wendkeep 0.2.5 → 0.2.6

package/README.md

@@ -40,6 +40,8 @@ npx wendkeep init
 3. Add the `wendkeep-vault` MCP server to `.mcp.json` (skip with `--no-mcp`).
 4. Offer to pin **companion** plugins/MCP (multi-choice; `context-mode` pre-checked). Each is wired through the most agent-agnostic path it supports — `context-mode` as an `.mcp.json` MCP server (any agent), `understand-anything` via a `understand-inject` SessionStart hook that injects its domain graph when generated, and the Claude Code plugin layer (`extraKnownMarketplaces` + `enabledPlugins`) as a bonus. Control with `--companions <csv>` or `--no-companions`. (`caveman` additionally runs its own cross-agent installer on non-Claude agents.)
 5. Install a **color system** into the vault's `.obsidian/`: a CSS snippet that accents notes by type (session/decision/bug/learning, via the `cssclasses` the hooks emit) plus graph color groups by folder. Non-destructive merge into `appearance.json`/`graph.json`; skip with `--no-colors`.
+6. Seed the **curated memory layer**: `.brain/CORE.md` (the hand-curated hot layer, with the 3 required sections) and `.brain/COMPACTION_PROTOCOL.md` (the protocol guide). The auto layers (`DIGEST.md`, `index.jsonl`) are generated by the hooks. Validate the curated layer with `wendkeep validate-memory` (cap 25 lines, 3 sections, no secrets/PII).
+7. Seed the **definitions layer**: `.brain/agents/` + `.brain/skills/` (versioned source of truth for custom agents/skills, with a README + one example each). Run `wendkeep sync-defs` to copy them into the project's agent dirs (`.brain/agents/*.toml` → `.codex/agents/`, `.brain/skills/<name>/` → `.claude/skills/`).
 
 ```bash
 npx wendkeep init --vault "~/vaults/work" --project . --yes   # non-interactive (companions: context-mode)

package/bin/wendkeep.mjs

@@ -40,6 +40,12 @@ Usage:
                            agent's JSON on stdin. Names: ${RUNNABLE_HOOKS.join(', ')}.
 
   wendkeep doctor [--vault P]  Run a vault health check.
+  wendkeep validate-memory [path]  Validate .brain/CORE.md against the compaction
+                           protocol (cap 25, 3 sections, no secrets/PII). Uses
+                           --vault <path> or OBSIDIAN_VAULT_PATH if no path given.
+  wendkeep sync-defs [opts]    Copy versioned defs from the vault's .brain into the
+                           project: .brain/agents/*.toml -> .codex/agents,
+                           .brain/skills/<name> -> .claude/skills. --vault P --project P.
   wendkeep --version           Print version.
   wendkeep --help              Show this help.
 `;
@@ -80,6 +86,16 @@ async function main() {
       runDoctor(rest);
       break;
     }
+    case 'validate-memory': {
+      const { runValidateMemory } = await import('../src/validate-core.mjs');
+      runValidateMemory(rest);
+      break;
+    }
+    case 'sync-defs': {
+      const { runSyncDefs } = await import('../src/sync-defs.mjs');
+      runSyncDefs(rest);
+      break;
+    }
     case '--version':
     case '-v':
       process.stdout.write(`${version()}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Automatically capture AI coding agent sessions (Claude Code, Codex) as local Markdown in your Obsidian vault — turn-by-turn history, cost/token tracking, auto-extracted decisions/bugs/learnings, rendered in the graph. Local-first.",
   "type": "module",
   "bin": {

package/src/init.mjs

@@ -3,8 +3,7 @@
 // OBSIDIAN_VAULT_PATH into .claude/settings.json, and adds the mcpvault server to
 // .mcp.json. Idempotent: re-running only adds what is missing.
 import { spawnSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, isAbsolute, join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import {
@@ -19,8 +18,7 @@ import {
   companionSettingsPatch,
   companionMcpPatch,
   companionHookSpecs,
-  cavemanInstallerCommand,
-  cavemanInstallerUrl,
+  cavemanInstallCommand,
 } from './taxonomy.mjs';
 import { renderVaultReadme } from './vault-readme.mjs';
 import { canInteractiveSelect, selectCompanionsInteractive } from './companion-select.mjs';
@@ -31,6 +29,8 @@ import {
   graphColorGroups,
   mergeGraphColorGroups,
 } from './vault-theme.mjs';
+import { renderCoreSkeleton, renderCompactionProtocol } from './validate-core.mjs';
+import { seedDefinitions } from './sync-defs.mjs';
 
 function parseArgs(argv) {
   const args = { mcp: true, yes: false, force: false };
@@ -132,25 +132,16 @@ export function mergeMcp(existing, { vaultPath, withVault = true, companions = [
 // script to a temp file and runs it as a FILE — piping to iex/bash leaves the
 // script's self-path null and the installer aborts. Best-effort, fail-soft: the
 // Claude Code plugin entry is already wired regardless.
-async function runCavemanInstaller(log) {
-  const url = cavemanInstallerUrl();
-  const ext = process.platform === 'win32' ? 'ps1' : 'sh';
-  const tmp = join(tmpdir(), `wendkeep-caveman-install-${process.pid}.${ext}`);
-  log(`\n  caveman: fetching cross-agent installer (best-effort): ${url}`);
+function runCavemanInstaller(log) {
+  const cmd = cavemanInstallCommand();
+  log(`\n  caveman: running cross-agent installer (best-effort, Gemini skipped):\n    ${cmd}`);
   try {
-    const res = await fetch(url);
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    writeFileSync(tmp, await res.text(), 'utf8');
-    const cmd = cavemanInstallerCommand(process.platform, tmp);
-    log(`  caveman: running ${cmd.command} ${cmd.args.join(' ')}`);
-    const r = spawnSync(cmd.command, cmd.args, { stdio: 'inherit' });
+    const r = spawnSync(cmd, { stdio: 'inherit', shell: true });
     if (r.status !== 0) {
       log(`  [!] caveman installer exited ${r.status ?? '?'} — Claude Code plugin entry still wired; rerun manually if needed.`);
     }
   } catch (e) {
     log(`  [!] caveman installer skipped (${e.message}) — Claude Code plugin entry still wired.`);
-  } finally {
-    try { rmSync(tmp, { force: true }); } catch { /* temp cleanup best-effort */ }
   }
 }
 
@@ -255,7 +246,19 @@ export async function runInit(argv) {
     writeFileSync(readmePath, renderVaultReadme({ projectName: basename(projectPath), vaultPath, withMcp: args.mcp }), 'utf8');
     readmeNote = ', README.md created';
   }
-  log(`  [1/4] vault taxonomy: ${VAULT_FOLDERS.length} folders (${created} created)${readmeNote}`);
+  // Seed the curated memory layer (CORE.md) + the compaction-protocol doc. The
+  // DIGEST/index are auto-generated by the hooks; CORE is hand-curated, so we
+  // bootstrap it with the 3 required sections. Non-destructive.
+  const brainDir = join(vaultPath, '.brain');
+  mkdirSync(brainDir, { recursive: true });
+  const corePath = join(brainDir, 'CORE.md');
+  if (!existsSync(corePath)) writeFileSync(corePath, renderCoreSkeleton(), 'utf8');
+  const protoPath = join(brainDir, 'COMPACTION_PROTOCOL.md');
+  if (!existsSync(protoPath)) writeFileSync(protoPath, renderCompactionProtocol(), 'utf8');
+  // Seed the definitions layer (.brain/agents + .brain/skills): versioned source of
+  // truth for custom agents/skills. `wendkeep sync-defs` copies them to the agent dirs.
+  seedDefinitions(brainDir);
+  log(`  [1/4] vault taxonomy: ${VAULT_FOLDERS.length} folders (${created} created)${readmeNote}, .brain seeded (CORE + agents/skills)`);
 
   // 2. .claude/settings.json --------------------------------------------------
   const settingsPath = join(projectPath, '.claude', 'settings.json');
@@ -304,7 +307,7 @@ export async function runInit(argv) {
   // caveman has no MCP / agnostic-hook path: on non-Claude agents its skills come
   // from its own cross-agent installer. Best-effort, fail-soft — the Claude Code
   // plugin entry is already wired in settings.json regardless.
-  if (companions.includes('caveman')) await runCavemanInstaller(log);
+  if (companions.includes('caveman')) runCavemanInstaller(log);
 
   log('\nNext steps:');
   log(`  1. Open the vault in Obsidian: "Open folder as vault" -> ${vaultPath}`);

package/src/sync-defs.mjs

@@ -0,0 +1,123 @@
+// Definitions layer: versioned custom agents/skills live in the vault's .brain so
+// they travel with the project in git. They have no automatic consumer — agents
+// read them from their own dirs — so `wendkeep sync-defs` copies them there:
+//   .brain/agents/*.toml  -> <project>/.codex/agents/   (Codex agent format)
+//   .brain/skills/<name>/ -> <project>/.claude/skills/   (skill format)
+// .brain is the source of truth; re-run sync after editing. Copy (not symlink) for
+// cross-platform robustness.
+import { copyFileSync, cpSync, existsSync, mkdirSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+
+export function syncDefs(vaultBase, projectPath) {
+  const out = { agents: [], skills: [] };
+
+  const agentsSrc = join(vaultBase, '.brain', 'agents');
+  if (existsSync(agentsSrc)) {
+    const dest = join(projectPath, '.codex', 'agents');
+    for (const f of readdirSync(agentsSrc)) {
+      if (!f.endsWith('.toml')) continue; // README.md etc. are docs, not defs
+      mkdirSync(dest, { recursive: true });
+      copyFileSync(join(agentsSrc, f), join(dest, f));
+      out.agents.push(f);
+    }
+  }
+
+  const skillsSrc = join(vaultBase, '.brain', 'skills');
+  if (existsSync(skillsSrc)) {
+    for (const name of readdirSync(skillsSrc)) {
+      const dir = join(skillsSrc, name);
+      if (!statSync(dir).isDirectory()) continue; // skip skills/README.md
+      const dest = join(projectPath, '.claude', 'skills', name);
+      mkdirSync(dest, { recursive: true });
+      cpSync(dir, dest, { recursive: true });
+      out.skills.push(name);
+    }
+  }
+
+  return out;
+}
+
+// CLI entry for `wendkeep sync-defs`.
+export function runSyncDefs(argv) {
+  let vault;
+  let project;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--vault') vault = argv[++i];
+    else if (a.startsWith('--vault=')) vault = a.slice(8);
+    else if (a === '--project') project = argv[++i];
+    else if (a.startsWith('--project=')) project = a.slice(10);
+  }
+  const base = vault || process.env.OBSIDIAN_VAULT_PATH;
+  if (!base) {
+    process.stderr.write('wendkeep sync-defs: no vault. Pass --vault <path> or set OBSIDIAN_VAULT_PATH.\n');
+    process.exit(2);
+  }
+  const vaultBase = isAbsolute(base) ? base : resolve(process.cwd(), base);
+  const projectPath = resolve(project || process.cwd());
+  const r = syncDefs(vaultBase, projectPath);
+  process.stdout.write(
+    `wendkeep sync-defs: ${r.agents.length} agent(s) -> .codex/agents, ${r.skills.length} skill(s) -> .claude/skills\n`,
+  );
+  if (r.agents.length) process.stdout.write(`  agents: ${r.agents.join(', ')}\n`);
+  if (r.skills.length) process.stdout.write(`  skills: ${r.skills.join(', ')}\n`);
+  process.exit(0);
+}
+
+// --- seeding (init) ---------------------------------------------------------
+
+const AGENTS_README = `# .brain/agents — versioned custom agent definitions
+
+Canonical, versioned source for your project's custom agents (Codex \`.toml\` format).
+\`wendkeep sync-defs\` copies each \`*.toml\` here into \`<project>/.codex/agents/\` so the
+agent loads them. Edit here (source of truth); re-run \`wendkeep sync-defs\` after changes.
+`;
+
+const EXAMPLE_AGENT = `# Example custom agent (Codex format). Replace with your own.
+name = "example-agent"
+description = "An example custom agent. Describe when to use it."
+developer_instructions = "You are an example agent. State the role, rules, and output format here."
+nickname_candidates = [ "example" ]
+model = "gpt-5.5"
+`;
+
+const SKILLS_README = `# .brain/skills — versioned custom skill definitions
+
+Canonical, versioned source for your project's custom skills (\`<name>/SKILL.md\`).
+\`wendkeep sync-defs\` copies each skill folder here into \`<project>/.claude/skills/\` so
+the agent loads them. Edit here (source of truth); re-run \`wendkeep sync-defs\` after changes.
+`;
+
+const EXAMPLE_SKILL = `---
+name: example-skill
+description: An example custom skill. Replace with your own — describe the trigger here.
+---
+Use this skill when ... (describe when it applies).
+
+Rules:
+- (what the skill should do)
+`;
+
+function writeIfAbsent(path, content, created) {
+  if (!existsSync(path)) {
+    writeFileSync(path, content, 'utf8');
+    created.push(path);
+  }
+}
+
+// Seed the definitions layer in the vault's .brain (folders + README + one example
+// each). Non-destructive. Returns the list of paths created.
+export function seedDefinitions(brainDir) {
+  const created = [];
+  const agentsDir = join(brainDir, 'agents');
+  mkdirSync(agentsDir, { recursive: true });
+  writeIfAbsent(join(agentsDir, 'README.md'), AGENTS_README, created);
+  writeIfAbsent(join(agentsDir, 'example-agent.toml'), EXAMPLE_AGENT, created);
+
+  const exampleSkillDir = join(brainDir, 'skills', 'example-skill');
+  mkdirSync(exampleSkillDir, { recursive: true });
+  writeIfAbsent(join(brainDir, 'skills', 'README.md'), SKILLS_README, created);
+  writeIfAbsent(join(exampleSkillDir, 'SKILL.md'), EXAMPLE_SKILL, created);
+
+  return created;
+}

package/src/taxonomy.mjs

@@ -110,11 +110,8 @@ export const COMPANIONS = [
     default: false,
     marketplace: { source: 'git', url: 'https://github.com/JuliusBrussee/caveman.git' },
     plugin: 'caveman',
-    // No MCP, no agnostic hook: on non-Claude agents, run its own installer.
-    installer: {
-      sh: 'https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.sh',
-      ps1: 'https://raw.githubusercontent.com/JuliusBrussee/caveman/main/install.ps1',
-    },
+    // No MCP, no agnostic hook: on non-Claude agents, run its own installer
+    // (see cavemanInstallCommand — npx, non-interactive, Gemini excluded).
   },
 ];
 
@@ -178,21 +175,18 @@ export function companionHookSpecs(ids) {
   return specs;
 }
 
-// The caveman installer URL for this platform (.ps1 on Windows, .sh elsewhere).
-export function cavemanInstallerUrl(platform = process.platform) {
-  const { sh, ps1 } = COMPANION_BY_ID.caveman.installer;
-  return platform === 'win32' ? ps1 : sh;
-}
+// Agents wendkeep installs caveman into via its cross-agent installer. Gemini is
+// excluded on purpose: its CLI rejects caveman's agent tool names and crashes
+// (libuv assertion) mid-install. caveman has no --exclude flag — only an --only
+// allow-list — so we enumerate the agents we want by their stable slugs.
+export const CAVEMAN_AGENTS = ['claude', 'codex', 'cursor', 'copilot', 'amp', 'antigravity'];
 
-// Command to run caveman's installer FROM A LOCAL FILE. We download the script to a
-// temp file and run it as a file (not `irm|iex` / `curl|bash`) so the script gets a
-// real $PSCommandPath/$0 — piping to iex leaves that null and the installer aborts
-// ("cannot bind argument to parameter 'Path'"). Pure: returns {command, args}.
-export function cavemanInstallerCommand(platform = process.platform, scriptPath) {
-  if (platform === 'win32') {
-    return { command: 'powershell', args: ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath] };
-  }
-  return { command: 'bash', args: [scriptPath] };
+// Non-interactive command installing caveman to CAVEMAN_AGENTS (never Gemini). Runs
+// the published installer directly via npx (no install.ps1, so no $PSCommandPath
+// issue). Returned as a shell string; the caller spawns it with shell: true.
+export function cavemanInstallCommand(agents = CAVEMAN_AGENTS) {
+  const only = agents.flatMap((a) => ['--only', a]).join(' ');
+  return `npx -y github:JuliusBrussee/caveman -- --non-interactive ${only}`;
 }
 
 // Derive the default vault folder name from the project folder: `.<project>-vault`.

package/src/validate-core.mjs

@@ -0,0 +1,156 @@
+// Memory-compaction protocol for the curated .brain/CORE.md layer.
+// Ported from NutriGym-Vision's scripts/validate-brain-core.js to ESM:
+//   - cap 25 lines (hard), 22 (soft warning) — 1 durable item per line
+//   - 3 required sections
+//   - no secrets / no real-provider PII emails
+// Plus the seeded skeleton and the protocol reference doc.
+
+import { existsSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+
+const HARD_LIMIT = 25;
+const SOFT_LIMIT = 22;
+
+const REQUIRED_SECTIONS = [
+  { label: 'Preferências do Usuário', regex: /^##\s+Prefer[êe]ncias\s+do\s+Usu[áa]rio\s*$/im },
+  { label: 'Padrões Ativos', regex: /^##\s+Padr[õo]es\s+Ativos\s*$/im },
+  { label: 'Pendências Abertas', regex: /^##\s+Pend[êe]ncias\s+Abertas\s*$/im },
+];
+
+// Secret patterns reject only "real" values (length floor); abstract mentions like
+// `sk_*` / `whsec_*` (trailing asterisk) are allowed.
+const SECRET_PATTERNS = [
+  { name: 'Stripe secret key', regex: /\bsk_(?:live|test)_[A-Za-z0-9]{20,}\b/ },
+  { name: 'Stripe webhook secret', regex: /\bwhsec_[A-Za-z0-9]{20,}\b/ },
+  { name: 'JWT token', regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/ },
+  { name: 'Bearer token', regex: /\bBearer\s+[A-Za-z0-9._-]{20,}\b/i },
+  { name: 'OpenAI API key', regex: /\bsk-[A-Za-z0-9]{40,}\b/ },
+  { name: 'Anthropic API key', regex: /\bsk-ant-[A-Za-z0-9_-]{40,}\b/ },
+  { name: 'Google API key', regex: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+];
+
+const PII_EMAIL_REGEX = /\b[A-Za-z0-9._%+-]+@(?!example\.(?:com|org|net)\b)(?:gmail|hotmail|yahoo|outlook|live|icloud|protonmail)\.[A-Za-z]{2,}\b/i;
+
+// Validate CORE.md content. Returns { ok, errors, warnings, lineCount }.
+export function validateCore(content) {
+  const text = String(content ?? '');
+  const lines = text.split('\n');
+  const lineCount = text.endsWith('\n') ? lines.length - 1 : lines.length;
+  const errors = [];
+
+  if (lineCount > HARD_LIMIT) {
+    errors.push(`Tamanho ${lineCount} > ${HARD_LIMIT} linhas (hard limit). Curar: remover itens resolvidos (detalhe vive no vault/git).`);
+  }
+  for (const { label, regex } of REQUIRED_SECTIONS) {
+    if (!regex.test(text)) errors.push(`Seção obrigatória ausente: ## ${label}`);
+  }
+  for (const { name, regex } of SECRET_PATTERNS) {
+    const m = text.match(regex);
+    if (m) errors.push(`Possível ${name} detectado: "${m[0].slice(0, 30)}..." — substituir por [REDACTED_SECRET].`);
+  }
+  const em = text.match(PII_EMAIL_REGEX);
+  if (em) errors.push(`Email real detectado: "${em[0]}" — usar user@example.com.`);
+
+  const warnings = [];
+  if (lineCount >= SOFT_LIMIT && lineCount <= HARD_LIMIT) {
+    warnings.push(`Tamanho ${lineCount}/${HARD_LIMIT} linhas — perto do limite; remover itens resolvidos (≥${SOFT_LIMIT}).`);
+  }
+
+  return { ok: errors.length === 0, errors, warnings, lineCount };
+}
+
+// The seeded CORE.md (must pass validateCore). Bootstraps the 3 sections so the
+// curated hot layer exists with the right shape from day one.
+export function renderCoreSkeleton() {
+  return `# CORE — núcleo curado da memória (.brain)
+
+> REGRA #1 — memória canônica do projeto. Curado à mão, cap 25 linhas (valide: \`wendkeep validate-memory\`). Volátil vive no DIGEST.md (auto). Profundidade: /brain-recall <tópico>.
+
+## Preferências do Usuário
+- (preferências duráveis: idioma, estilo, convenções)
+
+## Padrões Ativos
+- (padrões/arquitetura ativos que outro agente precise saber)
+
+## Pendências Abertas
+- (pendências/decisões em aberto — remova quando resolvidas)
+`;
+}
+
+// The compaction-protocol reference doc dropped into the vault.
+export function renderCompactionProtocol() {
+  return `# Protocolo de Memória — núcleo curado + digest automático (.brain)
+
+> Como cada agente recebe, consulta e persiste memória entre sessões no seu vault.
+
+## 1. Duas camadas
+
+- **QUENTE** (auto-injetada por sessão, budget ~45 linhas):
+  - \`.brain/CORE.md\` — curado à mão, **≤25 linhas** (1 item/linha): preferências, padrões, pendências.
+  - \`.brain/DIGEST.md\` — auto-gerado (0 token LLM, ≤15 linhas): decisões/sessões/bugs/aprendizados recentes.
+- **FRIA** (sob demanda):
+  - \`.brain/index.jsonl\` — índice de todas as sessões (1/linha, frontmatter).
+  - Vault: \`02-Sessões/**\`, \`04-Decisões/**\`, \`05-Bugs/**\`, \`06-Aprendizados/**\`. Desce via \`/brain-recall <tópico>\`.
+
+## 2. Compactação = regra de geração (sem trabalho manual)
+
+- **DIGEST se auto-compacta**: caps determinísticos (5 decisões, 4 sessões, 2 bugs, 2 aprendizados + \`+N mais\`). O velho cai do quente sozinho e permanece no índice/vault. **NUNCA editar** \`DIGEST.md\`/\`index.jsonl\`.
+- **CORE**: quando ≥22 linhas (soft warning), remover itens resolvidos/obsoletos — o detalhe já vive no vault e no histórico do git.
+
+## 3. O que escrever no CORE
+
+Só estado **durável** que outro agente precise saber — preferência, padrão ativo, pendência aberta. 1 linha por item. Nunca log de sessão (isso é automático no vault).
+
+3 seções fixas (obrigatórias): \`## Preferências do Usuário\`, \`## Padrões Ativos\`, \`## Pendências Abertas\`.
+
+## 4. Sem segredos / PII
+
+\`CORE.md\` nunca contém tokens (\`sk_*\`, \`whsec_*\`, JWT, Bearer), API keys, senhas ou email/telefone real. Use \`[REDACTED_SECRET]\` / \`user@example.com\`.
+
+## 5. Validação
+
+\`\`\`bash
+wendkeep validate-memory          # valida <vault>/.brain/CORE.md
+wendkeep validate-memory <path>   # valida outro arquivo
+\`\`\`
+
+Checa: cap 25 (soft 22), 3 seções, sem segredos/PII. Exit 0 = OK, 1 = falha.
+`;
+}
+
+// CLI entry for `wendkeep validate-memory [path]`. Resolves the target from an
+// explicit path, else <vault>/.brain/CORE.md (--vault or OBSIDIAN_VAULT_PATH).
+export function runValidateMemory(argv) {
+  let target;
+  let vault;
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--vault') vault = argv[++i];
+    else if (a.startsWith('--vault=')) vault = a.slice(8);
+    else if (!a.startsWith('-')) target = a;
+  }
+  if (!target) {
+    const base = vault || process.env.OBSIDIAN_VAULT_PATH;
+    if (!base) {
+      process.stderr.write('wendkeep validate-memory: no target. Pass a path, --vault <path>, or set OBSIDIAN_VAULT_PATH.\n');
+      process.exit(2);
+    }
+    target = join(base, '.brain', 'CORE.md');
+  }
+  const abs = isAbsolute(target) ? target : resolve(process.cwd(), target);
+  if (!existsSync(abs)) {
+    process.stderr.write(`wendkeep validate-memory: not found: ${abs}\n`);
+    process.exit(2);
+  }
+  const res = validateCore(readFileSync(abs, 'utf8'));
+  if (!res.ok) {
+    process.stderr.write(`❌  CORE.md viola protocolo (${res.errors.length} erro${res.errors.length > 1 ? 's' : ''}):\n`);
+    for (const e of res.errors) process.stderr.write(`   - ${e}\n`);
+    process.stderr.write('\nProtocolo: .brain/COMPACTION_PROTOCOL.md\n');
+    process.exit(1);
+  }
+  let msg = `✅  CORE.md OK (${res.lineCount} linhas, 3/3 seções, sem segredos).`;
+  for (const w of res.warnings) msg += `\n   ⚠  ${w}`;
+  process.stdout.write(`${msg}\n`);
+  process.exit(0);
+}