nexo-brain 7.12.14 → 7.13.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.12.14",
+  "version": "7.13.3",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.12.14` is the current packaged-runtime line. Patch release — dashboard followup execution now respects the selected terminal client across macOS, Windows via WSL, and Linux instead of returning a macOS-only dead end. Result: operators can launch followups from the dashboard on every supported Brain host without hardcoding Claude-only or Mac-only assumptions.
+Version `7.13.3` is the current packaged-runtime line. Unified release — doctor now repairs orphan personal script metadata and ignores historical `versions/**` snapshots, `nexo update` prunes runtime snapshots older than two back, protocol compliance self-heals missing task-open/change-log/stale-session gaps, headless automation uses bounded timeouts, Guardian false positives are tightened, and Codex CLI parity is release-gated. Result: coordinated Desktop bundles can ship the new Brain without changing the Mac/Windows installation contract.
+
+Previously in `7.12.15`: patch release — same-version packaged updates now still run the safe maintenance path, Deep Sleep clears process locks on shutdown, sent replies are recorded in durable continuity, and personal script schedule-marker drift is surfaced during reconcile. Result: coordinated Desktop bundles can refresh Brain safely without breaking install/update parity on macOS, Windows via WSL, or Linux.
 
 Previously in `7.12.0`: minor release — adds `nexo support-snapshot` for generic local runtime diagnostics and completes the silent-reminder hardening on the live Protocol Enforcer path. The support collector emits one JSON bundle with version/platform metadata, runtime path presence, health-check output, and recent event/operation tails, while map-driven reminders (`nexo_startup`, `nexo_smart_startup`, `nexo_heartbeat`, `nexo_reminders`, `nexo_session_diary_*`, `nexo_stop`, `nexo_task_close`, compaction checkpoint prompts) now say explicitly that silence owns the entire reminder turn.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.12.14",
+  "version": "7.13.3",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain \u2014 Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_close_sessions.py

@@ -152,6 +152,36 @@ def promote_draft_to_diary(sid: str, draft: dict, task: str = ""):
     delete_diary_draft(sid)
 
 
+def auto_close_open_protocol_tasks(conn, sid: str, task: str = "") -> list[str]:
+    """Close stale open protocol tasks as partial when their session is reaped."""
+    rows = conn.execute(
+        """SELECT task_id, goal
+           FROM protocol_tasks
+           WHERE session_id = ? AND status = 'open'
+           ORDER BY opened_at ASC""",
+        (sid,),
+    ).fetchall()
+    closed: list[str] = []
+    for row in rows:
+        task_id = row["task_id"]
+        goal = str(row["goal"] or "")
+        evidence = (
+            f"Auto-closed as partial because session {sid} became stale before an explicit nexo_task_close. "
+            f"Session task: {task or 'unknown'}. Open goal: {goal[:240]}"
+        )
+        conn.execute(
+            """UPDATE protocol_tasks
+               SET status = 'partial',
+                   close_evidence = ?,
+                   outcome_notes = 'auto-close: stale session ended without explicit task_close',
+                   closed_at = datetime('now')
+               WHERE task_id = ? AND status = 'open'""",
+            (evidence[:4000], task_id),
+        )
+        closed.append(task_id)
+    return closed
+
+
 def main():
     init_db()
     conn = get_db()
@@ -161,9 +191,12 @@ def main():
         print(f"[{datetime.datetime.now().isoformat(timespec='seconds')}] No stale sessions")
         return
 
+    closed_task_ids: list[str] = []
     for session in orphans:
         sid = session["sid"]
         draft = get_diary_draft(sid)
+        closed_tasks = auto_close_open_protocol_tasks(conn, sid, task=session.get("task", ""))
+        closed_task_ids.extend(closed_tasks)
 
         if draft:
             promote_draft_to_diary(sid, draft, task=session.get("task", ""))
@@ -196,7 +229,10 @@ def main():
     os.makedirs(os.path.dirname(AUTO_CLOSE_LOG), exist_ok=True)
     with open(AUTO_CLOSE_LOG, "a") as f:
         ts = datetime.datetime.now().isoformat(timespec="seconds")
-        f.write(f"{ts} — auto-closed {len(orphans)} session(s): {[s['sid'] for s in orphans]}\n")
+        f.write(
+            f"{ts} — auto-closed {len(orphans)} session(s): {[s['sid'] for s in orphans]} "
+            f"and {len(closed_task_ids)} protocol task(s): {closed_task_ids}\n"
+        )
 
 
 if __name__ == "__main__":

package/src/doctor/providers/runtime.py

@@ -704,10 +704,6 @@ def _client_assumption_regressions() -> list[str]:
     }
     offenders: list[str] = []
     for path in src_root.rglob("*.py"):
-        try:
-            text = path.read_text()
-        except Exception:
-            continue
         resolved = path.resolve()
         try:
             if resolved.is_relative_to(backup_root):
@@ -723,6 +719,12 @@ def _client_assumption_regressions() -> list[str]:
             relative_path = resolved.relative_to(src_root)
         except Exception:
             relative_path = path.relative_to(src_root)
+        if "versions" in relative_path.parts:
+            continue
+        try:
+            text = path.read_text()
+        except Exception:
+            continue
         if ".claude/projects" in text and relative_path not in allowed_relative_paths:
             offenders.append(f"{relative_path} hardcodes ~/.claude/projects")
     collect_path = src_root / "scripts" / "deep-sleep" / "collect.py"

package/src/email_sent_events.py

@@ -0,0 +1,222 @@
+"""Durable sent-email continuity for NEXO automations.
+
+The email monitor tracks inbound lifecycle rows. This module tracks outbound
+messages so startup, duplicate checks, and briefings can see what NEXO already
+sent even when the send path did not originate from an inbound email row.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+from datetime import datetime, timedelta
+from pathlib import Path
+from typing import Any
+
+import paths
+
+
+EMAIL_SENT_TABLE_SQL = """
+CREATE TABLE IF NOT EXISTS sent_email_events (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    message_id TEXT,
+    sender TEXT,
+    to_addrs TEXT NOT NULL DEFAULT '',
+    cc_addrs TEXT NOT NULL DEFAULT '',
+    subject TEXT NOT NULL DEFAULT '',
+    in_reply_to TEXT NOT NULL DEFAULT '',
+    references_header TEXT NOT NULL DEFAULT '',
+    source TEXT NOT NULL DEFAULT '',
+    status TEXT NOT NULL DEFAULT 'sent',
+    sent_at TEXT NOT NULL DEFAULT (datetime('now','localtime')),
+    meta TEXT NOT NULL DEFAULT '{}'
+);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_sent_email_message_id
+ON sent_email_events(message_id)
+WHERE message_id IS NOT NULL AND message_id != '';
+CREATE INDEX IF NOT EXISTS idx_sent_email_sent_at ON sent_email_events(sent_at);
+CREATE INDEX IF NOT EXISTS idx_sent_email_subject ON sent_email_events(subject);
+"""
+
+RECENT_SENT_EMAILS_TITLE = "EMAILS ENVIADOS ULTIMAS 24H POR LA OPERATIVA"
+
+
+def sent_email_db_path() -> Path:
+    return paths.nexo_email_dir() / "nexo-email.db"
+
+
+def ensure_sent_email_table(conn: sqlite3.Connection) -> None:
+    conn.executescript(EMAIL_SENT_TABLE_SQL)
+
+
+def _connect(db_path: str | Path | None = None) -> sqlite3.Connection:
+    path = Path(db_path) if db_path else sent_email_db_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    conn = sqlite3.connect(path)
+    conn.row_factory = sqlite3.Row
+    ensure_sent_email_table(conn)
+    return conn
+
+
+def _clean(value: object, limit: int = 500) -> str:
+    text = " ".join(str(value or "").split())
+    if len(text) <= limit:
+        return text
+    return text[: limit - 3].rstrip() + "..."
+
+
+def _safe_meta(meta: dict[str, Any] | None) -> str:
+    try:
+        return json.dumps(meta or {}, ensure_ascii=True, sort_keys=True)
+    except Exception:
+        return "{}"
+
+
+def _record_cognitive_memory(event: dict[str, str]) -> None:
+    try:
+        import cognitive
+
+        to_value = event.get("to_addrs", "")
+        subject = event.get("subject", "")
+        message_id = event.get("message_id", "")
+        content = (
+            "Sent email recorded by NEXO. "
+            f"To: {to_value}. Subject: {subject}. Message-ID: {message_id}."
+        )
+        cognitive.ingest_to_ltm(
+            content,
+            source_type="email_sent",
+            source_id=message_id or f"{to_value}:{subject}",
+            source_title=subject,
+            domain="email",
+            tags="email,sent,continuity",
+            bypass_gate=True,
+        )
+    except Exception:
+        pass
+
+
+def record_sent_email(
+    *,
+    message_id: str = "",
+    sender: str = "",
+    to_addrs: str = "",
+    cc_addrs: str = "",
+    subject: str = "",
+    in_reply_to: str = "",
+    references_header: str = "",
+    source: str = "",
+    status: str = "sent",
+    meta: dict[str, Any] | None = None,
+    db_path: str | Path | None = None,
+    record_memory: bool = True,
+) -> dict[str, str]:
+    event = {
+        "message_id": _clean(message_id, 300),
+        "sender": _clean(sender, 300),
+        "to_addrs": _clean(to_addrs, 800),
+        "cc_addrs": _clean(cc_addrs, 800),
+        "subject": _clean(subject, 500),
+        "in_reply_to": _clean(in_reply_to, 300),
+        "references_header": _clean(references_header, 1000),
+        "source": _clean(source or "unknown", 120),
+        "status": _clean(status or "sent", 80),
+        "meta": _safe_meta(meta),
+    }
+    conn = _connect(db_path)
+    try:
+        conn.execute(
+            """
+            INSERT OR REPLACE INTO sent_email_events (
+                message_id, sender, to_addrs, cc_addrs, subject, in_reply_to,
+                references_header, source, status, meta
+            )
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            """,
+            (
+                event["message_id"],
+                event["sender"],
+                event["to_addrs"],
+                event["cc_addrs"],
+                event["subject"],
+                event["in_reply_to"],
+                event["references_header"],
+                event["source"],
+                event["status"],
+                event["meta"],
+            ),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+    if record_memory:
+        _record_cognitive_memory(event)
+    return event
+
+
+def recent_sent_emails(
+    *,
+    hours: int = 24,
+    limit: int = 10,
+    db_path: str | Path | None = None,
+) -> list[dict[str, str]]:
+    cutoff = (datetime.now() - timedelta(hours=max(1, int(hours)))).strftime("%Y-%m-%d %H:%M:%S")
+    conn = _connect(db_path)
+    try:
+        rows = conn.execute(
+            """
+            SELECT message_id, sender, to_addrs, cc_addrs, subject, in_reply_to,
+                   references_header, source, status, sent_at, meta
+            FROM sent_email_events
+            WHERE sent_at >= ?
+            ORDER BY sent_at DESC
+            LIMIT ?
+            """,
+            (cutoff, max(1, int(limit))),
+        ).fetchall()
+        return [dict(row) for row in rows]
+    finally:
+        conn.close()
+
+
+def find_sent_email(
+    *,
+    to_addr: str = "",
+    subject: str = "",
+    since_hours: int = 72,
+    db_path: str | Path | None = None,
+) -> dict[str, str] | None:
+    target_to = _clean(to_addr).lower()
+    target_subject = _clean(subject).lower()
+    if not target_to or not target_subject:
+        return None
+    for event in recent_sent_emails(hours=since_hours, limit=100, db_path=db_path):
+        if target_to in str(event.get("to_addrs") or "").lower() and target_subject in str(event.get("subject") or "").lower():
+            return event
+    return None
+
+
+def format_recent_sent_email_block(*, hours: int = 24, limit: int = 8) -> str:
+    rows = recent_sent_emails(hours=hours, limit=limit)
+    if not rows:
+        return ""
+    lines = [f"== {RECENT_SENT_EMAILS_TITLE} =="]
+    for row in rows:
+        sent_at = str(row.get("sent_at") or "")
+        to_value = _clean(row.get("to_addrs"), 120)
+        subject = _clean(row.get("subject"), 160)
+        source = _clean(row.get("source"), 80)
+        lines.append(f"- {sent_at} | to: {to_value} | subject: {subject} | source: {source}")
+    return "\n".join(lines)
+
+
+__all__ = [
+    "RECENT_SENT_EMAILS_TITLE",
+    "ensure_sent_email_table",
+    "find_sent_email",
+    "format_recent_sent_email_block",
+    "recent_sent_emails",
+    "record_sent_email",
+    "sent_email_db_path",
+]

package/src/hook_guardrails.py

@@ -13,7 +13,7 @@ from pathlib import Path
 import paths
 
 from core_prompts import render_core_prompt
-from db import create_protocol_debt, get_db, get_last_heartbeat_ts
+from db import create_protocol_debt, create_protocol_task, get_db, get_last_heartbeat_ts
 from operator_language import append_operator_language_contract
 from plugins.guard import _load_conditioned_learnings, _normalize_path_token
 from protocol_settings import get_protocol_strictness
@@ -429,6 +429,42 @@ def _strict_write_without_task_severity(session_id: str) -> str:
     return "error"
 
 
+def _auto_task_open_enabled() -> bool:
+    return os.environ.get("NEXO_AUTO_TASK_OPEN", "1").strip().lower() not in {"0", "false", "no", "off"}
+
+
+def _auto_open_protocol_task_for_write(*, sid: str, tool_name: str, operation: str, files: list[str]) -> dict | None:
+    if not sid or not _auto_task_open_enabled():
+        return None
+    task_type = "edit" if operation == "write" else "execute"
+    clean_files = [item for item in files if str(item or "").strip()]
+    target = ", ".join(clean_files[:3]) if clean_files else "unknown target"
+    if len(clean_files) > 3:
+        target += f", +{len(clean_files) - 3} more"
+    try:
+        return create_protocol_task(
+            sid,
+            f"Auto-opened {task_type} task for {tool_name} on {target}",
+            task_type=task_type,
+            area="auto",
+            context_hint="PreToolUse auto-task_open: write/delete attempted without a matching open task.",
+            files=clean_files,
+            plan=[
+                "Auto-opened because the agent attempted a write/delete before explicit task_open.",
+                "Verify the edit and close with evidence.",
+            ],
+            constraints=[
+                "Do not treat this auto-open as success evidence.",
+                "Close as done only after verification; otherwise close partial/failed.",
+            ],
+            verification_step="Run the relevant test or inspection and close with evidence.",
+            must_verify=True,
+            must_change_log=True,
+        )
+    except Exception:
+        return None
+
+
 def _resolve_runtime_path(path: str) -> Path:
     candidate = Path(str(path or "")).expanduser()
     if not candidate.is_absolute():
@@ -1599,6 +1635,24 @@ def process_pre_tool_event(payload: dict) -> dict:
             "status": "blocked",
         }
 
+    auto_opened_task = None
+    if files:
+        missing_task_files = [filepath for filepath in files if not _find_open_task_for_file(conn, sid, filepath)]
+        if missing_task_files:
+            auto_opened_task = _auto_open_protocol_task_for_write(
+                sid=sid,
+                tool_name=tool_name,
+                operation=op,
+                files=missing_task_files,
+            )
+    elif not _find_any_open_task(conn, sid):
+        auto_opened_task = _auto_open_protocol_task_for_write(
+            sid=sid,
+            tool_name=tool_name,
+            operation=op,
+            files=[],
+        )
+
     if not files:
         task = _find_any_open_task(conn, sid)
         if not task:
@@ -1628,6 +1682,7 @@ def process_pre_tool_event(payload: dict) -> dict:
             "operation": op,
             "strictness": strictness,
             "blocks": blocks,
+            "auto_opened_task": auto_opened_task,
             "status": "blocked" if blocks else "clean",
         }
 
@@ -1711,6 +1766,7 @@ def process_pre_tool_event(payload: dict) -> dict:
         "operation": op,
         "strictness": strictness,
         "blocks": blocks,
+        "auto_opened_task": auto_opened_task,
         "status": "blocked" if blocks else "clean",
     }
 

package/src/hooks/post_edit_change_log.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+"""Best-effort PostToolUse change_log recorder for write tools.
+
+This hook records file edit visibility directly in the DB layer. It never
+calls MCP tools and never blocks the client pipeline.
+"""
+
+import json
+import os
+import sys
+from pathlib import Path
+
+
+_DIR = Path(__file__).resolve().parent
+_SRC = _DIR.parent
+if str(_SRC) not in sys.path:
+    sys.path.insert(0, str(_SRC))
+
+WRITE_TOOLS = {"Edit", "Write", "MultiEdit", "NotebookEdit"}
+
+
+def _short_tool_name(tool_name: str) -> str:
+    clean = str(tool_name or "").strip()
+    return clean.rsplit("__", 1)[-1] if "__" in clean else clean
+
+
+def _read_stdin_json() -> dict:
+    if sys.stdin.isatty():
+        return {}
+    try:
+        raw = sys.stdin.read()
+        if not raw.strip():
+            return {}
+        payload = json.loads(raw)
+        return payload if isinstance(payload, dict) else {}
+    except Exception:
+        return {}
+
+
+def _tool_input(payload: dict) -> dict:
+    value = payload.get("tool_input") or payload.get("toolInput") or payload.get("input") or {}
+    return value if isinstance(value, dict) else {}
+
+
+def _extract_file_paths(payload: dict) -> list[str]:
+    tool_input = _tool_input(payload)
+    candidates: list[str] = []
+    for key in ("file_path", "filePath", "path", "notebook_path", "notebookPath"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value.strip():
+            candidates.append(value.strip())
+    for key in ("file_paths", "filePaths", "paths"):
+        value = tool_input.get(key)
+        if isinstance(value, list):
+            candidates.extend(str(item).strip() for item in value if str(item).strip())
+    seen: set[str] = set()
+    paths: list[str] = []
+    for item in candidates:
+        if item in seen:
+            continue
+        seen.add(item)
+        paths.append(item)
+    return paths
+
+
+def _resolve_sid_from_payload(payload: dict) -> str:
+    candidates: list[str] = []
+    for key in ("nexo_sid", "sid", "session_id", "sessionId"):
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            candidates.append(value.strip())
+    for key in ("NEXO_SID", "CLAUDE_SESSION_ID"):
+        value = os.environ.get(key, "").strip()
+        if value:
+            candidates.append(value)
+    try:
+        from db import resolve_sid_from_external
+    except Exception:
+        return ""
+    for candidate in candidates:
+        if candidate.startswith("nexo-"):
+            return candidate
+        resolved = resolve_sid_from_external(candidate)
+        if resolved:
+            return resolved
+    return ""
+
+
+def record_post_edit_change(payload: dict) -> dict:
+    """Record a minimal change_log row for write-like tool payloads."""
+    tool_name = _short_tool_name(str(payload.get("tool_name") or payload.get("toolName") or ""))
+    if tool_name not in WRITE_TOOLS:
+        return {"ok": True, "skipped": True, "reason": "tool_not_write"}
+    if os.environ.get("NEXO_AUTO_CHANGE_LOG", "1").strip().lower() in {"0", "false", "no", "off"}:
+        return {"ok": True, "skipped": True, "reason": "disabled"}
+
+    paths = _extract_file_paths(payload)
+    if not paths:
+        return {"ok": True, "skipped": True, "reason": "missing_file_path"}
+
+    try:
+        from db import init_db, log_change
+    except Exception as exc:
+        return {"ok": False, "error": f"db_import_failed: {exc}"}
+
+    try:
+        init_db()
+        sid = _resolve_sid_from_payload(payload) or "unknown"
+        files = ", ".join(paths)
+        result = log_change(
+            sid,
+            files,
+            f"Auto-recorded PostToolUse {tool_name} file edit",
+            "PostToolUse observed a file write; recording traceability even if the agent forgets nexo_change_log.",
+            triggered_by="post_edit_change_log.py",
+            affects=files,
+            risks="Automatic trace only; verify the actual diff and tests separately.",
+            verify="Inspect git diff and run the relevant tests for the edited file.",
+            commit_ref="",
+        )
+        if "error" in result:
+            return {"ok": False, "error": result["error"]}
+        return {"ok": True, "change_log_id": result.get("id"), "files": paths}
+    except Exception as exc:
+        return {"ok": False, "error": str(exc)}
+
+
+def main() -> int:
+    record_post_edit_change(_read_stdin_json())
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/hooks/post_tool_use.py

@@ -208,6 +208,21 @@ def _run_auto_capture(payload: dict) -> int:
         return 1
 
 
+def _run_post_edit_change_log(payload: dict) -> int:
+    """Record write-tool visibility without calling MCP from the hook."""
+    try:
+        proc = subprocess.run(
+            ["python3", str(_DIR / "post_edit_change_log.py")],
+            input=json.dumps(payload),
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        return proc.returncode
+    except Exception:
+        return 1
+
+
 def main() -> int:
     started = time.time()
     payload = _read_stdin_json()
@@ -231,6 +246,7 @@ def main() -> int:
             protocol_message = stdout
 
     exits.append(_run_auto_capture(payload))
+    exits.append(_run_post_edit_change_log(payload))
 
     # v6.0.1 — inbox autodetect runs LAST so it sees the latest DB state
     # (including any writes the previous steps may have done). Emits a