nexo-brain 7.31.10 → 7.31.12

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.10",
+  "version": "7.31.12",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.31.10` is the current packaged-runtime line. Patch release over v7.31.9 - Local Memory search now downranks boilerplate emails when stronger documents match the same query.
+Version `7.31.12` is the current packaged-runtime line. Patch release over v7.31.11 - Local Memory core hardening (Release A: defensive cosine, stable chunk ids, iCloud dataless handling, performance PRAGMAs) plus an offline-first dependency installer. Version `7.31.11` was a patch release over v7.31.10 - MCP lifecycle robustness + guardrail precision.
 
 Previously in `7.31.9`: patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
 

package/bin/nexo-brain.js

@@ -4103,6 +4103,19 @@ async function runSetup() {
     log("Try manually: python3 -m venv ~/.nexo/.venv && ~/.nexo/.venv/bin/pip install -r src/requirements.txt");
     process.exit(1);
   }
+  // Mirror the bundled wheels into NEXO_HOME so the Python runtime (startup
+  // self-heal, update, cron) can reinstall any missing dep OFFLINE later, with no
+  // access to the Desktop bundle path. auto_update._bundled_wheels_dir() looks in
+  // <NEXO_HOME>/runtime/python-wheels. Works for WSL (linux) and macOS.
+  try {
+    if (fs.existsSync(bundledWheelsDir)) {
+      const runtimeWheels = path.join(NEXO_HOME, "runtime", "python-wheels");
+      fs.mkdirSync(runtimeWheels, { recursive: true });
+      fs.cpSync(bundledWheelsDir, runtimeWheels, { recursive: true });
+    }
+  } catch (e) {
+    log("  (note) could not mirror bundled wheels into runtime: " + (e && e.message));
+  }
   // Update python reference to use venv python for the rest of setup
   if (fs.existsSync(venvPython)) {
     python = venvPython;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.10",
+  "version": "7.31.12",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/auto_update.py

@@ -1058,8 +1058,46 @@ def _ensure_runtime_venv(runtime_root: Path = NEXO_HOME) -> Path | None:
     return None
 
 
+def _bundled_wheels_dir() -> "Path | None":
+    """Locate the bundled Python wheels for offline install.
+
+    Priority: explicit NEXO_BUNDLED_WHEELS_DIR (set by the Desktop bundle) →
+    a canonical runtime copy under NEXO_HOME. Returns the dir only if it holds
+    at least one .whl, else None (caller falls back to PyPI).
+    """
+    candidates = []
+    env_dir = os.environ.get("NEXO_BUNDLED_WHEELS_DIR", "").strip()
+    if env_dir:
+        candidates.append(Path(env_dir).expanduser())
+    candidates.append(NEXO_HOME / "runtime" / "python-wheels")
+    for directory in candidates:
+        try:
+            if directory.is_dir() and any(directory.glob("*.whl")):
+                return directory
+        except Exception:
+            continue
+    return None
+
+
+def _pip_install_argv(pip_bin, req_file, *, wheels_dir=None, use_python_m=False, break_system=False) -> list:
+    """Build a pip install argv. Offline (--no-index --find-links) when wheels_dir is set."""
+    argv = [str(pip_bin)]
+    if use_python_m:
+        argv += ["-m", "pip"]
+    argv += ["install", "--quiet", "-r", str(req_file)]
+    if wheels_dir is not None:
+        argv += ["--no-index", "--find-links", str(wheels_dir)]
+    if break_system:
+        argv.append("--break-system-packages")
+    return argv
+
+
 def _reinstall_pip_deps() -> bool:
-    """Reinstall Python deps from requirements.txt. Returns True on success."""
+    """Reinstall Python deps from requirements.txt. Returns True on success.
+
+    Prefers the bundled wheels (offline) so a user with no internet still gets a
+    self-repairing runtime; falls back to PyPI if the bundle can't satisfy it.
+    """
     req_file = SRC_DIR / "requirements.txt"
     if not req_file.exists():
         return True
@@ -1069,24 +1107,32 @@ def _reinstall_pip_deps() -> bool:
         alt_pip = NEXO_HOME / ".venv" / "bin" / "pip3"
         if alt_pip.exists():
             venv_pip = alt_pip
+    wheels_dir = _bundled_wheels_dir()
+    # Large wheel sets / slow links need more than the old 120s.
+    timeout_s = 600
+    use_python_m = not venv_pip.exists()
+    if use_python_m and desktop_product_requested():
+        _log(f"managed venv unavailable for Desktop dependency repair: {venv_python}")
+        return False
+    pip_bin = venv_pip if venv_pip.exists() else sys.executable
     try:
-        if venv_pip.exists():
-            result = subprocess.run(
-                [str(venv_pip), "install", "--quiet", "-r", str(req_file)],
-                capture_output=True, text=True, timeout=120,
-            )
-        elif not desktop_product_requested():
-            result = subprocess.run(
-                [sys.executable, "-m", "pip", "install", "--quiet", "-r", str(req_file), "--break-system-packages"],
-                capture_output=True, text=True, timeout=120,
+        argv = _pip_install_argv(
+            pip_bin, req_file, wheels_dir=wheels_dir,
+            use_python_m=use_python_m, break_system=use_python_m,
+        )
+        result = subprocess.run(argv, capture_output=True, text=True, timeout=timeout_s)
+        if result.returncode != 0 and wheels_dir is not None:
+            # Offline set couldn't satisfy it (missing/incompatible wheel) → retry online.
+            _log(f"offline pip install failed, retrying via PyPI: {result.stderr or result.stdout}")
+            argv_online = _pip_install_argv(
+                pip_bin, req_file, wheels_dir=None,
+                use_python_m=use_python_m, break_system=use_python_m,
             )
-        else:
-            _log(f"managed venv unavailable for Desktop dependency repair: {venv_python}")
-            return False
+            result = subprocess.run(argv_online, capture_output=True, text=True, timeout=timeout_s)
         if result.returncode != 0:
             _log(f"pip install failed (exit {result.returncode}): {result.stderr or result.stdout}")
             return False
-        _log("Reinstalled Python dependencies after update")
+        _log("Reinstalled Python dependencies" + (" (offline)" if wheels_dir is not None else ""))
         return True
     except Exception as e:
         _log(f"pip reinstall failed: {e}")
@@ -6107,6 +6153,18 @@ def startup_preflight(*, entrypoint: str, interactive: bool = False) -> dict:
             result["actions"].extend(extra_actions)
             if reconcile_message:
                 _log(reconcile_message)
+            # Self-heal: if the managed venv lost a critical importable module
+            # (e.g. pypdf -> PDFs indexed empty), reinstall it automatically. No
+            # user action, no prompt — the runtime repairs itself on startup.
+            try:
+                from doctor.providers.boot import check_managed_venv_modules
+
+                dep_check = check_managed_venv_modules(fix=True)
+                if getattr(dep_check, "fixed", False):
+                    result["actions"].append("venv-deps-repaired")
+                    _log(f"Managed venv dependencies repaired on startup: {dep_check.summary}")
+            except Exception as dep_exc:
+                _log(f"managed venv module check skipped: {dep_exc}")
         except Exception as e:
             result["error"] = str(e)
             _write_update_summary(result)

package/src/doctor/providers/boot.py

@@ -654,6 +654,99 @@ def check_managed_venv_python(fix: bool = False) -> DoctorCheck:
     )
 
 
+# Critical importable modules the managed venv must always have. A missing one
+# fails silently (e.g. pypdf absent -> every PDF/XLSX/MSG indexed as empty text).
+# Verified by importing INSIDE the managed venv, not the current interpreter.
+MANAGED_VENV_REQUIRED_MODULES = (
+    "fastmcp",
+    "numpy",
+    "anthropic",
+    "openai",
+    "fastembed",
+    "pypdf",
+    "openpyxl",
+    "extract_msg",
+)
+
+
+def _missing_venv_modules(venv_python: Path | str, modules) -> list[str]:
+    """Return the subset of ``modules`` that ``venv_python`` cannot import."""
+    mods = [str(m) for m in modules if str(m).strip()]
+    if not mods:
+        return []
+    probe = (
+        "import importlib.util as u, sys\n"
+        "print('\\n'.join(m for m in sys.argv[1:] if u.find_spec(m) is None))"
+    )
+    try:
+        result = subprocess.run(
+            [str(venv_python), "-c", probe, *mods],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+    except Exception:
+        return []
+    if result.returncode != 0:
+        return []
+    return [line.strip() for line in (result.stdout or "").splitlines() if line.strip()]
+
+
+def _repair_managed_venv_deps() -> bool:
+    try:
+        import auto_update
+
+        return bool(auto_update._reinstall_pip_deps())
+    except Exception:
+        return False
+
+
+def check_managed_venv_modules(fix: bool = False) -> DoctorCheck:
+    """Ensure the managed venv has every critical importable module.
+
+    A missing optional parser (pypdf/openpyxl/extract_msg) makes the local index
+    read PDF/XLSX/MSG as empty, silently. With ``fix=True`` (run automatically on
+    startup preflight) this reinstalls them, so the runtime repairs itself with no
+    user action.
+    """
+    venv_python = _managed_venv_python_path()
+    if not venv_python.exists():
+        # The python-version check already reports a missing venv; stay quiet here.
+        return DoctorCheck(
+            id="boot.managed_venv_modules",
+            tier="boot",
+            status="healthy",
+            severity="info",
+            summary="Managed Python venv not present yet",
+            evidence=[str(venv_python)],
+        )
+    missing = _missing_venv_modules(venv_python, MANAGED_VENV_REQUIRED_MODULES)
+    if not missing:
+        return DoctorCheck(
+            id="boot.managed_venv_modules",
+            tier="boot",
+            status="healthy",
+            severity="info",
+            summary=f"All {len(MANAGED_VENV_REQUIRED_MODULES)} critical venv modules present",
+            evidence=[str(venv_python)],
+        )
+    if fix and _repair_managed_venv_deps():
+        post = check_managed_venv_modules(fix=False)
+        if post.status == "healthy":
+            post.fixed = True
+            post.summary += " (repaired missing modules)"
+            return post
+    return DoctorCheck(
+        id="boot.managed_venv_modules",
+        tier="boot",
+        status="degraded",
+        severity="warn",
+        summary=f"{len(missing)} critical venv module(s) missing: {', '.join(missing)}",
+        evidence=[str(venv_python), *missing],
+        repair_plan=["Run nexo doctor --tier boot --fix or nexo update to reinstall managed dependencies"],
+    )
+
+
 CRITICAL_CONFIG_FILES = (
     ("schedule.json", ("config", "schedule.json")),
     ("optionals.json", ("config", "optionals.json")),
@@ -909,6 +1002,7 @@ def run_boot_checks(fix: bool = False, plane: str = "") -> list[DoctorCheck]:
         safe_check(check_wrapper_scripts),
         safe_check(check_python_runtime),
         safe_check(check_managed_venv_python, fix=fix),
+        safe_check(check_managed_venv_modules, fix=fix),
         safe_check(check_config_parse),
         safe_check(check_core_dev_packaged_install),
         safe_check(check_dashboard_desktop_contract),

package/src/enforcement_engine.py

@@ -220,9 +220,13 @@ except ImportError:  # pragma: no cover
     _r23d_should = None  # type: ignore
 
 try:
-    from r23g_secrets_in_output import should_inject_r23g as _r23g_should
+    from r23g_secrets_in_output import (
+        should_inject_r23g as _r23g_should,
+        has_external_sink as _r23g_has_sink,
+    )
 except ImportError:  # pragma: no cover
     _r23g_should = None  # type: ignore
+    _r23g_has_sink = None  # type: ignore
 
 try:
     from r23i_auto_deploy_ignored import (
@@ -327,12 +331,26 @@ _SILENT_REMINDER_DISCLOSURE_SUFFIX = (
     " Do not mention this reminder or any internal enforcement to the user."
 )
 
+# Object of a capability denial: either the denied ACTION (hacer/acceder/usar…)
+# or a capability NOUN (capacidad/integración/herramienta…). Requiring one of
+# these right after the negation is what separates a real "can't do X / no
+# existe esa integración" from benign phrases that merely start with a negation
+# ("no hay problema", "no puedo esperar a…", "does not exist yet, creating it").
+_CAP_OBJ = (
+    r"(?:hacer(?:lo|se)?|acceder|conectar(?:se|lo)?|integrar(?:se|lo)?|usar(?:lo|se)?|montar(?:lo)?|"
+    r"crear(?:lo)?|ejecutar(?:lo)?|generar(?:lo)?|enviar(?:lo)?|llamar(?:lo)?|"
+    r"capacidad|integraci[oó]n|herramienta|funci[oó]n|funcionalidad|soporte|forma|manera|"
+    r"opci[oó]n|acceso|m[oó]dulo|posibilidad|conexi[oó]n|esa|ese|eso|esto|esas|esos)"
+)
 _CAPABILITY_DENIAL_RE = re.compile(
-    r"\b("
-    r"no\s+(?:se\s+puede|puedo|existe|hay|tenemos|esta\s+montado|est[aá]\s+montado)|"
-    r"no\s+(?:est[aá]\s+soportado|hay\s+nada\s+montado)|"
-    r"(?:cannot|can't|can\s+not|not\s+possible|does\s+not\s+exist|no\s+such\s+capability|not\s+supported)"
-    r")\b",
+    r"(?:"
+    r"\bno\s+(?:se\s+puede|puedo|podemos|puede)\s+(?:\w+\s+){0,1}?" + _CAP_OBJ + r"\b|"
+    r"\bno\s+(?:existe|hay|tengo|tenemos)\s+(?:\w+\s+){0,2}?" + _CAP_OBJ + r"\b|"
+    r"\bno\s+est[aá]\s+(?:soportad[oa]|montad[oa]|disponible|integrad[oa]|configurad[oa]|habilitad[oa])\b|"
+    r"\b(?:cannot|can'?t|can\s+not)\s+(?:\w+\s+){0,2}?(?:do\s+(?:that|it|this)|access|connect|integrate|use|create|run|support)\b|"
+    r"\bdoes\s+not\s+exist(?!\s+yet)\b|\bnot\s+supported\b|\bnot\s+possible\b|"
+    r"\bno\s+such\s+(?:capability|tool|integration|feature)\b"
+    r")",
     re.IGNORECASE,
 )
 _CAPABILITY_REALITY_TOOLS = {
@@ -1914,21 +1932,30 @@ class HeadlessEnforcer:
         if not should:
             return
         if mode == "shadow":
+            # shadow → logs only. No enqueue, no followup, no side effects.
             _logger.info("[R23g SHADOW] would inject")
-            self._ensure_exposed_credential_followup(tool_input, reason="R23g shadow")
             return
         self._enqueue(prompt, "R23g_secrets_in_output", rule_id="R23g_secrets_in_output")
-        self._ensure_exposed_credential_followup(tool_input, reason="R23g detected secret exposure risk")
+        self._ensure_exposed_credential_followup(tool_input)
         _logger.info("[R23g %s] enqueued", mode.upper())
 
-    def _ensure_exposed_credential_followup(self, tool_input, *, reason: str) -> None:
+    def _ensure_exposed_credential_followup(self, tool_input) -> None:
         if not isinstance(tool_input, dict):
             return
         cmd = tool_input.get("command")
         if not isinstance(cmd, str) or not cmd.strip():
             return
+        # A critical "rotate the credential" followup is only warranted when the
+        # secret is actually exfiltrated to a third party. A bare local read
+        # (cat .env, env, printenv) exposes nothing and must NOT mint an
+        # un-closeable critical followup. The soft reminder above already nudges
+        # the agent; the persistent debt is reserved for real exposure.
+        if _r23g_has_sink is None or not _r23g_has_sink(cmd):
+            return
         safe_cmd = _redact_for_log(cmd, max_len=160)
-        followup_id = _security_followup_id(f"{reason}:{safe_cmd}")
+        # Deterministic id seeded only by the (redacted) command, so the same
+        # exfiltration dedups across shadow/soft/hard instead of duplicating.
+        followup_id = _security_followup_id(safe_cmd)
         try:
             from db import create_followup, get_followup  # type: ignore
 
@@ -1937,7 +1964,7 @@ class HeadlessEnforcer:
             create_followup(
                 followup_id,
                 description=(
-                    "SEGURIDAD: credencial expuesta o en riesgo detectada por el guard. "
+                    "SEGURIDAD: credencial expuesta a un tercero detectada por el guard. "
                     f"Origen: {safe_cmd}. Rotar/revocar la credencial y sustituirla en el gestor seguro."
                 ),
                 date=time.strftime("%Y-%m-%d"),
@@ -1945,7 +1972,7 @@ class HeadlessEnforcer:
                     "Cierre solo con evidencia de revocación efectiva: llamada/API/HTTP 401 para la credencial antigua "
                     "o comprobación oficial equivalente, más nueva ubicación segura registrada."
                 ),
-                reasoning=reason,
+                reasoning="R23g detected secret exfiltration to a third party",
                 priority="critical",
                 internal=1,
                 owner="agent",

package/src/hooks/post_tool_use.py

@@ -244,8 +244,8 @@ def _is_production_mutation_command(cmd: str) -> bool:
         r"\bgcloud\s+run\s+(?:deploy|services\s+update|jobs\s+deploy|jobs\s+update)\b",
         r"\bgcloud\s+dns\s+record-sets\s+transaction\s+execute\b",
         r"\bg(?:sutil|cloud\s+storage)\b.*\b(?:cp|rsync)\b.*\b(?:release|stable|cdn|bucket|buckets)\b",
-        r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot)\b",
-        r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/)[^'\"]*['\"]",
+        r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot|home/nexodesk)\b",
+        r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/|/home/nexodesk)[^'\"]*['\"]",
         r"\b(?:whmapi1|uapi|cpapi2)\b",
         r"\b(?:cloudflare|cfcli)\b.*\b(?:dns|record)\b.*\b(?:create|delete|update|patch|put|post)\b",
         r"\bcurl\b(?=.*api\.cloudflare\.com/client/v4/zones/.*/dns_records)(?=.*(?:-X|--request)\s*(?:POST|PUT|PATCH|DELETE)\b)",

package/src/hooks/stop.py

@@ -18,14 +18,24 @@ from pathlib import Path
 
 _DIR = Path(__file__).resolve().parent
 
+# Specific future-commitment phrases. Bare words like "pendiente" / "después"
+# were removed: they appear constantly in ordinary conversation and, read over a
+# GLOBAL rolling buffer, blocked closes spuriously. Each marker now expresses a
+# real deferral, not an incidental adverb.
 FUTURE_COMMITMENT_MARKERS = (
     "lo dejo como seguimiento",
-    "cuando quieras",
-    "pendiente",
     "lo cojo aparte",
-    "después",
-    "despues",
     "bloqueado por auth",
+    "queda pendiente de",
+    "lo dejo pendiente",
+    "lo retomo más tarde",
+    "lo retomo mas tarde",
+    "lo vemos en otra sesión",
+    "lo vemos en otra sesion",
+    "te lo dejo para después",
+    "te lo dejo para despues",
+    "lo dejo para más tarde",
+    "lo dejo para mas tarde",
 )
 FOLLOWUP_CREATE_MARKERS = ("nexo_followup_create", "mcp__nexo__nexo_followup_create")
 PARTIAL_TASK_CLOSE_RE = re.compile(
@@ -78,6 +88,42 @@ def _read_recent_lines(path: Path, max_lines: int = 800) -> list[str]:
         return []
 
 
+def _line_session_id(raw_line: str) -> str:
+    try:
+        payload = json.loads(raw_line)
+    except Exception:
+        return ""
+    if not isinstance(payload, dict):
+        return ""
+    for key in ("session_id", "sid", "claude_session_id", "sessionId"):
+        val = payload.get(key)
+        if isinstance(val, str) and val.strip():
+            return val.strip()
+    return ""
+
+
+def _scope_to_session(lines: list[str], sid: str) -> list[str]:
+    """Keep only buffer lines belonging to ``sid``. ``session_buffer.jsonl`` is a
+    GLOBAL rolling log shared by every session/client, so without scoping the
+    closeout gate counts *other* sessions' commitments and blocks this close
+    spuriously. If the buffer carries no session ids at all we cannot scope and
+    fall back to every line (prior behaviour)."""
+    if not sid:
+        return lines
+    tagged = [(raw, _line_session_id(raw)) for raw in lines]
+    if not any(s for _, s in tagged):
+        return lines
+    return [raw for raw, s in tagged if s == sid]
+
+
+def _current_session_id() -> str:
+    for key in ("CLAUDE_SESSION_ID", "NEXO_SID", "NEXO_SESSION_ID"):
+        val = os.environ.get(key, "").strip()
+        if val:
+            return val
+    return ""
+
+
 def _line_text(line: str) -> str:
     try:
         payload = json.loads(line)
@@ -133,8 +179,11 @@ def check_closeout_followups() -> dict:
         if chunk:
             lines.extend(chunk)
             sources.append(str(path))
+    sid = _current_session_id()
+    lines = _scope_to_session(lines, sid)
     result = scan_closeout_followup_gaps(lines)
     result["sources"] = sources
+    result["session_scoped"] = bool(sid)
     return result