nyxora 1.6.12 → 1.7.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.0]
+
+### Bug Fixes & Optimizations
+- **Time Sync Hallucination**: Fixed a critical issue where the AI hallucinates the current date and time. Nyxora now dynamically injects the host OS's exact `new Date().toLocaleString()` into the system prompt upon every execution.
+- **Aggressive UI Auto-Scroll**: Resolved a severe React rendering bug in the dashboard where the 2-second history polling forced the chat window to aggressively scroll to the bottom. Auto-scroll is now strictly isolated to new message arrivals (`messages.length`).
+- **Orphaned OS Skills**: Re-wired the `search_web` (Internet Search) and `analyze_document` (PDF/DOCX Extractor) skills back into the core reasoning engine. These skills were previously orphaned and inaccessible to the AI despite being active in the dashboard.
+- **Multicall3 Portfolio Engine**: Fully replaced parallel `client.getBalance` and ERC20 fetching with a hyper-efficient `Multicall3` architecture. Balances are now chunked (max 30 tokens per batch) to guarantee zero rate-limits and payload errors on public RPCs.
+- **ChatGPT-Level NLP Persona**: Upgraded the AI's core reasoning engine to natively understand unstructured text, slang, and informal contexts. Rigidly enforced Markdown Table generation for all financial data.
+- **Telegram HTML Parser**: Implemented a custom `formatToTelegramHTML` function. Nyxora now escapes dangerous characters (`<`, `>`, `&`) and automatically wraps AI-generated Markdown tables into `<pre>` monospaced blocks, completely eliminating the "Bad Request" rendering crash on Telegram.
+- **Dynamic Tx Formatter (Tap-to-Copy)**: The post-transaction approval message is now bilingual (auto-detecting English/Indonesian from chat history). Transaction Hashes and wallet addresses are wrapped in `<code>` tags for seamless tap-to-copy UX on mobile devices.
+- **CLI Setup Typography**: Updated outdated CLI prompts that falsely referenced legacy `AES-256-GCM` encryption. The CLI now correctly informs the user that Private Keys are securely locked inside the OS Native Keyring Vault.
+
 ## [1.6.7]
 
 ### UI/UX

package/README.md

@@ -8,7 +8,7 @@
 [![Execution: Cryptographic Approval](https://img.shields.io/badge/Execution-Cryptographic--Approval-orange.svg)](#️-advanced-security-threat-model)
 [![Privacy: Local-Only Keys](https://img.shields.io/badge/Privacy-Local--Only--Keys-success.svg)](#️-advanced-security-threat-model)
 
-Nyxora is a **secure, non-custodial runtime infrastructure for autonomous onchain agents** built with a robust Monorepo architecture (Node.js & React). Designed for autonomous workflows with a premium Glassmorphism UI dashboard and strict client-side key isolation. 
+Nyxora is a **secure, non-custodial runtime infrastructure for autonomous onchain agents** built with a robust Monorepo architecture (Node.js & React). Designed for autonomous workflows with a premium Utility-Centric dark-themed UI and strict client-side key isolation. 
 
 **Nyxora now natively supports the Model Context Protocol (MCP)**. You can transform your external AI agents (like Claude Desktop and Cursor) into secure Web3 actors that execute swaps and fetch balances using Nyxora's secure signer vault. [View the MCP Integration Guide](https://nyxoraAI.github.io/Nyxora/guide/mcp-integration)
 
@@ -25,7 +25,7 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 *   **Plugin Sandbox VM**: Execute community-built external skills securely inside an airtight Node.js `vm` chamber with zero access to your file system or terminal processes.
 
 ### 🌐 Web3 Skills (On-Chain)
-*   **Anti-Rugpull & Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
+*   **Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
 *   **Automated Take Profit (TP) & Cut Loss (CL)**: The trader's holy grail. Set natural language rules (e.g., "Sell my PEPE if price drops below $0.001"). Nyxora runs a background cron monitor and executes the swap while you sleep.
 *   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora",
-  "version": "1.6.12",
+  "version": "1.7.0",
   "license": "MIT",
   "workspaces": [
     "packages/*"
@@ -29,7 +29,6 @@
     "duck-duck-scrape": "^2.2.7",
     "express": "^5.2.1",
     "express-rate-limit": "^7.5.0",
-    "googleapis": "^173.0.0",
     "helmet": "^8.0.0",
     "isolated-vm": "^6.1.2",
     "jsonwebtoken": "^9.0.2",

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora-agent-core",
-  "version": "1.6.7",
+  "version": "1.7.0",
   "private": true,
   "main": "src/gateway/server.ts",
   "dependencies": {

package/packages/core/src/agent/reasoning.ts

@@ -21,10 +21,12 @@ import { getMyAddressToolDefinition, getMyAddress } from '../web3/skills/getMyAd
 import { createLimitOrderToolDefinition, listLimitOrdersToolDefinition, cancelLimitOrderToolDefinition, limitOrderManager } from './limitOrderManager';
 import { updateProfileToolDefinition, updateProfile } from './updateProfile';
 import { updateSecurityPolicyToolDefinition, updateSecurityPolicy } from '../system/skills/updateSecurityPolicy';
+import { analyzeDocumentToolDefinition, analyzeDocument } from '../system/skills/analyzeDocument';
 import { readLocalFileToolDefinition, readLocalFile } from '../system/skills/readFile';
 import { writeLocalFileToolDefinition, writeLocalFile } from '../system/skills/writeFile';
 import { runTerminalCommandToolDefinition, runTerminalCommand } from '../system/skills/executeShell';
 import { browseWebsiteToolDefinition, browseWebsite } from '../system/skills/browseWeb';
+import { searchWebToolDefinition, searchWeb } from '../system/skills/searchWeb';
 import { installExternalSkillToolDefinition, installExternalSkill } from '../system/skills/installSkill';
 import { 
   readGmailInbox, 
@@ -151,12 +153,20 @@ async function executeWithRetry(
 
 function getSystemPrompt() {
   const config = loadConfig();
+  const currentDateTime = new Date().toLocaleString('en-US', { timeZoneName: 'short' });
   let basePrompt = `You are an autonomous Web3 agent operating on EVM chains.
-You are equipped with a native wallet. 
-CRITICAL RULE: You must always reply in the exact same language that the user uses to talk to you. If the user speaks Indonesian, reply in Indonesian. If they speak English, reply in English.
-CRITICAL RULE: When the user asks to check "my balance", "saldo saya", or anything about their own wallet generally, ALWAYS use the check_portfolio tool to show all assets on the chain that have a USD value greater than 0. LEAVE THE ADDRESS PARAMETER EMPTY. Do NOT use get_balance unless the user explicitly asks for the balance of ONE specific token (e.g., "what is my ETH balance?").
-CRITICAL RULE: If the user doesn't specify a chain, default to: ${config.agent.default_chain}. If the user mentions a specific chain (e.g., "on BNB", "di Base"), you MUST override the default and execute the tool on that specific chain.
-CRITICAL RULE: If you use the default chain because the user forgot to specify one, you MUST politely confirm which chain you checked in your response (e.g., "I checked your balance on the ${config.agent.default_chain} network..."). Do not issue scary warnings.`;
+You are equipped with a native wallet.
+The current real-world date and time is: ${currentDateTime}. Use this for any time-related questions.
+
+CRITICAL RULE 1: ADVANCED NLP & PERSONA. You must act as a highly intelligent, adaptive, and intuitive assistant (similar to ChatGPT or Gemini). You must seamlessly understand the user's language structure, including slang, shorthand, informal context, and mixed languages. However, you must maintain a professional and highly accurate Web3 operational standard.
+CRITICAL RULE 2: LANGUAGE MATCHING. You must always reply in the exact same language that the user uses to talk to you. If the user speaks Indonesian, reply in Indonesian. If they speak English, reply in English.
+CRITICAL RULE 3: FORMATTING & CONCISENESS. 
+  - Your responses MUST be concise and to the point. Do not add unnecessary fluff or overly long explanations unless explicitly asked.
+  - When displaying numbers or monetary values, separate thousands with commas (e.g., $1,000,000) for readability.
+  - When displaying a list of assets, tokens, portfolio, or transaction history, YOU MUST USE MARKDOWN TABLES. Do not use bullet points for financial data.
+CRITICAL RULE 4: When the user asks to check "my balance", "saldo saya", or anything about their own wallet generally, ALWAYS use the check_portfolio tool to show all assets on the chain that have a USD value greater than 0. LEAVE THE ADDRESS PARAMETER EMPTY. Do NOT use get_balance unless the user explicitly asks for the balance of ONE specific token.
+CRITICAL RULE 5: If the user doesn't specify a chain, default to: ${config.agent.default_chain}. If the user mentions a specific chain (e.g., "on BNB", "di Base"), you MUST override the default and execute the tool on that specific chain.
+CRITICAL RULE 6: If you use the default chain because the user forgot to specify one, you MUST politely confirm which chain you checked in your response (e.g., "I checked your balance on the ${config.agent.default_chain} network..."). Do not issue scary warnings.`;
 
   // Read IDENTITY.md for core AI persona
   try {
@@ -246,10 +256,12 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
           cancelLimitOrderToolDefinition as any,
           updateProfileToolDefinition as any,
           updateSecurityPolicyToolDefinition as any,
+          analyzeDocumentToolDefinition as any,
           readLocalFileToolDefinition as any,
           writeLocalFileToolDefinition as any,
           runTerminalCommandToolDefinition as any,
           browseWebsiteToolDefinition as any,
+          searchWebToolDefinition as any,
           installExternalSkillToolDefinition as any,
           readGmailInboxToolDefinition as any,
           listCalendarEventsToolDefinition as any,
@@ -382,7 +394,11 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             case 'update_security_policy': {
-              result = updateSecurityPolicy(args.rule, args.action);
+              result = await updateSecurityPolicy(args.policy, args.action || 'add');
+              break;
+            }
+            case 'analyze_document': {
+              result = await analyzeDocument(args.filePath);
               break;
             }
             case 'read_local_file': {
@@ -409,6 +425,10 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               result = await browseWebsite(args.url);
               break;
             }
+            case 'search_web': {
+              result = await searchWeb(args.query);
+              break;
+            }
             case 'install_external_skill': {
               result = await installExternalSkill(args.url);
               break;

package/packages/core/src/gateway/setup.ts

@@ -242,7 +242,7 @@ Provider: ${config.llm.provider}`;
   let privateKey = '';
   if (walletSetupType === 'manual') {
     privateKey = (await password({
-      message: 'Enter Wallet Private Key (0x...)\n  (Will be AES-256-GCM encrypted. See documentation for import guides):',
+      message: 'Enter Wallet Private Key (0x...)\n  (Will be securely locked in your OS Native Keyring Vault):',
     })) as string;
     if (isCancel(privateKey)) return process.exit(0);
   } else if (walletSetupType === 'generate') {

package/packages/core/src/gateway/telegram.ts

@@ -10,6 +10,31 @@ import { executeCustomTx } from '../web3/skills/customTx';
 import { formatTransactionSuccess, formatTransactionError } from '../utils/formatter';
 import pc from 'picocolors';
 
+export function formatToTelegramHTML(text: string): string {
+  if (!text) return "";
+  let html = text
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+    
+  html = html.replace(/\*\*(.*?)\*\*/g, '<b>$1</b>');
+  // Match italic * avoiding bullet points at the start of a line
+  html = html.replace(/(?<!^|\n)\*(?!\s)(.*?)(?<!\s)\*/g, '<i>$1</i>');
+  html = html.replace(/_(.*?)_/g, '<i>$1</i>');
+  
+  // Convert code blocks and inline code
+  html = html.replace(/```([\s\S]*?)```/g, '<pre><code>$1</code></pre>');
+  html = html.replace(/`([^`]+)`/g, '<code>$1</code>');
+  
+  // Transform Markdown Tables to <pre> monospaced blocks so they don't break on mobile
+  const tableRegex = /(?:\|.*\|(?:\n|$))+/g;
+  html = html.replace(tableRegex, (match) => {
+     return `<pre>${match.trim()}</pre>\n`;
+  });
+
+  return html;
+}
+
 export function startTelegramBot() {
   const config = loadConfig();
   const token = config.integrations?.telegram?.bot_token;
@@ -104,10 +129,10 @@ export function startTelegramBot() {
         const onProgress = async (progressText: string) => {
           try {
             if (!progressMsgId) {
-              const sent = await ctx.reply(progressText, { parse_mode: 'Markdown' });
+              const sent = await ctx.reply(`<i>${progressText.replace(/_/g, '')}</i>`, { parse_mode: 'HTML' });
               progressMsgId = sent.message_id;
             } else {
-              await ctx.telegram.editMessageText(ctx.chat.id, progressMsgId, undefined, progressText, { parse_mode: 'Markdown' });
+              await ctx.telegram.editMessageText(ctx.chat.id, progressMsgId, undefined, `<i>${progressText.replace(/_/g, '')}</i>`, { parse_mode: 'HTML' });
             }
           } catch (e) {}
         };
@@ -122,17 +147,20 @@ export function startTelegramBot() {
         if (pendingTxs.length > 0) {
           const latestTx = pendingTxs[pendingTxs.length - 1];
           if (Date.now() - latestTx.createdAt < 120000) {
-            await ctx.reply(response, Markup.inlineKeyboard([
-              [
-                Markup.button.callback('✅ Approve', `approve_${latestTx.id}`),
-                Markup.button.callback('❌ Reject', `reject_${latestTx.id}`)
-              ]
-            ]));
+            await ctx.reply(formatToTelegramHTML(response), {
+              parse_mode: 'HTML',
+              ...Markup.inlineKeyboard([
+                [
+                  Markup.button.callback('✅ Approve', `approve_${latestTx.id}`),
+                  Markup.button.callback('❌ Reject', `reject_${latestTx.id}`)
+                ]
+              ])
+            });
             return;
           }
         }
 
-        await ctx.reply(response);
+        await ctx.reply(formatToTelegramHTML(response), { parse_mode: 'HTML' });
       } catch (error: any) {
         console.error('[Telegram] Error processing message:', error);
         await ctx.reply('❌ Sorry, I encountered an error while processing your message.');
@@ -170,8 +198,19 @@ export function startTelegramBot() {
         }
         
         txManager.updateStatus(txId, 'executed', result);
-        const prettyMsg = formatTransactionSuccess(tx, result);
-        await ctx.reply(`✅ Transaction processed:\n\n${prettyMsg}`);
+        
+        // Pass session history to formatTransactionSuccess to detect language
+        const sessionId = ctx.chat?.id.toString() || 'default';
+        const history = logger.getHistory(sessionId);
+        let isIndonesian = false;
+        if (history.length > 0) {
+           const lastMsg = history[history.length - 1].content.toLowerCase();
+           const idWords = ['saya', 'kamu', 'aku', 'apa', 'bagaimana', 'kenapa', 'bisa', 'tolong', 'ke', 'di', 'dari', 'yang', 'ini', 'itu', 'buat', 'cek', 'saldo'];
+           if (idWords.some(w => lastMsg.includes(w))) isIndonesian = true;
+        }
+
+        const prettyMsg = formatTransactionSuccess(tx, result, isIndonesian);
+        await ctx.reply(formatToTelegramHTML(`✅ **Transaction processed:**\n\n${prettyMsg}`), { parse_mode: 'HTML' });
         
         logger.addEntry({ role: 'assistant', content: `✅ Transaction processed:\n\n${prettyMsg}` });
         logger.addEntry({ role: 'tool', name: tx.type === 'swap' ? 'swap_token' : 'transfer_native', content: result });

package/packages/core/src/utils/formatter.ts

@@ -1,6 +1,6 @@
 import { PendingTransaction } from '../agent/transactionManager';
 
-export function formatTransactionSuccess(tx: PendingTransaction, rawResult: string): string {
+export function formatTransactionSuccess(tx: PendingTransaction, rawResult: string, isIndonesian: boolean = false): string {
   let txHash = 'N/A';
   
   try {
@@ -15,13 +15,20 @@ export function formatTransactionSuccess(tx: PendingTransaction, rawResult: stri
 
   const chainFormatted = tx.chainName.charAt(0).toUpperCase() + tx.chainName.slice(1);
 
+  let actionText = '';
   if (tx.type === 'swap') {
-    return `Alright, I have completed the swap from ${tx.details.amount} ${tx.details.fromToken.toUpperCase()} to ${tx.details.toToken.toUpperCase()}.\n\nChain: ${chainFormatted}\nTx Hash:\n${txHash}`;
+    actionText = isIndonesian ? `Swap ${tx.details.amount} ${tx.details.fromToken.toUpperCase()} ke ${tx.details.toToken.toUpperCase()}` : `Swapped ${tx.details.amount} ${tx.details.fromToken.toUpperCase()} to ${tx.details.toToken.toUpperCase()}`;
   } else if (tx.type === 'transfer') {
-    return `Alright, I have completed the transfer of ${tx.details.amountEth} tokens to ${tx.details.toAddress}.\n\nChain: ${chainFormatted}\nTx Hash:\n${txHash}`;
+    actionText = isIndonesian ? `Transfer ${tx.details.amountEth} token ke <code>${tx.details.toAddress}</code>` : `Transferred ${tx.details.amountEth} tokens to <code>${tx.details.toAddress}</code>`;
+  } else {
+    actionText = isIndonesian ? 'Aksi Berhasil' : 'Action Successful';
+  }
+
+  if (isIndonesian) {
+    return `**Nama Chain:** ${chainFormatted}\n**Status:** Sukses (${actionText})\n**Tx Hash:** <code>${txHash}</code>`;
+  } else {
+    return `**Chain Name:** ${chainFormatted}\n**Status:** Success (${actionText})\n**Tx Hash:** <code>${txHash}</code>`;
   }
-  
-  return `Transaction successful!\n\nChain: ${chainFormatted}\nTx Hash:\n${txHash}`;
 }
 
 export function formatTransactionError(tx: PendingTransaction, errorMsg: string): string {

package/packages/core/src/web3/skills/checkPortfolio.ts

@@ -60,51 +60,67 @@ export async function checkPortfolio(chainName: ChainName, address?: `0x${string
     let report = `📊 **Portfolio for ${targetAddress} on ${chainName.toUpperCase()}**\n\n`;
     let totalUsdValue = 0;
 
-    // We will do Promise.all for balances
-    const balancePromises = tokensToScan.map(async (t) => {
-      let balanceNum = 0;
+    // We will do True On-Chain Multicall with Chunking (max 30 tokens / 60 calls per batch)
+    const MULTICALL3_ADDRESS = '0xcA11bde05977b3631167028862bE2a173976CA11';
+    const MULTICALL3_ABI = [{
+      inputs: [{ name: 'addr', type: 'address' }],
+      name: 'getEthBalance',
+      outputs: [{ name: 'balance', type: 'uint256' }],
+      stateMutability: 'view',
+      type: 'function',
+    }] as const;
+
+    const contracts: any[] = [];
+    for (const t of tokensToScan) {
       if (t.isNative) {
-        const bal = await client.getBalance({ address: targetAddress as `0x${string}` });
-        balanceNum = parseFloat(formatEther(bal));
+        contracts.push({ address: MULTICALL3_ADDRESS, abi: MULTICALL3_ABI, functionName: 'getEthBalance', args: [targetAddress as `0x${string}`] });
       } else {
-        try {
-          const [balanceWei, decimals] = await Promise.all([
-            // @ts-ignore
-            client.readContract({
-              address: t.address,
-              abi: ERC20_ABI,
-              functionName: 'balanceOf',
-              args: [targetAddress as `0x${string}`],
-            }) as Promise<bigint>,
-            // @ts-ignore
-            client.readContract({
-              address: t.address,
-              abi: ERC20_ABI,
-              functionName: 'decimals',
-            }) as Promise<number>
-          ]);
-          balanceNum = parseFloat(formatUnits(balanceWei, decimals));
-        } catch (e) {
-          balanceNum = 0;
-        }
+        contracts.push({ address: t.address, abi: ERC20_ABI, functionName: 'balanceOf', args: [targetAddress as `0x${string}`] });
+        contracts.push({ address: t.address, abi: ERC20_ABI, functionName: 'decimals' });
       }
-      return { ...t, balanceNum };
-    });
-
-    const timeoutPromise = new Promise<any[]>((_, reject) => 
-      setTimeout(() => reject(new Error('RPC request timed out')), 3000)
-    );
+    }
 
-    let balances: any[];
+    const CHUNK_SIZE = 60; // 30 tokens (2 calls per token)
+    const multicallResults: any[] = [];
+    
     try {
-      balances = await Promise.race([
-        Promise.all(balancePromises),
-        timeoutPromise
-      ]);
+      // Create a timeout promise for 5 seconds (more tolerant for large portfolios)
+      const timeoutPromise = new Promise<never>((_, reject) => 
+        setTimeout(() => reject(new Error('RPC request timed out')), 5000)
+      );
+
+      const executionPromise = (async () => {
+        for (let i = 0; i < contracts.length; i += CHUNK_SIZE) {
+          const chunk = contracts.slice(i, i + CHUNK_SIZE);
+          const res = await client.multicall({ contracts: chunk, allowFailure: true } as any);
+          multicallResults.push(...res);
+        }
+      })();
+
+      await Promise.race([executionPromise, timeoutPromise]);
     } catch (e: any) {
-      return `⚠️ **${chainName.toUpperCase()} Network is experiencing high latency.**\nThe public RPC failed to respond within 3 seconds. Please try again later.`;
+      return `⚠️ **${chainName.toUpperCase()} Network is experiencing high latency.**\nThe public RPC failed to respond. Please try again later.`;
     }
 
+    // Map results back to tokens
+    let resultIndex = 0;
+    const balances = tokensToScan.map((t) => {
+      let balanceNum = 0;
+      if (t.isNative) {
+        const balResult = multicallResults[resultIndex++];
+        if (balResult?.status === 'success' && balResult.result) {
+          balanceNum = parseFloat(formatEther(balResult.result as bigint));
+        }
+      } else {
+        const balResult = multicallResults[resultIndex++];
+        const decResult = multicallResults[resultIndex++];
+        if (balResult?.status === 'success' && balResult.result !== undefined && decResult?.status === 'success' && decResult.result !== undefined) {
+          balanceNum = parseFloat(formatUnits(balResult.result as bigint, Number(decResult.result)));
+        }
+      }
+      return { ...t, balanceNum };
+    });
+
     const nonZeroBalances = balances.filter(b => b.balanceNum > 0);
 
     if (nonZeroBalances.length === 0) {