nexo-brain 7.30.11 → 7.30.12

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.11",
+  "version": "7.30.12",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.11` is the current packaged-runtime line. Patch release over v7.30.10 - the installer and npm postinstall path now stamp the verified repair baseline too, so the first update from older packaged installs is covered without a manual second run.
+Version `7.30.12` is the current packaged-runtime line. Patch release over v7.30.11 - Desktop-managed email credentials now resolve through the shared credential helper, so Email NEXO migrations and CLI reads use keychain-backed markers before legacy SQLite fallback.
+
+Previously in `7.30.11`: patch release over v7.30.10 - the installer and npm postinstall path now stamp the verified repair baseline too, so the first update from older packaged installs is covered without a manual second run.
 
 Previously in `7.30.10`: patch release over v7.30.9 - packaged `nexo update` now stamps the verified repair baseline after import verification, including same-version maintenance runs.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.11",
+  "version": "7.30.12",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/cli_email.py

@@ -21,7 +21,6 @@ from __future__ import annotations
 import getpass
 import json
 import sys
-import time
 from typing import Any
 
 
@@ -74,30 +73,16 @@ def _sent_folder_from_account(account: dict | None) -> str:
 
 
 def _store_credential(service: str, key: str, value: str) -> None:
-    """Write password to the `credentials` table (simple cleartext by
-    default — upgrading to keychain is a v7 follow-up). Never echo the
-    password back to stdout."""
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'email account password (nexo email setup)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value,
-            updated_at = excluded.updated_at
-        """,
-        (service, key, value, now, now),
-    )
-    conn.commit()
+    """Write password without echoing it back to stdout."""
+    from email_credentials import store_email_credential
+
+    store_email_credential(service, key, value, "email account password (nexo email setup)")
 
 
 def _delete_credential(service: str, key: str) -> None:
-    from db._core import get_db
-    conn = get_db()
-    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
-    conn.commit()
+    from email_credentials import delete_email_credential
+
+    delete_email_credential(service, key)
 
 
 def cmd_email_setup(args) -> int:

package/src/email_config.py

@@ -41,24 +41,11 @@ LEGACY_CONFIG_PATH = _legacy_config_path()
 
 
 def _get_credential(service: str, key: str) -> str:
-    """Fetch a password from the credentials table. Returns empty string
-    on any miss so the caller can log-and-skip instead of crashing a cron.
-    """
-    if not service or not key:
-        return ""
+    """Fetch a password from keyring marker or legacy credentials table."""
     try:
-        from db._core import get_db
-    except Exception:  # pragma: no cover
-        return ""
-    try:
-        conn = get_db()
-        row = conn.execute(
-            "SELECT value FROM credentials WHERE service = ? AND key = ?",
-            (service, key),
-        ).fetchone()
-        if row is None:
-            return ""
-        return str(row[0] or "")
+        from email_credentials import read_email_credential
+
+        return read_email_credential(service, key)
     except Exception as exc:  # pragma: no cover
         _logger.warning("credential lookup failed for %s/%s: %s", service, key, exc)
         return ""

package/src/email_credentials.py

@@ -0,0 +1,159 @@
+"""Credential storage for email account passwords.
+
+Email account rows keep only ``credential_service`` + ``credential_key``.
+Historically the referenced ``credentials.value`` column stored the password
+directly. New writes try to place the secret in the OS keyring and keep a
+``keyring://...`` marker in SQLite. Legacy plaintext values remain readable so
+older installs keep working until they are rotated or migrated.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+import time
+from urllib.parse import quote, unquote
+
+KEYRING_SERVICE = "com.nexo.email"
+KEYRING_MARKER_PREFIX = "keyring://"
+
+
+def _db():
+    from db._core import get_db
+
+    return get_db()
+
+
+def _marker(service: str, key: str) -> str:
+    return f"{KEYRING_MARKER_PREFIX}{quote(service, safe='')}/{quote(key, safe='')}"
+
+
+def _parse_marker(value: str) -> tuple[str, str] | None:
+    if not value.startswith(KEYRING_MARKER_PREFIX):
+        return None
+    rest = value[len(KEYRING_MARKER_PREFIX):]
+    if "/" not in rest:
+        return None
+    service, key = rest.split("/", 1)
+    return unquote(service), unquote(key)
+
+
+def _account_name(service: str, key: str) -> str:
+    return f"{service}:{key}"
+
+
+def _keyring_module():
+    try:
+        return importlib.import_module("keyring")
+    except Exception:
+        return None
+
+
+def _read_stored_value(service: str, key: str) -> str:
+    if not service or not key:
+        return ""
+    row = _db().execute(
+        "SELECT value FROM credentials WHERE service = ? AND key = ?",
+        (service, key),
+    ).fetchone()
+    if row is None:
+        return ""
+    return str(row[0] or "")
+
+
+def _write_db_value(service: str, key: str, value: str, notes: str) -> None:
+    conn = _db()
+    now = time.time()
+    conn.execute(
+        """
+        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(service, key) DO UPDATE SET
+            value = excluded.value,
+            notes = excluded.notes,
+            updated_at = excluded.updated_at
+        """,
+        (service, key, value, notes, now, now),
+    )
+    conn.commit()
+
+
+def store_email_credential(service: str, key: str, value: str, notes: str = "email account password") -> str:
+    """Store an email password and return the SQLite value written.
+
+    Uses keyring when available. If the keyring backend is unavailable or
+    locked, the legacy SQLite plaintext path is used so existing automation
+    does not lose email access.
+    """
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    value = str(value or "")
+    if not service or not key:
+        return ""
+
+    mode = os.environ.get("NEXO_EMAIL_CREDENTIAL_STORE", "auto").strip().lower()
+    keyring = None if mode in {"sqlite", "legacy", "plain", "plaintext"} else _keyring_module()
+    if keyring is not None:
+        try:
+            keyring.set_password(KEYRING_SERVICE, _account_name(service, key), value)
+            stored = _marker(service, key)
+            _write_db_value(service, key, stored, notes + " (stored in system keyring)")
+            return stored
+        except Exception:
+            pass
+
+    if mode == "keyring":
+        return ""
+
+    _write_db_value(service, key, value, notes + " (legacy sqlite fallback)")
+    return value
+
+
+def read_email_credential(service: str, key: str) -> str:
+    """Resolve an email password from keyring marker or legacy plaintext."""
+    stored = _read_stored_value(str(service or "").strip(), str(key or "").strip())
+    parsed = _parse_marker(stored)
+    if parsed is None:
+        return stored
+
+    keyring = _keyring_module()
+    if keyring is None:
+        return ""
+    try:
+        value = keyring.get_password(KEYRING_SERVICE, _account_name(*parsed))
+    except Exception:
+        return ""
+    return str(value or "")
+
+
+def delete_email_credential(service: str, key: str) -> None:
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    if not service or not key:
+        return
+
+    parsed = _parse_marker(_read_stored_value(service, key))
+    keyring = _keyring_module()
+    if parsed is not None and keyring is not None:
+        try:
+            keyring.delete_password(KEYRING_SERVICE, _account_name(*parsed))
+        except Exception:
+            pass
+
+    conn = _db()
+    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
+    conn.commit()
+
+
+def is_keyring_marker(value: str) -> bool:
+    return _parse_marker(str(value or "")) is not None
+
+
+__all__ = [
+    "KEYRING_MARKER_PREFIX",
+    "KEYRING_SERVICE",
+    "delete_email_credential",
+    "is_keyring_marker",
+    "read_email_credential",
+    "store_email_credential",
+]

package/src/scripts/nexo-email-migrate-config.py

@@ -26,7 +26,6 @@ import json
 import os
 import re
 import sys
-import time
 from pathlib import Path
 
 
@@ -121,20 +120,14 @@ def main(argv: list[str]) -> int:
         print(f"[dry-run] credentials[{cred_service}/{cred_key}] = <password>")
         return 0
 
-    # Store credential
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'migrated from ~/.nexo/nexo-email/config.json (F1)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value, updated_at = excluded.updated_at
-        """,
-        (cred_service, cred_key, password, now, now),
+    from email_credentials import store_email_credential
+
+    store_email_credential(
+        cred_service,
+        cred_key,
+        password,
+        "migrated from ~/.nexo/nexo-email/config.json (F1)",
     )
-    conn.commit()
 
     if existing and not args.force:
         existing_metadata = existing.get("metadata") if isinstance(existing.get("metadata"), dict) else {}
@@ -194,7 +187,7 @@ def main(argv: list[str]) -> int:
             can_send=True,
         )
         print(f"✓ Cuenta agente '{args.label}' migrada ({account.get('email')}).")
-        print(f"  Password guardada en credentials[{cred_service}/{cred_key}].")
+        print(f"  Password guardada en el almacen de credenciales[{cred_service}/{cred_key}].")
         print(
             "  Metadata: "
             f"operator_aliases={len(legacy_operator_aliases)}, trusted_domains={len(trusted)}."