nexo-brain 7.20.14 → 7.20.15

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.20.14` is the current packaged-runtime line. Patch release over v7.20.13 — Brain protects Local Memory during update/recovery paths, rotates runtime backup families to the latest 5 entries, keeps first-indexing status stable, and exposes bounded indexing speed profiles for Desktop.
+Version `7.20.15` is the current packaged-runtime line. Patch release over v7.20.14 — Brain update/recovery paths now fail closed when the DB guard is missing or stale, and backup validation rejects any replacement that loses Local Memory tables.
+
+Previously in `7.20.14`: patch release over v7.20.13 — Brain protects Local Memory during update/recovery paths, rotates runtime backup families to the latest 5 entries, keeps first-indexing status stable, and exposes bounded indexing speed profiles for Desktop.
 
 Previously in `7.20.13`: patch release over v7.20.12 — Brain recovery now pauses all known DB writers before restoring `nexo.db`, and Doctor can repair the zero-byte/locked database state that made Desktop Local Memory show zero files.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.20.14",
+  "version": "7.20.15",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -82,6 +82,23 @@ TEMPLATE_FILE = _RESOLVED_REPO_DIR / "templates" / "CLAUDE.md.template"
 CHECK_COOLDOWN_SECONDS = 3600  # 1 hour
 GIT_TIMEOUT_SECONDS = 4  # stay well under the 5s total budget
 CRITICAL_BACKUP_TABLES = ("learnings", "session_diary", "guard_checks", "protocol_debt")
+LOCAL_CONTEXT_BACKUP_TABLES = (
+    "local_index_roots",
+    "local_index_exclusions",
+    "local_index_jobs",
+    "local_index_checkpoints",
+    "local_index_state",
+    "local_index_errors",
+    "local_assets",
+    "local_asset_versions",
+    "local_chunks",
+    "local_entities",
+    "local_relations",
+    "local_embeddings",
+    "local_context_queries",
+    "local_index_dirs",
+)
+PROTECTED_BACKUP_TABLES = CRITICAL_BACKUP_TABLES + LOCAL_CONTEXT_BACKUP_TABLES
 CLASSIFIER_INSTALL_TIMEOUT_SECONDS = 1800
 CLASSIFIER_INSTALL_JOIN_SECONDS = 1500
 CLASSIFIER_INSTALL_LOG = paths.logs_dir() / "classifier-install.log"
@@ -321,7 +338,7 @@ def _validate_db_backup(source_db: Path, backup_db: Path) -> dict:
         report["errors"].append(f"backup db missing: {backup_db}")
         return report
 
-    for table in CRITICAL_BACKUP_TABLES:
+    for table in PROTECTED_BACKUP_TABLES:
         source_count = _critical_table_count(source_db, table)
         backup_count = _critical_table_count(backup_db, table)
         report["source_counts"][table] = source_count

package/src/plugins/update.py

@@ -32,10 +32,9 @@ except ModuleNotFoundError as exc:
     def is_duplicate_artifact_name(_path) -> bool:
         return False
 
-# db_guard landed in v5.5.5. When plugins/update.py is imported from a runtime
-# that still ships the v5.5.4 tree (e.g. mid-upgrade), the import will fail —
-# we fall back to no-op guards so the update can still complete and bring in
-# the fixed module on its own.
+# db_guard must be available before any DB-touching update runs. Desktop syncs
+# this file plus db_guard.py as a pair; if a stale runtime imports update.py
+# without a current guard, we abort instead of risking a local-memory wipe.
 try:
     from db_guard import (
         CRITICAL_TABLES,
@@ -52,8 +51,10 @@ try:
         validate_backup_matches_source,
     )
     _DB_GUARD_AVAILABLE = True
-except Exception:  # pragma: no cover - exercised only during mid-upgrade installs
+    _DB_GUARD_IMPORT_ERROR = ""
+except Exception as exc:  # pragma: no cover - exercised only during stale installs
     _DB_GUARD_AVAILABLE = False
+    _DB_GUARD_IMPORT_ERROR = str(exc)
     CRITICAL_TABLES = ()
     PROTECTED_TABLES = ()
     HOURLY_BACKUP_MAX_AGE = 48 * 3600
@@ -90,6 +91,13 @@ except Exception:  # pragma: no cover - exercised only during mid-upgrade instal
     def validate_backup_matches_source(*_args, **_kwargs):  # type: ignore[misc]
         return True, None
 
+REQUIRED_LOCAL_MEMORY_TABLES: tuple[str, ...] = (
+    "local_assets",
+    "local_chunks",
+    "local_embeddings",
+    "local_index_dirs",
+)
+
 # Code root is the parent of plugins/:
 # - source checkout: <repo>/src
 # - packaged runtime: <NEXO_HOME>
@@ -383,6 +391,30 @@ def _check_dirty() -> str | None:
     return None
 
 
+def _db_guard_integrity_error() -> str | None:
+    """Return why DB protection is unsafe, or None when current guard is usable."""
+    if os.environ.get("NEXO_SKIP_WIPE_GUARD") == "1":
+        return None
+    primary_db = DATA_DIR / "nexo.db"
+    if not primary_db.is_file():
+        return None
+    if not _DB_GUARD_AVAILABLE:
+        return (
+            "DB protection module is not available; refusing to update while local memory may exist.\n"
+            f"  import error: {_DB_GUARD_IMPORT_ERROR or 'unknown'}\n"
+            "Restart Desktop so it can sync the bundled Brain guard, then retry the update."
+        )
+    protected = set(PROTECTED_TABLES)
+    missing = [table for table in REQUIRED_LOCAL_MEMORY_TABLES if table not in protected]
+    if missing:
+        return (
+            "DB protection module is stale; refusing to update because local memory tables are not protected.\n"
+            f"  missing tables: {', '.join(missing)}\n"
+            "Restart Desktop so it can sync the bundled Brain guard, then retry the update."
+        )
+    return None
+
+
 def _preflight_wipe_check() -> str | None:
     """Abort the update early if the primary DB already looks wiped.
 
@@ -399,6 +431,9 @@ def _preflight_wipe_check() -> str | None:
     """
     if os.environ.get("NEXO_SKIP_WIPE_GUARD") == "1":
         return None
+    guard_err = _db_guard_integrity_error()
+    if guard_err:
+        return guard_err
     primary_db = DATA_DIR / "nexo.db"
     if not primary_db.is_file():
         return None  # Nothing to protect; fresh install path.