5.3.2 is a runtime-boundary patch. It does not add a brand-new cognitive subsystem. It makes a subtler but equally important promise enforceable: packaged core runtime files should not masquerade as operator-owned scripts just because they happen to live under the same runtime home.
The user-facing problem
After 5.3.1, packaged installs were finally anchored to ~/.nexo again, but the runtime still had an honesty problem: some packaged core scripts and hook shims could be discovered through the same filesystem bucket used for personal scripts. That makes the product feel unreliable because the user cannot easily tell what belongs to the public runtime and what belongs to their own operator layer.
What 5.3.2 changes
- Runtime core-artifacts manifest. Packaged installs now persist which top-level runtime scripts and hooks are shipped as product artifacts. The personal script registry reads that manifest, so a file can be classified as core even if it physically lives under
~/.nexo/scripts. - Heartbeat hooks are promoted into core. The Claude Code heartbeat wrappers now live under the managed hooks surface.
nexo updaterewrites managed client configs to those core hook paths and removes the retired legacy wrappers from the personal runtime bucket. - Stale public surface is removed. A public LaunchAgent template that referenced a non-packaged GitHub-monitor script is removed instead of being quietly treated as “maybe core later.” If something is not actually packaged core, it should not pretend to be.
Why this matters
The difference is operational, not cosmetic. A user can install NEXO from npm, keep years of their own data in ~/.nexo, work on the source repo separately if they want to, and still use nexo update without the packaged product surface bleeding into their personal automation bucket. The runtime remains replaceable; the data remains durable; the ownership boundary is explicit.
Client nuance stays honest
Claude Code still has the deepest hook surface, so it is where heartbeat and protocol hooks are managed most tightly. Codex and Claude Desktop share the same brain and supported runtime surfaces, but this release does not fake hook parity where the client does not provide it. Product surface stays shared; hook depth stays client-specific.
Validation
This release is backed by dedicated regression coverage for runtime core-artifacts manifests, packaged-update cleanup of retired heartbeat files, client-sync hook rewrites, and the personal-script classification rules. The real runtime audit now also yields zero collisions between the personal bucket and the public core product surface after the new manifest is applied.
Upgrade
If you want the exact release record, open the 5.3.2 changelog section. If you are already installed, the intended path is simply:
npm install -g nexo-brain@5.3.2nexo update
Your data stays in ~/.nexo. The runtime stays replaceable. The product surface and your own runtime layer stop pretending to be the same thing.