nexo-brain 1.7.0 → 2.1.0

package/src/scripts/nexo-send-reply.py

@@ -27,6 +27,7 @@ Options:
 import argparse
 import imaplib
 import json
+import os
 import smtplib
 import sys
 import time
@@ -35,7 +36,8 @@ from email.utils import make_msgid, formatdate
 from pathlib import Path
 import mimetypes
 
-CONFIG_PATH = Path.home() / ".nexo" / "nexo-email" / "config.json"
+NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
+CONFIG_PATH = NEXO_HOME / "nexo-email" / "config.json"
 
 
 def load_config():

package/src/scripts/nexo-sleep.py

@@ -32,7 +32,7 @@ from pathlib import Path
 NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
 
 # ─── Paths ────────────────────────────────────────────────────────────────────
-CLAUDE_DIR = Path.home() / ".nexo"
+CLAUDE_DIR = NEXO_HOME
 BRAIN_DIR = CLAUDE_DIR / "brain"
 COORD_DIR = CLAUDE_DIR / "coordination"
 MEMORY_DIR = CLAUDE_DIR / "memory"
@@ -46,8 +46,8 @@ HEARTBEAT_LOG = COORD_DIR / "heartbeat-log.json"
 REFLECTION_LOG = COORD_DIR / "reflection-log.json"
 SLEEP_LOG = COORD_DIR / "sleep-log.json"
 
-MEMORY_MD = Path.home() / ".nexo" / "memory" / "MEMORY.md"
-NEXO_DB = Path.home() / ".nexo" / "nexo.db"
+MEMORY_MD = NEXO_HOME / "memory" / "MEMORY.md"
+NEXO_DB = NEXO_HOME / "data" / "nexo.db"
 CLAUDE_MEM_DB = Path.home() / ".claude-mem" / "claude-mem.db"
 CLAUDE_CLI = Path.home() / ".local" / "bin" / "claude"
 
@@ -252,7 +252,7 @@ def stage_a_cleanup() -> dict:
 
     # A8: Delete cortex/logs/*.log >7 days, truncate launchd >5MB
     cutoff_7 = TODAY - timedelta(days=7)
-    cortex_logs = Path.home() / ".nexo" / "cortex" / "logs"
+    cortex_logs = NEXO_HOME / "cortex" / "logs"
     if cortex_logs.exists():
         for f in cortex_logs.glob("*.log"):
             if f.name.startswith("launchd-"):
@@ -383,9 +383,12 @@ The wrapper will handle the actual DB cleanup safely.""")
 
     tasks_str = "\n\n".join(tasks)
 
-    prompt = f"""You are NEXO Sleep — the nightly brain maintenance process.
+    prompt = f"""FIRST: Call nexo_startup(task='deep-sleep nightly maintenance') to register this session.
+
+You are NEXO Sleep — the nightly brain maintenance process.
 Like a human brain during sleep: consolidate important memories, discard noise,
 detect conflicts, prepare state for tomorrow.
+Use nexo_learning_add, nexo_followup_create, nexo_session_diary_write and other MCP tools directly.
 
 BRAIN STATE:
 - {len(state['learnings'])} active learnings
@@ -407,16 +410,17 @@ Write a summary to {COORD_DIR}/sleep-report.md when done.
 Execute without asking."""
 
     log("Stage B: Invoking Claude CLI (opus) — dreaming...")
-
     env = os.environ.copy()
+    env["NEXO_HEADLESS"] = "1"  # Skip stop hook post-mortem
     env.pop("CLAUDECODE", None)
     env.pop("CLAUDE_CODE", None)
 
     try:
         result = subprocess.run(
             [str(CLAUDE_CLI), "-p", prompt, "--model", "opus",
-             "--allowedTools", "Read,Write,Edit,Glob,Grep"],
-            capture_output=True, text=True, timeout=600, env=env
+             "--output-format", "text",
+             "--allowedTools", "Read,Write,Edit,Glob,Grep,Bash,mcp__nexo__*"],
+            capture_output=True, text=True, timeout=21600, env=env
         )
 
         if result.returncode != 0:
@@ -568,7 +572,7 @@ def main():
 
         # Register for catch-up
         try:
-            state_file = Path.home() / ".nexo" / "operations" / ".catchup-state.json"
+            state_file = NEXO_HOME / "operations" / ".catchup-state.json"
             st = json.loads(state_file.read_text()) if state_file.exists() else {}
             st["sleep"] = datetime.now().isoformat()
             state_file.write_text(json.dumps(st, indent=2))

package/src/scripts/nexo-snapshot-restore.sh

@@ -5,7 +5,8 @@ set -euo pipefail
 
 SNAP_DIR="${1:?Usage: nexo-snapshot-restore.sh <snapshot-dir>}"
 MANIFEST="$SNAP_DIR/manifest.json"
-RESTORE_LOG="$HOME/claude/logs/snapshot-restores.log"
+NEXO_HOME="${NEXO_HOME:-$HOME/.nexo}"
+RESTORE_LOG="$NEXO_HOME/logs/snapshot-restores.log"
 
 if [ ! -f "$MANIFEST" ]; then
     echo "ERROR: No manifest.json in $SNAP_DIR" >&2

package/src/scripts/nexo-synthesis.py

@@ -19,9 +19,10 @@ from datetime import datetime, date, timedelta
 from pathlib import Path
 
 HOME = Path.home()
+NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
 CLAUDE_DIR = NEXO_HOME
 COORD_DIR = CLAUDE_DIR / "coordination"
-NEXO_DB = NEXO_HOME / "nexo-mcp" / "db" / "nexo.db"
+NEXO_DB = NEXO_HOME / "data" / "nexo.db"
 OUTPUT_FILE = COORD_DIR / "daily-synthesis.md"
 LAST_RUN_FILE = COORD_DIR / "synthesis-last-run"
 LOCK_FILE = COORD_DIR / "synthesis.lock"
@@ -142,9 +143,11 @@ def synthesize(data: dict) -> bool:
     if len(data_json) > 15000:
         data_json = data_json[:15000] + "\n... (truncated)"
 
-    prompt = f"""You are NEXO's synthesis engine. Write the daily intelligence brief for tomorrow's
+    prompt = f"""FIRST: Call nexo_startup(task='daily synthesis') to register this session.
+
+You are NEXO's synthesis engine. Write the daily intelligence brief for tomorrow's
 startup. This file is read by NEXO at the beginning of each session to understand
-what happened today and what to focus on tomorrow.
+what happened today and what to focus on tomorrow. Use nexo_learning_add and nexo_followup_create if you discover actionable items.
 
 TODAY'S RAW DATA:
 {data_json}
@@ -181,17 +184,18 @@ not what merely happened. If a section has nothing, write "Nothing notable."
 
 Execute without asking."""
 
-    log("Invoking Claude CLI (sonnet) for synthesis...")
-
+    log("Invoking Claude CLI (opus) for synthesis...")
     env = os.environ.copy()
+    env["NEXO_HEADLESS"] = "1"  # Skip stop hook post-mortem
     env.pop("CLAUDECODE", None)
     env.pop("CLAUDE_CODE", None)
 
     try:
         result = subprocess.run(
             [str(CLAUDE_CLI), "-p", prompt, "--model", "opus",
-             "--allowedTools", "Read,Write,Edit,Glob,Grep"],
-            capture_output=True, text=True, timeout=180, env=env
+             "--output-format", "text",
+             "--allowedTools", "Read,Write,Edit,Glob,Grep,Bash,mcp__nexo__*"],
+            capture_output=True, text=True, timeout=21600, env=env
         )
 
         if result.returncode != 0:

package/src/scripts/nexo-tcc-approve.sh

@@ -0,0 +1,79 @@
+#!/bin/bash
+# NEXO TCC Auto-Approve — grants macOS permissions to new Claude Code versions.
+#
+# macOS only. On Linux this is a no-op (Linux doesn't have TCC).
+# Runs at load to approve any new Claude versions that appeared.
+#
+# What it does:
+#   1. Scans ~/.local/share/claude/versions/ for Claude binaries
+#   2. For each new version, grants TCC access to Documents, Desktop, Downloads, etc.
+#   3. Also approves the Python binary used by NEXO's venv
+#   4. Tracks which versions have been approved to avoid re-processing
+#
+# Why: Claude Code updates frequently. Each new binary needs macOS permission
+# grants or the user gets popup dialogs interrupting their work.
+
+set -euo pipefail
+
+# Linux: nothing to do
+if [ "$(uname -s)" != "Darwin" ]; then
+    exit 0
+fi
+
+NEXO_HOME="${NEXO_HOME:-$HOME/.nexo}"
+TCC_DB="$HOME/Library/Application Support/com.apple.TCC/TCC.db"
+VERSIONS_DIR="$HOME/.local/share/claude/versions"
+MARKER_DIR="$NEXO_HOME/data/.tcc-approved"
+LOG="$NEXO_HOME/logs/tcc-auto-approve.log"
+
+mkdir -p "$MARKER_DIR" "$(dirname "$LOG")"
+
+# TCC services Claude Code needs
+SERVICES=(
+    kTCCServiceSystemPolicyDocumentsFolder
+    kTCCServiceSystemPolicyDesktopFolder
+    kTCCServiceSystemPolicyDownloadsFolder
+    kTCCServiceMediaLibrary
+    kTCCServiceSystemPolicyNetworkVolumes
+    kTCCServiceSystemPolicyAppData
+    kTCCServiceFileProviderDomain
+)
+
+# Approve Claude versions
+if [ -d "$VERSIONS_DIR" ]; then
+    for bin_path in "$VERSIONS_DIR"/*; do
+        [ ! -e "$bin_path" ] && continue
+        version=$(basename "$bin_path")
+        marker="$MARKER_DIR/$version"
+
+        # Skip if already approved
+        [ -f "$marker" ] && continue
+
+        echo "$(date '+%Y-%m-%d %H:%M:%S') Approving Claude $version" >> "$LOG"
+
+        for svc in "${SERVICES[@]}"; do
+            sqlite3 "$TCC_DB" "
+            INSERT OR REPLACE INTO access (service, client, client_type, auth_value, auth_reason, auth_version)
+            VALUES ('$svc', '$bin_path', 1, 2, 4, 1);
+            " 2>/dev/null
+        done
+
+        touch "$marker"
+        echo "$(date '+%Y-%m-%d %H:%M:%S') Done: Claude $version — ${#SERVICES[@]} services approved" >> "$LOG"
+    done
+fi
+
+# Also approve Python from NEXO's venv (if it exists)
+NEXO_CODE="${NEXO_CODE:-}"
+if [ -n "$NEXO_CODE" ]; then
+    PYTHON_BIN="$(dirname "$NEXO_CODE")/.venv/bin/python"
+    if [ -e "$PYTHON_BIN" ]; then
+        PYTHON_REAL=$(readlink -f "$PYTHON_BIN" 2>/dev/null || echo "$PYTHON_BIN")
+        for svc in "${SERVICES[@]}"; do
+            sqlite3 "$TCC_DB" "
+            INSERT OR REPLACE INTO access (service, client, client_type, auth_value, auth_reason, auth_version)
+            VALUES ('$svc', '$PYTHON_REAL', 1, 2, 4, 1);
+            " 2>/dev/null
+        done
+    fi
+fi

package/src/scripts/nexo-update.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+# nexo-update.sh — Standalone NEXO update script
+# Same logic as the MCP tool but usable when the server itself needs updating.
+#
+# Usage:
+#   nexo-update.sh                    # pull from origin main
+#   nexo-update.sh origin beta        # pull from origin beta
+#   NEXO_HOME=/path nexo-update.sh    # custom NEXO_HOME
+
+set -euo pipefail
+
+# --- Configuration ---
+REMOTE="${1:-origin}"
+BRANCH="${2:-main}"
+NEXO_HOME="${NEXO_HOME:-$HOME/.nexo}"
+
+# Determine repo directory: script is at src/scripts/, repo root is ../../
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
+SRC_DIR="$REPO_DIR/src"
+PACKAGE_JSON="$REPO_DIR/package.json"
+
+# --- Helpers ---
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log()  { echo -e "${GREEN}[nexo-update]${NC} $*"; }
+warn() { echo -e "${YELLOW}[nexo-update]${NC} $*"; }
+err()  { echo -e "${RED}[nexo-update]${NC} $*" >&2; }
+
+read_version() {
+    python3 -c "import json; print(json.load(open('$PACKAGE_JSON')).get('version','unknown'))" 2>/dev/null || echo "unknown"
+}
+
+# --- Step 1: Check for uncommitted changes in src/ ---
+log "Checking for uncommitted changes in src/..."
+cd "$REPO_DIR"
+
+if [ -n "$(git status --porcelain -- src/ 2>/dev/null)" ]; then
+    err "ABORTED: Uncommitted changes in src/"
+    git status --short -- src/
+    exit 1
+fi
+log "Working tree clean."
+
+# Record current state
+OLD_VERSION="$(read_version)"
+OLD_COMMIT="$(git rev-parse HEAD)"
+log "Current: v${OLD_VERSION} (${OLD_COMMIT:0:8})"
+
+# --- Step 2: Backup databases ---
+TIMESTAMP="$(date +%Y-%m-%d-%H%M)"
+BACKUP_DIR="$NEXO_HOME/backups/pre-update-$TIMESTAMP"
+
+backup_dbs() {
+    local found=0
+    # Check data/, NEXO_HOME root, and src/ for .db files
+    for dir in "$NEXO_HOME/data" "$NEXO_HOME" "$SRC_DIR"; do
+        if [ -d "$dir" ]; then
+            for db in "$dir"/*.db; do
+                [ -f "$db" ] || continue
+                found=1
+                mkdir -p "$BACKUP_DIR"
+                cp "$db" "$BACKUP_DIR/$(basename "$db")"
+                log "  Backed up: $(basename "$db")"
+            done
+        fi
+    done
+    if [ "$found" -eq 0 ]; then
+        log "  No databases found to backup."
+    fi
+}
+
+log "Backing up databases..."
+backup_dbs
+
+# --- Step 3: git pull ---
+log "Pulling from ${REMOTE}/${BRANCH}..."
+PULL_OUTPUT="$(git pull "$REMOTE" "$BRANCH" 2>&1)" || {
+    err "git pull failed:"
+    err "$PULL_OUTPUT"
+    exit 1
+}
+log "$PULL_OUTPUT"
+
+if echo "$PULL_OUTPUT" | grep -q "Already up to date"; then
+    log "Already up to date (v${OLD_VERSION}). Done."
+    exit 0
+fi
+
+# --- Step 4: Check version ---
+NEW_VERSION="$(read_version)"
+log "New version: v${NEW_VERSION}"
+
+# --- Step 5: Run migrations if version changed ---
+if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
+    log "Version changed: ${OLD_VERSION} -> ${NEW_VERSION}"
+    log "Running migrations..."
+    if ! (cd "$SRC_DIR" && python3 -c "import db; db.init_db()" 2>&1); then
+        err "Migration failed! Rolling back..."
+        git reset --hard "$OLD_COMMIT"
+        # Restore DB backups
+        if [ -d "$BACKUP_DIR" ]; then
+            for db in "$BACKUP_DIR"/*.db; do
+                [ -f "$db" ] || continue
+                BASENAME="$(basename "$db")"
+                for candidate in "$NEXO_HOME/data/$BASENAME" "$NEXO_HOME/$BASENAME" "$SRC_DIR/$BASENAME"; do
+                    if [ -f "$candidate" ]; then
+                        cp "$db" "$candidate"
+                        warn "  Restored: $BASENAME"
+                        break
+                    fi
+                done
+            done
+        fi
+        err "Rolled back to ${OLD_COMMIT:0:8}. Databases restored."
+        exit 1
+    fi
+    log "Migrations applied."
+else
+    log "Version unchanged (${OLD_VERSION}), skipping migrations."
+fi
+
+# --- Step 6: Verify import ---
+log "Verifying server.py import..."
+if ! (cd "$SRC_DIR" && python3 -c "import server" 2>&1); then
+    err "Import verification failed! Rolling back..."
+    git reset --hard "$OLD_COMMIT"
+    if [ -d "$BACKUP_DIR" ]; then
+        for db in "$BACKUP_DIR"/*.db; do
+            [ -f "$db" ] || continue
+            BASENAME="$(basename "$db")"
+            for candidate in "$NEXO_HOME/data/$BASENAME" "$NEXO_HOME/$BASENAME" "$SRC_DIR/$BASENAME"; do
+                if [ -f "$candidate" ]; then
+                    cp "$db" "$candidate"
+                    warn "  Restored: $BASENAME"
+                    break
+                fi
+            done
+        done
+    fi
+    err "Rolled back to ${OLD_COMMIT:0:8}. Databases restored."
+    exit 1
+fi
+
+# --- Done ---
+echo ""
+log "========================================="
+log " UPDATE SUCCESSFUL"
+if [ "$OLD_VERSION" != "$NEW_VERSION" ]; then
+    log " Version: ${OLD_VERSION} -> ${NEW_VERSION}"
+else
+    log " Version: ${OLD_VERSION} (unchanged)"
+fi
+log " Branch: ${REMOTE}/${BRANCH}"
+log " Backup: ${BACKUP_DIR}"
+log "========================================="
+echo ""
+warn "MCP server restart needed to load new code."

package/src/scripts/nexo-watchdog-smoke.py

@@ -10,18 +10,19 @@ from __future__ import annotations
 
 import hashlib
 import json
+import os
 import sqlite3
 import subprocess
 from datetime import datetime
 from pathlib import Path
 
 HOME = Path.home()
-CLAUDE_DIR = HOME / ".nexo"
-NEXO_DIR = CLAUDE_DIR / "nexo-mcp"
-CORTEX_DIR = CLAUDE_DIR / "cortex"
-LOG_DIR = CLAUDE_DIR / "logs"
+NEXO_HOME = Path(os.environ.get("NEXO_HOME", str(HOME / ".nexo")))
+NEXO_CODE = Path(os.environ.get("NEXO_CODE", str(NEXO_HOME)))
+BRAIN_DIR = NEXO_HOME / "brain"
+LOG_DIR = NEXO_HOME / "logs"
 SUMMARY_FILE = LOG_DIR / "watchdog-smoke-summary.json"
-HASH_REGISTRY = CLAUDE_DIR / "scripts" / ".watchdog-hashes"
+HASH_REGISTRY = NEXO_HOME / "scripts" / ".watchdog-hashes"
 RESTORE_LOG = LOG_DIR / "snapshot-restores.log"
 
 
@@ -41,7 +42,7 @@ def main() -> int:
     LOG_DIR.mkdir(parents=True, exist_ok=True)
     findings = []
 
-    db_path = NEXO_DIR / "nexo.db"
+    db_path = NEXO_HOME / "data" / "nexo.db"
     integrity = "missing"
     if db_path.exists():
         try:
@@ -53,15 +54,16 @@ def main() -> int:
     if integrity != "ok":
         findings.append({"severity": "ERROR", "area": "sqlite", "msg": f"integrity={integrity}"})
 
-    cortex_running = subprocess.run(
-        ["pgrep", "-f", "cortex-wrapper.py"],
+    # Check if the NEXO MCP server process is alive (replaces legacy cortex process check)
+    nexo_server_running = subprocess.run(
+        ["pgrep", "-f", "nexo-brain"],
         capture_output=True,
         text=True,
     ).returncode == 0
-    if not cortex_running:
-        findings.append({"severity": "WARN", "area": "cortex", "msg": "cortex-wrapper.py not running"})
+    if not nexo_server_running:
+        findings.append({"severity": "INFO", "area": "server", "msg": "nexo-brain not running (normal if no active session)"})
 
-    backups = sorted((NEXO_DIR / "backups").glob("nexo-*.db"), key=lambda p: p.stat().st_mtime, reverse=True)
+    backups = sorted((NEXO_HOME / "backups").glob("nexo-*.db"), key=lambda p: p.stat().st_mtime, reverse=True)
     if backups:
         age_seconds = int(datetime.now().timestamp() - backups[0].stat().st_mtime)
         if age_seconds > 7200:
@@ -84,7 +86,10 @@ def main() -> int:
     elif restore_count > 0:
         findings.append({"severity": "INFO", "area": "restore_activity", "msg": f"{restore_count} restores this hour"})
 
-    objective = CORTEX_DIR / "evolution-objective.json"
+    # Check brain/ (canonical) first, fall back to cortex/ (legacy)
+    objective = BRAIN_DIR / "evolution-objective.json"
+    if not objective.exists():
+        objective = NEXO_HOME / "cortex" / "evolution-objective.json"
     evolution_enabled = None
     if objective.exists():
         obj = json.loads(objective.read_text())
@@ -100,7 +105,7 @@ def main() -> int:
         "timestamp": datetime.now().isoformat(),
         "ok": not any(f["severity"] == "ERROR" for f in findings),
         "integrity": integrity,
-        "cortex_running": cortex_running,
+        "server_running": nexo_server_running,
         "evolution_enabled": evolution_enabled,
         "restore_count_current_hour": restore_count,
         "findings": findings,

package/src/scripts/nexo-watchdog.sh

@@ -13,7 +13,7 @@ set -uo pipefail
 HOME_DIR="$HOME"
 NEXO_HOME="${NEXO_HOME:-$HOME/.nexo}"
 NEXO_DIR="$NEXO_HOME"
-CORTEX_DIR="$NEXO_HOME/cortex"
+CORTEX_DIR="$NEXO_HOME/brain"
 OPS_DIR="$NEXO_HOME/operations"
 LOG_DIR="$NEXO_HOME/logs"
 LOG="$LOG_DIR/watchdog.log"
@@ -49,12 +49,12 @@ MONITORS=(
   "Cognitive Decay|com.nexo.cognitive-decay|$NEXO_HOME/logs/cognitive-decay-stdout.log|$NEXO_HOME/logs/cognitive-decay-stderr.log|90000||Daily 3:00 AM|core"
   "Evolution|com.nexo.evolution|$NEXO_HOME/logs/evolution-stdout.log|$NEXO_HOME/logs/evolution-stderr.log|0||Weekly Sun 3:00 AM|core"
   "GitHub Monitor|com.nexo.github-monitor|$NEXO_HOME/logs/github-monitor-stdout.log|$NEXO_HOME/logs/github-monitor-stderr.log|90000||Daily 8:00 AM|core"
-  "Immune|com.nexo.immune|$NEXO_HOME/coordination/immune-stdout.log|$NEXO_HOME/coordination/immune-stderr.log|3600||Every 30 min|core"
+  "Immune|com.nexo.immune|$NEXO_HOME/logs/immune-stdout.log|$NEXO_HOME/logs/immune-stderr.log|3600||Every 30 min|core"
   "Postmortem|com.nexo.postmortem|$NEXO_HOME/logs/postmortem-stdout.log|$NEXO_HOME/logs/postmortem-stderr.log|90000||Daily 23:30|core"
   "Prevent Sleep|com.nexo.prevent-sleep|||0|caffeinate|KeepAlive|core"
   "Self Audit|com.nexo.self-audit|$NEXO_HOME/logs/self-audit-stdout.log|$NEXO_HOME/logs/self-audit-stderr.log|90000||Daily 7:00 AM|core"
-  "Sleep|com.nexo.sleep|$NEXO_HOME/coordination/sleep-stdout.log|$NEXO_HOME/coordination/sleep-stderr.log|90000||Daily 4:00 AM|core"
-  "Synthesis|com.nexo.synthesis|$NEXO_HOME/coordination/synthesis-stdout.log|$NEXO_HOME/coordination/synthesis-stderr.log|10800||Every 2 hours|core"
+  "Sleep|com.nexo.sleep|$NEXO_HOME/logs/sleep-stdout.log|$NEXO_HOME/logs/sleep-stderr.log|90000||Daily 4:00 AM|core"
+  "Synthesis|com.nexo.synthesis|$NEXO_HOME/logs/synthesis-stdout.log|$NEXO_HOME/logs/synthesis-stderr.log|10800||Every 2 hours|core"
   "Deep Sleep|com.nexo.deep-sleep|$NEXO_HOME/logs/deep-sleep-stdout.log|$NEXO_HOME/logs/deep-sleep-stderr.log|90000||Daily 4:30 AM|core"
   "Followup Hygiene|com.nexo.followup-hygiene|$NEXO_HOME/logs/followup-hygiene-stdout.log|$NEXO_HOME/logs/followup-hygiene-stderr.log|604800||Weekly Sun 5:00 AM|core"
   # Add your own personal monitors below (type "personal"):
@@ -76,11 +76,13 @@ ERROR_PATTERNS="Traceback|Error:|CRITICAL|FATAL|ModuleNotFoundError|PermissionEr
 UID_NUM=$(id -u)
 REPAIR_LOG="$LOG_DIR/watchdog-repairs.log"
 TOTAL_HEALED=0
+IS_MACOS=false
+[ "$(uname)" = "Darwin" ] && IS_MACOS=true
 
 log_repair() { echo "[$TS] REPAIR: $1" >> "$REPAIR_LOG"; log "REPAIR: $1"; }
 
 is_loaded() {
-  launchctl list "$1" &>/dev/null
+  $IS_MACOS && launchctl list "$1" &>/dev/null
 }
 
 # ============================================================================
@@ -88,6 +90,7 @@ is_loaded() {
 # ============================================================================
 
 try_repair_launchagent() {
+  $IS_MACOS || return 1
   local plist_id="$1"
   local proc_grep="$2"
   local plist_file="$HOME_DIR/Library/LaunchAgents/${plist_id}.plist"
@@ -134,6 +137,7 @@ try_repair_cron() {
 }
 
 try_reexecute_missed_cron() {
+  $IS_MACOS || return 1
   # Re-execute a cron that missed its scheduled run
   # Extracts ProgramArguments from the plist and runs them
   local plist_id="$1"
@@ -184,6 +188,7 @@ except:
 }
 
 try_verify_repair() {
+  $IS_MACOS || return 1
   # After Level 2 repair, wait and verify the service is healthy
   local plist_id="$1"
   local log_stdout="$2"
@@ -236,7 +241,7 @@ try_repair_backup() {
     local newest
     newest=$(ls -t "$NEXO_DIR/backups/nexo-"*.db 2>/dev/null | head -1)
     if [ -n "$newest" ]; then
-      local age=$(( TS_EPOCH - $(stat -f %m "$newest") ))
+      if $IS_MACOS; then local age=$(( TS_EPOCH - $(stat -f %m "$newest") )); else local age=$(( TS_EPOCH - $(stat -c %Y "$newest") )); fi
       if [ "$age" -lt 60 ]; then
         log_repair "backup_cron.sh: ran successfully, fresh backup created"
         return 0
@@ -249,7 +254,11 @@ try_repair_backup() {
 file_age() {
   if [ -f "$1" ]; then
     local mod_epoch
-    mod_epoch=$(stat -f %m "$1" 2>/dev/null || echo 0)
+    if $IS_MACOS; then
+      mod_epoch=$(stat -f %m "$1" 2>/dev/null || echo 0)
+    else
+      mod_epoch=$(stat -c %Y "$1" 2>/dev/null || echo 0)
+    fi
     echo $(( TS_EPOCH - mod_epoch ))
   else
     echo 999999
@@ -511,7 +520,7 @@ done
 # --- SQLite integrity ---
 SQLITE_STATUS="PASS"
 SQLITE_DETAIL=""
-INTEGRITY=$(sqlite3 "$NEXO_DIR/nexo.db" "PRAGMA integrity_check;" 2>/dev/null || echo "CORRUPT")
+INTEGRITY=$(sqlite3 "$NEXO_DIR/data/nexo.db" "PRAGMA integrity_check;" 2>/dev/null || echo "CORRUPT")
 if [ "$INTEGRITY" != "ok" ]; then
   SQLITE_STATUS="FAIL"
   SQLITE_DETAIL="Integrity check: $INTEGRITY"
@@ -519,7 +528,7 @@ if [ "$INTEGRITY" != "ok" ]; then
   TOTAL_FAIL=$((TOTAL_FAIL + 1))
   LATEST_BACKUP=$(ls -t "$NEXO_DIR/backups/nexo-"*.db 2>/dev/null | head -1)
   if [ -n "$LATEST_BACKUP" ]; then
-    cp "$LATEST_BACKUP" "$NEXO_DIR/nexo.db"
+    cp "$LATEST_BACKUP" "$NEXO_DIR/data/nexo.db"
     log "RESTORED from $LATEST_BACKUP"
     SQLITE_DETAIL="${SQLITE_DETAIL}. Restored from backup."
   fi
@@ -576,7 +585,7 @@ BACKUP_STATUS="PASS"
 BACKUP_DETAIL=""
 LATEST_BACKUP=$(ls -t "$NEXO_DIR/backups/nexo-"*.db 2>/dev/null | head -1)
 if [ -n "$LATEST_BACKUP" ]; then
-  BACKUP_AGE=$(( TS_EPOCH - $(stat -f %m "$LATEST_BACKUP") ))
+  if $IS_MACOS; then BACKUP_AGE=$(( TS_EPOCH - $(stat -f %m "$LATEST_BACKUP") )); else BACKUP_AGE=$(( TS_EPOCH - $(stat -c %Y "$LATEST_BACKUP") )); fi
   BACKUP_AGE_STR=$(format_age "$BACKUP_AGE")
   if [ "$BACKUP_AGE" -gt 7200 ]; then
     # AUTO-REPAIR: run backup now
@@ -603,7 +612,7 @@ fi
 # --- Cognitive DB check ---
 COG_STATUS="PASS"
 COG_DETAIL=""
-COG_DB="$NEXO_DIR/cognitive.db"
+COG_DB="$NEXO_DIR/data/cognitive.db"
 if [ -f "$COG_DB" ]; then
   COG_INT=$(sqlite3 "$COG_DB" "PRAGMA integrity_check;" 2>/dev/null || echo "CORRUPT")
   if [ "$COG_INT" != "ok" ]; then
@@ -724,7 +733,7 @@ if [ "$TOTAL_FAIL" -gt 0 ]; then
   LOCK_AGE=999999
   SKIP_REPAIR=false
   if [ -f "$REPAIR_LOCK" ]; then
-    LOCK_AGE=$(( TS_EPOCH - $(stat -f %m "$REPAIR_LOCK" 2>/dev/null || echo 0) ))
+    if $IS_MACOS; then LOCK_AGE=$(( TS_EPOCH - $(stat -f %m "$REPAIR_LOCK" 2>/dev/null || echo 0) )); else LOCK_AGE=$(( TS_EPOCH - $(stat -c %Y "$REPAIR_LOCK" 2>/dev/null || echo 0) )); fi
     if [ "$LOCK_AGE" -lt "$REPAIR_COOLDOWN" ]; then
       log "NEXO repair skipped: cooldown (${LOCK_AGE}s < ${REPAIR_COOLDOWN}s)"
       SKIP_REPAIR=true
@@ -773,7 +782,7 @@ ${STDOUT_TAIL}
       if $HAS_CORE_FAILS && [ -n "$NEXO_PUBLIC_REPO" ] && [ -d "$NEXO_PUBLIC_REPO/.git" ]; then
         PROPAGATE_BLOCK="
 PROPAGATION (for [core] fixes ONLY):
-If your fix modifies a file under $NEXO_HOME/ (server.py, db.py, plugins/, scripts/):
+If your fix modifies a file under $NEXO_HOME/ (server.py, db/, plugins/, scripts/):
 1. Commit the fix locally with a descriptive message
 2. Copy the changed files (sanitized — no personal data) to $NEXO_PUBLIC_REPO/src/
 3. Bump patch version in $NEXO_PUBLIC_REPO/package.json