nexo-brain 7.31.12 → 7.31.13

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.12",
+  "version": "7.31.13",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,7 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.31.12` is the current packaged-runtime line. Patch release over v7.31.11 - Local Memory core hardening (Release A: defensive cosine, stable chunk ids, iCloud dataless handling, performance PRAGMAs) plus an offline-first dependency installer. Version `7.31.11` was a patch release over v7.31.10 - MCP lifecycle robustness + guardrail precision.
+Version `7.31.13` is the current packaged-runtime line. Patch release over v7.31.12 - the offline wheel bundle no longer hard-pins onnxruntime, so cross-platform/offline installs (including older Linux) resolve a compatible native wheel instead of failing. Version `7.31.11` was a patch release over v7.31.10 - MCP lifecycle robustness + guardrail precision.
 
 Previously in `7.31.9`: patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.31.12",
+  "version": "7.31.13",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/hooks/post_tool_use.py

@@ -415,6 +415,73 @@ def check_production_change_log_closeout(payload: dict, sid: str) -> str | None:
     return append_operator_language_contract(message)
 
 
+_SHARED_MUTATION_TOOLS = {
+    "Edit",
+    "Write",
+    "MultiEdit",
+    "NotebookEdit",
+    "apply_patch",
+    "functions.apply_patch",
+}
+_SHARED_PATH_RE = re.compile(
+    r"("
+    r"/Users/[^ \n\r\t'\"]+/Documents/_PhpstormProjects/|"
+    r"/Users/[^ \n\r\t'\"]+/.nexo/core/|"
+    r"/home/nexodesk/|"
+    r"/var/www/|"
+    r"/public_html/|"
+    r"/httpdocs/"
+    r")",
+    re.IGNORECASE,
+)
+_SCOPE_REQUIRED_MARKERS = {
+    "conversation": re.compile(r"\b(conversation|conversaci[oó]n|hilo|thread|email|ticket|mensaje|message|n/a)\b", re.IGNORECASE),
+    "tenant": re.compile(r"\b(tenant|tienda|shop|cuenta|account|cliente|client|n/a)\b", re.IGNORECASE),
+    "language": re.compile(r"\b(idioma|language|lang|locale|es|en|de|fr|pt|it|ca|n/a)\b", re.IGNORECASE),
+    "environment": re.compile(r"\b(entorno|environment|local|runtime|producto|producci[oó]n|production|prod|staging)\b", re.IGNORECASE),
+    "surface": re.compile(r"\b(superficie|surface|api|ui|dominio|domain|web|public)\b", re.IGNORECASE),
+    "deploy": re.compile(r"\b(deploy|despliegue|publicado|published|release|rama|branch|n/a)\b", re.IGNORECASE),
+}
+
+
+def _payload_scope_text(payload: dict) -> str:
+    try:
+        return json.dumps(_tool_input(payload), ensure_ascii=False)
+    except Exception:
+        return str(_tool_input(payload) or "")
+
+
+def _is_shared_mutation_payload(payload: dict) -> bool:
+    tool_name = _tool_name(payload)
+    cmd = _extract_command(payload)
+    input_text = _payload_scope_text(payload)
+    combined = "\n".join(part for part in (tool_name, cmd, input_text) if part)
+    if tool_name in _SHARED_MUTATION_TOOLS and _SHARED_PATH_RE.search(combined):
+        return True
+    if cmd and (_is_production_mutation_command(cmd) or _SHARED_PATH_RE.search(cmd)):
+        return True
+    return False
+
+
+def check_shared_scope_closeout(payload: dict) -> str | None:
+    if not _is_shared_mutation_payload(payload):
+        return None
+    scope_text = _payload_scope_text(payload)
+    missing = [
+        label
+        for label, pattern in _SCOPE_REQUIRED_MARKERS.items()
+        if not pattern.search(scope_text)
+    ]
+    if not missing:
+        return None
+    message = (
+        "Antes de seguir con este cambio compartido, deja fijado el alcance operativo: "
+        "conversación afectada, tenant/tienda, idiomas, entorno, superficie pública y estado de deploy. "
+        "Si algún campo no aplica, márcalo como N/A y continúa con evidencia."
+    )
+    return append_operator_language_contract(message)
+
+
 def _run_auto_capture(payload: dict) -> int:
     """Pipe the tool result into auto_capture for post-output classification."""
     text = _extract_tool_text(payload)
@@ -484,13 +551,20 @@ def main() -> int:
         sid = _resolve_sid_from_payload(payload)
         reminder = check_inbox_and_emit_reminder(sid)
         change_log_message = check_production_change_log_closeout(payload, sid)
+        shared_scope_message = check_shared_scope_closeout(payload)
         g1_message: str | None = None
         try:
             from g1_enforcer import check_response_contract_gate  # type: ignore
             g1_message = check_response_contract_gate(sid)
         except Exception:
             g1_message = None
-        combined = _combine_system_messages(protocol_message, reminder, change_log_message, g1_message)
+        combined = _combine_system_messages(
+            protocol_message,
+            reminder,
+            change_log_message,
+            shared_scope_message,
+            g1_message,
+        )
         if combined:
             print(json.dumps({"systemMessage": combined}))
     except Exception:

package/src/plugins/protocol.py

@@ -1307,6 +1307,58 @@ PUBLIC_RELEASE_WORK_RE = re.compile(
     re.IGNORECASE,
 )
 HIGH_STAKES_WORK_TYPES = {"release", "deploy", "deployment", "publish", "publicar", "desplegar"}
+VISIBLE_RELEASE_SURFACE_PATTERNS = {
+    "api": (
+        re.compile(r"\bapi\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bendpoint(?:s)?\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bruta(?:s)?\b\s*[:=-]", re.IGNORECASE),
+    ),
+    "ui": (
+        re.compile(r"\bui\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bux\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\binterfaz\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bnavegador\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bbrowser\b\s*[:=-]", re.IGNORECASE),
+    ),
+    "dominio_publico": (
+        re.compile(r"\bdominio\s+p[uú]blico\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bpublic\s+domain\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\burl\s+p[uú]blica\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bpublic\s+url\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"https?://[^\s]+", re.IGNORECASE),
+    ),
+    "rama_publicacion": (
+        re.compile(r"\brama\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bbranch\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\borigin/(?:main|master|stable|release|gh-pages)\b", re.IGNORECASE),
+        re.compile(r"\bgh-pages\b", re.IGNORECASE),
+    ),
+    "artefactos": (
+        re.compile(r"\bartefacto(?:s)?\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bartifact(?:s)?\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\b(?:dmg|exe|zip|image|imagen|cloud\s+build|github\s+release)\b", re.IGNORECASE),
+    ),
+    "manifiestos": (
+        re.compile(r"\bmanifiesto(?:s)?\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bmanifest(?:s)?\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\b(?:manifest\.json|update\.json|package\.json|composer\.json)\b", re.IGNORECASE),
+    ),
+    "prueba_viva": (
+        re.compile(r"\bprueba\s+viva\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\blive\s+test\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\bsmoke\b\s*[:=-]", re.IGNORECASE),
+        re.compile(r"\b(?:curl|playwright|logs?\s+vivos?|gcloud\s+logs|http\s*200|200\s+ok)\b", re.IGNORECASE),
+    ),
+}
+VISIBLE_RELEASE_SURFACE_LABELS = {
+    "api": "API",
+    "ui": "UI",
+    "dominio_publico": "dominio público",
+    "rama_publicacion": "rama de publicación",
+    "artefactos": "artefactos",
+    "manifiestos": "manifiestos",
+    "prueba_viva": "prueba viva",
+}
 
 
 def _normalize_artifact_hash(value: str) -> str:
@@ -1344,6 +1396,15 @@ def _has_public_release_evidence(evidence: str) -> bool:
     return bool(PUBLIC_RELEASE_EVIDENCE_RE.search(evidence or ""))
 
 
+def _missing_visible_release_surfaces(evidence: str) -> list[str]:
+    text = evidence or ""
+    missing: list[str] = []
+    for key, patterns in VISIBLE_RELEASE_SURFACE_PATTERNS.items():
+        if not any(pattern.search(text) for pattern in patterns):
+            missing.append(VISIBLE_RELEASE_SURFACE_LABELS[key])
+    return missing
+
+
 def _active_followup_snapshot(limit: int = 5) -> list[dict]:
     try:
         followups = get_followups("active")
@@ -2476,6 +2537,40 @@ def handle_task_close(
             indent=2,
         )
 
+    if clean_outcome == "done" and _is_high_stakes_public_work(task, work_type, stakes, closure_text):
+        missing_surfaces = _missing_visible_release_surfaces(live_surface_evidence)
+        if missing_surfaces:
+            debt = _ensure_open_debt(
+                task["session_id"],
+                task_id,
+                "visible_release_surface_matrix_incomplete",
+                severity="error",
+                evidence=(
+                    "Visible release/deploy/fix close lacked the full evidence matrix. "
+                    f"Missing surfaces: {', '.join(missing_surfaces)}. "
+                    f"Evidence provided: {live_surface_evidence[:240]!r}"
+                ),
+                debts=debts_created,
+            )
+            return json.dumps(
+                {
+                    "ok": False,
+                    "error": "Cannot close visible release/deploy/fix as done without the full surface evidence matrix.",
+                    "hint": (
+                        "Enumerate API, UI, public domain, publication branch, artifacts, manifests, "
+                        "and live test evidence. Use N/A only for a surface that truly does not exist."
+                    ),
+                    "task_id": task_id,
+                    "blocked_by": "visible_release_surface_matrix",
+                    "debt_id": debt.get("id"),
+                    "debt_type": "visible_release_surface_matrix_incomplete",
+                    "missing_surfaces": missing_surfaces,
+                    "response_mode": "verify",
+                },
+                ensure_ascii=False,
+                indent=2,
+            )
+
     if task.get("guard_has_blocking") and not files_changed_list:
         open_task_debts = list_protocol_debts(status="open", task_id=task_id, limit=200)
         has_guard_touch_violation = any(

package/src/requirements.txt

@@ -17,15 +17,19 @@ anthropic>=0.80.0
 openai>=2.20.0
 
 # Embedding model (optional but recommended for cognitive features).
-# Hard-pinned (==) so the offline wheel bundle (fetch-python-wheels.sh) is
-# reproducible across Win+Mac. onnxruntime is fastembed's transitive native
-# wheel — the fragile, platform-specific one — so it is pinned explicitly too;
-# floating it lets pip resolve an unbundled build and break offline installs.
-# >=0.8.0 was the floor (older releases need Python <3.12 and pip iterates each
-# obsolete version for ~10 min on Ubuntu 24.04 before finding a compatible one,
-# verified during Win11 clean install bootstrap); 0.8.0 is the bundled version.
+# fastembed is hard-pinned (==) so the offline wheel bundle is reproducible; it is
+# pure-python (py3-none-any) so the pin holds on every platform. >=0.8.0 was the
+# floor (older releases need Python <3.12 and pip iterates each obsolete version for
+# ~10 min on Ubuntu 24.04 before finding a compatible one, verified during Win11
+# clean install bootstrap); 0.8.0 is the bundled version.
+#
+# onnxruntime (fastembed's native transitive dep) is deliberately NOT hard-pinned:
+# its wheels are platform/glibc-specific — e.g. 1.26 only ships for manylinux_2_28,
+# while the offline bundle also targets manylinux_2_17/2014 (which cap at 1.19.2).
+# A `==` pin can't be satisfied for every target and breaks BOTH the cross-platform
+# wheel bundle and installs on older Linux. Let fastembed/pip resolve the best
+# onnxruntime wheel per platform.
 fastembed==0.8.0
-onnxruntime==1.26.0
 
 # Local Context Layer — document parsers (REQUIRED for the local memory index).
 # extractors.py imports these lazily; without them a clean bundle silently indexes