nyxora 1.4.5 → 1.4.7

package/IDENTITY.md

@@ -1,7 +1,17 @@
-You are a Web3 AI assistant named Nyxora.
+You are Nyxora, a highly efficient Web3 AI engine.
 
-Use the following identity guidelines:
+---
+**CRITICAL EFFICIENCY & TONE RULES (MANDATORY):**
+1. ZERO CONVERSATIONAL FILLER. Never say "Sebagai Nyxora..." or "Saya dapat membantu..." or "Berikut adalah...".
+2. NO INTRODUCTIONS. NO OUTROS.
+3. GO STRAIGHT TO THE POINT. If the user asks for a price, just give the price.
+4. NO APOLOGIES. DO NOT use polite words. Be purely factual and robotic.
+5. NEVER explain your internal reasoning unless explicitly asked.
+6. If an error occurs, output ONLY the technical error message in 1 sentence.
 
-* Always be professional, visionary, and futuristic.
-* You are a living entity inside the blockchain network.
-* You help users navigate the crypto world safely.
+EXAMPLE GOOD RESPONSE:
+"Harga Bitcoin (BTC) adalah $74,240 USD.
+Perubahan 24 jam terakhir: -2.0165%"
+
+EXAMPLE BAD RESPONSE:
+"Baik, saya telah mengecek harga Bitcoin untuk Anda. Harga saat ini adalah..." (DO NOT DO THIS)

package/README.md

@@ -1,32 +1,30 @@
 # Nyxora Agent 🤖
+**Secure AI execution framework for Web3 agents.**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#)
-[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#)
-[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#)
+[![Security: Security-First](https://img.shields.io/badge/Security-Security--First-blue.svg)](#️-security-threat-model--permission-boundary)
+[![Execution: Human-in-the-Loop](https://img.shields.io/badge/Execution-Human--in--the--Loop-orange.svg)](#📐-architecture-workflow)
+[![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#️-security-threat-model--permission-boundary)
 
-A **secure, non-custodial, AI-native Web3 and System Automation Agent** built with Node.js and React. Designed for autonomous workflows with a premium Glassmorphism UI dashboard and client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model for financial transactions, requiring explicit operator approval for any on-chain action.
+Nyxora is a **secure, non-custodial runtime infrastructure for autonomous onchain agents** built with Node.js and React. Designed for autonomous workflows with a premium Glassmorphism UI dashboard and strict client-side key isolation. It operates under a strict **Human-in-the-Loop** execution model for financial transactions.
 
 ---
 
-## Key Features
+## 🔥 Key Features
 
-### Advanced Trading, Security & Operations (New in v1.4.1)
+### Advanced Trading, Security & Operations
 *   **System Automation & Full OS Access**: Instruct the agent to read/write local files, run terminal commands, and browse the web natively.
 *   **NLP Security Policy**: Command Nyxora using natural language to set security boundaries (e.g., *"Never touch partition E"*). Nyxora autonomously enforces these rules.
-*   **Dynamic Plugin Manager**: Dynamically load community-built skills. Simply provide a GitHub Gist URL, and Nyxora will hot-load the third-party skill.
+*   **Dynamic Plugin Sandboxing**: Dynamically load community-built skills with restricted FS/Shell access to prevent supply chain attacks and malicious payloads.
 *   **Anti-Rugpull & Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
 *   **Automated Limit Orders**: Set natural language rules (e.g., "Sell my PEPE if price drops below $0.001"). Nyxora runs a background cron monitor and executes the swap while you sleep.
 *   **PNL & Portfolio Tracking**: The AI scans your wallets and multiplies balances by live DEX prices to give you real-time Net Worth estimations.
 
 ### Core Features
-*   **Multi-LLM Support**: Seamlessly switch between Google Gemini, OpenAI, OpenRouter (unlimited models!), or local Ollama models dynamically.
+*   **Multi-LLM Support**: Seamlessly switch between Google Gemini, OpenAI, OpenRouter, or local Ollama models.
 *   **Premium Glassmorphism UI**: A gorgeous, resizable split-pane interface with Pseudo-Generative UI widgets (`<BalanceWidget>`, `<MarketWidget>`, `<SwapWidget>`).
 *   **Round-Robin API Rotation**: Add up to 10 API keys via the dashboard. The system will auto-rotate them to prevent rate-limiting and token drain.
 *   **Deep Personalization**: Feed the agent custom rules via `user.md` and define its core persona via `IDENTITY.md`.
-*   **Multi-Lingual Auto-Sync**: The agent natively detects your language and replies in the exact same language automatically.
-*   **Omnichannel Approvals & Telegram Integration**: Connect Nyxora to a Telegram Bot to execute trades, check prices, and chat on the go. Approve transactions directly from Telegram inline buttons!
-*   **Multi-Chain Support**: Pre-configured support for Ethereum, Base, BSC, Arbitrum, Optimism, and Sepolia Testnet.
 
 ---
 
@@ -38,76 +36,46 @@ This diagram shows how user interactions flow through the Nyxora Agent, from cha
 
 ---
 
-## 🛡️ Safety Model
+## 🛡️ Security, Threat Model & Permission Boundary
 
-To protect user assets and prevent common security concerns associated with AI agents, `Nyxora` operates under a strict safety specification:
-
-*   **No .env Leaks**: Your Private Key is encrypted using `AES-256-GCM` and locked behind a custom Master Password in `~/.nyxora/keystore.json`.
-*   **No Credential Collection**: Private keys are handled strictly within local volatile memory and are never transmitted to LLM providers.
-*   **Explicit Transaction Confirmation**: Write actions (like transfers, swaps, bridges) require manual, explicit confirmation from the human operator via the Web Dashboard or Telegram before broadcasting.
-*   **Human-in-the-Loop Execution**: The tool is engineered as a secure operational utility. The AI agent acts as a command generator, leaving financial execution authority with the human controller.
-
----
-
-## 📋 Example Safe Workflows
-
-The agent is designed for Web3 exploration, daily operations, and secure transaction execution. Typical workflows include:
-
-*   **Audit New Tokens**: Tell the AI, *"Check if the contract 0x... on Base is safe to buy."*
-*   **Track Portfolio Assets**: Tell the AI, *"What is my total net worth across all chains right now?"*
-*   **Automate Trading**: Tell the AI, *"Create a limit order to sell 1000 USDC for ETH if ETH drops below $3000."*
-*   **System Operations**: Tell the AI, *"Check my computer's RAM usage and save it to stats.txt."*
-
----
-
-## 🔒 Security, Threat Model & Permission Boundary
-
-This agent is designed with a **Zero-Knowledge to LLM** architectural pattern to ensure the highest levels of security:
+This agent is designed with a **Zero-Knowledge to LLM** architectural pattern to ensure the highest levels of security for investors and users:
 
 *   **Zero-Knowledge to AI Agent (LLM)**: Remote AI Agents and Large Language Models (LLMs) **never** handle your private keys. The LLM only generates structured JSON tool calls.
-*   **Cryptographic Memory Isolation**: Transaction signing occurs strictly client-side within the local Node.js process runtime using `viem`. 
-
-### 🛡️ Threat Model
-*   **NLP Sandboxing**: System access is bounded by plain-text rules defined in `security_policy.md`. The AI evaluates its own actions against this policy before execution.
-*   **Strict API Auth**: The local Express server is protected via ephemeral Session Tokens (`x-nyxora-token`) and Strict CORS.
-*   **Non-Autonomous Financials**: The tool never executes unsolicited on-chain actions. Every financial transaction is queued pending human approval.
-
-### 📋 Permission Boundary Matrix
-
-| Access Category | Permission Boundary | Rationale |
-| :--- | :--- | :--- |
-| **Read Access** | Read-Only Blockchain Queries | Fetching balances, contract security audits, transaction logs, and technical indicators. |
-| **Write Access**| Optional Wallet Signing | Required **only** for broadcasting transactions (swap, bridge, mint, transfer). Locked behind Human Approval. |
-| **Network Access**| Bounded Public APIs | Restricted strictly to the configured RPC endpoints, Block Explorers, DexScreener, and LLM APIs. |
-| **System Access**| Local Machine Access | Governed entirely by `security_policy.md`. The agent can run OS commands but will halt if it detects a policy violation. |
-
-For the full detailed security specifications, contact info, and vulnerability reporting procedures, refer to the [SECURITY.md](SECURITY.md) policy document.
+*   **Cryptographic Memory Isolation**: Transaction signing occurs strictly client-side within the local Node.js process runtime using `viem`. `~/.nyxora/keystore.json` is encrypted with AES-256-GCM.
+*   **Plugin Sandboxing**: Built with future plugin ecosystems in mind. Third-party plugins are explicitly denied unrestricted `fs` (FileSystem) and `shell` access to prevent supply chain attacks and malicious execution.
+*   **Human-in-the-Loop**: Write actions (like transfers, swaps, bridges) require manual confirmation from the human operator before broadcasting.
 
 ---
 
 ## 🚀 Quick Start & Installation
 
-Nyxora is available on NPM and can be installed as a global CLI tool on your operating system.
-
-### 1. Global Installation
+### 1. General Users (CLI Install)
 Open your terminal (Command Prompt, PowerShell, or Linux Terminal) and run:
 ```bash
 npm install -g nyxora
+nyxora setup
 ```
+The Interactive Setup Wizard will securely generate a local vault, configure your LLM, and offer to Auto-Generate a Web3 Wallet for you.
 
-### 2. Launching Nyxora
-No need to navigate to any specific folder! Just type:
+### 2. Local Development (For Contributors)
+If you want to modify Nyxora's code, build new skills, or contribute:
 ```bash
-nyxora
+git clone https://github.com/perasyudha/Nyxora.git
+cd Nyxora
+npm install
+cd dashboard && npm install && cd ..
+npm run build && npm run start
 ```
-On first launch, Nyxora will greet you with an **Interactive Setup Wizard**. This CLI wizard will guide you to securely configure your LLM providers, API keys, and Master Password Wallet. 
 
-The system will automatically initialize a secure vault in your `~/.nyxora/` directory and open the Web Dashboard in your browser!
+---
+
+## 📖 Official Documentation
+
+For complete technical deep-dives, please visit our official VitePress Documentation Site!
 
-## Architecture
-*   **Backend**: Node.js, Express, Viem (Web3), node-telegram-bot-api, OpenAI API.
-*   **Frontend**: React, Vite, Vanilla CSS, Web Speech API (TTS/STT).
-*   **Data**: Local `~/.nyxora/config.yaml` and `~/.nyxora/memory.json`.
+> **🔗 [Read the Full Nyxora Documentation Here](https://perasyudha.github.io/Nyxora/)**
 
-## License
-MIT License
+*(Includes guides on Secure Wallet Imports, API Key Rotations, Troubleshooting, and Custom Skill Development).*
+
+---
+**License:** MIT License

package/dist/agent/reasoning.js

@@ -31,6 +31,7 @@ const browseWeb_1 = require("../system/skills/browseWeb");
 const installSkill_1 = require("../system/skills/installSkill");
 const pluginManager_1 = require("../system/pluginManager");
 const paths_1 = require("../config/paths");
+const picocolors_1 = __importDefault(require("picocolors"));
 exports.logger = new logger_1.Logger();
 let currentKeyIndex = 0;
 function getOpenAI() {
@@ -91,6 +92,41 @@ function getOpenAI() {
         });
     }
 }
+async function executeWithRetry(requestBuilder, maxRetries = 3) {
+    let retries = 0;
+    while (retries <= maxRetries) {
+        try {
+            const client = getOpenAI();
+            return await requestBuilder(client);
+        }
+        catch (error) {
+            const status = error?.status || error?.response?.status;
+            // 401 Unauthorized or 400 Bad Request - don't retry, it's fatal
+            if (status === 401 || status === 400) {
+                console.error(`[LLM] Fatal Error ${status}: ${error.message}. Aborting.`);
+                throw error;
+            }
+            // 429 Rate Limit - rotate provider/key immediately and retry
+            if (status === 429) {
+                console.warn(`[LLM] Rate Limit (429) hit. Rotating key...`);
+                // getOpenAI() automatically rotates to next key if available
+                retries++;
+                if (retries > maxRetries)
+                    throw error;
+                continue; // Try next key immediately
+            }
+            // 500, 502, 503, Timeout, Network error - Exponential Backoff
+            retries++;
+            if (retries > maxRetries) {
+                console.error(`[LLM] Max retries reached.`);
+                throw error;
+            }
+            const delayMs = Math.pow(2, retries) * 1000; // 2s, 4s, 8s
+            console.warn(`[LLM] API Error (${status || error.message}). Retrying in ${delayMs}ms...`);
+            await new Promise(resolve => setTimeout(resolve, delayMs));
+        }
+    }
+}
 function getSystemPrompt() {
     const config = (0, parser_1.loadConfig)();
     let basePrompt = `You are an autonomous Web3 agent operating on EVM chains.
@@ -134,7 +170,7 @@ If the user doesn't specify a chain, default to: ${config.agent.default_chain}.`
     }
     return basePrompt;
 }
-async function processUserInput(input, role = 'user') {
+async function processUserInput(input, role = 'user', onProgress) {
     const config = (0, parser_1.loadConfig)();
     // Add input to memory
     exports.logger.addEntry({ role, content: input });
@@ -162,36 +198,37 @@ async function processUserInput(input, role = 'user') {
         if (config.llm.provider !== 'openai' && config.llm.provider !== 'ollama' && config.llm.provider !== 'gemini' && config.llm.provider !== 'openrouter') {
             return `Provider ${config.llm.provider} is configured, but currently only OpenAI, OpenRouter, Ollama, and Gemini adapters are implemented.`;
         }
-        const openai = getOpenAI();
-        const response = await openai.chat.completions.create({
-            model: config.llm.model,
-            temperature: config.llm.temperature,
-            messages: messages,
-            tools: [
-                getBalance_1.getBalanceToolDefinition,
-                transfer_1.transferToolDefinition,
-                getPrice_1.getPriceToolDefinition,
-                swapToken_1.swapTokenToolDefinition,
-                bridgeToken_1.bridgeTokenToolDefinition,
-                mintNft_1.mintNftToolDefinition,
-                customTx_1.customTxToolDefinition,
-                createWallet_1.createWalletToolDefinition,
-                checkSecurity_1.checkSecurityToolDefinition,
-                marketAnalysis_1.marketAnalysisToolDefinition,
-                checkPortfolio_1.checkPortfolioToolDefinition,
-                limitOrderManager_1.createLimitOrderToolDefinition,
-                limitOrderManager_1.listLimitOrdersToolDefinition,
-                limitOrderManager_1.cancelLimitOrderToolDefinition,
-                updateProfile_1.updateProfileToolDefinition,
-                updateSecurityPolicy_1.updateSecurityPolicyToolDefinition,
-                readFile_1.readLocalFileToolDefinition,
-                writeFile_1.writeLocalFileToolDefinition,
-                executeShell_1.runTerminalCommandToolDefinition,
-                browseWeb_1.browseWebsiteToolDefinition,
-                installSkill_1.installExternalSkillToolDefinition,
-                ...pluginManager_1.pluginManager.getToolDefinitions()
-            ],
-            tool_choice: "auto",
+        const response = await executeWithRetry(async (client) => {
+            return await client.chat.completions.create({
+                model: config.llm.model,
+                temperature: config.llm.temperature,
+                messages: messages,
+                tools: [
+                    getBalance_1.getBalanceToolDefinition,
+                    transfer_1.transferToolDefinition,
+                    getPrice_1.getPriceToolDefinition,
+                    swapToken_1.swapTokenToolDefinition,
+                    bridgeToken_1.bridgeTokenToolDefinition,
+                    mintNft_1.mintNftToolDefinition,
+                    customTx_1.customTxToolDefinition,
+                    createWallet_1.createWalletToolDefinition,
+                    checkSecurity_1.checkSecurityToolDefinition,
+                    marketAnalysis_1.marketAnalysisToolDefinition,
+                    checkPortfolio_1.checkPortfolioToolDefinition,
+                    limitOrderManager_1.createLimitOrderToolDefinition,
+                    limitOrderManager_1.listLimitOrdersToolDefinition,
+                    limitOrderManager_1.cancelLimitOrderToolDefinition,
+                    updateProfile_1.updateProfileToolDefinition,
+                    updateSecurityPolicy_1.updateSecurityPolicyToolDefinition,
+                    readFile_1.readLocalFileToolDefinition,
+                    writeFile_1.writeLocalFileToolDefinition,
+                    executeShell_1.runTerminalCommandToolDefinition,
+                    browseWeb_1.browseWebsiteToolDefinition,
+                    installSkill_1.installExternalSkillToolDefinition,
+                    ...pluginManager_1.pluginManager.getToolDefinitions()
+                ],
+                tool_choice: "auto",
+            });
         });
         const responseMessage = response.choices[0].message;
         // Log tracking
@@ -213,103 +250,147 @@ async function processUserInput(input, role = 'user') {
                 let result = "";
                 const args = JSON.parse(toolCall.function.arguments);
                 const toolName = toolCall.function.name;
-                switch (toolName) {
-                    case 'get_balance': {
-                        result = await (0, getBalance_1.getBalance)(args.chainName, args.address, args.token);
-                        break;
-                    }
-                    case 'transfer_token':
-                    case 'transfer_native': {
-                        result = await (0, transfer_1.prepareTransfer)(args.chainName, args.toAddress, args.amountStr || args.amountEth, args.token);
-                        break;
-                    }
-                    case 'get_price': {
-                        result = await (0, getPrice_1.getPrice)(args.coinId);
-                        break;
-                    }
-                    case 'swap_token': {
-                        result = await (0, swapToken_1.prepareSwapToken)(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
-                        break;
-                    }
-                    case 'bridge_token': {
-                        result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChainName, args.toChainName, args.fromToken, args.toToken, args.amountStr, args.mode, args.providerName);
-                        break;
-                    }
-                    case 'mint_nft': {
-                        result = await (0, mintNft_1.prepareMintNft)(args.chainName, args.contractAddress, args.functionSignature, args.argsStr, args.valueEth);
-                        break;
-                    }
-                    case 'custom_tx': {
-                        result = await (0, customTx_1.prepareCustomTx)(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
-                        break;
-                    }
-                    case 'create_wallet': {
-                        result = await (0, createWallet_1.createWallet)();
-                        break;
-                    }
-                    case 'check_token_security': {
-                        result = await (0, checkSecurity_1.checkTokenSecurity)(args.chainName, args.contractAddress);
-                        break;
-                    }
-                    case 'analyze_market': {
-                        result = await (0, marketAnalysis_1.analyzeMarket)(args.chainName, args.tokenAddressOrSymbol);
-                        break;
-                    }
-                    case 'check_portfolio': {
-                        result = await (0, checkPortfolio_1.checkPortfolio)(args.chainName, args.address);
-                        break;
-                    }
-                    case 'create_limit_order': {
-                        result = limitOrderManager_1.limitOrderManager.createOrder(args.chainName, args.fromToken, args.toToken, args.amountStr, args.targetPriceUsd, args.condition);
-                        break;
-                    }
-                    case 'list_limit_orders': {
-                        result = limitOrderManager_1.limitOrderManager.listOrders();
-                        break;
-                    }
-                    case 'cancel_limit_order': {
-                        result = limitOrderManager_1.limitOrderManager.cancelOrder(args.id);
-                        break;
-                    }
-                    case 'update_profile': {
-                        result = (0, updateProfile_1.updateProfile)(args.content, args.mode);
-                        break;
-                    }
-                    case 'update_security_policy': {
-                        result = (0, updateSecurityPolicy_1.updateSecurityPolicy)(args.rule, args.action);
-                        break;
-                    }
-                    case 'read_local_file': {
-                        result = (0, readFile_1.readLocalFile)(args.filePath);
-                        break;
-                    }
-                    case 'write_local_file': {
-                        result = (0, writeFile_1.writeLocalFile)(args.filePath, args.content);
-                        break;
-                    }
-                    case 'run_terminal_command': {
-                        result = await (0, executeShell_1.runTerminalCommand)(args.command);
-                        break;
-                    }
-                    case 'browse_website': {
-                        result = await (0, browseWeb_1.browseWebsite)(args.url);
-                        break;
-                    }
-                    case 'install_external_skill': {
-                        result = await (0, installSkill_1.installExternalSkill)(args.url);
-                        break;
-                    }
-                    default: {
-                        const externalResult = await pluginManager_1.pluginManager.executeTool(toolName, args);
-                        if (externalResult !== null) {
-                            result = externalResult;
+                console.log(picocolors_1.default.yellow(`[⚡ Eksekusi Tool] AI memanggil ${toolName}...`));
+                if (onProgress)
+                    onProgress(`_⚡ Menjalankan alat: ${toolName}..._`);
+                try {
+                    switch (toolName) {
+                        case 'get_balance': {
+                            result = await (0, getBalance_1.getBalance)(args.chainName, args.address, args.token);
+                            break;
+                        }
+                        case 'transfer_token':
+                        case 'transfer_native': {
+                            if (config.permissions?.web3?.allow_transfer === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Web3 transfers are disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = await (0, transfer_1.prepareTransfer)(args.chainName, args.toAddress, args.amountStr || args.amountEth, args.token);
+                            break;
+                        }
+                        case 'get_price': {
+                            result = await (0, getPrice_1.getPrice)(args.coinId);
+                            break;
+                        }
+                        case 'swap_token': {
+                            if (config.permissions?.web3?.allow_swap === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Web3 swaps are disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            // Note: max_usd_per_tx validation would ideally be calculated here before prepareSwapToken
+                            result = await (0, swapToken_1.prepareSwapToken)(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
+                            break;
+                        }
+                        case 'bridge_token': {
+                            if (config.permissions?.web3?.allow_transfer === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Web3 bridging (transfer) is disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChainName, args.toChainName, args.fromToken, args.toToken, args.amountStr, args.mode, args.providerName);
+                            break;
+                        }
+                        case 'mint_nft': {
+                            result = await (0, mintNft_1.prepareMintNft)(args.chainName, args.contractAddress, args.functionSignature, args.argsStr, args.valueEth);
+                            break;
+                        }
+                        case 'custom_tx': {
+                            if (config.permissions?.web3?.allow_transfer === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Custom transactions are blocked because transfers are disabled.`;
+                                break;
+                            }
+                            result = await (0, customTx_1.prepareCustomTx)(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
+                            break;
+                        }
+                        case 'create_wallet': {
+                            result = await (0, createWallet_1.createWallet)();
+                            break;
+                        }
+                        case 'check_token_security': {
+                            result = await (0, checkSecurity_1.checkTokenSecurity)(args.chainName, args.contractAddress);
+                            break;
+                        }
+                        case 'analyze_market': {
+                            result = await (0, marketAnalysis_1.analyzeMarket)(args.chainName, args.tokenAddressOrSymbol);
+                            break;
+                        }
+                        case 'check_portfolio': {
+                            result = await (0, checkPortfolio_1.checkPortfolio)(args.chainName, args.address);
+                            break;
+                        }
+                        case 'create_limit_order': {
+                            if (config.permissions?.web3?.allow_swap === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Limit orders require swap permissions. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = limitOrderManager_1.limitOrderManager.createOrder(args.chainName, args.fromToken, args.toToken, args.amountStr, args.targetPriceUsd, args.condition);
+                            break;
+                        }
+                        case 'list_limit_orders': {
+                            result = limitOrderManager_1.limitOrderManager.listOrders();
+                            break;
                         }
-                        else {
-                            result = `Error: Tool ${toolName} is not implemented.`;
+                        case 'cancel_limit_order': {
+                            result = limitOrderManager_1.limitOrderManager.cancelOrder(args.id);
+                            break;
                         }
-                        break;
+                        case 'update_profile': {
+                            result = (0, updateProfile_1.updateProfile)(args.content, args.mode);
+                            break;
+                        }
+                        case 'update_security_policy': {
+                            result = (0, updateSecurityPolicy_1.updateSecurityPolicy)(args.rule, args.action);
+                            break;
+                        }
+                        case 'read_local_file': {
+                            result = (0, readFile_1.readLocalFile)(args.filePath);
+                            break;
+                        }
+                        case 'write_local_file': {
+                            if (config.permissions?.system?.allow_file_write === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = (0, writeFile_1.writeLocalFile)(args.filePath, args.content);
+                            break;
+                        }
+                        case 'run_terminal_command': {
+                            if (config.permissions?.system?.allow_shell_execution === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: Shell execution is disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = await (0, executeShell_1.runTerminalCommand)(args.command);
+                            break;
+                        }
+                        case 'browse_website': {
+                            result = await (0, browseWeb_1.browseWebsite)(args.url);
+                            break;
+                        }
+                        case 'install_external_skill': {
+                            result = await (0, installSkill_1.installExternalSkill)(args.url);
+                            break;
+                        }
+                        default: {
+                            const externalResult = await pluginManager_1.pluginManager.executeTool(toolName, args);
+                            if (externalResult !== null) {
+                                result = externalResult;
+                            }
+                            else {
+                                result = `Error: Tool ${toolName} is not implemented.`;
+                            }
+                            break;
+                        }
+                    }
+                    if (result.includes('[Security Blocked]') || result.startsWith('Error:')) {
+                        console.log(picocolors_1.default.red(`[❌ Gagal] Tool ${toolName} mengembalikan error atau diblokir.`));
+                    }
+                    else {
+                        console.log(picocolors_1.default.green(`[✅ Sukses] Tool ${toolName} berhasil dieksekusi.`));
                     }
                 }
+                catch (toolError) {
+                    result = `Error executing ${toolName}: ${toolError.message}`;
+                    console.log(picocolors_1.default.red(`[❌ Error Crash] Eksekusi ${toolName} gagal total: ${toolError.message}`));
+                }
                 exports.logger.addEntry({
                     role: 'tool',
                     tool_call_id: toolCall.id,
@@ -336,10 +417,11 @@ async function processUserInput(input, role = 'user') {
                     return msg;
                 })
             ];
-            const openai = getOpenAI();
-            const secondResponse = await openai.chat.completions.create({
-                model: config.llm.model,
-                messages: secondMessages,
+            const secondResponse = await executeWithRetry(async (client) => {
+                return await client.chat.completions.create({
+                    model: config.llm.model,
+                    messages: secondMessages,
+                });
             });
             if (secondResponse.usage?.total_tokens) {
                 tracker_1.Tracker.addTokens(secondResponse.usage.total_tokens, config.llm.provider);

package/dist/config/parser.js

@@ -30,6 +30,10 @@ function loadConfig() {
             web3: { rpc_urls: {} },
             integrations: {
                 telegram: { enabled: false }
+            },
+            permissions: {
+                web3: { allow_transfer: false, allow_swap: true, max_usd_per_tx: 50 },
+                system: { allow_shell_execution: false, allow_file_write: false }
             }
         };
     }

package/dist/gateway/setup.js

@@ -11,6 +11,7 @@ const path_1 = __importDefault(require("path"));
 const paths_1 = require("../config/paths");
 const parser_1 = require("../config/parser");
 const crypto_1 = require("../utils/crypto");
+const accounts_1 = require("viem/accounts");
 async function runSetupWizard() {
     console.clear();
     const logo = `
@@ -76,12 +77,52 @@ Provider: ${config.llm.provider}`;
     if ((0, prompts_1.isCancel)(provider))
         return process.exit(0);
     // 2. Model Name
-    const model = await (0, prompts_1.text)({
-        message: 'Enter AI model name (e.g. gpt-4o, gemini-2.5-flash):',
-        initialValue: config.llm.model,
-    });
+    let modelOptions = [];
+    if (provider === 'gemini') {
+        modelOptions = [
+            { value: 'gemini-2.5-flash', label: 'gemini-2.5-flash (Fast & Cheap)' },
+            { value: 'gemini-2.5-pro', label: 'gemini-2.5-pro (Advanced Reasoning)' },
+            { value: 'gemini-1.5-pro', label: 'gemini-1.5-pro' },
+        ];
+    }
+    else if (provider === 'openai') {
+        modelOptions = [
+            { value: 'gpt-4o', label: 'gpt-4o (Powerful)' },
+            { value: 'gpt-4o-mini', label: 'gpt-4o-mini (Fast)' },
+            { value: 'o1-preview', label: 'o1-preview (Reasoning)' },
+            { value: 'o1-mini', label: 'o1-mini' },
+        ];
+    }
+    else if (provider === 'openrouter') {
+        modelOptions = [
+            { value: 'anthropic/claude-3.5-sonnet', label: 'Claude 3.5 Sonnet' },
+            { value: 'meta-llama/llama-3.1-70b-instruct', label: 'Llama 3.1 70B' },
+            { value: 'liquid/lfm-40b', label: 'Liquid LFM 40B' },
+            { value: 'google/gemini-pro-1.5', label: 'Gemini Pro 1.5' },
+        ];
+    }
+    else {
+        modelOptions = [
+            { value: 'llama3', label: 'Llama 3 (8B)' },
+            { value: 'qwen2', label: 'Qwen 2' },
+            { value: 'phi3', label: 'Phi-3' },
+        ];
+    }
+    modelOptions.push({ value: 'custom', label: 'Type manually (Custom Model)' });
+    let model = (await (0, prompts_1.select)({
+        message: 'Select AI Model:',
+        options: modelOptions,
+    }));
     if ((0, prompts_1.isCancel)(model))
         return process.exit(0);
+    if (model === 'custom') {
+        model = (await (0, prompts_1.text)({
+            message: 'Enter custom model name (e.g., deepseek-coder, llama-3-8b-instruct):',
+            initialValue: config.llm.model,
+        }));
+        if ((0, prompts_1.isCancel)(model))
+            return process.exit(0);
+    }
     // 3. API Key for LLM (Saved to config.yaml)
     let apiKey = '';
     if (provider !== 'ollama') {
@@ -121,19 +162,44 @@ Provider: ${config.llm.provider}`;
         if ((0, prompts_1.isCancel)(telegramToken))
             return process.exit(0);
     }
-    // 6. Wallet Private Key (keystore.json)
-    const privateKey = await (0, prompts_1.password)({
-        message: 'Enter Wallet Private Key (0x...)\n  (Will be AES-256-GCM encrypted. Leave empty to keep current):',
+    // 6. Wallet Setup
+    const walletSetupType = await (0, prompts_1.select)({
+        message: 'Web3 Wallet Setup:',
+        options: [
+            { value: 'skip', label: 'Skip for now (No Web3 execution)' },
+            { value: 'generate', label: 'Auto-Generate New Wallet (Recommended for testing)' },
+            { value: 'manual', label: 'Input Manual Private Key' },
+        ],
     });
-    if ((0, prompts_1.isCancel)(privateKey))
+    if ((0, prompts_1.isCancel)(walletSetupType))
         return process.exit(0);
+    let privateKey = '';
+    if (walletSetupType === 'manual') {
+        privateKey = (await (0, prompts_1.password)({
+            message: 'Enter Wallet Private Key (0x...)\n  (Will be AES-256-GCM encrypted. See documentation for import guides):',
+        }));
+        if ((0, prompts_1.isCancel)(privateKey))
+            return process.exit(0);
+    }
+    else if (walletSetupType === 'generate') {
+        privateKey = (0, accounts_1.generatePrivateKey)();
+        const account = (0, accounts_1.privateKeyToAccount)(privateKey);
+        (0, prompts_1.note)(`New Wallet Generated!\nAddress: ${account.address}\n\nIMPORTANT: Backup this address. The Private Key is securely injected into your local vault.`, 'Wallet Created');
+    }
     let masterPassword = '';
     if (privateKey) {
         masterPassword = (await (0, prompts_1.password)({
-            message: 'Enter MASTER PASSWORD to encrypt your key vault:',
+            message: 'Enter a strong MASTER PASSWORD to encrypt your key vault:',
         }));
         if ((0, prompts_1.isCancel)(masterPassword) || !masterPassword)
             return process.exit(0);
+        const masterPasswordConfirm = (await (0, prompts_1.password)({
+            message: 'Confirm MASTER PASSWORD:',
+        }));
+        if ((0, prompts_1.isCancel)(masterPasswordConfirm) || masterPassword !== masterPasswordConfirm) {
+            console.log(picocolors_1.default.red('❌ Passwords do not match. Setup cancelled.'));
+            return process.exit(1);
+        }
     }
     // --- SAVING ---
     // Update Config.yaml

package/dist/gateway/telegram.js

@@ -38,8 +38,25 @@ function startTelegramBot() {
             // Send typing action to Telegram
             bot.sendChatAction(chatId, 'typing');
             try {
+                let progressMsgId = null;
+                const onProgress = async (progressText) => {
+                    try {
+                        if (!progressMsgId) {
+                            const sent = await bot.sendMessage(chatId, progressText, { parse_mode: 'Markdown' });
+                            progressMsgId = sent.message_id;
+                        }
+                        else {
+                            await bot.editMessageText(progressText, { chat_id: chatId, message_id: progressMsgId, parse_mode: 'Markdown' });
+                        }
+                    }
+                    catch (e) { }
+                };
                 // Feed the message to the AI agent
-                const response = await (0, reasoning_1.processUserInput)(text);
+                const response = await (0, reasoning_1.processUserInput)(text, 'user', onProgress);
+                if (progressMsgId) {
+                    // Clean up the progress message
+                    bot.deleteMessage(chatId, progressMsgId).catch(() => { });
+                }
                 // Send the AI's response back to Telegram
                 // Check for newly created pending transactions
                 const pendingTxs = transactionManager_1.txManager.getPending();

package/dist/memory/logger.js

@@ -5,46 +5,105 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Logger = void 0;
 const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const parser_1 = require("../config/parser");
 const paths_1 = require("../config/paths");
 class Logger {
-    logFilePath;
-    memory = [];
+    db;
     constructor() {
         const config = (0, parser_1.loadConfig)();
-        this.logFilePath = (0, paths_1.getPath)(config.memory.path || 'memory.json');
-        this.loadMemory();
+        let dbPath = config.memory?.path || 'memory.db';
+        if (dbPath.endsWith('.json')) {
+            dbPath = dbPath.replace('.json', '.db');
+        }
+        const fullPath = (0, paths_1.getPath)(dbPath);
+        // Ensure directory exists
+        const dir = path_1.default.dirname(fullPath);
+        if (!fs_1.default.existsSync(dir)) {
+            fs_1.default.mkdirSync(dir, { recursive: true });
+        }
+        this.db = new better_sqlite3_1.default(fullPath);
+        this.initDb();
     }
-    loadMemory() {
-        if (fs_1.default.existsSync(this.logFilePath)) {
+    initDb() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS messages (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        name TEXT,
+        tool_call_id TEXT,
+        tool_calls TEXT,
+        timestamp DATETIME DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+        // Migration logic from old memory.json to SQLite
+        const config = (0, parser_1.loadConfig)();
+        const oldJsonPath = (0, paths_1.getPath)(config.memory?.path || 'memory.json');
+        const countRow = this.db.prepare('SELECT COUNT(*) as count FROM messages').get();
+        if (countRow.count === 0 && fs_1.default.existsSync(oldJsonPath)) {
             try {
-                const data = fs_1.default.readFileSync(this.logFilePath, 'utf-8');
-                this.memory = JSON.parse(data);
+                const data = fs_1.default.readFileSync(oldJsonPath, 'utf-8');
+                const oldMemory = JSON.parse(data);
+                if (Array.isArray(oldMemory) && oldMemory.length > 0) {
+                    const insert = this.db.prepare(`
+            INSERT INTO messages (role, content, name, tool_call_id, tool_calls)
+            VALUES (@role, @content, @name, @tool_call_id, @tool_calls)
+          `);
+                    const insertMany = this.db.transaction((entries) => {
+                        for (const entry of entries) {
+                            insert.run({
+                                role: entry.role,
+                                content: entry.content || '',
+                                name: entry.name || null,
+                                tool_call_id: entry.tool_call_id || null,
+                                tool_calls: entry.tool_calls ? JSON.stringify(entry.tool_calls) : null
+                            });
+                        }
+                    });
+                    insertMany(oldMemory);
+                    console.log('[Nyxora Memory] Successfully migrated memory.json to SQLite database (Atomic Storage).');
+                    // Rename old file to prevent re-migration issues and keep as backup
+                    fs_1.default.renameSync(oldJsonPath, oldJsonPath + '.bak');
+                }
             }
             catch (error) {
-                console.error('Failed to read memory file. Starting fresh.');
-                this.memory = [];
+                console.error('[Nyxora Memory] Failed to migrate old memory.json:', error);
             }
         }
     }
-    saveMemory() {
-        try {
-            fs_1.default.writeFileSync(this.logFilePath, JSON.stringify(this.memory, null, 2));
-        }
-        catch (error) {
-            console.error('Failed to write memory file.');
-        }
-    }
     getHistory() {
-        return [...this.memory];
+        const rows = this.db.prepare('SELECT role, content, name, tool_call_id, tool_calls FROM messages ORDER BY id ASC').all();
+        return rows.map((row) => {
+            const entry = {
+                role: row.role,
+                content: row.content,
+            };
+            if (row.name)
+                entry.name = row.name;
+            if (row.tool_call_id)
+                entry.tool_call_id = row.tool_call_id;
+            if (row.tool_calls)
+                entry.tool_calls = JSON.parse(row.tool_calls);
+            return entry;
+        });
     }
     addEntry(entry) {
-        this.memory.push(entry);
-        this.saveMemory();
+        const insert = this.db.prepare(`
+      INSERT INTO messages (role, content, name, tool_call_id, tool_calls)
+      VALUES (@role, @content, @name, @tool_call_id, @tool_calls)
+    `);
+        insert.run({
+            role: entry.role,
+            content: entry.content || '',
+            name: entry.name || null,
+            tool_call_id: entry.tool_call_id || null,
+            tool_calls: entry.tool_calls ? JSON.stringify(entry.tool_calls) : null
+        });
     }
     clear() {
-        this.memory = [];
-        this.saveMemory();
+        this.db.prepare('DELETE FROM messages').run();
     }
 }
 exports.Logger = Logger;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora",
-  "version": "1.4.5",
+  "version": "1.4.7",
   "description": "",
   "main": "dist/gateway/cli.js",
   "files": [
@@ -32,6 +32,7 @@
   "type": "commonjs",
   "dependencies": {
     "@clack/prompts": "^1.4.0",
+    "better-sqlite3": "^12.10.0",
     "concurrently": "^9.2.1",
     "cors": "^2.8.6",
     "express": "^5.2.1",
@@ -43,11 +44,14 @@
     "yaml": "^2.9.0"
   },
   "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
     "@types/node": "^25.9.1",
     "@types/node-telegram-bot-api": "^0.64.14",
     "ts-node": "^10.9.2",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "vitepress": "^1.6.4",
+    "vue": "^3.5.35"
   }
 }