nexo-brain 7.12.10 → 7.12.14

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.12.10",
+  "version": "7.12.14",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.12.2` is the current packaged-runtime line. Patch release — legacy headless automation paths now stay on the resonance engine: `task_profile` no longer pre-fills model/effort, `email-monitor` stops carrying a private routing override, personal automation helpers stop injecting a default model, and runtime updates scrub the last stale email-profile field automatically. Result: email daemon, personal scripts, and updated installs all converge on the same `caller`/`tier` → backend → `(model, effort)` resolution path already used by Deep Sleep and morning-agent.
+Version `7.12.14` is the current packaged-runtime line. Patch release — dashboard followup execution now respects the selected terminal client across macOS, Windows via WSL, and Linux instead of returning a macOS-only dead end. Result: operators can launch followups from the dashboard on every supported Brain host without hardcoding Claude-only or Mac-only assumptions.
 
 Previously in `7.12.0`: minor release — adds `nexo support-snapshot` for generic local runtime diagnostics and completes the silent-reminder hardening on the live Protocol Enforcer path. The support collector emits one JSON bundle with version/platform metadata, runtime path presence, health-check output, and recent event/operation tails, while map-driven reminders (`nexo_startup`, `nexo_smart_startup`, `nexo_heartbeat`, `nexo_reminders`, `nexo_session_diary_*`, `nexo_stop`, `nexo_task_close`, compaction checkpoint prompts) now say explicitly that silence owns the entire reminder turn.
 

package/bin/nexo-brain.js

@@ -225,6 +225,50 @@ function run(cmd, opts = {}) {
   }
 }
 
+function findBundledWheel(wheelsDir, prefix) {
+  try {
+    const normalizedPrefix = String(prefix || "").toLowerCase() + "-";
+    const matches = fs.readdirSync(wheelsDir)
+      .filter((name) => name.toLowerCase().startsWith(normalizedPrefix) && name.endsWith(".whl"))
+      .sort();
+    if (!matches.length) return "";
+    return path.join(wheelsDir, matches[matches.length - 1]);
+  } catch {
+    return "";
+  }
+}
+
+function pythonHasPip(pythonBin) {
+  try {
+    const result = spawnSync(pythonBin, ["-m", "pip", "--version"], {
+      stdio: "ignore",
+      timeout: 15000,
+    });
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+
+function seedPipFromBundledWheels(venvPython, bundledWheelsDir) {
+  if (!fs.existsSync(venvPython) || !fs.existsSync(bundledWheelsDir)) return false;
+  if (pythonHasPip(venvPython)) return true;
+  const pipWheel = findBundledWheel(bundledWheelsDir, "pip");
+  if (!pipWheel) return false;
+  log("  Seeding pip into venv from bundled wheels...");
+  const result = spawnSync(venvPython, [
+    path.join(pipWheel, "pip"),
+    "install",
+    "--no-index",
+    "--find-links",
+    bundledWheelsDir,
+    "pip",
+    "setuptools",
+    "wheel",
+  ], { stdio: "inherit", timeout: 120000 });
+  return result.status === 0 && pythonHasPip(venvPython);
+}
+
 function log(msg) {
   console.log(`  ${msg}`);
   try {
@@ -360,7 +404,14 @@ function isOnboardingComplete(calibration) {
   const meta = calibration.meta && typeof calibration.meta === "object" ? calibration.meta : {};
 
   if (meta.onboarding_completed === true) {
-    return nonEmptyString(name) && nonEmptyString(language);
+    // v7.12.11 — bug surfaced on Inma's smoke install 2026-05-03: Desktop
+    // bootstrap runs nexo-brain in --yes/--skip mode, which used to write
+    // `onboarding_completed: true` alongside the placeholder "Usuario"/"en"
+    // defaults. The Desktop wizard then never fired because this returned
+    // true on the very first launch. Treat a placeholder name as "marker is
+    // a lie, real onboarding never happened" so the renderer can still
+    // surface the wizard. Same guard applied to the legacy fallback below.
+    return nonEmptyString(name) && !isPlaceholderUserName(name) && nonEmptyString(language);
   }
 
   // Legacy fallback: v7.8/v7.9-era calibration files may not carry the
@@ -3440,8 +3491,16 @@ async function runSetup() {
       execution_first: true,
     },
     meta: {
-      onboarding_completed: true,
-      onboarding_completed_at: new Date().toISOString(),
+      // v7.12.11 — only mark onboarding_completed when the user actually
+      // answered the prompts (interactive run, !useDefaults). The
+      // Desktop bootstrap calls nexo-brain with `--yes/--skip` to set up
+      // the runtime non-interactively; in that path the values are
+      // placeholders ("Usuario" / "en" / "Nova") and the real wizard
+      // lives in the renderer. Marking it complete here used to short-
+      // circuit that wizard and leave new users staring at an empty chat
+      // (Inma 2026-05-03 smoke install).
+      onboarding_completed: !useDefaults,
+      onboarding_completed_at: !useDefaults ? new Date().toISOString() : null,
     },
     auto_install: "ask", // updated later if user answers P11
     calibrated_at: new Date().toISOString(),
@@ -3526,15 +3585,28 @@ async function runSetup() {
   const venvPython = platform === "win32"
     ? path.join(venvPath, "Scripts", "python.exe")
     : path.join(venvPath, "bin", "python3");
+  const bundledWheelsDir = path.join(__dirname, "..", "python-wheels");
 
   // Create venv if it doesn't exist
   if (!fs.existsSync(venvPython)) {
     log("  Creating Python virtual environment...");
     const venvResult = spawnSync(python, ["-m", "venv", venvPath], { stdio: "inherit" });
     if (venvResult.status !== 0) {
-      log("Failed to create venv. Trying pip install directly...");
+      if (platform === "linux" && fs.existsSync(bundledWheelsDir)) {
+        log("  Python venv could not seed pip; retrying offline without pip...");
+        try { fs.rmSync(venvPath, { recursive: true, force: true }); } catch {}
+        const bareVenv = spawnSync(python, ["-m", "venv", "--without-pip", venvPath], { stdio: "inherit" });
+        if (bareVenv.status !== 0) {
+          log("Failed to create venv. Trying pip install directly...");
+        }
+      } else {
+        log("Failed to create venv. Trying pip install directly...");
+      }
     }
   }
+  if (fs.existsSync(venvPython) && !pythonHasPip(venvPython)) {
+    seedPipFromBundledWheels(venvPython, bundledWheelsDir);
+  }
 
   // Use venv python if available, otherwise fall back to system python with --break-system-packages
   const pipPython = fs.existsSync(venvPython) ? venvPython : python;
@@ -3542,7 +3614,6 @@ async function runSetup() {
   // Detect bundled wheels in resources/python-wheels (offline-first). If
   // present, pip uses --no-index --find-links to install without internet.
   // Falls back to PyPI if bundle not found.
-  const bundledWheelsDir = path.join(__dirname, "..", "python-wheels");
   // v0.32.5 — el bundle empaca wheels manylinux (cp312 x86_64) porque
   // en Win Brain corre dentro de WSL Ubuntu noble. En Mac, Brain corre
   // nativo macOS y NO acepta esos wheels (ABI distinto). Si gateamos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.12.10",
+  "version": "7.12.14",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain \u2014 Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -1233,11 +1233,9 @@ def _reload_launch_agents_after_bump() -> dict:
           "errors": [{plist, stderr}],
         }
 
-    Linux equivalent: systemctl --user daemon-reload + restart of timer
-    units. Implemented as a no-op stub on Linux for now (the macOS
-    LaunchAgent path is the production target — Linux users running
-    `nexo update` get the cron sync but not the per-timer restart yet).
-    Captured as a TODO for the next round.
+    Linux/WSL remains a no-op by default. Systemd user-unit reload can be
+    enabled explicitly for development/runtime experiments, but public update
+    paths must not restart host services unexpectedly.
     """
     result: dict = {
         "scanned": 0,
@@ -1247,8 +1245,58 @@ def _reload_launch_agents_after_bump() -> dict:
         "platform": sys.platform,
     }
 
+    if sys.platform == "linux":
+        if os.environ.get("NEXO_ENABLE_SYSTEMD_RELOAD_AFTER_BUMP") != "1":
+            result["skipped_reason"] = "systemd-reload-disabled"
+            return result
+
+        # Experimental Linux path: reload systemd user units so nexo-* timers
+        # updated by auto-update pick up new ExecStart paths. Best-effort: a
+        # missing systemd (Docker/CI/most WSL installs) just returns no-op.
+        try:
+            unit_dir = Path.home() / ".config" / "systemd" / "user"
+            scanned_units = []
+            if unit_dir.is_dir():
+                scanned_units = sorted(
+                    [p for p in unit_dir.iterdir() if p.suffix in {".service", ".timer"} and p.name.startswith("nexo")]
+                )
+            result["scanned"] = len(scanned_units)
+            if scanned_units:
+                reload_proc = subprocess.run(
+                    ["systemctl", "--user", "daemon-reload"],
+                    capture_output=True,
+                    text=True,
+                    timeout=15,
+                )
+                if reload_proc.returncode != 0:
+                    result["errors"].append({
+                        "unit": "daemon-reload",
+                        "stderr": (reload_proc.stderr or reload_proc.stdout or "").strip(),
+                    })
+                else:
+                    for unit in scanned_units:
+                        restart = subprocess.run(
+                            ["systemctl", "--user", "restart", unit.name],
+                            capture_output=True,
+                            text=True,
+                            timeout=15,
+                        )
+                        if restart.returncode == 0:
+                            result["reloaded"] += 1
+                        else:
+                            result["errors"].append({
+                                "unit": unit.name,
+                                "stderr": (restart.stderr or restart.stdout or "").strip(),
+                            })
+        except FileNotFoundError:
+            result["skipped_reason"] = "systemctl-not-available"
+        except Exception as e:
+            result["errors"].append({"unit": "*", "stderr": f"systemd reload failed: {e}"})
+        return result
+
     if sys.platform != "darwin":
-        # macOS-only for now. systemd path tracked separately.
+        # Other platforms (win32 native — never reached because Brain runs
+        # inside WSL Linux on Windows): nothing to reload.
         return result
     if _is_ephemeral_runtime_install():
         result["skipped_reason"] = "ephemeral-runtime"

package/src/cli.py

@@ -1966,8 +1966,42 @@ def _service_control(service_name: str, action: str) -> int:
 
     label = f"com.nexo.{service_name}"
 
+    # v7.12.12 — Linux/WSL path uses systemd user units (`<service>.service`
+    # in ~/.config/systemd/user/). Until 7.12.11 this stub printed
+    # "supported only on macOS" and returned 1, leaving Linux operators
+    # with no CLI to start/stop the brain — they had to learn systemctl
+    # syntax themselves. Symmetric semantics: on=start, off=stop,
+    # status=is-active. Names match the macOS labels with "nexo-" prefix.
+    if plat.system() == "Linux":
+        unit = f"nexo-{service_name}.service"
+        if action == "status":
+            result = subprocess.run(
+                ["systemctl", "--user", "is-active", unit],
+                capture_output=True,
+                text=True,
+            )
+            state = (result.stdout or "").strip() or "unknown"
+            print(f"{service_name}: {'running' if state == 'active' else state}")
+            return 0
+        if action in ("on", "off"):
+            verb = "start" if action == "on" else "stop"
+            result = subprocess.run(
+                ["systemctl", "--user", verb, unit],
+                capture_output=True,
+                text=True,
+            )
+            if result.returncode == 0:
+                print(f"{service_name}: {'started' if action == 'on' else 'stopped'}")
+                return 0
+            err = (result.stderr or result.stdout or "").strip()
+            print(f"Failed to {verb} {service_name}: {err}", file=sys.stderr)
+            print(f"Hint: install the unit at ~/.config/systemd/user/{unit}", file=sys.stderr)
+            return 1
+        print(f"Unknown action: {action}. Use on, off, or status.", file=sys.stderr)
+        return 1
+
     if plat.system() != "Darwin":
-        print(f"Service control only supported on macOS for now.", file=sys.stderr)
+        print(f"Service control not supported on this platform: {plat.system()}", file=sys.stderr)
         return 1
 
     plist_path = Path.home() / "Library" / "LaunchAgents" / f"{label}.plist"

package/src/client_sync.py

@@ -396,15 +396,20 @@ def ensure_claude_code_installed(*, user_home: str | os.PathLike[str] | None = N
             "attempts": attempts,
         }
 
-    install_cmd = (
-        ["sudo", "npm", "install", "-g", CLAUDE_CODE_NPM_PACKAGE]
-        if sys.platform == "linux"
-        else ["npm", "install", "-g", CLAUDE_CODE_NPM_PACKAGE]
-    )
+    # v7.12.12 — try npm without sudo first on Linux. Hardcoding `sudo`
+    # used to make sense on stock Ubuntu where /usr/lib/node_modules is
+    # root-owned, but inside the WSL distro NEXO Desktop ships, the
+    # default global prefix is already `/home/<user>/.nexo/runtime/
+    # bootstrap/npm-global` (writable). A blind `sudo` there triggers a
+    # password prompt on a TTY the user cannot see, so the bootstrap
+    # appears stuck. Try unprivileged first; if it fails with EACCES
+    # (insufficient permissions), retry with sudo.
     install_error = ""
+    install = None
+    base_cmd = ["npm", "install", "-g", CLAUDE_CODE_NPM_PACKAGE]
     try:
         install = subprocess.run(
-            install_cmd,
+            base_cmd,
             capture_output=True,
             text=True,
             timeout=180,
@@ -413,6 +418,29 @@ def ensure_claude_code_installed(*, user_home: str | os.PathLike[str] | None = N
         if install.returncode != 0:
             install_error = (install.stderr or install.stdout or "npm install failed").strip()
             attempts.append(install_error)
+            permission_failure = (
+                "EACCES" in install_error
+                or "permission denied" in install_error.lower()
+                or "operation not permitted" in install_error.lower()
+            )
+            if permission_failure and sys.platform == "linux":
+                attempts.append("retrying with sudo (Linux EACCES fallback)")
+                try:
+                    install = subprocess.run(
+                        ["sudo", "-n", "npm", "install", "-g", CLAUDE_CODE_NPM_PACKAGE],
+                        capture_output=True,
+                        text=True,
+                        timeout=180,
+                        env=env,
+                    )
+                    if install.returncode != 0:
+                        install_error = (install.stderr or install.stdout or "sudo npm install failed").strip()
+                        attempts.append(install_error)
+                    else:
+                        install_error = ""
+                except Exception as exc:
+                    install_error = f"sudo npm install failed: {exc}"
+                    attempts.append(install_error)
     except Exception as exc:
         install_error = f"npm install failed: {exc}"
         attempts.append(install_error)

package/src/dashboard/app.py

@@ -1101,26 +1101,82 @@ async def api_ops_execute(fid: str):
     if not row:
         return JSONResponse({"error": f"Followup {fid} not found"}, status_code=404)
     item = dict(row)
-    if platform.system() != "Darwin":
-        return JSONResponse(
-            {"error": "This operation requires macOS (uses osascript to open Terminal)"},
-            status_code=501,
-        )
     # Security: avoid interpolating user-controlled data into shell commands.
-    # Write the followup ID to a temp file and pass a safe, fixed command to osascript.
+    # Write the followup ID to a temp file and pass a safe, fixed command.
     import tempfile
     tmp = tempfile.NamedTemporaryFile(mode="w", suffix=".txt", prefix="nexo-followup-", delete=False)
     tmp.write(fid)
     tmp.close()
-    # The selected terminal client reads the followup ID from the temp file — no shell interpolation of description
     try:
+        # Use the selected terminal client from NEXO preferences (Claude Code or
+        # Codex) instead of hardcoding a launcher in the dashboard.
         _, shell_cmd = build_followup_terminal_shell_command(tmp.name)
     except AgentRunnerError as exc:
         return JSONResponse({"error": str(exc)}, status_code=503)
-    escaped = shell_cmd.replace("\\", "\\\\").replace('"', '\\"')
-    script = f'tell application "Terminal" to do script "{escaped}"'
-    subprocess.Popen(["osascript", "-e", script])
-    return {"success": True, "followup_id": fid}
+
+    system = platform.system()
+    if system == "Darwin":
+        # macOS: open Terminal.app via osascript (legacy path).
+        escaped = shell_cmd.replace("\\", "\\\\").replace('"', '\\"')
+        script = f'tell application "Terminal" to do script "{escaped}"'
+        subprocess.Popen(["osascript", "-e", script])
+        return {"success": True, "followup_id": fid, "platform": "darwin"}
+
+    # 7.12.14 — Windows / WSL parity. Until now this endpoint returned 501
+    # on any non-Darwin host, leaving Win11 users without a way to launch
+    # followups from the dashboard. We detect WSL via WSL_DISTRO_NAME /
+    # /proc/sys/fs/binfmt_misc/WSLInterop and shell out through Win
+    # interop (cmd.exe /c start ... wt.exe) so the user gets a real
+    # Windows Terminal tab running `wsl.exe -d <distro> -- bash -lc "<cmd>"`
+    # — matching the Mac UX of "click → terminal opens with claude waiting".
+    is_wsl = bool(os.environ.get("WSL_DISTRO_NAME")) or os.path.exists(
+        "/proc/sys/fs/binfmt_misc/WSLInterop"
+    )
+    if is_wsl:
+        distro = os.environ.get("WSL_DISTRO_NAME") or "Ubuntu-24.04"
+        # Quote the bash command for cmd.exe; cmd's start unwraps one level
+        # so we double-escape inner double quotes.
+        bash_cmd = shell_cmd.replace('"', '\\"')
+        wsl_invoke = f'wsl.exe -d {distro} -- bash -lc "{bash_cmd}"'
+        try:
+            subprocess.Popen(
+                ["cmd.exe", "/c", "start", "", "wt.exe", "new-tab", "--", "cmd.exe", "/k", wsl_invoke],
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+            )
+        except FileNotFoundError:
+            return JSONResponse(
+                {
+                    "error": "Could not launch Windows Terminal automatically.",
+                    "manual_command": wsl_invoke,
+                    "followup_id": fid,
+                },
+                status_code=503,
+            )
+        return {"success": True, "followup_id": fid, "platform": "wsl", "distro": distro}
+
+    # Pure Linux (no WSL): try common terminal emulators in order, then
+    # fall back to returning the manual command. Best-effort because the
+    # dashboard is primarily Mac + WSL.
+    from shutil import which
+    for emulator in ("x-terminal-emulator", "gnome-terminal", "konsole", "xterm"):
+        if which(emulator):
+            try:
+                if emulator == "gnome-terminal":
+                    subprocess.Popen([emulator, "--", "bash", "-lc", shell_cmd])
+                else:
+                    subprocess.Popen([emulator, "-e", shell_cmd])
+                return {"success": True, "followup_id": fid, "platform": "linux", "emulator": emulator}
+            except OSError:
+                continue
+    return JSONResponse(
+        {
+            "error": "No terminal emulator available to launch the followup automatically.",
+            "manual_command": shell_cmd,
+            "followup_id": fid,
+        },
+        status_code=503,
+    )
 
 
 # ---------------------------------------------------------------------------
@@ -1959,8 +2015,21 @@ def main():
             webbrowser.open(f"http://localhost:{args.port}")
         threading.Thread(target=_open, daemon=True).start()
 
+    # v7.12.12 — bind 0.0.0.0 when running inside WSL so the Windows host
+    # can reach the dashboard. WSL2 does auto port forwarding for 127.0.0.1
+    # in most setups, but corporate networks and certain WSL versions break
+    # the loopback bridge; binding all interfaces inside the guest closes
+    # that gap with no security cost (the WSL guest is private to the
+    # logged-in Windows user). On Mac/Linux native, keep 127.0.0.1.
+    bind_host = "127.0.0.1"
+    try:
+        from src.windows_runtime import running_inside_wsl  # type: ignore
+        if running_inside_wsl():
+            bind_host = "0.0.0.0"
+    except Exception:
+        pass
     import uvicorn
-    uvicorn.run(app, host="127.0.0.1", port=args.port, log_level="info")
+    uvicorn.run(app, host=bind_host, port=args.port, log_level="info")
 
 
 if __name__ == "__main__":

package/src/desktop_bridge.py

@@ -405,14 +405,20 @@ def _onboard_steps() -> list[dict]:
             "id": "residence",
             "prompt": {"es": "¿Dónde vives o trabajas habitualmente?", "en": "Where do you live or work most days?"},
             "hint": {
-                "es": "Una ciudad o zona; me ayuda con horarios, clima, ofertas locales y mil cosas más.",
-                "en": "A city or area; helps me with schedules, weather, local options, and a thousand small things.",
+                "es": "Empieza a escribir y elige tu ciudad. Guardo coordenadas para clima, horarios, etc.",
+                "en": "Start typing and pick your city. We save coordinates for weather, schedules, and so on.",
             },
-            "type": "text",
+            # v7.12.13 — `city` triggers the geocoding autocomplete in the
+            # renderer (CityStep talks to Nominatim and writes a JSON
+            # payload with display, name, lat, lon, country). The weather
+            # widget and any future location-aware feature can then read
+            # real coordinates from profile.current_residence instead of
+            # a free-text label.
+            "type": "city",
             "writes": "profile.current_residence",
             "file": "profile.json",
             "optional": True,
-            "validate": r"^.{0,120}$",
+            "validate": r"^.{0,2000}$",
         },
         {
             "id": "role",

package/src/hooks/pre-compact.sh

@@ -230,24 +230,55 @@ conn.execute('''
 ''', (sid, decisions, pending, context_next, summary))
 conn.commit()
 
-# Layer 3: structured auto-flush for continuity and inspectability
+conn.close()
+" 2>/dev/null || true
+
+    # Layer 3: structured auto-flush is useful but non-critical. Keep it
+    # best-effort in the background so pre-compaction never blocks on heavy
+    # imports, vector backends, or ingestion latency after the emergency diary
+    # has already been committed.
+    (
+        NEXO_PRECOMPACT_SID="$TARGET_SID" \
+        NEXO_PRECOMPACT_LOG_FILE="$LOG_FILE" \
+        HOOK_DIR="$HOOK_DIR" \
+        python3 - <<'PY'
+import os
+import sqlite3
+import sys
+
+sid = os.environ.get("NEXO_PRECOMPACT_SID", "")
+log_file = os.environ.get("NEXO_PRECOMPACT_LOG_FILE", "")
+hook_dir = os.environ.get("HOOK_DIR", "")
+if not sid or not hook_dir:
+    sys.exit(0)
+
+sys.path.insert(0, os.path.abspath(os.path.join(hook_dir, "..")))
 try:
-    import os
-    sys.path.insert(0, os.path.abspath(os.path.join('$HOOK_DIR', '..')))
+    import paths
+
+    task = ""
+    try:
+        conn = sqlite3.connect(str(paths.db_path()), timeout=3)
+        row = conn.execute("SELECT task FROM sessions WHERE sid = ? LIMIT 1", (sid,)).fetchone()
+        task = (row[0] if row else "") or ""
+        conn.close()
+    except Exception:
+        task = ""
+
     import compaction_memory
+
     compaction_memory.record_auto_flush(
         session_id=sid,
         task=task,
-        current_goal='',
+        current_goal="",
         log_file=log_file,
-        last_diary_ts=last_diary_ts,
-        source='pre-compact-hook',
+        last_diary_ts="",
+        source="pre-compact-hook",
     )
 except Exception:
     pass
-
-conn.close()
-" 2>/dev/null || true
+PY
+    ) >/dev/null 2>&1 &
 fi
 
 cat << HOOKEOF