nexo-brain 2.3.1 → 2.4.0

package/src/dashboard/templates/calendar.html

@@ -303,7 +303,7 @@
             btn.innerHTML = `<svg class="w-3 h-3 spin" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2"><path stroke-linecap="round" stroke-linejoin="round" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15"/></svg> Running`;
             btn.disabled = true;
             try {
-                const res = await fetch(`/api/followups/${id}/execute`, { method: 'POST' });
+                const res = await fetch(`/api/ops/execute/${id}`, { method: 'POST' });
                 const data = await res.json();
                 if (res.ok) {
                     btn.innerHTML = `<svg class="w-3 h-3" fill="none" viewBox="0 0 24 24" stroke="currentColor" stroke-width="2.5"><path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/></svg> Done`;
@@ -311,13 +311,15 @@
                     // Reload items in background
                     await loadCalendarData();
                 } else {
-                    btn.innerHTML = '✗ Failed';
+                    const errMsg = data.error || data.detail || 'HTTP ' + res.status;
+                    btn.innerHTML = '✗ ' + errMsg;
+                    btn.title = errMsg;
                     btn.className = btn.className.replace('bg-violet-600 hover:bg-violet-500', 'bg-red-700');
-                    setTimeout(() => { btn.innerHTML = originalHtml; btn.disabled = false; btn.className = btn.className.replace('bg-red-700', 'bg-violet-600 hover:bg-violet-500'); }, 2000);
+                    setTimeout(() => { btn.innerHTML = originalHtml; btn.title = ''; btn.disabled = false; btn.className = btn.className.replace('bg-red-700', 'bg-violet-600 hover:bg-violet-500'); }, 3000);
                 }
             } catch(e) {
-                btn.innerHTML = '✗ Error';
-                setTimeout(() => { btn.innerHTML = originalHtml; btn.disabled = false; }, 2000);
+                btn.innerHTML = '✗ ' + e.message;
+                setTimeout(() => { btn.innerHTML = originalHtml; btn.disabled = false; }, 3000);
             }
         }
 

package/src/dashboard/templates/dashboard.html

@@ -310,9 +310,16 @@
   async function fetchJSON(url) {
     try {
       const res = await fetch(url);
-      if (!res.ok) return null;
+      if (!res.ok) {
+        let detail = `HTTP ${res.status}`;
+        try { const b = await res.json(); detail = b.error || b.detail || detail; } catch {}
+        throw new Error(detail);
+      }
       return await res.json();
-    } catch { return null; }
+    } catch (err) {
+      console.error(`fetchJSON(${url}):`, err);
+      return null;
+    }
   }
 
   function getToday() {
@@ -387,7 +394,7 @@
         closeModal();
         loadDashboardData();
       } else {
-        showToast(data.error || 'Failed to create');
+        showToast(data.error || data.detail || 'Create failed (HTTP ' + res.status + ')');
       }
     } catch (err) {
       showToast('Error: ' + err.message);

package/src/dashboard/templates/inbox.html

@@ -245,6 +245,11 @@
         async function loadMessages() {
             try {
                 const res = await fetch('/api/inbox?limit=200');
+                if (!res.ok) {
+                    let detail = `HTTP ${res.status}`;
+                    try { const b = await res.json(); detail = b.error || b.detail || detail; } catch {}
+                    throw new Error(detail);
+                }
                 const data = await res.json();
                 messages = data.notes || [];
                 messages.sort((a, b) => new Date(a.created_at) - new Date(b.created_at));
@@ -281,6 +286,11 @@
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify(body)
                 });
+                if (!res.ok) {
+                    let detail = `HTTP ${res.status}`;
+                    try { const b = await res.json(); detail = b.error || b.detail || detail; } catch {}
+                    throw new Error(detail);
+                }
                 const data = await res.json();
                 textarea.value = '';
                 cancelReply();

package/src/dashboard/templates/operations.html

@@ -368,9 +368,16 @@
   async function fetchJSON(url) {
     try {
       const res = await fetch(url);
-      if (!res.ok) return null;
+      if (!res.ok) {
+        let detail = `HTTP ${res.status}`;
+        try { const b = await res.json(); detail = b.error || b.detail || detail; } catch {}
+        throw new Error(detail);
+      }
       return await res.json();
-    } catch { return null; }
+    } catch (err) {
+      console.error(`fetchJSON(${url}):`, err);
+      return null;
+    }
   }
 
   // -----------------------------------------------------------------------
@@ -538,56 +545,72 @@
   // Actions
   // -----------------------------------------------------------------------
   async function completeItem(id, type) {
-    const url = type === 'reminder' ? '/api/reminders/' + id : '/api/followups/' + id;
-    const res = await fetch(url, {
-      method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ status: 'COMPLETED' })
-    });
-    const data = await res.json();
-    if (data.success) {
-      showToast('Completed ' + id);
-      loadOpsData();
-    } else {
-      showToast(data.error || 'Failed', 'error');
+    try {
+      const url = type === 'reminder' ? '/api/reminders/' + id : '/api/followups/' + id;
+      const res = await fetch(url, {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ status: 'COMPLETED' })
+      });
+      const data = await res.json();
+      if (data.success) {
+        showToast('Completed ' + id);
+        loadOpsData();
+      } else {
+        showToast(data.error || data.detail || 'Complete failed (HTTP ' + res.status + ')', 'error');
+      }
+    } catch (err) {
+      showToast('Complete error: ' + err.message, 'error');
     }
   }
 
   async function moveItem(id, direction) {
-    const res = await fetch('/api/ops/move', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ id, direction })
-    });
-    const data = await res.json();
-    if (data.success) {
-      showToast('Moved ' + id + ' to ' + (direction === 'to_followup' ? 'NEXO' : 'User'));
-      loadOpsData();
-    } else {
-      showToast(data.error || 'Failed to move', 'error');
+    try {
+      const res = await fetch('/api/ops/move', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ id, direction })
+      });
+      const data = await res.json();
+      if (data.success) {
+        showToast('Moved ' + id + ' to ' + (direction === 'to_followup' ? 'NEXO' : 'User'));
+        loadOpsData();
+      } else {
+        showToast(data.error || data.detail || 'Move failed (HTTP ' + res.status + ')', 'error');
+      }
+    } catch (err) {
+      showToast('Move error: ' + err.message, 'error');
     }
   }
 
   async function executeItem(id) {
-    const res = await fetch('/api/ops/execute/' + id, { method: 'POST' });
-    const data = await res.json();
-    if (data.success) {
-      showToast('Executing ' + id, 'info');
-    } else {
-      showToast(data.error || 'Failed', 'error');
+    try {
+      const res = await fetch('/api/ops/execute/' + id, { method: 'POST' });
+      const data = await res.json();
+      if (data.success) {
+        showToast('Executing ' + id, 'info');
+      } else {
+        showToast(data.error || data.detail || 'Execute failed (HTTP ' + res.status + ')', 'error');
+      }
+    } catch (err) {
+      showToast('Execute error: ' + err.message, 'error');
     }
   }
 
   function deleteItem(id, type) {
     pendingConfirmAction = async () => {
-      const url = type === 'reminder' ? '/api/reminders/' + id : '/api/followups/' + id;
-      const res = await fetch(url, { method: 'DELETE' });
-      const data = await res.json();
-      if (data.success) {
-        showToast('Deleted ' + id);
-        loadOpsData();
-      } else {
-        showToast(data.error || 'Failed', 'error');
+      try {
+        const url = type === 'reminder' ? '/api/reminders/' + id : '/api/followups/' + id;
+        const res = await fetch(url, { method: 'DELETE' });
+        const data = await res.json();
+        if (data.success) {
+          showToast('Deleted ' + id);
+          loadOpsData();
+        } else {
+          showToast(data.error || data.detail || 'Delete failed (HTTP ' + res.status + ')', 'error');
+        }
+      } catch (err) {
+        showToast('Delete error: ' + err.message, 'error');
       }
     };
     document.getElementById('confirm-message').textContent = 'Delete ' + id + '? This cannot be undone.';
@@ -693,10 +716,10 @@
         closeModal();
         loadOpsData();
       } else {
-        showToast(data.error || 'Failed', 'error');
+        showToast(data.error || data.detail || 'Save failed (HTTP ' + res.status + ')', 'error');
       }
     } catch (err) {
-      showToast('Error: ' + err.message, 'error');
+      showToast('Save error: ' + err.message, 'error');
     }
   }
 

package/src/dashboard/templates/sessions.html

@@ -120,6 +120,11 @@
 
             try {
                 const resp = await fetch(`/api/sessions?limit=${PAGE_SIZE}&offset=${offset}`);
+                if (!resp.ok) {
+                    let detail = `HTTP ${resp.status}`;
+                    try { const b = await resp.json(); detail = b.error || b.detail || detail; } catch {}
+                    throw new Error(detail);
+                }
                 const data = await resp.json();
                 const sessions = data.sessions || [];
 
@@ -136,13 +141,19 @@
                     btn.disabled = false;
                 }
             } catch (err) {
-                btn.textContent = 'Error — retry';
+                btn.textContent = 'Error: ' + err.message + ' — retry';
                 btn.disabled = false;
             }
         }
 
         async function init() {
             const resp = await fetch(`/api/sessions?limit=${PAGE_SIZE}&offset=0`);
+            if (!resp.ok) {
+                let detail = `HTTP ${resp.status}`;
+                try { const b = await resp.json(); detail = b.error || b.detail || detail; } catch {}
+                document.getElementById('sessions').innerHTML = `<p class="text-sm text-red-400 text-center py-8">Error loading sessions: ${detail}</p>`;
+                return;
+            }
             const data = await resp.json();
             const sessions = data.sessions || [];
             const container = document.getElementById('sessions');

package/src/db/_schema.py

@@ -358,6 +358,14 @@ def _m17_cron_runs(conn):
     _migrate_add_index(conn, "idx_cron_runs_started", "cron_runs", "started_at")
 
 
+def _m18_skills_steps(conn):
+    # content: the full procedure — markdown with steps, gotchas, notes.
+    # Can also reference a script file via file_path column.
+    _migrate_add_column(conn, "skills", "content", "TEXT DEFAULT ''")
+    _migrate_add_column(conn, "skills", "steps", "TEXT DEFAULT '[]'")
+    _migrate_add_column(conn, "skills", "gotchas", "TEXT DEFAULT '[]'")
+
+
 MIGRATIONS = [
     (1, "learnings_columns", _m1_learnings_columns),
     (2, "followups_reasoning", _m2_followups_reasoning),
@@ -376,6 +384,7 @@ MIGRATIONS = [
     (15, "core_rules_tables", _m15_core_rules_tables),
     (16, "skills_tables", _m16_skills_tables),
     (17, "cron_runs", _m17_cron_runs),
+    (18, "skills_steps_column", _m18_skills_steps),
 ]
 
 
@@ -399,6 +408,7 @@ def run_migrations(conn=None):
 
     applied = {r[0] for r in conn.execute("SELECT version FROM schema_migrations").fetchall()}
 
+    failed = []
     for version, name, fn in MIGRATIONS:
         if version not in applied:
             try:
@@ -409,9 +419,18 @@ def run_migrations(conn=None):
                 )
                 conn.commit()
             except Exception as e:
-                # Log but don't crash — partial migration is better than no server
+                conn.rollback()
                 import sys
                 print(f"[MIGRATION] v{version} ({name}) failed: {e}", file=sys.stderr)
+                failed.append((version, name, str(e)))
+                # Stop on first failure — don't run subsequent migrations
+                # against a potentially inconsistent schema
+                break
+
+    if failed:
+        raise RuntimeError(
+            f"Migration failed: v{failed[0][0]} ({failed[0][1]}): {failed[0][2]}"
+        )
 
     return len(MIGRATIONS) - len(applied)
 

package/src/db/_skills.py

@@ -39,8 +39,17 @@ def create_skill(
     linked_learnings: list | str = '[]',
     file_path: str = '',
     trust_score: int = TRUST_INITIAL,
+    steps: list | str = '[]',
+    gotchas: list | str = '[]',
+    content: str = '',
 ) -> dict:
-    """Create a new skill entry."""
+    """Create a new skill entry.
+
+    Content can be:
+    - Markdown with numbered steps (auto-generated from steps/gotchas if empty)
+    - A reference to a script file (set file_path)
+    - Free-form procedure description
+    """
     if level not in VALID_LEVELS:
         return {"error": f"level must be one of: {', '.join(sorted(VALID_LEVELS))}"}
 
@@ -48,15 +57,31 @@ def create_skill(
     trigger_json = json.dumps(trigger_patterns) if isinstance(trigger_patterns, list) else trigger_patterns
     sessions_json = json.dumps(source_sessions) if isinstance(source_sessions, list) else source_sessions
     learnings_json = json.dumps(linked_learnings) if isinstance(linked_learnings, list) else linked_learnings
+    steps_json = json.dumps(steps) if isinstance(steps, list) else steps
+    gotchas_json = json.dumps(gotchas) if isinstance(gotchas, list) else gotchas
+
+    # Auto-generate content from steps/gotchas if not provided
+    if not content and steps:
+        steps_list = steps if isinstance(steps, list) else json.loads(steps_json)
+        gotchas_list = gotchas if isinstance(gotchas, list) else json.loads(gotchas_json)
+        lines = [f"# {name}", "", description, "", "## Steps"]
+        for i, s in enumerate(steps_list, 1):
+            lines.append(f"{i}. {s}")
+        if gotchas_list:
+            lines.extend(["", "## Gotchas"])
+            for g in gotchas_list:
+                lines.append(f"- {g}")
+        content = "\n".join(lines)
 
     conn = get_db()
     conn.execute(
         """INSERT INTO skills
            (id, name, description, level, trust_score, file_path, tags,
-            trigger_patterns, source_sessions, linked_learnings)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+            trigger_patterns, source_sessions, linked_learnings, content, steps, gotchas)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
         (skill_id, name, description, level, trust_score, file_path,
-         tags_json, trigger_json, sessions_json, learnings_json),
+         tags_json, trigger_json, sessions_json, learnings_json,
+         content, steps_json, gotchas_json),
     )
     conn.commit()
 

package/src/hooks/capture-tool-logs.sh

@@ -24,25 +24,43 @@ TODAY=$(date +%Y-%m-%d)
 LOG_FILE="$LOG_DIR/${TODAY}.jsonl"
 
 # Build and write record with python3 (faster than jq on macOS when cached)
+# Security: redact output of credential-related tools to avoid plaintext secrets in logs
 echo "$INPUT" | python3 -c "
-import json, sys
+import json, sys, re
 from datetime import datetime
 d = json.load(sys.stdin)
+tool_name = d.get('tool_name', 'unknown')
+
+tool_input = d.get('tool_input')
+tool_response = d.get('tool_response')
+
+# Redact tools that handle credentials/secrets
+SENSITIVE_TOOLS = ('credential', 'secret', 'token', 'password', 'apikey', 'api_key')
+if any(kw in tool_name.lower() for kw in SENSITIVE_TOOLS):
+    tool_response = '[REDACTED]'
+    # Also redact input values (keep keys for debuggability)
+    if isinstance(tool_input, dict):
+        tool_input = {k: '[REDACTED]' if k not in ('servicio', 'service', 'name', 'key') else v for k, v in tool_input.items()}
+
 record = {
     'timestamp': datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%SZ'),
     'session_id': d.get('session_id', 'unknown'),
-    'tool_name': d.get('tool_name', 'unknown'),
+    'tool_name': tool_name,
     'hook_event': d.get('hook_event_name', 'unknown'),
     'tool_use_id': d.get('tool_use_id'),
-    'tool_input': d.get('tool_input'),
-    'tool_response': d.get('tool_response'),
+    'tool_input': tool_input,
+    'tool_response': tool_response,
     'error': d.get('error')
 }
 print(json.dumps(record))
 " >> "$LOG_FILE" 2>/dev/null
 
-# ── Layer 1: Auto-diary every 10 tool calls ─────────────────────────
-COUNTER_FILE="$NEXO_HOME/operations/.tool-call-count"
+# ── Layer 1: Auto-diary every 10 tool calls (session-scoped) ─────────
+# Extract session_id for per-session counters (prevents cross-terminal contamination)
+SESSION_ID=$(echo "$INPUT" | python3 -c "import sys,json; print(json.load(sys.stdin).get('session_id','global'))" 2>/dev/null || echo "global")
+COUNTER_DIR="$NEXO_HOME/operations/counters"
+mkdir -p "$COUNTER_DIR"
+COUNTER_FILE="$COUNTER_DIR/.tool-call-count-${SESSION_ID}"
 NEXO_DB="$NEXO_HOME/data/nexo.db"
 
 # Increment counter (atomic: read+write in one step)
@@ -86,12 +104,25 @@ if not entries:
 
 tools_summary = ', '.join(entries[-10:])
 
-# Get current session and task from sessions table
+# Get session by claude session_id (scoped), fallback to most recent
+session_id = '$SESSION_ID'
 conn = sqlite3.connect(db_path, timeout=2)
 conn.row_factory = sqlite3.Row
-row = conn.execute(
-    'SELECT sid, task FROM sessions ORDER BY last_update_epoch DESC LIMIT 1'
-).fetchone()
+
+# Try to find NEXO SID mapped to this claude session_id
+row = None
+if session_id and session_id != 'global':
+    row = conn.execute(
+        'SELECT sid, task FROM sessions WHERE claude_session_id = ? LIMIT 1',
+        (session_id,)
+    ).fetchone()
+
+# Fallback: most recent active session
+if not row:
+    row = conn.execute(
+        'SELECT sid, task FROM sessions ORDER BY last_update_epoch DESC LIMIT 1'
+    ).fetchone()
+
 if not row:
     conn.close()
     sys.exit(0)

package/src/hooks/session-start.sh

@@ -92,10 +92,11 @@ try:
 
         try:
             rows = db.execute(
-                'SELECT sid, task, started FROM sessions '
-                'WHERE completed=0 AND (strftime(\"%s\",\"now\") - last_update) < 900'
+                'SELECT sid, task, started_epoch FROM sessions '
+                'WHERE (strftime(\"%s\",\"now\") - last_update_epoch) < 900'
             ).fetchall()
-            sessions = [{'sid': r['sid'], 'task': r['task'], 'started': r['started'][:16]} for r in rows]
+            from datetime import datetime as _dt
+            sessions = [{'sid': r['sid'], 'task': r['task'], 'started': _dt.fromtimestamp(r['started_epoch']).strftime('%Y-%m-%d %H:%M') if r['started_epoch'] else '?'} for r in rows]
         except Exception:
             pass
 

package/src/plugin_loader.py

@@ -87,6 +87,10 @@ def load_plugin(mcp, filename: str, plugins_dir: str | None = None) -> int:
     if not filename.endswith(".py"):
         filename += ".py"
 
+    # Reject path separators and traversal sequences before joining
+    if "/" in filename or "\\" in filename or ".." in filename:
+        raise ValueError(f"Invalid plugin filename (path separators or '..' not allowed): {filename}")
+
     if plugins_dir is not None:
         filepath = os.path.join(plugins_dir, filename)
         if not os.path.isfile(filepath):
@@ -106,6 +110,16 @@ def load_plugin(mcp, filename: str, plugins_dir: str | None = None) -> int:
                 f"Plugin not found in repo ({PLUGINS_DIR}) or personal ({PERSONAL_PLUGINS_DIR}): {filename}"
             )
 
+    # Security: reject path traversal — resolved path must stay inside allowed directories
+    real_path = os.path.realpath(filepath)
+    real_plugins = os.path.realpath(PLUGINS_DIR)
+    real_personal = os.path.realpath(PERSONAL_PLUGINS_DIR)
+    if not (real_path.startswith(real_plugins + os.sep) or real_path.startswith(real_personal + os.sep)):
+        raise ValueError(
+            f"Path traversal blocked: {filename!r} resolves to {real_path}, "
+            f"which is outside {real_plugins} and {real_personal}"
+        )
+
     module_name = f"plugins.{filename[:-3]}"
 
     # For personal plugins (outside repo), use spec_from_file_location