nexo-brain 7.13.9 → 7.15.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.13.9",
+  "version": "7.15.0",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,11 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.13.9` is the current packaged-runtime line. Patch release over v7.13.8 — Brain now moves aside an existing managed `.venv` when it was created with unsupported Python <3.10, then recreates it with the supported interpreter prepared by Desktop.
+Version `7.15.0` is the current packaged-runtime line. Minor release over v7.14.0 — Brain unifies sent-email continuity across send paths, moves cognitive recall to multilingual embeddings, forces tagged learnings into context, hardens email loop guards and headless runners, exposes learning creation dates, and adds AUTO-N burst postmortems.
+
+Previously in `7.14.0`: minor release — Brain closes the install/reliability loop with update-path venv recovery, platform-gated wheels, WSL Desktop-managed flag preservation, startup memory authority warnings, legacy MEMORY write blocking, post-action real-world verification, and stale followup triage.
+
+Previously in `7.13.9`: patch release — Brain moves aside an existing managed `.venv` when it was created with unsupported Python <3.10, then recreates it with the supported interpreter prepared by Desktop.
 
 Previously in `7.13.8`: patch release — Brain rejects Python <3.10 during Desktop-managed fresh installs, honors the Python interpreter prepared by Desktop, and fails clearly before dependency resolution if an unsupported Apple Python 3.9 reaches the installer.
 
@@ -381,7 +385,7 @@ That keeps the core Ebbinghaus model, but makes decay more individual and less p
 
 ### Semantic Search (Finding by Meaning)
 
-NEXO Brain doesn't search by keywords. It searches by **meaning** using vector embeddings (fastembed, 768 dimensions).
+NEXO Brain doesn't search by keywords. It searches by **meaning** using multilingual vector embeddings (fastembed, 384 dimensions).
 
 Example: If you search for "deploy problems", NEXO Brain will find a memory about "SSH connection timeout on production server" — even though they share zero words. This is how human associative memory works.
 
@@ -599,7 +603,7 @@ NEXO Brain was evaluated on [LoCoMo](https://github.com/snap-research/locomo) (A
 - 93.3% adversarial rejection rate — reliably says "I don't know" when information isn't available
 - 74.9% recall across 1,986 questions
 - Open-domain F1: 0.637 | Multi-hop F1: 0.333 | Temporal F1: 0.326
-- Runs on CPU with 768-dim embeddings (BAAI/bge-base-en-v1.5) — no GPU required
+- Runs on CPU with local multilingual embeddings — no GPU required
 - First MCP memory server benchmarked on a peer-reviewed dataset
 
 Full results in [`benchmarks/locomo/results/`](benchmarks/locomo/results/).
@@ -1445,7 +1449,7 @@ See [benchmarks/results/memory-recall-vs-static.md](benchmarks/results/memory-re
 
 ### v0.9.0 — Cognitive Memory (2026-03-15)
 - Atkinson-Shiffrin memory model (STM → LTM promotion)
-- Semantic RAG with fastembed (BAAI/bge-base-en-v1.5, 768 dims)
+- Semantic RAG with pinned local multilingual fastembed models
 - Trust scoring, sentiment detection, adaptive personality modes
 - Ebbinghaus decay, sister detection, quarantine system
 

package/bin/nexo-brain.js

@@ -24,7 +24,26 @@ const readline = require("readline");
 require = createRequire(path.join(__dirname, "nexo-brain.js"));
 const { runViaWsl } = require("./windows-wsl-bridge");
 
-if (process.platform === "win32") {
+function isCliEntrypoint() {
+  const invoked = process.argv && process.argv[1] ? String(process.argv[1]) : "";
+  if (!invoked) return false;
+
+  const normalize = (candidate) => {
+    try {
+      return fs.realpathSync.native(candidate);
+    } catch {
+      try {
+        return fs.realpathSync(candidate);
+      } catch {
+        return path.resolve(candidate);
+      }
+    }
+  };
+
+  return normalize(invoked) === normalize(__filename);
+}
+
+if (process.platform === "win32" && isCliEntrypoint()) {
   const bridged = runViaWsl({
     scriptPath: __filename,
     args: process.argv.slice(2),
@@ -291,6 +310,23 @@ function findBundledWheel(wheelsDir, prefix) {
   }
 }
 
+function bundledWheelsSupportCurrentPlatform(wheelsDir) {
+  if (!fs.existsSync(wheelsDir)) return false;
+  if (process.platform === "linux") return true;
+  if (process.platform !== "darwin") return false;
+  try {
+    const names = fs.readdirSync(wheelsDir).map((name) => String(name || "").toLowerCase());
+    const archTag = process.arch === "arm64" ? "arm64" : "x86_64";
+    return names.some((name) => (
+      name.endsWith(".whl")
+      && name.includes("macosx")
+      && (name.includes("universal2") || name.includes(archTag))
+    ));
+  } catch {
+    return false;
+  }
+}
+
 function pythonHasPip(pythonBin) {
   try {
     const result = spawnSync(pythonBin, ["-m", "pip", "--version"], {
@@ -2436,7 +2472,9 @@ async function maybeConfigurePublicContribution(schedule, useDefaults) {
  * Resolve the venv python path for an existing NEXO_HOME installation.
  */
 function findVenvPython(nexoHome) {
+  const venvPath = path.join(nexoHome, ".venv");
   const venvPy = managedVenvPythonPath(nexoHome);
+  ensureManagedVenvCompatible(venvPath, venvPy);
   if (fs.existsSync(venvPy)) return venvPy;
   return null;
 }
@@ -3779,12 +3817,11 @@ async function runSetup() {
   // Detect bundled wheels in resources/python-wheels (offline-first). If
   // present, pip uses --no-index --find-links to install without internet.
   // Falls back to PyPI if bundle not found.
-  // v0.32.5 — el bundle empaca wheels manylinux (cp312 x86_64) porque
-  // en Win Brain corre dentro de WSL Ubuntu noble. En Mac, Brain corre
-  // nativo macOS y NO acepta esos wheels (ABI distinto). Si gateamos
-  // useBundle a !linux, pip cae al PyPI online — bien. macOS y Win
-  // (host nativo) deben tener red la primera vez.
-  const useBundle = process.platform === "linux" && fs.existsSync(bundledWheelsDir);
+  // Desktop bundles Linux/WSL wheels and, from 0.32.44, macOS arm64/x64
+  // wheels. Only use --no-index when the bundle clearly contains wheels
+  // compatible with the current runtime; otherwise fall back to PyPI
+  // instead of failing on ABI-mismatched wheels.
+  const useBundle = bundledWheelsSupportCurrentPlatform(bundledWheelsDir);
   const pipArgs = useBundle
     ? ["-m", "pip", "install", "--no-index", "--find-links", bundledWheelsDir, "--progress-bar", "off", "-r", requirementsFile]
     : ["-m", "pip", "install", "-v", "--progress-bar", "off", "--default-timeout=60", "-r", requirementsFile];
@@ -4965,8 +5002,10 @@ async function main() {
   }
 }
 
-main().catch((err) => {
-  closeReadline();
-  console.error("Setup failed:", err.message);
-  process.exit(1);
-});
+if (isCliEntrypoint()) {
+  Promise.resolve(main()).catch((err) => {
+    closeReadline();
+    console.error("Setup failed:", err.message);
+    process.exit(1);
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.13.9",
+  "version": "7.15.0",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/agent_runner.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import paths
 import shlex
 import shutil
@@ -385,6 +386,79 @@ def _headless_env(env: dict | None = None) -> dict:
     return merged
 
 
+_MUTATING_TOOL_NAMES = frozenset({
+    "write",
+    "edit",
+    "multiedit",
+    "notebookedit",
+    "delete",
+    "bash",
+    "shell",
+})
+
+
+def _runner_mutating_tools_allowed(allowed_tools: str) -> bool:
+    text = str(allowed_tools or "").strip().lower()
+    if not text:
+        return True
+    parts = {part.strip().split(":", 1)[0].lower() for part in re.split(r"[,;\s]+", text) if part.strip()}
+    return bool(parts & _MUTATING_TOOL_NAMES)
+
+
+def _extract_runner_guard_paths(prompt: str, cwd: Path) -> list[str]:
+    found: set[str] = set()
+    text = str(prompt or "")
+    for match in re.findall(r"(?<![A-Za-z0-9_])(?:/[^\s'\"`<>]+|[A-Za-z]:\\[^\s'\"`<>]+)", text):
+        cleaned = match.rstrip(".,);:]")
+        if cleaned:
+            found.add(cleaned)
+    for match in re.findall(r"(?<![A-Za-z0-9_])(?:src|scripts|tests|docs|lib|renderer|app)/[A-Za-z0-9_./-]+\.[A-Za-z0-9]+", text):
+        found.add(str((cwd / match.rstrip(".,);:]")).resolve()))
+    try:
+        resolved_cwd = cwd.resolve()
+    except Exception:
+        resolved_cwd = cwd
+    runtime_core = NEXO_HOME / "core"
+    try:
+        if resolved_cwd == runtime_core or runtime_core in resolved_cwd.parents:
+            found.add(str(resolved_cwd))
+    except Exception:
+        pass
+    return sorted(found)
+
+
+def _run_headless_runner_guard(*, caller: str, cwd: Path, prompt: str, allowed_tools: str) -> dict:
+    if not _runner_mutating_tools_allowed(allowed_tools):
+        return {"blocked": False, "skipped": "read_only_tools"}
+    guard_paths = _extract_runner_guard_paths(prompt, cwd)
+    if not guard_paths:
+        return {"blocked": False, "skipped": "no_explicit_paths"}
+    try:
+        runtime_root = str(NEXO_HOME)
+        if runtime_root and runtime_root not in sys.path:
+            sys.path.insert(0, runtime_root)
+        from plugins.guard import handle_guard_check  # type: ignore
+
+        output = handle_guard_check(
+            files=",".join(guard_paths),
+            area=f"runner:{caller or 'headless'}",
+            project_hint=f"headless runner caller={caller or 'unknown'} cwd={cwd}",
+            include_schemas="true",
+        )
+    except Exception as exc:
+        return {
+            "blocked": True,
+            "summary": f"Runner guard unavailable: {exc}",
+            "paths": guard_paths,
+        }
+    blocked = "BLOCKING RULES" in str(output or "")
+    return {
+        "blocked": blocked,
+        "summary": str(output or ""),
+        "paths": guard_paths,
+    }
+
+
 def _load_client_bootstrap_prompt(client: str) -> str:
     try:
         from bootstrap_docs import load_bootstrap_prompt
@@ -1000,6 +1074,18 @@ def run_automation_prompt(
         reasoning_effort=reasoning_effort,
         preferences=prefs,
     )
+    guard_result = _run_headless_runner_guard(
+        caller=caller,
+        cwd=cwd_path,
+        prompt=prompt,
+        allowed_tools=allowed_tools,
+    )
+    if guard_result.get("blocked"):
+        stderr = "NEXO runner guard blocked this automation before editing shared files.\n"
+        summary = str(guard_result.get("summary") or "").strip()
+        if summary:
+            stderr = _append_stderr(stderr, summary)
+        return subprocess.CompletedProcess(["nexo-runner-guard"], 2, "", stderr)
     started_at = time.perf_counter()
 
     if selected_backend == CLIENT_CLAUDE_CODE:

package/src/claim_graph.py

@@ -22,13 +22,28 @@ def _get_db():
 
 
 def _embed(text: str) -> np.ndarray:
-    import cognitive
-    return cognitive.embed(text)
+    try:
+        import cognitive
+        return cognitive.embed(text)
+    except Exception:
+        try:
+            import cognitive
+            dim = int(getattr(cognitive, "EMBEDDING_DIM", 384) or 384)
+        except Exception:
+            dim = 768
+        return np.zeros(dim, dtype=np.float32)
 
 
 def _cosine_similarity(a, b) -> float:
-    import cognitive
-    return cognitive.cosine_similarity(a, b)
+    try:
+        import cognitive
+        return cognitive.cosine_similarity(a, b)
+    except Exception:
+        norm_a = np.linalg.norm(a)
+        norm_b = np.linalg.norm(b)
+        if norm_a == 0 or norm_b == 0:
+            return 0.0
+        return float(np.dot(a, b) / (norm_a * norm_b))
 
 
 def _array_to_blob(arr: np.ndarray) -> bytes:

package/src/cognitive/_core.py

@@ -3,8 +3,10 @@
 import base64
 import json
 import math
+import hashlib
 import os
 import re
+import shutil
 import sqlite3
 import numpy as np
 from datetime import datetime, timedelta
@@ -18,7 +20,19 @@ _cognitive_dir = paths.cognitive_dir()
 _cognitive_dir.mkdir(parents=True, exist_ok=True)
 
 COGNITIVE_DB = str(_cognitive_dir / "cognitive.db")
-EMBEDDING_DIM = 768
+def _configured_embedding_dim() -> int:
+    try:
+        from local_models import get_local_model_spec
+
+        dim = int(get_local_model_spec("bge-base-embeddings").dimension or 0)
+        if dim > 0:
+            return dim
+    except Exception:
+        pass
+    return 384
+
+
+EMBEDDING_DIM = _configured_embedding_dim()
 LAMBDA_STM = 0.004126   # half-life = ln(2) / (7 * 24) ≈ 7 days
 LAMBDA_LTM = 0.000481  # half-life = ln(2) / (60 * 24) ≈ 60 days
 DEFAULT_MEMORY_STABILITY = 1.0
@@ -307,20 +321,37 @@ def _migrate_memory_personalization(conn: sqlite3.Connection):
 
 
 def _auto_migrate_embeddings(conn: sqlite3.Connection):
-    """Auto-detect old 384-dim embeddings and re-embed to 768-dim. Transparent to user."""
+    """Re-embed when vector dimension or pinned embedding model changes."""
     try:
-        row = conn.execute("SELECT embedding FROM stm_memories LIMIT 1").fetchone()
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS embedding_model_state (
+                key TEXT PRIMARY KEY,
+                value TEXT NOT NULL,
+                updated_at TEXT DEFAULT (datetime('now'))
+            )
+        """)
+        current_marker = _current_embedding_model_marker()
+        stored = conn.execute(
+            "SELECT value FROM embedding_model_state WHERE key = 'embedding_model_marker'"
+        ).fetchone()
+        stored_marker = stored["value"] if stored else ""
+
+        row = None
+        for table in ("stm_memories", "ltm_memories", "quarantine"):
+            row = conn.execute(f"SELECT embedding FROM {table} LIMIT 1").fetchone()
+            if row:
+                break
         if not row:
-            return  # Empty DB, nothing to migrate
+            _write_embedding_model_marker(conn, current_marker)
+            return
 
         vec = np.frombuffer(row["embedding"], dtype=np.float32)
-        if len(vec) == EMBEDDING_DIM:
-            return  # Already correct dimension
-
-        if len(vec) != 384:
-            return  # Unknown dimension, don't touch
+        dimension_matches = len(vec) == EMBEDDING_DIM
+        model_matches = stored_marker == current_marker
+        if dimension_matches and model_matches:
+            return
 
-        # Need migration: 384 → 768
+        _backup_cognitive_db_for_embedding_migration(stored_marker, current_marker)
         model = _get_model()
 
         for table in ("stm_memories", "ltm_memories", "quarantine"):
@@ -333,14 +364,75 @@ def _auto_migrate_embeddings(conn: sqlite3.Connection):
 
             embeddings = list(model.embed(contents))
             for mem_id, emb in zip(ids, embeddings):
-                blob = np.array(emb, dtype=np.float32).tobytes()
+                arr = np.array(emb, dtype=np.float32)
+                if len(arr) != EMBEDDING_DIM:
+                    raise ValueError(f"embedding dimension mismatch: {len(arr)} != {EMBEDDING_DIM}")
+                blob = arr.tobytes()
                 conn.execute(f"UPDATE {table} SET embedding = ? WHERE id = ?", (blob, mem_id))
 
+        _write_embedding_model_marker(conn, current_marker)
         conn.commit()
     except Exception:
         pass  # Don't break startup if migration fails
 
 
+def _current_embedding_model_marker() -> str:
+    try:
+        from local_models import get_local_model_spec
+
+        spec = get_local_model_spec("bge-base-embeddings")
+        return "|".join([
+            spec.name,
+            spec.kind,
+            spec.model_id,
+            spec.source_repo,
+            spec.revision,
+            str(EMBEDDING_DIM),
+        ])
+    except Exception:
+        return f"unknown|{EMBEDDING_DIM}"
+
+
+def _write_embedding_model_marker(conn: sqlite3.Connection, marker: str) -> None:
+    conn.execute(
+        """
+        INSERT INTO embedding_model_state (key, value, updated_at)
+        VALUES ('embedding_model_marker', ?, datetime('now'))
+        ON CONFLICT(key) DO UPDATE SET
+            value = excluded.value,
+            updated_at = excluded.updated_at
+        """,
+        (marker,),
+    )
+    conn.commit()
+
+
+def _backup_cognitive_db_for_embedding_migration(old_marker: str, new_marker: str) -> None:
+    db_path = Path(COGNITIVE_DB)
+    if not db_path.exists():
+        return
+    stamp = datetime.now().strftime("%Y%m%d-%H%M%S")
+    backup = db_path.with_name(f"{db_path.name}.bak-embedding-{stamp}")
+    meta = backup.with_suffix(backup.suffix + ".json")
+    try:
+        shutil.copy2(db_path, backup)
+        meta.write_text(
+            json.dumps(
+                {
+                    "old_marker": old_marker,
+                    "new_marker": new_marker,
+                    "created_at": datetime.now().isoformat(timespec="seconds"),
+                },
+                indent=2,
+                ensure_ascii=True,
+                sort_keys=True,
+            ) + "\n",
+            encoding="utf-8",
+        )
+    except Exception:
+        pass
+
+
 def _init_tables(conn: sqlite3.Connection):
     """Create tables if they don't exist."""
     conn.executescript("""
@@ -558,6 +650,8 @@ def _get_model():
     """Lazy-load fastembed TextEmbedding model."""
     global _model
     if _model is None:
+        if _model_download_disabled():
+            raise RuntimeError("cognitive model loading disabled for this environment")
         from local_models import build_fastembed_embedding
 
         _model = build_fastembed_embedding("bge-base-embeddings")
@@ -577,6 +671,22 @@ def _get_reranker():
     return _reranker if _reranker is not False else None
 
 
+def _model_download_disabled() -> bool:
+    return os.environ.get("NEXO_SKIP_COGNITIVE_MODEL_DOWNLOAD", "").strip().lower() in {"1", "true", "yes"}
+
+
+def _deterministic_fallback_embedding(text: str) -> np.ndarray:
+    """Return a stable vector for tests/offline fallback paths."""
+    digest = hashlib.sha256(str(text or "").encode("utf-8", errors="ignore")).digest()
+    arr = np.zeros(EMBEDDING_DIM, dtype=np.float32)
+    for index, byte in enumerate(digest):
+        arr[index] = (float(byte) / 255.0) - 0.5
+    norm = np.linalg.norm(arr)
+    if norm > 0:
+        arr = arr / norm
+    return arr.astype(np.float32)
+
+
 def rerank_results(query: str, results: list[dict], top_k: int = 5) -> list[dict]:
     """Rerank search results using cross-encoder for precise top-k.
 
@@ -603,9 +713,11 @@ def rerank_results(query: str, results: list[dict], top_k: int = 5) -> list[dict
 
 
 def embed(text: str) -> np.ndarray:
-    """Embed text into a 768-dim float32 vector. Returns zeros for empty text."""
+    """Embed text into a float32 vector. Returns zeros for empty text."""
     if not text or not text.strip():
         return np.zeros(EMBEDDING_DIM, dtype=np.float32)
+    if _model_download_disabled():
+        return _deterministic_fallback_embedding(text)
     model = _get_model()
     embeddings = list(model.embed([text]))
     return np.array(embeddings[0], dtype=np.float32)