Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nowledge-mem-alma-plugin/main.js`:
- Around line 409-410: searchThreads and showThread use the long flag "--limit"
while documentation and examples use the short "-n"; update both runtime methods
(searchThreads and showThread) to accept and emit the short flag "-n" instead of
"--limit" so the CLI flag style matches the playbook/CLAUDE.md, and ensure any
parsing or help text references (e.g., flag registration or yargs/commander
setup within those functions) are changed accordingly to "-n" so behavior and
docs stay in sync.

In `@nowledge-mem-openclaw-plugin/CLAUDE.md`:
- Around line 124-125: The CLI docs show inconsistent flags for thread
pagination: `nmem --json t search <q> --limit N` vs `nmem --json t show <id> -n
N --offset O`; pick one canonical flag name (either `--limit N` or `-n N`) and
update the table entry for `nmem --json t search` to use the chosen flag so both
`client.searchThreadsFull()` and `client.fetchThread()` rows present the same
pagination flag; ensure the rest of the docs use that same flag for
thread-related commands.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nowledge-mem-droid-plugin/hooks/hooks.json`:
- Around line 10-19: Replace the bare "nmem wm read 2>/dev/null || cat
~/ai-now/memory.md" pattern in both SessionStart hooks with an explicit JSON
read and exists-check using "nmem --json wm read"; call "nmem --json wm read",
parse the JSON response to verify the briefing actually contains content (e.g.,
non-empty field or array) and only when that check fails fall back to "cat
~/ai-now/memory.md"; ensure errors from the nmem command
(server/auth/connection) are not treated as "no briefing" so they surface rather
than silently loading the local file, and keep the surrounding compact hook's
trailing printf intact.

In `@nowledge-mem-droid-plugin/README.md`:
- Around line 146-150: The README's "Validate Locally" section runs "node
scripts/validate-plugin.mjs" but doesn't state the required working directory;
update the README (Validate Locally block) to make the cwd explicit by
prepending a step to change into the nowledge-mem-droid-plugin directory (e.g.,
add "cd nowledge-mem-droid-plugin" before running node
scripts/validate-plugin.mjs) so the command is copy/paste safe and works from
the documented checkout flow.

In `@nowledge-mem-droid-plugin/scripts/validate-plugin.mjs`:
- Around line 3-8: The code uses process.cwd() to set pluginRoot/repoRoot which
breaks when the script is run from elsewhere; change path resolution to be
relative to the script file using import.meta.url (e.g., compute the scriptDir
via fileURLToPath(new URL(import.meta.url)) / path.dirname) and then set
pluginRoot = path.resolve(scriptDir) and repoRoot = path.resolve(pluginRoot,
".."); update the top imports to include fileURLToPath from 'url' if needed and
replace references to pluginRoot/repoRoot accordingly (look for the pluginRoot
and repoRoot variables).

---

Nitpick comments:
In `@nowledge-mem-droid-plugin/scripts/validate-plugin.mjs`:
- Around line 107-135: Replace the literal string checks on pluginText with
regex-based tests: instead of pluginText.includes("nmem t save --from droid")
add a RegExp test (with i and s flags) that matches the nmem CLI save pattern in
any flag order, e.g. something like new
RegExp("\\bnmem\\b.*\\b(t\\s+)?save\\b.*--from\\s+droid","is") to catch variants
like "nmem --json t save --from droid"; add another regex to detect stale t
search/show examples with limits, e.g. /\bt\b.*\b(search|show)\b.*--limit\b/i;
and replace the python3 literal check with a regex like /\bpython3\b/i (or
/\bpython3(?:\\.\\d+)?\b/i for versions) — update the pluginText.includes(...)
usages and corresponding fail/ok branches to use these RegExp.test(pluginText)
checks while keeping the same fail messages and symbols runtimeSurfaceFiles and
pluginText to locate the code.

In `@nowledge-mem-droid-plugin/skills/distill-memory/SKILL.md`:
- Around line 36-38: The example for the "m update" command in SKILL.md is
missing the --json flag and should be changed to match the parseable output used
elsewhere; update the example line containing `nmem m update <id> -t "Updated
title"` to include `--json` (so it mirrors the `nmem --json m add` pattern) so
downstream tooling receives JSON output.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nowledge-mem-openclaw-plugin/src/client.js`:
- Around line 203-230: The exec method currently logs the full argv on error
which may contain sensitive message content; update exec (function exec,
variable argv) to avoid emitting raw arguments by producing a redacted
representation before logging (e.g., keep argv[0] and any flag-like strings,
replace non-flag args with "<redacted>" or log only the args count), then call
this.logger.error with the sanitized string instead of argv.join(" "). Ensure
the redaction is applied after resolveCommand/_apiUrlArgs() and before the
logger.error line that reports failures from runtimeSystem.runCommandWithTimeout
so no raw payloads are written to logs.
- Around line 910-913: The checkHealth() method currently calls
this.exec(["status"]) without the required --json flag; update the call in
checkHealth() to include the "--json" argument so it becomes
this.exec(["status", "--json"]) (preserving existing error handling and return
true) to adhere to the parseable-output contract for all nmem commands.

In `@nowledge-mem-openclaw-plugin/src/spawn-env.js`:
- Around line 7-15: buildNmemSpawnEnv currently clones process.env which allows
inherited NMEM_API_URL/NMEM_API_KEY to survive and override resolved plugin
config; modify buildNmemSpawnEnv to start from a fresh env object that
explicitly clears NMEM_API_URL and NMEM_API_KEY (do not copy them from
process.env), then overlay values from plugin config: if apiUrl is set and not
equal to LOCAL_API_URL set NMEM_API_URL, and if apiKey set NMEM_API_KEY; ensure
process.env values are only used if neither pluginConfig nor user config provide
them (i.e., consult process.env as a fallback rather than the initial source).