nexo-brain 5.4.6 → 5.4.7

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "5.4.6",
+  "version": "5.4.7",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,9 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `5.4.6` is the current packaged-runtime line: runtime dependency management in `nexo update` + daily auto-update cron. `nexo update` now manages external dependencies declared in `runtimeDependencies` (starting with Claude Code).
+Version `5.4.7` is the current packaged-runtime line: tool-enforcement-map.json for Protocol Enforcer — canonical map of all 247 tools with enforcement metadata, plus verify script.
 
-Previously in `5.4.5`: test isolation for tree_hygiene module + fake venv to prevent CI timeout.
+Previously in `5.4.6`: runtime dependency management in `nexo update` + daily auto-update cron.
 
 Start here:
 - [5-minute quickstart](docs/quickstart-5-minutes.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "5.4.6",
+  "version": "5.4.7",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/crons/manifest.json

@@ -207,7 +207,7 @@
     {
       "id": "auto-update",
       "script": "scripts/nexo-auto-update.py",
-      "schedule": {"hour": 3, "minute": 45},
+      "schedule": {"hour": 2, "minute": 0},
       "description": "Daily auto-update — Brain + runtime dependencies",
       "core": true,
       "recovery_policy": "catchup",

package/src/plugins/update.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 """Update plugin — pull latest code, backup DBs, run migrations, verify."""
 import json
 import os
+import re
 import shutil
 import sqlite3
 import subprocess
@@ -347,6 +348,14 @@ def _read_runtime_dependencies() -> list[dict]:
     return []
 
 
+_VALID_NPM_NAME = re.compile(r'^(@[a-z0-9\-_.]+/)?[a-z0-9\-_.]+$')
+
+
+def _validate_npm_name(name: str) -> bool:
+    """Validate that a package name follows npm naming conventions."""
+    return bool(name) and bool(_VALID_NPM_NAME.match(name)) and ".." not in name
+
+
 def _get_npm_global_version(package_name: str) -> str | None:
     """Return the currently installed global npm package version, or None."""
     try:
@@ -354,7 +363,9 @@ def _get_npm_global_version(package_name: str) -> str | None:
             ["npm", "list", "-g", package_name, "--json", "--depth=0"],
             capture_output=True, text=True, timeout=15,
         )
-        if result.returncode == 0:
+        # npm list returns exit 1 with valid JSON for peer dep issues;
+        # always try to parse the output regardless of returncode.
+        if result.stdout.strip():
             data = json.loads(result.stdout)
             deps = data.get("dependencies", {})
             info = deps.get(package_name)
@@ -362,6 +373,8 @@ def _get_npm_global_version(package_name: str) -> str | None:
                 return info.get("version")
     except subprocess.TimeoutExpired:
         pass
+    except FileNotFoundError:
+        pass  # npm not installed
     except Exception:
         pass
     return None
@@ -378,6 +391,8 @@ def _get_npm_registry_version(package_name: str) -> str | None:
             return result.stdout.strip()
     except subprocess.TimeoutExpired:
         pass
+    except FileNotFoundError:
+        pass  # npm not installed
     except Exception:
         pass
     return None
@@ -401,7 +416,7 @@ def _update_runtime_dependencies(progress_fn=None) -> list[dict]:
     for dep in deps:
         name = dep.get("name", "")
         dep_type = dep.get("type", "")
-        optional = dep.get("optional", True)
+        optional = dep.get("optional", False)
 
         if not name or dep_type != "npm-global":
             results.append({
@@ -412,6 +427,16 @@ def _update_runtime_dependencies(progress_fn=None) -> list[dict]:
             })
             continue
 
+        if not _validate_npm_name(name):
+            results.append({
+                "name": name,
+                "old_version": None,
+                "new_version": None,
+                "status": "failed",
+                "error": f"invalid npm package name: {name!r}",
+            })
+            continue
+
         _emit_progress(progress_fn, f"Checking runtime dependency: {name}...")
 
         old_version = _get_npm_global_version(name)