nexo-brain 7.30.21 → 7.30.23

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.21",
+  "version": "7.30.23",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.21` is the current packaged-runtime line. Patch release over v7.30.20 - Brain now ships managed default MCP catalog/lock reconciliation and the Operational Closure Plane, with Desktop v0.43.12 consuming the coordinated runtime contract.
+Version `7.30.23` is the current packaged-runtime line. Patch release over v7.30.22 - Brain now ships Opportunity Orchestrator Phase 1 for evidence-backed proactive preparation, read-only dry-run reports, bounded proposal queues, and feedback/suppression controls.
 
 Previously in `7.30.20`: patch release over v7.30.19 - packaged installs now copy the `product_knowledge` package into the installed runtime so `nexo update` can import the new product knowledge tools.
 
@@ -26,6 +26,8 @@ Previously in `7.30.19`: patch release over v7.30.18 - product capabilities now
 
 Previously in `7.30.16`: patch release over v7.30.14 - Desktop diagnostics can read embedding migration status without warming models, and the coordinated Desktop update path is covered for bundled model verification and obsolete managed model cleanup.
 
+Previously in `7.30.15`: patch release over v7.30.14 - Email NEXO closes affirmative actionable replies correctly and avoids reopening processed threads after a sent reply is already recorded.
+
 Previously in `7.30.14`: patch release over v7.30.13 - support tickets, provider capability discovery, task-close rearming, internal audit followups, and the memory-observation watchdog are aligned for Desktop-managed agents.
 
 Previously in `7.30.13`: patch release over v7.30.12 - Email NEXO monitor prompts now require a full IMAP body fetch before replying, and managed email defaults use the MXroute `Sent` folder instead of `INBOX.Sent`.

package/bin/nexo-brain.js

@@ -1346,7 +1346,7 @@ function getCoreRuntimeFlatFiles(srcDir = path.join(__dirname, "..", "src")) {
 }
 
 function getCoreRuntimePackages() {
-  return ["db", "cognitive", "doctor", "local_context", "product_knowledge"];
+  return ["db", "cognitive", "doctor", "local_context", "managed_mcp", "product_knowledge"];
 }
 
 // Brain contracts — files the NEXO Brain publishes to consumers like
@@ -4306,6 +4306,12 @@ async function runSetup() {
   const runtimeCliPath = path.join(NEXO_HOME, "bin", "nexo");
   fs.writeFileSync(runtimeCliPath, runtimeCli);
   fs.chmodSync(runtimeCliPath, 0o755);
+  const managedMcpSource = path.join(__dirname, "nexo-managed-mcp.js");
+  if (fs.existsSync(managedMcpSource)) {
+    const managedMcpTarget = path.join(NEXO_HOME, "bin", "nexo-managed-mcp");
+    fs.copyFileSync(managedMcpSource, managedMcpTarget);
+    fs.chmodSync(managedMcpTarget, 0o755);
+  }
 
   log("Copying core packages...");
   // Core packages (directories with __init__.py)

package/bin/nexo-managed-mcp.js

@@ -30,6 +30,23 @@ function findEntry(capabilityId) {
   return null;
 }
 
+function disabledList() {
+  return String(process.env.NEXO_MANAGED_MCP_DISABLED_CAPABILITIES || "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function isDisabled(capabilityId) {
+  const global = String(process.env.NEXO_MANAGED_MCP_DISABLE || "").trim().toLowerCase();
+  if (["1", "true", "yes", "on"].includes(global)) return true;
+  return disabledList().includes(capabilityId);
+}
+
+function readInstalledState() {
+  return readJson(path.join(nexoHome(), "runtime", "managed-mcp", "installed-state.json")) || {};
+}
+
 function providerEnv() {
   return {
     PATH: process.env.PATH || "",
@@ -38,8 +55,15 @@ function providerEnv() {
   };
 }
 
-function stagedProviderCommand(providerId) {
-  return path.join(nexoHome(), "runtime", "managed-mcp", "artifacts", providerId, "bin", providerId);
+function stagedProviderCommand(providerId, state) {
+  const providers = state && state.providers && typeof state.providers === "object" ? state.providers : {};
+  const provider = providers[providerId] && typeof providers[providerId] === "object" ? providers[providerId] : {};
+  const explicit = process.platform === "win32"
+    ? (provider.executable_win32 || provider.executable)
+    : provider.executable;
+  if (explicit) return String(explicit);
+  const suffix = process.platform === "win32" ? ".cmd" : "";
+  return path.join(nexoHome(), "runtime", "managed-mcp", "artifacts", providerId, "bin", `${providerId}${suffix}`);
 }
 
 function spawnProvider(command, args, env) {
@@ -63,6 +87,11 @@ function main() {
     console.error("usage: nexo-managed-mcp run <capability_id>");
     process.exit(64);
   }
+  if (isDisabled(capabilityId)) {
+    console.error(`NEXO managed MCP capability '${capabilityId}' is disabled by policy.`);
+    process.exit(78);
+  }
+  const state = readInstalledState();
   const entry = findEntry(capabilityId);
   const meta = entry && entry.nexo ? entry.nexo : {};
   const providerId = meta.provider_id || "";
@@ -70,12 +99,21 @@ function main() {
     console.error(`NEXO managed MCP capability '${capabilityId}' is not installed yet.`);
     process.exit(69);
   }
-  const providerCommand = stagedProviderCommand(providerId);
-  const env = providerEnv();
+  const providerCommand = stagedProviderCommand(providerId, state);
+  const env = {
+    ...providerEnv(),
+    NEXO_MANAGED_MCP_CAPABILITY: capabilityId,
+    NEXO_MANAGED_MCP_PROVIDER: providerId,
+    NEXO_MANAGED_MCP_RISK: String(meta.risk || ""),
+  };
   if (!fs.existsSync(providerCommand)) {
     const providerPackage = String(meta.provider_package || "");
     const providerVersion = String(meta.provider_version || "");
     const providerBin = String(meta.provider_bin || providerId);
+    if (String(process.env.NEXO_MANAGED_MCP_ALLOW_NPX_FALLBACK || "").trim() !== "1") {
+      console.error(`NEXO managed MCP provider '${providerId}' is not staged. Run nexo_managed_mcp_status(apply=true) to install managed providers.`);
+      process.exit(69);
+    }
     if (!providerPackage || !providerVersion || providerVersion === "0.0.0-managed") {
       console.error(`NEXO managed MCP provider '${providerId}' is not staged and has no exact locked npm package.`);
       process.exit(69);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.21",
+  "version": "7.30.23",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -4828,6 +4828,7 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
         "cognitive",
         "doctor",
         "local_context",
+        "managed_mcp",
         "product_knowledge",
         "dashboard",
         "rules",
@@ -4970,6 +4971,12 @@ def _copy_runtime_from_source(src_dir: Path, repo_dir: Path, dest: Path = NEXO_H
     wrapper = bin_dir / "nexo"
     wrapper.write_text(_runtime_cli_wrapper_text())
     wrapper.chmod(0o755)
+    managed_mcp_src = repo_dir / "bin" / "nexo-managed-mcp.js"
+    if managed_mcp_src.is_file():
+        managed_mcp_target = bin_dir / "nexo-managed-mcp"
+        _remove_runtime_copy_target(managed_mcp_target)
+        shutil.copy2(str(managed_mcp_src), str(managed_mcp_target))
+        managed_mcp_target.chmod(0o755)
 
     return {
         "packages": copied_packages,

package/src/cli.py

@@ -170,6 +170,48 @@ def _mcp_status(args) -> int:
     )
 
 
+def _closure(args) -> int:
+    from closure_plane import closure_next, closure_snapshot, closure_status, refresh_closure_items
+    from db import get_db
+    from db._schema import run_migrations
+
+    conn = get_db()
+    run_migrations(conn)
+    command = str(getattr(args, "closure_command", "") or "status")
+    if command == "status":
+        payload = closure_status(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    elif command == "next":
+        if bool(getattr(args, "refresh", False)):
+            refresh_closure_items(conn)
+        payload = {
+            "ok": True,
+            "items": closure_next(
+                conn,
+                limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+                include_waiting=bool(getattr(args, "include_waiting", False)),
+                source=str(getattr(args, "source", "") or ""),
+                kind=str(getattr(args, "kind", "") or ""),
+                state=str(getattr(args, "state", "") or ""),
+                max_risk=getattr(args, "max_risk", 0.0),
+                area=str(getattr(args, "area", "") or ""),
+            ),
+        }
+    elif command == "snapshot":
+        payload = closure_snapshot(
+            conn,
+            refresh=not bool(getattr(args, "no_refresh", False)),
+            snapshot_date=str(getattr(args, "date", "") or ""),
+            limit=max(1, min(int(getattr(args, "limit", 10) or 10), 100)),
+        )
+    else:
+        payload = {"ok": False, "error": "unsupported closure command"}
+    return _print_json_or_text(payload, as_json=bool(getattr(args, "json", False)))
+
+
 def _mcp_write_message(stdin, payload: dict) -> None:
     raw = json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
     stdin.write(raw + b"\n")
@@ -4307,6 +4349,29 @@ def main():
         help="Install Codex automatically when the selected runtime needs it and it is missing.",
     )
 
+    # -- closure --
+    closure_parser = sub.add_parser("closure", help="Operational closure queue")
+    closure_sub = closure_parser.add_subparsers(dest="closure_command")
+    closure_status_p = closure_sub.add_parser("status", help="Show closure queue status")
+    closure_status_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_status_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before reading")
+    closure_status_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_next_p = closure_sub.add_parser("next", help="Show ranked closure items")
+    closure_next_p.add_argument("--limit", type=int, default=10, help="Maximum items")
+    closure_next_p.add_argument("--include-waiting", action="store_true", help="Include waiting_user/blocked items")
+    closure_next_p.add_argument("--refresh", action="store_true", help="Refresh adapters before reading")
+    closure_next_p.add_argument("--source", default="", help="Filter by source")
+    closure_next_p.add_argument("--kind", default="", help="Filter by kind")
+    closure_next_p.add_argument("--state", default="", help="Filter by state, e.g. ready or waiting_user")
+    closure_next_p.add_argument("--area", default="", help="Filter by owner/source/kind/payload area")
+    closure_next_p.add_argument("--max-risk", type=float, default=0.0, help="Filter by maximum risk_score")
+    closure_next_p.add_argument("--json", action="store_true", help="JSON output")
+    closure_snapshot_p = closure_sub.add_parser("snapshot", help="Write and show the daily closure snapshot")
+    closure_snapshot_p.add_argument("--date", default="", help="Snapshot date YYYY-MM-DD")
+    closure_snapshot_p.add_argument("--limit", type=int, default=10, help="Top items to include")
+    closure_snapshot_p.add_argument("--no-refresh", action="store_true", help="Do not refresh adapters before snapshot")
+    closure_snapshot_p.add_argument("--json", action="store_true", help="JSON output")
+
     # -- preferences --
     preferences_parser = sub.add_parser(
         "preferences",
@@ -4848,6 +4913,10 @@ def main():
             return _clients_sync(args)
         clients_parser.print_help()
         return 0
+    elif args.command == "closure":
+        if not args.closure_command:
+            args.closure_command = "status"
+        return _closure(args)
     elif args.command == "mcp":
         if args.mcp_command == "status":
             return _mcp_status(args)