nexo-brain 7.30.23 → 7.30.25

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.23",
+  "version": "7.30.25",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,11 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.30.23` is the current packaged-runtime line. Patch release over v7.30.22 - Brain now ships Opportunity Orchestrator Phase 1 for evidence-backed proactive preparation, read-only dry-run reports, bounded proposal queues, and feedback/suppression controls.
+Version `7.30.25` is the current packaged-runtime line. Patch release over v7.30.24 - Desktop-facing maintenance diagnostics now self-heal or stay informational when the runtime is healthy, and watchdog uses the canonical cognitive DB layout.
+
+Previously in `7.30.24`: patch release over v7.30.23 - client sync now stages and verifies managed MCP providers before writing Brain-owned default MCP entries into Claude, Codex, or Desktop configs.
+
+Previously in `7.30.23`: patch release over v7.30.22 - Brain ships Opportunity Orchestrator Phase 1 for evidence-backed proactive preparation, read-only dry-run reports, bounded proposal queues, and feedback/suppression controls.
 
 Previously in `7.30.20`: patch release over v7.30.19 - packaged installs now copy the `product_knowledge` package into the installed runtime so `nexo update` can import the new product knowledge tools.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.30.23",
+  "version": "7.30.25",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/client_sync.py

@@ -24,11 +24,21 @@ from bootstrap_docs import sync_client_bootstrap
 from runtime_home import resolve_nexo_home
 
 try:
-    from managed_mcp import build_managed_server_entries, merge_json_mcp_servers, merge_toml_mcp_servers
+    from managed_mcp import (
+        build_managed_server_entries,
+        merge_json_mcp_servers,
+        merge_toml_mcp_servers,
+        reconcile_managed_mcp,
+        remove_json_nexo_managed_mcp_servers,
+        remove_toml_nexo_managed_mcp_servers,
+    )
 except Exception:
     build_managed_server_entries = None
     merge_json_mcp_servers = None
     merge_toml_mcp_servers = None
+    reconcile_managed_mcp = None
+    remove_json_nexo_managed_mcp_servers = None
+    remove_toml_nexo_managed_mcp_servers = None
 
 try:
     from client_preferences import (
@@ -842,7 +852,7 @@ def build_server_config(
 def _managed_mcp_entries_for(client: str, server_config: dict) -> dict:
     if str(os.environ.get("NEXO_MANAGED_MCP_DISABLE", "")).strip().lower() in {"1", "true", "yes", "on"}:
         return {}
-    if not build_managed_server_entries:
+    if not build_managed_server_entries or not reconcile_managed_mcp:
         return {}
     env = server_config.get("env") if isinstance(server_config.get("env"), dict) else {}
     nexo_home = str(env.get("NEXO_HOME") or "").strip()
@@ -855,16 +865,51 @@ def _managed_mcp_entries_for(client: str, server_config: dict) -> dict:
         or ""
     ).strip()
     try:
-        return build_managed_server_entries(
+        plan = reconcile_managed_mcp(
+            nexo_home=nexo_home,
+            runtime_root=runtime_root or None,
+            clients=[client],
+            apply=True,
+            platform=target_platform or None,
+        )
+        providers = plan.get("providers") if isinstance(plan.get("providers"), dict) else {}
+        if not plan.get("ok") or not providers:
+            return {}
+        entries = build_managed_server_entries(
             client=client,
             nexo_home=nexo_home,
             runtime_root=runtime_root or None,
             platform=target_platform or None,
         )
+        required_providers = {
+            str((entry.get("nexo") or {}).get("provider_id") or "").strip()
+            for entry in entries.values()
+            if isinstance(entry, dict)
+        }
+        required_providers.discard("")
+        if not required_providers:
+            return {}
+        for provider_id in required_providers:
+            state = providers.get(provider_id) if isinstance(providers.get(provider_id), dict) else {}
+            if state.get("status") != "healthy":
+                return {}
+        return entries
     except Exception:
         return {}
 
 
+def _remove_unhealthy_json_managed_mcp(payload: dict) -> dict:
+    if not remove_json_nexo_managed_mcp_servers:
+        return payload
+    return remove_json_nexo_managed_mcp_servers(payload)
+
+
+def _remove_unhealthy_toml_managed_mcp(payload: dict) -> dict:
+    if not remove_toml_nexo_managed_mcp_servers:
+        return payload
+    return remove_toml_nexo_managed_mcp_servers(payload)
+
+
 def _claude_code_settings_path(home: Path | None = None) -> Path:
     base = home or _user_home()
     return base / ".claude" / "settings.json"
@@ -1039,6 +1084,10 @@ def _sync_codex_managed_config(
             payload = merge_toml_mcp_servers(payload, managed_entries)
             codex_table = payload.setdefault("nexo", {}).setdefault("codex", {})
             codex_table["managed_default_mcp_count"] = len(managed_entries)
+        else:
+            payload = _remove_unhealthy_toml_managed_mcp(payload)
+            codex_table = payload.setdefault("nexo", {}).setdefault("codex", {})
+            codex_table["managed_default_mcp_count"] = 0
 
     # Ensure Codex headless crons (followup-runner, email-monitor, deep-sleep,
     # etc.) do not stall on approval prompts. Only set defaults when the user
@@ -1056,7 +1105,7 @@ def _sync_codex_managed_config(
         "hooks_enabled": True,
         "model": runtime_profile.get("model", ""),
         "reasoning_effort": runtime_profile.get("reasoning_effort", "") or "",
-        "managed_default_mcp_count": len(_managed_mcp_entries_for("codex", server_config)) if server_config else 0,
+        "managed_default_mcp_count": len(managed_entries) if server_config else 0,
     }
 
 
@@ -1450,6 +1499,8 @@ def _sync_json_client(path: Path, server_config: dict, label: str, *, managed_me
     managed_entries = _managed_mcp_entries_for(label, server_config)
     if managed_entries and merge_json_mcp_servers:
         payload = merge_json_mcp_servers(payload, managed_entries)
+    else:
+        payload = _remove_unhealthy_json_managed_mcp(payload)
     _write_json_object(path, payload)
     return {
         "ok": True,
@@ -1537,6 +1588,8 @@ def _sync_claude_code_settings(path: Path, server_config: dict) -> dict:
     managed_entries = _managed_mcp_entries_for("claude_code", server_config)
     if managed_entries and merge_json_mcp_servers:
         payload = merge_json_mcp_servers(payload, managed_entries)
+    else:
+        payload = _remove_unhealthy_json_managed_mcp(payload)
     _ensure_headless_permissions(payload)
     _write_json_object(path, payload)
     return {

package/src/doctor/providers/runtime.py

@@ -50,6 +50,7 @@ WATCHDOG_FRESHNESS = 3600  # 1 hour (runs every 30 min)
 RUNNER_HEALTH_FRESHNESS = 43200  # 12 hours (runner-health-check runs every 6h)
 DEFAULT_CRON_THRESHOLD = 7200  # Fallback when manifest data is unavailable
 LIVE_PROTOCOL_SESSION_FRESHNESS = 1800  # 30 minutes
+AUTOMATION_TELEMETRY_USAGE_WARN_COVERAGE = 99.0
 SPECIAL_ENV_NORMALIZE_IDS = {"prevent-sleep", "tcc-approve"}
 OPTIONALS_FILE = paths.config_dir() / "optionals.json"
 SCHEDULE_FILE = paths.config_dir() / "schedule.json"
@@ -1071,6 +1072,43 @@ def _run_at_load_cron_ids() -> set[str]:
     return ids
 
 
+def _launchd_calendar_weekdays(schedule: dict) -> list[int]:
+    raw = schedule.get("weekdays") or schedule.get("Weekdays")
+    if raw is None and "weekday" in schedule:
+        raw = [schedule.get("weekday")]
+    if raw is None and "Weekday" in schedule:
+        raw = [schedule.get("Weekday")]
+    if isinstance(raw, str):
+        parts = [part.strip() for part in raw.replace("+", ",").split(",")]
+    elif isinstance(raw, (list, tuple, set)):
+        parts = list(raw)
+    else:
+        return []
+    selected: set[int] = set()
+    for part in parts:
+        try:
+            selected.add(int(part) % 7)
+        except Exception:
+            continue
+    if len(selected) >= 7:
+        return []
+    return [day for day in (1, 2, 3, 4, 5, 6, 0) if day in selected]
+
+
+def _launchd_calendar_interval(schedule: dict) -> dict | list[dict]:
+    base = {}
+    if "hour" in schedule:
+        base["Hour"] = schedule["hour"]
+    if "minute" in schedule:
+        base["Minute"] = schedule["minute"]
+    weekdays = _launchd_calendar_weekdays(schedule)
+    if weekdays:
+        if len(weekdays) == 1:
+            return {**base, "Weekday": weekdays[0]}
+        return [{**base, "Weekday": day} for day in weekdays]
+    return base
+
+
 def _launchagent_schedule_expectations() -> dict[str, dict]:
     expectations = {}
     for cron in _enabled_manifest_crons():
@@ -1096,14 +1134,7 @@ def _launchagent_schedule_expectations() -> dict[str, dict]:
             expected["schedule_configured"] = True
         elif "schedule" in cron:
             schedule = resolve_declared_schedule(cron)
-            cal = {}
-            if "hour" in schedule:
-                cal["Hour"] = schedule["hour"]
-            if "minute" in schedule:
-                cal["Minute"] = schedule["minute"]
-            if "weekday" in schedule:
-                cal["Weekday"] = schedule["weekday"]
-            expected["StartCalendarInterval"] = cal
+            expected["StartCalendarInterval"] = _launchd_calendar_interval(schedule)
             expected["RunAtLoad"] = True if should_run_at_load(cron) else None
             expected["schedule_configured"] = True
         elif should_run_at_load(cron):
@@ -3380,6 +3411,7 @@ def check_release_trace_hygiene() -> DoctorCheck:
             evidence=[],
             repair_plan=[],
             escalation_prompt="",
+            category="operator_history",
         )
 
     try:
@@ -3402,6 +3434,7 @@ def check_release_trace_hygiene() -> DoctorCheck:
                     evidence=[],
                     repair_plan=[],
                     escalation_prompt="",
+                    category="operator_history",
                 )
 
             stale_run_samples: list[str] = []
@@ -3465,6 +3498,7 @@ def check_release_trace_hygiene() -> DoctorCheck:
             evidence=[str(exc)],
             repair_plan=["Inspect workflow_goals/workflow_runs state manually"],
             escalation_prompt="Release traces could not be audited, so stale audit artifacts may be hiding in the runtime.",
+            category="operator_history",
         )
 
     evidence = [
@@ -3486,6 +3520,7 @@ def check_release_trace_hygiene() -> DoctorCheck:
                 "Keep workflow/goal state aligned with the real shipped state after releases",
             ],
             escalation_prompt="Audit/release traces drifted away from reality, which makes shipping state look ambiguous.",
+            category="operator_history",
         )
     return DoctorCheck(
         id="runtime.release_trace_hygiene",
@@ -3496,6 +3531,7 @@ def check_release_trace_hygiene() -> DoctorCheck:
         evidence=evidence,
         repair_plan=[],
         escalation_prompt="",
+        category="operator_history",
     )
 
 
@@ -3754,7 +3790,7 @@ def check_automation_telemetry(days: int = 7) -> DoctorCheck:
     status = "healthy"
     severity = "info"
     repair_plan: list[str] = []
-    if usage_coverage < 100.0 and missing_usage_runs > 1:
+    if usage_coverage < AUTOMATION_TELEMETRY_USAGE_WARN_COVERAGE and missing_usage_runs > 1:
         status = "degraded"
         severity = "warn"
         repair_plan.append("Restore backend usage parsing so automation runs always emit token telemetry")
@@ -3933,10 +3969,21 @@ def check_local_index_hygiene(fix: bool = False) -> DoctorCheck:
     try:
         from local_context import api as local_context_api
 
-        try:
-            result = local_context_api.local_index_hygiene(fix=fix, quick=not fix)
-        except TypeError:
-            result = local_context_api.local_index_hygiene(fix=fix)
+        result = None
+        for attempt in range(3):
+            try:
+                try:
+                    result = local_context_api.local_index_hygiene(fix=fix, quick=not fix)
+                except TypeError:
+                    result = local_context_api.local_index_hygiene(fix=fix)
+                break
+            except sqlite3.OperationalError as exc:
+                if "locked" not in str(exc).lower() or attempt >= 2:
+                    raise
+                time.sleep(0.2 * (attempt + 1))
+        if result is None:
+            raise RuntimeError("local_index_hygiene returned no result")
+
         residue = result.get("residue") or {}
         cleanup = result.get("cleanup") or {}
         privacy = result.get("privacy") or {}
@@ -3958,13 +4005,18 @@ def check_local_index_hygiene(fix: bool = False) -> DoctorCheck:
             "privacy_truncated=" + str(privacy_truncated),
         ]
         evidence.extend(f"root={path}" for path in suspect_roots[:5])
-        if residue_total == 0 and privacy_residue_total == 0 and not suspect_roots and not privacy_truncated:
+        if residue_total == 0 and privacy_residue_total == 0 and not suspect_roots:
+            summary = (
+                "Local memory index quick scan found no residue"
+                if privacy_truncated
+                else "Local memory index hygiene is clean"
+            )
             return DoctorCheck(
                 id="runtime.local_index_hygiene",
                 tier="runtime",
                 status="healthy",
                 severity="info",
-                summary="Local memory index hygiene is clean",
+                summary=summary,
                 evidence=evidence,
                 repair_plan=[],
             )

package/src/managed_mcp/__init__.py

@@ -11,7 +11,12 @@ from .catalog import (
     provider_for_capability,
     validate_catalog_lock,
 )
-from .client_config import merge_json_mcp_servers, merge_toml_mcp_servers
+from .client_config import (
+    merge_json_mcp_servers,
+    merge_toml_mcp_servers,
+    remove_json_nexo_managed_mcp_servers,
+    remove_toml_nexo_managed_mcp_servers,
+)
 from .reconcile import managed_mcp_status, reconcile_managed_mcp
 
 __all__ = [
@@ -26,6 +31,8 @@ __all__ = [
     "validate_catalog_lock",
     "merge_json_mcp_servers",
     "merge_toml_mcp_servers",
+    "remove_json_nexo_managed_mcp_servers",
+    "remove_toml_nexo_managed_mcp_servers",
     "managed_mcp_status",
     "reconcile_managed_mcp",
 ]

package/src/managed_mcp/client_config.py

@@ -11,6 +11,47 @@ def _is_nexo_owned(entry: Any) -> bool:
     return isinstance(meta, dict) and meta.get("owner") == "nexo"
 
 
+def _managed_servers_metadata(container: dict[str, Any]) -> dict[str, Any]:
+    nexo_meta = container.get("nexo") if isinstance(container.get("nexo"), dict) else {}
+    managed = nexo_meta.get("managed_mcp") if isinstance(nexo_meta.get("managed_mcp"), dict) else {}
+    servers = managed.get("servers") if isinstance(managed.get("servers"), dict) else {}
+    return servers
+
+
+def _remove_nexo_owned_by_metadata(servers: dict[str, Any], managed_servers: dict[str, Any]) -> None:
+    for name, meta in list(managed_servers.items()):
+        if not (isinstance(meta, dict) and meta.get("owner") == "nexo"):
+            continue
+        current = servers.get(name)
+        if current is None or _is_nexo_owned(current) or name in servers:
+            servers.pop(name, None)
+        managed_servers.pop(name, None)
+
+
+def remove_json_nexo_managed_mcp_servers(payload: dict[str, Any]) -> dict[str, Any]:
+    result = deepcopy(payload) if isinstance(payload, dict) else {}
+    servers = result.get("mcpServers")
+    if not isinstance(servers, dict):
+        return result
+    managed_servers = _managed_servers_metadata(result)
+    for name, entry in list(servers.items()):
+        if _is_nexo_owned(entry):
+            servers.pop(name, None)
+            managed_servers.pop(name, None)
+    _remove_nexo_owned_by_metadata(servers, managed_servers)
+    return result
+
+
+def remove_toml_nexo_managed_mcp_servers(payload: dict[str, Any]) -> dict[str, Any]:
+    result = deepcopy(payload) if isinstance(payload, dict) else {}
+    servers = result.get("mcp_servers")
+    if not isinstance(servers, dict):
+        return result
+    managed_servers = _managed_servers_metadata(result)
+    _remove_nexo_owned_by_metadata(servers, managed_servers)
+    return result
+
+
 def merge_json_mcp_servers(payload: dict[str, Any], entries: dict[str, dict[str, Any]]) -> dict[str, Any]:
     result = deepcopy(payload) if isinstance(payload, dict) else {}
     servers = result.setdefault("mcpServers", {})

package/src/scripts/nexo-watchdog.sh

@@ -23,6 +23,8 @@ LOG_DIR="$NEXO_HOME/runtime/logs"
 [ ! -d "$LOG_DIR" ] && [ -d "$NEXO_HOME/logs" ] && LOG_DIR="$NEXO_HOME/logs"
 DATA_DIR="$NEXO_HOME/runtime/data"
 [ ! -d "$DATA_DIR" ] && [ -d "$NEXO_HOME/data" ] && DATA_DIR="$NEXO_HOME/data"
+COGNITIVE_DIR="$NEXO_HOME/runtime/cognitive"
+[ ! -d "$COGNITIVE_DIR" ] && COGNITIVE_DIR="$DATA_DIR"
 BACKUP_DIR="$NEXO_HOME/runtime/backups"
 [ ! -d "$BACKUP_DIR" ] && [ -d "$NEXO_HOME/backups" ] && BACKUP_DIR="$NEXO_HOME/backups"
 DB_PATH="$DATA_DIR/nexo.db"
@@ -841,8 +843,7 @@ for monitor in "${MONITORS[@]}"; do
             fi
           fi
         elif [ "$age" -gt $(( max_stale * 3 )) ]; then
-          [ "$status" = "PASS" ] && status="WARN"
-          details="${details}In-flight for ${stale_age} (long-running, process alive). "
+          details="${details}In-flight for ${stale_age} (long-running, process alive; observing). "
         else
           details="${details}In-flight (started ${stale_age}). "
         fi
@@ -1206,7 +1207,10 @@ fi
 # --- Cognitive DB check ---
 COG_STATUS="PASS"
 COG_DETAIL=""
-COG_DB="$DATA_DIR/cognitive.db"
+COG_DB="$COGNITIVE_DIR/cognitive.db"
+if [ ! -f "$COG_DB" ] && [ -f "$DATA_DIR/cognitive.db" ]; then
+  COG_DB="$DATA_DIR/cognitive.db"
+fi
 if [ -f "$COG_DB" ]; then
   COG_INT=$(sqlite3 "$COG_DB" "PRAGMA integrity_check;" 2>/dev/null || echo "CORRUPT")
   if [ "$COG_INT" != "ok" ]; then