list` | List running team containers |
+| `wayfind deploy status` | Check container health |
 | `wayfind migrate-to-plugin` | Remove old hooks (after plugin install) |
 
 Run `wayfind help` for the full list.
 
 ---
 
+## MCP Server
+
+Wayfind includes an MCP server (`wayfind-mcp`) that exposes team context to any MCP-compatible AI tool.
+
+**Tools:** `search_context`, `get_entry`, `list_recent`, `get_signals`, `get_team_status`, `get_personas`, `record_feedback`, `add_context`
+
+Auto-registered during `wayfind init`. When a team container is running, the local MCP server proxies semantic search to it automatically — no config needed beyond the team-context repo.
+
+---
+
 ## Environment Variables
 
 ### For digests and bot
@@ -171,6 +185,8 @@ Run `wayfind help` for the full list.
 | `TEAM_CONTEXT_DIGEST_SCHEDULE` | Cron schedule (default: `0 8 * * 1` — Monday 8am) |
 | `TEAM_CONTEXT_EXCLUDE_REPOS` | Repos to exclude from digests |
 | `TEAM_CONTEXT_TELEMETRY` | `true` for anonymous usage telemetry |
+| `TEAM_CONTEXT_NO_SLACK` | Run container without Slack integration (set to `1`) |
+| `TEAM_CONTEXT_KEY_ROTATE_SCHEDULE` | API key rotation cron (default: `0 2 * * *`) |
 
 ---
 
@@ -182,6 +198,7 @@ Run `wayfind help` for the full list.
 | Claude Code | Full support (npm) | `wayfind init` |
 | Cursor | Session protocol | `wayfind init-cursor` |
 | Generic | Manual | See `specializations/generic/` |
+| Any MCP client | Full support (MCP) | `wayfind init` auto-registers |
 
 ---
 
@@ -198,6 +215,8 @@ Everything that runs on your machine is open source (Apache 2.0).
 | Digest generation (your API key) | |
 | Slack bot (self-hosted) | |
 | Multi-team support | |
+| MCP server (local + container proxy) | |
+| Per-team content store isolation | |
 
 See [LICENSING.md](LICENSING.md) for details.
 

package/bin/mcp-server.js

@@ -30,8 +30,199 @@ const path = require('path');
 const fs = require('fs');
 const contentStore = require('./content-store.js');
 
+const http = require('http');
+
 const pkg = require('../package.json');
 
+// ── Container proxy ─────────────────────────────────────────────────────────
+
+const HOME = process.env.HOME || process.env.USERPROFILE;
+const WAYFIND_DIR = HOME ? path.join(HOME, '.claude', 'team-context') : null;
+
+/**
+ * Read context.json to find the active team's container_endpoint.
+ */
+function getContainerEndpoint() {
+  if (!WAYFIND_DIR) return null;
+  const configPath = path.join(WAYFIND_DIR, 'context.json');
+  try {
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    // Resolve active team: repo binding → default
+    const teamId = getActiveTeamId(config);
+    if (!teamId || !config.teams || !config.teams[teamId]) return null;
+    return config.teams[teamId].container_endpoint || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Resolve active team ID from context.json (simplified — mirrors team-context.js logic).
+ */
+function getActiveTeamId(config) {
+  // Check repo-level binding first
+  try {
+    const bindingFile = path.join(process.cwd(), '.claude', 'wayfind.json');
+    if (fs.existsSync(bindingFile)) {
+      const binding = JSON.parse(fs.readFileSync(bindingFile, 'utf8'));
+      if (binding.team_id) return binding.team_id;
+    }
+  } catch (_) {}
+  return config.default || null;
+}
+
+/**
+ * Read the shared API key from the team-context repo.
+ */
+function readApiKey() {
+  if (!WAYFIND_DIR) return null;
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(WAYFIND_DIR, 'context.json'), 'utf8'));
+    const teamId = getActiveTeamId(config);
+    if (!teamId || !config.teams || !config.teams[teamId]) return null;
+    const teamPath = config.teams[teamId].path;
+    if (!teamPath) return null;
+    const keyFile = path.join(teamPath, '.wayfind-api-key');
+    return fs.readFileSync(keyFile, 'utf8').trim();
+  } catch (_) {
+    return null;
+  }
+}
+
+// Cache for API key (re-read from disk on 401)
+let cachedApiKey = null;
+
+/**
+ * HTTP POST to the container's search API.
+ * Returns parsed JSON or null on failure.
+ */
+function containerPost(endpoint, apiKey, body) {
+  return new Promise((resolve) => {
+    try {
+      const url = new URL(endpoint);
+      const postData = JSON.stringify(body);
+      const req = http.request({
+        hostname: url.hostname,
+        port: url.port || 80,
+        path: url.pathname,
+        method: 'POST',
+        timeout: 10000,
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(postData),
+          'Authorization': `Bearer ${apiKey}`,
+        },
+      }, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          resolve({ status: res.statusCode, body: data });
+        });
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      req.write(postData);
+      req.end();
+    } catch (_) {
+      resolve(null);
+    }
+  });
+}
+
+/**
+ * HTTP GET from the container's entry API.
+ */
+function containerGet(endpoint, apiKey) {
+  return new Promise((resolve) => {
+    try {
+      const url = new URL(endpoint);
+      const req = http.request({
+        hostname: url.hostname,
+        port: url.port || 80,
+        path: url.pathname + url.search,
+        method: 'GET',
+        timeout: 10000,
+        headers: {
+          'Authorization': `Bearer ${apiKey}`,
+        },
+      }, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          resolve({ status: res.statusCode, body: data });
+        });
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      req.end();
+    } catch (_) {
+      resolve(null);
+    }
+  });
+}
+
+/**
+ * Try to proxy a search request to the container.
+ * On 401, re-reads the API key from disk and retries once.
+ * Returns parsed result or null if container unreachable/unavailable.
+ */
+async function proxySearch(body) {
+  const endpoint = getContainerEndpoint();
+  if (!endpoint) return null;
+
+  if (!cachedApiKey) cachedApiKey = readApiKey();
+  if (!cachedApiKey) return null;
+
+  const searchUrl = `${endpoint}/api/search`;
+  let result = await containerPost(searchUrl, cachedApiKey, body);
+
+  // On 401, re-read key (may have been rotated) and retry once
+  if (result && result.status === 401) {
+    process.stderr.write('Container returned 401 — re-reading API key...\n');
+    cachedApiKey = readApiKey();
+    if (!cachedApiKey) return null;
+    result = await containerPost(searchUrl, cachedApiKey, body);
+  }
+
+  if (!result || result.status !== 200) return null;
+
+  try {
+    return JSON.parse(result.body);
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Try to proxy an entry retrieval to the container.
+ * Same 401-retry logic as proxySearch.
+ */
+async function proxyGetEntry(id) {
+  const endpoint = getContainerEndpoint();
+  if (!endpoint) return null;
+
+  if (!cachedApiKey) cachedApiKey = readApiKey();
+  if (!cachedApiKey) return null;
+
+  const entryUrl = `${endpoint}/api/entry/${encodeURIComponent(id)}`;
+  let result = await containerGet(entryUrl, cachedApiKey);
+
+  if (result && result.status === 401) {
+    process.stderr.write('Container returned 401 — re-reading API key...\n');
+    cachedApiKey = readApiKey();
+    if (!cachedApiKey) return null;
+    result = await containerGet(entryUrl, cachedApiKey);
+  }
+
+  if (!result || result.status !== 200) return null;
+
+  try {
+    return JSON.parse(result.body);
+  } catch (_) {
+    return null;
+  }
+}
+
 // ── Tool definitions ─────────────────────────────────────────────────────────
 
 const TOOLS = [
@@ -137,8 +328,18 @@ const TOOLS = [
 
 async function handleSearchContext(args) {
   const { query, limit = 10, repo, since, mode } = args;
-  const opts = { limit, repo, since };
 
+  // Try container first for semantic search (has embeddings for full team)
+  if (mode !== 'text') {
+    const containerResult = await proxySearch({ query, limit, repo, since, mode });
+    if (containerResult && containerResult.found > 0) {
+      containerResult.source = 'container';
+      return containerResult;
+    }
+  }
+
+  // Fall back to local search
+  const opts = { limit, repo, since };
   let results;
   if (mode === 'text') {
     results = contentStore.searchText(query, opts);
@@ -147,11 +348,12 @@ async function handleSearchContext(args) {
   }
 
   if (!results || results.length === 0) {
-    return { found: 0, results: [], hint: 'No matches. Try a broader query or check wayfind reindex.' };
+    return { found: 0, results: [], source: 'local', hint: 'No matches. Try a broader query or check wayfind reindex.' };
   }
 
   return {
     found: results.length,
+    source: 'local',
     results: results.map(r => ({
       id: r.id,
       score: r.score ? Math.round(r.score * 1000) / 1000 : null,
@@ -165,29 +367,34 @@ async function handleSearchContext(args) {
   };
 }
 
-function handleGetEntry(args) {
+async function handleGetEntry(args) {
   const { id } = args;
   const storePath = contentStore.resolveStorePath();
   const journalDir = contentStore.DEFAULT_JOURNAL_DIR;
 
-  // Get entry metadata
+  // Try local first (fastest)
   const index = contentStore.getBackend(storePath).loadIndex();
-  if (!index || !index.entries || !index.entries[id]) {
-    return { error: `Entry not found: ${id}` };
+  if (index && index.entries && index.entries[id]) {
+    const entry = index.entries[id];
+    const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+    return {
+      id,
+      date: entry.date,
+      repo: entry.repo,
+      title: entry.title,
+      source: entry.source,
+      tags: entry.tags || [],
+      content: fullContent || entry.summary || null,
+    };
   }
 
-  const entry = index.entries[id];
-  const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+  // Not found locally — try container (may have entries from other team members)
+  const containerResult = await proxyGetEntry(id);
+  if (containerResult && !containerResult.error) {
+    return containerResult;
+  }
 
-  return {
-    id,
-    date: entry.date,
-    repo: entry.repo,
-    title: entry.title,
-    source: entry.source,
-    tags: entry.tags || [],
-    content: fullContent || entry.summary || null,
-  };
+  return { error: `Entry not found: ${id}` };
 }
 
 function handleListRecent(args) {
@@ -382,7 +589,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
   let result;
   switch (name) {
     case 'search_context':   result = await handleSearchContext(args); break;
-    case 'get_entry':        result = handleGetEntry(args); break;
+    case 'get_entry':        result = await handleGetEntry(args); break;
     case 'list_recent':      result = handleListRecent(args); break;
     case 'get_signals':      result = handleGetSignals(args); break;
     case 'get_team_status':  result = handleGetTeamStatus(args); break;

package/bin/team-context.js

@@ -2103,7 +2103,7 @@ function commitAndPushTeamJournals(teamContextPath, copied) {
   stampMemberVersion(teamContextPath);
 
   try {
-    const gitAdd = spawnSync('git', ['add', 'journals/', 'members/'], { cwd: teamContextPath, stdio: 'pipe' });
+    const gitAdd = spawnSync('git', ['add', 'journals/', 'members/', '.wayfind-api-key'], { cwd: teamContextPath, stdio: 'pipe' });
     if (gitAdd.status !== 0) {
       console.error(`git add failed: ${(gitAdd.stderr || '').toString().trim()}`);
       return;
@@ -3804,25 +3804,51 @@ async function runDeploy(args) {
     case 'status':
       deployStatus();
       break;
+    case 'set-endpoint': {
+      const endpointTeamId = teamId || (readContextConfig().default);
+      const endpointUrl = filteredArgs[1];
+      if (!endpointTeamId || !endpointUrl) {
+        console.error('Usage: wayfind deploy set-endpoint <url> --team <id>');
+        console.error('Example: wayfind deploy set-endpoint http://gregs-laptop:3141 --team abc123');
+        process.exit(1);
+      }
+      const cfg = readContextConfig();
+      if (!cfg.teams || !cfg.teams[endpointTeamId]) {
+        console.error(`Team "${endpointTeamId}" not found in context.json`);
+        process.exit(1);
+      }
+      cfg.teams[endpointTeamId].container_endpoint = endpointUrl;
+      writeContextConfig(cfg);
+      console.log(`Set container_endpoint for team "${endpointTeamId}" to ${endpointUrl}`);
+      break;
+    }
     default:
       console.error(`Unknown deploy subcommand: ${sub}`);
-      console.error('Available: init [--team <id>], list, status');
+      console.error('Available: init [--team <id>], list, status, set-endpoint');
       process.exit(1);
   }
 }
 
 /**
- * Scaffold a per-team container config at ~/.claude/team-context/teams/<teamId>/deploy/
+ * Scaffold a per-team container config in the team's registered repo (deploy/ subdir).
+ * Falls back to ~/.claude/team-context/teams/<teamId>/deploy/ if no repo is registered.
  */
 function deployTeamInit(teamId, { port } = {}) {
-  const teamsBaseDir = HOME ? path.join(HOME, '.claude', 'team-context', 'teams') : null;
-  if (!teamsBaseDir) {
+  if (!HOME) {
     console.error('Cannot resolve home directory.');
     process.exit(1);
   }
 
-  const deployDir = path.join(teamsBaseDir, teamId, 'deploy');
-  const storeDir = path.join(teamsBaseDir, teamId, 'content-store');
+  // Resolve deploy dir: team repo path first, fallback to store-adjacent
+  const config = readContextConfig();
+  const teamEntry = config.teams && config.teams[teamId];
+  const teamContextPath = teamEntry ? teamEntry.path : null;
+  const deployDir = teamContextPath
+    ? path.join(teamContextPath, 'deploy')
+    : path.join(HOME, '.claude', 'team-context', 'teams', teamId, 'deploy');
+
+  // Ensure the per-team store dir exists
+  const storeDir = path.join(HOME, '.claude', 'team-context', 'teams', teamId, 'content-store');
 
   // Check for duplicate running container
   const psResult = spawnSync('docker', ['ps', '--filter', `label=com.wayfind.team=${teamId}`, '--format', '{{.Names}}'], { stdio: 'pipe' });
@@ -3838,22 +3864,42 @@ function deployTeamInit(teamId, { port } = {}) {
   console.log(`Scaffolding deploy config for team: ${teamId}`);
   console.log(`Deploy dir: ${deployDir}`);
 
-  // Resolve team-context repo path for volume mount
-  const config = readContextConfig();
-  const teamEntry = config.teams && config.teams[teamId];
-  const teamContextPath = teamEntry ? teamEntry.path : null;
-
-  // Assign port (default 3141; if taken, user should pass --port)
-  const assignedPort = port || 3141;
+  // Auto-detect port: find all wayfind containers, pick next available
   const containerName = `wayfind-${teamId}`;
+  let assignedPort = port;
+  if (!assignedPort) {
+    const usedPorts = new Set();
+    // Check labeled containers
+    const portsResult = spawnSync('docker', [
+      'ps', '--filter', 'label=com.wayfind.team',
+      '--format', '{{.Ports}}',
+    ], { stdio: 'pipe' });
+    // Also check legacy container named "wayfind"
+    const legacyPortsResult = spawnSync('docker', [
+      'ps', '--filter', 'name=^wayfind',
+      '--format', '{{.Ports}}',
+    ], { stdio: 'pipe' });
+    const allPortOutput = [
+      (portsResult.stdout || '').toString(),
+      (legacyPortsResult.stdout || '').toString(),
+    ].join('\n');
+    // Extract host ports from "0.0.0.0:3141->3141/tcp" patterns
+    for (const match of allPortOutput.matchAll(/:(\d+)->/g)) {
+      usedPorts.add(parseInt(match[1], 10));
+    }
+    assignedPort = 3141;
+    while (usedPorts.has(assignedPort)) assignedPort++;
+    if (assignedPort !== 3141) {
+      console.log(`Port 3141 in use — assigning port ${assignedPort}`);
+    }
+  }
 
   // Build docker-compose.yml content with per-team overrides
   const templatePath = path.join(DEPLOY_TEMPLATES_DIR, 'docker-compose.yml');
   let composeContent = fs.readFileSync(templatePath, 'utf8');
   composeContent = composeContent
     .replace(/container_name: wayfind/, `container_name: ${containerName}`)
-    .replace(/- "3141:3141"/, `- "${assignedPort}:3141"`)
-    .replace(/(TEAM_CONTEXT_TENANT_ID:.*$)/m, `TEAM_CONTEXT_TENANT_ID: \${TEAM_CONTEXT_TENANT_ID:-${teamId}}`);
+    .replace(/- "3141:3141"/, `- "${assignedPort}:3141"`);
 
   // Inject Docker label for discovery
   composeContent = composeContent.replace(
@@ -3869,42 +3915,72 @@ function deployTeamInit(teamId, { port } = {}) {
     console.log('  docker-compose.yml — already exists, skipping');
   }
 
-  // .env.example
+  // .env.example — full reference with all options
   const envExampleSrc = path.join(DEPLOY_TEMPLATES_DIR, '.env.example');
   const envExampleDst = path.join(deployDir, '.env.example');
   if (!fs.existsSync(envExampleDst) && fs.existsSync(envExampleSrc)) {
-    let envContent = fs.readFileSync(envExampleSrc, 'utf8');
-    if (teamContextPath) {
-      envContent += `\nTEAM_CONTEXT_TEAM_CONTEXT_PATH=${teamContextPath}\n`;
-    }
-    fs.writeFileSync(envExampleDst, envContent, 'utf8');
-    console.log('  .env.example — created');
+    fs.copyFileSync(envExampleSrc, envExampleDst);
+    console.log('  .env.example — created (full reference)');
   }
 
-  // .env from .env.example
+  // .env — minimal seed with only required keys
   const envPath = path.join(deployDir, '.env');
-  if (!fs.existsSync(envPath) && fs.existsSync(envExampleDst)) {
-    fs.copyFileSync(envExampleDst, envPath);
-    console.log('  .env — created from .env.example (fill in your tokens)');
-  }
-
-  const ghToken = detectGitHubToken();
-  if (ghToken && fs.existsSync(envPath)) {
-    let envContent = fs.readFileSync(envPath, 'utf8');
-    if (!envContent.match(/^GITHUB_TOKEN=.+/m)) {
-      envContent = envContent.replace(/^GITHUB_TOKEN=.*$/m, `GITHUB_TOKEN=${ghToken}`);
-      if (!envContent.includes('GITHUB_TOKEN=')) envContent += `\nGITHUB_TOKEN=${ghToken}\n`;
-      fs.writeFileSync(envPath, envContent, 'utf8');
+  if (!fs.existsSync(envPath)) {
+    const ghToken = detectGitHubToken();
+    const lines = [
+      '# Wayfind — required configuration',
+      '# See .env.example for all available options.',
+      '',
+      '# Anthropic API key (for digests and bot answers)',
+      'ANTHROPIC_API_KEY=sk-ant-your-key',
+      '',
+      '# GitHub token (for pulling team journals and signals)',
+      `GITHUB_TOKEN=${ghToken || ''}`,
+      '',
+      `TEAM_CONTEXT_TENANT_ID=${teamId}`,
+    ];
+    // Set volume mount path so docker-compose.yml resolves correctly
+    if (teamContextPath) {
+      lines.push(`TEAM_CONTEXT_TEAM_CONTEXT_PATH=${teamContextPath}`);
+    }
+    fs.writeFileSync(envPath, lines.join('\n') + '\n', 'utf8');
+    console.log('  .env — created (fill in ANTHROPIC_API_KEY)');
+    if (ghToken) {
       console.log('  GITHUB_TOKEN — auto-detected from gh CLI');
     }
+  } else {
+    console.log('  .env — already exists, skipping');
+  }
+
+  // Ensure deploy/.env is gitignored if we're in a repo
+  if (teamContextPath) {
+    const gitignorePath = path.join(teamContextPath, '.gitignore');
+    const gitignoreEntry = 'deploy/.env';
+    if (fs.existsSync(gitignorePath)) {
+      const content = fs.readFileSync(gitignorePath, 'utf8');
+      if (!content.includes(gitignoreEntry)) {
+        fs.appendFileSync(gitignorePath, `\n${gitignoreEntry}\n`);
+        console.log('  .gitignore — added deploy/.env');
+      }
+    }
+  }
+
+  // Store container_endpoint in context.json so team members' MCP can discover it
+  const updatedConfig = readContextConfig();
+  if (updatedConfig.teams && updatedConfig.teams[teamId]) {
+    updatedConfig.teams[teamId].container_endpoint = `http://localhost:${assignedPort}`;
+    writeContextConfig(updatedConfig);
+    console.log(`  context.json — set container_endpoint to http://localhost:${assignedPort}`);
+    console.log('  Tip: update the hostname if team members connect over a network (e.g. Tailscale).');
   }
 
   console.log('');
   console.log('Next steps:');
-  console.log(`  1. Fill in ${deployDir}/.env with your tokens`);
+  console.log(`  1. Set ANTHROPIC_API_KEY in ${deployDir}/.env`);
   console.log(`  2. cd "${deployDir}" && docker compose up -d`);
   console.log(`  3. Verify: curl http://localhost:${assignedPort}/healthz`);
   console.log('');
+  console.log('See .env.example for optional config (Slack, embeddings, signals, schedules).');
   console.log(`Tip: run "wayfind deploy list" to see all running team containers.`);
 
   telemetry.capture('deploy_team_init', { teamId }, CLI_USER);
@@ -3928,7 +4004,7 @@ function deployList() {
   const rows = (psResult.stdout || '').toString().trim();
   if (!rows) {
     console.log('No Wayfind team containers running.');
-    console.log('Start one with: wayfind deploy --team <teamId> && cd ~/.claude/team-context/teams/<teamId>/deploy && docker compose up -d');
+    console.log('Start one with: wayfind deploy --team <teamId>');
     return;
   }
 
@@ -4125,14 +4201,149 @@ function deployStatus() {
   }
 }
 
-// ── Health endpoint ──────────────────────────────────────────────────────────
+// ── API key management ──────────────────────────────────────────────────────
+
+/**
+ * Read or generate the API key for container search endpoints.
+ * Key is stored in the team-context repo so team members can read it.
+ */
+function getOrCreateApiKey() {
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  if (!teamDir) return null;
+
+  const keyFile = path.join(teamDir, '.wayfind-api-key');
+  try {
+    if (fs.existsSync(keyFile)) {
+      const key = fs.readFileSync(keyFile, 'utf8').trim();
+      if (key.length >= 32) return key;
+    }
+  } catch (_) {}
+
+  // Generate a new key
+  const key = crypto.randomBytes(32).toString('hex');
+  try {
+    fs.writeFileSync(keyFile, key + '\n', 'utf8');
+    console.log(`[${new Date().toISOString()}] Generated new API key in ${keyFile}`);
+  } catch (err) {
+    console.error(`Failed to write API key: ${err.message}`);
+    return null;
+  }
+  return key;
+}
+
+/**
+ * Rotate the API key and commit/push it to the team-context repo.
+ */
+function rotateApiKey() {
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  if (!teamDir) return;
+
+  const key = crypto.randomBytes(32).toString('hex');
+  const keyFile = path.join(teamDir, '.wayfind-api-key');
+  try {
+    fs.writeFileSync(keyFile, key + '\n', 'utf8');
+    currentApiKey = key;
+    console.log(`[${new Date().toISOString()}] Rotated API key`);
+    pushApiKey(teamDir);
+  } catch (err) {
+    console.error(`Key rotation failed: ${err.message}`);
+  }
+}
+
+/**
+ * Git add/commit/push the API key file.
+ */
+function pushApiKey(teamDir) {
+  const token = process.env.GITHUB_TOKEN;
+  const env = { ...process.env };
+  const gitConfig = [['safe.directory', teamDir]];
+  if (token) {
+    env.GIT_ASKPASS = 'echo';
+    env.GIT_TERMINAL_PROMPT = '0';
+    gitConfig.push(['credential.helper', '']);
+    gitConfig.push([`url.https://x-access-token:${token}@github.com/.insteadOf`, 'https://github.com/']);
+  }
+  env.GIT_CONFIG_COUNT = String(gitConfig.length);
+  for (let i = 0; i < gitConfig.length; i++) {
+    env[`GIT_CONFIG_KEY_${i}`] = gitConfig[i][0];
+    env[`GIT_CONFIG_VALUE_${i}`] = gitConfig[i][1];
+  }
+
+  try {
+    spawnSync('git', ['add', '.wayfind-api-key'], { cwd: teamDir, env, stdio: 'pipe' });
+    const diff = spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: teamDir, env, stdio: 'pipe' });
+    if (diff.status === 0) return; // Nothing to commit
+    spawnSync('git', ['commit', '-m', 'Rotate Wayfind API key'], { cwd: teamDir, env, stdio: 'pipe' });
+    const push = spawnSync('git', ['push'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+    if (push.status !== 0) {
+      // Rebase and retry on conflict
+      spawnSync('git', ['pull', '--rebase'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+      spawnSync('git', ['push'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+    }
+  } catch (err) {
+    console.error(`API key push failed: ${err.message}`);
+  }
+}
+
+// Current in-memory API key (loaded on startup, updated on rotation)
+let currentApiKey = null;
+
+// ── Health + API endpoint ───────────────────────────────────────────────────
 
 let healthStatus = { ok: true, mode: null, started: null, services: {} };
 
+/**
+ * Parse JSON body from an incoming request.
+ */
+function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => { body += chunk; if (body.length > 1e6) reject(new Error('Body too large')); });
+    req.on('end', () => {
+      try { resolve(body ? JSON.parse(body) : {}); }
+      catch (e) { reject(e); }
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Check Authorization header against the current API key.
+ * Returns true if authorized, false otherwise (and sends 401).
+ */
+function checkApiAuth(req, res) {
+  if (!currentApiKey) {
+    res.writeHead(503, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'API key not configured' }));
+    return false;
+  }
+  const auth = req.headers['authorization'] || '';
+  const token = auth.startsWith('Bearer ') ? auth.slice(7).trim() : '';
+  if (token !== currentApiKey) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid or expired API key' }));
+    return false;
+  }
+  return true;
+}
+
 function startHealthServer() {
   const port = parseInt(process.env.TEAM_CONTEXT_HEALTH_PORT || '3141', 10);
-  const server = http.createServer((req, res) => {
-    if (req.url === '/healthz' && req.method === 'GET') {
+
+  // Load API key for search endpoints
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  const keyExisted = teamDir && fs.existsSync(path.join(teamDir, '.wayfind-api-key'));
+  currentApiKey = getOrCreateApiKey();
+  if (currentApiKey) {
+    console.log('API search endpoints enabled (key loaded)');
+    // Push newly generated key so team members can pull it
+    if (!keyExisted && teamDir) pushApiKey(teamDir);
+  }
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://localhost:${port}`);
+
+    if (url.pathname === '/healthz' && req.method === 'GET') {
       // Enrich with index freshness
       const storePath = contentStore.resolveStorePath();
       const index = contentStore.loadIndex(storePath);
@@ -4147,17 +4358,108 @@ function startHealthServer() {
       const botExpected = healthStatus.services.bot === 'running';
       const slackHealthy = !botExpected || slackStatus.connected;
 
-      const response = { ...healthStatus, index: indexInfo, slack: slackStatus };
+      const response = {
+        ...healthStatus,
+        index: indexInfo,
+        slack: slackStatus,
+        api: { enabled: !!currentApiKey },
+      };
       const status = (healthStatus.ok && slackHealthy) ? 200 : 503;
       res.writeHead(status, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(response));
-    } else {
-      res.writeHead(404);
-      res.end();
+      return;
+    }
+
+    // ── Search API: POST /api/search ──
+    if (url.pathname === '/api/search' && req.method === 'POST') {
+      if (!checkApiAuth(req, res)) return;
+      try {
+        const body = await parseJsonBody(req);
+        const { query, limit = 10, repo, since, mode } = body;
+        if (!query) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'query is required' }));
+          return;
+        }
+
+        const opts = { limit, repo, since };
+        let results;
+        if (mode === 'text') {
+          results = contentStore.searchText(query, opts);
+        } else {
+          results = await contentStore.searchJournals(query, opts);
+        }
+
+        const mapped = (results || []).map(r => ({
+          id: r.id,
+          score: r.score ? Math.round(r.score * 1000) / 1000 : null,
+          date: r.entry.date,
+          repo: r.entry.repo,
+          title: r.entry.title,
+          source: r.entry.source,
+          tags: r.entry.tags || [],
+          summary: r.entry.summary || null,
+        }));
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ found: mapped.length, results: mapped }));
+      } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: err.message }));
+      }
+      return;
+    }
+
+    // ── Entry API: GET /api/entry/:id ──
+    if (url.pathname.startsWith('/api/entry/') && req.method === 'GET') {
+      if (!checkApiAuth(req, res)) return;
+      try {
+        const id = decodeURIComponent(url.pathname.slice('/api/entry/'.length));
+        if (!id) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'entry id is required' }));
+          return;
+        }
+
+        const storePath = contentStore.resolveStorePath();
+        const journalDir = process.env.TEAM_CONTEXT_JOURNALS_DIR || contentStore.DEFAULT_JOURNAL_DIR;
+        const index = contentStore.getBackend(storePath).loadIndex();
+
+        if (!index || !index.entries || !index.entries[id]) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `Entry not found: ${id}` }));
+          return;
+        }
+
+        const entry = index.entries[id];
+        const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          id,
+          date: entry.date,
+          repo: entry.repo,
+          title: entry.title,
+          source: entry.source,
+          tags: entry.tags || [],
+          content: fullContent || entry.summary || null,
+        }));
+      } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: err.message }));
+      }
+      return;
     }
+
+    res.writeHead(404);
+    res.end();
   });
   server.listen(port, () => {
-    console.log(`Health endpoint: http://0.0.0.0:${port}/healthz`);
+    console.log(`Health + API endpoint: http://0.0.0.0:${port}/healthz`);
+    if (currentApiKey) {
+      console.log(`  Search API: POST http://0.0.0.0:${port}/api/search`);
+      console.log(`  Entry API:  GET  http://0.0.0.0:${port}/api/entry/:id`);
+    }
   });
   return server;
 }
@@ -4170,8 +4472,10 @@ async function runStart() {
 
   // Validate required env vars before proceeding
   const missing = [];
-  if (!process.env.SLACK_BOT_TOKEN) missing.push('SLACK_BOT_TOKEN');
-  if (!process.env.SLACK_APP_TOKEN) missing.push('SLACK_APP_TOKEN');
+  // Slack tokens are only required for modes that run the bot
+  const needsSlack = ['bot', 'all-in-one'].includes(mode) && !process.env.TEAM_CONTEXT_NO_SLACK;
+  if (needsSlack && !process.env.SLACK_BOT_TOKEN) missing.push('SLACK_BOT_TOKEN');
+  if (needsSlack && !process.env.SLACK_APP_TOKEN) missing.push('SLACK_APP_TOKEN');
   if (!process.env.ANTHROPIC_API_KEY) missing.push('ANTHROPIC_API_KEY');
   if (missing.length > 0) {
     console.error('');
@@ -4181,6 +4485,8 @@ async function runStart() {
     console.error('  cp deploy/.env.example deploy/.env');
     console.error('  # Fill in your tokens, then: docker compose up -d');
     console.error('');
+    console.error('Tip: set TEAM_CONTEXT_NO_SLACK=1 to run without Slack integration.');
+    console.error('');
     process.exit(1);
   }
 
@@ -4309,6 +4615,14 @@ function runStartScheduler() {
     await indexSignalsIfAvailable();
   });
 
+  // Rotate API key daily (default 2am)
+  const keyRotateSchedule = process.env.TEAM_CONTEXT_KEY_ROTATE_SCHEDULE || '0 2 * * *';
+  console.log(`API key rotation schedule: ${keyRotateSchedule}`);
+  scheduleCron(keyRotateSchedule, () => {
+    console.log(`[${new Date().toISOString()}] Rotating API key...`);
+    rotateApiKey();
+  });
+
   console.log('Scheduler running. Waiting for scheduled events...');
 }
 
@@ -5181,13 +5495,13 @@ const COMMANDS = {
             if (labelDir && fs.existsSync(path.join(labelDir, 'docker-compose.yml'))) {
               composeDir = labelDir;
             } else {
-              // For per-team containers, check teams dir
-              const teamsBase = HOME ? path.join(HOME, '.claude', 'team-context', 'teams') : '';
-              if (teamsBase && fs.existsSync(teamsBase)) {
-                for (const tid of fs.readdirSync(teamsBase)) {
-                  const candidate = path.join(teamsBase, tid, 'deploy');
+              // Check team repo paths from context.json first
+              const updateConfig = readContextConfig();
+              if (updateConfig.teams) {
+                for (const [tid, entry] of Object.entries(updateConfig.teams)) {
+                  if (!entry.path) continue;
+                  const candidate = path.join(entry.path, 'deploy');
                   if (fs.existsSync(path.join(candidate, 'docker-compose.yml'))) {
-                    // Check if this compose file manages this container
                     const checkResult = spawnSync('docker', ['compose', 'ps', '--format', '{{.Name}}'], { cwd: candidate, stdio: 'pipe' });
                     const composeContainers = (checkResult.stdout || '').toString();
                     if (composeContainers.includes(containerName)) {
@@ -5197,6 +5511,23 @@ const COMMANDS = {
                   }
                 }
               }
+              // Fallback: check store-adjacent deploy dirs
+              if (!composeDir) {
+                const teamsBase = HOME ? path.join(HOME, '.claude', 'team-context', 'teams') : '';
+                if (teamsBase && fs.existsSync(teamsBase)) {
+                  for (const tid of fs.readdirSync(teamsBase)) {
+                    const candidate = path.join(teamsBase, tid, 'deploy');
+                    if (fs.existsSync(path.join(candidate, 'docker-compose.yml'))) {
+                      const checkResult = spawnSync('docker', ['compose', 'ps', '--format', '{{.Name}}'], { cwd: candidate, stdio: 'pipe' });
+                      const composeContainers = (checkResult.stdout || '').toString();
+                      if (composeContainers.includes(containerName)) {
+                        composeDir = candidate;
+                        break;
+                      }
+                    }
+                  }
+                }
+              }
               // Legacy fallback
               if (!composeDir) {
                 const legacyCandidates = [process.cwd(), path.join(HOME || '', 'team-context', 'deploy')];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wayfind",
-  "version": "2.0.44",
+  "version": "2.0.46",
   "description": "Team decision trail for AI-assisted development. The connective tissue between product, engineering, and strategy.",
   "bin": {
     "wayfind": "./bin/team-context.js",

package/templates/deploy/.env.example

@@ -1,14 +1,11 @@
 # Wayfind — Docker environment configuration
 # Copy to .env and fill in your values: cp .env.example .env
+#
+# Only ANTHROPIC_API_KEY and GITHUB_TOKEN are required.
+# Everything else is optional — add as needed.
 
 # ── Required ──────────────────────────────────────────────────────────────────
 
-# Slack bot tokens — from the Slack app you created using slack-app-manifest.json.
-# Go to api.slack.com/apps → your Wayfind app → OAuth & Permissions for the bot token,
-# and Basic Information → App-Level Tokens for the app token.
-SLACK_BOT_TOKEN=xoxb-your-bot-token
-SLACK_APP_TOKEN=xapp-your-app-token
-
 # Anthropic API key (for digests and bot answers)
 # Get one at console.anthropic.com
 ANTHROPIC_API_KEY=sk-ant-your-key
@@ -18,73 +15,33 @@ ANTHROPIC_API_KEY=sk-ant-your-key
 # Needs read access to the team-context repo.
 GITHUB_TOKEN=
 
-# ── Digest delivery ───────────────────────────────────────────────────────────
-# Primary: bot token + channel. The bot posts digests via chat.postMessage,
-# which enables reaction tracking and threaded feedback.
-# Fallback: webhook. Used only if bot delivery fails.
+# ── Slack (for digest delivery and bot) ──────────────────────────────────────
+# Without these, set TEAM_CONTEXT_NO_SLACK=1 and the container runs in
+# scheduler/worker-only mode (no digest posting, no bot answers).
 
-# Slack channel for digest delivery (channel ID, not name)
-# Right-click channel in Slack → View channel details → copy the ID at bottom
+# SLACK_BOT_TOKEN=xoxb-your-bot-token
+# SLACK_APP_TOKEN=xapp-your-app-token
 # SLACK_DIGEST_CHANNEL=C0123456789
-
-# Slack webhook — fallback for digest delivery if bot token is unavailable
 # TEAM_CONTEXT_SLACK_WEBHOOK=https://hooks.slack.com/services/T.../B.../...
 
-# ── Optional ──────────────────────────────────────────────────────────────────
-
-# Tenant identifier (prefixes storage paths)
-# TEAM_CONTEXT_TENANT_ID=my-team
-
-# Team repo allowlist — only journals from these repos appear in digests and queries.
-# Supports org/* wildcards. This is the recommended way to scope a container to one team.
-# TEAM_CONTEXT_INCLUDE_REPOS=MyOrg/*,MyOrg-Libs/*
-
-# DEPRECATED: Blocklist approach. Use INCLUDE_REPOS instead.
-# TEAM_CONTEXT_EXCLUDE_REPOS=wayfind,personal-project
-
-# Encryption key — generate with: openssl rand -base64 32
-# TEAM_CONTEXT_ENCRYPTION_KEY=
-
-# Author slug for CLI telemetry attribution
-# TEAM_CONTEXT_AUTHOR=greg
-
-# ── LLM models ───────────────────────────────────────────────────────────────
-
-# Model for digest generation and onboarding packs (default: claude-sonnet-4-5-20250929)
-# TEAM_CONTEXT_LLM_MODEL=claude-sonnet-4-5-20250929
-
-# Model for conversation transcript extraction (default: claude-sonnet-4-5-20250929)
-# TEAM_CONTEXT_EXTRACTION_MODEL=claude-sonnet-4-5-20250929
-
-# ── Embeddings (without these, bot uses keyword search only) ─────────────────
+# ── Embeddings (for semantic search — falls back to keyword search without) ──
 # Option A: OpenAI
 # OPENAI_API_KEY=sk-your-openai-key
-# Option B: Azure OpenAI (if you have an AOAI deployment)
+# Option B: Azure OpenAI
 # AZURE_OPENAI_EMBEDDING_ENDPOINT=https://your-resource.openai.azure.com/
 # AZURE_OPENAI_EMBEDDING_KEY=your-key
 # AZURE_OPENAI_EMBEDDING_DEPLOYMENT=text-embedding-3-small
 
-# ── Path overrides ───────────────────────────────────────────────────────────
-
-# Override content store path (default: ~/.claude/team-context/content-store)
-# TEAM_CONTEXT_STORE_PATH=/data/content-store
-
-# Override signals directory (default: ~/.claude/team-context/signals)
-# TEAM_CONTEXT_SIGNALS_DIR=/data/signals
+# ── Team scoping ─────────────────────────────────────────────────────────────
 
-# Override conversations directory (default: ~/.claude/projects)
-# TEAM_CONTEXT_CONVERSATIONS_DIR=/data/conversations
-
-# ── Schedules ────────────────────────────────────────────────────────────────
-
-# Digest schedule (cron, default: daily 12pm UTC / 7am ET)
-# TEAM_CONTEXT_DIGEST_SCHEDULE=0 12 * * *
+# Tenant identifier (prefixes storage paths)
+# TEAM_CONTEXT_TENANT_ID=my-team
 
-# Signal pull schedule (cron, default: daily 6am UTC)
-# TEAM_CONTEXT_SIGNAL_SCHEDULE=0 6 * * *
+# Team repo allowlist — only journals from these repos appear in digests/queries.
+# TEAM_CONTEXT_INCLUDE_REPOS=MyOrg/*,MyOrg-Libs/*
 
-# Reindex schedule (cron, default: hourly)
-# TEAM_CONTEXT_REINDEX_SCHEDULE=0 * * * *
+# Author slug for telemetry attribution
+# TEAM_CONTEXT_AUTHOR=greg
 
 # ── Signal sources ───────────────────────────────────────────────────────────
 
@@ -93,21 +50,28 @@ GITHUB_TOKEN=
 
 # Intercom API token for support signal ingestion
 # INTERCOM_TOKEN=your-intercom-token
-
-# Filter Intercom conversations by tags (comma-separated)
 # TEAM_CONTEXT_INTERCOM_TAGS=bug,feature-request
 
 # Notion integration token for page/database signal ingestion
-# Create at: https://www.notion.so/my-integrations
 # NOTION_TOKEN=ntn_your-integration-token
-
-# Specific Notion database IDs to monitor (comma-separated, or blank for all shared pages)
 # TEAM_CONTEXT_NOTION_DATABASES=db_id1,db_id2
 
-# ── Monitoring ───────────────────────────────────────────────────────────────
+# ── Schedules ────────────────────────────────────────────────────────────────
 
-# Health check port (default: 3141)
-# TEAM_CONTEXT_HEALTH_PORT=3141
+# TEAM_CONTEXT_DIGEST_SCHEDULE=0 12 * * *
+# TEAM_CONTEXT_SIGNAL_SCHEDULE=0 6 * * *
+# TEAM_CONTEXT_REINDEX_SCHEDULE=0 * * * *
 
-# Telemetry — opt-in anonymous usage data to help improve Wayfind
+# ── Advanced ─────────────────────────────────────────────────────────────────
+
+# Set to 1 to run without Slack (scheduler + worker only, no bot)
+# TEAM_CONTEXT_NO_SLACK=1
+
+# TEAM_CONTEXT_LLM_MODEL=claude-sonnet-4-5-20250929
+# TEAM_CONTEXT_EXTRACTION_MODEL=claude-sonnet-4-5-20250929
+# TEAM_CONTEXT_ENCRYPTION_KEY=
+# TEAM_CONTEXT_HEALTH_PORT=3141
 # TEAM_CONTEXT_TELEMETRY=true
+# TEAM_CONTEXT_STORE_PATH=/data/content-store
+# TEAM_CONTEXT_SIGNALS_DIR=/data/signals
+# TEAM_CONTEXT_CONVERSATIONS_DIR=/data/conversations

package/templates/deploy/docker-compose.yml

@@ -7,52 +7,9 @@ services:
     image: ghcr.io/usewayfind/wayfind:latest
     container_name: wayfind
     restart: unless-stopped
+    env_file: .env
     environment:
       TEAM_CONTEXT_MODE: all-in-one
-      TEAM_CONTEXT_TENANT_ID: ${TEAM_CONTEXT_TENANT_ID:-my-team}
-      TEAM_CONTEXT_AUTHOR: ${TEAM_CONTEXT_AUTHOR:-}
-
-      # Slack
-      SLACK_BOT_TOKEN: ${SLACK_BOT_TOKEN}
-      SLACK_APP_TOKEN: ${SLACK_APP_TOKEN}
-      SLACK_DIGEST_CHANNEL: ${SLACK_DIGEST_CHANNEL:-}
-      TEAM_CONTEXT_SLACK_WEBHOOK: ${TEAM_CONTEXT_SLACK_WEBHOOK:-}
-
-      # Team repo allowlist (recommended over EXCLUDE_REPOS)
-      TEAM_CONTEXT_INCLUDE_REPOS: ${TEAM_CONTEXT_INCLUDE_REPOS:-}
-      # DEPRECATED: Blocklist approach — use INCLUDE_REPOS instead
-      TEAM_CONTEXT_EXCLUDE_REPOS: ${TEAM_CONTEXT_EXCLUDE_REPOS:-}
-
-      # Telemetry (opt-in, sends anonymous usage data to improve Wayfind)
-      TEAM_CONTEXT_TELEMETRY: ${TEAM_CONTEXT_TELEMETRY:-false}
-
-      # GitHub signals
-      GITHUB_TOKEN: ${GITHUB_TOKEN:-}
-
-      # Intercom signals
-      INTERCOM_TOKEN: ${INTERCOM_TOKEN:-}
-      TEAM_CONTEXT_INTERCOM_TAGS: ${TEAM_CONTEXT_INTERCOM_TAGS:-}
-
-      # LLM
-      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
-      TEAM_CONTEXT_LLM_MODEL: ${TEAM_CONTEXT_LLM_MODEL:-claude-sonnet-4-5-20250929}
-
-      # Embeddings (for semantic search — falls back to keyword search without these)
-      # Option A: OpenAI
-      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
-      # Option B: Azure OpenAI
-      AZURE_OPENAI_EMBEDDING_ENDPOINT: ${AZURE_OPENAI_EMBEDDING_ENDPOINT:-}
-      AZURE_OPENAI_EMBEDDING_KEY: ${AZURE_OPENAI_EMBEDDING_KEY:-}
-      AZURE_OPENAI_EMBEDDING_DEPLOYMENT: ${AZURE_OPENAI_EMBEDDING_DEPLOYMENT:-text-embedding-3-small}
-
-      # Encryption — generate with: openssl rand -base64 32
-      TEAM_CONTEXT_ENCRYPTION_KEY: ${TEAM_CONTEXT_ENCRYPTION_KEY:-}
-
-      # Scheduling
-      TEAM_CONTEXT_DIGEST_SCHEDULE: ${TEAM_CONTEXT_DIGEST_SCHEDULE:-0 8 * * 1}
-      TEAM_CONTEXT_SIGNAL_SCHEDULE: ${TEAM_CONTEXT_SIGNAL_SCHEDULE:-0 6 * * *}
-
-      # Team context repo (mounted at /data/team-context for git pull)
       TEAM_CONTEXT_TEAM_CONTEXT_DIR: /data/team-context
       TEAM_CONTEXT_JOURNALS_DIR: /data/team-context/journals
     volumes:

package/templates/global.md

@@ -49,7 +49,7 @@ Record how you actually think about recurring decision types. Examples:
 
 ## Memory Files (load on demand)
 
-Load these from `~/.ai-memory/memory/` when the session topic matches:
+Load these from `~/.claude/memory/` when the session topic matches:
 
 | File | When to load | Summary |
 |------|-------------|---------|
@@ -59,21 +59,21 @@ Load these from `~/.ai-memory/memory/` when the session topic matches:
 
 | Location | Covers |
 |----------|--------|
-| `~/.ai-memory/state.md` | Admin work, non-repo tasks |
-| `~/repos/org/repo/.ai-memory/state.md` | What this repo is about |
+| `~/.claude/state.md` | Admin work, non-repo tasks |
+| `~/repos/org/repo/.claude/state.md` | What this repo is about |
 
 ## Session Protocol
 
 **Start:**
-1. Read this file + the repo's `.ai-memory/state.md`
+1. Read this file + the repo's `.claude/state.md`
 2. Check Memory Files table — load any that match this session's topic
 3. Summarize current state, then ask: **"What's the goal for this session? What does success look like?"**
 
 **Mid-session drift check:** If work diverges from the stated goal, flag it gently and ask whether to stay the course or pivot.
 
 **End (on "stop" / "done" / "pause" / "tomorrow"):**
-1. Update the repo's `.ai-memory/state.md`
+1. Update the repo's `.claude/state.md`
 2. Do NOT update this file's Active Projects table — it is rebuilt automatically by `wayfind status`.
 3. Create/update topic memory files for any significant new cross-repo context
-4. Append to `~/.ai-memory/memory/journal/YYYY-MM-DD.md`
+4. Append to `~/.claude/memory/journal/YYYY-MM-DD.md`
 5. Confirm: **"State saved. Say 'let's continue' next time."**