wendkeep 0.71.1 → 0.72.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wendkeep",
-  "version": "0.71.1",
+  "version": "0.72.1",
   "description": "Vault-first persistent memory for AI coding agents, with an optional profile-aware governance runtime: OFF, FLOW, GUIDE, GOVERN, or ASSURE. Local-first and agent-agnostic (Claude Code, Codex, Cursor…).",
   "type": "module",
   "workspaces": [
@@ -41,10 +41,12 @@
     "node": ">=18"
   },
   "scripts": {
-    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
+    "check": "node --check scripts/release.mjs && node --check scripts/release-plan.mjs && node --check scripts/release-provenance.mjs && node --check scripts/run-scope.mjs && node --check src/release-provenance.mjs && node --check bin/wendkeep.mjs && node --check packages/cli/src/index.mjs && node --check src/init.mjs && node --check src/doctor.mjs && node --check src/project-vault.mjs && node --check src/observer-auth.mjs && node --check src/observer-privacy.mjs && node --check src/observer-snapshot.mjs && node --check src/observer-store.mjs && node --check src/observer-memory.mjs && node --check src/observer-memory-publish.mjs && node --check src/observer-sql-store.mjs && node --check src/observer-sql-migrate.mjs && node --check src/observer-sql-publish.mjs && node --check src/observer-transcript-store.mjs && node --check src/observer-server.mjs && node --check src/observer.mjs && node --check src/observer-publish.mjs && node --check src/operating-profile.mjs && node --check src/profile.mjs && node --check src/flow.mjs && node --check web/observer/app.mjs && node --check hooks/observer-publish.mjs && node --check hooks/operating-profile-runtime.mjs && node --check hooks/operating-profile-task-store.mjs && node --check hooks/flow-core.mjs && node --check hooks/flow-protected-policy.mjs && node --check hooks/git-snapshot.mjs && node --check hooks/vault-path-safety.mjs && node --check hooks/vault-runtime-store.mjs && node --check packages/harness/src/index.mjs && node --check packages/harness/src/flow-store.mjs && node --check packages/harness/src/operating-profile.mjs && node --check packages/harness/src/sensors-core.mjs && node --check packages/integrations/src/host-hooks.mjs && node --check packages/integrations/src/hook-envelope.mjs && node --check packages/integrations/src/prompt-content.mjs && node --check packages/integrations/src/transcript-usage.mjs && node --check packages/integrations/src/transcripts.mjs && node --check packages/integrations/src/session-identity.mjs && node --check packages/integrations/src/index.mjs && node --check packages/mcp/src/config.mjs && node --check packages/mcp/src/index.mjs && node --check packages/vault/src/index.mjs && node --check packages/vault/src/project-vault.mjs && node --check packages/vault/src/vault-path-safety.mjs && node --check packages/vault/src/locale.mjs && node --check packages/vault/src/memory-schema.mjs && node --check packages/vault/src/memory-mode.mjs && node --check packages/vault/src/memory-handoff.mjs && node --check packages/vault/src/memory-store.mjs && node --check packages/vault/src/validate-core.mjs && node --check packages/vault/src/validate-memory.mjs",
     "test": "node --test --test-concurrency=2",
+    "test:core": "node scripts/run-scope.mjs core",
     "release": "node scripts/release.mjs",
     "release:dry": "node scripts/release.mjs --dry-run",
+    "release:provenance": "node scripts/release-provenance.mjs",
     "prepack": "node scripts/readme-pack.mjs pre",
     "postpack": "node scripts/readme-pack.mjs post"
   },
@@ -70,7 +72,6 @@
     "url": "https://github.com/rogersialves/wendkeep/issues"
   },
   "devDependencies": {
-    "acorn": "^8.18.0",
-    "wendkeep": "^0.69.0"
+    "acorn": "^8.18.0"
   }
 }

package/packages/integrations/src/host-hooks.mjs

@@ -24,13 +24,15 @@ export const SESSION_HOOKS = [
   { event: 'PostToolUse', matcher: 'AskUserQuestion', name: 'decision-capture', timeout: 15, statusMessage: 'wendkeep: recording decision' },
   // Refresh subagent/workflow telemetry as each subagent finishes (resilient to a missed Stop).
   { event: 'SubagentStop', matcher: null, name: 'subagent-stop', timeout: 20, codex: true, statusMessage: 'wendkeep: subagent telemetry' },
+  // Publish the SQL observer projection after the subagent telemetry is settled.
+  { event: 'SubagentStop', matcher: null, name: 'observer-publish', timeout: 5, order: 20, codex: true, statusMessage: 'wendkeep: publishing local observer usage' },
   // Log plan/task progress into the active session note when a task is marked complete.
   // codex: TaskCompleted is not in Codex's hook event enum.
   { event: 'TaskCompleted', matcher: null, name: 'task-log', timeout: 10, statusMessage: 'wendkeep: plan progress' },
 ];
 
 export function hookCommand(name) {
-  return `npx wendkeep hook ${name}`;
+  return `npx --no-install wendkeep hook ${name}`;
 }
 
 // Forma node-direta do comando de hook: 1 processo (~100-250ms) em vez dos 3 do npx (cold-start

package/packages/vault/src/memory-store.mjs

@@ -112,12 +112,25 @@ function readCheckedMemoryFile(vaultBase, path, encoding, label, { allowMissing
   return readFileSync(checked.target, encoding);
 }
 
+export function memoryFileIdentityMatches(descriptor, target, {
+  platform = process.platform,
+} = {}) {
+  if (descriptor.ino !== target.ino) return false;
+  // libuv before 1.51 can report an inconsistent Windows volume serial number
+  // between stat(path) and fstat(fd). The inode is still the file index; path
+  // containment/reparse checks and nlink validation remain independent guards.
+  return platform === 'win32' || descriptor.dev === target.dev;
+}
+
 function assertOpenedMemoryFile(vaultBase, path, fd, label) {
   const checked = checkedMemoryFile(vaultBase, path, label, { allowMissing: false });
-  const descriptor = fstatSync(fd);
-  const target = statSync(checked.target);
-  if (!descriptor.isFile() || descriptor.nlink > 1 || target.nlink > 1
-      || descriptor.dev !== target.dev || descriptor.ino !== target.ino) {
+  // Windows file identities can exceed Number's safe integer range. Node 22.13 may
+  // round stat(path) and fstat(fd) differently for the same file, so compare the
+  // exact bigint values and keep nlink as the independent hardlink guard.
+  const descriptor = fstatSync(fd, { bigint: true });
+  const target = statSync(checked.target, { bigint: true });
+  if (!descriptor.isFile() || descriptor.nlink > 1n || target.nlink > 1n
+      || !memoryFileIdentityMatches(descriptor, target)) {
     throw unsafeMemoryPath(`${label} mudou de inode ou possui hardlink antes da mutação: ${checked.target}`);
   }
   return checked.target;

package/schema/observer/001-authority.sql

@@ -0,0 +1,107 @@
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS schema_migrations (
+  version INTEGER PRIMARY KEY,
+  name TEXT NOT NULL,
+  applied_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS projects (
+  project_id TEXT PRIMARY KEY,
+  project_name TEXT NOT NULL,
+  wendkeep_version TEXT NOT NULL DEFAULT '',
+  registered_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS ingest_events (
+  event_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  kind TEXT NOT NULL,
+  payload_hash TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  occurred_at TEXT NOT NULL,
+  ingested_at TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'accepted'
+);
+
+CREATE INDEX IF NOT EXISTS idx_ingest_events_project_time
+  ON ingest_events(project_id, occurred_at);
+
+CREATE TABLE IF NOT EXISTS memory_events (
+  event_id TEXT PRIMARY KEY REFERENCES ingest_events(event_id) ON DELETE CASCADE,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  entity_type TEXT NOT NULL,
+  logical_path TEXT NOT NULL,
+  operation TEXT NOT NULL,
+  revision INTEGER NOT NULL DEFAULT 1,
+  content_hash TEXT NOT NULL DEFAULT '',
+  source_session_id TEXT NOT NULL DEFAULT '',
+  source_turn_id TEXT NOT NULL DEFAULT '',
+  occurred_at TEXT NOT NULL,
+  payload_json TEXT NOT NULL,
+  UNIQUE(project_id, logical_path, revision)
+);
+
+CREATE INDEX IF NOT EXISTS idx_memory_events_project_path
+  ON memory_events(project_id, logical_path, revision);
+
+CREATE TABLE IF NOT EXISTS documents (
+  document_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  logical_path TEXT NOT NULL,
+  entity_type TEXT NOT NULL,
+  title TEXT NOT NULL DEFAULT '',
+  content TEXT NOT NULL DEFAULT '',
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  content_hash TEXT NOT NULL DEFAULT '',
+  revision INTEGER NOT NULL DEFAULT 1,
+  source_session_id TEXT NOT NULL DEFAULT '',
+  source_turn_id TEXT NOT NULL DEFAULT '',
+  captured_at TEXT NOT NULL,
+  deleted_at TEXT,
+  UNIQUE(project_id, logical_path)
+);
+
+CREATE INDEX IF NOT EXISTS idx_documents_project_type
+  ON documents(project_id, entity_type, deleted_at);
+
+CREATE INDEX IF NOT EXISTS idx_documents_project_revision
+  ON documents(project_id, revision);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  session_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  provider TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'unknown',
+  summary TEXT NOT NULL DEFAULT '',
+  change_slug TEXT NOT NULL DEFAULT '',
+  started_at TEXT,
+  ended_at TEXT,
+  updated_at TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_sessions_project_time
+  ON sessions(project_id, started_at, ended_at);
+
+CREATE TABLE IF NOT EXISTS agent_runs (
+  agent_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
+  parent_agent_id TEXT,
+  role TEXT NOT NULL DEFAULT 'main',
+  agent_name TEXT NOT NULL DEFAULT '',
+  agent_type TEXT NOT NULL DEFAULT '',
+  workflow TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'unknown',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  started_at TEXT,
+  ended_at TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  FOREIGN KEY(parent_agent_id) REFERENCES agent_runs(agent_id) ON DELETE SET NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_agent_runs_project_session
+  ON agent_runs(project_id, session_id, role);

package/schema/observer/002-usage.sql

@@ -0,0 +1,72 @@
+CREATE TABLE IF NOT EXISTS usage_rollups (
+  rollup_key TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
+  agent_id TEXT NOT NULL REFERENCES agent_runs(agent_id) ON DELETE CASCADE,
+  role TEXT NOT NULL DEFAULT 'main',
+  provider TEXT NOT NULL DEFAULT '',
+  model_provider TEXT NOT NULL DEFAULT '',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  calls INTEGER NOT NULL DEFAULT 0,
+  tokens_input INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_write INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_read INTEGER NOT NULL DEFAULT 0,
+  tokens_output INTEGER NOT NULL DEFAULT 0,
+  tokens_reasoning INTEGER NOT NULL DEFAULT 0,
+  tokens_total INTEGER NOT NULL DEFAULT 0,
+  cost_usd REAL NOT NULL DEFAULT 0,
+  cost_status TEXT NOT NULL DEFAULT 'unknown',
+  pricing_source TEXT NOT NULL DEFAULT '',
+  pricing_version TEXT NOT NULL DEFAULT '',
+  wasted_usd REAL NOT NULL DEFAULT 0,
+  revision INTEGER NOT NULL DEFAULT 1,
+  occurred_at TEXT NOT NULL,
+  source_event_id TEXT NOT NULL REFERENCES ingest_events(event_id) ON DELETE CASCADE,
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_usage_rollups_project_time
+  ON usage_rollups(project_id, occurred_at);
+
+CREATE INDEX IF NOT EXISTS idx_usage_rollups_project_agent
+  ON usage_rollups(project_id, agent_id, role);
+
+CREATE INDEX IF NOT EXISTS idx_usage_rollups_project_model
+  ON usage_rollups(project_id, model_provider, model);
+
+CREATE TABLE IF NOT EXISTS llm_calls (
+  call_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
+  agent_id TEXT NOT NULL REFERENCES agent_runs(agent_id) ON DELETE CASCADE,
+  role TEXT NOT NULL DEFAULT 'main',
+  provider TEXT NOT NULL DEFAULT '',
+  model_provider TEXT NOT NULL DEFAULT '',
+  model TEXT NOT NULL DEFAULT '',
+  effort TEXT NOT NULL DEFAULT '',
+  sequence INTEGER NOT NULL DEFAULT 0,
+  occurred_at TEXT NOT NULL,
+  tokens_input INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_write INTEGER NOT NULL DEFAULT 0,
+  tokens_cache_read INTEGER NOT NULL DEFAULT 0,
+  tokens_output INTEGER NOT NULL DEFAULT 0,
+  tokens_reasoning INTEGER NOT NULL DEFAULT 0,
+  tokens_total INTEGER NOT NULL DEFAULT 0,
+  cost_usd REAL NOT NULL DEFAULT 0,
+  cost_status TEXT NOT NULL DEFAULT 'unknown',
+  transcript_id TEXT,
+  prompt_text TEXT NOT NULL DEFAULT '',
+  response_text TEXT NOT NULL DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'complete',
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_llm_calls_project_time
+  ON llm_calls(project_id, occurred_at);
+
+CREATE INDEX IF NOT EXISTS idx_llm_calls_project_agent
+  ON llm_calls(project_id, agent_id, sequence);
+
+CREATE INDEX IF NOT EXISTS idx_llm_calls_project_model
+  ON llm_calls(project_id, model_provider, model);

package/schema/observer/003-transcripts.sql

@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS transcripts (
+  transcript_id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(project_id) ON DELETE CASCADE,
+  session_id TEXT NOT NULL REFERENCES sessions(session_id) ON DELETE CASCADE,
+  agent_id TEXT NOT NULL REFERENCES agent_runs(agent_id) ON DELETE CASCADE,
+  coverage TEXT NOT NULL DEFAULT 'summary_only',
+  codec TEXT NOT NULL DEFAULT 'gzip',
+  content_gzip BLOB NOT NULL,
+  content_sha256 TEXT NOT NULL,
+  original_bytes INTEGER NOT NULL,
+  compressed_bytes INTEGER NOT NULL,
+  source TEXT NOT NULL DEFAULT '',
+  occurred_at TEXT NOT NULL,
+  metadata_json TEXT NOT NULL DEFAULT '{}'
+);
+
+CREATE INDEX IF NOT EXISTS idx_transcripts_project_session
+  ON transcripts(project_id, session_id, occurred_at);
+
+CREATE INDEX IF NOT EXISTS idx_transcripts_project_coverage
+  ON transcripts(project_id, coverage);

package/src/init.mjs

@@ -323,7 +323,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json ignorado (--no-mcp, sem companions MCP)',
     colorsSkipped: '  [5/5] cores ignoradas (--no-colors)',
     colors: (r) => `  [5/5] cores: ${r}`,
-    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/',
+    runtimeIgnore: '  [!] ignore runtimes locais do wendkeep no Git quando o vault for versionado: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
     merged: 'mesclado', created: 'criado', bakSaved: ', .bak salvo',
     nextSteps: '\nPróximos passos:',
     step1: (v) => `  1. Abra o vault no Obsidian: "Abrir pasta como cofre" -> ${v}`,
@@ -352,7 +352,7 @@ const MESSAGES = {
     mcpSkipped: '  [4/5] .mcp.json skipped (--no-mcp, no MCP companions)',
     colorsSkipped: '  [5/5] colors skipped (--no-colors)',
     colors: (r) => `  [5/5] colors: ${r}`,
-    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/',
+    runtimeIgnore: '  [!] keep local wendkeep runtimes out of Git when the vault is versioned: .brain/.change-* .brain/runtime/flows/ .brain/observer-sql-state.json .brain/observer-sql-outbox/',
     merged: 'merged', created: 'created', bakSaved: ', .bak saved',
     nextSteps: '\nNext steps:',
     step1: (v) => `  1. Open the vault in Obsidian: "Open folder as vault" -> ${v}`,

package/src/observer-auth.mjs

@@ -0,0 +1,10 @@
+export function resolveObserverToken(value = '') {
+  return String(value || process.env.WENDKEEP_OBSERVER_TOKEN || '').trim();
+}
+
+export function observerAuthHeaders(token, headers = {}) {
+  const resolved = resolveObserverToken(token);
+  return resolved
+    ? { ...headers, authorization: `Bearer ${resolved}` }
+    : { ...headers };
+}

package/src/observer-memory-publish.mjs

@@ -12,6 +12,8 @@ import {
 } from 'node:fs';
 import { join } from 'node:path';
 import { MAX_MEMORY_CONTENT_BYTES } from './observer-memory.mjs';
+import { observerAuthHeaders } from './observer-auth.mjs';
+import { sanitizeObserverContent } from './observer-privacy.mjs';
 
 export const MEMORY_OUTBOX_REL = '.brain/observer-memory-outbox';
 export const MEMORY_STATE_FILE = '.brain/observer-memory-state.json';
@@ -68,7 +70,8 @@ function entityType(logicalPath) {
 }
 
 function shouldSkip(name, relativePath) {
-  if (TRANSIENT_NAMES.has(name) || name.endsWith('.tmp') || name.endsWith('.lock')) return true;
+  if (TRANSIENT_NAMES.has(name) || name === 'observer-sql-state.json' || name === 'observer-sql-outbox'
+    || name.endsWith('.tmp') || name.endsWith('.lock')) return true;
   if (relativePath === MEMORY_STATE_FILE) return true;
   return false;
 }
@@ -102,7 +105,7 @@ function memoryFiles(vaultBase) {
 
 export function localMemoryManifest(vaultBase) {
   return Object.fromEntries(memoryFiles(vaultBase).map((file) => {
-    const content = readFileSync(file.absolute, 'utf8');
+    const content = sanitizeObserverContent(readFileSync(file.absolute, 'utf8'));
     return [file.logicalPath, {
       logical_path: file.logicalPath,
       content_hash: hash(content),
@@ -158,7 +161,7 @@ export function buildMemoryEventBatch({
   const events = [];
 
   for (const file of currentFiles) {
-    const content = readFileSync(file.absolute, 'utf8');
+    const content = sanitizeObserverContent(readFileSync(file.absolute, 'utf8'));
     if (Buffer.byteLength(content, 'utf8') > MAX_MEMORY_CONTENT_BYTES) {
       throw new Error('arquivo excede o limite de memória: ' + file.logicalPath);
     }
@@ -230,12 +233,12 @@ export function listMemoryOutbox(vaultBase) {
     .map((name) => join(dir, name));
 }
 
-async function postBatch(url, projectId, events, fetchImpl = globalThis.fetch) {
+async function postBatch(url, projectId, events, fetchImpl = globalThis.fetch, token = '') {
   const response = await fetchImpl(
     String(url).replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/memory/events',
     {
       method: 'POST',
-      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      headers: observerAuthHeaders(token, { 'content-type': 'application/json', accept: 'application/json' }),
       body: JSON.stringify({ events }),
     },
   );
@@ -248,6 +251,7 @@ export async function retryObserverMemoryOutbox({
   projectId = projectIdFromVault(vaultBase),
   url,
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   const files = listMemoryOutbox(vaultBase);
   if (!url) return { attempted: 0, confirmed: 0, pending: files.length };
@@ -261,7 +265,7 @@ export async function retryObserverMemoryOutbox({
         unlinkSync(path);
         continue;
       }
-      await postBatch(url, projectId, batch.events, fetchImpl);
+      await postBatch(url, projectId, batch.events, fetchImpl, token);
       unlinkSync(path);
       confirmed += 1;
     } catch {
@@ -276,10 +280,11 @@ export async function compareMemoryParity({
   projectId = projectIdFromVault(vaultBase),
   url,
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   const response = await fetchImpl(
     String(url).replace(/\/$/, '') + '/v1/projects/' + encodeURIComponent(projectId) + '/memory/tree',
-    { headers: { accept: 'application/json' } },
+    { headers: observerAuthHeaders(token, { accept: 'application/json' }) },
   );
   if (!response.ok) throw new Error('Observer respondeu HTTP ' + response.status + '.');
   const body = await response.json();
@@ -308,9 +313,10 @@ export async function publishObserverMemory({
   sourceTurnId = '',
   now = new Date(),
   fetchImpl = globalThis.fetch,
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   if (!vaultBase || !projectId) throw new Error('vaultBase e projectId são obrigatórios.');
-  await retryObserverMemoryOutbox({ vaultBase, projectId, url, fetchImpl });
+  await retryObserverMemoryOutbox({ vaultBase, projectId, url, fetchImpl, token });
   const state = readState(vaultBase);
   const batch = buildMemoryEventBatch({ vaultBase, projectId, sourceSessionId, sourceTurnId, now, state });
   if (batch.events.length === 0) {
@@ -323,7 +329,7 @@ export async function publishObserverMemory({
     return { ok: false, queued: true, scanned: batch.scanned, changed: batch.changed, pending: listMemoryOutbox(vaultBase).length, hookExitCode: 0 };
   }
   try {
-    await postBatch(url, projectId, batch.events, fetchImpl);
+    await postBatch(url, projectId, batch.events, fetchImpl, token);
     commitMemoryPublishState(vaultBase, batch.nextState);
     return { ok: true, queued: false, scanned: batch.scanned, changed: batch.changed, pending: listMemoryOutbox(vaultBase).length };
   } catch (error) {

package/src/observer-privacy.mjs

@@ -0,0 +1,23 @@
+import { basename } from 'node:path';
+
+const TRANSCRIPT_PATH_KEY = /^(?:transcript_path|agent_transcript_path|transcriptPath|agentTranscriptPath)$/i;
+const TRANSCRIPT_PATH_LINE = /^(\s*["']?(?:transcript_path|agent_transcript_path|transcriptPath|agentTranscriptPath)["']?\s*:\s*)(["']?)(.*?)(\2)(\s*,?\s*)$/gmi;
+
+function sourceLabel(value) {
+  return basename(String(value || '').replaceAll('\\', '/'));
+}
+
+export function sanitizeObserverContent(content) {
+  return String(content || '').replace(TRANSCRIPT_PATH_LINE, (_line, prefix, quote, value, _closing, suffix) => (
+    `${prefix}${quote}${sourceLabel(value)}${quote}${suffix}`
+  ));
+}
+
+export function sanitizeObserverMetadata(value) {
+  if (Array.isArray(value)) return value.map(sanitizeObserverMetadata);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    TRANSCRIPT_PATH_KEY.test(key) ? sourceLabel(item) : sanitizeObserverMetadata(item),
+  ]));
+}

package/src/observer-publish.mjs

@@ -1,7 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { buildProjectSnapshot } from './observer-snapshot.mjs';
-import { publishObserverMemory } from './observer-memory-publish.mjs';
+import { publishObserverSql } from './observer-sql-publish.mjs';
+import { observerAuthHeaders, resolveObserverToken } from './observer-auth.mjs';
 
 const OUTBOX_REL = join('.brain', 'observer-outbox');
 const REQUEST_TIMEOUT_MS = 500;
@@ -46,15 +47,15 @@ function removeOutbox(vaultBase, eventId) {
   if (existsSync(path)) unlinkSync(path);
 }
 
-async function postSnapshot(url, event) {
+async function postSnapshot(url, event, token) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
   try {
     const response = await fetch(`${String(url).replace(/\/$/, '')}/v1/projects/${encodeURIComponent(event.project_id)}/snapshot`, {
       method: 'POST',
-      headers: {
+      headers: observerAuthHeaders(token, {
         'content-type': 'application/json',
-      },
+      }),
       body: JSON.stringify(event),
       signal: controller.signal,
     });
@@ -70,14 +71,14 @@ async function postSnapshot(url, event) {
   }
 }
 
-export async function retryObserverOutbox({ vaultBase, url } = {}) {
+export async function retryObserverOutbox({ vaultBase, url, token = process.env.WENDKEEP_OBSERVER_TOKEN || '' } = {}) {
   if (!url) return { attempted: 0, confirmed: 0, pending: listOutbox(vaultBase).length };
   let attempted = 0;
   let confirmed = 0;
   for (const event of listOutbox(vaultBase)) {
     attempted += 1;
     try {
-      await postSnapshot(url, event);
+      await postSnapshot(url, event, token);
       removeOutbox(vaultBase, event.event_id);
       confirmed += 1;
     } catch { /* preserve the event for a later retry */ }
@@ -90,25 +91,27 @@ export async function publishObserverSnapshot({
   projectRoot,
   url = process.env.WENDKEEP_OBSERVER_URL || '',
   now = new Date(),
+  input = {},
+  token = process.env.WENDKEEP_OBSERVER_TOKEN || '',
 } = {}) {
   try {
     const event = buildProjectSnapshot({ vaultBase, projectRoot, now });
-    if (!url) return { ok: true, skipped: true, queued: false, hookExitCode: 0, event_id: event.event_id };
+    const sql = await publishObserverSql({
+      vaultBase,
+      projectId: event.project_id,
+      url,
+      input,
+      now,
+      token,
+    });
+    if (!url) return { ok: sql.ok, skipped: true, queued: sql.queued, hookExitCode: 0, event_id: event.event_id, sql };
 
-    await retryObserverOutbox({ vaultBase, url });
-    let memory;
-    try {
-      memory = await publishObserverMemory({
-        vaultBase,
-        projectId: event.project_id,
-        url,
-        now,
-      });
-    } catch (error) {
-      memory = { ok: false, queued: false, error: error.message };
-    }
+    await retryObserverOutbox({ vaultBase, url, token });
+    // SQL is the live authority. Keep the legacy-shaped `memory` field for
+    // older integrations while reporting the real SQL publication separately.
+    const memory = { ok: sql.ok, queued: sql.queued, changed: sql.changed, pending: sql.pending, authority: 'sqlite' };
     try {
-      const response = await postSnapshot(url, event);
+      const response = await postSnapshot(url, event, resolveObserverToken(token));
       return {
         ok: true,
         queued: false,
@@ -116,6 +119,7 @@ export async function publishObserverSnapshot({
         event_id: event.event_id,
         duplicate: response.duplicate === true,
         memory,
+        sql,
       };
     } catch (error) {
       queueOutbox(vaultBase, event);
@@ -126,6 +130,7 @@ export async function publishObserverSnapshot({
         event_id: event.event_id,
         error: error.message,
         memory,
+        sql,
       };
     }
   } catch (error) {