nexo-brain 7.30.21 → 7.30.23

package/src/db/_schema.py

@@ -2867,6 +2867,202 @@ def _m78_operational_closure_plane(conn):
     _migrate_add_index(conn, "idx_closure_events_item", "closure_item_events", "closure_item_id, created_at")
 
 
+def _m79_operational_closure_links_readiness(conn):
+    """Upgrade Closure Plane with links and capability readiness tables."""
+    _m78_operational_closure_plane(conn)
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS closure_item_links (
+            id TEXT PRIMARY KEY,
+            closure_item_id TEXT NOT NULL,
+            link_type TEXT NOT NULL,
+            link_id TEXT NOT NULL,
+            relation TEXT NOT NULL DEFAULT 'related',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY(closure_item_id) REFERENCES closure_items(id) ON DELETE CASCADE,
+            UNIQUE(closure_item_id, link_type, link_id, relation)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS closure_capability_readiness (
+            id TEXT PRIMARY KEY,
+            capability TEXT NOT NULL,
+            status TEXT NOT NULL DEFAULT 'unknown',
+            reason TEXT NOT NULL DEFAULT '',
+            verified_at TEXT NOT NULL,
+            verification_evidence TEXT NOT NULL DEFAULT '',
+            expires_at TEXT NOT NULL DEFAULT '',
+            UNIQUE(capability)
+        )
+        """
+    )
+    _migrate_add_index(conn, "idx_closure_links_item", "closure_item_links", "closure_item_id")
+    _migrate_add_index(conn, "idx_closure_links_target", "closure_item_links", "link_type, link_id")
+    _migrate_add_index(conn, "idx_closure_readiness_capability", "closure_capability_readiness", "capability, status")
+
+
+def _m80_opportunity_orchestrator(conn):
+    """Opportunity Orchestrator v1: sparse, evidence-backed proactive queue."""
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_signals (
+            id TEXT PRIMARY KEY,
+            source_type TEXT NOT NULL,
+            source_id TEXT NOT NULL DEFAULT '',
+            entity_ref TEXT NOT NULL DEFAULT '',
+            summary TEXT NOT NULL DEFAULT '',
+            signal_kind TEXT NOT NULL,
+            urgency REAL NOT NULL DEFAULT 0,
+            confidence REAL NOT NULL DEFAULT 0,
+            privacy_level TEXT NOT NULL DEFAULT 'normal',
+            source_hash TEXT NOT NULL,
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            expires_at TEXT NOT NULL DEFAULT '',
+            UNIQUE(source_type, source_id, signal_kind)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_opportunities (
+            id TEXT PRIMARY KEY,
+            title TEXT NOT NULL,
+            hypothesis TEXT NOT NULL DEFAULT '',
+            domain TEXT NOT NULL DEFAULT 'general',
+            opportunity_type TEXT NOT NULL,
+            dedupe_key TEXT NOT NULL,
+            impact REAL NOT NULL DEFAULT 0,
+            urgency REAL NOT NULL DEFAULT 0,
+            confidence REAL NOT NULL DEFAULT 0,
+            risk REAL NOT NULL DEFAULT 0,
+            effort REAL NOT NULL DEFAULT 0,
+            readiness REAL NOT NULL DEFAULT 0,
+            user_burden_reduction REAL NOT NULL DEFAULT 0,
+            interruption_cost REAL NOT NULL DEFAULT 0,
+            strategic_alignment REAL NOT NULL DEFAULT 0,
+            repetition_penalty REAL NOT NULL DEFAULT 0,
+            score REAL NOT NULL DEFAULT 0,
+            state TEXT NOT NULL DEFAULT 'candidate',
+            owner TEXT NOT NULL DEFAULT 'nero',
+            why_now TEXT NOT NULL DEFAULT '',
+            next_action TEXT NOT NULL DEFAULT '',
+            action_class TEXT NOT NULL DEFAULT 'read_only',
+            authorization_status TEXT NOT NULL DEFAULT 'not_required',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+            expires_at TEXT NOT NULL DEFAULT '',
+            last_proposed_at TEXT NOT NULL DEFAULT '',
+            source_payload_json TEXT NOT NULL DEFAULT '{}',
+            UNIQUE(dedupe_key)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_opportunity_evidence (
+            id TEXT PRIMARY KEY,
+            opportunity_id TEXT NOT NULL,
+            source_type TEXT NOT NULL,
+            source_id TEXT NOT NULL,
+            evidence_summary TEXT NOT NULL DEFAULT '',
+            confidence REAL NOT NULL DEFAULT 0,
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY(opportunity_id) REFERENCES nexo_opportunities(id) ON DELETE CASCADE,
+            UNIQUE(opportunity_id, source_type, source_id)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_preparations (
+            id TEXT PRIMARY KEY,
+            opportunity_id TEXT NOT NULL,
+            artifact_type TEXT NOT NULL,
+            artifact_ref TEXT NOT NULL DEFAULT '',
+            safe_mode INTEGER NOT NULL DEFAULT 1,
+            approval_required INTEGER NOT NULL DEFAULT 0,
+            status TEXT NOT NULL DEFAULT 'ready',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            expires_at TEXT NOT NULL DEFAULT '',
+            FOREIGN KEY(opportunity_id) REFERENCES nexo_opportunities(id) ON DELETE CASCADE,
+            UNIQUE(opportunity_id, artifact_type, artifact_ref)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_proposals (
+            id TEXT PRIMARY KEY,
+            opportunity_id TEXT NOT NULL,
+            surface TEXT NOT NULL DEFAULT 'home',
+            copy TEXT NOT NULL DEFAULT '',
+            cta_primary TEXT NOT NULL DEFAULT 'Inspect evidence',
+            cta_secondary TEXT NOT NULL DEFAULT 'Snooze',
+            shown_at TEXT NOT NULL DEFAULT '',
+            feedback TEXT NOT NULL DEFAULT '',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY(opportunity_id) REFERENCES nexo_opportunities(id) ON DELETE CASCADE,
+            UNIQUE(opportunity_id, surface)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_proposal_events (
+            id TEXT PRIMARY KEY,
+            proposal_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            feedback TEXT NOT NULL DEFAULT '',
+            note TEXT NOT NULL DEFAULT '',
+            metadata_json TEXT NOT NULL DEFAULT '{}',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            FOREIGN KEY(proposal_id) REFERENCES nexo_proposals(id) ON DELETE CASCADE
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_suppression_rules (
+            id TEXT PRIMARY KEY,
+            scope_type TEXT NOT NULL,
+            scope_key TEXT NOT NULL,
+            reason TEXT NOT NULL DEFAULT '',
+            expires_at TEXT NOT NULL DEFAULT '',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            UNIQUE(scope_type, scope_key, reason)
+        )
+        """
+    )
+    conn.execute(
+        """
+        CREATE TABLE IF NOT EXISTS nexo_action_authorizations (
+            id TEXT PRIMARY KEY,
+            scope TEXT NOT NULL,
+            allowed_action_class TEXT NOT NULL,
+            max_cost REAL NOT NULL DEFAULT 0,
+            expires_at TEXT NOT NULL DEFAULT '',
+            granted_by TEXT NOT NULL DEFAULT '',
+            evidence_ref TEXT NOT NULL DEFAULT '',
+            created_at TEXT NOT NULL DEFAULT (datetime('now')),
+            UNIQUE(scope, allowed_action_class, evidence_ref)
+        )
+        """
+    )
+    _migrate_add_index(conn, "idx_nexo_signals_source", "nexo_signals", "source_type, source_id")
+    _migrate_add_index(conn, "idx_nexo_signals_expires", "nexo_signals", "expires_at")
+    _migrate_add_index(conn, "idx_nexo_opportunities_state_score", "nexo_opportunities", "state, score DESC, updated_at")
+    _migrate_add_index(conn, "idx_nexo_opportunities_type", "nexo_opportunities", "opportunity_type, state")
+    _migrate_add_index(conn, "idx_nexo_opportunities_expires", "nexo_opportunities", "expires_at")
+    _migrate_add_index(conn, "idx_nexo_opportunity_evidence_item", "nexo_opportunity_evidence", "opportunity_id")
+    _migrate_add_index(conn, "idx_nexo_preparations_item", "nexo_preparations", "opportunity_id, status")
+    _migrate_add_index(conn, "idx_nexo_proposals_surface", "nexo_proposals", "surface, feedback")
+    _migrate_add_index(conn, "idx_nexo_proposal_events_proposal", "nexo_proposal_events", "proposal_id, created_at")
+    _migrate_add_index(conn, "idx_nexo_suppression_scope", "nexo_suppression_rules", "scope_type, scope_key")
+    _migrate_add_index(conn, "idx_nexo_authorizations_scope", "nexo_action_authorizations", "scope, allowed_action_class")
+
+
 MIGRATIONS = [
     (1, "learnings_columns", _m1_learnings_columns),
     (2, "followups_reasoning", _m2_followups_reasoning),
@@ -2946,6 +3142,8 @@ MIGRATIONS = [
     (76, "semantic_layers", _m76_semantic_layers),
     (77, "morning_briefing_presentation", _m77_morning_briefing_presentation),
     (78, "operational_closure_plane", _m78_operational_closure_plane),
+    (79, "operational_closure_links_readiness", _m79_operational_closure_links_readiness),
+    (80, "opportunity_orchestrator", _m80_opportunity_orchestrator),
 ]
 
 
@@ -2967,7 +3165,11 @@ def run_migrations(conn=None):
     """)
     conn.commit()
 
-    applied = {r[0] for r in conn.execute("SELECT version FROM schema_migrations").fetchall()}
+    applied = {
+        int(r[0])
+        for r in conn.execute("SELECT version FROM schema_migrations").fetchall()
+        if str(r[0]).strip().isdigit()
+    }
 
     failed = []
     for version, name, fn in MIGRATIONS:
@@ -2975,9 +3177,10 @@ def run_migrations(conn=None):
             try:
                 fn(conn)
                 conn.execute(
-                    "INSERT INTO schema_migrations (version, name) VALUES (?, ?)",
+                    "INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (?, ?)",
                     (version, name)
                 )
+                applied.add(version)
                 conn.commit()
             except Exception as e:
                 conn.rollback()

package/src/managed_mcp/catalog.py

@@ -189,6 +189,12 @@ def provider_for_capability(
 
 
 def _runner_path(nexo_home: Path, runtime_root: Path | None = None) -> Path:
+    runtime_bin = nexo_home / "bin" / "nexo-managed-mcp"
+    if runtime_bin.exists():
+        return runtime_bin
+    runtime_js = nexo_home / "bin" / "nexo-managed-mcp.js"
+    if runtime_js.exists():
+        return runtime_js
     runtime_bin = nexo_home / "runtime" / "bin" / "nexo-managed-mcp"
     if runtime_bin.exists():
         return runtime_bin

package/src/managed_mcp/reconcile.py

@@ -2,6 +2,8 @@ from __future__ import annotations
 
 import json
 import os
+import shutil
+import subprocess
 import time
 from pathlib import Path
 from typing import Any
@@ -17,6 +19,23 @@ def _state_path(nexo_home: Path) -> Path:
     return _state_dir(nexo_home) / "installed-state.json"
 
 
+def _artifacts_dir(nexo_home: Path) -> Path:
+    return _state_dir(nexo_home) / "artifacts"
+
+
+def _provider_root(nexo_home: Path, provider_id: str) -> Path:
+    return _artifacts_dir(nexo_home) / provider_id
+
+
+def _provider_stage_dir(nexo_home: Path, provider_id: str, version: str) -> Path:
+    return _provider_root(nexo_home, provider_id) / version
+
+
+def _provider_wrapper_path(nexo_home: Path, provider_id: str, *, platform: str | None = None) -> Path:
+    suffix = ".cmd" if str(platform or os.name).lower().startswith(("win", "nt")) else ""
+    return _provider_root(nexo_home, provider_id) / "bin" / f"{provider_id}{suffix}"
+
+
 def _read_state(nexo_home: Path) -> dict[str, Any]:
     path = _state_path(nexo_home)
     if not path.is_file():
@@ -37,6 +56,160 @@ def _write_state(nexo_home: Path, state: dict[str, Any]) -> None:
     tmp.replace(path)
 
 
+def _provider_ids_from_desired(desired: dict[str, Any]) -> set[str]:
+    provider_ids: set[str] = set()
+    for client_entries in desired.values():
+        if not isinstance(client_entries, dict):
+            continue
+        for entry in client_entries.values():
+            meta = entry.get("nexo") if isinstance(entry, dict) else {}
+            if isinstance(meta, dict) and meta.get("provider_id"):
+                provider_ids.add(str(meta["provider_id"]))
+    return provider_ids
+
+
+def _locked_providers(lock: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    providers = lock.get("providers") if isinstance(lock.get("providers"), dict) else {}
+    return {str(key): value for key, value in providers.items() if isinstance(value, dict)}
+
+
+def _run_npm_install(stage_dir: Path, package: str, version: str) -> subprocess.CompletedProcess:
+    npm = "npm.cmd" if os.name == "nt" else "npm"
+    return subprocess.run(
+        [
+            npm,
+            "install",
+            "--prefix",
+            str(stage_dir),
+            "--omit=dev",
+            "--no-audit",
+            "--no-fund",
+            "--package-lock=false",
+            f"{package}@{version}",
+        ],
+        text=True,
+        capture_output=True,
+        timeout=180,
+    )
+
+
+def _write_provider_wrappers(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    version: str,
+    provider_bin: str,
+) -> dict[str, str]:
+    root = _provider_root(nexo_home, provider_id)
+    bin_dir = root / "bin"
+    bin_dir.mkdir(parents=True, exist_ok=True)
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version)
+    unix_target = stage_dir / "node_modules" / ".bin" / provider_bin
+    win_target = stage_dir / "node_modules" / ".bin" / f"{provider_bin}.cmd"
+    unix_wrapper = bin_dir / provider_id
+    unix_wrapper.write_text(f"#!/bin/sh\nexec {json.dumps(str(unix_target))} \"$@\"\n")
+    unix_wrapper.chmod(0o755)
+    win_wrapper = bin_dir / f"{provider_id}.cmd"
+    win_wrapper.write_text(f"@echo off\r\ncall \"{win_target}\" %*\r\n")
+    return {
+        "unix": str(unix_wrapper),
+        "win32": str(win_wrapper),
+        "target": str(unix_target),
+        "target_win32": str(win_target),
+    }
+
+
+def _stage_provider(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    locked: dict[str, Any],
+    npm_runner=_run_npm_install,
+) -> dict[str, Any]:
+    package = str(locked.get("package") or "").strip()
+    version = str(locked.get("version") or "").strip()
+    provider_bin = str(locked.get("bin") or "").strip()
+    if not package or not version or not provider_bin:
+        return {"status": "failed", "error": "provider lock is incomplete"}
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version)
+    root = _provider_root(nexo_home, provider_id)
+    tmp_dir = root / f".stage-{version}-{int(time.time() * 1000)}"
+    root.mkdir(parents=True, exist_ok=True)
+    if stage_dir.is_dir():
+        wrappers = _write_provider_wrappers(
+            nexo_home=nexo_home,
+            provider_id=provider_id,
+            version=version,
+            provider_bin=provider_bin,
+        )
+        return {
+            "status": "healthy",
+            "version": version,
+            "package": package,
+            "staged_path": str(stage_dir),
+            "executable": wrappers["unix"],
+            "executable_win32": wrappers["win32"],
+            "reused": True,
+        }
+    try:
+        tmp_dir.mkdir(parents=True, exist_ok=True)
+        result = npm_runner(tmp_dir, package, version)
+        if getattr(result, "returncode", 1) != 0:
+            return {
+                "status": "failed",
+                "version": version,
+                "package": package,
+                "error": (getattr(result, "stderr", "") or getattr(result, "stdout", "") or "npm install failed")[-1200:],
+            }
+        if stage_dir.exists():
+            shutil.rmtree(stage_dir)
+        tmp_dir.replace(stage_dir)
+        wrappers = _write_provider_wrappers(
+            nexo_home=nexo_home,
+            provider_id=provider_id,
+            version=version,
+            provider_bin=provider_bin,
+        )
+        return {
+            "status": "healthy",
+            "version": version,
+            "package": package,
+            "staged_path": str(stage_dir),
+            "executable": wrappers["unix"],
+            "executable_win32": wrappers["win32"],
+            "integrity": str(locked.get("integrity") or ""),
+        }
+    except Exception as exc:
+        return {"status": "failed", "version": version, "package": package, "error": str(exc)}
+    finally:
+        if tmp_dir.exists():
+            shutil.rmtree(tmp_dir, ignore_errors=True)
+
+
+def _provider_health(
+    *,
+    nexo_home: Path,
+    provider_id: str,
+    locked: dict[str, Any],
+    platform: str | None = None,
+) -> dict[str, Any]:
+    version = str(locked.get("version") or "").strip()
+    executable = _provider_wrapper_path(nexo_home, provider_id, platform=platform)
+    stage_dir = _provider_stage_dir(nexo_home, provider_id, version) if version else _provider_root(nexo_home, provider_id)
+    if not version:
+        return {"status": "failed", "reason": "missing_version"}
+    if not stage_dir.is_dir():
+        return {"status": "unstaged", "version": version, "staged_path": str(stage_dir)}
+    if not executable.exists():
+        return {"status": "failed", "version": version, "reason": "wrapper_missing", "executable": str(executable)}
+    return {
+        "status": "healthy",
+        "version": version,
+        "staged_path": str(stage_dir),
+        "executable": str(executable),
+    }
+
+
 def reconcile_managed_mcp(
     *,
     nexo_home: str | os.PathLike[str] | Path,
@@ -44,6 +217,7 @@ def reconcile_managed_mcp(
     clients: list[str] | tuple[str, ...] | None = None,
     apply: bool = False,
     platform: str | None = None,
+    npm_runner=_run_npm_install,
 ) -> dict[str, Any]:
     nexo_home_path = Path(nexo_home).expanduser()
     catalog = load_catalog()
@@ -76,6 +250,27 @@ def reconcile_managed_mcp(
             actions.append({"client": client, "server": name, "action": action})
         for name in set(old_entries) - set(entries):
             actions.append({"client": client, "server": name, "action": "disable"})
+    locked_by_provider = _locked_providers(lock)
+    provider_ids = _provider_ids_from_desired(desired)
+    provider_state: dict[str, Any] = {}
+    if apply:
+        for provider_id in sorted(provider_ids):
+            provider_state[provider_id] = _stage_provider(
+                nexo_home=nexo_home_path,
+                provider_id=provider_id,
+                locked=locked_by_provider.get(provider_id) or {},
+                npm_runner=npm_runner,
+            )
+    else:
+        for provider_id in sorted(provider_ids):
+            provider_state[provider_id] = _provider_health(
+                nexo_home=nexo_home_path,
+                provider_id=provider_id,
+                locked=locked_by_provider.get(provider_id) or {},
+                platform=platform,
+            )
+    if any((state.get("status") if isinstance(state, dict) else "") not in {"healthy"} for state in provider_state.values()):
+        actions.append({"client": "runtime", "server": "managed_mcp", "action": "healthcheck"})
 
     state = {
         "schema": "nexo.managed_mcp.state.v1",
@@ -83,6 +278,7 @@ def reconcile_managed_mcp(
         "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
         "validation": validation,
         "desired": desired,
+        "providers": provider_state,
         "last_plan": actions,
     }
     if apply:
@@ -94,6 +290,7 @@ def reconcile_managed_mcp(
         "validation": validation,
         "actions": actions,
         "desired_clients": sorted(desired),
+        "providers": provider_state,
     }
 
 
@@ -119,4 +316,5 @@ def managed_mcp_status(
         "validation": plan["validation"],
         "last_applied_at": state.get("updated_at", ""),
         "actions": plan["actions"],
+        "providers": plan.get("providers", {}),
     }