nexo-brain 7.31.4 → 7.31.7

package/src/hooks/post_tool_use.py

@@ -20,6 +20,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import subprocess
 import sys
 import time
@@ -180,16 +181,240 @@ def _extract_tool_text(payload: dict) -> str:
         return result
     if isinstance(result, dict):
         content = result.get("content") or result.get("output") or result.get("text") or ""
-        if isinstance(content, str):
+        if isinstance(content, str) and content.strip():
             return content
         if isinstance(content, list):
             return "\n".join(
                 str(item.get("text", "")) if isinstance(item, dict) else str(item)
                 for item in content
             )
+    fallback_parts = []
+    for key in ("tool_response", "output", "stdout", "stderr"):
+        value = payload.get(key)
+        if isinstance(value, str) and value.strip():
+            fallback_parts.append(value)
+    if fallback_parts:
+        return "\n".join(fallback_parts)
     return ""
 
 
+def _tool_name(payload: dict) -> str:
+    return str(payload.get("tool_name") or payload.get("name") or "").strip()
+
+
+def _tool_input(payload: dict) -> dict:
+    for key in ("tool_input", "input", "arguments"):
+        value = payload.get(key)
+        if isinstance(value, dict):
+            return value
+    return {}
+
+
+def _production_closeout_dir() -> Path:
+    try:
+        import paths  # type: ignore
+
+        root = paths.operations_dir()
+    except Exception:
+        root = _NEXO_HOME / "runtime" / "operations"
+    path = root / "protocol-closeout"
+    path.mkdir(parents=True, exist_ok=True)
+    return path
+
+
+def _pending_change_log_path(sid: str) -> Path:
+    safe_sid = "".join(ch if ch.isalnum() or ch in "-_" else "_" for ch in (sid or "unknown"))
+    return _production_closeout_dir() / f"change-log-required-{safe_sid}.json"
+
+
+def _extract_command(payload: dict) -> str:
+    tool_input = _tool_input(payload)
+    for key in ("command", "cmd", "script"):
+        value = tool_input.get(key)
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+    return ""
+
+
+def _is_production_mutation_command(cmd: str) -> bool:
+    patterns = (
+        r"\bgit\s+push\b(?!.*--dry-run)(?=.*\b(?:origin\s+)?(?:main|master|stable|release)\b)",
+        r"\bgcloud\s+builds\s+submit\b",
+        r"\bgcloud\s+builds\s+triggers\s+run\b",
+        r"\bgcloud\s+run\s+(?:deploy|services\s+update|jobs\s+deploy|jobs\s+update)\b",
+        r"\bgcloud\s+dns\s+record-sets\s+transaction\s+execute\b",
+        r"\bg(?:sutil|cloud\s+storage)\b.*\b(?:cp|rsync)\b.*\b(?:release|stable|cdn|bucket|buckets)\b",
+        r"\b(?:rsync|scp)\b(?!.*--dry-run).+\s+\S+:(?:/[^ \n\r;]*)(?:public_html|httpdocs|www|webroot)\b",
+        r"\bssh\b[^'\"]*['\"][^'\"]*(?:sed\s+-i|tee\s+|>\s*\S|>>\s*\S|rm\s+-|mv\s+|cp\s+)[^'\"]*(?:public_html|httpdocs|/var/www|/opt/)[^'\"]*['\"]",
+        r"\b(?:whmapi1|uapi|cpapi2)\b",
+        r"\b(?:cloudflare|cfcli)\b.*\b(?:dns|record)\b.*\b(?:create|delete|update|patch|put|post)\b",
+        r"\bcurl\b(?=.*api\.cloudflare\.com/client/v4/zones/.*/dns_records)(?=.*(?:-X|--request)\s*(?:POST|PUT|PATCH|DELETE)\b)",
+        r"\bcws-upload(?:\.sh)?\b.*\bpublish\b",
+        r"\bnpm\s+publish\b",
+    )
+    return any(re.search(pattern, cmd, re.IGNORECASE | re.DOTALL) for pattern in patterns)
+
+
+_WEBROOT_BACKUP_RE = re.compile(
+    r"https?://[^\s'\"<>]+(?:\.php\.(?:bak|old|new)|\.(?:bak|old|new|sql|zip|tar|tgz|gz|env))(?:[?#][^\s'\"<>]*)?",
+    re.IGNORECASE,
+)
+_HTTP_200_RE = re.compile(r"\b(?:HTTP/\d(?:\.\d)?\s+200|200\s+OK|http_code\s*=\s*200|status\s*[:=]\s*200)\b", re.IGNORECASE)
+_SECRET_MARKER_RE = re.compile(
+    r"\b(?:OPENAI_API_KEY|DB_PASSWORD|DB_USERNAME|MYSQL_PASSWORD|SHOPIFY_TOKEN|STRIPE_SECRET|"
+    r"api[_-]?key|secret|password|Bearer\s+[A-Za-z0-9._-]{12,}|sk_(?:live|test)_[A-Za-z0-9]+|sk-proj-[A-Za-z0-9_-]+)\b",
+    re.IGNORECASE,
+)
+
+
+def _served_backup_secret_signal(payload: dict) -> dict | None:
+    text = "\n".join(part for part in (_extract_command(payload), _extract_tool_text(payload)) if part)
+    if not text:
+        return None
+    match = _WEBROOT_BACKUP_RE.search(text)
+    if not match:
+        return None
+    if not _HTTP_200_RE.search(text):
+        return None
+    if not _SECRET_MARKER_RE.search(text):
+        return None
+    return {"url": match.group(0)[:240]}
+
+
+def _security_followup_id(seed: str) -> str:
+    import hashlib
+
+    digest = hashlib.sha1(seed.encode("utf-8", errors="ignore"), usedforsecurity=False).hexdigest()[:8].upper()
+    return f"NF-SECURITY-WEBROOT-BACKUP-ROTATE-{digest}"
+
+
+def _ensure_webroot_backup_rotation_followup(payload: dict, sid: str) -> str | None:
+    signal = _served_backup_secret_signal(payload)
+    if not signal:
+        return None
+    followup_id = _security_followup_id(f"{sid}:{signal['url']}")
+    try:
+        from db import create_followup, get_followup  # type: ignore
+
+        if not get_followup(followup_id):
+            create_followup(
+                followup_id,
+                description=(
+                    "SEGURIDAD: canary HTTP detectó un backup o artefacto temporal servible desde webroot "
+                    f"con marcador de secreto ({signal['url']}). Rotar/revocar los secretos expuestos, "
+                    "mover el artefacto fuera del webroot y dejar bloqueo/canary verificado."
+                ),
+                date=time.strftime("%Y-%m-%d"),
+                verification=(
+                    "Cierre solo con HTTP público ya no servible (404/403), evidencia de revocación/rotación "
+                    "de la credencial antigua y nueva ubicación segura registrada."
+                ),
+                reasoning="post_tool_use webroot backup canary detected served secret",
+                priority="critical",
+                internal=1,
+                owner="agent",
+            )
+    except Exception:
+        return None
+    return followup_id
+
+
+def _is_change_log_tool(tool_name: str) -> bool:
+    return tool_name in {"nexo_change_log", "mcp__nexo__nexo_change_log"}
+
+
+def _is_task_close_tool(tool_name: str) -> bool:
+    return tool_name in {"nexo_task_close", "mcp__nexo__nexo_task_close"}
+
+
+def _task_close_payload_has_change_trace(payload: dict) -> bool:
+    tool_input = _tool_input(payload)
+    files = str(tool_input.get("files_changed") or "").strip()
+    what = str(tool_input.get("change_summary") or tool_input.get("summary") or "").strip()
+    why = str(tool_input.get("change_why") or tool_input.get("triggered_by") or "").strip()
+    return bool(files and what and why)
+
+
+def _queue_change_log_from_task_close(payload: dict, sid: str, pending: dict) -> bool:
+    if not _task_close_payload_has_change_trace(payload):
+        return False
+    try:
+        from mcp_write_queue import enqueue_write  # type: ignore
+    except Exception:
+        return False
+    tool_input = _tool_input(payload)
+    queued = enqueue_write(
+        "change_log",
+        {
+            "session_id": sid,
+            "files": str(tool_input.get("files_changed") or ""),
+            "what_changed": str(tool_input.get("change_summary") or tool_input.get("summary") or ""),
+            "why": str(tool_input.get("change_why") or tool_input.get("triggered_by") or pending.get("command") or ""),
+            "triggered_by": str(tool_input.get("triggered_by") or pending.get("triggered_by") or "post_tool_use production mutation"),
+            "affects": str(tool_input.get("change_summary") or ""),
+            "risks": str(tool_input.get("change_risks") or ""),
+            "verify": str(tool_input.get("change_verify") or tool_input.get("verification") or tool_input.get("evidence") or ""),
+            "commit_ref": str(tool_input.get("commit_ref") or ""),
+        },
+        priority="high",
+    )
+    return bool(queued.get("accepted"))
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except Exception:
+        return {}
+
+
+def _write_json(path: Path, payload: dict) -> None:
+    tmp = path.with_suffix(path.suffix + f".tmp-{os.getpid()}")
+    tmp.write_text(json.dumps(payload, ensure_ascii=False, sort_keys=True) + "\n", encoding="utf-8")
+    tmp.replace(path)
+
+
+def check_production_change_log_closeout(payload: dict, sid: str) -> str | None:
+    if not sid:
+        sid = "unknown"
+    tool_name = _tool_name(payload)
+    pending_path = _pending_change_log_path(sid)
+    rotation_followup_id = _ensure_webroot_backup_rotation_followup(payload, sid)
+    if _is_change_log_tool(tool_name):
+        pending_path.unlink(missing_ok=True)
+        return None
+
+    cmd = _extract_command(payload)
+    if cmd and _is_production_mutation_command(cmd):
+        _write_json(
+            pending_path,
+            {
+                "sid": sid,
+                "command": cmd[:500],
+                "tool_name": tool_name,
+                "created_at": time.time(),
+                "triggered_by": "PostToolUse production mutation detector",
+            },
+        )
+
+    pending = _read_json(pending_path)
+    if not pending:
+        return None
+
+    if _is_task_close_tool(tool_name) and _queue_change_log_from_task_close(payload, sid, pending):
+        pending_path.unlink(missing_ok=True)
+        return None
+
+    message = (
+        "Cierre pendiente: se detectó una señal de despliegue/publicación de producción y todavía no consta "
+        "`nexo_change_log(...)` ni un `nexo_task_close(...)` con archivos, motivo y verificación suficiente. "
+        "Registra el cambio antes de declarar la tarea cerrada."
+    )
+    if rotation_followup_id:
+        message += f" Además, el canary webroot creó el followup de rotación {rotation_followup_id}."
+    return append_operator_language_contract(message)
+
+
 def _run_auto_capture(payload: dict) -> int:
     """Pipe the tool result into auto_capture for post-output classification."""
     text = _extract_tool_text(payload)
@@ -258,13 +483,14 @@ def main() -> int:
     try:
         sid = _resolve_sid_from_payload(payload)
         reminder = check_inbox_and_emit_reminder(sid)
+        change_log_message = check_production_change_log_closeout(payload, sid)
         g1_message: str | None = None
         try:
             from g1_enforcer import check_response_contract_gate  # type: ignore
             g1_message = check_response_contract_gate(sid)
         except Exception:
             g1_message = None
-        combined = _combine_system_messages(protocol_message, reminder, g1_message)
+        combined = _combine_system_messages(protocol_message, reminder, change_log_message, g1_message)
         if combined:
             print(json.dumps({"systemMessage": combined}))
     except Exception:

package/src/hooks/stop.py

@@ -8,6 +8,8 @@ without rewriting ~200 lines of working bash.
 from __future__ import annotations
 
 import os
+import json
+import re
 import subprocess
 import sys
 import time
@@ -16,6 +18,21 @@ from pathlib import Path
 
 _DIR = Path(__file__).resolve().parent
 
+FUTURE_COMMITMENT_MARKERS = (
+    "lo dejo como seguimiento",
+    "cuando quieras",
+    "pendiente",
+    "lo cojo aparte",
+    "después",
+    "despues",
+    "bloqueado por auth",
+)
+FOLLOWUP_CREATE_MARKERS = ("nexo_followup_create", "mcp__nexo__nexo_followup_create")
+PARTIAL_TASK_CLOSE_RE = re.compile(
+    r"(nexo_task_close|mcp__nexo__nexo_task_close).{0,800}['\"]?outcome['\"]?\s*[:=]\s*['\"]?partial",
+    re.IGNORECASE | re.DOTALL,
+)
+
 
 def _record(duration_ms: int, exit_code: int) -> None:
     try:
@@ -31,10 +48,105 @@ def _record(duration_ms: int, exit_code: int) -> None:
         pass
 
 
+def _candidate_transcript_paths() -> list[Path]:
+    try:
+        sys.path.insert(0, str(_DIR.parent))
+        import paths  # type: ignore
+
+        candidates = [paths.brain_dir() / "session_buffer.jsonl"]
+    except Exception:
+        nexo_home = Path(os.environ.get("NEXO_HOME", str(Path.home() / ".nexo")))
+        candidates = [
+            nexo_home / "personal" / "brain" / "session_buffer.jsonl",
+            nexo_home / "brain" / "session_buffer.jsonl",
+        ]
+
+    for key in ("NEXO_TRANSCRIPT_PATH", "CLAUDE_TRANSCRIPT_PATH", "TRANSCRIPT_PATH"):
+        raw = os.environ.get(key, "").strip()
+        if raw:
+            candidates.append(Path(raw).expanduser())
+    return candidates
+
+
+def _read_recent_lines(path: Path, max_lines: int = 800) -> list[str]:
+    try:
+        if not path.is_file():
+            return []
+        lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+        return lines[-max(1, max_lines):]
+    except Exception:
+        return []
+
+
+def _line_text(line: str) -> str:
+    try:
+        payload = json.loads(line)
+    except Exception:
+        return line
+    if isinstance(payload, dict):
+        return json.dumps(payload, ensure_ascii=False, sort_keys=True)
+    return str(payload)
+
+
+def scan_closeout_followup_gaps(lines: list[str]) -> dict:
+    findings: list[dict] = []
+    followup_creates = 0
+    for idx, raw_line in enumerate(lines):
+        text = _line_text(raw_line)
+        lower = text.lower()
+        if any(marker in lower for marker in FOLLOWUP_CREATE_MARKERS):
+            followup_creates += 1
+        for marker in FUTURE_COMMITMENT_MARKERS:
+            if marker in lower:
+                findings.append({"line": idx + 1, "kind": "future_commitment", "marker": marker})
+                break
+        if PARTIAL_TASK_CLOSE_RE.search(text):
+            findings.append({"line": idx + 1, "kind": "partial_task_close", "marker": "task_close partial"})
+
+    missing = max(0, len(findings) - followup_creates)
+    return {
+        "ok": missing == 0,
+        "findings": findings,
+        "followup_creates": followup_creates,
+        "missing_followups": missing,
+    }
+
+
+def _closeout_followup_message(result: dict) -> str:
+    examples = ", ".join(
+        f"{item.get('kind')}:{item.get('marker')}" for item in result.get("findings", [])[:5]
+    )
+    return (
+        "Cierre bloqueado: hay compromisos futuros o cierres parciales sin seguimiento persistente. "
+        f"Detectados={len(result.get('findings', []))}; followups_creados={result.get('followup_creates', 0)}; "
+        f"faltan={result.get('missing_followups', 0)}. "
+        "Crea los `nexo_followup_create(...)` necesarios antes de cerrar. "
+        f"Ejemplos: {examples}"
+    )
+
+
+def check_closeout_followups() -> dict:
+    lines: list[str] = []
+    sources: list[str] = []
+    for path in _candidate_transcript_paths():
+        chunk = _read_recent_lines(path)
+        if chunk:
+            lines.extend(chunk)
+            sources.append(str(path))
+    result = scan_closeout_followup_gaps(lines)
+    result["sources"] = sources
+    return result
+
+
 def main() -> int:
     started = time.time()
     script = _DIR / "session-stop.sh"
     exit_code = 0
+    closeout = check_closeout_followups()
+    if not closeout.get("ok", True):
+        print(json.dumps({"decision": "block", "systemMessage": _closeout_followup_message(closeout)}, ensure_ascii=False))
+        _record(int((time.time() - started) * 1000), 2)
+        return 0
     if script.is_file():
         try:
             exit_code = subprocess.run(

package/src/local_context/api.py

@@ -6,7 +6,6 @@ import re
 import shutil
 import sqlite3
 import stat
-import hashlib
 import subprocess
 import sys
 import time
@@ -16,7 +15,7 @@ from pathlib import Path
 from typing import Any
 
 import paths
-from . import embeddings
+from . import embeddings, usage_events
 from .db import LOCAL_CONTEXT_TABLES, close_local_context_db, connect_local_context_db_readonly, ensure_local_context_db, get_local_context_db, local_context_db_path
 from .extractors import canonical_entity_key, chunk_text, contains_secret, entities, entity_mentions, extract_text, normalize_entity_alias, summarize
 from .logging import log_event, tail
@@ -4663,7 +4662,7 @@ def context_query(
     include_relations: bool = True,
     snippet_chars: int = 1200,
     readonly: bool = True,
-    record_query: bool = False,
+    record_query: bool = True,
 ) -> dict:
     conn = _read_conn() if readonly else _conn()
     close_conn = bool(readonly)
@@ -4680,7 +4679,7 @@ def context_query(
             include_entities=include_entities,
             include_relations=include_relations,
             snippet_chars=snippet_chars,
-            record_query=bool(record_query and not readonly),
+            record_query=bool(record_query),
         )
     finally:
         if close_conn:
@@ -4791,21 +4790,27 @@ def _context_query_conn(
     if assets:
         summary = f"Found {len(assets)} local asset(s) related to '{clean_query}'."
     if record_query:
-        conn.execute(
-            """
-            INSERT INTO local_context_queries(query_hash, intent, result_count, confidence, warnings_json, created_at)
-            VALUES (?, ?, ?, ?, ?, ?)
-            """,
-            (
-                hashlib.sha256(clean_query.encode("utf-8", errors="ignore")).hexdigest(),
-                intent,
-                len(assets),
-                0.75 if evidence_refs else 0.0,
-                json_dumps(warnings),
-                now(),
-            ),
+        recorded = usage_events.record_usage_event(
+            query=clean_query,
+            client="nexo",
+            tool="nexo_local_context",
+            source="local_context_query",
+            route_stage="context_query",
+            intent=intent,
+            result_count=len(assets),
+            should_inject=bool(evidence_refs),
+            evidence_refs_count=len(evidence_refs),
+            used_before_response=False,
+            metadata={
+                "legacy_table": "local_context_queries",
+                "mode": normalized_mode,
+                "warnings_count": len(warnings),
+            },
         )
-        conn.commit()
+        if not recorded.get("ok"):
+            warnings.append(
+                f"Local-context usage telemetry not recorded: {recorded.get('error') or 'unknown_error'}"
+            )
     payload = {
         "ok": True,
         "query": clean_query,

package/src/local_context/health.py

@@ -7,7 +7,7 @@ import time
 from typing import Any, Callable
 
 from .db import connect_local_context_db_readonly, local_context_db_path
-from .usage_events import DEFAULT_USAGE_WINDOW_SECONDS, summarize_usage, usage_snapshot
+from .usage_events import DEFAULT_USAGE_WINDOW_SECONDS, summarize_query_events, summarize_usage, usage_snapshot
 
 DEFAULT_HEALTH_DEADLINE_MS = 500
 DEFAULT_DB_TIMEOUT_MS = 120
@@ -106,6 +106,7 @@ def _read_sidecar_snapshot(*, db_timeout_ms: int) -> dict[str, Any]:
         latest_query = 0.0
         if query_total:
             latest_query = float(_scalar(conn, "SELECT MAX(created_at) FROM local_context_queries") or 0.0)
+        usage_query_counter = summarize_query_events()
 
         jobs_pending = jobs_running = jobs_failed = jobs_done = 0
         if _table_exists(conn, "local_index_jobs"):
@@ -144,9 +145,13 @@ def _read_sidecar_snapshot(*, db_timeout_ms: int) -> dict[str, Any]:
                 "phase": phase,
             },
             "sidecar_query_counter": {
-                "total": query_total,
-                "latest_at": latest_query,
-                "note": "legacy_counter_not_real_usage",
+                "total": int(usage_query_counter.get("total") or 0) if usage_query_counter.get("ok") else 0,
+                "latest_at": float(usage_query_counter.get("latest_at") or 0.0) if usage_query_counter.get("ok") else 0.0,
+                "store_path": usage_query_counter.get("store_path") or "",
+                "note": "usage_store_query_events",
+                "legacy_total": query_total,
+                "legacy_latest_at": latest_query,
+                "legacy_note": "legacy_counter_not_real_usage",
             },
         }
     finally:

package/src/local_context/usage_events.py

@@ -678,6 +678,66 @@ def summarize_usage(
     }
 
 
+def summarize_query_events(
+    *,
+    window_seconds: int = DEFAULT_USAGE_WINDOW_SECONDS,
+    db_path: str | os.PathLike[str] | None = None,
+    now_ts: float | None = None,
+) -> dict[str, Any]:
+    path = Path(db_path).expanduser() if db_path else usage_db_path()
+    window = max(0, int(window_seconds))
+    current = float(now_ts if now_ts is not None else _now())
+    since = 0.0 if window == 0 else current - window
+    if not path.exists():
+        return {
+            "ok": True,
+            "store_path": str(path),
+            "window_seconds": window,
+            "since": since,
+            "total": 0,
+            "latest_at": 0.0,
+            "by_intent": {},
+        }
+    try:
+        conn = _connect_usage_db(create=False, db_path=path)
+    except sqlite3.OperationalError as exc:
+        return {"ok": False, "error": "usage_store_busy", "detail": str(exc), "store_path": str(path)}
+    except sqlite3.DatabaseError as exc:
+        return {"ok": False, "error": "usage_store_unreadable", "detail": str(exc), "store_path": str(path)}
+    try:
+        totals = conn.execute(
+            f"""
+            SELECT COUNT(*) AS total, MAX(created_at) AS latest_at
+            FROM {USAGE_TABLE}
+            WHERE created_at >= ?
+              AND (source = 'local_context_query' OR route_stage = 'context_query')
+            """,
+            (since,),
+        ).fetchone()
+        intent_rows = conn.execute(
+            f"""
+            SELECT intent, COUNT(*) AS total
+            FROM {USAGE_TABLE}
+            WHERE created_at >= ?
+              AND (source = 'local_context_query' OR route_stage = 'context_query')
+            GROUP BY intent
+            ORDER BY total DESC, intent ASC
+            """,
+            (since,),
+        ).fetchall()
+    finally:
+        conn.close()
+    return {
+        "ok": True,
+        "store_path": str(path),
+        "window_seconds": window,
+        "since": since,
+        "total": int(totals["total"] or 0),
+        "latest_at": float(totals["latest_at"] or 0.0),
+        "by_intent": {str(row["intent"]): int(row["total"] or 0) for row in intent_rows},
+    }
+
+
 def usage_snapshot(
     *,
     indexed_files: int | None = None,
@@ -735,3 +795,28 @@ def list_recent_events(
     finally:
         conn.close()
     return [dict(row) for row in rows]
+
+
+def list_recent_query_events(
+    *,
+    limit: int = 50,
+    db_path: str | os.PathLike[str] | None = None,
+) -> list[dict[str, Any]]:
+    path = Path(db_path).expanduser() if db_path else usage_db_path()
+    if not path.exists():
+        return []
+    conn = _connect_usage_db(create=False, db_path=path)
+    try:
+        rows = conn.execute(
+            f"""
+            SELECT *
+            FROM {USAGE_TABLE}
+            WHERE source = 'local_context_query' OR route_stage = 'context_query'
+            ORDER BY created_at DESC
+            LIMIT ?
+            """,
+            (max(1, min(int(limit or 50), 500)),),
+        ).fetchall()
+    finally:
+        conn.close()
+    return [dict(row) for row in rows]

package/src/mcp_write_queue.py

@@ -253,6 +253,27 @@ def _apply_write(record: dict[str, Any]) -> None:
 
         capture_context_event(**payload)
         return
+    if kind == "followup_create":
+        from tools_reminders_crud import handle_followup_create
+
+        result = handle_followup_create(**payload)
+        if str(result).startswith("ERROR:"):
+            raise ValueError(result)
+        return
+    if kind == "change_log":
+        from plugins.episodic_memory import handle_change_log
+
+        result = handle_change_log(**payload)
+        if str(result).startswith("ERROR:"):
+            raise ValueError(result)
+        return
+    if kind == "learning_add":
+        from tools_learnings import handle_learning_add
+
+        result = handle_learning_add(**payload)
+        if str(result).startswith("ERROR:"):
+            raise ValueError(result)
+        return
     raise ValueError(f"unsupported write kind: {kind}")
 
 
@@ -351,4 +372,3 @@ def _worker_loop() -> None:
             drain_write_queue(limit=50)
         except Exception:
             pass
-