wendkeep 0.70.0 → 0.71.1

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to **wendkeep** are documented here. Format based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.71.1] — 2026-08-17
+
+### Added
+
+- **Observer memory authority.** O container local agora recebe a cópia integral das sessões,
+  decisões, bugs, aprendizados, specs, changes, CORE, DIGEST, SHARED_MEMORY e estado do brain.
+  A API oferece árvore, leitura completa, busca por corpo, sincronização, modos
+  `mirror`/`container-read`/`container-authority` e exportação read-only.
+- **Workspace de memória no navegador.** O painel local navega por projeto, sessões, memória,
+  changes, sincronização e leitor Markdown completo, sem formulário ou token no loopback.
+- **Importação do WendKeep.** `observer memory import` registra a carga inicial e informa paridade
+  por arquivo e hash; o volume Docker permanece preservado em rebuild e reinício.
+
+### Fixed
+
+- **Observer local abre diretamente.** O dashboard não exige mais token, formulário ou
+  `Authorization` para consultar a projeção no loopback; o compose também inicia sem variável de
+  token obrigatória.
+
+## [0.71.0] — 2026-08-17
+
+### Added
+
+- **Painel web local do Observer.** O servidor agora entrega uma interface read-only no navegador
+  para consultar projetos, saúde, sessões, changes e snapshots sanitizados da última captura. A interface é empacotada no
+  npm e na imagem Docker, exige o token local para consultar `/v1`, mantém o token somente no
+  `sessionStorage` da aba e
+  não amplia o contrato de dados sanitizados.
+
 ## [0.70.0] — 2026-08-17
 
 ### Added

package/README.en.md

@@ -78,7 +78,7 @@ npx wendkeep import                          # backfill past Claude + Codex sess
 
 ## The problem: the context dies when the window closes
 
-Decisions, dead ends, the reason you chose X over Y — gone next session. The pieces to fix that exist but are scattered (qmd‑sessions, memsearch, Nexus, hand‑written hooks). wendkeep ships them as one turnkey package that writes into a knowledge graph **inside the Obsidian vault you already use** — no manual setup, no snapshot to keep in sync.
+Decisions, dead ends, the reason you chose X over Y — gone next session. The pieces to fix that exist but are scattered (qmd‑sessions, memsearch, Nexus, hand‑written hooks). wendkeep ships local capture plus an optional Docker Observer that keeps complete memory browsable without depending on Obsidian.
 
 | | |
 |---|---|
@@ -88,7 +88,7 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps a local HTTP index of sanitized, idempotent snapshots; vaults remain local, the container does not mount them, and unavailable hooks use an outbox without blocking the session. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps snapshots plus a complete copy of sessions, decisions, bugs, learnings, specs, and changes in the Docker volume; the read-only dashboard opens directly at `http://127.0.0.1:8787/`, local mode has no token, and unavailable hooks use an outbox without blocking the session. |
 
 ## Requirements
 

package/README.md

@@ -78,7 +78,7 @@ npx wendkeep import                          # backfill past Claude + Codex sess
 
 ## The problem: the context dies when the window closes
 
-Decisions, dead ends, the reason you chose X over Y — gone next session. The pieces to fix that exist but are scattered (qmd‑sessions, memsearch, Nexus, hand‑written hooks). wendkeep ships them as one turnkey package that writes into a knowledge graph **inside the Obsidian vault you already use** — no manual setup, no snapshot to keep in sync.
+Decisions, dead ends, the reason you chose X over Y — gone next session. The pieces to fix that exist but are scattered (qmd‑sessions, memsearch, Nexus, hand‑written hooks). wendkeep ships local capture plus an optional Docker Observer that keeps complete memory browsable without depending on Obsidian.
 
 | | |
 |---|---|
@@ -88,7 +88,7 @@ Decisions, dead ends, the reason you chose X over Y — gone next session. The p
 | **Cost** — what it all cost | Per‑model, cache‑aware token pricing per session — plus `cost --trend` with a run‑rate projection across the whole vault; research previews without a final rate remain unestimated. |
 | **Multi‑agent** — one vault, both agents | `init` wires the session hooks into `.claude/settings.json` *and* `.codex/hooks.json`, and every note is tagged with the agent that wrote it: Claude Code is detected from its environment, anything else is recorded as Codex. One shared graph, whichever agent you are in. |
 | **Local‑first** — no cloud, no account | Everything is plain Markdown on your disk. An optional MCP server (`@bitbonsai/mcpvault`) lets the agent read/write the vault. |
-| **Local Observer** — many projects, one view | `wendkeep observer` keeps a local HTTP index of sanitized, idempotent snapshots; vaults remain local, the container does not mount them, and unavailable hooks use an outbox without blocking the session. |
+| **Local Observer** — many projects, one view | `wendkeep observer` keeps snapshots plus a complete copy of sessions, decisions, bugs, learnings, specs, and changes in the Docker volume; the read-only dashboard opens directly at `http://127.0.0.1:8787/`, local mode has no token, and unavailable hooks use an outbox without blocking the session. |
 
 ## Requirements
 

package/docs/en/commands/observer.md

@@ -4,23 +4,25 @@
 
 ## Purpose
 
-The Observer consolidates observability for multiple WendKeep projects in a local service without
-copying or taking ownership of their vaults.
+The Observer consolidates observability for multiple WendKeep projects in a local service and
+stores a complete copy of the memory published by hooks in the Docker volume. The content can be
+browsed and searched in the container without depending on Obsidian for queries.
 
 ## When to use
 
-Use it to query summarized changes, sessions, tasks, and health across projects through one local
-projection while each vault remains authoritative.
+Use it to query changes, sessions, decisions, bugs, learnings, specs, brain documents, and health
+across projects through one local memory. During the transition, the vault is preserved as a
+recovery copy; the Observer is authoritative for queries made through its container.
 
 ## When not to use
 
 Do not use the Observer to edit, complete, or archive changes, curate memory, store transcripts,
-or replace local hooks. Do not expose it to the network in this version.
+or expose the service to the network. Edits still go through local WendKeep hooks.
 
 ## Prerequisites
 
-Initialize projects with WendKeep, explicitly register each project, and set a local token before
-starting the HTTP server.
+Initialize projects with WendKeep and explicitly register each project before starting the HTTP
+server. The default local mode has no token to configure.
 
 ## Syntax
 
@@ -28,6 +30,7 @@ starting the HTTP server.
 npx wendkeep observer status --data-dir <directory> --json
 npx wendkeep observer register --project <project> --vault <vault> --data-dir <directory>
 npx wendkeep observer publish --project <project> --vault <vault> --data-dir <directory>
+npx wendkeep observer memory import --project <project> --vault <vault> --url http://127.0.0.1:8787 --json
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 ```
 
@@ -35,17 +38,17 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <directory>
 
 - `--data-dir` selects the local event and index directory; the default is
   `WENDKEEP_OBSERVER_DATA_DIR` or `~/.wendkeep-observer`.
-- `--project` and `--vault` identify a project only for `register` and `publish`.
+- `--project` and `--vault` identify a project for `register`, `publish`, and `memory import`.
 - `--host` accepts only `127.0.0.1`, `localhost`, or `::1`; other hosts are rejected before
   listening.
-- `--token` or `WENDKEEP_OBSERVER_TOKEN` protects `/v1`; `GET /healthz` exposes no project data.
+- `/v1` is open in the default local mode; keep `--host 127.0.0.1` and do not publish the port on
+  a network address.
 - Exit `0` means success; exit `1` means configuration or operation failure; the publisher hook
   also returns `0` when the Observer is unavailable.
 
 ## Examples
 
 ```powershell
-$env:WENDKEEP_OBSERVER_TOKEN = '<local-token>'
 npx wendkeep observer register --project C:\GitHub\WendKeep --vault C:\GitHub\WendKeep\.WendKeep-vault --data-dir C:\WendKeepObserver
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver
 $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
@@ -54,30 +57,46 @@ $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
 For local Docker:
 
 ```powershell
-$env:WENDKEEP_OBSERVER_TOKEN = '<local-token>'
 docker compose -f docker/wendkeep-observer/compose.yaml up -d --build
 ```
 
+## Local web dashboard
+
+With the server running, open [http://127.0.0.1:8787/](http://127.0.0.1:8787/) in a browser. The
+dashboard is served by the same process and opens directly, without a form or token. Keep the port
+bound to the computer loopback; do not expose this address on a network interface.
+
+The dashboard shows the multi-project list, version, health, latest session, active change, change
+count, and last capture time. Opening a project exposes Overview, Sessions, Memory, Changes, and
+Sync screens. Each list opens the complete Markdown document in a read-only reader, with local
+filtering, body search, and a source toggle. Loading, empty, unavailable-server, conflict, and
+stale-data states are visible, with manual refresh and an automatic 15-second refresh.
+
+If the browser shows the shell but the list fails, check the service health at
+`http://127.0.0.1:8787/healthz` and confirm that the container is running.
+
 ## Expected result
 
-`register` stores only `project_id`, name, version, and registration time. `publish` reads the
-local vault, produces a sanitized snapshot, and sends an idempotent event. The container stores
-only `EVENTS.jsonl` and `INDEX.json` in the `observer-data` volume; it does not mount `C:\GitHub`
-or any `.WendKeep-vault`.
+`register` stores `project_id`, name, version, and registration time. `publish` reads the local
+vault, produces the snapshot, and also sends idempotent events containing the complete content of
+sessions, decisions, bugs, learnings, specs, changes, CORE, DIGEST, SHARED_MEMORY, and brain
+state. The container stores Markdown under `/data/memory` plus `MEMORY_EVENTS.jsonl` and
+`MEMORY_INDEX.json` in the `observer-data` volume; it does not mount `C:\GitHub` or any
+`.WendKeep-vault`. `memory import` performs the initial load and returns file/hash parity.
 
 `init` projects `observer-publish` into `SessionStart` and `Stop` after the primary hooks. Without
-`WENDKEEP_OBSERVER_URL`, the hook is a no-op. When the server is stopped, it writes to
-`.brain/observer-outbox/` and does not block the session; a later run retries pending events.
+`WENDKEEP_OBSERVER_URL`, the hook is a no-op. When the server is stopped, it writes snapshots to
+`.brain/observer-outbox/` and complete memory to `.brain/observer-memory-outbox/` without blocking
+the session; a later run retries both event types.
 
 ## Common errors and diagnosis
 
 - `project_not_registered`: run `observer register` before publishing.
-- `unauthorized`: check `Authorization: Bearer <token>` and `WENDKEEP_OBSERVER_TOKEN`.
 - `host loopback`: replace `0.0.0.0` or a LAN address with `127.0.0.1`.
 - Pending outbox: the service was unavailable; preserve `.brain/observer-outbox/` and rerun the
   publisher. Do not delete events manually.
-- The Observer does not read raw content, paths, transcripts, or memory; such rejections are
-  expected and should be investigated at the snapshot source.
+- If memory is incomplete, check the Sync screen, preserve the outbox, and run
+  `observer memory import` to rebuild the copy from the vault.
 
 ## Next steps
 
@@ -87,9 +106,9 @@ projection.
 
 ## Data authority
 
-Each project vault remains authoritative for sessions, changes, tasks, memory, and evidence. The
-Observer is a read-only, rebuildable projection; its queries do not complete, archive, repair, or
-promote state in a vault.
+The container is canonical for Observer queries and stores the complete published content. The
+vault remains preserved locally during migration as a transition and recovery copy; Observer
+screens do not complete, archive, repair, or promote state.
 
 ## Minimal API
 
@@ -97,8 +116,15 @@ promote state in a vault.
 - `GET /v1/projects` — projects with an accepted snapshot.
 - `GET /v1/projects/:project_id` — the latest project snapshot.
 - `GET /v1/projects/:project_id/changes` — change summary from the snapshot.
-- `PUT /v1/projects/:project_id` — authenticated explicit registration.
-- `POST /v1/projects/:project_id/snapshot` — authenticated idempotent ingestion.
-
-The `/v1` routes reject oversized bodies and never accept vault paths, transcripts, secrets, or raw
-memory content.
+- `PUT /v1/projects/:project_id` — explicit local registration.
+- `POST /v1/projects/:project_id/snapshot` — idempotent local ingestion.
+- `GET /v1/projects/:project_id/memory/tree` — document tree and metadata.
+- `GET /v1/projects/:project_id/memory/document?path=...` — complete Markdown content.
+- `GET /v1/projects/:project_id/memory/search?q=...` — path and body search.
+- `GET /v1/projects/:project_id/sync` — mode, counts, conflicts, and latest event.
+- `PUT /v1/projects/:project_id/sync` — explicitly changes the local mode.
+- `GET /v1/projects/:project_id/memory/export` — read-only export with complete content.
+- `POST /v1/projects/:project_id/memory/events` — idempotent batch ingestion.
+
+The `/v1` routes reject oversized bodies and validate project, path, revision, hash, and
+isolation before writing content to the volume.

package/docs/pt-BR/commands/observer.md

@@ -4,23 +4,26 @@
 
 ## Objetivo
 
-O Observer consolida a observabilidade de vários projetos WendKeep em um serviço local, sem
-copiar ou assumir a propriedade dos vaults.
+O Observer consolida a observabilidade de vários projetos WendKeep em um serviço local e grava no
+volume Docker uma cópia integral da memória publicada pelos hooks. O conteúdo fica disponível
+para navegação e busca no próprio container, sem depender do Obsidian para consulta.
 
 ## Quando usar
 
-Use para consultar changes, sessões, tarefas resumidas e saúde de vários projetos em uma única
-projeção local, mantendo cada vault como fonte oficial.
+Use para consultar changes, sessões, decisões, bugs, aprendizados, specs, documentos do brain e
+saúde de vários projetos em uma única memória local. Durante a transição, o vault continua sendo
+preservado como cópia de origem para recuperação; o Observer é a autoridade de consulta do seu
+container.
 
 ## Quando não usar
 
 Não use o Observer para editar, concluir ou arquivar changes, curar memória, armazenar transcripts
-ou substituir os hooks locais. Não o exponha na rede nesta versão.
+ou expor o serviço na rede. As edições continuam passando pelos hooks e pelo WendKeep local.
 
 ## Pré-requisitos
 
-Tenha os projetos inicializados com WendKeep, registre explicitamente cada projeto e defina um
-token local antes de iniciar o servidor HTTP.
+Tenha os projetos inicializados com WendKeep e registre explicitamente cada projeto antes de
+iniciar o servidor HTTP. No modo local padrão não há token para configurar.
 
 ## Sintaxe
 
@@ -28,6 +31,7 @@ token local antes de iniciar o servidor HTTP.
 npx wendkeep observer status --data-dir <diretório> --json
 npx wendkeep observer register --project <projeto> --vault <vault> --data-dir <diretório>
 npx wendkeep observer publish --project <projeto> --vault <vault> --data-dir <diretório>
+npx wendkeep observer memory import --project <projeto> --vault <vault> --url http://127.0.0.1:8787 --json
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <diretório>
 ```
 
@@ -35,18 +39,17 @@ npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir <diretório>
 
 - `--data-dir` escolhe o diretório local de eventos e índice; o padrão é
   `WENDKEEP_OBSERVER_DATA_DIR` ou `~/.wendkeep-observer`.
-- `--project` e `--vault` identificam o projeto somente nos comandos `register` e `publish`.
+- `--project` e `--vault` identificam o projeto nos comandos `register`, `publish` e `memory import`.
 - `--host` aceita somente `127.0.0.1`, `localhost` ou `::1`; outros hosts são recusados antes do
   listen.
-- `--token` ou `WENDKEEP_OBSERVER_TOKEN` protege as rotas `/v1`; `GET /healthz` permanece sem
-  dados de projeto.
+- as rotas `/v1` ficam abertas no modo local padrão; mantenha `--host 127.0.0.1` e não publique a
+  porta em um endereço de rede.
 - Exit `0` indica sucesso; exit `1` indica falha de configuração ou operação; o hook publisher
   também retorna `0` quando o Observer está indisponível.
 
 ## Exemplos
 
 ```powershell
-$env:WENDKEEP_OBSERVER_TOKEN = '<token-local>'
 npx wendkeep observer register --project C:\GitHub\WendKeep --vault C:\GitHub\WendKeep\.WendKeep-vault --data-dir C:\WendKeepObserver
 npx wendkeep observer serve --host 127.0.0.1 --port 8787 --data-dir C:\WendKeepObserver
 $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
@@ -55,31 +58,47 @@ $env:WENDKEEP_OBSERVER_URL = 'http://127.0.0.1:8787'
 Para Docker local:
 
 ```powershell
-$env:WENDKEEP_OBSERVER_TOKEN = '<token-local>'
 docker compose -f docker/wendkeep-observer/compose.yaml up -d --build
 ```
 
+## Painel web local
+
+Com o servidor em execução, abra [http://127.0.0.1:8787/](http://127.0.0.1:8787/) no navegador.
+O painel é servido pelo mesmo processo e abre diretamente, sem formulário ou token. A porta fica
+presa ao loopback do computador; não coloque o endereço em uma interface de rede.
+
+O painel mostra a lista multi-projeto, versão, saúde, sessão mais recente, change ativa, contagem
+de changes e data da última captura. Ao abrir um projeto, o workspace oferece as telas Overview,
+Sessões, Memória, Changes e Sincronização. Cada lista abre o documento Markdown completo em um
+leitor read-only, com filtro local, busca no corpo e alternância para a fonte. Os estados de
+carregamento, vazio, servidor indisponível, conflito e dados desatualizados ficam visíveis, e a
+atualização pode ser manual ou automática a cada 15 segundos.
+
+Se o navegador mostrar a tela mas a lista falhar, confirme a saúde em
+`http://127.0.0.1:8787/healthz` e verifique se o container está em execução.
+
 ## Resultado esperado
 
-`register` grava apenas `project_id`, nome, versão e data de registro. `publish` lê o vault local,
-produz um snapshot sanitizado e envia um evento idempotente. O container mantém somente
-`EVENTS.jsonl` e `INDEX.json` no volume `observer-data`; não monta `C:\GitHub` nem qualquer
-`.WendKeep-vault`.
+`register` grava `project_id`, nome, versão e data de registro. `publish` lê o vault local,
+produz o snapshot e também envia eventos idempotentes com o conteúdo integral das sessões,
+decisões, bugs, aprendizados, specs, changes, CORE, DIGEST, SHARED_MEMORY e estado do brain. O
+container grava os Markdown em `/data/memory` e mantém `MEMORY_EVENTS.jsonl` e
+`MEMORY_INDEX.json` no volume `observer-data`; não monta `C:\GitHub` nem qualquer
+`.WendKeep-vault`. `memory import` faz a carga inicial e retorna a paridade por arquivo e hash.
 
 O `init` projeta `observer-publish` para `SessionStart` e `Stop` depois dos hooks principais. Sem
-`WENDKEEP_OBSERVER_URL`, o hook é no-op. Com o servidor parado, ele grava em
-`.brain/observer-outbox/` e não bloqueia a sessão; uma execução posterior tenta reenviar eventos
-pendentes.
+`WENDKEEP_OBSERVER_URL`, o hook é no-op. Com o servidor parado, ele grava os snapshots em
+`.brain/observer-outbox/` e a memória integral em `.brain/observer-memory-outbox/`, sem bloquear a
+sessão; uma execução posterior tenta reenviar os dois tipos de evento.
 
 ## Erros comuns e diagnóstico
 
 - `project_not_registered`: rode `observer register` antes de publicar.
-- `unauthorized`: confira `Authorization: Bearer <token>` e `WENDKEEP_OBSERVER_TOKEN`.
 - `host loopback`: troque `0.0.0.0` ou endereço LAN por `127.0.0.1`.
 - Outbox pendente: o serviço estava indisponível; preserve `.brain/observer-outbox/` e repita o
   publisher. Não apague eventos manualmente.
-- O Observer não lê conteúdo bruto, caminhos, transcripts ou memória; rejeições desse tipo são
-  esperadas e devem ser investigadas na origem do snapshot.
+- Se a memória ficar incompleta, verifique a tela Sincronização, preserve o outbox e rode
+  `observer memory import` para reconstruir a cópia a partir do vault.
 
 ## Próximos passos
 
@@ -88,9 +107,9 @@ removido com `docker compose down -v` durante a operação normal, pois isso apa
 
 ## Autoridade dos dados
 
-O vault de cada projeto continua sendo a fonte oficial de sessões, changes, tarefas, memória e
-evidências. O Observer é uma projeção read-only reconstruível; suas consultas não concluem,
-arquivam, reparam ou promovem estado no vault.
+O container é a memória canônica para consultas do Observer e guarda o conteúdo integral
+publicado. O vault continua preservado localmente durante a migração como cópia de transição e
+fonte de recuperação; as telas do Observer não concluem, arquivam, reparam ou promovem estado.
 
 ## API mínima
 
@@ -98,8 +117,15 @@ arquivam, reparam ou promovem estado no vault.
 - `GET /v1/projects` — projetos com snapshot aceito.
 - `GET /v1/projects/:project_id` — último snapshot do projeto.
 - `GET /v1/projects/:project_id/changes` — resumo das changes do snapshot.
-- `PUT /v1/projects/:project_id` — registro explícito autenticado.
-- `POST /v1/projects/:project_id/snapshot` — ingestão autenticada e idempotente.
-
-As rotas `/v1` rejeitam corpo acima do limite e nunca aceitam caminho de vault, transcript, segredo
-ou conteúdo bruto de memória.
+- `PUT /v1/projects/:project_id` — registro explícito local.
+- `POST /v1/projects/:project_id/snapshot` — ingestão local idempotente.
+- `GET /v1/projects/:project_id/memory/tree` — árvore e metadados dos documentos.
+- `GET /v1/projects/:project_id/memory/document?path=...` — conteúdo Markdown integral.
+- `GET /v1/projects/:project_id/memory/search?q=...` — busca no caminho e no corpo.
+- `GET /v1/projects/:project_id/sync` — modo, contagem, conflitos e último evento.
+- `PUT /v1/projects/:project_id/sync` — altera explicitamente o modo local.
+- `GET /v1/projects/:project_id/memory/export` — exportação read-only com conteúdo completo.
+- `POST /v1/projects/:project_id/memory/events` — ingestão idempotente em lote.
+
+As rotas `/v1` rejeitam corpo acima do limite e validam projeto, caminho, revisão, hash e
+isolamento antes de gravar o conteúdo no volume.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.70.0",
+  "version": "0.71.1",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -30,6 +30,7 @@
     "hooks",
     "packages",
     "schema",
+    "web/observer",
     "docs/pt-BR/commands/*.md",
     "docs/en/commands/*.md",
     "README.md",
@@ -40,7 +41,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check hooks/observer-publish.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
     "release": "node scripts/release.mjs",
     "release:dry": "node scripts/release.mjs --dry-run",