NEXO 7.20.4 — local memory privacy hardening

Published 2026-05-13. Patch release over v7.20.3.

Why this release exists

Local Context is designed to give NEXO a useful memory of local files, projects and documents. v7.20.4 tightens the privacy boundary so private runtime folders, credential dotfiles, hidden project folders and files containing token-like secrets never become searchable chunks, embeddings, graph relations or agent context.

What changed

• Private paths are blocked earlier. Dotfiles such as .npmrc, .boto, .claude.json, .mcp.json, .nexo/**, hidden project folders and temporary files are skipped before inventory or extraction.
• Secret-bearing content is inventory-only. If a normal-looking file contains token, password or private-key patterns, Brain removes chunks, embeddings, entities and relations and keeps only a blocked asset marker.
• Old residue is repaired. Local index hygiene, doctor fix and the background service cycle purge private assets, stale jobs, chunks, embeddings, entities, relations and directory checkpoints left by older builds.
• Agent context is redacted. Context queries return redacted display_path values only and filter non-queryable privacy classes before results reach agents.

Validation

PYTHONDONTWRITEBYTECODE=1 pytest -q tests/test_local_context.py \
  tests/test_local_context_cli.py \
  tests/test_local_context_pre_action.py -p no:cacheprovider
# 31 passed

python3 -m py_compile src/local_context/privacy.py \
  src/local_context/api.py \
  src/local_context/extractors.py \
  src/doctor/providers/runtime.py
# clean

# Live operator DB hygiene after fix:
# private residue: 0
# hidden chunk hits: 0
# secret chunk hits: 0

Full changelog entry → · Previous public Local Context hardening note