nexo-brain 3.0.0 → 3.0.2

package/src/plugins/backup.py

@@ -21,10 +21,14 @@ def handle_backup_now() -> str:
     # Use SQLite backup API for consistency
     import sqlite3
     src_conn = sqlite3.connect(DB_PATH)
-    dst_conn = sqlite3.connect(dest)
-    src_conn.backup(dst_conn)
-    dst_conn.close()
-    src_conn.close()
+    try:
+        dst_conn = sqlite3.connect(dest)
+        try:
+            src_conn.backup(dst_conn)
+        finally:
+            dst_conn.close()
+    finally:
+        src_conn.close()
 
     size_kb = os.path.getsize(dest) / 1024
     _cleanup_old()
@@ -63,17 +67,25 @@ def handle_backup_restore(filename: str) -> str:
     safety = os.path.join(BACKUP_DIR, f"nexo-pre-restore-{time.strftime('%Y%m%d%H%M%S')}.db")
     import sqlite3
     src_conn = sqlite3.connect(DB_PATH)
-    dst_conn = sqlite3.connect(safety)
-    src_conn.backup(dst_conn)
-    dst_conn.close()
-    src_conn.close()
+    try:
+        dst_conn = sqlite3.connect(safety)
+        try:
+            src_conn.backup(dst_conn)
+        finally:
+            dst_conn.close()
+    finally:
+        src_conn.close()
 
     # Restore
     restore_conn = sqlite3.connect(src)
-    target_conn = sqlite3.connect(DB_PATH)
-    restore_conn.backup(target_conn)
-    target_conn.close()
-    restore_conn.close()
+    try:
+        target_conn = sqlite3.connect(DB_PATH)
+        try:
+            restore_conn.backup(target_conn)
+        finally:
+            target_conn.close()
+    finally:
+        restore_conn.close()
 
     # Invalidate shared connection so db.py reconnects to restored data
     import db

package/src/plugins/schedule.py

@@ -3,6 +3,7 @@
 import json
 import os
 import platform
+import re
 import subprocess
 from pathlib import Path
 
@@ -69,9 +70,20 @@ def _summary_has_warning(summary: str = "") -> bool:
     lowered = str(summary or "").strip().lower()
     if not lowered:
         return False
+    if re.search(r"\b[1-9]\d*\s+(errors?|warnings?)\b", lowered):
+        return True
     if "no warning" in lowered or "without warnings" in lowered:
         return False
-    warning_tokens = ("warning", "warnings", "warn:", "degraded", "partial failure", "issues detected")
+    warning_tokens = (
+        "warning",
+        "warnings",
+        "warn:",
+        "degraded",
+        "partial failure",
+        "issues detected",
+        "completed with findings",
+        "findings detected",
+    )
     return any(token in lowered for token in warning_tokens)
 
 

package/src/plugins/update.py

@@ -149,14 +149,21 @@ def _backup_databases() -> tuple[str, str | None]:
 
     for db_file in db_files:
         dest = backup_dir / db_file.name
+        src_conn = None
+        dst_conn = None
         try:
             src_conn = sqlite3.connect(str(db_file))
             dst_conn = sqlite3.connect(str(dest))
             src_conn.backup(dst_conn)
-            dst_conn.close()
-            src_conn.close()
         except Exception as e:
             return str(backup_dir), f"Failed to backup {db_file.name}: {e}"
+        finally:
+            for conn in (dst_conn, src_conn):
+                if conn is not None:
+                    try:
+                        conn.close()
+                    except Exception:
+                        pass
 
     return str(backup_dir), None
 
@@ -170,14 +177,21 @@ def _restore_databases(backup_dir: str):
         # Try to find original location
         for candidate in [DATA_DIR / db_backup.name, NEXO_HOME / db_backup.name, SRC_DIR / db_backup.name]:
             if candidate.is_file():
+                src_conn = None
+                dst_conn = None
                 try:
                     src_conn = sqlite3.connect(str(db_backup))
                     dst_conn = sqlite3.connect(str(candidate))
                     src_conn.backup(dst_conn)
-                    dst_conn.close()
-                    src_conn.close()
                 except Exception:
                     pass
+                finally:
+                    for conn in (dst_conn, src_conn):
+                        if conn is not None:
+                            try:
+                                conn.close()
+                            except Exception:
+                                pass
                 break
 
 

package/src/public_contribution.py

@@ -14,7 +14,7 @@ import re
 import shutil
 import socket
 import subprocess
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from pathlib import Path
 
 from runtime_power import load_schedule_config, save_schedule_config
@@ -33,8 +33,6 @@ STATUS_PENDING_AUTH = "pending_auth"
 STATUS_PAUSED_OPEN_PR = "paused_open_pr"
 STATUS_COOLDOWN = "cooldown"
 STATUS_OFF = "off"
-COOLDOWN_HOURS_MERGED = 168
-COOLDOWN_HOURS_CLOSED = 72
 VALID_MODES = {MODE_UNSET, MODE_OFF, MODE_DRAFT_PRS, MODE_PENDING_AUTH}
 VALID_STATUSES = {
     STATUS_UNSET,
@@ -224,10 +222,6 @@ def _parse_iso(ts: str | None) -> datetime | None:
         return None
 
 
-def _future_iso(hours: int) -> str:
-    return (_utcnow() + timedelta(hours=hours)).isoformat()
-
-
 def format_public_contribution_label(config: dict | None = None) -> str:
     cfg = normalize_public_contribution_config(config)
     if cfg["mode"] == MODE_DRAFT_PRS:
@@ -369,12 +363,13 @@ def refresh_public_contribution_state(config: dict | None = None) -> dict:
                 config["status"] = STATUS_PAUSED_OPEN_PR
                 save_public_contribution_config(config)
                 return config
+            resolution = "merged" if payload.get("mergedAt") else "closed"
             config["active_pr_url"] = ""
             config["active_pr_number"] = None
             config["active_branch"] = ""
-            cooldown_hours = COOLDOWN_HOURS_MERGED if payload.get("mergedAt") else COOLDOWN_HOURS_CLOSED
-            config["cooldown_until"] = _future_iso(cooldown_hours)
-            config["status"] = STATUS_COOLDOWN
+            config["cooldown_until"] = ""
+            config["status"] = STATUS_ACTIVE
+            config["last_result"] = f"resolved_pr:{resolution}:{payload.get('url') or ''}".rstrip(":")
             save_public_contribution_config(config)
             return config
         return _set_pending_auth(
@@ -384,7 +379,11 @@ def refresh_public_contribution_state(config: dict | None = None) -> dict:
 
     cooldown_until = _parse_iso(config.get("cooldown_until"))
     if cooldown_until and cooldown_until > _utcnow():
-        config["status"] = STATUS_COOLDOWN
+        # Legacy installs used a post-merge/close cooldown that blocked the next
+        # public contribution cycle even after maintainers resolved the Draft PR.
+        # Public contribution should pause only while the PR is still open.
+        config["cooldown_until"] = ""
+        config["status"] = STATUS_ACTIVE
         save_public_contribution_config(config)
         return config
 
@@ -430,9 +429,6 @@ def can_run_public_contribution(config: dict | None = None) -> tuple[bool, str,
         return False, "public contribution is disabled", config
     if config["status"] == STATUS_PAUSED_OPEN_PR:
         return False, "an active Draft PR is already open for this machine", config
-    cooldown_until = _parse_iso(config.get("cooldown_until"))
-    if cooldown_until and cooldown_until > _utcnow():
-        return False, f"cooldown until {cooldown_until.isoformat()}", config
     return True, "", config
 
 

package/src/requirements.txt

@@ -11,3 +11,4 @@ fastapi
 uvicorn
 pydantic
 jinja2
+tomli; python_version < "3.11"

package/src/scripts/nexo-catchup.py

@@ -197,14 +197,14 @@ def main():
         log("Catch-Up already running; skipping overlapping invocation.")
         return
 
-    _heal_personal_schedules()
-    state = load_state()
-    tasks = catchup_candidates()
-
     ran = 0
     skipped = 0
     skipped_out_of_window = 0
     try:
+        _heal_personal_schedules()
+        state = load_state()
+        tasks = catchup_candidates()
+
         for candidate in tasks:
             name = candidate["cron_id"]
             if not candidate.get("missed"):
@@ -221,19 +221,19 @@ def main():
             log(f"  {name} — missed scheduled run due at {due_at}, catching up...")
             if run_task(candidate, state):
                 ran += 1
-    finally:
-        lock_handle.close()
 
-    if ran == 0 and skipped_out_of_window == 0:
-        log("All tasks up to date, nothing to catch up.")
-    elif ran >= 3:
-        # Many tasks caught up — ask CLI to assess system state
-        _cli_post_catchup_assessment(ran, skipped, state)
-    else:
-        suffix = f", {skipped_out_of_window} outside recovery window" if skipped_out_of_window else ""
-        log(f"Caught up {ran} tasks, {skipped} already current{suffix}.")
+        if ran == 0 and skipped_out_of_window == 0:
+            log("All tasks up to date, nothing to catch up.")
+        elif ran >= 3:
+            # Many tasks caught up — ask CLI to assess system state
+            _cli_post_catchup_assessment(ran, skipped, state)
+        else:
+            suffix = f", {skipped_out_of_window} outside recovery window" if skipped_out_of_window else ""
+            log(f"Caught up {ran} tasks, {skipped} already current{suffix}.")
 
-    log("=== Catch-Up complete ===")
+        log("=== Catch-Up complete ===")
+    finally:
+        lock_handle.close()
 
 
 def _cli_post_catchup_assessment(ran: int, skipped: int, state: dict):

package/src/scripts/nexo-daily-self-audit.py

@@ -1407,8 +1407,19 @@ def main():
     except Exception:
         pass
 
+    if errors or warns:
+        log(
+            f"Self-audit completed with findings: {errors} errors, {warns} warnings, {infos} info. "
+            f"Summary written to {summary_file}."
+        )
+    else:
+        log(
+            f"Self-audit completed cleanly: {errors} errors, {warns} warnings, {infos} info. "
+            f"Summary written to {summary_file}."
+        )
+
     log("=" * 60)
-    return 1 if errors > 0 else 0
+    return 0
 
 
 if __name__ == "__main__":

package/src/scripts/nexo-evolution-run.py

@@ -364,8 +364,6 @@ def _sanitize_public_diff(worktree_dir: Path, changed_files: list[str]) -> tuple
     private_markers = [
         str(Path.home()),
         str(NEXO_HOME),
-        "/Users/",
-        "/home/",
         "CLAUDE.md",
         "AGENTS.md",
         ".nexo/",
@@ -374,6 +372,14 @@ def _sanitize_public_diff(worktree_dir: Path, changed_files: list[str]) -> tuple
     for marker in private_markers:
         if marker and marker in diff_text:
             return False, f"Sanitization blocked private marker in diff: {marker}"
+    private_path_patterns = [
+        re.compile(r"/Users/[^/\s\"']+/"),
+        re.compile(r"/home/[^/\s\"']+/"),
+    ]
+    for pattern in private_path_patterns:
+        match = pattern.search(diff_text)
+        if match:
+            return False, f"Sanitization blocked private path in diff: {match.group(0)}"
     return True, ""
 
 
@@ -865,7 +871,7 @@ def run_public_contribution_cycle(*, objective: dict, cycle_num: int) -> None:
 
         pr_url, pr_number = _create_draft_pr(worktree_dir, config, branch_name, summary)
         artifact_dir = _write_public_artifacts(worktree_dir, branch_name, summary)
-        mark_active_pr(pr_url=pr_url, pr_number=pr_number, branch=branch_name, config=config)
+        config = mark_active_pr(pr_url=pr_url, pr_number=pr_number, branch=branch_name, config=config)
 
         conn.execute(
             "INSERT INTO evolution_log (cycle_number, dimension, proposal, classification, reasoning, status, files_changed, test_result) "

package/src/state_watchers_runtime.py

@@ -5,7 +5,7 @@ import json
 import os
 import sqlite3
 import subprocess
-from datetime import UTC, datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from urllib import error, request
 
@@ -30,7 +30,7 @@ def _manifest_file() -> Path:
 
 
 def _now_iso() -> str:
-    return datetime.now(UTC).strftime("%Y-%m-%d %H:%M:%S")
+    return datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
 
 
 def _parse_dt(value: str | None) -> datetime | None:
@@ -41,13 +41,13 @@ def _parse_dt(value: str | None) -> datetime | None:
     for candidate in (normalized, normalized + "T00:00:00+00:00"):
         try:
             parsed = datetime.fromisoformat(candidate)
-            return parsed if parsed.tzinfo else parsed.replace(tzinfo=UTC)
+            return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
         except Exception:
             continue
     for fmt in ("%Y-%m-%d", "%Y-%m-%d %H:%M:%S"):
         try:
             parsed = datetime.strptime(text, fmt)
-            return parsed.replace(tzinfo=UTC)
+            return parsed.replace(tzinfo=timezone.utc)
         except Exception:
             continue
     return None
@@ -70,11 +70,15 @@ def _load_last_cron_run(cron_id: str) -> datetime | None:
     if not db_path.is_file():
         return None
     conn = sqlite3.connect(str(db_path))
-    row = conn.execute(
-        "SELECT started_at FROM cron_runs WHERE cron_id = ? ORDER BY started_at DESC LIMIT 1",
-        (cron_id,),
-    ).fetchone()
-    conn.close()
+    try:
+        row = conn.execute(
+            "SELECT started_at FROM cron_runs WHERE cron_id = ? ORDER BY started_at DESC LIMIT 1",
+            (cron_id,),
+        ).fetchone()
+    except Exception:
+        return None
+    finally:
+        conn.close()
     if not row or not row[0]:
         return None
     return _parse_dt(str(row[0]))
@@ -150,7 +154,7 @@ def _evaluate_cron_drift(watcher: dict) -> dict:
     last_run = _load_last_cron_run(cron_id)
     if not last_run:
         return {"health": "critical", "summary": f"cron {cron_id} has never run", "evidence": [f"threshold_seconds={threshold}"]}
-    age = (datetime.now(UTC) - last_run).total_seconds()
+    age = (datetime.now(timezone.utc) - last_run).total_seconds()
     if age > threshold * 2:
         health = "critical"
     elif age > threshold:
@@ -218,7 +222,7 @@ def _evaluate_expiry(watcher: dict) -> dict:
         return {"health": "critical", "summary": f"expiry watcher missing due_at: {watcher.get('watcher_id')}", "evidence": []}
     warn_days = int(config.get("warn_days") or 21)
     critical_days = int(config.get("critical_days") or 7)
-    remaining = due_at - datetime.now(UTC)
+    remaining = due_at - datetime.now(timezone.utc)
     days = remaining.total_seconds() / 86400
     if days <= critical_days:
         health = "critical"
@@ -263,25 +267,26 @@ def _list_watchers(*, status: str) -> list[dict]:
     if not db_path.is_file():
         return []
     conn = sqlite3.connect(str(db_path))
-    conn.row_factory = sqlite3.Row
-    clauses = []
-    params = []
-    if status:
-        clauses.append("status = ?")
-        params.append(status)
-    where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
     try:
-        rows = conn.execute(
-            f"""SELECT watcher_id, watcher_type, title, target, severity, status, config, last_health, last_result, last_checked_at
-                FROM state_watchers
-                {where}
-                ORDER BY updated_at DESC, watcher_id DESC""",
-            tuple(params),
-        ).fetchall()
-    except sqlite3.OperationalError:
+        conn.row_factory = sqlite3.Row
+        clauses = []
+        params = []
+        if status:
+            clauses.append("status = ?")
+            params.append(status)
+        where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
+        try:
+            rows = conn.execute(
+                f"""SELECT watcher_id, watcher_type, title, target, severity, status, config, last_health, last_result, last_checked_at
+                    FROM state_watchers
+                    {where}
+                    ORDER BY updated_at DESC, watcher_id DESC""",
+                tuple(params),
+            ).fetchall()
+        except sqlite3.OperationalError:
+            return []
+    finally:
         conn.close()
-        return []
-    conn.close()
     watchers = []
     for row in rows:
         watcher = dict(row)
@@ -298,19 +303,21 @@ def _persist_result(result: dict) -> None:
     if not db_path.is_file():
         return
     conn = sqlite3.connect(str(db_path))
-    conn.execute(
-        """UPDATE state_watchers
-           SET last_health = ?, last_result = ?, last_checked_at = ?, updated_at = datetime('now')
-           WHERE watcher_id = ?""",
-        (
-            result["health"],
-            json.dumps(result, ensure_ascii=False),
-            result["checked_at"],
-            result["watcher_id"],
-        ),
-    )
-    conn.commit()
-    conn.close()
+    try:
+        conn.execute(
+            """UPDATE state_watchers
+               SET last_health = ?, last_result = ?, last_checked_at = ?, updated_at = datetime('now')
+               WHERE watcher_id = ?""",
+            (
+                result["health"],
+                json.dumps(result, ensure_ascii=False),
+                result["checked_at"],
+                result["watcher_id"],
+            ),
+        )
+        conn.commit()
+    finally:
+        conn.close()
 
 
 def run_state_watchers(*, persist: bool = True, status: str = "active") -> dict:

package/src/tools_sessions.py

@@ -6,7 +6,7 @@ import os
 import time
 import secrets
 import threading
-from datetime import datetime, UTC
+from datetime import datetime, timezone
 from pathlib import Path
 from db import (
     register_session, update_session, complete_session,
@@ -133,7 +133,7 @@ def _session_portability_bundle(sid: str = "") -> dict:
     ]
     return {
         "ok": True,
-        "generated_at": datetime.now(UTC).isoformat(),
+        "generated_at": datetime.now(timezone.utc).isoformat(),
         "session": {
             "sid": session_id,
             "task": session_row["task"],