nexo-brain 7.37.1 → 7.37.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.37.1",
+  "version": "7.37.4",
   "description": "Local cognitive runtime for Claude Code \u2014 persistent memory, overnight learning, doctor diagnostics, personal scripts, recovery-aware jobs, startup preflight, and optional dashboard/power helper.",
   "author": {
     "name": "NEXO Brain",

package/README.md

@@ -18,7 +18,13 @@
 
 [Watch the overview video](https://nexo-brain.com/watch/) · [Watch on YouTube](https://www.youtube.com/watch?v=i2lkGhKyVqI) · [Open the infographic](https://nexo-brain.com/assets/nexo-brain-infographic-v5.png)
 
-Version `7.37.1` is the current packaged-runtime line. Patch release over v7.37.0 - release hardening for Desktop-bundled Brain: large existing `local-context.db` files no longer run a surprise full `VACUUM` on the first writer, `schema_abstraction` MCP tools are loaded by the essential startup set, and learning tools tolerate Desktop compatibility payloads. Builds on v7.37.0 (transparent server self-heal + email zombie reinjection guard).
+Version `7.37.4` is the current packaged-runtime line. Patch release over v7.37.3 - product-gap reporting, stale briefing noise, and opportunity loops: Deep Sleep reports recurring NEXO product gaps through sanitized Desktop support tickets, self-audit preserves closed internal opportunities, the morning briefing reads item history before resurfacing decisions, and support-ticket tools match the live backend contract.
+
+Previously in `7.37.3`: patch release over v7.37.2 - release pipeline timeout hardening: the Brain publish workflow keeps the full pre-publish pytest gate, but now gives slow GitHub runners enough time to finish the suite and release readiness before public-channel publication.
+
+Previously in `7.37.2`: patch release over v7.37.1 - runtime shutdown and CI stability: session keepalive writers now stop before the shared SQLite connection closes, SQLite close is serialized under the write lock, and the full Brain test workflow has enough time to finish instead of cancelling slow-but-valid runs. The v7.37.2 tag attempt did not publish npm/GitHub release artifacts; v7.37.3 is the public line.
+
+Previously in `7.37.1`: patch release over v7.37.0 - release hardening for Desktop-bundled Brain: large existing `local-context.db` files no longer run a surprise full `VACUUM` on the first writer, `schema_abstraction` MCP tools are loaded by the essential startup set, and learning tools tolerate Desktop compatibility payloads. Builds on v7.37.0 (transparent server self-heal + email zombie reinjection guard).
 
 Previously in `7.31.9`: patch release over v7.31.8 - UI release closeout now has to prove the original reported symptom was reopened with observable evidence before claiming the release is ready.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexo-brain",
-  "version": "7.37.1",
+  "version": "7.37.4",
   "mcpName": "io.github.wazionapps/nexo",
   "description": "NEXO Brain — Shared brain for AI agents. Persistent memory, semantic RAG, natural forgetting, metacognitive guard, trust scoring, 150+ MCP tools. Works with Claude Code, Codex, Claude Desktop & any MCP client. 100% local, free.",
   "homepage": "https://nexo-brain.com",

package/src/db/_core.py

@@ -131,7 +131,8 @@ class _SerializedConnection:
             return self._conn.commit()
 
     def close(self):
-        return self._conn.close()
+        with _write_lock:
+            return self._conn.close()
 
     def __getattr__(self, name):
         return getattr(self._conn, name)

package/src/managed_mcp/lock.json

@@ -6,9 +6,9 @@
     "chrome-devtools-mcp": {
       "source_type": "npm",
       "package": "chrome-devtools-mcp",
-      "version": "1.2.0",
-      "integrity": "sha512-xHd8hoLZQArDsYhu8OUHvKBIiihx1Co9DgAPHWaM4kzRf41TpZ0IuxKioIWTEGzFKpRqQzIxpFqydY4AKqP5sQ==",
-      "tarball": "https://registry.npmjs.org/chrome-devtools-mcp/-/chrome-devtools-mcp-1.2.0.tgz",
+      "version": "1.3.0",
+      "integrity": "sha512-52NVUwWSL4eW7W9nsDrzYJF96IKVuxEwAn4O7ZfdNRtopS954P9nryJbdYwg7vdqxhLrvioGFlm5e4P41WXsiw==",
+      "tarball": "https://registry.npmjs.org/chrome-devtools-mcp/-/chrome-devtools-mcp-1.3.0.tgz",
       "bin": "chrome-devtools-mcp",
       "engines": {
         "node": "^20.19.0 || ^22.12.0 || >=23"

package/src/pre_answer_router.py

@@ -41,6 +41,7 @@ EVIDENCE_REQUIRED_INTENTS = {"live_state_claim"}
 
 DEFAULT_BUDGET_MS = 2500
 DEFAULT_TOKEN_BUDGET = 2500
+STRONG_TRANSCRIPT_INDEX_MATCH = 0.75
 MAX_SOURCE_WORKERS = int(os.environ.get("NEXO_PRE_ANSWER_SOURCE_WORKERS", "6") or "6")
 PRE_ANSWER_SEMANTIC_DECISION_KIND = "pre_answer_intent"
 
@@ -1989,20 +1990,23 @@ def _source_transcripts(request: SourceRequest) -> SourceResult:
         query_tokens = _tokenize(request.query)
         indexed_rows: list[dict[str, Any]] = []
         for row in rows:
-            modified = str(row.get("modified_at") or "")
-            if modified:
-                try:
-                    if datetime.fromisoformat(modified) < cutoff:
-                        continue
-                except Exception:
-                    pass
             haystack = " ".join(
                 str(row.get(field) or "")
                 for field in ("sanitized_summary", "display_name", "session_id", "conversation_id", "path_ref", "metadata_json")
             )
             score = _score_text_match(query_tokens, haystack) if query_tokens else 0.0
-            if _row_ref_matches(request.query, row):
+            ref_matches = _row_ref_matches(request.query, row)
+            if ref_matches:
                 score = max(score, 2.0)
+            modified = str(row.get("modified_at") or "")
+            stale = False
+            if modified:
+                try:
+                    stale = datetime.fromisoformat(modified) < cutoff
+                except Exception:
+                    pass
+            if stale and not ref_matches and score < STRONG_TRANSCRIPT_INDEX_MATCH:
+                continue
             if score <= 0:
                 continue
             row["_score"] = round(score, 4)

package/src/scripts/deep-sleep/apply_findings.py

@@ -129,6 +129,108 @@ CONTRADICTION_PAIRS = (
 )
 TABLE_COLUMNS_CACHE: dict[tuple[str, str], set[str]] = {}
 
+_EMAIL_RE = re.compile(r"\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b", re.IGNORECASE)
+_URL_RE = re.compile(r"\bhttps?://[^\s<>'\"]+", re.IGNORECASE)
+_MAC_PATH_RE = re.compile(r"(?<!\w)/(?:Users|Volumes|private|tmp|var)/[^\s<>'\"]+")
+_WIN_PATH_RE = re.compile(r"\b[A-Za-z]:\\(?:Users|ProgramData|Windows|Temp)\\[^\s<>'\"]+")
+_SECRET_ASSIGNMENT_RE = re.compile(
+    r"(?i)\b(api[_-]?key|authorization|bearer|cookie|credential|password|secret|session|token)\b\s*[:=]\s*[^\s,;]+"
+)
+_SECRET_VALUE_RE = re.compile(
+    r"\b(?:sk-[A-Za-z0-9_-]{12,}|pk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9_]{12,}|AKIA[0-9A-Z]{12,})\b"
+)
+
+
+def sanitize_product_gap_text(value: object, *, limit: int = 600) -> str:
+    """Redact tenant/operator data before sending product-gap reports to Desktop."""
+    text = str(value or "")
+    home = str(Path.home())
+    if home:
+        text = text.replace(home, "[redacted-home]")
+    for raw in (str(NEXO_HOME), str(NEXO_CODE)):
+        if raw:
+            text = text.replace(raw, "[redacted-path]")
+    text = _EMAIL_RE.sub("[redacted-email]", text)
+    text = _URL_RE.sub("[redacted-url]", text)
+    text = _SECRET_ASSIGNMENT_RE.sub(lambda m: f"{m.group(1)}=[redacted-secret]", text)
+    text = _SECRET_VALUE_RE.sub("[redacted-secret]", text)
+    text = _MAC_PATH_RE.sub("[redacted-path]", text)
+    text = _WIN_PATH_RE.sub("[redacted-path]", text)
+    text = re.sub(r"\b(?:AGENTS|CLAUDE|MEMORY)\.md\b", "[redacted-bootstrap]", text)
+    text = re.sub(r"\s+", " ", text).strip()
+    if limit > 0 and len(text) > limit:
+        return text[: max(0, limit - 3)].rstrip() + "..."
+    return text
+
+
+def _product_gap_evidence_examples(action: dict, limit: int = 3) -> list[str]:
+    examples: list[str] = []
+    for entry in action.get("evidence", []) or []:
+        if isinstance(entry, dict):
+            raw = entry.get("quote") or entry.get("text") or entry.get("summary") or entry.get("evidence") or entry
+        else:
+            raw = entry
+        cleaned = sanitize_product_gap_text(raw, limit=220)
+        if cleaned:
+            examples.append(cleaned)
+        if len(examples) >= limit:
+            break
+    return examples
+
+
+def create_product_gap_report(action: dict, content: dict, dedupe_key: str) -> dict:
+    """Create a sanitized NEXO Desktop support ticket for a recurring product gap."""
+    try:
+        from tools_api_call import handle_support_ticket_create
+    except Exception as exc:
+        return {"success": False, "error": f"support ticket API unavailable: {exc}"}
+
+    title = sanitize_product_gap_text(content.get("title") or "Deep Sleep product gap", limit=140)
+    description = sanitize_product_gap_text(content.get("description") or title, limit=900)
+    pattern = sanitize_product_gap_text(content.get("pattern") or "", limit=500)
+    deliverable = sanitize_product_gap_text(content.get("deliverable") or "", limit=120)
+    sessions_count = content.get("sessions_count", "")
+    evidence_count = content.get("evidence_count", len(action.get("evidence", []) or []))
+    impact = sanitize_product_gap_text(action.get("impact") or "", limit=80)
+    confidence = action.get("confidence", "")
+    examples = _product_gap_evidence_examples(action)
+
+    lines = [
+        "Deep Sleep detected a recurring NEXO product gap that should be reviewed by the product team.",
+        "",
+        f"Impact: {impact or 'unspecified'}",
+        f"Confidence: {confidence}",
+        f"Suggested deliverable: {deliverable or 'product improvement'}",
+        f"Observed sessions: {sessions_count or 'unknown'}",
+        f"Evidence items: {evidence_count or 0}",
+        "",
+        f"Pattern: {pattern or 'No compact pattern supplied.'}",
+        f"Requested behavior: {description}",
+        "",
+        "Privacy: operator/client-specific paths, URLs, emails, bootstrap filenames and secret-looking values were redacted before sending.",
+    ]
+    if examples:
+        lines.extend(["", "Redacted examples:"])
+        lines.extend(f"- {example}" for example in examples)
+
+    client_message_id = sanitize_product_gap_text(dedupe_key or "", limit=120) or (
+        "product-gap-" + hashlib.md5(description.encode("utf-8"), usedforsecurity=False).hexdigest()[:16]
+    )
+    priority = "high" if str(action.get("impact") or "").lower() in {"high", "critical"} else "normal"
+    response = handle_support_ticket_create(
+        f"[NEXO-PRODUCT-GAP] {title}",
+        "\n".join(lines),
+        priority=priority,
+        client_message_id=client_message_id,
+        origin="auto_incident",
+    )
+    return {
+        "success": str(response).startswith("HTTP 2") or str(response).startswith("HTTP 201"),
+        "response": response,
+        "client_message_id": client_message_id,
+        "sanitized": True,
+    }
+
 
 def generate_run_id(target_date: str) -> str:
     """Generate a unique run ID for this execution."""
@@ -2263,6 +2365,11 @@ def apply_action(action: dict, run_id: str) -> dict:
         log_entry["status"] = "applied" if result.get("success") else "error"
         log_entry["details"] = result
 
+    elif action_type == "product_gap_report":
+        result = create_product_gap_report(action, content, dedupe_key)
+        log_entry["status"] = "applied" if result.get("success") else "error"
+        log_entry["details"] = result
+
     elif action_type == "skill_create":
         result = create_skill(content)
         log_entry["status"] = "applied" if result.get("success") else "error"

package/src/scripts/deep-sleep/synthesize.py

@@ -40,6 +40,16 @@ DEEP_SLEEP_DIR = paths.operations_dir() / "deep-sleep"
 
 CLAUDE_TIMEOUT = AUTOMATION_SUBPROCESS_TIMEOUT
 ACTION_VERBS = {"add", "implement", "create", "write", "build", "enforce", "automate", "validate", "guard", "fix", "review"}
+PRODUCT_GAP_DELIVERABLES = {
+    "automation",
+    "guard",
+    "guardrail",
+    "hook",
+    "script",
+    "skill",
+    "tool",
+    "workflow",
+}
 
 
 def extract_json_from_response(text: str) -> dict | None:
@@ -107,6 +117,19 @@ def _looks_concrete_action(text: str) -> bool:
     return bool(words & ACTION_VERBS)
 
 
+def _looks_product_gap_deliverable(value: str) -> bool:
+    words = {
+        word.strip(".,:;()[]{}").lower()
+        for word in str(value or "").replace("/", " ").replace("-", " ").split()
+    }
+    return bool(words & PRODUCT_GAP_DELIVERABLES)
+
+
+def _product_gap_fingerprint(*parts: str) -> str:
+    normalized = _normalize_action_text(" ".join(str(part or "") for part in parts))
+    return hashlib.md5(normalized.encode("utf-8"), usedforsecurity=False).hexdigest()[:16]
+
+
 def _pattern_followup_from_fix(pattern: dict) -> dict | None:
     severity = str(pattern.get("severity", "") or "").lower()
     sessions = pattern.get("sessions", []) or []
@@ -141,13 +164,37 @@ def _pattern_followup_from_fix(pattern: dict) -> dict | None:
     if not _looks_concrete_action(followup_description):
         followup_description = f"Implement this fix: {followup_description}"
 
+    confidence = round(max(float(proposed_fix.get("confidence", 0.0) or 0.0), 0.86 if severity == "high" else 0.78), 2)
+    impact = "high" if severity == "high" else "medium"
+    evidence = pattern.get("evidence", []) or []
+    if _looks_product_gap_deliverable(deliverable):
+        fingerprint = _product_gap_fingerprint(pattern_text, title, description, deliverable)
+        return {
+            "action_type": "product_gap_report",
+            "action_class": "auto_apply",
+            "confidence": confidence,
+            "impact": impact,
+            "reversibility": "reversible",
+            "evidence": evidence,
+            "dedupe_key": f"product-gap:{fingerprint}",
+            "content": {
+                "title": title or f"Product gap for: {pattern_text[:90]}",
+                "description": followup_description,
+                "deliverable": deliverable,
+                "pattern": pattern_text,
+                "sessions_count": len(sessions),
+                "evidence_count": len(evidence),
+                "reasoning": f"Deep Sleep product gap from recurring pattern: {pattern_text}",
+            },
+        }
+
     return {
         "action_type": "followup_create",
         "action_class": "auto_apply" if severity == "high" else "draft_for_morning",
-        "confidence": round(max(float(proposed_fix.get("confidence", 0.0) or 0.0), 0.86 if severity == "high" else 0.78), 2),
-        "impact": "high" if severity == "high" else "medium",
+        "confidence": confidence,
+        "impact": impact,
         "reversibility": "reversible",
-        "evidence": pattern.get("evidence", []) or [],
+        "evidence": evidence,
         # Content fingerprint, not security-sensitive.
         "dedupe_key": "engineering-fix:" + hashlib.md5(
             _normalize_action_text(followup_description).encode("utf-8"),

package/src/scripts/nexo-daily-self-audit.py

@@ -294,6 +294,16 @@ def _ensure_followup(conn: sqlite3.Connection, *, prefix: str, description: str,
         (followup_id,),
     ).fetchone()
     if existing_id_row:
+        closed_status = str(existing_id_row["status"] or "").upper()
+        if closed_status.startswith("COMPLETED") or closed_status in {"DELETED", "ARCHIVED", "BLOCKED", "WAITING"}:
+            conn.commit()
+            nexo_db.add_followup_note(
+                followup_id,
+                "Daily self-audit saw this canonical opportunity again and preserved its closed/non-operational status.",
+                actor="self-audit",
+            )
+            return followup_id
+
         update_fields = {
             "description": description,
             "verification": verification,
@@ -305,9 +315,6 @@ def _ensure_followup(conn: sqlite3.Connection, *, prefix: str, description: str,
             update_fields["internal"] = int(bool(internal))
         if "owner" in columns:
             update_fields["owner"] = owner
-        closed_status = str(existing_id_row["status"] or "").upper()
-        if closed_status.startswith("COMPLETED") or closed_status in {"DELETED", "ARCHIVED", "BLOCKED", "WAITING"}:
-            update_fields["status"] = "PENDING"
         conn.commit()
         result = nexo_db.update_followup(
             followup_id,
@@ -797,6 +804,23 @@ TOPIC_STOPWORDS = {
     "prepare", "finish", "open", "another", "around", "must",
 }
 
+OPPORTUNITY_DRAIN_LIMIT = int(os.environ.get("NEXO_SELFAUDIT_OPPORTUNITY_DRAIN_LIMIT", "500"))
+OPPORTUNITY_DRAIN_STOPWORDS = TOPIC_STOPWORDS | {
+    "extract", "reusable", "automation", "automations", "automated", "manual",
+    "pattern", "patterns", "successful", "protocol", "tasks", "days", "seen",
+    "operator", "time", "skill", "skills", "script", "scripts", "workflow",
+    "workflows", "candidate", "opportunity", "opportunities", "around",
+}
+OPPORTUNITY_HISTORY_COVERAGE_RE = re.compile(
+    r"\b("
+    r"already covered|covered by|coverage exists|automation exists|skill exists|script exists|"
+    r"ya cubiert[oa]s?|cubiert[oa]s? por|automatizad[oa]s?|"
+    r"automatizaci[oó]n(?:es)? existente(?:s)?|skills? existente(?:s)?|"
+    r"scripts? existente(?:s)?|workflows? existente(?:s)?|resuelt[oa]s?|resolved|"
+    r"no actionable|no accionable|suppressed|suprimid[oa]s?"
+    r")\b",
+    re.IGNORECASE,
+)
 
 def _topic_signature(text: str) -> str:
     tokens = [
@@ -806,6 +830,156 @@ def _topic_signature(text: str) -> str:
     return " ".join(tokens[:2])
 
 
+def _opportunity_terms(text: str) -> set[str]:
+    return {
+        token
+        for token in re.findall(r"[a-z0-9]+", (text or "").lower())
+        if len(token) >= 4 and token not in OPPORTUNITY_DRAIN_STOPWORDS and not token.isdigit()
+    }
+
+
+def _opportunity_match(terms: set[str], candidate_text: str, *, min_overlap: int = 4) -> tuple[bool, list[str]]:
+    if not terms:
+        return False, []
+    candidate_terms = _opportunity_terms(candidate_text)
+    overlap = sorted(terms & candidate_terms)
+    required = min(min_overlap, max(2, len(terms)))
+    return len(overlap) >= required, overlap
+
+
+def _coverage_from_history(conn: sqlite3.Connection, followup_id: str) -> str:
+    if not _table_exists(conn, "item_history"):
+        return ""
+    rows = conn.execute(
+        """SELECT event_type, note
+           FROM item_history
+           WHERE item_type = 'followup' AND item_id = ?
+           ORDER BY created_at DESC, id DESC
+           LIMIT 25""",
+        (followup_id,),
+    ).fetchall()
+    for row in rows:
+        note = str(row["note"] or "").strip()
+        if note and OPPORTUNITY_HISTORY_COVERAGE_RE.search(note):
+            snippet = " ".join(note.split())[:180]
+            return f"history:{row['event_type']}:{snippet}"
+    return ""
+
+
+def _coverage_from_skills(conn: sqlite3.Connection, terms: set[str]) -> str:
+    if not _table_exists(conn, "skills"):
+        return ""
+    rows = conn.execute(
+        """SELECT id, name, description, content, steps, trigger_patterns, tags
+           FROM skills
+           ORDER BY COALESCE(success_count, 0) DESC, COALESCE(trust_score, 0) DESC
+           LIMIT 500"""
+    ).fetchall()
+    for row in rows:
+        candidate = " ".join(
+            str(row[key] or "")
+            for key in ("name", "description", "content", "steps", "trigger_patterns", "tags")
+        )
+        ok, overlap = _opportunity_match(terms, candidate)
+        if ok:
+            return f"skill:{row['id']} overlap={','.join(overlap[:6])}"
+    return ""
+
+
+def _coverage_from_scripts(conn: sqlite3.Connection, terms: set[str]) -> str:
+    if not _table_exists(conn, "personal_scripts"):
+        return ""
+    rows = conn.execute(
+        """SELECT id, name, description, path, metadata_json
+           FROM personal_scripts
+           WHERE COALESCE(enabled, 1) = 1
+           LIMIT 500"""
+    ).fetchall()
+    for row in rows:
+        candidate = " ".join(
+            str(row[key] or "")
+            for key in ("name", "description", "path", "metadata_json")
+        )
+        ok, overlap = _opportunity_match(terms, candidate)
+        if ok:
+            return f"script:{row['id']} overlap={','.join(overlap[:6])}"
+    return ""
+
+
+def _coverage_from_learnings(conn: sqlite3.Connection, terms: set[str]) -> str:
+    if not _table_exists(conn, "learnings"):
+        return ""
+    rows = conn.execute(
+        """SELECT id, title, content, reasoning, prevention, applies_to
+           FROM learnings
+           WHERE COALESCE(status, 'active') = 'active'
+           ORDER BY COALESCE(updated_at, created_at, 0) DESC
+           LIMIT 500"""
+    ).fetchall()
+    for row in rows:
+        candidate = " ".join(
+            str(row[key] or "")
+            for key in ("title", "content", "reasoning", "prevention", "applies_to")
+        )
+        if not OPPORTUNITY_HISTORY_COVERAGE_RE.search(candidate):
+            continue
+        ok, overlap = _opportunity_match(terms, candidate, min_overlap=3)
+        if ok:
+            return f"learning:{row['id']} overlap={','.join(overlap[:6])}"
+    return ""
+
+
+def _covered_opportunity_evidence(conn: sqlite3.Connection, row: sqlite3.Row) -> str:
+    followup_id = str(row["id"] or "")
+    history = _coverage_from_history(conn, followup_id)
+    if history:
+        return history
+    text = " ".join(
+        str(row[key] or "")
+        for key in ("description", "verification", "reasoning")
+    )
+    terms = _opportunity_terms(text)
+    return (
+        _coverage_from_skills(conn, terms)
+        or _coverage_from_scripts(conn, terms)
+        or _coverage_from_learnings(conn, terms)
+    )
+
+
+def _drain_covered_opportunity_backlog(conn: sqlite3.Connection, *, limit: int = OPPORTUNITY_DRAIN_LIMIT) -> dict:
+    if not _table_exists(conn, "followups"):
+        return {"ok": False, "checked": 0, "completed": 0, "reason": "followups_missing"}
+    rows = conn.execute(
+        """SELECT id, description, verification, reasoning
+           FROM followups
+           WHERE id LIKE 'NF-OPPORTUNITY-%'
+             AND status NOT LIKE 'COMPLETED%'
+             AND UPPER(COALESCE(status, '')) NOT IN ('DELETED','ARCHIVED','BLOCKED','WAITING')
+           ORDER BY COALESCE(created_at, updated_at, 0) ASC
+           LIMIT ?""",
+        (max(1, int(limit or OPPORTUNITY_DRAIN_LIMIT)),),
+    ).fetchall()
+    completed = 0
+    examples: list[str] = []
+    for row in rows:
+        evidence = _covered_opportunity_evidence(conn, row)
+        if not evidence:
+            continue
+        note = (
+            "Daily self-audit backlog drain closed this NF-OPPORTUNITY because existing coverage was found. "
+            f"Evidence: {evidence}. "
+            "No backlog history was deleted; this item remains traceable in item_history."
+        )
+        conn.commit()
+        result = nexo_db.complete_followup(str(row["id"]), note)
+        if result.get("error"):
+            continue
+        completed += 1
+        if len(examples) < 5:
+            examples.append(f"{row['id']} -> {evidence}")
+    return {"ok": True, "checked": len(rows), "completed": completed, "examples": examples}
+
+
 REPAIR_KEYWORDS = {
     "fix", "fixed", "bug", "bugs", "regression", "regressions", "repair", "repaired",
     "correct", "corrected", "correction", "typo", "hotfix", "patch", "patched",
@@ -1673,6 +1847,13 @@ def check_automation_opportunities():
     conn = sqlite3.connect(str(NEXO_DB))
     conn.row_factory = sqlite3.Row
     if not _table_exists(conn, "protocol_tasks"):
+        drain = _drain_covered_opportunity_backlog(conn)
+        if drain.get("completed"):
+            finding(
+                "INFO",
+                "opportunities",
+                f"drained {drain['completed']} covered NF-OPPORTUNITY backlog item(s)",
+            )
         conn.close()
         return
 
@@ -1684,6 +1865,13 @@ def check_automation_opportunities():
            ORDER BY closed_at DESC"""
     ).fetchall()
     if not rows:
+        drain = _drain_covered_opportunity_backlog(conn)
+        if drain.get("completed"):
+            finding(
+                "INFO",
+                "opportunities",
+                f"drained {drain['completed']} covered NF-OPPORTUNITY backlog item(s)",
+            )
         conn.close()
         return
 
@@ -1721,6 +1909,17 @@ def check_automation_opportunities():
                 priority="medium",
             )
         conn.commit()
+    drain = _drain_covered_opportunity_backlog(conn)
+    if drain.get("completed"):
+        example_text = ""
+        examples = drain.get("examples") or []
+        if examples:
+            example_text = f" | examples: {'; '.join(examples)}"
+        finding(
+            "INFO",
+            "opportunities",
+            f"drained {drain['completed']} covered NF-OPPORTUNITY backlog item(s){example_text}",
+        )
     conn.close()
 
 

package/src/scripts/nexo-morning-agent.py

@@ -34,6 +34,7 @@ from __future__ import annotations
 import argparse
 import json
 import os
+import re
 import signal
 import subprocess
 import sys
@@ -85,11 +86,50 @@ CLI_TIMEOUT = 1500
 MAX_DUE_ITEMS = 8
 MAX_ACTIVE_ITEMS = 8
 MAX_DIARY_ITEMS = 6
+HISTORY_SIGNAL_LIMIT = 5
 MORNING_BRIEFING_STALE_HOURS = 12
 _ACTIVE_CLAIM: dict[str, str] = {}
 HTTP_TIMEOUT = 7
 NEWS_MAX_HEADLINES = 8
 NEWS_MAX_FEEDS = 5
+RESOLUTION_SIGNAL_WORDS = (
+    "already decided",
+    "already resolved",
+    "cerrado",
+    "closed",
+    "completed",
+    "covered",
+    "cubierto",
+    "decidido",
+    "descartad",
+    "false alarm",
+    "falsa alarma",
+    "monitor activo",
+    "no accionable",
+    "resolved",
+    "resuelto",
+)
+APPROVAL_SIGNAL_WORDS = (
+    "awaiting approval",
+    "espera luz verde",
+    "esperando luz verde",
+    "needs approval",
+    "pending approval",
+)
+TOPIC_STOPWORDS = {
+    "about",
+    "after",
+    "before",
+    "briefing",
+    "check",
+    "para",
+    "pendiente",
+    "review",
+    "sobre",
+    "ticket",
+    "update",
+    "with",
+}
 NEWS_INTEREST_QUERY_ES = {
     "business": "empresa economia negocios",
     "technology": "tecnologia inteligencia artificial software",
@@ -454,16 +494,115 @@ def _followup_recency_fields(row: dict) -> dict:
     }
 
 
+def _compact_item_history(item_type: str, item_id: str, *, limit: int = HISTORY_SIGNAL_LIMIT) -> list[dict]:
+    if not item_id:
+        return []
+    try:
+        rows = nexo_db.get_item_history(item_type, item_id, limit=limit)
+    except Exception:
+        return []
+    result: list[dict] = []
+    for row in rows:
+        note = _clean_text(row.get("note"), limit=220)
+        event_type = str(row.get("event_type") or "")
+        if not note and not event_type:
+            continue
+        result.append({
+            "event_type": event_type,
+            "actor": str(row.get("actor") or ""),
+            "note": note,
+            "created_at": str(row.get("created_at") or ""),
+        })
+    return result
+
+
+def _resolution_state(status: str, history: list[dict], *text_fields: object) -> str:
+    clean_status = str(status or "").strip().upper()
+    if clean_status.startswith("COMPLETED") or clean_status in {"DELETED", "ARCHIVED", "BLOCKED", "WAITING"}:
+        return "closed_or_non_operational"
+
+    signal_text = " ".join(
+        [
+            str(status or ""),
+            *[str(value or "") for value in text_fields],
+            *[
+                f"{entry.get('event_type', '')} {entry.get('note', '')}"
+                for entry in history
+                if isinstance(entry, dict)
+            ],
+        ]
+    ).lower()
+    if any(word in signal_text for word in APPROVAL_SIGNAL_WORDS):
+        return "awaiting_user_approval"
+    if any(word in signal_text for word in RESOLUTION_SIGNAL_WORDS):
+        return "resolved_or_decided_signal"
+    return "active"
+
+
+def _status_claim_guard(resolution_state: str) -> str:
+    if resolution_state == "awaiting_user_approval":
+        return "Do not describe as authorized/done; state that it is waiting for approval."
+    if resolution_state == "resolved_or_decided_signal":
+        return "Do not present resolved/decided subtopics as new decisions."
+    if resolution_state == "closed_or_non_operational":
+        return "Do not present this as operationally pending."
+    return ""
+
+
+def _topic_signature(item: dict) -> str:
+    text = " ".join(
+        str(item.get(key) or "")
+        for key in ("description", "verification", "reasoning")
+    )
+    normalized = unicodedata.normalize("NFKD", text).encode("ascii", "ignore").decode("ascii").lower()
+    tokens = [
+        token
+        for token in re.findall(r"[a-z0-9]{4,}", normalized)
+        if token not in TOPIC_STOPWORDS
+    ]
+    unique = list(dict.fromkeys(tokens))
+    if len(unique) < 3:
+        return f"id:{item.get('id', '')}"
+    return "topic:" + " ".join(sorted(unique[:10]))
+
+
+def _dedupe_context_groups(*groups: list[dict]) -> tuple[list[dict], ...]:
+    seen: set[str] = set()
+    output: list[list[dict]] = []
+    for group in groups:
+        kept: list[dict] = []
+        for item in group:
+            signature = _topic_signature(item)
+            if signature and signature in seen:
+                continue
+            if signature:
+                seen.add(signature)
+            kept.append(item)
+        output.append(kept)
+    return tuple(output)
+
+
 def _serialize_reminders(filter_type: str, *, limit: int) -> list[dict]:
     rows = list(nexo_db.get_reminders(filter_type))
     result: list[dict] = []
     for row in rows[:limit]:
+        item_id = str(row.get("id") or "")
+        history = _compact_item_history("reminder", item_id)
+        resolution_state = _resolution_state(
+            str(row.get("status") or ""),
+            history,
+            row.get("description"),
+        )
         result.append({
-            "id": str(row.get("id") or ""),
+            "id": item_id,
             "description": _clean_text(row.get("description")),
             "date": str(row.get("date") or ""),
             "category": str(row.get("category") or ""),
             "status": str(row.get("status") or ""),
+            "recent_history": history,
+            "resolution_state": resolution_state,
+            "has_resolution_signal": resolution_state in {"closed_or_non_operational", "resolved_or_decided_signal"},
+            "status_claim_guard": _status_claim_guard(resolution_state),
         })
     return result
 
@@ -475,8 +614,17 @@ def _serialize_followups(filter_type: str, *, limit: int) -> list[dict]:
         status = str(row.get("status") or "").strip().upper()
         if status.startswith("COMPLETED") or status in {"DELETED", "ARCHIVED"}:
             continue
+        item_id = str(row.get("id") or "")
+        history = _compact_item_history("followup", item_id)
+        resolution_state = _resolution_state(
+            row.get("status"),
+            history,
+            row.get("description"),
+            row.get("verification"),
+            row.get("reasoning"),
+        )
         item = {
-            "id": str(row.get("id") or ""),
+            "id": item_id,
             "description": _clean_text(row.get("description")),
             "date": str(row.get("date") or ""),
             "priority": _item_priority(row.get("priority")),
@@ -484,6 +632,10 @@ def _serialize_followups(filter_type: str, *, limit: int) -> list[dict]:
             "status": str(row.get("status") or ""),
             "verification": _clean_text(row.get("verification"), limit=180),
             "reasoning": _clean_text(row.get("reasoning"), limit=180),
+            "recent_history": history,
+            "resolution_state": resolution_state,
+            "has_resolution_signal": resolution_state in {"closed_or_non_operational", "resolved_or_decided_signal"},
+            "status_claim_guard": _status_claim_guard(resolution_state),
         }
         item.update(_followup_recency_fields(row))
         result.append(item)
@@ -935,6 +1087,12 @@ def collect_context(profile: dict, preferences: dict | None = None) -> dict:
         for row in _serialize_reminders("active", limit=MAX_ACTIVE_ITEMS + MAX_DUE_ITEMS)
         if row["id"] not in due_reminder_ids
     ][:MAX_ACTIVE_ITEMS]
+    due_followups, active_followups, due_reminders, active_reminders = _dedupe_context_groups(
+        due_followups,
+        active_followups,
+        due_reminders,
+        active_reminders,
+    )
     recent_sent = _serialize_recent_sent_emails()
     external = _collect_external_context(profile, preferences)
     return {

package/src/server.py

@@ -132,9 +132,12 @@ from tools_guardian import handle_guardian_rule_override
 from tools_api_call import (
     handle_api_call,
     handle_create_app_token,
+    handle_support_ticket_close,
     handle_support_ticket_create,
     handle_support_ticket_list,
+    handle_support_ticket_message,
     handle_support_ticket_read,
+    handle_support_ticket_reopen,
 )
 from runtime_versioning import (
     RestartRequiredMiddleware,
@@ -3198,9 +3201,33 @@ def nexo_support_ticket_read(ticket_id: str) -> str:
 
 
 @mcp.tool
-def nexo_support_ticket_create(subject: str, message: str, priority: str = "normal") -> str:
+def nexo_support_ticket_create(
+    subject: str,
+    message: str,
+    priority: str = "normal",
+    client_message_id: str = "",
+    origin: str = "desktop",
+) -> str:
     """Create a real NEXO support ticket for a product bug/setup issue."""
-    return handle_support_ticket_create(subject, message, priority)
+    return handle_support_ticket_create(subject, message, priority, client_message_id, origin)
+
+
+@mcp.tool
+def nexo_support_ticket_message(ticket_id: str, body: str, client_message_id: str = "") -> str:
+    """Append an evidence note to a real NEXO support ticket before status changes."""
+    return handle_support_ticket_message(ticket_id, body, client_message_id)
+
+
+@mcp.tool
+def nexo_support_ticket_close(ticket_id: str) -> str:
+    """Close a real NEXO support ticket after evidence has been recorded."""
+    return handle_support_ticket_close(ticket_id)
+
+
+@mcp.tool
+def nexo_support_ticket_reopen(ticket_id: str) -> str:
+    """Reopen a real NEXO support ticket if fresh evidence shows it is active."""
+    return handle_support_ticket_reopen(ticket_id)
 
 
 @mcp.tool

package/src/tools_api_call.py

@@ -1,11 +1,14 @@
 """HTTP API calls to the nexo-desktop-web backend using the user's session bearer.
 
-Exposes two MCP tools registered in server.py:
+Exposes MCP tools registered in server.py:
   - nexo_api_call(method, path, body_json, idempotency_key, headers_json, base_url)
   - nexo_create_app_token(name, abilities, allowed_platforms, expires_at)
   - nexo_support_ticket_list(status, limit)
   - nexo_support_ticket_read(ticket_id)
   - nexo_support_ticket_create(subject, message, priority)
+  - nexo_support_ticket_message(ticket_id, body, client_message_id)
+  - nexo_support_ticket_close(ticket_id)
+  - nexo_support_ticket_reopen(ticket_id)
 
 The session bearer (Sanctum personal access token) is stored by NEXO Desktop in
 the OS keychain at:
@@ -210,7 +213,7 @@ def handle_support_ticket_list(status: str = "", limit: int = 20) -> str:
         parsed_limit = max(1, min(100, int(limit or 20)))
     except Exception:
         parsed_limit = 20
-    query["limit"] = str(parsed_limit)
+    query["per_page"] = str(parsed_limit)
     suffix = "?" + urlencode(query) if query else ""
     return handle_api_call("GET", f"/api/support/tickets{suffix}")
 
@@ -223,20 +226,75 @@ def handle_support_ticket_read(ticket_id: str) -> str:
     return handle_api_call("GET", f"/api/support/tickets/{quote(clean, safe='')}")
 
 
-def handle_support_ticket_create(subject: str, message: str, priority: str = "normal") -> str:
+def _normalize_support_priority(priority: str) -> str:
+    clean_priority = (priority or "normal").strip().lower()
+    if clean_priority == "urgent":
+        return "critical"
+    if clean_priority not in {"low", "normal", "high", "critical"}:
+        return "normal"
+    return clean_priority
+
+
+def handle_support_ticket_create(
+    subject: str,
+    message: str,
+    priority: str = "normal",
+    client_message_id: str = "",
+    origin: str = "desktop",
+) -> str:
     """Create a real NEXO support ticket instead of a private/internal followup."""
     clean_subject = (subject or "").strip()
     clean_message = (message or "").strip()
-    clean_priority = (priority or "normal").strip().lower()
+    clean_priority = _normalize_support_priority(priority)
+    clean_origin = (origin or "desktop").strip().lower()
     if not clean_subject:
         return "ERROR: subject is required."
     if not clean_message:
         return "ERROR: message is required."
-    if clean_priority not in {"low", "normal", "high", "urgent"}:
-        clean_priority = "normal"
+    if clean_origin not in {"desktop", "web", "auto_incident"}:
+        clean_origin = "desktop"
     payload = {
-        "subject": clean_subject,
-        "message": clean_message,
+        "title": clean_subject,
+        "description": clean_message,
         "priority": clean_priority,
+        "origin": clean_origin,
     }
+    clean_client_message_id = (client_message_id or "").strip()
+    if clean_client_message_id:
+        payload["client_message_id"] = clean_client_message_id
     return handle_api_call("POST", "/api/support/tickets", body_json=json.dumps(payload, ensure_ascii=False))
+
+
+def handle_support_ticket_message(ticket_id: str, body: str, client_message_id: str = "") -> str:
+    """Append an evidence note to a real NEXO support ticket."""
+    clean = (ticket_id or "").strip()
+    clean_body = (body or "").strip()
+    if not clean:
+        return "ERROR: ticket_id is required."
+    if not clean_body:
+        return "ERROR: body is required."
+    payload = {"body": clean_body}
+    clean_client_message_id = (client_message_id or "").strip()
+    if clean_client_message_id:
+        payload["client_message_id"] = clean_client_message_id
+    return handle_api_call(
+        "POST",
+        f"/api/support/tickets/{quote(clean, safe='')}/messages",
+        body_json=json.dumps(payload, ensure_ascii=False),
+    )
+
+
+def handle_support_ticket_close(ticket_id: str) -> str:
+    """Close a real NEXO support ticket after evidence has been recorded."""
+    clean = (ticket_id or "").strip()
+    if not clean:
+        return "ERROR: ticket_id is required."
+    return handle_api_call("POST", f"/api/support/tickets/{quote(clean, safe='')}/close")
+
+
+def handle_support_ticket_reopen(ticket_id: str) -> str:
+    """Reopen a real NEXO support ticket when fresh evidence shows it is still active."""
+    clean = (ticket_id or "").strip()
+    if not clean:
+        return "ERROR: ticket_id is required."
+    return handle_api_call("POST", f"/api/support/tickets/{quote(clean, safe='')}/reopen")

package/src/tools_sessions.py

@@ -111,7 +111,7 @@ def _safe_packet_payload(value, *, _depth: int = 0):
         return [_safe_packet_payload(item, _depth=_depth + 1) for item in list(value)[:100]]
     return _safe_packet_text(value)
 
-_keepalive_threads: dict[str, threading.Event] = {}  # sid → stop_event
+_keepalive_threads: dict[str, tuple[threading.Event, threading.Thread]] = {}  # sid -> (stop_event, thread)
 
 
 def _env_flag(name: str, default: bool = False) -> bool:
@@ -235,16 +235,34 @@ def _start_keepalive(sid: str) -> None:
     """Start a keepalive thread for the given session."""
     _stop_keepalive(sid)  # clean up any leftover
     stop_event = threading.Event()
-    _keepalive_threads[sid] = stop_event
     t = threading.Thread(target=_keepalive_loop, args=(sid, stop_event), daemon=True)
+    _keepalive_threads[sid] = (stop_event, t)
     t.start()
 
 
-def _stop_keepalive(sid: str) -> None:
+def _stop_keepalive(sid: str, join_timeout: float = 1.0) -> None:
     """Signal the keepalive thread for the given session to stop."""
-    stop_event = _keepalive_threads.pop(sid, None)
-    if stop_event is not None:
+    entry = _keepalive_threads.pop(sid, None)
+    if entry is None:
+        return
+    stop_event, thread = entry
+    stop_event.set()
+    if thread is not threading.current_thread():
+        thread.join(timeout=max(0.0, join_timeout))
+
+
+def _stop_all_keepalives(join_timeout: float = 1.0) -> None:
+    """Signal and briefly join all keepalive threads before DB shutdown."""
+    entries = list(_keepalive_threads.values())
+    _keepalive_threads.clear()
+    for stop_event, _thread in entries:
         stop_event.set()
+    deadline = time.monotonic() + max(0.0, join_timeout)
+    for _stop_event, thread in entries:
+        if thread is threading.current_thread():
+            continue
+        remaining = max(0.0, deadline - time.monotonic())
+        thread.join(timeout=remaining)
 
 
 def _generate_sid() -> str:

package/templates/core-prompts/morning-agent.md

@@ -20,6 +20,10 @@ Hard rules:
 - Prioritise what changed recently, what is due now, what is blocked, and what deserves focus today.
 - If activity was quiet, say so plainly instead of padding.
 - Mention operator decisions only when the context actually supports them.
+- Treat `recent_history`, `resolution_state`, `has_resolution_signal`, and `status_claim_guard` as stronger evidence than an older description field. If history says a subtopic was decided, resolved, discarded, covered, or moved to monitoring, do not ask the operator to decide it again.
+- If a followup remains pending for one reason but its description mentions another subtopic already decided in history, discuss only the still-open reason. Do not drag the decided subtopic back into "waiting for your decision".
+- Do not duplicate the same topic across sections. If one item could fit Top priorities and Decisions/green lights, mention it once in the most useful section.
+- Never say "authorized", "done", "deployed", "closed", or equivalent unless the structured context provides direct evidence in status, verification, recent_history, sent email, or external verified data. If evidence is missing or contradictory, say the exact current state such as "waiting for approval", "in diagnosis", or "not verified yet".
 - Treat followup recency as evidence: `last_activity`, `days_open`, `days_since_activity`, and `stale_without_recent_signal` are there to prevent stale items from becoming today's top action by accident.
 - Do not promote a followup to opening/top priority/decision of the day when it is `owner=user`, stale for 3+ days, or its own description/diaries say the incident is contained, stable, historical, already resolved, or waiting only for a billing/admin confirmation. In that case mention it, if useful, as "risk in seguimiento" or "pendiente administrativo", not as a live crisis.
 - Never reconstruct an old crisis from a contained followup. If the context says a service is stable after a date/time, use that stability as the current status unless there is fresh contrary evidence in the structured context.

package/tool-enforcement-map.json

@@ -354,6 +354,19 @@
       },
       "triggers_after": []
     },
+    "nexo_support_ticket_close": {
+      "description": "Close a real authenticated NEXO support ticket",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_support_ticket_list": {
       "description": "List authenticated NEXO support tickets",
       "category": "support",
@@ -367,6 +380,19 @@
       },
       "triggers_after": []
     },
+    "nexo_support_ticket_message": {
+      "description": "Append an evidence note to a real authenticated NEXO support ticket",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_support_ticket_read": {
       "description": "Read one authenticated NEXO support ticket by ID",
       "category": "support",
@@ -380,6 +406,19 @@
       },
       "triggers_after": []
     },
+    "nexo_support_ticket_reopen": {
+      "description": "Reopen a real authenticated NEXO support ticket",
+      "category": "support",
+      "source": "server",
+      "requires": [],
+      "provides": ["support_ticket"],
+      "internal_calls": ["nexo_api_call"],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_artifact_create": {
       "description": "Register artifact (service, dashboard, script)",
       "category": "artifact",
@@ -3283,6 +3322,19 @@
       },
       "triggers_after": []
     },
+    "nexo_memory_forget": {
+      "description": "Selective forget for revoked secrets or reversible fact correction",
+      "category": "memory",
+      "source": "server",
+      "requires": [],
+      "provides": [],
+      "internal_calls": [],
+      "enforcement": {
+        "level": "none",
+        "rules": []
+      },
+      "triggers_after": []
+    },
     "nexo_memory_health": {
       "description": "Report Memory Observations v2 health and table status",
       "category": "memory",