nexo-brain 7.30.10 → 7.30.12

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.10",
+  "version": "7.30.12",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,11 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.10` is the current packaged-runtime line. Patch release over v7.30.9 - packaged `nexo update` now stamps the verified repair baseline after import verification, including same-version maintenance runs.
+Version `7.30.12` is the current packaged-runtime line. Patch release over v7.30.11 - Desktop-managed email credentials now resolve through the shared credential helper, so Email NEXO migrations and CLI reads use keychain-backed markers before legacy SQLite fallback.
+
+Previously in `7.30.11`: patch release over v7.30.10 - the installer and npm postinstall path now stamp the verified repair baseline too, so the first update from older packaged installs is covered without a manual second run.
+
+Previously in `7.30.10`: patch release over v7.30.9 - packaged `nexo update` now stamps the verified repair baseline after import verification, including same-version maintenance runs.
 
 Previously in `7.30.9`: patch release over v7.30.8 - post-update self-heal now stamps a verified repair baseline, and doctor release gates distinguish current installation failures from historical operator/session drift.
 

package/bin/nexo-brain.js

@@ -949,6 +949,52 @@ function syncRuntimePackageMetadata(repoRoot = path.join(__dirname, ".."), runti
   }
 }
 
+const REPAIR_BASELINE_FILE = "last-repair-baseline.json";
+
+function _runtimeRepairBaselineDir(nexoHome = NEXO_HOME) {
+  const canonical = path.join(nexoHome, "runtime", "operations");
+  const legacy = path.join(nexoHome, "operations");
+  if (!fs.existsSync(path.join(nexoHome, "runtime")) && fs.existsSync(legacy)) {
+    return legacy;
+  }
+  return canonical;
+}
+
+function stampRuntimeRepairBaseline(nexoHome = NEXO_HOME, source = "bin.nexo-brain") {
+  try {
+    const operationsDir = _runtimeRepairBaselineDir(nexoHome);
+    fs.mkdirSync(operationsDir, { recursive: true });
+    const now = new Date();
+    const body = JSON.stringify({
+      last_repair_epoch: now.getTime() / 1000,
+      last_repair_at: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
+      source,
+      reason: "verified runtime repair baseline after installer/postinstall repair",
+    }, null, 2) + "\n";
+    const baselinePath = path.join(operationsDir, REPAIR_BASELINE_FILE);
+    fs.writeFileSync(baselinePath, body);
+
+    const legacyDir = path.join(nexoHome, "operations");
+    const legacyPath = path.join(legacyDir, REPAIR_BASELINE_FILE);
+    if (legacyPath !== baselinePath && fs.existsSync(legacyDir)) {
+      try {
+        fs.writeFileSync(legacyPath, body);
+      } catch (_) {}
+    }
+    return { ok: true, path: baselinePath };
+  } catch (err) {
+    return { ok: false, error: String((err && err.message) || err) };
+  }
+}
+
+function logRepairBaselineStatus(result) {
+  if (result && result.ok) {
+    log("  Repair baseline: updated.");
+  } else {
+    log(`  Repair baseline warning: ${(result && result.error) || "unknown error"}`);
+  }
+}
+
 function resolveRuntimeConfigDir(nexoHome) {
   const canonical = path.join(nexoHome, "personal", "config");
   const legacy = path.join(nexoHome, "config");
@@ -3286,6 +3332,9 @@ async function runSetup() {
           throw new Error(`Runtime activation failed: ${migActivation.error}`);
         }
         log(`  Runtime activation: core/current -> versions/${currentVersion}`);
+        logRepairBaselineStatus(
+          stampRuntimeRepairBaseline(NEXO_HOME, "bin.nexo-brain.migration")
+        );
 
         // Keep the rendered template in-memory for version tracking, but do
         // not drop a loose reference file in NEXO_HOME root.
@@ -3439,6 +3488,9 @@ async function runSetup() {
       if (!syncLayoutFinalize.ok) {
         throw new Error(`F0.6 layout finalization failed: ${syncLayoutFinalize.error}`);
       }
+      logRepairBaselineStatus(
+        stampRuntimeRepairBaseline(NEXO_HOME, "bin.nexo-brain.same-version-repair")
+      );
 
       runDesktopAwareModelWarmup(syncPython, NEXO_HOME, { reason: "repair" });
       logMacPermissionsNotice(NEXO_HOME, syncPython);
@@ -5029,6 +5081,9 @@ See ~/.nexo/ for configuration.
   if (!layoutFinalize.ok) {
     throw new Error(`F0.6 layout finalization failed: ${layoutFinalize.error}`);
   }
+  logRepairBaselineStatus(
+    stampRuntimeRepairBaseline(NEXO_HOME, "bin.nexo-brain.install")
+  );
 
   console.log("");
   const readyMsg = t.ready(operatorName, aliasName);

package/bin/postinstall.js

@@ -13,6 +13,7 @@ const { execFileSync } = require("child_process");
 const NEXO_HOME = process.env.NEXO_HOME || path.join(require("os").homedir(), ".nexo");
 const VERSION_FILE = path.join(NEXO_HOME, "version.json");
 const INSTALLER = path.join(__dirname, "nexo-brain.js");
+const REPAIR_BASELINE_FILE = "last-repair-baseline.json";
 
 if (process.env.NEXO_SKIP_POSTINSTALL === "1") {
   // Called during rollback — skip migration to avoid loops
@@ -31,13 +32,44 @@ function runModelWarmup(reason) {
   });
 }
 
+function runtimeRepairBaselineDir(nexoHome = NEXO_HOME) {
+  const canonical = path.join(nexoHome, "runtime", "operations");
+  const legacy = path.join(nexoHome, "operations");
+  if (!fs.existsSync(path.join(nexoHome, "runtime")) && fs.existsSync(legacy)) {
+    return legacy;
+  }
+  return canonical;
+}
+
+function stampRuntimeRepairBaseline(source = "bin.postinstall") {
+  const operationsDir = runtimeRepairBaselineDir(NEXO_HOME);
+  fs.mkdirSync(operationsDir, { recursive: true });
+  const now = new Date();
+  const body = JSON.stringify({
+    last_repair_epoch: now.getTime() / 1000,
+    last_repair_at: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
+    source,
+    reason: "verified runtime repair baseline after installer/postinstall repair",
+  }, null, 2) + "\n";
+  const baselinePath = path.join(operationsDir, REPAIR_BASELINE_FILE);
+  fs.writeFileSync(baselinePath, body);
+
+  const legacyDir = path.join(NEXO_HOME, "operations");
+  const legacyPath = path.join(legacyDir, REPAIR_BASELINE_FILE);
+  if (legacyPath !== baselinePath && fs.existsSync(legacyDir)) {
+    try {
+      fs.writeFileSync(legacyPath, body);
+    } catch (_) {}
+  }
+}
+
 if (fs.existsSync(VERSION_FILE)) {
   // Existing installation — run auto-migration silently
   const installed = JSON.parse(fs.readFileSync(VERSION_FILE, "utf8"));
   const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf8"));
 
   if (installed.version === pkg.version) {
-    // Same version, nothing to do
+    stampRuntimeRepairBaseline("bin.postinstall.same-version");
     process.exit(0);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.10",
+  "version": "7.30.12",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/cli_email.py

@@ -21,7 +21,6 @@ from __future__ import annotations
 import getpass
 import json
 import sys
-import time
 from typing import Any
 
 
@@ -74,30 +73,16 @@ def _sent_folder_from_account(account: dict | None) -> str:
 
 
 def _store_credential(service: str, key: str, value: str) -> None:
-    """Write password to the `credentials` table (simple cleartext by
-    default — upgrading to keychain is a v7 follow-up). Never echo the
-    password back to stdout."""
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'email account password (nexo email setup)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value,
-            updated_at = excluded.updated_at
-        """,
-        (service, key, value, now, now),
-    )
-    conn.commit()
+    """Write password without echoing it back to stdout."""
+    from email_credentials import store_email_credential
+
+    store_email_credential(service, key, value, "email account password (nexo email setup)")
 
 
 def _delete_credential(service: str, key: str) -> None:
-    from db._core import get_db
-    conn = get_db()
-    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
-    conn.commit()
+    from email_credentials import delete_email_credential
+
+    delete_email_credential(service, key)
 
 
 def cmd_email_setup(args) -> int:

package/src/email_config.py

@@ -41,24 +41,11 @@ LEGACY_CONFIG_PATH = _legacy_config_path()
 
 
 def _get_credential(service: str, key: str) -> str:
-    """Fetch a password from the credentials table. Returns empty string
-    on any miss so the caller can log-and-skip instead of crashing a cron.
-    """
-    if not service or not key:
-        return ""
+    """Fetch a password from keyring marker or legacy credentials table."""
     try:
-        from db._core import get_db
-    except Exception:  # pragma: no cover
-        return ""
-    try:
-        conn = get_db()
-        row = conn.execute(
-            "SELECT value FROM credentials WHERE service = ? AND key = ?",
-            (service, key),
-        ).fetchone()
-        if row is None:
-            return ""
-        return str(row[0] or "")
+        from email_credentials import read_email_credential
+
+        return read_email_credential(service, key)
     except Exception as exc:  # pragma: no cover
         _logger.warning("credential lookup failed for %s/%s: %s", service, key, exc)
         return ""

package/src/email_credentials.py

@@ -0,0 +1,159 @@
+"""Credential storage for email account passwords.
+
+Email account rows keep only ``credential_service`` + ``credential_key``.
+Historically the referenced ``credentials.value`` column stored the password
+directly. New writes try to place the secret in the OS keyring and keep a
+``keyring://...`` marker in SQLite. Legacy plaintext values remain readable so
+older installs keep working until they are rotated or migrated.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+import time
+from urllib.parse import quote, unquote
+
+KEYRING_SERVICE = "com.nexo.email"
+KEYRING_MARKER_PREFIX = "keyring://"
+
+
+def _db():
+    from db._core import get_db
+
+    return get_db()
+
+
+def _marker(service: str, key: str) -> str:
+    return f"{KEYRING_MARKER_PREFIX}{quote(service, safe='')}/{quote(key, safe='')}"
+
+
+def _parse_marker(value: str) -> tuple[str, str] | None:
+    if not value.startswith(KEYRING_MARKER_PREFIX):
+        return None
+    rest = value[len(KEYRING_MARKER_PREFIX):]
+    if "/" not in rest:
+        return None
+    service, key = rest.split("/", 1)
+    return unquote(service), unquote(key)
+
+
+def _account_name(service: str, key: str) -> str:
+    return f"{service}:{key}"
+
+
+def _keyring_module():
+    try:
+        return importlib.import_module("keyring")
+    except Exception:
+        return None
+
+
+def _read_stored_value(service: str, key: str) -> str:
+    if not service or not key:
+        return ""
+    row = _db().execute(
+        "SELECT value FROM credentials WHERE service = ? AND key = ?",
+        (service, key),
+    ).fetchone()
+    if row is None:
+        return ""
+    return str(row[0] or "")
+
+
+def _write_db_value(service: str, key: str, value: str, notes: str) -> None:
+    conn = _db()
+    now = time.time()
+    conn.execute(
+        """
+        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(service, key) DO UPDATE SET
+            value = excluded.value,
+            notes = excluded.notes,
+            updated_at = excluded.updated_at
+        """,
+        (service, key, value, notes, now, now),
+    )
+    conn.commit()
+
+
+def store_email_credential(service: str, key: str, value: str, notes: str = "email account password") -> str:
+    """Store an email password and return the SQLite value written.
+
+    Uses keyring when available. If the keyring backend is unavailable or
+    locked, the legacy SQLite plaintext path is used so existing automation
+    does not lose email access.
+    """
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    value = str(value or "")
+    if not service or not key:
+        return ""
+
+    mode = os.environ.get("NEXO_EMAIL_CREDENTIAL_STORE", "auto").strip().lower()
+    keyring = None if mode in {"sqlite", "legacy", "plain", "plaintext"} else _keyring_module()
+    if keyring is not None:
+        try:
+            keyring.set_password(KEYRING_SERVICE, _account_name(service, key), value)
+            stored = _marker(service, key)
+            _write_db_value(service, key, stored, notes + " (stored in system keyring)")
+            return stored
+        except Exception:
+            pass
+
+    if mode == "keyring":
+        return ""
+
+    _write_db_value(service, key, value, notes + " (legacy sqlite fallback)")
+    return value
+
+
+def read_email_credential(service: str, key: str) -> str:
+    """Resolve an email password from keyring marker or legacy plaintext."""
+    stored = _read_stored_value(str(service or "").strip(), str(key or "").strip())
+    parsed = _parse_marker(stored)
+    if parsed is None:
+        return stored
+
+    keyring = _keyring_module()
+    if keyring is None:
+        return ""
+    try:
+        value = keyring.get_password(KEYRING_SERVICE, _account_name(*parsed))
+    except Exception:
+        return ""
+    return str(value or "")
+
+
+def delete_email_credential(service: str, key: str) -> None:
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    if not service or not key:
+        return
+
+    parsed = _parse_marker(_read_stored_value(service, key))
+    keyring = _keyring_module()
+    if parsed is not None and keyring is not None:
+        try:
+            keyring.delete_password(KEYRING_SERVICE, _account_name(*parsed))
+        except Exception:
+            pass
+
+    conn = _db()
+    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
+    conn.commit()
+
+
+def is_keyring_marker(value: str) -> bool:
+    return _parse_marker(str(value or "")) is not None
+
+
+__all__ = [
+    "KEYRING_MARKER_PREFIX",
+    "KEYRING_SERVICE",
+    "delete_email_credential",
+    "is_keyring_marker",
+    "read_email_credential",
+    "store_email_credential",
+]

package/src/scripts/nexo-email-migrate-config.py

@@ -26,7 +26,6 @@ import json
 import os
 import re
 import sys
-import time
 from pathlib import Path
 
 
@@ -121,20 +120,14 @@ def main(argv: list[str]) -> int:
         print(f"[dry-run] credentials[{cred_service}/{cred_key}] = <password>")
         return 0
 
-    # Store credential
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'migrated from ~/.nexo/nexo-email/config.json (F1)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value, updated_at = excluded.updated_at
-        """,
-        (cred_service, cred_key, password, now, now),
+    from email_credentials import store_email_credential
+
+    store_email_credential(
+        cred_service,
+        cred_key,
+        password,
+        "migrated from ~/.nexo/nexo-email/config.json (F1)",
     )
-    conn.commit()
 
     if existing and not args.force:
         existing_metadata = existing.get("metadata") if isinstance(existing.get("metadata"), dict) else {}
@@ -194,7 +187,7 @@ def main(argv: list[str]) -> int:
             can_send=True,
         )
         print(f"✓ Cuenta agente '{args.label}' migrada ({account.get('email')}).")
-        print(f"  Password guardada en credentials[{cred_service}/{cred_key}].")
+        print(f"  Password guardada en el almacen de credenciales[{cred_service}/{cred_key}].")
         print(
             "  Metadata: "
             f"operator_aliases={len(legacy_operator_aliases)}, trusted_domains={len(trusted)}."