nexo-brain 7.24.0 → 7.25.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.24.0",
+  "version": "7.25.1",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,11 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.24.0` is the current packaged-runtime line. Minor release over v7.23.13 - Home Agents, cognitive quality controls, English operational copy, and non-blocking task-open context are integrated into main.
+Version `7.25.1` is the current packaged-runtime line. Patch release over v7.25.0 - shell guardrails skip non-path curl/wget arguments and daily protocol-debt audits keep ERROR classes visible by severity and type.
+
+Previously in `7.25.0`: minor release over v7.24.0 - Memory Fabric links transcript lookup, historical backup diary recovery, unified search and knowledge graph evidence so memories are not available only inside expiring snapshots.
+
+Previously in `7.24.0`: minor release over v7.23.13 - Home Agents, cognitive quality controls, English operational copy, and non-blocking task-open context are integrated into main.
 
 Previously in `7.23.13`: patch over v7.23.12 - release guardrails now audit publish workflows for masked failures and add minimal-delta coverage for punctual UI edits.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.24.0",
+  "version": "7.25.1",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -4715,6 +4715,11 @@ def _run_runtime_post_sync(dest: Path = NEXO_HOME, progress_fn=None) -> tuple[bo
                     "reconcile_scripts = getattr(script_registry, 'reconcile_personal_scripts', None); "
                     "result = reconcile_scripts(dry_run=False) if callable(reconcile_scripts) else {}; "
                     "result = result if isinstance(result, dict) else {}; "
+                    "exec(\"try:\\n"
+                    " import memory_fabric\\n"
+                    " result['memory_fabric'] = memory_fabric.repair_memory_fabric(transcript_limit=1000, backup_limit=5000)\\n"
+                    "except Exception as exc:\\n"
+                    " result['memory_fabric_error'] = repr(exc)\"); "
                     "result['retired_superseded_scripts'] = retired; "
                     "result['retired_superseded_skills'] = retired_skills; "
                     "print(json.dumps(result))"
@@ -4732,6 +4737,31 @@ def _run_runtime_post_sync(dest: Path = NEXO_HOME, progress_fn=None) -> tuple[bo
         reconcile_payload = _parse_runtime_init_payload(init_result.stdout or "")
         extra_actions, reconcile_message = _personal_schedule_reconcile_summary(reconcile_payload)
         actions.extend(extra_actions)
+        memory_fabric_result = reconcile_payload.get("memory_fabric")
+        if isinstance(memory_fabric_result, dict):
+            transcript_indexed = int((memory_fabric_result.get("transcripts") or {}).get("indexed") or 0)
+            historical_inserted = int((memory_fabric_result.get("backups") or {}).get("inserted") or 0)
+            health = memory_fabric_result.get("health") or {}
+            health_issues = health.get("issues") or []
+            historical_health = health.get("historical_diaries") or {}
+            unreconciled = int(historical_health.get("backup_rows_unreconciled") or 0)
+            if transcript_indexed or historical_inserted:
+                actions.append(f"memory-fabric-repaired:{transcript_indexed + historical_inserted}")
+                _emit_progress(
+                    progress_fn,
+                    f"Memory Fabric: indexed {transcript_indexed} transcript(s), reconciled {historical_inserted} historical diary row(s).",
+                )
+            else:
+                actions.append("memory-fabric-checked")
+            if unreconciled:
+                actions.append(f"memory-fabric-unreconciled:{unreconciled}")
+            if memory_fabric_result.get("ok") is False or any(
+                isinstance(issue, dict) and issue.get("code") == "backup_diaries_not_reconciled"
+                for issue in health_issues
+            ):
+                actions.append("memory-fabric-warning")
+        elif reconcile_payload.get("memory_fabric_error"):
+            actions.append("memory-fabric-warning")
         if reconcile_message:
             _emit_progress(progress_fn, reconcile_message)
     except Exception as e:

package/src/crons/manifest.json

@@ -302,6 +302,19 @@
       "run_on_boot": true,
       "run_on_wake": true
     },
+    {
+      "id": "memory-fabric",
+      "script": "scripts/nexo-memory-fabric.py",
+      "schedule": {"hour": 2, "minute": 35},
+      "description": "Daily Memory Fabric maintenance — refresh transcript search, historical backup diaries, and graph links",
+      "core": true,
+      "recovery_policy": "catchup",
+      "idempotent": true,
+      "max_catchup_age": 172800,
+      "stuck_after_seconds": 3600,
+      "run_on_boot": true,
+      "run_on_wake": true
+    },
     {
       "id": "local-index",
       "script": "scripts/nexo-local-index.py",

package/src/db/_fts.py

@@ -1,5 +1,5 @@
 """NEXO DB — Fts module."""
-import os, pathlib, sqlite3, threading, datetime
+import os, pathlib, re, sqlite3, threading, datetime
 import paths
 from db._core import get_db, now_epoch, DB_PATH
 
@@ -328,22 +328,26 @@ def fts_search(query: str, source_filter: str = None, limit: int = 20) -> list[d
         limit: Max results (default 20)
     """
     conn = get_db()
-    words = query.strip().split()
+    raw_query = query.strip()
+    words = raw_query.split()
     if not words:
         return []
 
     # Expand with synonyms for cross-language matching
     all_words = _expand_synonyms(words)
 
-    # Build FTS5 query: each word as quoted term with OR for broad matching
+    # Build FTS5 query: each word as quoted term with OR for broad matching.
+    # Symbol-heavy identifiers (emails, paths, refs) need deterministic token
+    # boundaries so FTS5 never treats punctuation as query syntax.
     fts_terms = []
     for w in all_words:
         # Strip FTS5 special chars to avoid syntax errors
-        safe = w.replace('"', '').replace("'", '').replace('*', '').replace('^', '').replace('-', ' ').strip()
+        safe = w.replace('"', '').replace("'", '').replace('*', '').replace('^', '').strip()
+        safe = re.sub(r"[-@/\\:]+", " ", safe)
         if not safe:
             continue
-        # Split on dots (e.g., "capabilities.json" → "capabilities" + "json")
-        parts = [p.strip() for p in safe.split('.') if p.strip()]
+        # Split on dots and punctuation boundaries (e.g., emails, paths, files).
+        parts = [p.strip() for p in re.split(r"[.\s]+", safe) if p.strip()]
         for part in parts:
             fts_terms.append(f'"{part}"')
             # Add prefix search for camelCase/code identifiers (contains uppercase mid-word)
@@ -361,6 +365,24 @@ def fts_search(query: str, source_filter: str = None, limit: int = 20) -> list[d
     params.append(limit)
 
     try:
+        exact_rows = []
+        if re.search(r"[@/\\:.-]", raw_query):
+            exact_where = ""
+            exact_params = [f"%{raw_query}%", f"%{raw_query}%", f"%{raw_query}%"]
+            if source_filter:
+                exact_where = "AND source = ?"
+                exact_params.append(source_filter)
+            exact_params.append(limit)
+            exact_rows = conn.execute(f"""
+                SELECT source, source_id, title,
+                       substr(body, 1, 240) AS snippet,
+                       category, updated_at, -100.0 AS rank
+                FROM unified_search
+                WHERE (title LIKE ? OR body LIKE ? OR source_id LIKE ?) {exact_where}
+                ORDER BY updated_at DESC
+                LIMIT ?
+            """, exact_params).fetchall()
+
         rows = conn.execute(f"""
             SELECT source, source_id, title,
                    snippet(unified_search, 3, '»', '«', '...', 40) AS snippet,
@@ -370,7 +392,16 @@ def fts_search(query: str, source_filter: str = None, limit: int = 20) -> list[d
             ORDER BY rank
             LIMIT ?
         """, params).fetchall()
-        return [dict(r) for r in rows]
+        merged = []
+        seen = set()
+        for row in list(exact_rows) + list(rows):
+            item = dict(row)
+            key = (item.get("source"), item.get("source_id"))
+            if key in seen:
+                continue
+            seen.add(key)
+            merged.append(item)
+        return merged[:limit]
     except Exception:
         return []
 
@@ -403,4 +434,3 @@ def _migrate_add_index(conn, index_name: str, table: str, column: str):
     """Create index if it doesn't exist (idempotent)."""
     conn.execute(f"CREATE INDEX IF NOT EXISTS {index_name} ON {table}({column})")
     conn.commit()
-

package/src/db/_schema.py

@@ -2080,6 +2080,51 @@ def _m67_diary_quality_backfill_repair(conn):
     _migrate_add_index(conn, "idx_diary_archive_quality", "diary_archive", "quality_tier, quality_score, created_at")
 
 
+def _m68_memory_fabric_index(conn):
+    """Memory Fabric v1 index tables for historical backup memory."""
+    conn.executescript(
+        """
+        CREATE TABLE IF NOT EXISTS memory_fabric_sources (
+            source_id TEXT PRIMARY KEY,
+            source_type TEXT NOT NULL,
+            source_ref TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'active',
+            item_count INTEGER NOT NULL DEFAULT 0,
+            last_indexed_at TEXT DEFAULT '',
+            metadata_json TEXT NOT NULL DEFAULT '{}'
+        );
+
+        CREATE TABLE IF NOT EXISTS historical_diary_index (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            source_backup_path TEXT NOT NULL,
+            source_table TEXT NOT NULL DEFAULT 'session_diary',
+            source_row_id INTEGER NOT NULL,
+            session_id TEXT NOT NULL DEFAULT '',
+            created_at TEXT NOT NULL DEFAULT '',
+            domain TEXT NOT NULL DEFAULT '',
+            summary TEXT NOT NULL DEFAULT '',
+            decisions TEXT NOT NULL DEFAULT '',
+            pending TEXT NOT NULL DEFAULT '',
+            context_next TEXT NOT NULL DEFAULT '',
+            mental_state TEXT NOT NULL DEFAULT '',
+            self_critique TEXT NOT NULL DEFAULT '',
+            source TEXT NOT NULL DEFAULT '',
+            content_hash TEXT NOT NULL UNIQUE,
+            indexed_at TEXT DEFAULT (datetime('now')),
+            metadata_json TEXT NOT NULL DEFAULT '{}',
+            UNIQUE(source_backup_path, source_table, source_row_id)
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_historical_diary_session
+            ON historical_diary_index(session_id);
+        CREATE INDEX IF NOT EXISTS idx_historical_diary_created
+            ON historical_diary_index(created_at);
+        CREATE INDEX IF NOT EXISTS idx_historical_diary_domain
+            ON historical_diary_index(domain);
+        """
+    )
+
+
 MIGRATIONS = [
     (1, "learnings_columns", _m1_learnings_columns),
     (2, "followups_reasoning", _m2_followups_reasoning),
@@ -2148,6 +2193,7 @@ MIGRATIONS = [
     (65, "diary_quality", _m65_diary_quality),
     (66, "transcript_index", _m66_transcript_index),
     (67, "diary_quality_backfill_repair", _m67_diary_quality_backfill_repair),
+    (68, "memory_fabric_index", _m68_memory_fabric_index),
 ]
 
 

package/src/doctor/providers/runtime.py

@@ -3900,6 +3900,74 @@ def check_local_index_hygiene(fix: bool = False) -> DoctorCheck:
         )
 
 
+def check_memory_fabric_health(fix: bool = False) -> DoctorCheck:
+    try:
+        import memory_fabric
+
+        repair = None
+        if fix:
+            repair = memory_fabric.repair_memory_fabric(
+                transcript_hours=720,
+                transcript_limit=1000,
+                backup_limit=5000,
+            )
+        report = memory_fabric.memory_fabric_health(include_backup_scan=True)
+        issues = report.get("issues") or []
+        evidence = [
+            "transcripts=" + json.dumps(report.get("transcripts") or {}, sort_keys=True),
+            "historical_diaries=" + json.dumps(report.get("historical_diaries") or {}, sort_keys=True),
+            "local_context=" + json.dumps(report.get("local_context") or {}, sort_keys=True),
+            "knowledge_graph=" + json.dumps(report.get("knowledge_graph") or {}, sort_keys=True),
+        ]
+        evidence.extend(
+            f"issue={item.get('severity')}:{item.get('code')}:{item.get('message')}"
+            for item in issues[:6]
+            if isinstance(item, dict)
+        )
+        if repair:
+            evidence.append("repair=" + json.dumps({
+                "transcripts_indexed": (repair.get("transcripts") or {}).get("indexed"),
+                "historical_diaries_inserted": (repair.get("backups") or {}).get("inserted"),
+            }, sort_keys=True))
+        blocking = [
+            item for item in issues
+            if isinstance(item, dict) and item.get("code") in {"transcript_index_empty", "backup_diaries_not_reconciled"}
+        ]
+        if not blocking:
+            return DoctorCheck(
+                id="runtime.memory_fabric",
+                tier="runtime",
+                status="healthy",
+                severity="info",
+                summary="Memory Fabric coverage is queryable",
+                evidence=evidence,
+                repair_plan=[],
+                fixed=bool(repair),
+            )
+        return DoctorCheck(
+            id="runtime.memory_fabric",
+            tier="runtime",
+            status="degraded",
+            severity="warn",
+            summary="Memory Fabric coverage needs repair",
+            evidence=evidence,
+            repair_plan=["Run `nexo doctor --tier runtime --fix` or `nexo update` to warm transcript and historical backup indexes"],
+            escalation_prompt="Some memory sources exist outside the active query indexes, so exact historical lookup may fall back to slow raw scans.",
+            fixed=bool(repair),
+        )
+    except Exception as exc:
+        return DoctorCheck(
+            id="runtime.memory_fabric",
+            tier="runtime",
+            status="degraded",
+            severity="warn",
+            summary="Memory Fabric health could not be checked",
+            evidence=[str(exc)],
+            repair_plan=["Inspect memory_fabric.py and DB migrations"],
+            escalation_prompt="Support cannot verify unified memory coverage.",
+        )
+
+
 def run_runtime_checks(fix: bool = False) -> list[DoctorCheck]:
     """Run all runtime-tier checks. Read-only by default."""
     return [
@@ -3922,6 +3990,7 @@ def run_runtime_checks(fix: bool = False) -> list[DoctorCheck]:
         safe_check(check_automation_caller_coverage),
         safe_check(check_state_watchers),
         safe_check(check_local_index_hygiene, fix=fix),
+        safe_check(check_memory_fabric_health, fix=fix),
         safe_check(check_release_artifact_sync),
         safe_check(check_release_trace_hygiene),
         safe_check(check_launchagent_inventory),

package/src/hook_guardrails.py

@@ -76,6 +76,26 @@ SHELL_WRITE_BASES = {
     "rsync",
 }
 SHELL_REDIRECT_TOKENS = {">", ">>", "1>", "1>>", "2>", "2>>"}
+# Flags whose *next* token is a non-path argument (User-Agent strings,
+# headers, query payloads, URLs, etc.). Without this whitelist the bash
+# path extractor lifts fragments like ``Mozilla/5.0`` and ``AppleWebKit/
+# 537.36`` as candidate paths, generating a ``g4_guard_check_required``
+# debt for every curl/wget with a ``-A`` flag. Tracked by NF-AUDIT-
+# 20260522-DRAIN-WHITELIST-EXPAND (W2).
+SHELL_FLAGS_WITH_NON_PATH_ARG = {
+    "-A", "--user-agent",
+    "-H", "--header",
+    "-e", "--referer",
+    "-X", "--request",
+    "-d", "--data", "--data-raw", "--data-binary", "--data-urlencode",
+    "-F", "--form",
+    "-u", "--user",
+    "--url",
+    "--cookie", "-b",
+    "--connect-timeout", "--max-time",
+    "--retry", "--retry-delay", "--retry-max-time",
+    "--resolve",
+}
 INLINE_INTERPRETER_BASES = {
     "python",
     "python3",
@@ -392,6 +412,14 @@ def _looks_like_real_path(path: str) -> bool:
     stripped = raw.lstrip("/")
     if stripped and re.fullmatch(r"\d+", stripped):
         return False
+    # Version-like fragments (``/5.0``, ``/537.36``, ``/140.0.0.0``) come
+    # from User-Agent / library version strings that the EMBEDDED_PATH_RE
+    # scanner lifts out of curl/wget commands. Token-level skip
+    # (SHELL_FLAGS_WITH_NON_PATH_ARG) does not help here because the regex
+    # runs against the raw command string. Filter them out at the path
+    # plausibility check instead.
+    if stripped and re.fullmatch(r"\d+(?:\.\d+)+", stripped):
+        return False
     if raw.lower() in _PATH_DICTIONARY_BLOCKLIST:
         return False
     # Reject single-segment ``/word`` candidates that do not exist on the
@@ -697,12 +725,25 @@ def _extract_bash_touched_files(tool_input) -> list[str]:
             seen.add(normalized)
             candidates.append(resolved)
 
+    skip_next = False
     for index, token in enumerate(tokens):
+        if skip_next:
+            skip_next = False
+            continue
         if token in SHELL_REDIRECT_TOKENS:
             if index + 1 < len(tokens):
                 add(tokens[index + 1])
             continue
         if token.startswith("-"):
+            # ``--flag=value`` is self-contained; the value is glued so the
+            # extractor already ignores it. For the separated form
+            # (``-A "Mozilla/5.0 ..."`` / ``-H "X-Foo: bar"``) we have to
+            # skip the NEXT token, otherwise the path extractor lifts
+            # User-Agent / header / payload fragments as candidate paths
+            # and floods the audit with ``g4_guard_check_required`` noise.
+            flag_head = token.split("=", 1)[0]
+            if flag_head in SHELL_FLAGS_WITH_NON_PATH_ARG and "=" not in token:
+                skip_next = True
             continue
         if (
             token.startswith(("/", "~", ".", "$"))