wayfind 2.0.45 → 2.0.46

package/BOOTSTRAP_PROMPT.md

@@ -27,6 +27,9 @@ Once both steps complete:
 6. Ask me if I want to set up team context (/wayfind:init-team) for shared journals,
    digests, and product state
 7. Let me know that anonymous usage telemetry is enabled by default (set TEAM_CONTEXT_TELEMETRY=false to opt out)
+8. If I'm joining an existing team, check if there's a container_endpoint in my
+   context.json — if so, my MCP server will automatically proxy semantic search
+   to the team's container. No extra setup needed.
 ```
 
 ---
@@ -36,10 +39,12 @@ Once both steps complete:
 The CLI install creates:
 - `~/.claude/memory/` and `~/.claude/memory/journal/`
 - `~/.claude/global-state.md` (your persistent index)
+- `~/.claude/team-context/context.json` (team registry for multi-team support)
 
 The plugin provides:
 - SessionStart and Stop hooks (context loading, decision extraction)
 - Slash commands: `/wayfind:init-memory`, `/wayfind:init-team`, `/wayfind:journal`, `/wayfind:doctor`, `/wayfind:standup`
+- MCP server (`wayfind-mcp`) — registered automatically, gives any MCP-compatible AI tool access to your team's context
 
 After the paste, Claude will walk you through filling in your preferences. From
 then on, every session in every repo will start with full context of where you
@@ -100,6 +105,27 @@ Claude will create `.claude/team-state.md` (shared) and `.claude/personal-state.
 
 ---
 
+## Container deployment (for teams)
+
+One team member (the team owner) runs a Docker container that provides:
+- Slack bot, automated digests, signal connectors
+- Semantic search API for the whole team's content
+- API key auto-rotation (daily, committed to team-context repo)
+
+Other team members don't need Docker — their local MCP server automatically
+proxies search queries to the container via the shared API key.
+
+```bash
+wayfind deploy --team <teamId>           # Scaffold config
+# Edit deploy/.env with your Anthropic key
+cd deploy && docker compose up -d        # Start container
+wayfind deploy set-endpoint http://your-hostname:3141 --team <teamId>  # Set endpoint for team
+```
+
+Team members pull the team-context repo to get the API key and endpoint config.
+
+---
+
 ## For Cursor users
 
 ```
@@ -117,11 +143,11 @@ https://github.com/usewayfind/wayfind
 
 To install a specific version:
 ```
-npm install -g wayfind@2.0.15
+npm install -g wayfind@2.0.45
 wayfind init
 ```
 
 Or via the shell installer with a pinned version:
 ```
-WAYFIND_VERSION=v2.0.15 bash <(curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh)
+WAYFIND_VERSION=v2.0.45 bash <(curl -fsSL https://raw.githubusercontent.com/usewayfind/wayfind/main/install.sh)
 ```

package/README.md

@@ -145,12 +145,26 @@ wayfind pull --all        # All configured channels
 | `wayfind journal sync` | Sync journals to team repo |
 | `wayfind onboard <repo>` | Generate onboarding context pack |
 | `wayfind deploy init` | Scaffold Docker deployment |
+| `wayfind deploy --team <id>` | Scaffold per-team Docker deployment |
+| `wayfind deploy set-endpoint <url>` | Set container endpoint for team search |
+| `wayfind deploy list` | List running team containers |
+| `wayfind deploy status` | Check container health |
 | `wayfind migrate-to-plugin` | Remove old hooks (after plugin install) |
 
 Run `wayfind help` for the full list.
 
 ---
 
+## MCP Server
+
+Wayfind includes an MCP server (`wayfind-mcp`) that exposes team context to any MCP-compatible AI tool.
+
+**Tools:** `search_context`, `get_entry`, `list_recent`, `get_signals`, `get_team_status`, `get_personas`, `record_feedback`, `add_context`
+
+Auto-registered during `wayfind init`. When a team container is running, the local MCP server proxies semantic search to it automatically — no config needed beyond the team-context repo.
+
+---
+
 ## Environment Variables
 
 ### For digests and bot
@@ -171,6 +185,8 @@ Run `wayfind help` for the full list.
 | `TEAM_CONTEXT_DIGEST_SCHEDULE` | Cron schedule (default: `0 8 * * 1` — Monday 8am) |
 | `TEAM_CONTEXT_EXCLUDE_REPOS` | Repos to exclude from digests |
 | `TEAM_CONTEXT_TELEMETRY` | `true` for anonymous usage telemetry |
+| `TEAM_CONTEXT_NO_SLACK` | Run container without Slack integration (set to `1`) |
+| `TEAM_CONTEXT_KEY_ROTATE_SCHEDULE` | API key rotation cron (default: `0 2 * * *`) |
 
 ---
 
@@ -182,6 +198,7 @@ Run `wayfind help` for the full list.
 | Claude Code | Full support (npm) | `wayfind init` |
 | Cursor | Session protocol | `wayfind init-cursor` |
 | Generic | Manual | See `specializations/generic/` |
+| Any MCP client | Full support (MCP) | `wayfind init` auto-registers |
 
 ---
 
@@ -198,6 +215,8 @@ Everything that runs on your machine is open source (Apache 2.0).
 | Digest generation (your API key) | |
 | Slack bot (self-hosted) | |
 | Multi-team support | |
+| MCP server (local + container proxy) | |
+| Per-team content store isolation | |
 
 See [LICENSING.md](LICENSING.md) for details.
 

package/bin/mcp-server.js

@@ -30,8 +30,199 @@ const path = require('path');
 const fs = require('fs');
 const contentStore = require('./content-store.js');
 
+const http = require('http');
+
 const pkg = require('../package.json');
 
+// ── Container proxy ─────────────────────────────────────────────────────────
+
+const HOME = process.env.HOME || process.env.USERPROFILE;
+const WAYFIND_DIR = HOME ? path.join(HOME, '.claude', 'team-context') : null;
+
+/**
+ * Read context.json to find the active team's container_endpoint.
+ */
+function getContainerEndpoint() {
+  if (!WAYFIND_DIR) return null;
+  const configPath = path.join(WAYFIND_DIR, 'context.json');
+  try {
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    // Resolve active team: repo binding → default
+    const teamId = getActiveTeamId(config);
+    if (!teamId || !config.teams || !config.teams[teamId]) return null;
+    return config.teams[teamId].container_endpoint || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Resolve active team ID from context.json (simplified — mirrors team-context.js logic).
+ */
+function getActiveTeamId(config) {
+  // Check repo-level binding first
+  try {
+    const bindingFile = path.join(process.cwd(), '.claude', 'wayfind.json');
+    if (fs.existsSync(bindingFile)) {
+      const binding = JSON.parse(fs.readFileSync(bindingFile, 'utf8'));
+      if (binding.team_id) return binding.team_id;
+    }
+  } catch (_) {}
+  return config.default || null;
+}
+
+/**
+ * Read the shared API key from the team-context repo.
+ */
+function readApiKey() {
+  if (!WAYFIND_DIR) return null;
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(WAYFIND_DIR, 'context.json'), 'utf8'));
+    const teamId = getActiveTeamId(config);
+    if (!teamId || !config.teams || !config.teams[teamId]) return null;
+    const teamPath = config.teams[teamId].path;
+    if (!teamPath) return null;
+    const keyFile = path.join(teamPath, '.wayfind-api-key');
+    return fs.readFileSync(keyFile, 'utf8').trim();
+  } catch (_) {
+    return null;
+  }
+}
+
+// Cache for API key (re-read from disk on 401)
+let cachedApiKey = null;
+
+/**
+ * HTTP POST to the container's search API.
+ * Returns parsed JSON or null on failure.
+ */
+function containerPost(endpoint, apiKey, body) {
+  return new Promise((resolve) => {
+    try {
+      const url = new URL(endpoint);
+      const postData = JSON.stringify(body);
+      const req = http.request({
+        hostname: url.hostname,
+        port: url.port || 80,
+        path: url.pathname,
+        method: 'POST',
+        timeout: 10000,
+        headers: {
+          'Content-Type': 'application/json',
+          'Content-Length': Buffer.byteLength(postData),
+          'Authorization': `Bearer ${apiKey}`,
+        },
+      }, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          resolve({ status: res.statusCode, body: data });
+        });
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      req.write(postData);
+      req.end();
+    } catch (_) {
+      resolve(null);
+    }
+  });
+}
+
+/**
+ * HTTP GET from the container's entry API.
+ */
+function containerGet(endpoint, apiKey) {
+  return new Promise((resolve) => {
+    try {
+      const url = new URL(endpoint);
+      const req = http.request({
+        hostname: url.hostname,
+        port: url.port || 80,
+        path: url.pathname + url.search,
+        method: 'GET',
+        timeout: 10000,
+        headers: {
+          'Authorization': `Bearer ${apiKey}`,
+        },
+      }, (res) => {
+        let data = '';
+        res.on('data', (chunk) => { data += chunk; });
+        res.on('end', () => {
+          resolve({ status: res.statusCode, body: data });
+        });
+      });
+      req.on('error', () => resolve(null));
+      req.on('timeout', () => { req.destroy(); resolve(null); });
+      req.end();
+    } catch (_) {
+      resolve(null);
+    }
+  });
+}
+
+/**
+ * Try to proxy a search request to the container.
+ * On 401, re-reads the API key from disk and retries once.
+ * Returns parsed result or null if container unreachable/unavailable.
+ */
+async function proxySearch(body) {
+  const endpoint = getContainerEndpoint();
+  if (!endpoint) return null;
+
+  if (!cachedApiKey) cachedApiKey = readApiKey();
+  if (!cachedApiKey) return null;
+
+  const searchUrl = `${endpoint}/api/search`;
+  let result = await containerPost(searchUrl, cachedApiKey, body);
+
+  // On 401, re-read key (may have been rotated) and retry once
+  if (result && result.status === 401) {
+    process.stderr.write('Container returned 401 — re-reading API key...\n');
+    cachedApiKey = readApiKey();
+    if (!cachedApiKey) return null;
+    result = await containerPost(searchUrl, cachedApiKey, body);
+  }
+
+  if (!result || result.status !== 200) return null;
+
+  try {
+    return JSON.parse(result.body);
+  } catch (_) {
+    return null;
+  }
+}
+
+/**
+ * Try to proxy an entry retrieval to the container.
+ * Same 401-retry logic as proxySearch.
+ */
+async function proxyGetEntry(id) {
+  const endpoint = getContainerEndpoint();
+  if (!endpoint) return null;
+
+  if (!cachedApiKey) cachedApiKey = readApiKey();
+  if (!cachedApiKey) return null;
+
+  const entryUrl = `${endpoint}/api/entry/${encodeURIComponent(id)}`;
+  let result = await containerGet(entryUrl, cachedApiKey);
+
+  if (result && result.status === 401) {
+    process.stderr.write('Container returned 401 — re-reading API key...\n');
+    cachedApiKey = readApiKey();
+    if (!cachedApiKey) return null;
+    result = await containerGet(entryUrl, cachedApiKey);
+  }
+
+  if (!result || result.status !== 200) return null;
+
+  try {
+    return JSON.parse(result.body);
+  } catch (_) {
+    return null;
+  }
+}
+
 // ── Tool definitions ─────────────────────────────────────────────────────────
 
 const TOOLS = [
@@ -137,8 +328,18 @@ const TOOLS = [
 
 async function handleSearchContext(args) {
   const { query, limit = 10, repo, since, mode } = args;
-  const opts = { limit, repo, since };
 
+  // Try container first for semantic search (has embeddings for full team)
+  if (mode !== 'text') {
+    const containerResult = await proxySearch({ query, limit, repo, since, mode });
+    if (containerResult && containerResult.found > 0) {
+      containerResult.source = 'container';
+      return containerResult;
+    }
+  }
+
+  // Fall back to local search
+  const opts = { limit, repo, since };
   let results;
   if (mode === 'text') {
     results = contentStore.searchText(query, opts);
@@ -147,11 +348,12 @@ async function handleSearchContext(args) {
   }
 
   if (!results || results.length === 0) {
-    return { found: 0, results: [], hint: 'No matches. Try a broader query or check wayfind reindex.' };
+    return { found: 0, results: [], source: 'local', hint: 'No matches. Try a broader query or check wayfind reindex.' };
   }
 
   return {
     found: results.length,
+    source: 'local',
     results: results.map(r => ({
       id: r.id,
       score: r.score ? Math.round(r.score * 1000) / 1000 : null,
@@ -165,29 +367,34 @@ async function handleSearchContext(args) {
   };
 }
 
-function handleGetEntry(args) {
+async function handleGetEntry(args) {
   const { id } = args;
   const storePath = contentStore.resolveStorePath();
   const journalDir = contentStore.DEFAULT_JOURNAL_DIR;
 
-  // Get entry metadata
+  // Try local first (fastest)
   const index = contentStore.getBackend(storePath).loadIndex();
-  if (!index || !index.entries || !index.entries[id]) {
-    return { error: `Entry not found: ${id}` };
+  if (index && index.entries && index.entries[id]) {
+    const entry = index.entries[id];
+    const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+    return {
+      id,
+      date: entry.date,
+      repo: entry.repo,
+      title: entry.title,
+      source: entry.source,
+      tags: entry.tags || [],
+      content: fullContent || entry.summary || null,
+    };
   }
 
-  const entry = index.entries[id];
-  const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+  // Not found locally — try container (may have entries from other team members)
+  const containerResult = await proxyGetEntry(id);
+  if (containerResult && !containerResult.error) {
+    return containerResult;
+  }
 
-  return {
-    id,
-    date: entry.date,
-    repo: entry.repo,
-    title: entry.title,
-    source: entry.source,
-    tags: entry.tags || [],
-    content: fullContent || entry.summary || null,
-  };
+  return { error: `Entry not found: ${id}` };
 }
 
 function handleListRecent(args) {
@@ -382,7 +589,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
   let result;
   switch (name) {
     case 'search_context':   result = await handleSearchContext(args); break;
-    case 'get_entry':        result = handleGetEntry(args); break;
+    case 'get_entry':        result = await handleGetEntry(args); break;
     case 'list_recent':      result = handleListRecent(args); break;
     case 'get_signals':      result = handleGetSignals(args); break;
     case 'get_team_status':  result = handleGetTeamStatus(args); break;

package/bin/team-context.js

@@ -2103,7 +2103,7 @@ function commitAndPushTeamJournals(teamContextPath, copied) {
   stampMemberVersion(teamContextPath);
 
   try {
-    const gitAdd = spawnSync('git', ['add', 'journals/', 'members/'], { cwd: teamContextPath, stdio: 'pipe' });
+    const gitAdd = spawnSync('git', ['add', 'journals/', 'members/', '.wayfind-api-key'], { cwd: teamContextPath, stdio: 'pipe' });
     if (gitAdd.status !== 0) {
       console.error(`git add failed: ${(gitAdd.stderr || '').toString().trim()}`);
       return;
@@ -3804,9 +3804,27 @@ async function runDeploy(args) {
     case 'status':
       deployStatus();
       break;
+    case 'set-endpoint': {
+      const endpointTeamId = teamId || (readContextConfig().default);
+      const endpointUrl = filteredArgs[1];
+      if (!endpointTeamId || !endpointUrl) {
+        console.error('Usage: wayfind deploy set-endpoint <url> --team <id>');
+        console.error('Example: wayfind deploy set-endpoint http://gregs-laptop:3141 --team abc123');
+        process.exit(1);
+      }
+      const cfg = readContextConfig();
+      if (!cfg.teams || !cfg.teams[endpointTeamId]) {
+        console.error(`Team "${endpointTeamId}" not found in context.json`);
+        process.exit(1);
+      }
+      cfg.teams[endpointTeamId].container_endpoint = endpointUrl;
+      writeContextConfig(cfg);
+      console.log(`Set container_endpoint for team "${endpointTeamId}" to ${endpointUrl}`);
+      break;
+    }
     default:
       console.error(`Unknown deploy subcommand: ${sub}`);
-      console.error('Available: init [--team <id>], list, status');
+      console.error('Available: init [--team <id>], list, status, set-endpoint');
       process.exit(1);
   }
 }
@@ -3947,6 +3965,15 @@ function deployTeamInit(teamId, { port } = {}) {
     }
   }
 
+  // Store container_endpoint in context.json so team members' MCP can discover it
+  const updatedConfig = readContextConfig();
+  if (updatedConfig.teams && updatedConfig.teams[teamId]) {
+    updatedConfig.teams[teamId].container_endpoint = `http://localhost:${assignedPort}`;
+    writeContextConfig(updatedConfig);
+    console.log(`  context.json — set container_endpoint to http://localhost:${assignedPort}`);
+    console.log('  Tip: update the hostname if team members connect over a network (e.g. Tailscale).');
+  }
+
   console.log('');
   console.log('Next steps:');
   console.log(`  1. Set ANTHROPIC_API_KEY in ${deployDir}/.env`);
@@ -4174,14 +4201,149 @@ function deployStatus() {
   }
 }
 
-// ── Health endpoint ──────────────────────────────────────────────────────────
+// ── API key management ──────────────────────────────────────────────────────
+
+/**
+ * Read or generate the API key for container search endpoints.
+ * Key is stored in the team-context repo so team members can read it.
+ */
+function getOrCreateApiKey() {
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  if (!teamDir) return null;
+
+  const keyFile = path.join(teamDir, '.wayfind-api-key');
+  try {
+    if (fs.existsSync(keyFile)) {
+      const key = fs.readFileSync(keyFile, 'utf8').trim();
+      if (key.length >= 32) return key;
+    }
+  } catch (_) {}
+
+  // Generate a new key
+  const key = crypto.randomBytes(32).toString('hex');
+  try {
+    fs.writeFileSync(keyFile, key + '\n', 'utf8');
+    console.log(`[${new Date().toISOString()}] Generated new API key in ${keyFile}`);
+  } catch (err) {
+    console.error(`Failed to write API key: ${err.message}`);
+    return null;
+  }
+  return key;
+}
+
+/**
+ * Rotate the API key and commit/push it to the team-context repo.
+ */
+function rotateApiKey() {
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  if (!teamDir) return;
+
+  const key = crypto.randomBytes(32).toString('hex');
+  const keyFile = path.join(teamDir, '.wayfind-api-key');
+  try {
+    fs.writeFileSync(keyFile, key + '\n', 'utf8');
+    currentApiKey = key;
+    console.log(`[${new Date().toISOString()}] Rotated API key`);
+    pushApiKey(teamDir);
+  } catch (err) {
+    console.error(`Key rotation failed: ${err.message}`);
+  }
+}
+
+/**
+ * Git add/commit/push the API key file.
+ */
+function pushApiKey(teamDir) {
+  const token = process.env.GITHUB_TOKEN;
+  const env = { ...process.env };
+  const gitConfig = [['safe.directory', teamDir]];
+  if (token) {
+    env.GIT_ASKPASS = 'echo';
+    env.GIT_TERMINAL_PROMPT = '0';
+    gitConfig.push(['credential.helper', '']);
+    gitConfig.push([`url.https://x-access-token:${token}@github.com/.insteadOf`, 'https://github.com/']);
+  }
+  env.GIT_CONFIG_COUNT = String(gitConfig.length);
+  for (let i = 0; i < gitConfig.length; i++) {
+    env[`GIT_CONFIG_KEY_${i}`] = gitConfig[i][0];
+    env[`GIT_CONFIG_VALUE_${i}`] = gitConfig[i][1];
+  }
+
+  try {
+    spawnSync('git', ['add', '.wayfind-api-key'], { cwd: teamDir, env, stdio: 'pipe' });
+    const diff = spawnSync('git', ['diff', '--cached', '--quiet'], { cwd: teamDir, env, stdio: 'pipe' });
+    if (diff.status === 0) return; // Nothing to commit
+    spawnSync('git', ['commit', '-m', 'Rotate Wayfind API key'], { cwd: teamDir, env, stdio: 'pipe' });
+    const push = spawnSync('git', ['push'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+    if (push.status !== 0) {
+      // Rebase and retry on conflict
+      spawnSync('git', ['pull', '--rebase'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+      spawnSync('git', ['push'], { cwd: teamDir, env, stdio: 'pipe', timeout: 30000 });
+    }
+  } catch (err) {
+    console.error(`API key push failed: ${err.message}`);
+  }
+}
+
+// Current in-memory API key (loaded on startup, updated on rotation)
+let currentApiKey = null;
+
+// ── Health + API endpoint ───────────────────────────────────────────────────
 
 let healthStatus = { ok: true, mode: null, started: null, services: {} };
 
+/**
+ * Parse JSON body from an incoming request.
+ */
+function parseJsonBody(req) {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    req.on('data', (chunk) => { body += chunk; if (body.length > 1e6) reject(new Error('Body too large')); });
+    req.on('end', () => {
+      try { resolve(body ? JSON.parse(body) : {}); }
+      catch (e) { reject(e); }
+    });
+    req.on('error', reject);
+  });
+}
+
+/**
+ * Check Authorization header against the current API key.
+ * Returns true if authorized, false otherwise (and sends 401).
+ */
+function checkApiAuth(req, res) {
+  if (!currentApiKey) {
+    res.writeHead(503, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'API key not configured' }));
+    return false;
+  }
+  const auth = req.headers['authorization'] || '';
+  const token = auth.startsWith('Bearer ') ? auth.slice(7).trim() : '';
+  if (token !== currentApiKey) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid or expired API key' }));
+    return false;
+  }
+  return true;
+}
+
 function startHealthServer() {
   const port = parseInt(process.env.TEAM_CONTEXT_HEALTH_PORT || '3141', 10);
-  const server = http.createServer((req, res) => {
-    if (req.url === '/healthz' && req.method === 'GET') {
+
+  // Load API key for search endpoints
+  const teamDir = process.env.TEAM_CONTEXT_TEAM_CONTEXT_DIR;
+  const keyExisted = teamDir && fs.existsSync(path.join(teamDir, '.wayfind-api-key'));
+  currentApiKey = getOrCreateApiKey();
+  if (currentApiKey) {
+    console.log('API search endpoints enabled (key loaded)');
+    // Push newly generated key so team members can pull it
+    if (!keyExisted && teamDir) pushApiKey(teamDir);
+  }
+
+  const server = http.createServer(async (req, res) => {
+    const url = new URL(req.url, `http://localhost:${port}`);
+
+    if (url.pathname === '/healthz' && req.method === 'GET') {
       // Enrich with index freshness
       const storePath = contentStore.resolveStorePath();
       const index = contentStore.loadIndex(storePath);
@@ -4196,17 +4358,108 @@ function startHealthServer() {
       const botExpected = healthStatus.services.bot === 'running';
       const slackHealthy = !botExpected || slackStatus.connected;
 
-      const response = { ...healthStatus, index: indexInfo, slack: slackStatus };
+      const response = {
+        ...healthStatus,
+        index: indexInfo,
+        slack: slackStatus,
+        api: { enabled: !!currentApiKey },
+      };
       const status = (healthStatus.ok && slackHealthy) ? 200 : 503;
       res.writeHead(status, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(response));
-    } else {
-      res.writeHead(404);
-      res.end();
+      return;
     }
+
+    // ── Search API: POST /api/search ──
+    if (url.pathname === '/api/search' && req.method === 'POST') {
+      if (!checkApiAuth(req, res)) return;
+      try {
+        const body = await parseJsonBody(req);
+        const { query, limit = 10, repo, since, mode } = body;
+        if (!query) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'query is required' }));
+          return;
+        }
+
+        const opts = { limit, repo, since };
+        let results;
+        if (mode === 'text') {
+          results = contentStore.searchText(query, opts);
+        } else {
+          results = await contentStore.searchJournals(query, opts);
+        }
+
+        const mapped = (results || []).map(r => ({
+          id: r.id,
+          score: r.score ? Math.round(r.score * 1000) / 1000 : null,
+          date: r.entry.date,
+          repo: r.entry.repo,
+          title: r.entry.title,
+          source: r.entry.source,
+          tags: r.entry.tags || [],
+          summary: r.entry.summary || null,
+        }));
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ found: mapped.length, results: mapped }));
+      } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: err.message }));
+      }
+      return;
+    }
+
+    // ── Entry API: GET /api/entry/:id ──
+    if (url.pathname.startsWith('/api/entry/') && req.method === 'GET') {
+      if (!checkApiAuth(req, res)) return;
+      try {
+        const id = decodeURIComponent(url.pathname.slice('/api/entry/'.length));
+        if (!id) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'entry id is required' }));
+          return;
+        }
+
+        const storePath = contentStore.resolveStorePath();
+        const journalDir = process.env.TEAM_CONTEXT_JOURNALS_DIR || contentStore.DEFAULT_JOURNAL_DIR;
+        const index = contentStore.getBackend(storePath).loadIndex();
+
+        if (!index || !index.entries || !index.entries[id]) {
+          res.writeHead(404, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `Entry not found: ${id}` }));
+          return;
+        }
+
+        const entry = index.entries[id];
+        const fullContent = contentStore.getEntryContent(id, { storePath, journalDir });
+
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+          id,
+          date: entry.date,
+          repo: entry.repo,
+          title: entry.title,
+          source: entry.source,
+          tags: entry.tags || [],
+          content: fullContent || entry.summary || null,
+        }));
+      } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: err.message }));
+      }
+      return;
+    }
+
+    res.writeHead(404);
+    res.end();
   });
   server.listen(port, () => {
-    console.log(`Health endpoint: http://0.0.0.0:${port}/healthz`);
+    console.log(`Health + API endpoint: http://0.0.0.0:${port}/healthz`);
+    if (currentApiKey) {
+      console.log(`  Search API: POST http://0.0.0.0:${port}/api/search`);
+      console.log(`  Entry API:  GET  http://0.0.0.0:${port}/api/entry/:id`);
+    }
   });
   return server;
 }
@@ -4362,6 +4615,14 @@ function runStartScheduler() {
     await indexSignalsIfAvailable();
   });
 
+  // Rotate API key daily (default 2am)
+  const keyRotateSchedule = process.env.TEAM_CONTEXT_KEY_ROTATE_SCHEDULE || '0 2 * * *';
+  console.log(`API key rotation schedule: ${keyRotateSchedule}`);
+  scheduleCron(keyRotateSchedule, () => {
+    console.log(`[${new Date().toISOString()}] Rotating API key...`);
+    rotateApiKey();
+  });
+
   console.log('Scheduler running. Waiting for scheduled events...');
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wayfind",
-  "version": "2.0.45",
+  "version": "2.0.46",
   "description": "Team decision trail for AI-assisted development. The connective tissue between product, engineering, and strategy.",
   "bin": {
     "wayfind": "./bin/team-context.js",

package/templates/global.md

@@ -49,7 +49,7 @@ Record how you actually think about recurring decision types. Examples:
 
 ## Memory Files (load on demand)
 
-Load these from `~/.ai-memory/memory/` when the session topic matches:
+Load these from `~/.claude/memory/` when the session topic matches:
 
 | File | When to load | Summary |
 |------|-------------|---------|
@@ -59,21 +59,21 @@ Load these from `~/.ai-memory/memory/` when the session topic matches:
 
 | Location | Covers |
 |----------|--------|
-| `~/.ai-memory/state.md` | Admin work, non-repo tasks |
-| `~/repos/org/repo/.ai-memory/state.md` | What this repo is about |
+| `~/.claude/state.md` | Admin work, non-repo tasks |
+| `~/repos/org/repo/.claude/state.md` | What this repo is about |
 
 ## Session Protocol
 
 **Start:**
-1. Read this file + the repo's `.ai-memory/state.md`
+1. Read this file + the repo's `.claude/state.md`
 2. Check Memory Files table — load any that match this session's topic
 3. Summarize current state, then ask: **"What's the goal for this session? What does success look like?"**
 
 **Mid-session drift check:** If work diverges from the stated goal, flag it gently and ask whether to stay the course or pivot.
 
 **End (on "stop" / "done" / "pause" / "tomorrow"):**
-1. Update the repo's `.ai-memory/state.md`
+1. Update the repo's `.claude/state.md`
 2. Do NOT update this file's Active Projects table — it is rebuilt automatically by `wayfind status`.
 3. Create/update topic memory files for any significant new cross-repo context
-4. Append to `~/.ai-memory/memory/journal/YYYY-MM-DD.md`
+4. Append to `~/.claude/memory/journal/YYYY-MM-DD.md`
 5. Confirm: **"State saved. Say 'let's continue' next time."**