nexo-brain 7.30.11 → 7.30.14

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.11",
+  "version": "7.30.14",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,13 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.11` is the current packaged-runtime line. Patch release over v7.30.10 - the installer and npm postinstall path now stamp the verified repair baseline too, so the first update from older packaged installs is covered without a manual second run.
+Version `7.30.14` is the current packaged-runtime line. Patch release over v7.30.13 - support tickets, provider capability discovery, task-close rearming, internal audit followups, and the memory-observation watchdog are aligned for Desktop-managed agents.
+
+Previously in `7.30.13`: patch release over v7.30.12 - Email NEXO monitor prompts now require a full IMAP body fetch before replying, and managed email defaults use the MXroute `Sent` folder instead of `INBOX.Sent`.
+
+Previously in `7.30.12`: patch release over v7.30.11 - Desktop-managed email credentials now resolve through the shared credential helper, so Email NEXO migrations and CLI reads use keychain-backed markers before legacy SQLite fallback.
+
+Previously in `7.30.11`: patch release over v7.30.10 - the installer and npm postinstall path now stamp the verified repair baseline too, so the first update from older packaged installs is covered without a manual second run.
 
 Previously in `7.30.10`: patch release over v7.30.9 - packaged `nexo update` now stamps the verified repair baseline after import verification, including same-version maintenance runs.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.11",
+  "version": "7.30.14",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/cli_email.py

@@ -21,7 +21,6 @@ from __future__ import annotations
 import getpass
 import json
 import sys
-import time
 from typing import Any
 
 
@@ -70,34 +69,20 @@ def _sent_folder_from_account(account: dict | None) -> str:
     if isinstance(account, dict) and isinstance(account.get("metadata"), dict):
         metadata = account.get("metadata") or {}
     value = str(metadata.get("sent_folder") or "").strip()
-    return value or "INBOX.Sent"
+    return value or "Sent"
 
 
 def _store_credential(service: str, key: str, value: str) -> None:
-    """Write password to the `credentials` table (simple cleartext by
-    default — upgrading to keychain is a v7 follow-up). Never echo the
-    password back to stdout."""
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'email account password (nexo email setup)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value,
-            updated_at = excluded.updated_at
-        """,
-        (service, key, value, now, now),
-    )
-    conn.commit()
+    """Write password without echoing it back to stdout."""
+    from email_credentials import store_email_credential
+
+    store_email_credential(service, key, value, "email account password (nexo email setup)")
 
 
 def _delete_credential(service: str, key: str) -> None:
-    from db._core import get_db
-    conn = get_db()
-    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
-    conn.commit()
+    from email_credentials import delete_email_credential
+
+    delete_email_credential(service, key)
 
 
 def cmd_email_setup(args) -> int:
@@ -154,7 +139,7 @@ def cmd_email_setup(args) -> int:
         "",
     )
     trusted = [d.strip() for d in trusted_raw.split(",") if d.strip()]
-    sent_folder = _prompt("IMAP sent folder", "INBOX.Sent").strip() or "INBOX.Sent"
+    sent_folder = _prompt("IMAP sent folder", "Sent").strip() or "Sent"
 
     role = _prompt(
         "Account role: inbox (read only) / outbox (send only) / both",
@@ -727,7 +712,7 @@ def register_email_parser(subparsers) -> None:
     s.add_argument("--operator", dest="operator", default="")
     s.add_argument("--trusted-domains", dest="trusted_domains", default="")
     s.add_argument("--sent-folder", dest="sent_folder", default=None,
-                   help="IMAP folder where sent copies should be appended (default: INBOX.Sent).")
+                   help="IMAP folder where sent copies should be appended (default: Sent).")
     s.add_argument("--role", dest="role", default="both", choices=["inbox", "outbox", "both"])
     read_group = s.add_mutually_exclusive_group()
     read_group.add_argument("--can-read", dest="can_read", action="store_true", default=None)

package/src/crons/manifest.json

@@ -328,6 +328,20 @@
       "run_on_boot": true,
       "run_on_wake": true
     },
+    {
+      "id": "memory-observation-watchdog",
+      "script": "scripts/nexo-memory-observation-watchdog.py",
+      "interval_seconds": 900,
+      "description": "Keep Memory Observations v2 queue convergent and repair stale/missed observation rows",
+      "core": true,
+      "optional": "automation",
+      "recovery_policy": "catchup",
+      "idempotent": true,
+      "max_catchup_age": 7200,
+      "stuck_after_seconds": 600,
+      "run_on_boot": true,
+      "run_on_wake": true
+    },
     {
       "id": "email-monitor",
       "script": "scripts/nexo-email-monitor.py",

package/src/email_config.py

@@ -41,24 +41,11 @@ LEGACY_CONFIG_PATH = _legacy_config_path()
 
 
 def _get_credential(service: str, key: str) -> str:
-    """Fetch a password from the credentials table. Returns empty string
-    on any miss so the caller can log-and-skip instead of crashing a cron.
-    """
-    if not service or not key:
-        return ""
+    """Fetch a password from keyring marker or legacy credentials table."""
     try:
-        from db._core import get_db
-    except Exception:  # pragma: no cover
-        return ""
-    try:
-        conn = get_db()
-        row = conn.execute(
-            "SELECT value FROM credentials WHERE service = ? AND key = ?",
-            (service, key),
-        ).fetchone()
-        if row is None:
-            return ""
-        return str(row[0] or "")
+        from email_credentials import read_email_credential
+
+        return read_email_credential(service, key)
     except Exception as exc:  # pragma: no cover
         _logger.warning("credential lookup failed for %s/%s: %s", service, key, exc)
         return ""
@@ -70,7 +57,7 @@ def _account_to_runtime_account(account: dict) -> dict:
         account.get("credential_key", ""),
     )
     metadata = account.get("metadata") if isinstance(account.get("metadata"), dict) else {}
-    sent_folder = str(metadata.get("sent_folder") or "").strip() or "INBOX.Sent"
+    sent_folder = str(metadata.get("sent_folder") or "").strip() or "Sent"
     return {
         "label": account.get("label", ""),
         "email": account.get("email", ""),

package/src/email_credentials.py

@@ -0,0 +1,159 @@
+"""Credential storage for email account passwords.
+
+Email account rows keep only ``credential_service`` + ``credential_key``.
+Historically the referenced ``credentials.value`` column stored the password
+directly. New writes try to place the secret in the OS keyring and keep a
+``keyring://...`` marker in SQLite. Legacy plaintext values remain readable so
+older installs keep working until they are rotated or migrated.
+"""
+
+from __future__ import annotations
+
+import importlib
+import os
+import time
+from urllib.parse import quote, unquote
+
+KEYRING_SERVICE = "com.nexo.email"
+KEYRING_MARKER_PREFIX = "keyring://"
+
+
+def _db():
+    from db._core import get_db
+
+    return get_db()
+
+
+def _marker(service: str, key: str) -> str:
+    return f"{KEYRING_MARKER_PREFIX}{quote(service, safe='')}/{quote(key, safe='')}"
+
+
+def _parse_marker(value: str) -> tuple[str, str] | None:
+    if not value.startswith(KEYRING_MARKER_PREFIX):
+        return None
+    rest = value[len(KEYRING_MARKER_PREFIX):]
+    if "/" not in rest:
+        return None
+    service, key = rest.split("/", 1)
+    return unquote(service), unquote(key)
+
+
+def _account_name(service: str, key: str) -> str:
+    return f"{service}:{key}"
+
+
+def _keyring_module():
+    try:
+        return importlib.import_module("keyring")
+    except Exception:
+        return None
+
+
+def _read_stored_value(service: str, key: str) -> str:
+    if not service or not key:
+        return ""
+    row = _db().execute(
+        "SELECT value FROM credentials WHERE service = ? AND key = ?",
+        (service, key),
+    ).fetchone()
+    if row is None:
+        return ""
+    return str(row[0] or "")
+
+
+def _write_db_value(service: str, key: str, value: str, notes: str) -> None:
+    conn = _db()
+    now = time.time()
+    conn.execute(
+        """
+        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+        ON CONFLICT(service, key) DO UPDATE SET
+            value = excluded.value,
+            notes = excluded.notes,
+            updated_at = excluded.updated_at
+        """,
+        (service, key, value, notes, now, now),
+    )
+    conn.commit()
+
+
+def store_email_credential(service: str, key: str, value: str, notes: str = "email account password") -> str:
+    """Store an email password and return the SQLite value written.
+
+    Uses keyring when available. If the keyring backend is unavailable or
+    locked, the legacy SQLite plaintext path is used so existing automation
+    does not lose email access.
+    """
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    value = str(value or "")
+    if not service or not key:
+        return ""
+
+    mode = os.environ.get("NEXO_EMAIL_CREDENTIAL_STORE", "auto").strip().lower()
+    keyring = None if mode in {"sqlite", "legacy", "plain", "plaintext"} else _keyring_module()
+    if keyring is not None:
+        try:
+            keyring.set_password(KEYRING_SERVICE, _account_name(service, key), value)
+            stored = _marker(service, key)
+            _write_db_value(service, key, stored, notes + " (stored in system keyring)")
+            return stored
+        except Exception:
+            pass
+
+    if mode == "keyring":
+        return ""
+
+    _write_db_value(service, key, value, notes + " (legacy sqlite fallback)")
+    return value
+
+
+def read_email_credential(service: str, key: str) -> str:
+    """Resolve an email password from keyring marker or legacy plaintext."""
+    stored = _read_stored_value(str(service or "").strip(), str(key or "").strip())
+    parsed = _parse_marker(stored)
+    if parsed is None:
+        return stored
+
+    keyring = _keyring_module()
+    if keyring is None:
+        return ""
+    try:
+        value = keyring.get_password(KEYRING_SERVICE, _account_name(*parsed))
+    except Exception:
+        return ""
+    return str(value or "")
+
+
+def delete_email_credential(service: str, key: str) -> None:
+    service = str(service or "").strip()
+    key = str(key or "").strip()
+    if not service or not key:
+        return
+
+    parsed = _parse_marker(_read_stored_value(service, key))
+    keyring = _keyring_module()
+    if parsed is not None and keyring is not None:
+        try:
+            keyring.delete_password(KEYRING_SERVICE, _account_name(*parsed))
+        except Exception:
+            pass
+
+    conn = _db()
+    conn.execute("DELETE FROM credentials WHERE service = ? AND key = ?", (service, key))
+    conn.commit()
+
+
+def is_keyring_marker(value: str) -> bool:
+    return _parse_marker(str(value or "")) is not None
+
+
+__all__ = [
+    "KEYRING_MARKER_PREFIX",
+    "KEYRING_SERVICE",
+    "delete_email_credential",
+    "is_keyring_marker",
+    "read_email_credential",
+    "store_email_credential",
+]

package/src/enforcement_engine.py

@@ -475,6 +475,7 @@ class HeadlessEnforcer:
         # per task cycle. Cleared on skill_match OR task_close.
         self._multi_step_event_fired: bool = False
         self._post_close_cooldown_until: float = 0.0
+        self._last_task_close_user_message_count: int = -1
         # A headless nexo_stop is terminal for the automation cycle. Once
         # seen, periodic/conditional reminders stay suppressed so cron
         # runners can reach TURN_END instead of reopening the task loop.
@@ -2287,6 +2288,7 @@ class HeadlessEnforcer:
         # v7.6 task_close observed → rearm conditional for the companion
         # open tool so the next task cycle re-opens the obligation.
         if name == "nexo_task_close":
+            self._last_task_close_user_message_count = int(self.user_message_count or 0)
             self.reset_task_cycle("nexo_task_open")
             self._start_post_close_cooldown()
             self._resolve_r17_commitments_from_task_close(tool_input)
@@ -2522,6 +2524,17 @@ class HeadlessEnforcer:
         the recent tool mix shows edit/execute/delegate signals (Edit,
         Write, Bash with mutation commands, Task dispatch).
         """
+        if getattr(self, "_session_stopped", False):
+            return
+        if self._post_close_cooldown_active():
+            return
+        # A closed task cycle must not re-open itself on idle/background
+        # ticks. Rearm only after a new visible user message advances the
+        # turn counter.
+        last_close_raw = getattr(self, "_last_task_close_user_message_count", -1)
+        last_close_count = int(last_close_raw) if last_close_raw is not None else -1
+        if last_close_count >= 0 and int(self.user_message_count or 0) <= last_close_count:
+            return
         for entry in self._conditional:
             tool = entry["tool"]
             rule = entry.get("rule", {})

package/src/retroactive_learnings.py

@@ -321,6 +321,10 @@ def apply_learning_retroactively(
     created = 0
     now_epoch = datetime.now().timestamp()
     summary_matches = []
+    try:
+        followup_columns = {row["name"] for row in conn.execute("PRAGMA table_info(followups)").fetchall()}
+    except Exception:
+        followup_columns = set()
     for m in capped:
         decision = m["decision"]
         followup_id = f"NF-RETRO-L{learning['id']}-D{decision['id']}"
@@ -334,18 +338,36 @@ def apply_learning_retroactively(
             f"SELECT id, domain, decision, based_on, status FROM decisions WHERE id = {int(decision['id'])}"
         )
         try:
+            insert_columns = [
+                "id",
+                "description",
+                "date",
+                "status",
+                "verification",
+                "created_at",
+                "updated_at",
+                "priority",
+            ]
+            values = [
+                followup_id,
+                description,
+                None,
+                "PENDING",
+                verification,
+                now_epoch,
+                now_epoch,
+                learning.get("priority") or "medium",
+            ]
+            if "internal" in followup_columns:
+                insert_columns.append("internal")
+                values.append(1)
+            if "owner" in followup_columns:
+                insert_columns.append("owner")
+                values.append("agent")
+            placeholders = ", ".join("?" for _ in insert_columns)
             conn.execute(
-                "INSERT OR REPLACE INTO followups (id, description, date, status, "
-                "verification, created_at, updated_at, priority) "
-                "VALUES (?, ?, NULL, 'PENDING', ?, ?, ?, ?)",
-                (
-                    followup_id,
-                    description,
-                    verification,
-                    now_epoch,
-                    now_epoch,
-                    learning.get("priority") or "medium",
-                ),
+                f"INSERT OR REPLACE INTO followups ({', '.join(insert_columns)}) VALUES ({placeholders})",
+                tuple(values),
             )
             created += 1
             summary_matches.append({

package/src/scripts/nexo-daily-self-audit.py

@@ -271,7 +271,8 @@ def _ensure_protocol_debt(conn: sqlite3.Connection, *, debt_type: str, severity:
 
 
 def _ensure_followup(conn: sqlite3.Connection, *, prefix: str, description: str,
-                     verification: str, reasoning: str, priority: str = "high") -> str:
+                     verification: str, reasoning: str, priority: str = "high",
+                     internal: int = 1, owner: str = "agent") -> str:
     if not _table_exists(conn, "followups"):
         return ""
     # Content fingerprint, not security-sensitive.
@@ -300,6 +301,10 @@ def _ensure_followup(conn: sqlite3.Connection, *, prefix: str, description: str,
         }
         if "priority" in columns:
             update_fields["priority"] = priority
+        if "internal" in columns:
+            update_fields["internal"] = int(bool(internal))
+        if "owner" in columns:
+            update_fields["owner"] = owner
         closed_status = str(existing_id_row["status"] or "").upper()
         if closed_status.startswith("COMPLETED") or closed_status in {"DELETED", "ARCHIVED", "BLOCKED", "WAITING"}:
             update_fields["status"] = "PENDING"
@@ -324,6 +329,8 @@ def _ensure_followup(conn: sqlite3.Connection, *, prefix: str, description: str,
         reasoning=reasoning,
         recurrence=None,
         priority=priority,
+        internal=internal,
+        owner=owner,
     )
     if result.get("error"):
         return ""
@@ -985,6 +992,30 @@ def check_db_size():
         size_mb = NEXO_DB.stat().st_size / (1024 * 1024)
         if size_mb > 100:
             finding("WARN", "database", f"nexo.db is {size_mb:.1f} MB — consider cleanup")
+    # Guard against runaway growth of the local context index. Root cause of the
+    # 2026-06-03 disk burst: local-context.db reached 268 GB unseen because the
+    # only DB checked here was nexo.db (learning #824). Surface oversized runtime
+    # DBs early — well before the total-disk WARN@80% / FAIL would trip.
+    try:
+        import paths as paths_module
+
+        local_ctx = paths_module.memory_dir() / "local-context.db"
+        if local_ctx.exists():
+            size_gb = local_ctx.stat().st_size / (1024 ** 3)
+            if size_gb > 60:
+                finding(
+                    "ERROR",
+                    "database",
+                    f"local-context.db is {size_gb:.1f} GB — local index runaway; purge + VACUUM (see roots/exclusions)",
+                )
+            elif size_gb > 25:
+                finding(
+                    "WARN",
+                    "database",
+                    f"local-context.db is {size_gb:.1f} GB — local index growing; review indexed roots/exclusions",
+                )
+    except Exception as exc:
+        finding("WARN", "database", f"Could not check local-context.db size: {exc}")
 
 
 def check_stale_sessions():
@@ -1821,8 +1852,14 @@ def check_cognitive_health():
         if metrics["total_retrievals"] > 0:
             finding("INFO", "cognitive-metrics",
                     f"7d: {metrics['total_retrievals']} retrievals, relevance={metrics['retrieval_relevance_pct']}%")
-            if metrics["retrieval_relevance_pct"] < 50 and metrics["total_retrievals"] >= 5:
+            if metrics["retrieval_relevance_pct"] < 50 and metrics["total_retrievals"] >= 30:
                 finding("ERROR", "cognitive-metrics", f"Relevance critically low: {metrics['retrieval_relevance_pct']}%")
+            elif metrics["retrieval_relevance_pct"] < 50 and metrics["total_retrievals"] < 30:
+                finding(
+                    "INFO",
+                    "cognitive-metrics",
+                    f"Relevance below 50% but sample is low ({metrics['total_retrievals']} retrievals)",
+                )
 
         repeats = cog.check_repeat_errors()
         if repeats["new_count"] > 0 and repeats["repeat_rate_pct"] > 30:

package/src/scripts/nexo-email-migrate-config.py

@@ -26,7 +26,6 @@ import json
 import os
 import re
 import sys
-import time
 from pathlib import Path
 
 
@@ -107,7 +106,7 @@ def main(argv: list[str]) -> int:
         "claude_binary": legacy.get("claude_binary", ""),
         "working_dir": legacy.get("working_dir", str(Path.home())),
         "max_process_time": legacy.get("max_process_time"),
-        "sent_folder": legacy.get("sent_folder", "INBOX.Sent"),
+        "sent_folder": legacy.get("sent_folder", "Sent"),
         "operator_aliases": legacy_operator_aliases,
     }
 
@@ -121,20 +120,14 @@ def main(argv: list[str]) -> int:
         print(f"[dry-run] credentials[{cred_service}/{cred_key}] = <password>")
         return 0
 
-    # Store credential
-    from db._core import get_db
-    conn = get_db()
-    now = time.time()
-    conn.execute(
-        """
-        INSERT INTO credentials (service, key, value, notes, created_at, updated_at)
-        VALUES (?, ?, ?, 'migrated from ~/.nexo/nexo-email/config.json (F1)', ?, ?)
-        ON CONFLICT(service, key) DO UPDATE SET
-            value = excluded.value, updated_at = excluded.updated_at
-        """,
-        (cred_service, cred_key, password, now, now),
+    from email_credentials import store_email_credential
+
+    store_email_credential(
+        cred_service,
+        cred_key,
+        password,
+        "migrated from ~/.nexo/nexo-email/config.json (F1)",
     )
-    conn.commit()
 
     if existing and not args.force:
         existing_metadata = existing.get("metadata") if isinstance(existing.get("metadata"), dict) else {}
@@ -147,7 +140,7 @@ def main(argv: list[str]) -> int:
             **metadata,
             **existing_metadata,
             "operator_aliases": merged_aliases,
-            "sent_folder": str(existing_metadata.get("sent_folder") or metadata.get("sent_folder") or "INBOX.Sent"),
+            "sent_folder": str(existing_metadata.get("sent_folder") or metadata.get("sent_folder") or "Sent"),
         }
         normalized_role = str(existing.get("role") or "both")
         account = add_email_account(
@@ -194,7 +187,7 @@ def main(argv: list[str]) -> int:
             can_send=True,
         )
         print(f"✓ Cuenta agente '{args.label}' migrada ({account.get('email')}).")
-        print(f"  Password guardada en credentials[{cred_service}/{cred_key}].")
+        print(f"  Password guardada en el almacen de credenciales[{cred_service}/{cred_key}].")
         print(
             "  Metadata: "
             f"operator_aliases={len(legacy_operator_aliases)}, trusted_domains={len(trusted)}."

package/src/scripts/nexo-email-monitor.py

@@ -1172,7 +1172,7 @@ def count_stuck_emails():
 
 # === Email-loss prevention (2026-04-14): pre-register + orphan recovery ===
 # Problem: if headless NEXO dies before marking email in BD, IMAP may have it
-# marked SEEN (from nexo_email_read) but BD has no row. count_stuck_emails
+# marked SEEN (from an IMAP full-message read) but BD has no row. count_stuck_emails
 # cannot see it, and has_new_email returns 0. The email is lost.
 # Fix:
 #   1. Pre-register: INSERT status='pending' rows BEFORE launching NEXO, using

package/src/scripts/nexo-memory-observation-watchdog.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+# nexo: name=memory-observation-watchdog
+# nexo: description=Keep Memory Observations v2 queue convergent without user-visible followups.
+# nexo: category=memory
+# nexo: runtime=python
+# nexo: timeout=600
+# nexo: cron_id=memory-observation-watchdog
+# nexo: interval_seconds=900
+# nexo: schedule_required=true
+# nexo: recovery_policy=catchup
+# nexo: run_on_boot=true
+# nexo: run_on_wake=true
+# nexo: idempotent=true
+# nexo: max_catchup_age=7200
+# nexo: stuck_after_seconds=600
+# nexo: doctor_allow_db=true
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime
+from pathlib import Path
+
+
+def _bootstrap_nexo_code(default_repo_src: Path) -> Path:
+    nexo_home = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
+    raw_env = os.environ.get("NEXO_CODE", "")
+    candidates: list[Path] = []
+    if raw_env:
+        raw = Path(raw_env).expanduser()
+        candidates.extend([raw, raw / "core"])
+    candidates.extend([default_repo_src, nexo_home / "core", nexo_home])
+    seen: set[str] = set()
+    for candidate in candidates:
+        key = str(candidate)
+        if key in seen:
+            continue
+        seen.add(key)
+        if (candidate / "paths.py").is_file() or (candidate / "server.py").is_file():
+            if str(candidate) not in sys.path:
+                sys.path.insert(0, str(candidate))
+            return candidate
+    fallback = candidates[0]
+    if str(fallback) not in sys.path:
+        sys.path.insert(0, str(fallback))
+    return fallback
+
+
+_SCRIPT_DIR = Path(__file__).resolve().parent
+NEXO_CODE = _bootstrap_nexo_code(_SCRIPT_DIR.parent)
+
+from paths import logs_dir, operations_dir  # noqa: E402
+from memory_observation_processor import process_incremental, queue_health  # noqa: E402
+
+
+LOG_FILE = logs_dir() / "memory-observation-watchdog.log"
+SUMMARY_FILE = operations_dir() / "memory-observation-watchdog-latest.json"
+DEFAULT_SLA_SECONDS = int(os.environ.get("NEXO_MEMORY_OBSERVATION_SLA_SECONDS", "3600") or "3600")
+DEFAULT_PROCESS_LIMIT = int(os.environ.get("NEXO_MEMORY_OBSERVATION_PROCESS_LIMIT", "100") or "100")
+DEFAULT_BACKFILL_LIMIT = int(os.environ.get("NEXO_MEMORY_OBSERVATION_BACKFILL_LIMIT", "100") or "100")
+
+
+def log(message: str) -> None:
+    ts = datetime.now().isoformat(timespec="seconds")
+    line = f"[{ts}] {message}"
+    print(line, flush=True)
+    LOG_FILE.parent.mkdir(parents=True, exist_ok=True)
+    with LOG_FILE.open("a", encoding="utf-8") as handle:
+        handle.write(line + "\n")
+
+
+def write_summary(payload: dict) -> None:
+    SUMMARY_FILE.parent.mkdir(parents=True, exist_ok=True)
+    tmp = SUMMARY_FILE.with_suffix(SUMMARY_FILE.suffix + ".tmp")
+    tmp.write_text(json.dumps(payload, ensure_ascii=True, indent=2, sort_keys=True), encoding="utf-8")
+    tmp.replace(SUMMARY_FILE)
+
+
+def should_process(health: dict) -> bool:
+    if not health.get("ok", False):
+        return False
+    if bool(health.get("skipped", False)):
+        return False
+    return bool(
+        not health.get("healthy", True)
+        or int(health.get("pending", 0) or 0) > 0
+        or int(health.get("unqueued_events", 0) or 0) > 0
+        or int(health.get("processed_missing_observations", 0) or 0) > 0
+    )
+
+
+def main() -> int:
+    log("=== Memory Observation Watchdog starting ===")
+    health = queue_health(pending_sla_seconds=DEFAULT_SLA_SECONDS)
+    payload: dict = {
+        "ok": bool(health.get("ok", True)),
+        "processed": False,
+        "health_before": health,
+        "timestamp": datetime.now().isoformat(timespec="seconds"),
+    }
+
+    if should_process(health):
+        result = process_incremental(
+            process_limit=DEFAULT_PROCESS_LIMIT,
+            backfill_limit=DEFAULT_BACKFILL_LIMIT,
+            pending_sla_seconds=DEFAULT_SLA_SECONDS,
+        )
+        payload.update({"processed": True, "result": result})
+        log(
+            "Processed queue: "
+            f"backfill={result.get('backfill', {}).get('enqueued', 0)} "
+            f"processed={result.get('processed', {}).get('processed', 0)} "
+            f"healthy={result.get('healthy', True)}"
+        )
+    else:
+        log("Queue healthy or unavailable; no processing needed.")
+
+    write_summary(payload)
+    return 0 if payload.get("ok", True) else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/src/scripts/nexo-send-reply.py

@@ -445,7 +445,7 @@ def save_to_sent(config, raw_message: bytes, folder: str = ""):
     imap_host = str((config or {}).get("imap_host") or "").strip()
     if not imap_host or not str((config or {}).get("password") or ""):
         return False
-    resolved_folder = str(folder or config.get("sent_folder") or "INBOX.Sent").strip() or "INBOX.Sent"
+    resolved_folder = str(folder or config.get("sent_folder") or "Sent").strip() or "Sent"
     client = imaplib.IMAP4_SSL(imap_host, int(config.get("imap_port") or 993))
     try:
         client.login(config["email"], config["password"])

package/src/server.py

@@ -120,7 +120,13 @@ from plugins.workflow import (
 )
 from plugin_loader import load_all_plugins, load_plugin, remove_plugin, list_plugins
 from tools_guardian import handle_guardian_rule_override
-from tools_api_call import handle_api_call, handle_create_app_token
+from tools_api_call import (
+    handle_api_call,
+    handle_create_app_token,
+    handle_support_ticket_create,
+    handle_support_ticket_list,
+    handle_support_ticket_read,
+)
 from runtime_versioning import (
     RestartRequiredMiddleware,
     build_mcp_status,
@@ -2773,6 +2779,28 @@ def nexo_api_call(
     return handle_api_call(method, path, body_json, idempotency_key, headers_json, base_url)
 
 
+@mcp.tool
+def nexo_support_ticket_list(status: str = "", limit: int = 20) -> str:
+    """List real support tickets from the NEXO backend for the signed-in Desktop user.
+
+    Use this when the user asks about support tickets or bug reports. Do not
+    substitute a private followup for an actual product support ticket.
+    """
+    return handle_support_ticket_list(status, limit)
+
+
+@mcp.tool
+def nexo_support_ticket_read(ticket_id: str) -> str:
+    """Read one real support ticket from the NEXO backend by id."""
+    return handle_support_ticket_read(ticket_id)
+
+
+@mcp.tool
+def nexo_support_ticket_create(subject: str, message: str, priority: str = "normal") -> str:
+    """Create a real NEXO support ticket for a product bug/setup issue."""
+    return handle_support_ticket_create(subject, message, priority)
+
+
 @mcp.tool
 def nexo_create_app_token(
     name: str,

package/src/system_catalog.py

@@ -28,6 +28,7 @@ SECTION_ORDER = (
     "skills",
     "scripts",
     "crons",
+    "product_capabilities",
     "projects",
     "artifacts",
 )
@@ -85,6 +86,8 @@ def _tool_category(name: str) -> str:
         return "workflow"
     if name.startswith("nexo_learning"):
         return "learnings"
+    if name.startswith("nexo_support_ticket"):
+        return "support"
     if name.startswith("nexo_guard") or name.startswith("nexo_task") or name.startswith("nexo_cortex"):
         return "protocol"
     return "general"
@@ -610,6 +613,128 @@ def _artifact_entries() -> list[dict]:
     ]
 
 
+def _product_capability_entries() -> list[dict]:
+    """Static product contract map for agent self-discovery.
+
+    These entries are intentionally endpoint-level rather than marketing
+    copy. They let a fresh agent find the real backend surfaces before
+    guessing unsupported workflows.
+    """
+
+    return [
+        {
+            "kind": "product_capability",
+            "name": "nexo_support_tickets_api",
+            "display_name": "NEXO Support Tickets API",
+            "category": "support",
+            "description": "Create, list, read, reply, close and reopen real customer support tickets from Desktop/backend.",
+            "source": "nexo-desktop-web routes/web.php",
+            "endpoints": [
+                "GET /api/support/tickets",
+                "POST /api/support/tickets",
+                "GET /api/support/tickets/{supportTicket}",
+                "POST /api/support/tickets/{supportTicket}/messages",
+                "POST /api/support/tickets/{supportTicket}/close",
+                "POST /api/support/tickets/{supportTicket}/reopen",
+            ],
+            "notes": "Use this for product bug reports instead of creating private followups.",
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_provider_proxy",
+            "display_name": "NEXO Credits Provider Proxy",
+            "category": "credits",
+            "description": "Billable proxy for provider calls. Platforms are discoverable; calls must pass credits, policy and app-token checks.",
+            "source": "nexo-desktop-web ProviderProxyController",
+            "endpoints": [
+                "GET /api/provider-proxy/platforms",
+                "GET /api/provider-proxy/models",
+                "POST /api/provider-proxy/estimate",
+                "POST /api/provider-proxy/call",
+                "GET /api/provider-proxy/requests/{providerRequest}",
+            ],
+            "notes": "Treat declared capabilities separately from invokable model support.",
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_provider_models",
+            "display_name": "Provider Model Discovery",
+            "category": "credits",
+            "description": "Model/capability discovery endpoint for text, image, audio, vision and planned video support.",
+            "source": "nexo-desktop-web ProviderCatalogService",
+            "endpoints": [
+                "GET /api/provider-proxy/models?platform=openrouter",
+                "GET /api/provider-proxy/models?platform=openrouter&capability=video",
+            ],
+            "notes": "If a capability is not invokable, report it as planned/not_invokable instead of promising execution.",
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_credits_cloud",
+            "display_name": "NEXO Credits Managed Cloud",
+            "category": "cloud",
+            "description": "Managed GCloud project provisioning/listing billed through NEXO Credits.",
+            "source": "nexo-desktop-web NexoCloudController",
+            "endpoints": [
+                "GET /api/nexo-cloud/projects",
+                "GET /api/nexo-cloud/sites",
+                "GET /api/nexo-cloud/deployments",
+                "GET /api/credits/cloud",
+                "GET /api/credits/projects",
+                "POST /api/nexo-cloud/provision",
+                "POST /api/nexo-cloud/token",
+                "POST /api/nexo-cloud/grants",
+            ],
+            "notes": "Read/list endpoints are safe discovery; provisioning remains a billable operation with spend limits.",
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_edge_cloudflare",
+            "display_name": "NEXO Edge Cloudflare",
+            "category": "cloud",
+            "description": "Cloudflare zones, domains, DNS, redirects and jobs managed through NEXO Credits.",
+            "source": "nexo-desktop-web NexoEdgeController",
+            "endpoints": [
+                "GET /api/nexo-edge/assets",
+                "POST /api/nexo-edge/domains/check",
+                "POST /api/nexo-edge/domains/register",
+                "POST /api/nexo-edge/dns",
+                "POST /api/nexo-edge/redirects",
+                "GET /api/nexo-edge/jobs/{job}",
+            ],
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_email_managed_agent_mailbox",
+            "display_name": "Email NEXO Managed Agent Mailbox",
+            "category": "email",
+            "description": "One managed IMAP/SMTP mailbox per NEXO license for the user's agent.",
+            "source": "nexo-desktop-web NexoEmailController + Desktop Email preferences",
+            "endpoints": [
+                "GET /api/nexo-email/account",
+                "POST /api/nexo-email/availability",
+                "POST /api/nexo-email/account/ensure",
+                "POST /api/nexo-email/account/connection",
+            ],
+            "notes": "If an account already exists, configure that mailbox; do not ask for a new address.",
+        },
+        {
+            "kind": "product_capability",
+            "name": "nexo_protocol_cards",
+            "display_name": "NEXO Protocol Cards",
+            "category": "workflow",
+            "description": "Official backend-served cards for product workflows and runtime contracts.",
+            "source": "nexo-desktop-web CardCatalogService",
+            "endpoints": [
+                "GET /api/cards/catalog",
+                "POST /api/cards/match",
+                "GET /api/cards/{slug}",
+                "POST /api/cards/{slug}/activate",
+            ],
+        },
+    ]
+
+
 def _locations() -> dict[str, str]:
     """Plan Consolidado 0.X.4 — canonical paths for runtime artefacts.
 
@@ -667,6 +792,7 @@ def build_system_catalog() -> dict:
         "skills": _skill_entries(),
         "scripts": _script_entries(),
         "crons": _cron_entries(),
+        "product_capabilities": _product_capability_entries(),
         "projects": _project_entries(),
         "artifacts": _artifact_entries(),
     }

package/src/tools_api_call.py

@@ -3,6 +3,9 @@
 Exposes two MCP tools registered in server.py:
   - nexo_api_call(method, path, body_json, idempotency_key, headers_json, base_url)
   - nexo_create_app_token(name, abilities, allowed_platforms, expires_at)
+  - nexo_support_ticket_list(status, limit)
+  - nexo_support_ticket_read(ticket_id)
+  - nexo_support_ticket_create(subject, message, priority)
 
 The session bearer (Sanctum personal access token) is stored by NEXO Desktop in
 the OS keychain at:
@@ -24,6 +27,7 @@ from __future__ import annotations
 
 import json
 from typing import Any
+from urllib.parse import quote, urlencode
 
 import keyring
 import requests
@@ -194,3 +198,45 @@ def handle_create_app_token(
         path="/api/auth/app-tokens",
         body_json=json.dumps(payload),
     )
+
+
+def handle_support_ticket_list(status: str = "", limit: int = 20) -> str:
+    """List real NEXO support tickets for the signed-in Desktop user."""
+    query: dict[str, str] = {}
+    clean_status = (status or "").strip()
+    if clean_status:
+        query["status"] = clean_status
+    try:
+        parsed_limit = max(1, min(100, int(limit or 20)))
+    except Exception:
+        parsed_limit = 20
+    query["limit"] = str(parsed_limit)
+    suffix = "?" + urlencode(query) if query else ""
+    return handle_api_call("GET", f"/api/support/tickets{suffix}")
+
+
+def handle_support_ticket_read(ticket_id: str) -> str:
+    """Read one real NEXO support ticket by id for the signed-in Desktop user."""
+    clean = (ticket_id or "").strip()
+    if not clean:
+        return "ERROR: ticket_id is required."
+    return handle_api_call("GET", f"/api/support/tickets/{quote(clean, safe='')}")
+
+
+def handle_support_ticket_create(subject: str, message: str, priority: str = "normal") -> str:
+    """Create a real NEXO support ticket instead of a private/internal followup."""
+    clean_subject = (subject or "").strip()
+    clean_message = (message or "").strip()
+    clean_priority = (priority or "normal").strip().lower()
+    if not clean_subject:
+        return "ERROR: subject is required."
+    if not clean_message:
+        return "ERROR: message is required."
+    if clean_priority not in {"low", "normal", "high", "urgent"}:
+        clean_priority = "normal"
+    payload = {
+        "subject": clean_subject,
+        "message": clean_message,
+        "priority": clean_priority,
+    }
+    return handle_api_call("POST", "/api/support/tickets", body_json=json.dumps(payload, ensure_ascii=False))

package/templates/CLAUDE.md.template

@@ -44,7 +44,7 @@ Claude Code may list `mcp__nexo__*` tools as **deferred** at session start (name
 - Only continue into deeper investigation before the first visible answer if the user explicitly asked for a deep investigation or the situation is urgent/high-risk.
 - For single-artifact asks (email, message, diary item, reminder, prior fact), retrieve the artifact, summarize it, then decide whether further action is needed.
 - For single-artifact asks, the default cap before the first visible answer is one lookup plus one detail read. Do not keep chaining tools before answering unless the user explicitly asked for more depth.
-- After `nexo_email_read`, `nexo_session_diary_read`, `nexo_reminders`, `nexo_followups`, or equivalent single-artifact retrieval, answer immediately. Do not launch another search, another read, or background analysis before the first user-visible answer unless the user explicitly asked for it.
+- After `nexo_session_diary_read`, `nexo_reminders`, `nexo_followups`, or equivalent single-artifact retrieval, answer immediately. Do not launch another search, another read, or background analysis before the first user-visible answer unless the user explicitly asked for it.
 
 ## Communication Guardrail
 - In the first answer to Francisco on any thread, lead with the direct recommendation, decision, or status.

package/templates/CODEX.AGENTS.md.template

@@ -39,7 +39,7 @@ Codex (and Claude Code) may list `mcp__nexo__*` tools as **deferred** at session
 - Only keep investigating before the first visible answer if the user explicitly requested deep investigation or the situation is urgent/high-risk.
 - For single-artifact asks (email, message, diary item, reminder, prior fact), retrieve it, summarize it, then decide if more work is needed.
 - For single-artifact asks, the default cap before the first visible answer is one lookup plus one detail read. Do not keep chaining tools before answering unless the user explicitly asked for more depth.
-- After `nexo_email_read`, `nexo_session_diary_read`, `nexo_reminders`, `nexo_followups`, or equivalent single-artifact retrieval, answer immediately. Do not launch another search, another read, or background analysis before the first visible answer unless the user explicitly asked for it.
+- After `nexo_session_diary_read`, `nexo_reminders`, `nexo_followups`, or equivalent single-artifact retrieval, answer immediately. Do not launch another search, another read, or background analysis before the first visible answer unless the user explicitly asked for it.
 
 ## Communication Guardrail
 - In the first answer to Francisco on any thread, lead with the direct recommendation, decision, or status.

package/templates/core-prompts/email-monitor.md

@@ -60,13 +60,20 @@ This is CRITICAL — without the diary, the next NEXO session loses continuity.
 CONFIG: [[config_path]] (IMAP/SMTP, port, password)
 DATABASE: [[email_db_path]] (SQLite, `emails` table)
 
-1. Connect via IMAP. Detect ALL unread emails in INBOX.
-2. For EACH unread email, ALWAYS use `nexo_email_related(uid, folder='INBOX')`.
-   It is FORBIDDEN to decide using only `nexo_email_read(uid)` or `nexo_email_thread(uid)`.
-   `nexo_email_related` returns the full related context as complete threads
-   (Inbox + Sent), a MERGED TIMELINE in chronological order,
-   and an aggregated index of RELATED FILES with stored local paths.
-   If you only need the clean attachment list, use `nexo_email_attachments(uid, folder='INBOX')`.
+1. Connect via IMAP directly using CONFIG. Detect ALL unread emails in INBOX.
+2. For EACH assigned `message_id`, resolve the matching IMAP UID by fetching headers
+   from INBOX with `BODY.PEEK[HEADER]` and matching the `Message-ID` header exactly.
+   Then fetch the complete RFC822 message with `BODY.PEEK[]` (or equivalent full-message fetch)
+   and parse the body before making any decision.
+   It is FORBIDDEN to decide from the local DB header row alone. The DB row usually contains
+   `message_id`, sender and subject only; it is not the email body.
+   If the full body cannot be fetched or parsed into text, do NOT reply to the sender.
+   Mark the DB row as `error` or `needs_interactive`, add an `email_events` detail explaining
+   the fetch/parse failure, and escalate to the operator if the message cannot be safely handled.
+   If you need attachments, extract them from the fetched RFC822 MIME parts.
+2.5. To rebuild related thread context, use direct IMAP searches in INBOX and Sent based on
+     `Message-ID`, `In-Reply-To`, `References`, subject, and participants. Fetch the full RFC822
+     body for each related message you rely on. Do not use unavailable `nexo_email_*` helpers.
 3. Treat all related messages as ONE operational context.
    If email 1 says 'do X' and email 3 later says 'actually do not do it',
    the LATER instruction wins.
@@ -145,7 +152,7 @@ This guard call must happen before creating or editing the buffer files. Do not
 When replying, the email MUST include the COMPLETE related history below,
 not just the immediate thread.
 Mandatory steps before sending:
-1. Reuse the MERGED TIMELINE from `nexo_email_related(uid)` as the source of truth.
+1. Reuse the MERGED TIMELINE you rebuilt by direct IMAP full-message fetches as the source of truth.
 2. Sort it chronologically (oldest first).
 3. Concatenate it into `/tmp/nexo-thread-UID.txt` with this format for each message:
    -- From: Name <email>

package/tool-enforcement-map.json

@@ -341,6 +341,45 @@
       },
       "triggers_after": []
     },
+    "nexo_support_ticket_create": {
+      "description": "Create a real authenticated NEXO support ticket",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
+    "nexo_support_ticket_list": {
+      "description": "List authenticated NEXO support tickets",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket_list"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
+    "nexo_support_ticket_read": {
+      "description": "Read one authenticated NEXO support ticket by ID",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_artifact_create": {
       "description": "Register artifact (service, dashboard, script)",
       "category": "artifact",