wendkeep 0.58.1 → 0.59.0

package/src/sync-defs.mjs

@@ -58,14 +58,23 @@ function renderAgentsSection(skills, sourceHash = '') {
   const list = skills.map((s) => `- **${s.name}** — ${s.description}`).join('\n');
   return `${AG_START}
 <!-- wendkeep-version: ${WENDKEEP_VERSION}; skills-sha256: ${sourceHash} -->
-## wendkeep — process skills & loop
+## wendkeep — Keep Core & operating profiles
 
-This project uses the [wendkeep](https://github.com/rogersialves/wendkeep) harness. Work
-through its change loop: \`wendkeep change new <slug>\` → implement tasks test-first
-(tag proof \`[sensor:id]\` and requirement \`[req:ID]\`) → \`wendkeep verify\` →
-\`wendkeep verify --deep\` + an independent read-only verification pass writing
-\`verdict.json\` → \`wendkeep change archive\` (gated). Inspect with \`wendkeep change
-status\` / \`spec effective --change <slug>\` / \`sensors list\`. Author specs only in
+This project uses the [wendkeep](https://github.com/rogersialves/wendkeep) harness. **Keep Core is always active**
+in every profile: Vault, session, identity, memory, lessons, and persistence integrations.
+The effective profile is selected explicitly; missing or invalid configuration uses **GOVERN as the default**.
+
+Route work by the effective profile:
+- **OFF** — Wend Runtime is disabled and governance belongs to the native LLM harness; Keep Core stays active.
+- **FLOW** — Execute → Validate through \`wendkeep flow start/finish\`, without creating a change.
+- **GUIDE** — Plan → Execute → Validate through a compact change.
+- **GOVERN** — the default a2 loop: \`wendkeep change new <slug>\` → review → implement tasks test-first
+  (tag proof \`[sensor:id]\` and requirement \`[req:ID]\`) → \`wendkeep verify\` →
+  \`wendkeep verify --deep\` + independent read-only verdict → \`wendkeep change archive\`.
+- **ASSURE** — GOVERN plus explicit confirmation and handoff.
+
+Inspect with \`wendkeep profile status\` / \`wendkeep change status\` /
+\`spec effective --change <slug>\` / \`sensors list\`. Author specs only in
 \`08-Mudanças/<slug>/specs/\`; \`07-Specs\` is generated and must not be edited directly.
 
 Process skills (full text in \`.claude/skills/\`, \`.agents/skills/\`, and the vault's \`.brain/skills/\`):

package/src/sync.mjs

@@ -22,6 +22,9 @@ const step = (n, label) => process.stdout.write(`\n[${n}/3] ${label}\n`);
 export async function runSync(argv) {
   const projectRaw = opt(argv, '--project');
   const vaultRaw = opt(argv, '--vault');
+  const hasProfile = argv.includes('--profile') || argv.some((a) => a.startsWith('--profile='));
+  const profileRaw = opt(argv, '--profile');
+  const profileArgs = hasProfile ? ['--profile', profileRaw] : [];
   const projectPath = resolve(projectRaw && !projectRaw.startsWith('--') ? projectRaw : process.cwd());
   const passthrough = argv.filter((a) => a === '--yes' || a === '-y' || a === '--force');
 
@@ -29,7 +32,12 @@ export async function runSync(argv) {
   step(1, 'init');
   const { runInit } = await import('./init.mjs');
   try {
-    await runInit(['--project', projectPath, ...(vaultRaw ? ['--vault', vaultRaw] : []), ...passthrough]);
+    await runInit([
+      '--project', projectPath,
+      ...(vaultRaw ? ['--vault', vaultRaw] : []),
+      ...profileArgs,
+      ...passthrough,
+    ]);
   } catch (error) {
     process.stderr.write(`wendkeep sync: init falhou — ${error.message}\n`);
     return 1;

package/src/taxonomy.mjs

@@ -37,6 +37,15 @@ export const HOOK_FILES = [
   'memory-schema.mjs',
   'memory-store.mjs',
   'memory-handoff.mjs',
+  'session-memory-lifecycle.mjs',
+  'session-note-io.mjs',
+  'operating-profile-runtime.mjs',
+  'git-snapshot.mjs',
+  'flow-protected-policy.mjs',
+  'session-iteration.mjs',
+  'vault-path-safety.mjs',
+  'vault-runtime-store.mjs',
+  'flow-core.mjs',
   'change-core.mjs',
   'spec-core.mjs',
   'sensors-core.mjs',

package/src/validate-memory.mjs

@@ -1,16 +1,29 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { validateMemoryEvent, validateSharedMemory } from '../hooks/memory-schema.mjs';
+import { assertVaultPathSafe } from '../hooks/vault-path-safety.mjs';
 import { validateCore } from './validate-core.mjs';
 
 function failedComponent(errors, extra = {}) {
   return { ok: false, errors: Array.isArray(errors) ? errors : [errors], warnings: [], ...extra };
 }
 
-function readRequired(path, label) {
-  if (!existsSync(path)) return { ok: false, error: `${label} ausente: ${path}` };
+function readRequired(vaultBase, path, label) {
+  let checked;
   try {
-    return { ok: true, content: readFileSync(path, 'utf8') };
+    checked = assertVaultPathSafe(vaultBase, path, {
+      expectedType: 'file', label: `artefato ${label}`,
+    });
+  } catch (error) {
+    return { ok: false, error: `${label} inseguro: ${error?.message || error}` };
+  }
+  if (!checked.exists) return { ok: false, error: `${label} ausente: ${path}` };
+  try {
+    // Deliberately adjacent to the open performed by readFileSync.
+    checked = assertVaultPathSafe(vaultBase, checked.target, {
+      allowMissing: false, expectedType: 'file', label: `artefato ${label}`,
+    });
+    return { ok: true, content: readFileSync(checked.target, 'utf8') };
   } catch (error) {
     return { ok: false, error: `${label} ilegível: ${error?.message || error}` };
   }
@@ -18,7 +31,7 @@ function readRequired(path, label) {
 
 export function readProjectForValidation(vaultBase) {
   const path = join(vaultBase, '.brain', 'PROJECT.json');
-  const read = readRequired(path, 'PROJECT.json');
+  const read = readRequired(vaultBase, path, 'PROJECT.json');
   if (!read.ok) return failedComponent(read.error, { projectId: '', path });
   try {
     const marker = JSON.parse(read.content);
@@ -34,7 +47,7 @@ export function readProjectForValidation(vaultBase) {
 /** Read and validate the append-only JSONL authority without repairing or mutating it. */
 export function readLedgerForValidation(vaultBase, { projectId } = {}) {
   const path = join(vaultBase, '.brain', 'MEMORY_EVENTS.jsonl');
-  const read = readRequired(path, 'MEMORY_EVENTS.jsonl');
+  const read = readRequired(vaultBase, path, 'MEMORY_EVENTS.jsonl');
   if (!read.ok) return failedComponent(read.error, { events: [], eventIds: new Set(), path });
 
   const errors = [];
@@ -79,14 +92,14 @@ export function readLedgerForValidation(vaultBase, { projectId } = {}) {
 
 function validateCoreArtifact(vaultBase) {
   const path = join(vaultBase, '.brain', 'CORE.md');
-  const read = readRequired(path, 'CORE.md');
+  const read = readRequired(vaultBase, path, 'CORE.md');
   if (!read.ok) return failedComponent(read.error, { lineCount: 0, path });
   return { ...validateCore(read.content), path, content: read.content };
 }
 
 function validateSharedArtifact(vaultBase, eventIds) {
   const path = join(vaultBase, '.brain', 'SHARED_MEMORY.md');
-  const read = readRequired(path, 'SHARED_MEMORY.md');
+  const read = readRequired(vaultBase, path, 'SHARED_MEMORY.md');
   if (!read.ok) return failedComponent(read.error, { path });
   return { ...validateSharedMemory(read.content, { eventIds }), path, content: read.content };
 }

package/src/verify.mjs

@@ -4,7 +4,14 @@
 import { readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { isAbsolute, join, resolve } from 'node:path';
 import { parseTasks, activeChange, appendFixTasks, healSpecBacklinks } from '../hooks/change-core.mjs';
-import { loadSensorsDetailed, findProjectRoot, requiredSensors, runSensors, evaluateGate } from '../hooks/sensors-core.mjs';
+import {
+  loadSensorsDetailed,
+  findProjectRoot,
+  requiredSensors,
+  runSensors,
+  evaluateGate,
+  sensorProcessEnv,
+} from '../hooks/sensors-core.mjs';
 import {
   buildEffectiveRequirementPackage,
   captureSpecBaseline,
@@ -54,7 +61,10 @@ export function runVerify(argv) {
     process.stderr.write(`wendkeep verify: wendkeep.sensors.json não encontrado em ${loaded.path} — rode da raiz do projeto ou use --project <raiz>\n`);
   }
   const sensors = loaded.sensors;
-  const evidence = runSensors(sensors, ids, { cwd: projectRoot });
+  const evidence = runSensors(sensors, ids, {
+    cwd: projectRoot,
+    env: sensorProcessEnv(vaultBase),
+  });
   writeFileSync(join(changeDir, 'evidencia.json'), `${JSON.stringify(evidence, null, 2)}\n`, 'utf8');
   // Freshness seal: bind this evidence to the tarefas.md it was produced against, so the archive
   // gate can reject evidence gone stale (a sensor task added after this verify run).