nexo-brain 7.30.20 → 7.30.22

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.20",
+  "version": "7.30.22",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,9 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.20` is the current packaged-runtime line. Patch release over v7.30.19 - packaged installs now copy the `product_knowledge` package into the installed runtime so `nexo update` can import the new product knowledge tools.
+Version `7.30.22` is the current packaged-runtime line. Patch release over v7.30.21 - Brain now ships managed default MCP catalog/lock reconciliation and the Operational Closure Plane, with Desktop v0.43.14 consuming the coordinated runtime contract.
+
+Previously in `7.30.20`: patch release over v7.30.19 - packaged installs now copy the `product_knowledge` package into the installed runtime so `nexo update` can import the new product knowledge tools.
 
 Previously in `7.30.19`: patch release over v7.30.18 - product capabilities now live in a structured, validated catalog with read-only discovery tools and preserved legacy system-catalog names.
 

package/bin/nexo-brain.js

@@ -1346,7 +1346,7 @@ function getCoreRuntimeFlatFiles(srcDir = path.join(__dirname, "..", "src")) {
 }
 
 function getCoreRuntimePackages() {
-  return ["db", "cognitive", "doctor", "local_context", "product_knowledge"];
+  return ["db", "cognitive", "doctor", "local_context", "managed_mcp", "product_knowledge"];
 }
 
 // Brain contracts — files the NEXO Brain publishes to consumers like
@@ -4306,6 +4306,12 @@ async function runSetup() {
   const runtimeCliPath = path.join(NEXO_HOME, "bin", "nexo");
   fs.writeFileSync(runtimeCliPath, runtimeCli);
   fs.chmodSync(runtimeCliPath, 0o755);
+  const managedMcpSource = path.join(__dirname, "nexo-managed-mcp.js");
+  if (fs.existsSync(managedMcpSource)) {
+    const managedMcpTarget = path.join(NEXO_HOME, "bin", "nexo-managed-mcp");
+    fs.copyFileSync(managedMcpSource, managedMcpTarget);
+    fs.chmodSync(managedMcpTarget, 0o755);
+  }
 
   log("Copying core packages...");
   // Core packages (directories with __init__.py)

package/bin/nexo-managed-mcp.js

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const { spawn } = require("child_process");
+
+function nexoHome() {
+  return process.env.NEXO_HOME || path.join(require("os").homedir(), ".nexo");
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch (_) {
+    return null;
+  }
+}
+
+function findEntry(capabilityId) {
+  const state = readJson(path.join(nexoHome(), "runtime", "managed-mcp", "installed-state.json"));
+  const desired = state && state.desired && typeof state.desired === "object" ? state.desired : {};
+  for (const clientEntries of Object.values(desired)) {
+    if (!clientEntries || typeof clientEntries !== "object") continue;
+    for (const entry of Object.values(clientEntries)) {
+      const meta = entry && entry.nexo;
+      if (meta && meta.capability_id === capabilityId) return entry;
+    }
+  }
+  return null;
+}
+
+function disabledList() {
+  return String(process.env.NEXO_MANAGED_MCP_DISABLED_CAPABILITIES || "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function isDisabled(capabilityId) {
+  const global = String(process.env.NEXO_MANAGED_MCP_DISABLE || "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(global)) return true;
+  return disabledList().includes(capabilityId);
+}
+
+function readInstalledState() {
+  return readJson(path.join(nexoHome(), "runtime", "managed-mcp", "installed-state.json")) || {};
+}
+
+function providerEnv() {
+  return {
+    PATH: process.env.PATH || "",
+    HOME: process.env.HOME || "",
+    NEXO_HOME: nexoHome(),
+  };
+}
+
+function stagedProviderCommand(providerId, state) {
+  const providers = state && state.providers && typeof state.providers === "object" ? state.providers : {};
+  const provider = providers[providerId] && typeof providers[providerId] === "object" ? providers[providerId] : {};
+  const explicit = process.platform === "win32"
+    ? (provider.executable_win32 || provider.executable)
+    : provider.executable;
+  if (explicit) return String(explicit);
+  const suffix = process.platform === "win32" ? ".cmd" : "";
+  return path.join(nexoHome(), "runtime", "managed-mcp", "artifacts", providerId, "bin", `${providerId}${suffix}`);
+}
+
+function spawnProvider(command, args, env) {
+  const child = spawn(command, args, {
+    stdio: "inherit",
+    env,
+  });
+  child.on("exit", (code, signal) => {
+    if (signal) process.kill(process.pid, signal);
+    process.exit(typeof code === "number" ? code : 1);
+  });
+  child.on("error", (error) => {
+    console.error(`NEXO managed MCP failed to start: ${error && error.message ? error.message : String(error)}`);
+    process.exit(69);
+  });
+}
+
+function main() {
+  const [command, capabilityId] = process.argv.slice(2);
+  if (command !== "run" || !capabilityId) {
+    console.error("usage: nexo-managed-mcp run <capability_id>");
+    process.exit(64);
+  }
+  if (isDisabled(capabilityId)) {
+    console.error(`NEXO managed MCP capability '${capabilityId}' is disabled by policy.`);
+    process.exit(78);
+  }
+  const state = readInstalledState();
+  const entry = findEntry(capabilityId);
+  const meta = entry && entry.nexo ? entry.nexo : {};
+  const providerId = meta.provider_id || "";
+  if (!providerId) {
+    console.error(`NEXO managed MCP capability '${capabilityId}' is not installed yet.`);
+    process.exit(69);
+  }
+  const providerCommand = stagedProviderCommand(providerId, state);
+  const env = {
+    ...providerEnv(),
+    NEXO_MANAGED_MCP_CAPABILITY: capabilityId,
+    NEXO_MANAGED_MCP_PROVIDER: providerId,
+    NEXO_MANAGED_MCP_RISK: String(meta.risk || ""),
+  };
+  if (!fs.existsSync(providerCommand)) {
+    const providerPackage = String(meta.provider_package || "");
+    const providerVersion = String(meta.provider_version || "");
+    const providerBin = String(meta.provider_bin || providerId);
+    if (String(process.env.NEXO_MANAGED_MCP_ALLOW_NPX_FALLBACK || "").trim() !== "1") {
+      console.error(`NEXO managed MCP provider '${providerId}' is not staged. Run nexo_managed_mcp_status(apply=true) to install managed providers.`);
+      process.exit(69);
+    }
+    if (!providerPackage || !providerVersion || providerVersion === "0.0.0-managed") {
+      console.error(`NEXO managed MCP provider '${providerId}' is not staged and has no exact locked npm package.`);
+      process.exit(69);
+    }
+    const npxBin = process.platform === "win32" ? "npx.cmd" : "npx";
+    spawnProvider(npxBin, ["--yes", "--package", `${providerPackage}@${providerVersion}`, providerBin], env);
+    return;
+  }
+  spawnProvider(providerCommand, [], env);
+}
+
+main();

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.20",
+  "version": "7.30.22",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",
   "bin": {
     "nexo-brain": "bin/nexo-brain.js",
-    "nexo": "bin/nexo.js"
+    "nexo": "bin/nexo.js",
+    "nexo-managed-mcp": "bin/nexo-managed-mcp.js"
   },
   "keywords": [
     "claude-code",
@@ -78,6 +79,7 @@
   "files": [
     "bin/nexo-brain.js",
     "bin/nexo.js",
+    "bin/nexo-managed-mcp.js",
     "bin/windows-wsl-bridge.js",
     "bin/postinstall.js",
     "scripts/sync_release_artifacts.py",

package/src/auto_update.py

@@ -4828,6 +4828,7 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
         "cognitive",
         "doctor",
         "local_context",
+        "managed_mcp",
         "product_knowledge",
         "dashboard",
         "rules",
@@ -4970,6 +4971,12 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
     wrapper = bin_dir / "nexo"
     wrapper.write_text(_runtime_cli_wrapper_text())
     wrapper.chmod(0o755)
+    managed_mcp_src = repo_dir / "bin" / "nexo-managed-mcp.js"
+    if managed_mcp_src.is_file():
+        managed_mcp_target = bin_dir / "nexo-managed-mcp"
+        _remove_runtime_copy_target(managed_mcp_target)
+        shutil.copy2(str(managed_mcp_src), str(managed_mcp_target))
+        managed_mcp_target.chmod(0o755)
 
     return {
         "packages": copied_packages,

package/src/cli.py

@@ -170,6 +170,48 @@ def _mcp_status(args) -> int:
     )
 
 
+def _closure(args) -> int:
+    from closure_plane import closure_next, closure_snapshot, closure_status, refresh_closure_items
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    command = str(getattr(args, "closure_command", "") or "status")
+    if command == "status":
+        payload = closure_status(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    elif command == "next":
+        if bool(getattr(args, "refresh", False)):
+            refresh_closure_items(conn)
+        payload = {
+            "ok": True,
+            "items": closure_next(
+                conn,
+                limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+                include_waiting=bool(getattr(args, "include_waiting", False)),
+                source=str(getattr(args, "source", "") or ""),
+                kind=str(getattr(args, "kind", "") or ""),
+                state=str(getattr(args, "state", "") or ""),
+                max_risk=getattr(args, "max_risk", 0.0),
+                area=str(getattr(args, "area", "") or ""),
+            ),
+        }
+    elif command == "snapshot":
+        payload = closure_snapshot(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            snapshot_date=str(getattr(args, "date", "") or ""),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    else:
+        payload = {"ok": False, "error": "unsupported closure command"}
+    return _print_json_or_text(payload, as_json=bool(getattr(args, "json", False)))
+
+
 def _mcp_write_message(stdin, payload: dict) -> None:
     raw = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
     stdin.write(raw + b"\n")
@@ -4307,6 +4349,29 @@ def main():
         help="Install Codex automatically when the selected runtime needs it and it is missing.",
     )
 
+    # -- closure --
+    closure_parser = sub.add_parser("closure", help="Operational closure queue")
+    closure_sub = closure_parser.add_subparsers(dest="closure_command")
+    closure_status_p = closure_sub.add_parser("status", help="Show closure queue status")
+    closure_status_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_status_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before reading")
+    closure_status_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_next_p = closure_sub.add_parser("next", help="Show ranked closure items")
+    closure_next_p.add_argument("--limit", type=int, default=10, help="Maximum items")
+    closure_next_p.add_argument("--include-waiting", action="store_true", help="Include waiting_user/blocked items")
+    closure_next_p.add_argument("--refresh", action="store_true", help="Refresh adapters before reading")
+    closure_next_p.add_argument("--source", default="", help="Filter by source")
+    closure_next_p.add_argument("--kind", default="", help="Filter by kind")
+    closure_next_p.add_argument("--state", default="", help="Filter by state, e.g. ready or waiting_user")
+    closure_next_p.add_argument("--area", default="", help="Filter by owner/source/kind/payload area")
+    closure_next_p.add_argument("--max-risk", type=float, default=0.0, help="Filter by maximum risk_score")
+    closure_next_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_snapshot_p = closure_sub.add_parser("snapshot", help="Write and show the daily closure snapshot")
+    closure_snapshot_p.add_argument("--date", default="", help="Snapshot date YYYY-MM-DD")
+    closure_snapshot_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_snapshot_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before snapshot")
+    closure_snapshot_p.add_argument("--json", action="store_true", help="JSON output")
+
     # -- preferences --
     preferences_parser = sub.add_parser(
         "preferences",
@@ -4848,6 +4913,10 @@ def main():
             return _clients_sync(args)
         clients_parser.print_help()
         return 0
+    elif args.command == "closure":
+        if not args.closure_command:
+            args.closure_command = "status"
+        return _closure(args)
     elif args.command == "mcp":
         if args.mcp_command == "status":
             return _mcp_status(args)

package/src/client_sync.py

@@ -23,6 +23,13 @@ except ModuleNotFoundError:  # Python < 3.11
 from bootstrap_docs import sync_client_bootstrap
 from runtime_home import resolve_nexo_home
 
+try:
+    from managed_mcp import build_managed_server_entries, merge_json_mcp_servers, merge_toml_mcp_servers
+except Exception:
+    build_managed_server_entries = None
+    merge_json_mcp_servers = None
+    merge_toml_mcp_servers = None
+
 try:
     from client_preferences import (
         BACKEND_NONE,
@@ -832,6 +839,32 @@ def build_server_config(
     return config
 
 
+def _managed_mcp_entries_for(client: str, server_config: dict) -> dict:
+    if str(os.environ.get("NEXO_MANAGED_MCP_DISABLE", "")).strip().lower() in {"1", "true", "yes", "on"}:
+        return {}
+    if not build_managed_server_entries:
+        return {}
+    env = server_config.get("env") if isinstance(server_config.get("env"), dict) else {}
+    nexo_home = str(env.get("NEXO_HOME") or "").strip()
+    runtime_root = str(env.get("NEXO_CODE") or "").strip()
+    if not nexo_home:
+        return {}
+    target_platform = str(
+        os.environ.get("NEXO_MANAGED_MCP_PLATFORM")
+        or env.get("NEXO_MANAGED_MCP_PLATFORM")
+        or ""
+    ).strip()
+    try:
+        return build_managed_server_entries(
+            client=client,
+            nexo_home=nexo_home,
+            runtime_root=runtime_root or None,
+            platform=target_platform or None,
+        )
+    except Exception:
+        return {}
+
+
 def _claude_code_settings_path(home: Path | None = None) -> Path:
     base = home or _user_home()
     return base / ".claude" / "settings.json"
@@ -1001,6 +1034,11 @@ def _sync_codex_managed_config(
             "env": dict(server_config.get("env", {}) or {}),
         }
         codex_table["managed_server_command"] = server_config.get("command", "")
+        managed_entries = _managed_mcp_entries_for("codex", server_config)
+        if managed_entries and merge_toml_mcp_servers:
+            payload = merge_toml_mcp_servers(payload, managed_entries)
+            codex_table = payload.setdefault("nexo", {}).setdefault("codex", {})
+            codex_table["managed_default_mcp_count"] = len(managed_entries)
 
     # Ensure Codex headless crons (followup-runner, email-monitor, deep-sleep,
     # etc.) do not stall on approval prompts. Only set defaults when the user
@@ -1018,6 +1056,7 @@ def _sync_codex_managed_config(
         "hooks_enabled": True,
         "model": runtime_profile.get("model", ""),
         "reasoning_effort": runtime_profile.get("reasoning_effort", "") or "",
+        "managed_default_mcp_count": len(_managed_mcp_entries_for("codex", server_config)) if server_config else 0,
     }
 
 
@@ -1408,12 +1447,16 @@ def _sync_json_client(path: Path, server_config: dict, label: str, *, managed_me
             nexo_meta = {}
             payload["nexo"] = nexo_meta
         nexo_meta.update(managed_metadata)
+    managed_entries = _managed_mcp_entries_for(label, server_config)
+    if managed_entries and merge_json_mcp_servers:
+        payload = merge_json_mcp_servers(payload, managed_entries)
     _write_json_object(path, payload)
     return {
         "ok": True,
         "client": label,
         "action": action,
         "path": str(path),
+        "managed_default_mcp_count": len(managed_entries),
     }
 
 
@@ -1491,6 +1534,9 @@ def _sync_claude_code_settings(path: Path, server_config: dict) -> dict:
         runtime_root=runtime_root,
         nexo_home=nexo_home,
     )
+    managed_entries = _managed_mcp_entries_for("claude_code", server_config)
+    if managed_entries and merge_json_mcp_servers:
+        payload = merge_json_mcp_servers(payload, managed_entries)
     _ensure_headless_permissions(payload)
     _write_json_object(path, payload)
     return {
@@ -1499,6 +1545,7 @@ def _sync_claude_code_settings(path: Path, server_config: dict) -> dict:
         "action": action,
         "path": str(path),
         "managed_hook_count": managed_hook_count,
+        "managed_default_mcp_count": len(managed_entries),
     }