nexo-brain 3.0.1 → 3.1.0

package/src/evolution_cycle.py

@@ -120,52 +120,54 @@ def save_objective(obj: dict):
 def get_week_data(db_path: str) -> dict:
     """Gather last 7 days of learnings, decisions, changes, diaries."""
     conn = sqlite3.connect(db_path, timeout=10)
-    conn.row_factory = sqlite3.Row
-    cutoff_epoch = time.time() - 7 * 86400
-    cutoff_date = (date.today() - timedelta(days=7)).isoformat()
-
-    data = {}
-
-    rows = conn.execute(
-        "SELECT category, title, content FROM learnings WHERE created_at > ? ORDER BY created_at DESC LIMIT 50",
-        (cutoff_epoch,)
-    ).fetchall()
-    data["learnings"] = [dict(r) for r in rows]
-
-    rows = conn.execute(
-        "SELECT domain, decision, alternatives, based_on, confidence, outcome FROM decisions "
-        "WHERE created_at > ? ORDER BY created_at DESC LIMIT 20",
-        (cutoff_date,)
-    ).fetchall()
-    data["decisions"] = [dict(r) for r in rows]
-
-    rows = conn.execute(
-        "SELECT files, what_changed, why, affects, risks FROM change_log "
-        "WHERE created_at > ? ORDER BY created_at DESC LIMIT 30",
-        (cutoff_date,)
-    ).fetchall()
-    data["changes"] = [dict(r) for r in rows]
-
-    rows = conn.execute(
-        "SELECT summary, decisions as diary_decisions, pending, mental_state, domain, user_signals "
-        "FROM session_diary WHERE created_at > ? ORDER BY created_at DESC LIMIT 20",
-        (cutoff_date,)
-    ).fetchall()
-    data["diaries"] = [dict(r) for r in rows]
-
-    rows = conn.execute(
-        "SELECT * FROM evolution_log ORDER BY id DESC LIMIT 20"
-    ).fetchall()
-    data["evolution_history"] = [dict(r) for r in rows]
-
-    rows = conn.execute(
-        "SELECT dimension, score, delta, measured_at FROM evolution_metrics "
-        "WHERE id IN (SELECT MAX(id) FROM evolution_metrics GROUP BY dimension)"
-    ).fetchall()
-    data["current_metrics"] = {r["dimension"]: dict(r) for r in rows}
-
-    conn.close()
-    return data
+    try:
+        conn.row_factory = sqlite3.Row
+        cutoff_epoch = time.time() - 7 * 86400
+        cutoff_date = (date.today() - timedelta(days=7)).isoformat()
+
+        data = {}
+
+        rows = conn.execute(
+            "SELECT category, title, content FROM learnings WHERE created_at > ? ORDER BY created_at DESC LIMIT 50",
+            (cutoff_epoch,)
+        ).fetchall()
+        data["learnings"] = [dict(r) for r in rows]
+
+        rows = conn.execute(
+            "SELECT domain, decision, alternatives, based_on, confidence, outcome FROM decisions "
+            "WHERE created_at > ? ORDER BY created_at DESC LIMIT 20",
+            (cutoff_date,)
+        ).fetchall()
+        data["decisions"] = [dict(r) for r in rows]
+
+        rows = conn.execute(
+            "SELECT files, what_changed, why, affects, risks FROM change_log "
+            "WHERE created_at > ? ORDER BY created_at DESC LIMIT 30",
+            (cutoff_date,)
+        ).fetchall()
+        data["changes"] = [dict(r) for r in rows]
+
+        rows = conn.execute(
+            "SELECT summary, decisions as diary_decisions, pending, mental_state, domain, user_signals "
+            "FROM session_diary WHERE created_at > ? ORDER BY created_at DESC LIMIT 20",
+            (cutoff_date,)
+        ).fetchall()
+        data["diaries"] = [dict(r) for r in rows]
+
+        rows = conn.execute(
+            "SELECT * FROM evolution_log ORDER BY id DESC LIMIT 20"
+        ).fetchall()
+        data["evolution_history"] = [dict(r) for r in rows]
+
+        rows = conn.execute(
+            "SELECT dimension, score, delta, measured_at FROM evolution_metrics "
+            "WHERE id IN (SELECT MAX(id) FROM evolution_metrics GROUP BY dimension)"
+        ).fetchall()
+        data["current_metrics"] = {r["dimension"]: dict(r) for r in rows}
+
+        return data
+    finally:
+        conn.close()
 
 
 def create_snapshot(files_to_backup: list) -> str:
@@ -348,7 +350,12 @@ Max 3 proposals. Quality over quantity. If nothing needs improving, say so."""
     return prompt
 
 
-def build_public_contribution_prompt(*, repo_root: str, cycle_number: int) -> str:
+def build_public_contribution_prompt(
+    *,
+    repo_root: str,
+    cycle_number: int,
+    queued_candidate: dict | None = None,
+) -> str:
     """Prompt for the public-core contributor mode.
 
     This prompt must never rely on private runtime state. It should inspect only
@@ -356,6 +363,27 @@ def build_public_contribution_prompt(*, repo_root: str, cycle_number: int) -> st
     by returning machine-readable summary JSON.
     """
 
+    queued_section = ""
+    if queued_candidate:
+        queued_files = "\n".join(
+            f"- {path}" for path in (queued_candidate.get("files_changed") or [])[:20]
+        ) or "- (no files recorded)"
+        queued_source = str((queued_candidate.get("metadata") or {}).get("source") or "managed-runtime")
+        queued_section = f"""
+
+PRIORITY PUBLIC-PORT QUEUE ITEM:
+- Source: {queued_source}
+- Title: {str(queued_candidate.get("title") or "").strip()}
+- Why it matters: {str(queued_candidate.get("reasoning") or "").strip()}
+- Files originally touched:
+{queued_files}
+
+This item was already fixed or detected outside the public contribution runner.
+Before inventing another improvement, verify whether the public repository still
+needs the same change and port it if necessary. If the repo is already correct,
+make the smallest validating change that captures the same gap.
+"""
+
     return f"""You are NEXO Public Evolution.
 
 You are running inside an isolated checkout of the public NEXO repository.
@@ -387,6 +415,7 @@ What to do:
 
 Cycle: #{cycle_number}
 Quality over quantity. One strong improvement is better than three weak ones.
+{queued_section}
 """
 
 

package/src/hook_guardrails.py

@@ -3,11 +3,13 @@ from __future__ import annotations
 """Post-tool guardrails for conditioned file learnings."""
 
 import json
+import os
 import sys
 from pathlib import Path
 
 from db import create_protocol_debt, get_db
 from plugins.guard import _load_conditioned_learnings, _normalize_path_token
+from protocol_settings import get_protocol_strictness
 
 READ_LIKE_TOOLS = {"Read"}
 WRITE_LIKE_TOOLS = {"Edit", "MultiEdit", "Write"}
@@ -94,6 +96,18 @@ def _find_open_task_for_file(conn, sid: str, filepath: str) -> dict | None:
     return None
 
 
+def _find_any_open_task(conn, sid: str) -> dict | None:
+    row = conn.execute(
+        """SELECT task_id, files, guard_has_blocking
+           FROM protocol_tasks
+           WHERE session_id = ? AND status = 'open'
+           ORDER BY opened_at DESC
+           LIMIT 1""",
+        (sid,),
+    ).fetchone()
+    return dict(row) if row else None
+
+
 def _find_open_debt(conn, *, session_id: str, task_id: str, debt_type: str, file_token: str) -> dict | None:
     row = conn.execute(
         """SELECT *
@@ -152,6 +166,136 @@ def _ensure_protocol_debt(
     )
 
 
+def process_pre_tool_event(payload: dict) -> dict:
+    strictness = get_protocol_strictness()
+    tool_name = str(payload.get("tool_name", "")).strip()
+    op = _operation_kind(tool_name)
+    if strictness == "lenient":
+        return {"ok": True, "skipped": True, "reason": "lenient mode", "strictness": strictness}
+    if op not in {"write", "delete"}:
+        return {"ok": True, "skipped": True, "reason": "operation not blocked", "strictness": strictness}
+
+    tool_input = payload.get("tool_input")
+    files = _extract_touched_files(tool_input)
+    conn = get_db()
+    sid = _resolve_nexo_sid(conn, str(payload.get("session_id", "")))
+    blocks: list[dict] = []
+
+    if not sid:
+        debt = _ensure_protocol_debt(
+            conn,
+            session_id="",
+            task_id="",
+            debt_type="strict_protocol_write_without_startup",
+            severity="error",
+            evidence=f"{tool_name} attempted before nexo_startup/session mapping.",
+            file_token="startup",
+        )
+        blocks.append(
+            {
+                "file": "",
+                "task_id": "",
+                "debt_id": debt.get("id"),
+                "debt_type": "strict_protocol_write_without_startup",
+                "reason_code": "missing_startup",
+            }
+        )
+        return {
+            "ok": True,
+            "session_id": sid,
+            "tool_name": tool_name,
+            "operation": op,
+            "strictness": strictness,
+            "blocks": blocks,
+            "status": "blocked",
+        }
+
+    if not files:
+        task = _find_any_open_task(conn, sid)
+        if not task:
+            debt = _ensure_protocol_debt(
+                conn,
+                session_id=sid,
+                task_id="",
+                debt_type="strict_protocol_write_without_task",
+                severity="error",
+                evidence=f"{tool_name} attempted without a detectable file path and without an open protocol task.",
+                file_token="unknown-target",
+            )
+            blocks.append(
+                {
+                    "file": "",
+                    "task_id": "",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "strict_protocol_write_without_task",
+                    "reason_code": "missing_task",
+                }
+            )
+        return {
+            "ok": True,
+            "session_id": sid,
+            "tool_name": tool_name,
+            "operation": op,
+            "strictness": strictness,
+            "blocks": blocks,
+            "status": "blocked" if blocks else "clean",
+        }
+
+    for filepath in files:
+        task = _find_open_task_for_file(conn, sid, filepath)
+        if not task:
+            debt = _ensure_protocol_debt(
+                conn,
+                session_id=sid,
+                task_id="",
+                debt_type="strict_protocol_write_without_task",
+                severity="error",
+                evidence=f"{tool_name} attempted on {filepath} without an open protocol task for that file.",
+                file_token=filepath,
+            )
+            blocks.append(
+                {
+                    "file": filepath,
+                    "task_id": "",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "strict_protocol_write_without_task",
+                    "reason_code": "missing_task",
+                }
+            )
+            continue
+
+        guard_debt = _find_task_guard_blocking_debt(conn, task["task_id"])
+        if guard_debt:
+            debt = _ensure_protocol_debt(
+                conn,
+                session_id=sid,
+                task_id=task["task_id"],
+                debt_type="strict_protocol_write_without_guard_ack",
+                severity="error",
+                evidence=f"{tool_name} attempted on {filepath} before acknowledging guard debt for task {task['task_id']}.",
+                file_token=filepath,
+            )
+            blocks.append(
+                {
+                    "file": filepath,
+                    "task_id": task["task_id"],
+                    "debt_id": debt.get("id"),
+                    "debt_type": "strict_protocol_write_without_guard_ack",
+                    "reason_code": "guard_unacknowledged",
+                }
+            )
+
+    return {
+        "ok": True,
+        "session_id": sid,
+        "tool_name": tool_name,
+        "operation": op,
+        "strictness": strictness,
+        "blocks": blocks,
+        "status": "blocked" if blocks else "clean",
+    }
+
+
 def process_tool_event(payload: dict) -> dict:
     tool_name = str(payload.get("tool_name", "")).strip()
     op = _operation_kind(tool_name)
@@ -289,6 +433,38 @@ def format_hook_message(result: dict) -> str:
     return "\n".join(lines)
 
 
+def format_pretool_block_message(result: dict) -> str:
+    blocks = result.get("blocks") or []
+    if not blocks:
+        return ""
+    strictness = str(result.get("strictness") or "strict")
+    header = (
+        "NEXO LEARNING MODE BLOCKED THIS EDIT:"
+        if strictness == "learning"
+        else "NEXO STRICT MODE BLOCKED THIS EDIT:"
+    )
+    lines = [header]
+    for item in blocks:
+        file_note = item["file"] or "(unknown target)"
+        if item.get("reason_code") == "missing_startup":
+            lines.append(
+                f"- Start the shared-brain session first: call `nexo_startup`, then `nexo_task_open`, before editing {file_note}."
+            )
+        elif item.get("reason_code") == "guard_unacknowledged":
+            lines.append(
+                f"- {file_note}: task {item['task_id']} still has blocking guard debt. Acknowledge it with `nexo_task_acknowledge_guard` before retrying."
+            )
+        elif strictness == "learning":
+            lines.append(
+                f"- {file_note}: open `nexo_task_open(task_type='edit', files=['{file_note}'])` first, then rerun the edit."
+            )
+        else:
+            lines.append(
+                f"- {file_note}: open `nexo_task_open(... files=['{file_note}'])` before editing."
+            )
+    return "\n".join(lines)
+
+
 def main() -> int:
     raw = sys.stdin.read()
     if not raw.strip():
@@ -297,6 +473,12 @@ def main() -> int:
         payload = json.loads(raw)
     except Exception:
         return 0
+    if os.environ.get("NEXO_HOOK_PHASE", "").strip().lower() == "pre":
+        result = process_pre_tool_event(payload)
+        message = format_pretool_block_message(result)
+        if message:
+            print(message, file=sys.stderr)
+        return 2 if result.get("status") == "blocked" else 0
     result = process_tool_event(payload)
     message = format_hook_message(result)
     if message:

package/src/hooks/protocol-guardrail.sh

@@ -5,6 +5,6 @@ INPUT=$(cat || true)
 [ -z "$INPUT" ] && exit 0
 
 NEXO_CODE="${NEXO_CODE:-${HOME}/.nexo}"
-python3 "$NEXO_CODE/hook_guardrails.py" <<< "$INPUT" 2>/dev/null || true
+NEXO_HOOK_PHASE=post python3 "$NEXO_CODE/hook_guardrails.py" <<< "$INPUT" 2>/dev/null || true
 
 exit 0

package/src/hooks/protocol-pretool-guardrail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# NEXO PreToolUse hook — strict protocol blocking before writes/deletes
+
+INPUT=$(cat || true)
+[ -z "$INPUT" ] && exit 0
+
+NEXO_CODE="${NEXO_CODE:-${HOME}/.nexo}"
+NEXO_HOOK_PHASE=pre python3 "$NEXO_CODE/hook_guardrails.py" <<< "$INPUT"
+exit $?

package/src/kg_populate.py

@@ -147,25 +147,27 @@ def backfill_decisions() -> int:
 def backfill_somatic() -> int:
     """Read somatic_markers from cognitive.db → create file/area nodes with risk."""
     cdb = _cognitive_db()
-    rows = cdb.execute(
-        "SELECT target, target_type, risk_score, incident_count FROM somatic_markers"
-    ).fetchall()
-    count = 0
-    for row in rows:
-        target_type = row["target_type"] or "file"
-        node_ref = f"{target_type}:{row['target']}"
-        kg.upsert_node(
-            node_type=target_type,
-            node_ref=node_ref,
-            label=os.path.basename(row["target"]) or row["target"],
-            properties={
-                "risk_score": row["risk_score"],
-                "incident_count": row["incident_count"],
-            },
-        )
-        count += 1
-    cdb.close()
-    return count
+    try:
+        rows = cdb.execute(
+            "SELECT target, target_type, risk_score, incident_count FROM somatic_markers"
+        ).fetchall()
+        count = 0
+        for row in rows:
+            target_type = row["target_type"] or "file"
+            node_ref = f"{target_type}:{row['target']}"
+            kg.upsert_node(
+                node_type=target_type,
+                node_ref=node_ref,
+                label=os.path.basename(row["target"]) or row["target"],
+                properties={
+                    "risk_score": row["risk_score"],
+                    "incident_count": row["incident_count"],
+                },
+            )
+            count += 1
+        return count
+    finally:
+        cdb.close()
 
 
 def run_full_backfill() -> dict:

package/src/maintenance.py

@@ -1,7 +1,7 @@
 """Opportunistic maintenance — run overdue tasks on MCP startup."""
 
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 from db import get_db
 
 
@@ -16,7 +16,7 @@ def check_and_run_overdue():
         if last_run:
             try:
                 last_dt = datetime.strptime(last_run, "%Y-%m-%dT%H:%M:%S")
-                hours_since = (datetime.now(datetime.timezone.utc).replace(tzinfo=None) - last_dt).total_seconds() / 3600
+                hours_since = (datetime.now(timezone.utc).replace(tzinfo=None) - last_dt).total_seconds() / 3600
                 if hours_since < interval:
                     continue
             except (ValueError, TypeError):
@@ -28,7 +28,7 @@ def check_and_run_overdue():
             conn.execute(
                 "UPDATE maintenance_schedule SET last_run_at = ?, last_duration_ms = ?, "
                 "run_count = run_count + 1 WHERE task_name = ?",
-                (datetime.now(datetime.timezone.utc).replace(tzinfo=None).strftime("%Y-%m-%dT%H:%M:%S"), duration_ms, task))
+                (datetime.now(timezone.utc).replace(tzinfo=None).strftime("%Y-%m-%dT%H:%M:%S"), duration_ms, task))
             conn.commit()
             ran.append({"task": task, "duration_ms": duration_ms})
         except Exception as e:

package/src/migrate_embeddings.py

@@ -30,15 +30,17 @@ MODELS = {
 def verify():
     """Check current embedding dimensions in the database."""
     conn = sqlite3.connect(DB_PATH)
-    for table in ["stm_memories", "ltm_memories"]:
-        count = conn.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]
-        if count == 0:
-            print(f"  {table}: {count} rows (empty)")
-            continue
-        row = conn.execute(f"SELECT embedding FROM {table} LIMIT 1").fetchone()
-        vec = np.frombuffer(row[0], dtype=np.float32)
-        print(f"  {table}: {count} rows, embedding dim = {len(vec)}")
-    conn.close()
+    try:
+        for table in ["stm_memories", "ltm_memories"]:
+            count = conn.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0]
+            if count == 0:
+                print(f"  {table}: {count} rows (empty)")
+                continue
+            row = conn.execute(f"SELECT embedding FROM {table} LIMIT 1").fetchone()
+            vec = np.frombuffer(row[0], dtype=np.float32)
+            print(f"  {table}: {count} rows, embedding dim = {len(vec)}")
+    finally:
+        conn.close()
 
 
 def upgrade():
@@ -62,31 +64,31 @@ def upgrade():
     model = TextEmbedding(model_name)
 
     conn = sqlite3.connect(DB_PATH)
-
-    for table in ["stm_memories", "ltm_memories"]:
-        rows = conn.execute(f"SELECT id, content FROM {table}").fetchall()
-        if not rows:
-            print(f"\n{table}: empty, skipping")
-            continue
-
-        print(f"\n{table}: re-embedding {len(rows)} memories...")
-        t0 = time.time()
-
-        # Batch embed for speed
-        contents = [r[1] for r in rows]
-        ids = [r[0] for r in rows]
-
-        embeddings = list(model.embed(contents))
-
-        for mem_id, emb in zip(ids, embeddings):
-            blob = np.array(emb, dtype=np.float32).tobytes()
-            conn.execute(f"UPDATE {table} SET embedding = ? WHERE id = ?", (blob, mem_id))
-
-        conn.commit()
-        elapsed = time.time() - t0
-        print(f"  Done: {len(rows)} memories in {elapsed:.1f}s ({elapsed/len(rows)*1000:.0f}ms/memory)")
-
-    conn.close()
+    try:
+        for table in ["stm_memories", "ltm_memories"]:
+            rows = conn.execute(f"SELECT id, content FROM {table}").fetchall()
+            if not rows:
+                print(f"\n{table}: empty, skipping")
+                continue
+
+            print(f"\n{table}: re-embedding {len(rows)} memories...")
+            t0 = time.time()
+
+            # Batch embed for speed
+            contents = [r[1] for r in rows]
+            ids = [r[0] for r in rows]
+
+            embeddings = list(model.embed(contents))
+
+            for mem_id, emb in zip(ids, embeddings):
+                blob = np.array(emb, dtype=np.float32).tobytes()
+                conn.execute(f"UPDATE {table} SET embedding = ? WHERE id = ?", (blob, mem_id))
+
+            conn.commit()
+            elapsed = time.time() - t0
+            print(f"  Done: {len(rows)} memories in {elapsed:.1f}s ({elapsed/len(rows)*1000:.0f}ms/memory)")
+    finally:
+        conn.close()
 
     print("\nAfter upgrade:")
     verify()

package/src/plugins/backup.py

@@ -21,10 +21,14 @@ def handle_backup_now() -> str:
     # Use SQLite backup API for consistency
     import sqlite3
     src_conn = sqlite3.connect(DB_PATH)
-    dst_conn = sqlite3.connect(dest)
-    src_conn.backup(dst_conn)
-    dst_conn.close()
-    src_conn.close()
+    try:
+        dst_conn = sqlite3.connect(dest)
+        try:
+            src_conn.backup(dst_conn)
+        finally:
+            dst_conn.close()
+    finally:
+        src_conn.close()
 
     size_kb = os.path.getsize(dest) / 1024
     _cleanup_old()
@@ -63,17 +67,25 @@ def handle_backup_restore(filename: str) -> str:
     safety = os.path.join(BACKUP_DIR, f"nexo-pre-restore-{time.strftime('%Y%m%d%H%M%S')}.db")
     import sqlite3
     src_conn = sqlite3.connect(DB_PATH)
-    dst_conn = sqlite3.connect(safety)
-    src_conn.backup(dst_conn)
-    dst_conn.close()
-    src_conn.close()
+    try:
+        dst_conn = sqlite3.connect(safety)
+        try:
+            src_conn.backup(dst_conn)
+        finally:
+            dst_conn.close()
+    finally:
+        src_conn.close()
 
     # Restore
     restore_conn = sqlite3.connect(src)
-    target_conn = sqlite3.connect(DB_PATH)
-    restore_conn.backup(target_conn)
-    target_conn.close()
-    restore_conn.close()
+    try:
+        target_conn = sqlite3.connect(DB_PATH)
+        try:
+            restore_conn.backup(target_conn)
+        finally:
+            target_conn.close()
+    finally:
+        restore_conn.close()
 
     # Invalidate shared connection so db.py reconnects to restored data
     import db

package/src/plugins/protocol.py

@@ -23,6 +23,7 @@ from db import (
 )
 from plugins.cortex import evaluate_cortex_state
 from plugins.guard import handle_guard_check
+from protocol_settings import get_protocol_strictness
 from tools_sessions import handle_heartbeat
 
 
@@ -450,6 +451,18 @@ def handle_task_open(
 
     clean_type = task_type if task_type in {"answer", "analyze", "edit", "execute", "delegate"} else "answer"
     files_list = _parse_list(files)
+    protocol_strictness = get_protocol_strictness()
+    if protocol_strictness in {"strict", "learning"} and clean_type == "edit" and not files_list:
+        note = (
+            "Strict protocol mode requires explicit `files` for edit tasks."
+            if protocol_strictness == "strict"
+            else "Learning mode requires explicit `files` on edit tasks so NEXO can match the write against the open protocol task."
+        )
+        return json.dumps(
+            {"ok": False, "error": note, "protocol_strictness": protocol_strictness},
+            ensure_ascii=False,
+            indent=2,
+        )
     state = {
         "goal": clean_goal,
         "task_type": clean_type,
@@ -569,6 +582,7 @@ def handle_task_open(
         "session_id": sid,
         "goal": clean_goal,
         "task_type": clean_type,
+        "protocol_strictness": protocol_strictness,
         "mode": cortex["mode"],
         "check_id": cortex["check_id"],
         "blocked_reason": cortex.get("blocked_reason"),
@@ -596,6 +610,7 @@ def handle_task_open(
             "must_change_log": must_change_log,
             "must_learning_if_corrected": must_learning_if_corrected,
             "must_write_diary_on_close": must_write_diary_on_close,
+            "protocol_strictness": protocol_strictness,
         },
         "session_touch": heartbeat_result.splitlines()[0] if heartbeat_result else "",
         "open_debts": debts_created,