This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryFixed installer leaking export PATH="$NEXO_HOME/bin:$PATH" into user shell profiles.
Full changelog
[6.0.6] - 2026-04-17
Fixed
- Installer leaked
export PATH="$NEXO_HOME/bin:$PATH"into the developer's real shell profile wheneverNEXO_HOMEwas not the canonical$HOME/.nexo. Repro: any pytest case, sandbox, or CI job that ran the installer withNEXO_HOME=/tmp/pytest-xxxappended# NEXO runtime CLI\nexport PATH="/tmp/pytest-xxx/bin:$PATH"to~/.bash_profile,~/.bashrc, and~/.zshrc— contaminating the operator's real shell between runs._ensure_runtime_cli_in_shell()(and its two JavaScript twins inbin/nexo-brain.js: install Step 8 and the migration path) computed the rc file list fromPath.home()/os.homedir()regardless of whereNEXO_HOMEpointed. Reported by a Claude Code session recovering the runtime after a full reset.
Added
src/auto_update.py::_should_skip_shell_profile_backfill(). Returns(skip, reason)based on (a)NEXO_SKIP_SHELL_PROFILE=1|true|yes|onand (b) whetherNEXO_HOMEresolves to the canonicalmanaged_nexo_home()path. Used by_ensure_runtime_cli_in_shell()to gate the write. Fail-safe: whenNEXO_HOMEmatches the canonical install path and the flag is unset, behaviour is unchanged.bin/nexo-brain.js::shouldSkipShellProfileBackfill(). Mirror of the Python helper. Guards both call sites that touch.bash_profile/.bashrc/.zshrc: theinstallcommand Step 8 (alias + PATH for fresh operators) and themigratepath that restores the alias for existing installs.tests/test_auto_update_shell_profile.py. Five regression cases covering: pytest tmp dir (non-canonical) → skip, env flag → skip, canonical install → write, multiple truthy flag values, and env flag set to0with canonical install → write.
Housekeeping
.github/workflows/tests 2.yml— duplicate workflow file with a space in the name (accidentally committed alongsidetests.yml) removed. Also purged 78+ stale__pycache__/*\ 2.*duplicates created by Finder copies during earlier releases.
What's Changed
- docs: add v6.0.5 blog post by @wazionapps in https://github.com/wazionapps/nexo/pull/209
- v6.0.6 — Installer no longer leaks $NEXO_HOME/bin into shell profile by @wazionapps in https://github.com/wazionapps/nexo/pull/210
Full Changelog: https://github.com/wazionapps/nexo/compare/v6.0.5...v6.0.6
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About wazionapps/nexo
Cognitive memory for AI agents with Atkinson-Shiffrin memory model (STM/LTM/sensory register), semantic RAG, Ebbinghaus decay, trust scoring, and 76+ MCP tools.
Related context
Beta — feedback welcome: [email protected]