nexo-brain 7.25.5 → 7.26.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.25.5",
+  "version": "7.26.0",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.25.5` is the current packaged-runtime line. Patch release over v7.25.4 - explicit user-included Local Memory roots can override default system/noisy-tree skips, while Brain LocalIndex operator messages stay in English and Desktop continues to enforce the Core-pinned Python 3.12 runtime.
+Version `7.26.0` is the current packaged-runtime line. Minor release over v7.25.6 - provider runtime parity lets Desktop-managed Brain choose Anthropic Claude or OpenAI Codex, keep provider metadata on sessions/automation/crons, and provision the managed Codex runtime from bundled Desktop resources.
+
+Previously in `7.25.6`: patch release over v7.25.5 - existing Local Memory sidecar databases repair legacy root/exclusion columns before source-dependent indexes are created, and core background crons prefer the NEXO-managed Python runtime.
 
 Previously in `7.25.4`: patch release over v7.25.3 - Local Memory starts from safe user-content and email roots, adds configurable included/excluded file types, and cleans legacy whole-disk index state with backup or archive-rebuild safety.
 

package/bin/nexo-brain.js

@@ -18,6 +18,7 @@ const { execSync, spawnSync } = require("child_process");
 const crypto = require("crypto");
 const fs = require("fs");
 const { createRequire } = require("module");
+const os = require("os");
 const path = require("path");
 const readline = require("readline");
 // Force relative launcher helpers to resolve from bin/ even under test harnesses.
@@ -1672,6 +1673,7 @@ function getDefaultSchedule(timezone) {
     default_terminal_client: "claude_code",
     automation_enabled: true,
     automation_backend: "claude_code",
+    provider_runtime: defaultProviderRuntime("anthropic", "anthropic"),
     // v6.0.0 — model/reasoning_effort have moved to src/resonance_tiers.json
     // keyed by the operator's preferences.default_resonance. The shape
     // below stays so that downstream readers that iterate the profile
@@ -1813,9 +1815,31 @@ function detectInstalledClients() {
     : [];
   const desktopAppPath = desktopApps.find((candidate) => fs.existsSync(candidate)) || "";
   const managedClaudeBin = resolveManagedClaudeBinary();
+  const managedCodexBin = resolveManagedCodexBinary();
+  const desktopManaged = isDesktopManagedInstall();
+  if (desktopManaged) {
+    const managedCodexReady = managedCodexBin && codexVendorPresent(managedClaudePrefix());
+    return {
+      claude_code: {
+        installed: Boolean(managedClaudeBin),
+        path: managedClaudeBin,
+        detectedBy: managedClaudeBin ? "managed_binary" : "missing",
+      },
+      codex: {
+        installed: Boolean(managedCodexReady),
+        path: managedCodexReady ? managedCodexBin : "",
+        detectedBy: managedCodexReady ? "managed_binary" : "missing",
+      },
+      claude_desktop: {
+        installed: Boolean(desktopAppPath || fs.existsSync(desktopConfig)),
+        path: desktopAppPath || desktopConfig,
+        detectedBy: desktopAppPath ? "app" : (fs.existsSync(desktopConfig) ? "config" : "missing"),
+      },
+    };
+  }
   const persistedClaudeBin = readPersistedClaudeCliPath();
   const claudeBin = managedClaudeBin || persistedClaudeBin || run("which claude", { env: buildManagedCliEnv() }) || run("which claude") || "";
-  const codexBin = run("which codex") || "";
+  const codexBin = managedCodexBin || run("which codex", { env: buildManagedCliEnv() }) || run("which codex") || "";
   return {
     claude_code: {
       installed: Boolean(claudeBin),
@@ -1905,6 +1929,14 @@ function resolveManagedClaudeBinary() {
   return candidates.find((candidate) => candidate && fs.existsSync(candidate)) || "";
 }
 
+function resolveManagedCodexBinary() {
+  const prefix = managedClaudePrefix();
+  const candidates = process.platform === "win32"
+    ? [path.join(prefix, "codex.cmd"), path.join(prefix, "bin", "codex.cmd")]
+    : [path.join(prefix, "bin", "codex"), path.join(prefix, "codex")];
+  return candidates.find((candidate) => candidate && fs.existsSync(candidate)) || "";
+}
+
 function readPersistedClaudeCliPath() {
   const candidates = [
     path.join(NEXO_HOME, "config", "claude-cli-path"),
@@ -2000,6 +2032,60 @@ function defaultClientRuntimeProfiles() {
   };
 }
 
+function defaultProviderRuntime(selectedProvider = "anthropic", automationProvider = selectedProvider) {
+  const automationBackend = automationProvider === "openai" ? "codex" : (automationProvider === "anthropic" ? "claude_code" : "none");
+  return {
+    schema_version: 1,
+    selected_chat_provider: selectedProvider,
+    automation_provider: automationProvider,
+    automation_backend: automationBackend,
+    providers: {
+      anthropic: {
+        client: "claude_code",
+        runtime_account_status: {
+          surface: "desktop_login",
+          status: "unknown",
+          plan: null,
+          last_checked_at: null,
+          detail: null,
+        },
+        install_status: {
+          installed: false,
+          managed: true,
+          binary_path: null,
+          version: null,
+        },
+      },
+      openai: {
+        client: "codex",
+        runtime_account_status: {
+          surface: "desktop_login",
+          status: "unknown",
+          plan: null,
+          last_checked_at: null,
+          detail: null,
+        },
+        install_status: {
+          installed: false,
+          managed: true,
+          binary_path: null,
+          version: null,
+        },
+      },
+    },
+    fallback_policy: {
+      chat: "ask",
+      automation: "fail_closed",
+    },
+    last_provider_change: {
+      changed_at: null,
+      from_provider: null,
+      to_provider: null,
+      source: null,
+    },
+  };
+}
+
 function runtimeClientLabel(client) {
   if (client === "claude_code") return "Claude Code";
   if (client === "codex") return "Codex";
@@ -2039,6 +2125,7 @@ function defaultClientSetup(detected) {
     default_terminal_client: "claude_code",
     automation_enabled: true,
     automation_backend: "claude_code",
+    provider_runtime: defaultProviderRuntime("anthropic", "anthropic"),
     client_runtime_profiles: defaultClientRuntimeProfiles(),
     client_install_preferences: {
       claude_code: "ask",
@@ -2057,6 +2144,17 @@ function applyClientSetupToSchedule(schedule, setup) {
   schedule.default_terminal_client = setup.default_terminal_client;
   schedule.automation_enabled = Boolean(setup.automation_enabled);
   schedule.automation_backend = schedule.automation_enabled ? setup.automation_backend : "none";
+  const selectedProvider = setup.default_terminal_client === "codex" ? "openai" : "anthropic";
+  const automationProvider = schedule.automation_backend === "codex"
+    ? "openai"
+    : (schedule.automation_backend === "claude_code" ? "anthropic" : "none");
+  schedule.provider_runtime = {
+    ...defaultProviderRuntime(selectedProvider, automationProvider),
+    ...(setup.provider_runtime || {}),
+    selected_chat_provider: selectedProvider,
+    automation_provider: automationProvider,
+    automation_backend: schedule.automation_backend,
+  };
   schedule.client_runtime_profiles = {
     ...defaultClientRuntimeProfiles(),
     ...(setup.client_runtime_profiles || {}),
@@ -2090,6 +2188,9 @@ function installClaudeCodeCli(platform) {
   const npmViaDesktop = desktopNode && bundledNpmCli;
   let installEnv = buildManagedCliEnv();
   if (desktopNode) installEnv = withDesktopNodeShim(installEnv, desktopNode);
+  if (desktopManaged && !npmViaDesktop) {
+    return { installed: false, path: "" };
+  }
 
   // OFFLINE-FIRST v0.32.4: install claude-code wrapper + ALL its native packs
   // from bundled tarballs. Path: resources/brain-bundle/claude-code/*.tgz.
@@ -2186,22 +2287,7 @@ function installClaudeCodeCli(platform) {
     }
   }
 
-  if (desktopManaged) {
-    spawnSync(
-      "npm",
-      ["install", "-g", "--prefix", managedPrefix, "@anthropic-ai/claude-code"],
-      {
-        stdio: "inherit",
-        env: installEnv,
-      },
-    );
-    claudeInstalled = detectInstalledClients().claude_code.path || "";
-    if (claudeInstalled) {
-      persistClaudeCliPath(claudeInstalled);
-      return { installed: true, path: claudeInstalled };
-    }
-    return { installed: false, path: "" };
-  }
+  if (desktopManaged) return { installed: false, path: "" };
 
   spawnSync("npx", ["-y", "@anthropic-ai/claude-code", "--version"], {
     stdio: "pipe",
@@ -2221,11 +2307,128 @@ function installClaudeCodeCli(platform) {
   return { installed: Boolean(claudeInstalled), path: claudeInstalled || "" };
 }
 
+function installBundledCodexVendor(bundleDir, managedPrefix) {
+  const packageRoots = [
+    path.join(managedPrefix, "lib", "node_modules", "@openai", "codex"),
+    path.join(managedPrefix, "node_modules", "@openai", "codex"),
+  ];
+  const packageRoot = packageRoots.find((candidate) => fs.existsSync(candidate)) || packageRoots[0];
+  if (!fs.existsSync(packageRoot)) return false;
+  const allTgz = fs.readdirSync(bundleDir).filter((f) => f.endsWith(".tgz"));
+  const platformSlug = `${process.platform}-${process.arch}`;
+  const nativePacks = allTgz.filter((f) => f.includes(`-${platformSlug}.tgz`) || f.includes(`-${platformSlug}-`));
+  if (!nativePacks.length) return false;
+  const tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nexo-codex-vendor-"));
+  try {
+    for (const pack of nativePacks) {
+      const tgzPath = path.join(bundleDir, pack);
+      const extract = spawnSync("tar", ["-xzf", tgzPath, "-C", tmpRoot], { stdio: "pipe" });
+      if (extract.status !== 0) continue;
+      const vendorRoot = path.join(tmpRoot, "package", "vendor");
+      if (!fs.existsSync(vendorRoot)) continue;
+      fs.mkdirSync(path.join(packageRoot, "vendor"), { recursive: true });
+      for (const entry of fs.readdirSync(vendorRoot)) {
+        fs.cpSync(path.join(vendorRoot, entry), path.join(packageRoot, "vendor", entry), { recursive: true, force: true });
+      }
+      return true;
+    }
+  } finally {
+    try { fs.rmSync(tmpRoot, { recursive: true, force: true }); } catch {}
+  }
+  return false;
+}
+
+function codexVendorPresent(managedPrefix) {
+  const packageRoots = [
+    path.join(managedPrefix, "lib", "node_modules", "@openai", "codex"),
+    path.join(managedPrefix, "node_modules", "@openai", "codex"),
+  ];
+  for (const packageRoot of packageRoots) {
+    const vendorRoot = path.join(packageRoot, "vendor");
+    if (!fs.existsSync(vendorRoot)) continue;
+    try {
+      const stack = [vendorRoot];
+      while (stack.length) {
+        const current = stack.pop();
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+          const target = path.join(current, entry.name);
+          if (entry.isDirectory()) {
+            stack.push(target);
+          } else if (entry.isFile() && path.basename(path.dirname(target)) === "bin" && entry.name.startsWith("codex")) {
+            return true;
+          }
+        }
+      }
+    } catch {}
+  }
+  return false;
+}
+
 function installCodexCli() {
-  const before = run("which codex");
-  if (before) return { installed: true, path: before };
-  spawnSync("npm", ["install", "-g", "@openai/codex"], { stdio: "inherit" });
-  const codexInstalled = run("which codex") || "";
+  const desktopNode = String(process.env.NEXO_DESKTOP_NODE || "").trim();
+  const bundledNpmCli = String(process.env.NEXO_DESKTOP_NPM_CLI || "").trim();
+  const managedPrefix = managedClaudePrefix();
+  const desktopManaged = isDesktopManagedInstall();
+  let before = detectInstalledClients().codex.path || "";
+  if (before && (!desktopManaged || codexVendorPresent(managedPrefix))) return { installed: true, path: before };
+  if (before && desktopManaged) {
+    log("  Managed Codex wrapper exists, but native vendor is missing; repairing bundled vendor.");
+  }
+  const npmViaDesktop = desktopNode && bundledNpmCli;
+  let installEnv = buildManagedCliEnv();
+  if (desktopNode) installEnv = withDesktopNodeShim(installEnv, desktopNode);
+  if (desktopManaged && !npmViaDesktop) {
+    return { installed: false, path: "" };
+  }
+
+  const bundledCodexDir = path.join(__dirname, "..", "codex");
+  if (fs.existsSync(bundledCodexDir)) {
+    const allTgz = fs.readdirSync(bundledCodexDir).filter((f) => f.endsWith(".tgz")).sort();
+    const wrapper = allTgz.find((f) => /^openai-codex-\d+\.\d+\.\d+\.tgz$/.test(f));
+    if (wrapper) {
+      const tgzPath = path.join(bundledCodexDir, wrapper);
+      log("  Installing Codex from bundled tarball (offline wrapper + native vendor)...");
+      spawnSync(
+        npmViaDesktop ? desktopNode : "npm",
+        [
+          ...(npmViaDesktop ? [bundledNpmCli] : []),
+          "install",
+          "-g",
+          "--prefix",
+          managedPrefix,
+          "--offline",
+          "--no-audit",
+          "--no-fund",
+          tgzPath,
+        ],
+        { stdio: "inherit", env: installEnv },
+      );
+      const bundledVendorInstalled = installBundledCodexVendor(bundledCodexDir, managedPrefix);
+      before = detectInstalledClients().codex.path || "";
+      if (before && bundledVendorInstalled) return { installed: true, path: before };
+      if (before && !bundledVendorInstalled) {
+        log("  Bundled Codex wrapper installed, but native vendor extraction failed; falling back to online install.");
+      }
+    }
+  }
+
+  if (desktopNode && bundledNpmCli) {
+    spawnSync(
+      desktopNode,
+      [bundledNpmCli, "install", "-g", "--prefix", managedPrefix, "@openai/codex"],
+      {
+        stdio: "inherit",
+        env: { ...installEnv, ELECTRON_RUN_AS_NODE: "1" },
+      },
+    );
+    before = detectInstalledClients().codex.path || "";
+    if (before && (!desktopManaged || codexVendorPresent(managedPrefix))) return { installed: true, path: before };
+  }
+
+  if (desktopManaged) return { installed: false, path: "" };
+
+  spawnSync("npm", ["install", "-g", "--prefix", managedPrefix, "@openai/codex"], { stdio: "inherit", env: installEnv });
+  const codexInstalled = detectInstalledClients().codex.path || "";
   return { installed: Boolean(codexInstalled), path: codexInstalled };
 }
 
@@ -2284,19 +2487,19 @@ async function configureClientSetup({ lang, useDefaults, autoInstall, detected }
   const required = requiredCliClients(setup);
   for (const client of required) {
     if (detected[client] && detected[client].installed) continue;
-    if (desktopManaged && client === "claude_code") {
-      const bundledClaudeDir = path.join(__dirname, "..", "claude-code");
+    if (desktopManaged && (client === "claude_code" || client === "codex")) {
+      const bundledClientDir = path.join(__dirname, "..", client === "claude_code" ? "claude-code" : "codex");
       let hasBundle = false;
       try {
-        if (fs.existsSync(bundledClaudeDir)) {
-          hasBundle = fs.readdirSync(bundledClaudeDir).some((f) => f.endsWith(".tgz"));
+        if (fs.existsSync(bundledClientDir)) {
+          hasBundle = fs.readdirSync(bundledClientDir).some((f) => f.endsWith(".tgz"));
         }
       } catch (_) {}
       if (!hasBundle) {
-        log("Claude Code install deferred to Desktop final sync.");
+        log(`${runtimeClientLabel(client)} install deferred to Desktop final sync.`);
         continue;
       }
-      log("Bundled Claude Code tarball detected — installing offline now.");
+      log(`Bundled ${runtimeClientLabel(client)} tarball detected — installing offline now.`);
     }
     let shouldInstall = useDefaults || autoInstall === "auto";
     if (!shouldInstall && process.stdin.isTTY && process.stdout.isTTY) {
@@ -2326,8 +2529,9 @@ async function configureClientSetup({ lang, useDefaults, autoInstall, detected }
   }
 
   if (setup.automation_enabled && setup.automation_backend !== "none" && !detected[setup.automation_backend]?.installed) {
-    if (desktopManaged && setup.automation_backend === "claude_code") {
-      log("Claude Code will be provisioned by Desktop after the core runtime is ready.");
+    if (desktopManaged && (setup.automation_backend === "claude_code" || setup.automation_backend === "codex")) {
+      const label = setup.automation_backend === "claude_code" ? "Claude Code" : "Codex";
+      log(`${label} will be provisioned by Desktop after the core runtime is ready.`);
       return { setup, detected };
     }
     const label = setup.automation_backend === "claude_code" ? "Claude Code" : "Codex";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.25.5",
+  "version": "7.26.0",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",
@@ -65,6 +65,11 @@
       "name": "@anthropic-ai/claude-code",
       "type": "npm-global",
       "optional": false
+    },
+    {
+      "name": "@openai/codex",
+      "type": "npm-global",
+      "optional": true
     }
   ],
   "engines": {
@@ -87,6 +92,7 @@
     "!templates/**/__pycache__",
     "!templates/**/*.pyc",
     "!templates/**/*.pyo",
+    "codex/openai-codex-0.133.0.tgz",
     ".claude-plugin/",
     ".mcp.json",
     "hooks/hooks.json",

package/src/agent_runner.py

@@ -24,8 +24,12 @@ from client_preferences import (
     BACKEND_NONE,
     CLIENT_CLAUDE_CODE,
     CLIENT_CODEX,
+    client_to_provider,
     TERMINAL_CLIENT_KEYS,
     load_client_preferences,
+    _desktop_product_requested,
+    _managed_codex_binary,
+    _managed_codex_vendor_present,
     normalize_client_key,
     resolve_automation_backend,
     resolve_client_runtime_profile,
@@ -54,6 +58,10 @@ class TerminalClientUnavailableError(AgentRunnerError):
 class AutomationBackendUnavailableError(AgentRunnerError):
     """Raised when the configured automation backend is unavailable."""
 
+
+def _automation_provider_for_backend(backend: str) -> str:
+    return client_to_provider(backend) or ""
+
 def _canonical_pricing_model(model: str) -> str:
     lowered = str(model or "").strip().lower()
     lowered = lowered.split("[", 1)[0]
@@ -199,6 +207,7 @@ def _record_automation_start(
     *,
     caller: str,
     backend: str,
+    provider: str = "",
     session_type: str,
     task_profile: str,
     model: str,
@@ -225,14 +234,15 @@ def _record_automation_start(
         cur = conn.execute(
             """
             INSERT INTO automation_runs (
-                caller, backend, session_type, task_profile, model,
+                caller, backend, provider, session_type, task_profile, model,
                 reasoning_effort, resonance_tier, cwd, output_format,
                 prompt_chars, status, started_at, pid
-            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', datetime('now'), ?)
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', datetime('now'), ?)
             """,
             (
                 caller or "",
                 backend,
+                provider or _automation_provider_for_backend(backend),
                 session_type or "headless",
                 task_profile or "default",
                 model or "",
@@ -339,6 +349,7 @@ def _record_automation_end(
 def _record_automation_run(
     *,
     backend: str,
+    provider: str = "",
     task_profile: str,
     model: str,
     reasoning_effort: str,
@@ -359,6 +370,7 @@ def _record_automation_run(
     row_id, err = _record_automation_start(
         caller=caller,
         backend=backend,
+        provider=provider or _automation_provider_for_backend(backend),
         session_type=session_type,
         task_profile=task_profile,
         model=model,
@@ -378,14 +390,57 @@ def _record_automation_run(
     )
 
 
+def _record_backend_unavailable(
+    *,
+    backend: str,
+    caller: str,
+    cwd: Path,
+    prompt: str,
+) -> None:
+    profile = resolve_client_runtime_profile(backend)
+    _record_automation_run(
+        backend=backend,
+        provider=_automation_provider_for_backend(backend),
+        task_profile="default",
+        model=profile.get("model", ""),
+        reasoning_effort=profile.get("reasoning_effort", ""),
+        cwd=cwd,
+        output_format="text",
+        prompt=prompt,
+        returncode=2,
+        duration_ms=0,
+        telemetry={
+            "telemetry_source": "backend_unavailable",
+            "cost_source": "missing",
+            "usage": {},
+            "warnings": ["backend_unavailable", "fallback_blocked"],
+            "raw": {
+                "event": "backend_unavailable",
+                "backend": backend,
+                "provider": _automation_provider_for_backend(backend),
+                "fallback_policy": "fail_closed",
+            },
+        },
+        caller=caller,
+        session_type="headless",
+    )
+
+
 def _resolve_claude_cli() -> str:
     return _shared_resolve_claude_cli()
 
 
 def _resolve_codex_cli() -> str:
+    home = Path.home()
+    if _desktop_product_requested(home):
+        managed_path = _managed_codex_binary(home)
+        return managed_path if managed_path and _managed_codex_vendor_present(home) else ""
     env_path = os.environ.get("CODEX_BIN", "").strip()
     if env_path and Path(env_path).exists():
         return env_path
+    managed_path = _managed_codex_binary(home)
+    if managed_path and _managed_codex_vendor_present(home):
+        return managed_path
     return shutil.which("codex") or ""
 
 
@@ -790,6 +845,7 @@ def run_automation_interactive(
     row_id, _record_err = _record_automation_start(
         caller=caller,
         backend=resolved_client,
+        provider=_automation_provider_for_backend(resolved_client),
         session_type=session_type,
         task_profile="",
         model="",
@@ -905,15 +961,6 @@ def _backend_is_available(backend: str) -> bool:
 
 
 def _resolve_available_backend(selected_backend: str, *, preferences: dict | None = None) -> str:
-    if _backend_is_available(selected_backend):
-        return selected_backend
-    prefs = preferences or load_client_preferences()
-    preferred = resolve_automation_backend(preferences=prefs)
-    for candidate in (preferred, CLIENT_CLAUDE_CODE, CLIENT_CODEX):
-        if candidate == selected_backend or candidate == BACKEND_NONE:
-            continue
-        if _backend_is_available(candidate):
-            return candidate
     return selected_backend
 
 
@@ -1011,7 +1058,7 @@ _ANTHROPIC_API_KEY_SEARCH_PATHS = (
 
 
 def _resolve_anthropic_api_key() -> str:
-    """Locate an Anthropic API key for bare-mode invocations.
+    """Locate a legacy Anthropic API key for opt-in bare-mode invocations.
 
     ``claude --bare`` skips macOS Keychain auth entirely, so the child
     must find the API key in ``ANTHROPIC_API_KEY`` or via ``apiKeyHelper``.
@@ -1039,15 +1086,16 @@ def _resolve_anthropic_api_key() -> str:
     return ""
 
 
-# Callers for which bare_mode=True is safe. The child's only allowed_tools
-# must be file/grep/shell (no ``mcp__nexo__*``), otherwise --bare's opt-out
-# of plugin sync / MCP bootstrap breaks the run. Extract/synthesize fit
-# this profile: they read transcripts + shared-context and emit JSON, no
-# NEXO tool calls.
-BARE_MODE_SAFE_CALLERS: frozenset[str] = frozenset({
-    "deep-sleep/extract",
-    "deep-sleep/synthesize",
-})
+def _allow_anthropic_api_key_bare_mode() -> bool:
+    value = os.environ.get("NEXO_ALLOW_ANTHROPIC_API_BARE", "").strip().lower()
+    return value in {"1", "true", "yes", "on"}
+
+
+# v7.26 provider-runtime contract: Desktop-managed automation must use the
+# selected account runtime (Claude Code or Codex), not an Anthropic API key
+# side path. Bare mode remains a hidden legacy opt-in for controlled local
+# experiments only via NEXO_ALLOW_ANTHROPIC_API_BARE=1.
+BARE_MODE_SAFE_CALLERS: frozenset[str] = frozenset()
 
 # Execution contracts keep background agents disciplined without polluting
 # machine-only child calls that must return strict JSON.
@@ -1153,6 +1201,17 @@ def run_automation_prompt(
     if selected_backend == BACKEND_NONE:
         raise AutomationBackendUnavailableError("Automation backend is disabled in config.")
     selected_backend = _resolve_available_backend(selected_backend, preferences=prefs)
+    if not _backend_is_available(selected_backend):
+        cwd_path = Path(cwd).expanduser().resolve() if cwd else Path.cwd()
+        _record_backend_unavailable(
+            backend=selected_backend,
+            caller=caller,
+            cwd=cwd_path,
+            prompt=prompt,
+        )
+        raise AutomationBackendUnavailableError(
+            f"{selected_backend} automation backend selected but launcher is not installed; fallback blocked."
+        )
 
     # Resonance map decides (model, effort) for every call. ``caller`` is
     # MANDATORY — every script that invokes the automation backend must be
@@ -1256,13 +1315,13 @@ def run_automation_prompt(
         # completes in seconds.
         #
         # Selection rules:
-        #   - bare_mode=True explicit → trust the caller.
+        #   - bare_mode=True explicit → allow only when the legacy API-key
+        #     escape hatch is enabled.
         #   - bare_mode=None (default) + caller in BARE_MODE_SAFE_CALLERS
-        #     → auto-enable.
+        #     → auto-enable. v7.26 keeps this set empty for provider parity.
         #   - bare_mode=False → never.
-        #   - --bare disables keychain auth, so we must provide an
-        #     ANTHROPIC_API_KEY. If one cannot be located, fall back to
-        #     normal mode with a warning on stderr rather than failing.
+        #   - --bare disables keychain auth, so the legacy path requires
+        #     ANTHROPIC_API_KEY. If disabled or missing, use normal account auth.
         resolved_bare = False
         if bare_mode is True:
             resolved_bare = True
@@ -1271,12 +1330,14 @@ def run_automation_prompt(
 
         bare_api_key = ""
         if resolved_bare:
-            bare_api_key = _resolve_anthropic_api_key()
-            if not bare_api_key:
-                # Silent fallback: we would rather take the slower path
-                # than force the caller to fail-closed on an env quirk.
+            if not _allow_anthropic_api_key_bare_mode():
                 resolved_bare = False
-
+            else:
+                bare_api_key = _resolve_anthropic_api_key()
+                if not bare_api_key:
+                    # Silent fallback: we would rather take the slower path
+                    # than force the caller to fail-closed on an env quirk.
+                    resolved_bare = False
         # Headless claude -p does NOT reliably honour permissions.allow from
         # settings.json for MCP tool calls — it can stall waiting for an
         # approval that will never come in non-interactive mode. All NEXO
@@ -1293,6 +1354,8 @@ def run_automation_prompt(
             run_env = dict(run_env)
             run_env["ANTHROPIC_API_KEY"] = bare_api_key
         else:
+            run_env = dict(run_env)
+            run_env.pop("ANTHROPIC_API_KEY", None)
             cmd.append("--dangerously-skip-permissions")
         if resolved_model:
             cmd.extend(["--model", resolved_model])
@@ -1342,6 +1405,7 @@ def run_automation_prompt(
         telemetry["automation_contract"] = automation_contract
         recorded, record_error = _record_automation_run(
             backend=selected_backend,
+            provider=_automation_provider_for_backend(selected_backend),
             task_profile=task_profile,
             model=resolved_model,
             reasoning_effort=resolved_effort,
@@ -1420,6 +1484,7 @@ def run_automation_prompt(
             telemetry["automation_contract"] = automation_contract
             recorded, record_error = _record_automation_run(
                 backend=selected_backend,
+                provider=_automation_provider_for_backend(selected_backend),
                 task_profile=task_profile,
                 model=resolved_model,
                 reasoning_effort=resolved_effort,