nyxora 26.6.10-2 → 26.6.12

package/README.md

@@ -22,6 +22,7 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 ### Advanced Security Architecture
 *   **🛡️ On-Chain AI Kill-Switch**: Nyxora is governed by an Arbitrum Smart Contract (`NyxoraAgentRegistry`). Users have absolute cryptographic power to instantly paralyze the AI's on-chain execution if compromised, solving the Web3 AI safety dilemma. [Read more about our Arbitrum Architecture ->](https://nyxoraai.github.io/Nyxora/security/smart-contract)
 *   **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
+*   **DeFi Configuration BYOK & UI Masking**: All aggregator and provider API keys are strictly isolated via a Bring Your Own Keys (BYOK) architecture into a heavily guarded `~/.nyxora/defi_keys.yaml` file. The local web Dashboard masks these injected secrets using `***********` and `IS_SET` censorship, completely neutralizing malicious browser extensions from exfiltrating your keys.
 *   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
 *   **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
 *   **Plugin Sandbox VM**: Execute community-built external skills securely inside an airtight Node.js `vm` chamber with zero access to your file system or terminal processes.
@@ -30,8 +31,9 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 ### 🌐 Web3 Skills (On-Chain)
 *   **Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
 *   **Advanced DeFi Optimization**: Autonomously supply assets to Aave V3, deposit into Beefy/Yearn Auto-Compounder Vaults, manage Uniswap V3 Liquidity (LP), and instantly revoke infinite approvals to secure your wallet. Features intelligent Transaction Chaining to auto-approve allowances prior to execution.
-*   **Anti-MEV Slippage Protection**: Hardened routing engine with dynamic Slippage Tolerance (default 0.5%) for Relay and Li.Fi. You can manually adjust slippage via the UI or dynamically override it using natural language (e.g., "Swap 1 ETH to PEPE with 10% slippage").
-*   **Automated Take Profit (TP) & Cut Loss (CL)**: The trader's holy grail. Set natural language rules (e.g., "Sell my PEPE if price drops below $0.001"). Nyxora runs a background cron monitor and executes the swap while you sleep.
+*   **6-Engine Meta-Aggregator & Anti-MEV**: The core engine interfaces with a powerful 6-Engine Meta-Aggregator (**1inch, 0x, LI.FI, Relay, OpenOcean, and KyberSwap**) to route tokens cross-chain, ensuring absolute maximum liquidity depth.
+*   **Adaptive Auto Slippage Protection**: Nyxora enforces a dynamic and adaptive **'auto' slippage** by default to leverage dynamic MEV-protection from these enterprise aggregators. However, the user retains absolute control to override this dynamically—either globally via the Dashboard Settings or on a per-transaction basis through NLP chat commands (e.g., *"Swap 1 ETH to PEPE with 10% slippage"*).
+
 *   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.
 *   **Dynamic Portfolio Engine**: Merges standard tokens, your custom Degen CAs, and CoinGecko's daily trending list into a single hyper-fast Multicall scan to deliver a clean, spam-free PnL portfolio report in under 1 second.
@@ -72,6 +74,12 @@ The following diagram illustrates Nyxora's **3-Tier Monorepo Architecture**, sho
 2. **🛡️ Policy Engine (The Guard)**: The security guard that verifies the Brain's plans. If the AI attempts to send funds exceeding your set limits, this engine automatically blocks it.
 3. **🔒 Signer Vault (The Safe)**: The offline vault where your Private Keys **and highly sensitive 3rd-party tokens (e.g., Google Workspace OAuth)** are securely locked natively in your OS Keyring (GNOME Keyring / macOS Keychain / Windows Credential Manager). It only signs transactions after they pass all rigorous security checks.
 
+### Web3 Separation of Concerns (Zero-Trust Routing)
+Within the AI Brain, the Web3 codebase is strictly divided to prevent the LLM from hallucinating or maliciously manipulating low-level routing paths:
+- **`aggregator/`**: The core routing engine (1inch, 0x, KyberSwap, etc.) immune to prompt injection. The AI cannot modify execution rules here.
+- **`skills/`**: The execution muscles. Pure functions and tools explicitly exposed to the AI for usage.
+- **`utils/`**: The nervous system managing blockchain configurations, supported tokens, and the RPC Engine.
+
 *(Note: Despite the multi-layered security process appearing lengthy, the internal system validation and cryptographic signing occurs in **milliseconds**, ensuring zero latency bottlenecks).*
 
 ---

package/dist/launcher.js

@@ -9,6 +9,9 @@ const child_process_1 = require("child_process");
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const dns_1 = __importDefault(require("dns"));
+// Fix Node 18+ native fetch randomly failing on dual-stack VPS (IPv6 issues)
+dns_1.default.setDefaultResultOrder('ipv4first');
 const INTERNAL_AUTH_TOKEN = crypto_1.default.randomBytes(64).toString('hex');
 console.log(`[Launcher] Generated Internal Auth Token: ${INTERNAL_AUTH_TOKEN.substring(0, 8)}...`);
 const nyxoraDir = path_1.default.join(process.env.HOME || process.env.USERPROFILE || '', '.nyxora');

package/dist/packages/core/src/agent/limitOrderManager.js

@@ -8,10 +8,7 @@ const fs_1 = __importDefault(require("fs"));
 const parser_1 = require("../config/parser");
 const paths_1 = require("../config/paths");
 const config_1 = require("../web3/config");
-const tokens_1 = require("../web3/utils/tokens");
-const swapToken_1 = require("../web3/skills/swapToken");
 const transactionManager_1 = require("./transactionManager");
-const reasoning_1 = require("./reasoning");
 class LimitOrderManager {
     filePath;
     orders = [];
@@ -40,12 +37,17 @@ class LimitOrderManager {
     }
     createOrder(chainName, fromToken, toToken, amountStr, targetPriceUsd, condition) {
         const id = `order_${Date.now()}_${Math.random().toString(36).substr(2, 5)}`;
-        const order = {
-            id, chainName, fromToken, toToken, amountStr, targetPriceUsd, condition, status: 'pending', createdAt: Date.now()
+        const txDetails = {
+            id,
+            fromToken,
+            toToken,
+            amountStr,
+            targetPriceUsd,
+            condition
         };
-        this.orders.push(order);
-        this.saveOrders();
-        return `Limit order created successfully. ID: ${id}. The system will monitor ${fromToken} price on ${chainName} and execute the swap to ${toToken} when price is ${condition} $${targetPriceUsd}.`;
+        // Instead of saving directly, we push it to txManager to trigger the Approval Gate UX
+        transactionManager_1.txManager.createPendingTransaction('limit_order', chainName, txDetails);
+        return `Prepared limit order: Sell ${amountStr} ${fromToken} for ${toToken} when price is ${condition} $${targetPriceUsd}. I have pushed this to the Transaction Manager. Please wait for user approval on the Dashboard/Telegram. Do not say it's created yet.`;
     }
     listOrders() {
         const pending = this.orders.filter(o => o.status === 'pending');
@@ -58,6 +60,8 @@ class LimitOrderManager {
         return report;
     }
     cancelOrder(id) {
+        // Note: To truly cancel a 1inch limit order, we need to call 1inch API to cancel the hash.
+        // For now, we mark it cancelled locally.
         const order = this.orders.find(o => o.id === id);
         if (!order)
             return `Order ${id} not found.`;
@@ -65,74 +69,16 @@ class LimitOrderManager {
             return `Order ${id} cannot be cancelled because it is ${order.status}.`;
         order.status = 'cancelled';
         this.saveOrders();
-        return `Order ${id} cancelled successfully.`;
+        return `Order ${id} cancelled successfully locally.`;
     }
+    // Polling logic removed as per Phase 2 Migration to 1inch Off-Chain Protocol
     startMonitor() {
-        if (this.monitorInterval)
-            clearInterval(this.monitorInterval);
-        // Monitor every 60 seconds
-        this.monitorInterval = setInterval(() => this.checkOrders(), 60000);
-        console.log('[LimitOrderManager] Order monitoring started (interval: 60s)');
+        console.log('[LimitOrderManager] Local polling disabled. Delegating to 1inch Limit Order Protocol.');
     }
-    async checkOrders() {
-        const pending = this.orders.filter(o => o.status === 'pending');
-        if (pending.length === 0)
-            return;
-        for (const order of pending) {
-            try {
-                let tokenAddress = (0, tokens_1.resolveToken)(order.fromToken, order.chainName);
-                if (tokenAddress === "0x0000000000000000000000000000000000000000") {
-                    tokenAddress = (0, tokens_1.resolveToken)("W" + order.fromToken, order.chainName);
-                }
-                const res = await fetch(`https://api.dexscreener.com/latest/dex/tokens/${tokenAddress}`);
-                if (!res.ok)
-                    continue;
-                const data = await res.json();
-                if (!data.pairs || data.pairs.length === 0)
-                    continue;
-                let pair = data.pairs.find((p) => p.chainId === order.chainName) || data.pairs[0];
-                const currentPrice = parseFloat(pair.priceUsd);
-                let shouldExecute = false;
-                if (order.condition === 'above' && currentPrice >= order.targetPriceUsd)
-                    shouldExecute = true;
-                if (order.condition === 'below' && currentPrice <= order.targetPriceUsd)
-                    shouldExecute = true;
-                if (shouldExecute) {
-                    console.log(`[LimitOrderManager] Condition met for order ${order.id}. Current price $${currentPrice} is ${order.condition} $${order.targetPriceUsd}. Executing...`);
-                    // 1. Prepare Swap
-                    const prepareResult = await (0, swapToken_1.prepareSwapToken)(order.chainName, order.fromToken, order.toToken, order.amountStr, 'auto');
-                    // 2. Extract Tx ID
-                    const txMatch = prepareResult.match(/Transaction ID: ([\w-]+)\./);
-                    if (!txMatch) {
-                        order.status = 'failed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} execution failed during preparation. Output: ${prepareResult}`, 'system').catch(() => { });
-                        continue;
-                    }
-                    const txId = txMatch[1];
-                    const tx = transactionManager_1.txManager.getTransaction(txId);
-                    if (!tx)
-                        throw new Error("Transaction not found in manager");
-                    // 3. Execute Swap automatically (bypass policy with autoApprove: true)
-                    const executeResult = await (0, swapToken_1.executeSwap)(order.chainName, tx.details, true);
-                    if (executeResult.includes('executed') || executeResult.includes('successful')) {
-                        transactionManager_1.txManager.updateStatus(txId, 'executed', executeResult);
-                        order.status = 'executed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} just EXECUTED automatically! Price hit $${currentPrice}. Swap result: ${executeResult}. Please notify the user immediately!`, 'system').catch(() => { });
-                    }
-                    else {
-                        transactionManager_1.txManager.updateStatus(txId, 'failed', executeResult);
-                        order.status = 'failed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} FAILED to execute. Price hit $${currentPrice} but execution failed: ${executeResult}. Please notify the user.`, 'system').catch(() => { });
-                    }
-                }
-            }
-            catch (error) {
-                console.error(`[LimitOrderManager] Error checking order ${order.id}:`, error.message);
-            }
-        }
+    // We can add a method to save the 1inch hash after the user approves it
+    recordApprovedOrder(orderMetadata) {
+        this.orders.push(orderMetadata);
+        this.saveOrders();
     }
 }
 exports.LimitOrderManager = LimitOrderManager;

package/dist/packages/core/src/agent/reasoning.js

@@ -20,7 +20,6 @@ const bridgeToken_1 = require("../web3/skills/bridgeToken");
 const skillManager_1 = require("../utils/skillManager");
 const mintNft_1 = require("../web3/skills/mintNft");
 const customTx_1 = require("../web3/skills/customTx");
-const createWallet_1 = require("../web3/skills/createWallet");
 const checkSecurity_1 = require("../web3/skills/checkSecurity");
 const marketAnalysis_1 = require("../web3/skills/marketAnalysis");
 const checkPortfolio_1 = require("../web3/skills/checkPortfolio");
@@ -32,7 +31,7 @@ const defiLending_1 = require("../web3/skills/defiLending");
 const yieldVault_1 = require("../web3/skills/yieldVault");
 const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
 const getTxHistory_1 = require("../web3/skills/getTxHistory");
-const limitOrderManager_1 = require("./limitOrderManager");
+const createLimitOrder_1 = require("../web3/skills/createLimitOrder");
 const updateProfile_1 = require("./updateProfile");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
@@ -43,6 +42,12 @@ const executeShell_1 = require("../system/skills/executeShell");
 const browseWeb_1 = require("../system/skills/browseWeb");
 const searchWeb_1 = require("../system/skills/searchWeb");
 const installSkill_1 = require("../system/skills/installSkill");
+const editFile_1 = require("../system/skills/editFile");
+const gitManager_1 = require("../system/skills/gitManager");
+const xManager_1 = require("../system/skills/xManager");
+const notionWorkspace_1 = require("../system/skills/notionWorkspace");
+const audioTranscribe_1 = require("../system/skills/audioTranscribe");
+const summarizeText_1 = require("../system/skills/summarizeText");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
 const pluginManager_1 = require("../system/pluginManager");
 const paths_1 = require("../config/paths");
@@ -118,21 +123,35 @@ async function executeWithRetry(requestBuilder, maxRetries = 3) {
 function getSystemPrompt() {
     const config = (0, parser_1.loadConfig)();
     const currentDateTime = new Date().toLocaleString('en-US', { timeZoneName: 'short' });
-    let basePrompt = `You are an autonomous Web3 agent operating on EVM chains.
+    let basePrompt = `[CORE DIRECTIVES]
+You are an autonomous Web3 agent operating on EVM chains.
 You are equipped with a native wallet.
 The current real-world date and time is: ${currentDateTime}. Use this for any time-related questions.
+Default Chain: ${config.agent.default_chain}
 
+CRITICAL: You MUST use a Chain of Thought approach for every response. You must enclose your internal reasoning steps within <think>...</think> XML tags BEFORE taking any action or providing a final response. This allows you to plan your tool usage, recall the rules, and avoid hallucinations.
+IMPORTANT: The <think> block is strictly for your internal hidden monologue. NEVER put your final answer, conversational text, or questions to the user inside the <think> block. The actual response that the user will see MUST be written OUTSIDE and AFTER the </think> tag.
+
+[EXECUTION WORKFLOW]
 CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
-CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt. If the user's latest prompt is in English, you MUST reply entirely in English, completely ignoring the language of previous messages. If their latest prompt is in Indonesian, reply in Indonesian.
-CRITICAL RULE 3: FORMATTING & CONCISENESS. 
-  - Your responses MUST be concise and to the point. Do not add unnecessary fluff or overly long explanations unless explicitly asked.
-  - When displaying numbers or monetary values, separate thousands with commas (e.g., $1,000,000) for readability.
-  - When displaying a list of assets, tokens, portfolio, or transaction history, YOU MUST USE MARKDOWN TABLES. Do not use bullet points for financial data.
-CRITICAL RULE 4: When the user asks to check "my balance", "saldo saya", or anything about their own wallet generally, ALWAYS use the check_portfolio tool to show all assets on the chain that have a USD value greater than 0. LEAVE THE ADDRESS PARAMETER EMPTY. Do NOT use get_balance unless the user explicitly asks for the balance of ONE specific token.
-CRITICAL RULE 5: If the user doesn't specify a chain, default to: ${config.agent.default_chain}. If the user mentions a specific chain (e.g., "on BNB", "di Base"), you MUST override the default and execute the tool on that specific chain. For transactions that require two chains (like bridge_token), if the user only provides the destination chain, you MUST automatically use ${config.agent.default_chain} as the source chain (fromChainName) without asking for clarification.
-CRITICAL RULE 6: If you use the default chain because the user forgot to specify one, you MUST politely confirm which chain you checked in your response (e.g., "I checked your balance on the ${config.agent.default_chain} network..."). Do not issue scary warnings.
-CRITICAL RULE 7: TOOL PRIORITIZATION. When the user asks about crypto prices, market analysis, token security, or blockchain data, YOU MUST prioritize using the dedicated Web3 skills (e.g., get_price, analyze_market, check_security) FIRST. Only if those tools fail or cannot provide the requested information, you may fallback to using search_web.
-CRITICAL RULE 8: EXACTNESS AND SAFETY IN TRANSACTIONS. Never guess or hallucinate token symbols, network chains, or amounts for Web3 transactions. If the user's intent is ambiguous, you MUST politely ask for clarification instead of attempting a potentially risky transaction. Before confirming any swap or bridge, reiterate the exact tokens, chains, and amounts.`;
+CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt.
+CRITICAL RULE 3: FORMATTING & CONCISENESS. Provide concise analytical summaries of data rather than just dumping raw markdown tables. Be analytical but brief. Use commas for thousands.
+CRITICAL RULE 4: TOOL PRIORITIZATION. Web3 tasks must use Web3 Skills exclusively. OS Skills (search, browse) are fallbacks only. Use get_my_address to show wallet address, and check_portfolio to show balances.
+CRITICAL RULE 5: DEFAULT CHAIN HANDLING. Default to: ${config.agent.default_chain} unless specified. If overridden, confirm the chain politely. For 2-chain txs (bridge), default source to ${config.agent.default_chain}.
+CRITICAL RULE 8: CONDITIONAL PARALLEL EXECUTION. Parallel tool execution is ONLY allowed if there are zero data dependencies between them.
+CRITICAL RULE 10: PLANNING & RISK DISCLOSURE. For high-level instructions (e.g. "Get yield"), formulate a plan and briefly disclose major risks (smart contract risk, impermanent loss) before asking for approval.
+CRITICAL RULE 11: ADAPTIVE RESPONSE RULE. You must process Web3 data (portfolio, price) and provide a concise, to-the-point analysis based on the context. Do not use useless filler greetings/closings. Provide deep analysis only if the data requires it to protect the user's portfolio.
+CRITICAL RULE 13: WALLET CONTEXT CACHING. Portfolio data in chat history is potentially stale. Do not use cached data for transactional planning; refresh the balance via tools first.
+CRITICAL RULE 14: TRANSACTION EXECUTION. For ALL state-changing transactions (swap, bridge, transfer, stake), do NOT ask for verbal confirmation. Execute the tool IMMEDIATELY. The tool itself will trigger a secure popup in the user's dashboard UI for final approval.
+CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answer exists in recent verified context and freshness is not strictly required. Use history to save latency.
+
+[ANTI-HALLUCINATION PROTOCOL]
+CRITICAL RULE 6: NETWORK SAFETY VALIDATION. If a request implies cross-chain or mainnet/testnet mixing, or the token symbol is ambiguous (USDC vs USDC.e), YOU MUST NOT GUESS. Ask for confirmation.
+CRITICAL RULE 7: TOOL CONFIDENCE & HALUCINATION PREVENTION. NEVER fabricate blockchain data. If a tool fails or data is missing, state it explicitly. Do not estimate balances, prices, APY, or gas.
+CRITICAL RULE 9: DEFI CONFIGURATION FALLBACK. If a tool fails due to Rate Limits, Unauthorized, or Missing API Keys, instruct the user to visit the "DeFi Configuration 🔑" menu in the dashboard.
+CRITICAL RULE 12: SMART SLIPPAGE AWARENESS. For low-liquidity assets, warn the user that default slippage might not be enough. NEVER invent specific slippage percentage numbers.
+CRITICAL RULE 16: CAPABILITY HONESTY. NEVER claim a capability not available through installed tools. If asked for an unsupported action, state honestly that the skill is missing.
+CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token security, or preparing trades, you MUST explicitly declare a 'Confidence Score (0-100%)' INSIDE your <think> block. If your score is below 40%, you must firmly WARN the user and advise against the trade in your final response.`;
     // Read IDENTITY.md for core AI persona
     try {
         const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
@@ -179,6 +198,23 @@ CRITICAL RULE 8: EXACTNESS AND SAFETY IN TRANSACTIONS. Never guess or hallucinat
     catch (error) {
         // Ignore db errors if not initialized
     }
+    // V3: Inject Personalized Risk Profile
+    try {
+        const profile = exports.logger.getUserProfile();
+        if (profile) {
+            basePrompt += `\n\n--- [USER_PERSONA] RISK PROFILE & PREFERENCES ---\n`;
+            basePrompt += `Risk Level: ${profile.risk_level}\n`;
+            basePrompt += `Max Slippage Tolerance: ${profile.max_slippage}%\n`;
+            basePrompt += `Avoid Memecoins: ${profile.avoid_memecoins ? 'YES' : 'NO'}\n`;
+            if (profile.custom_rules) {
+                basePrompt += `Custom Rules: ${profile.custom_rules}\n`;
+            }
+            basePrompt += `CRITICAL: You MUST adhere to these risk parameters when advising the user or executing tools. If a requested action violates these parameters (e.g., buying a high-risk memecoin when 'Avoid Memecoins' is YES), you MUST warn the user and refuse execution unless they explicitly override.\n`;
+        }
+    }
+    catch (e) {
+        // Ignore if db not ready
+    }
     return basePrompt;
 }
 async function processUserInput(input, role = 'user', onProgress, sessionId) {
@@ -214,9 +250,9 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         const hasGoogleKeyword = /email|gmail|calendar|sheet|doc|form|event/i.test(lowerInput);
         let tools = [];
         if ((0, skillManager_1.isSkillActive)('web3')) {
-            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, createWallet_1.createWalletToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, limitOrderManager_1.createLimitOrderToolDefinition, limitOrderManager_1.listLimitOrdersToolDefinition, limitOrderManager_1.cancelLimitOrderToolDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition);
+            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition, createLimitOrder_1.createLimitOrderToolDefinition);
         }
-        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition];
+        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
         let activeTools = [];
         if (hasGoogleKeyword && !hasWeb3Keyword) {
@@ -250,6 +286,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
             tool_calls: responseMessage.tool_calls,
         }, sessionId);
         if (responseMessage.tool_calls && responseMessage.tool_calls.length > 0) {
+            let canFastReturnAll = true;
+            let accumulatedResults = [];
+            // Disabled fastReturnTools to enforce Web3 Reasoning (V3 feature)
+            const fastReturnTools = [];
             for (const _toolCall of responseMessage.tool_calls) {
                 const toolCall = _toolCall;
                 let result = "";
@@ -303,7 +343,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                                 result = `[Security Blocked] Runtime Permission Denied: Web3 bridging (transfer) is disabled. Update config.yaml to allow.`;
                                 break;
                             }
-                            result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChainName, args.toChainName, args.fromToken, args.toToken, args.amountStr, args.mode, args.providerName);
+                            result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChain, args.toChain, args.tokenSymbol, args.amountStr, args.mode, args.providerName);
                             break;
                         }
                         case 'mint_nft': {
@@ -318,10 +358,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, customTx_1.prepareCustomTx)(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
                             break;
                         }
-                        case 'create_wallet': {
-                            result = await (0, createWallet_1.createWallet)();
-                            break;
-                        }
                         case 'check_token_security': {
                             result = await (0, checkSecurity_1.checkTokenSecurity)(args.chainName, args.contractAddress);
                             break;
@@ -367,19 +403,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'create_limit_order': {
-                            if (config.permissions?.web3?.allow_swap === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Limit orders require swap permissions. Update config.yaml to allow.`;
-                                break;
-                            }
-                            result = limitOrderManager_1.limitOrderManager.createOrder(args.chainName, args.fromToken, args.toToken, args.amountStr, args.targetPriceUsd, args.condition);
-                            break;
-                        }
-                        case 'list_limit_orders': {
-                            result = limitOrderManager_1.limitOrderManager.listOrders();
-                            break;
-                        }
-                        case 'cancel_limit_order': {
-                            result = limitOrderManager_1.limitOrderManager.cancelOrder(args.id);
+                            result = await (0, createLimitOrder_1.createLimitOrder)(args.tokenSymbol, args.tokenAddress, args.triggerCondition, args.triggerPriceUsd, args.action, args.amountUsd, args.slippageTolerance);
                             break;
                         }
                         case 'update_profile': {
@@ -395,7 +419,31 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'read_local_file': {
-                            result = (0, readFile_1.readLocalFile)(args.filePath);
+                            result = (0, readFile_1.readLocalFile)(args.filePath, args.startLine, args.endLine);
+                            break;
+                        }
+                        case 'edit_local_file': {
+                            result = (0, editFile_1.editLocalFile)(args.filePath, args.searchString, args.replacementString);
+                            break;
+                        }
+                        case 'execute_git_command': {
+                            result = await (0, gitManager_1.executeGitCommand)(args.action, args.commitMessage);
+                            break;
+                        }
+                        case 'manage_twitter': {
+                            result = await (0, xManager_1.manageTwitter)(args.action, args.content, args.username);
+                            break;
+                        }
+                        case 'manage_notion': {
+                            result = await (0, notionWorkspace_1.manageNotion)(args.action, args.pageId, args.text);
+                            break;
+                        }
+                        case 'transcribe_audio': {
+                            result = await (0, audioTranscribe_1.transcribeAudio)(args.filePath);
+                            break;
+                        }
+                        case 'summarize_text': {
+                            result = await (0, summarizeText_1.summarizeText)(args.text, args.focus);
                             break;
                         }
                         case 'write_local_file': {
@@ -482,17 +530,18 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                     name: toolName,
                     content: result,
                 }, sessionId);
-                // V2 Optimization (Expanded in v1.7.4): Zero-LLM Fast Return for data-heavy and read-only tools
-                // If the tool already returns perfectly formatted markdown, skip the second LLM call to save 5-10s latency and tokens!
-                const fastReturnTools = [
-                    'check_portfolio', 'check_address', 'get_price', 'get_my_address',
-                    'analyze_market', 'check_token_security', 'search_web', 'read_gmail_inbox', 'list_calendar_events'
-                ];
-                if (fastReturnTools.includes(toolName)) {
-                    exports.logger.addEntry({ role: 'assistant', content: result }, sessionId);
-                    return result;
+                accumulatedResults.push(result);
+                if (!fastReturnTools.includes(toolName)) {
+                    canFastReturnAll = false;
                 }
             }
+            // V2 Optimization (Expanded in v1.7.4): Zero-LLM Fast Return for data-heavy and read-only tools
+            // If all tools already return perfectly formatted markdown, skip the second LLM call to save 5-10s latency!
+            if (canFastReturnAll && accumulatedResults.length > 0) {
+                const finalContent = accumulatedResults.join('\n\n---\n\n');
+                exports.logger.addEntry({ role: 'assistant', content: finalContent }, sessionId);
+                return finalContent;
+            }
             // Second call to get the final answer after tool execution
             const secondMessages = [
                 { role: 'system', content: getSystemPrompt() },

package/dist/packages/core/src/config/defiConfigManager.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDefiKeys = loadDefiKeys;
+exports.saveDefiKeys = saveDefiKeys;
+const fs_1 = __importDefault(require("fs"));
+const yaml_1 = __importDefault(require("yaml"));
+const paths_1 = require("./paths");
+function loadDefiKeys() {
+    const configPath = (0, paths_1.getPath)('defi_keys.yaml');
+    try {
+        if (!fs_1.default.existsSync(configPath)) {
+            return {};
+        }
+        const file = fs_1.default.readFileSync(configPath, 'utf8');
+        return yaml_1.default.parse(file) || {};
+    }
+    catch (e) {
+        console.error('[DefiConfig] Failed to load defi_keys.yaml', e);
+        return {};
+    }
+}
+function saveDefiKeys(newKeys) {
+    const configPath = (0, paths_1.getPath)('defi_keys.yaml');
+    try {
+        const currentKeys = loadDefiKeys();
+        const merged = { ...currentKeys, ...newKeys };
+        const yamlStr = yaml_1.default.stringify(merged);
+        fs_1.default.writeFileSync(configPath, yamlStr, 'utf8');
+    }
+    catch (e) {
+        console.error('[DefiConfig] Failed to save defi_keys.yaml', e);
+    }
+}

package/dist/packages/core/src/config/parser.js

@@ -52,7 +52,7 @@ function loadConfig() {
             }
         }
         return {
-            agent: parsed.agent || { name: 'Nyxora-Default', description: 'Your Personal Web3 Assistant.', default_chain: 'base', default_router: 'auto', default_slippage: 0.5 },
+            agent: parsed.agent || { name: 'Nyxora-Default', description: 'Your Personal Web3 Assistant.', default_chain: 'base', default_router: 'auto', default_slippage: 'auto' },
             llm: parsed.llm || {
                 provider: 'openai',
                 model: 'gpt-4o-mini',
@@ -88,7 +88,7 @@ function loadConfig() {
                 description: "Your Personal Web3 Assistant.",
                 default_chain: "ethereum",
                 default_router: "auto",
-                default_slippage: 0.5
+                default_slippage: "auto"
             },
             llm: {
                 provider: 'openai',

package/dist/packages/core/src/gateway/cli.js

@@ -102,7 +102,10 @@ async function main() {
             'xai': 'xai_key',
             'deepseek': 'deepseek_key',
             'tavily': 'tavily_key',
-            'brave': 'brave_key'
+            'brave': 'brave_key',
+            'twitter': 'twitter_key',
+            'notion': 'notion_key',
+            'github': 'github_key'
         };
         const mappedKey = keyMap[provider.toLowerCase()] || `${provider.toLowerCase()}_key`;
         await (0, parser_1.saveApiKeys)({ [mappedKey]: key });
@@ -129,9 +132,19 @@ async function main() {
                 await entry.setPassword(pk);
                 console.log(picocolors_1.default.green('✅ Wallet updated securely in OS Native Vault.'));
                 console.log(picocolors_1.default.yellow('⚠️ Please restart your Nyxora agent for the new wallet to take effect.\n'));
+                // 2. Clear vault.key
+                try {
+                    const vaultPath = path_1.default.join(os_1.default.homedir(), '.nyxora', 'auth', 'vault.key');
+                    if (fs_1.default.existsSync(vaultPath))
+                        fs_1.default.unlinkSync(vaultPath);
+                }
+                catch (e) { }
             }
             catch (e) {
-                const vaultPath = path_1.default.join(os_1.default.homedir(), '.nyxora', 'vault.key');
+                const vaultDir = path_1.default.join(os_1.default.homedir(), '.nyxora', 'auth');
+                if (!fs_1.default.existsSync(vaultDir))
+                    fs_1.default.mkdirSync(vaultDir, { recursive: true });
+                const vaultPath = path_1.default.join(vaultDir, 'vault.key');
                 fs_1.default.writeFileSync(vaultPath, `PRIVATE_KEY=${pk}\n`, { mode: 0o600 });
                 console.log(picocolors_1.default.green('✅ Wallet updated securely in fallback vault.key.'));
                 console.log(picocolors_1.default.yellow('⚠️ Please restart your Nyxora agent for the new wallet to take effect.\n'));