nyxora 26.6.11-2 → 26.6.13

package/README.md

@@ -13,14 +13,14 @@ Nyxora is a **secure, non-custodial runtime infrastructure for autonomous onchai
 
 **Nyxora now natively supports the Model Context Protocol (MCP)**. You can transform your external AI agents (like Claude Desktop and Cursor) into secure Web3 actors that execute swaps and fetch balances using Nyxora's secure signer vault. [View the MCP Integration Guide](https://nyxoraai.github.io/Nyxora/guide/mcp-integration)
 
-It operates under an institutional-grade **Cryptographically Bound Human-in-the-Loop** execution model, ensuring that Remote AIs (LLMs) never have unilateral access to your funds.
+It operates under a **Zero-Trust, Defense-in-Depth Cryptographically Bound Human-in-the-Loop** execution model, ensuring that Remote AIs (LLMs) never have unilateral access to your funds.
 
 ---
 
 ## 🔥 Key Features
 
 ### Advanced Security Architecture
-*   **🛡️ On-Chain AI Kill-Switch**: Nyxora is governed by an Arbitrum Smart Contract (`NyxoraAgentRegistry`). Users have absolute cryptographic power to instantly paralyze the AI's on-chain execution if compromised, solving the Web3 AI safety dilemma. [Read more about our Arbitrum Architecture ->](https://nyxoraai.github.io/Nyxora/security/smart-contract)
+*   **🛡️ On-Chain AI Kill-Switch**: Nyxora is governed by an Arbitrum Smart Contract (`NyxoraAgentRegistry`). Users have absolute cryptographic power to instantly paralyze the AI's on-chain execution if compromised, solving the Web3 AI safety dilemma. [Read more about our Arbitrum Architecture](https://nyxoraai.github.io/Nyxora/security/smart-contract)
 *   **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
 *   **DeFi Configuration BYOK & UI Masking**: All aggregator and provider API keys are strictly isolated via a Bring Your Own Keys (BYOK) architecture into a heavily guarded `~/.nyxora/defi_keys.yaml` file. The local web Dashboard masks these injected secrets using `***********` and `IS_SET` censorship, completely neutralizing malicious browser extensions from exfiltrating your keys.
 *   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
@@ -32,7 +32,7 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 *   **Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
 *   **Advanced DeFi Optimization**: Autonomously supply assets to Aave V3, deposit into Beefy/Yearn Auto-Compounder Vaults, manage Uniswap V3 Liquidity (LP), and instantly revoke infinite approvals to secure your wallet. Features intelligent Transaction Chaining to auto-approve allowances prior to execution.
 *   **6-Engine Meta-Aggregator & Anti-MEV**: The core engine interfaces with a powerful 6-Engine Meta-Aggregator (**1inch, 0x, LI.FI, Relay, OpenOcean, and KyberSwap**) to route tokens cross-chain, ensuring absolute maximum liquidity depth.
-*   **Adaptive Auto Slippage Protection**: Nyxora enforces a dynamic and adaptive **'auto' slippage** by default to leverage dynamic MEV-protection from these enterprise aggregators. However, the user retains absolute control to override this dynamically—either globally via the Dashboard Settings or on a per-transaction basis through NLP chat commands (e.g., *"Swap 1 ETH to PEPE with 10% slippage"*).
+*   **Adaptive Auto Slippage Protection**: Nyxora enforces a dynamic and adaptive **'auto' slippage** by default to leverage dynamic MEV-protection from these industry-standard aggregators. However, the user retains absolute control to override this dynamically—either globally via the Dashboard Settings or on a per-transaction basis through NLP chat commands (e.g., *"Swap 1 ETH to PEPE with 10% slippage"*).
 
 *   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.

package/dist/packages/core/src/agent/bridgeWatcher.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startBridgeWatcher = startBridgeWatcher;
+const transactionManager_1 = require("./transactionManager");
+const telegram_1 = require("../gateway/telegram");
+const parser_1 = require("../config/parser");
+// In a real production environment, this would use the @eth-optimism/sdk 
+// to fetch the Merkle Proof and call proveWithdrawalTransaction on L1.
+// For the scope of this architecture prototype, we simulate the Challenge Period
+// watcher by using a time-delay, representing the exact asynchronous behavior.
+const CHALLENGE_PERIOD_MS = 2 * 60 * 1000; // Simulating a 2-minute challenge period for testnet demo
+function startBridgeWatcher() {
+    console.log('[Bridge Watcher] Started background daemon for asynchronous L2 withdrawals');
+    setInterval(async () => {
+        const config = (0, parser_1.loadConfig)();
+        const authId = config.integrations?.telegram?.authorized_chat_id;
+        if (!authId)
+            return;
+        const pending = transactionManager_1.txManager.getPendingWithdrawals();
+        const now = Date.now();
+        for (const w of pending) {
+            if (w.status === 'WAITING_FOR_CHALLENGE') {
+                if (now - w.createdAt > CHALLENGE_PERIOD_MS) {
+                    // The simulated challenge period is over. State root is "published".
+                    console.log(`[Bridge Watcher] Withdrawal ${w.id} is ready for L1 claim!`);
+                    transactionManager_1.txManager.updateWithdrawalStatus(w.id, 'READY_FOR_CLAIM');
+                    const amountDisplay = Number(w.amount) / 1e18; // assuming 18 decimals
+                    const message = `🔔 **Bridge Ready to Claim!**\n\nYour withdrawal of ${amountDisplay} ETH from ${w.l2Chain} to ${w.l1Chain} has completed its challenge period.\n\nShall I execute the Prove & Claim transaction on L1 now?`;
+                    await (0, telegram_1.sendPushNotification)(authId, message, w.id);
+                }
+            }
+        }
+    }, 30000); // Check every 30 seconds
+}

package/dist/packages/core/src/agent/reasoning.js

@@ -31,6 +31,7 @@ const defiLending_1 = require("../web3/skills/defiLending");
 const yieldVault_1 = require("../web3/skills/yieldVault");
 const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
 const getTxHistory_1 = require("../web3/skills/getTxHistory");
+const createLimitOrder_1 = require("../web3/skills/createLimitOrder");
 const updateProfile_1 = require("./updateProfile");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
@@ -122,26 +123,35 @@ async function executeWithRetry(requestBuilder, maxRetries = 3) {
 function getSystemPrompt() {
     const config = (0, parser_1.loadConfig)();
     const currentDateTime = new Date().toLocaleString('en-US', { timeZoneName: 'short' });
-    let basePrompt = `You are an autonomous Web3 agent operating on EVM chains.
+    let basePrompt = `[CORE DIRECTIVES]
+You are an autonomous Web3 agent operating on EVM chains.
 You are equipped with a native wallet.
 The current real-world date and time is: ${currentDateTime}. Use this for any time-related questions.
+Default Chain: ${config.agent.default_chain}
 
+CRITICAL: You MUST use a Chain of Thought approach for every response. You must enclose your internal reasoning steps within <think>...</think> XML tags BEFORE taking any action or providing a final response. This allows you to plan your tool usage, recall the rules, and avoid hallucinations.
+IMPORTANT: The <think> block is strictly for your internal hidden monologue. NEVER put your final answer, conversational text, or questions to the user inside the <think> block. The actual response that the user will see MUST be written OUTSIDE and AFTER the </think> tag.
+
+[EXECUTION WORKFLOW]
 CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
 CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt.
-CRITICAL RULE 3: FORMATTING & CONCISENESS. Be concise. Use markdown tables for lists of assets/transactions. Use commas for thousands.
+CRITICAL RULE 3: FORMATTING & CONCISENESS. Provide concise analytical summaries of data rather than just dumping raw markdown tables. Be analytical but brief. Use commas for thousands.
 CRITICAL RULE 4: TOOL PRIORITIZATION. Web3 tasks must use Web3 Skills exclusively. OS Skills (search, browse) are fallbacks only. Use get_my_address to show wallet address, and check_portfolio to show balances.
 CRITICAL RULE 5: DEFAULT CHAIN HANDLING. Default to: ${config.agent.default_chain} unless specified. If overridden, confirm the chain politely. For 2-chain txs (bridge), default source to ${config.agent.default_chain}.
-CRITICAL RULE 6: NETWORK SAFETY VALIDATION. If a request implies cross-chain or mainnet/testnet mixing, or the token symbol is ambiguous (USDC vs USDC.e), YOU MUST NOT GUESS. Ask for confirmation.
-CRITICAL RULE 7: TOOL CONFIDENCE & HALUCINATION PREVENTION. NEVER fabricate blockchain data. If a tool fails or data is missing, state it explicitly. Do not estimate balances, prices, APY, or gas.
 CRITICAL RULE 8: CONDITIONAL PARALLEL EXECUTION. Parallel tool execution is ONLY allowed if there are zero data dependencies between them.
-CRITICAL RULE 9: DEFI CONFIGURATION FALLBACK. If a tool fails due to Rate Limits, Unauthorized, or Missing API Keys, instruct the user to visit the "DeFi Configuration 🔑" menu in the dashboard.
 CRITICAL RULE 10: PLANNING & RISK DISCLOSURE. For high-level instructions (e.g. "Get yield"), formulate a plan and briefly disclose major risks (smart contract risk, impermanent loss) before asking for approval.
-CRITICAL RULE 11: FAST RETURN RULE. If parameters for read-only tools are complete, execute them IMMEDIATELY without preamble or conversational filler.
-CRITICAL RULE 12: SMART SLIPPAGE AWARENESS. For low-liquidity assets, warn the user that default slippage might not be enough. NEVER invent specific slippage percentage numbers.
+CRITICAL RULE 11: ADAPTIVE RESPONSE RULE. You must process Web3 data (portfolio, price) and provide a concise, to-the-point analysis based on the context. Do not use useless filler greetings/closings. Provide deep analysis only if the data requires it to protect the user's portfolio.
 CRITICAL RULE 13: WALLET CONTEXT CACHING. Portfolio data in chat history is potentially stale. Do not use cached data for transactional planning; refresh the balance via tools first.
 CRITICAL RULE 14: TRANSACTION EXECUTION. For ALL state-changing transactions (swap, bridge, transfer, stake), do NOT ask for verbal confirmation. Execute the tool IMMEDIATELY. The tool itself will trigger a secure popup in the user's dashboard UI for final approval.
+CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answer exists in recent verified context and freshness is not strictly required. Use history to save latency.
+
+[ANTI-HALLUCINATION PROTOCOL]
+CRITICAL RULE 6: NETWORK SAFETY VALIDATION. If a request implies cross-chain or mainnet/testnet mixing, or the token symbol is ambiguous (USDC vs USDC.e), YOU MUST NOT GUESS. Ask for confirmation.
+CRITICAL RULE 7: TOOL CONFIDENCE & HALUCINATION PREVENTION. NEVER fabricate blockchain data. If a tool fails or data is missing, state it explicitly. Do not estimate balances, prices, APY, or gas.
+CRITICAL RULE 9: DEFI CONFIGURATION FALLBACK. If a tool fails due to Rate Limits, Unauthorized, or Missing API Keys, instruct the user to visit the "DeFi Configuration 🔑" menu in the dashboard.
+CRITICAL RULE 12: SMART SLIPPAGE AWARENESS. For low-liquidity assets, warn the user that default slippage might not be enough. NEVER invent specific slippage percentage numbers.
 CRITICAL RULE 16: CAPABILITY HONESTY. NEVER claim a capability not available through installed tools. If asked for an unsupported action, state honestly that the skill is missing.
-CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answer exists in recent verified context and freshness is not strictly required. Use history to save latency.`;
+CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token security, or preparing trades, you MUST explicitly declare a 'Confidence Score (0-100%)' INSIDE your <think> block. If your score is below 40%, you must firmly WARN the user and advise against the trade in your final response.`;
     // Read IDENTITY.md for core AI persona
     try {
         const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
@@ -188,6 +198,23 @@ CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answ
     catch (error) {
         // Ignore db errors if not initialized
     }
+    // V3: Inject Personalized Risk Profile
+    try {
+        const profile = exports.logger.getUserProfile();
+        if (profile) {
+            basePrompt += `\n\n--- [USER_PERSONA] RISK PROFILE & PREFERENCES ---\n`;
+            basePrompt += `Risk Level: ${profile.risk_level}\n`;
+            basePrompt += `Max Slippage Tolerance: ${profile.max_slippage}%\n`;
+            basePrompt += `Avoid Memecoins: ${profile.avoid_memecoins ? 'YES' : 'NO'}\n`;
+            if (profile.custom_rules) {
+                basePrompt += `Custom Rules: ${profile.custom_rules}\n`;
+            }
+            basePrompt += `CRITICAL: You MUST adhere to these risk parameters when advising the user or executing tools. If a requested action violates these parameters (e.g., buying a high-risk memecoin when 'Avoid Memecoins' is YES), you MUST warn the user and refuse execution unless they explicitly override.\n`;
+        }
+    }
+    catch (e) {
+        // Ignore if db not ready
+    }
     return basePrompt;
 }
 async function processUserInput(input, role = 'user', onProgress, sessionId) {
@@ -223,7 +250,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         const hasGoogleKeyword = /email|gmail|calendar|sheet|doc|form|event/i.test(lowerInput);
         let tools = [];
         if ((0, skillManager_1.isSkillActive)('web3')) {
-            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition);
+            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition, createLimitOrder_1.createLimitOrderToolDefinition);
         }
         const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
@@ -261,9 +288,11 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         if (responseMessage.tool_calls && responseMessage.tool_calls.length > 0) {
             let canFastReturnAll = true;
             let accumulatedResults = [];
+            // Enabled fastReturnTools to eliminate 2nd LLM latency for transaction popups
             const fastReturnTools = [
-                'check_portfolio', 'check_address', 'get_price', 'get_my_address',
-                'analyze_market', 'check_token_security', 'search_web', 'read_gmail_inbox', 'list_calendar_events'
+                'transfer_token', 'transfer_native', 'swap_token', 'bridge_token',
+                'mint_nft', 'custom_tx', 'revoke_approval', 'supply_aave',
+                'deposit_yield_vault', 'provide_liquidity_v3'
             ];
             for (const _toolCall of responseMessage.tool_calls) {
                 const toolCall = _toolCall;
@@ -377,6 +406,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, getTxHistory_1.getTxHistory)(args.chainName, args.address, args.days);
                             break;
                         }
+                        case 'create_limit_order': {
+                            result = await (0, createLimitOrder_1.createLimitOrder)(args.tokenSymbol, args.tokenAddress, args.triggerCondition, args.triggerPriceUsd, args.action, args.amountUsd, args.slippageTolerance);
+                            break;
+                        }
                         case 'update_profile': {
                             result = (0, updateProfile_1.updateProfile)(args.content, args.mode);
                             break;

package/dist/packages/core/src/agent/transactionManager.js

@@ -5,8 +5,32 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.txManager = void 0;
 const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
 class TransactionManager {
     transactions = new Map();
+    withdrawals = new Map();
+    dbPath;
+    constructor() {
+        this.dbPath = path_1.default.join(process.cwd(), '.nyxora_withdrawals.json');
+        this.loadWithdrawals();
+    }
+    loadWithdrawals() {
+        if (fs_1.default.existsSync(this.dbPath)) {
+            try {
+                const data = fs_1.default.readFileSync(this.dbPath, 'utf8');
+                const parsed = JSON.parse(data);
+                parsed.forEach(w => this.withdrawals.set(w.id, w));
+            }
+            catch (e) {
+                console.error("Failed to load withdrawals DB:", e);
+            }
+        }
+    }
+    saveWithdrawals() {
+        const data = Array.from(this.withdrawals.values());
+        fs_1.default.writeFileSync(this.dbPath, JSON.stringify(data, null, 2));
+    }
     createPendingTransaction(type, chainName, details) {
         const id = crypto_1.default.randomUUID();
         const nonce = crypto_1.default.randomBytes(16).toString('hex');
@@ -36,5 +60,28 @@ class TransactionManager {
                 tx.result = result;
         }
     }
+    // --- WITHDRAWAL LOGIC ---
+    createPendingWithdrawal(data) {
+        const id = crypto_1.default.randomUUID();
+        const withdrawal = {
+            ...data,
+            id,
+            status: 'WAITING_FOR_CHALLENGE',
+            createdAt: Date.now()
+        };
+        this.withdrawals.set(id, withdrawal);
+        this.saveWithdrawals();
+        return withdrawal;
+    }
+    getPendingWithdrawals() {
+        return Array.from(this.withdrawals.values()).filter(w => w.status !== 'COMPLETED');
+    }
+    updateWithdrawalStatus(id, status) {
+        const w = this.withdrawals.get(id);
+        if (w) {
+            w.status = status;
+            this.saveWithdrawals();
+        }
+    }
 }
 exports.txManager = new TransactionManager();

package/dist/packages/core/src/gateway/server.js

@@ -51,6 +51,7 @@ const yieldVault_1 = require("../web3/skills/yieldVault");
 const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
 const getTxHistory_1 = require("../web3/skills/getTxHistory");
 const checkRegistryStatus_1 = require("../web3/skills/checkRegistryStatus");
+const createLimitOrder_1 = require("../web3/skills/createLimitOrder");
 // System Skills
 const browseWeb_1 = require("../system/skills/browseWeb");
 const executeShell_1 = require("../system/skills/executeShell");
@@ -69,6 +70,8 @@ const analyzeDocument_1 = require("../system/skills/analyzeDocument");
 const searchWeb_1 = require("../system/skills/searchWeb");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
 const telegram_1 = require("./telegram");
+const bridgeWatcher_1 = require("../agent/bridgeWatcher");
+const eventListener_1 = require("../web3/eventListener");
 const googleAuthModule_1 = require("./googleAuthModule");
 const legalGenerator_1 = require("./legalGenerator");
 const episodic_1 = require("../memory/episodic");
@@ -309,7 +312,8 @@ app.get('/api/skills', (req, res) => {
         revokeApprovals_2.revokeApprovalToolDefinition,
         yieldVault_1.vaultDepositToolDefinition,
         provideLiquidity_1.provideLiquidityToolDefinition,
-        getTxHistory_1.getTxHistoryToolDefinition
+        getTxHistory_1.getTxHistoryToolDefinition,
+        createLimitOrder_1.createLimitOrderToolDefinition
     ];
     const skillsWithStatus = allSkills.map(skill => ({
         ...skill,
@@ -778,6 +782,25 @@ app.delete('/api/memory/:id', (req, res) => {
         res.status(500).json({ error: error.message });
     }
 });
+// --- User Persona / Risk Profile Endpoints (V3) ---
+app.get('/api/profile', (req, res) => {
+    try {
+        const profile = reasoning_1.logger.getUserProfile();
+        res.json(profile || { risk_level: 'Moderate', max_slippage: 1.0, avoid_memecoins: false, custom_rules: '' });
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
+app.post('/api/profile', (req, res) => {
+    try {
+        reasoning_1.logger.updateUserProfile(req.body);
+        res.json({ success: true });
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
 // Fallback for React Router (Single Page Application)
 app.use((req, res, next) => {
     if (req.method === 'GET' && !req.path.startsWith('/api')) {
@@ -827,6 +850,10 @@ function startServer() {
         console.log(`🤖 Nyxora API Server running on port ${PORT}`);
         // Start the Telegram bot listener
         (0, telegram_1.startTelegramBot)();
+        // Start Asynchronous Bridge Watcher
+        (0, bridgeWatcher_1.startBridgeWatcher)();
+        // Start Event Listener for Limit Orders (V3)
+        eventListener_1.eventListener.start();
     });
     server.on('error', (e) => {
         if (e.code === 'EADDRINUSE') {

package/dist/packages/core/src/gateway/telegram.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatToTelegramHTML = formatToTelegramHTML;
 exports.startTelegramBot = startTelegramBot;
+exports.sendPushNotification = sendPushNotification;
 const telegraf_1 = require("telegraf");
 const reasoning_1 = require("../agent/reasoning");
 const parser_1 = require("../config/parser");
@@ -18,6 +19,7 @@ const executeDefi_1 = require("../web3/skills/executeDefi");
 const revokeApprovals_1 = require("../web3/skills/revokeApprovals");
 const formatter_1 = require("../utils/formatter");
 const picocolors_1 = __importDefault(require("picocolors"));
+let globalBotInstance = null;
 function formatToTelegramHTML(text) {
     if (!text)
         return "";
@@ -32,9 +34,11 @@ function formatToTelegramHTML(text) {
     // Convert code blocks and inline code
     html = html.replace(/```([\s\S]*?)```/g, '<pre><code>$1</code></pre>');
     html = html.replace(/`([^`]+)`/g, '<code>$1</code>');
-    // Strip <thought> blocks completely for user-friendly output
+    // Strip <thought> and <think> blocks completely for user-friendly output
     html = html.replace(/&lt;thought&gt;[\s\S]*?&lt;\/thought&gt;\n?/g, '');
     html = html.replace(/<thought>[\s\S]*?<\/thought>\n?/g, '');
+    html = html.replace(/&lt;think&gt;[\s\S]*?&lt;\/think&gt;\n?/g, '');
+    html = html.replace(/<think>[\s\S]*?<\/think>\n?/g, '');
     // Transform Markdown Tables to <pre> monospaced blocks so they don't break on mobile
     const tableRegex = /(?:\|.*\|(?:\n|$))+/g;
     html = html.replace(tableRegex, (match) => {
@@ -51,6 +55,7 @@ function startTelegramBot() {
     }
     try {
         const bot = new telegraf_1.Telegraf(token);
+        globalBotInstance = bot;
         // Pairing state variables
         const isPaired = !!config.integrations?.telegram?.authorized_chat_id;
         let generatedPin = '';
@@ -201,6 +206,15 @@ function startTelegramBot() {
                 else if (tx.type === 'revokeApproval') {
                     result = await (0, revokeApprovals_1.executeRevokeApproval)(tx.chainName, tx.details, true);
                 }
+                else if (tx.type === 'limit_order') {
+                    const success = reasoning_1.logger.activateLimitOrder(tx.details.orderId);
+                    if (success) {
+                        result = `Limit Order ${tx.details.orderId} is now ACTIVE. The Event-Driven Engine is monitoring the market.`;
+                    }
+                    else {
+                        throw new Error(`Failed to activate Limit Order. ID not found in database.`);
+                    }
+                }
                 transactionManager_1.txManager.updateStatus(txId, 'executed', result);
                 // Pass session history to formatTransactionSuccess to detect language
                 const sessionId = ctx.chat?.id.toString() || 'default';
@@ -248,3 +262,22 @@ function startTelegramBot() {
         console.error('[Telegram] Failed to initialize bot:', error);
     }
 }
+async function sendPushNotification(chatId, message, withdrawalId) {
+    if (!globalBotInstance)
+        return;
+    try {
+        let extraParams = { parse_mode: 'HTML' };
+        if (withdrawalId) {
+            extraParams = {
+                ...extraParams,
+                ...telegraf_1.Markup.inlineKeyboard([
+                    [telegraf_1.Markup.button.callback(`✅ Approve Claim`, `claim_${withdrawalId}`)]
+                ])
+            };
+        }
+        await globalBotInstance.telegram.sendMessage(chatId, formatToTelegramHTML(message), extraParams);
+    }
+    catch (error) {
+        console.error('[Telegram] Failed to send push notification:', error);
+    }
+}

package/dist/packages/core/src/memory/logger.js

@@ -53,6 +53,34 @@ class Logger {
         // Phase 1: SQLite Index Optimization
         this.db.exec(`
       CREATE INDEX IF NOT EXISTS idx_session_id ON messages(session_id);
+    `);
+        // V3: Limit Orders & Event-Driven Engine
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS limit_orders (
+        id TEXT PRIMARY KEY,
+        token_address TEXT NOT NULL,
+        token_symbol TEXT NOT NULL,
+        trigger_condition TEXT NOT NULL,
+        trigger_price_usd REAL NOT NULL,
+        action TEXT NOT NULL,
+        amount_usd REAL NOT NULL,
+        slippage_tolerance REAL DEFAULT 5.0,
+        status TEXT DEFAULT 'ACTIVE',
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        expires_at DATETIME,
+        tx_hash TEXT
+      )
+    `);
+        // V3: Personalized Risk Profile
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS user_profiles (
+        id TEXT PRIMARY KEY,
+        risk_level TEXT DEFAULT 'Moderate',
+        max_slippage REAL DEFAULT 1.0,
+        avoid_memecoins BOOLEAN DEFAULT 0,
+        custom_rules TEXT,
+        updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+      )
     `);
         // Ensure session_id exists for older DBs
         try {
@@ -193,6 +221,60 @@ class Logger {
             console.error('[Nyxora Memory] Error closing database:', e);
         }
     }
+    // V3: User Persona & Risk Profile
+    getUserProfile() {
+        try {
+            const row = this.db.prepare('SELECT * FROM user_profiles WHERE id = ?').get('default');
+            if (row) {
+                return {
+                    id: row.id,
+                    risk_level: row.risk_level,
+                    max_slippage: row.max_slippage,
+                    avoid_memecoins: Boolean(row.avoid_memecoins),
+                    custom_rules: row.custom_rules
+                };
+            }
+            return null;
+        }
+        catch (e) {
+            return null;
+        }
+    }
+    updateUserProfile(profile) {
+        const existing = this.getUserProfile() || {
+            id: 'default',
+            risk_level: 'Moderate',
+            max_slippage: 1.0,
+            avoid_memecoins: false,
+            custom_rules: null
+        };
+        const updated = { ...existing, ...profile };
+        this.db.prepare(`
+      INSERT INTO user_profiles (id, risk_level, max_slippage, avoid_memecoins, custom_rules, updated_at)
+      VALUES (?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+      ON CONFLICT(id) DO UPDATE SET
+        risk_level = excluded.risk_level,
+        max_slippage = excluded.max_slippage,
+        avoid_memecoins = excluded.avoid_memecoins,
+        custom_rules = excluded.custom_rules,
+        updated_at = excluded.updated_at
+    `).run('default', updated.risk_level, updated.max_slippage, updated.avoid_memecoins ? 1 : 0, updated.custom_rules);
+    }
+    // V3: Limit Orders
+    createLimitOrder(order) {
+        const id = crypto_1.default.randomUUID();
+        this.db.prepare(`
+      INSERT INTO limit_orders (
+        id, token_address, token_symbol, trigger_condition, trigger_price_usd, action, amount_usd, slippage_tolerance, status
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(id, order.token_address, order.token_symbol, order.trigger_condition, order.trigger_price_usd, order.action, order.amount_usd, order.slippage_tolerance || 5.0, 'PENDING_APPROVAL' // Requires user approval in Dashboard/Telegram
+        );
+        return id;
+    }
+    activateLimitOrder(orderId) {
+        const result = this.db.prepare(`UPDATE limit_orders SET status = 'ACTIVE' WHERE id = ?`).run(orderId);
+        return result.changes > 0;
+    }
 }
 exports.Logger = Logger;
 exports.logger = new Logger();

package/dist/packages/core/src/system/skills/analyzeDocument.js

@@ -91,22 +91,25 @@ async function analyzeDocument(filePath) {
             return text;
         }
         if (ext === '.xlsx' || ext === '.csv') {
-            const ExcelJS = await Promise.resolve().then(() => __importStar(require('exceljs')));
-            const workbook = new ExcelJS.Workbook();
+            let text = `--- Spreadsheet Data from ${path_1.default.basename(absolutePath)} ---\n`;
             if (ext === '.csv') {
-                await workbook.csv.readFile(absolutePath);
+                const { parse } = await Promise.resolve().then(() => __importStar(require('csv-parse/sync')));
+                const content = fs_1.default.readFileSync(absolutePath, 'utf8');
+                const records = parse(content, { skip_empty_lines: true });
+                records.forEach((row) => {
+                    text += row.join(',') + '\n';
+                });
             }
             else {
-                await workbook.xlsx.readFile(absolutePath);
-            }
-            let text = `--- Spreadsheet Data from ${path_1.default.basename(absolutePath)} ---\n`;
-            workbook.eachSheet((worksheet) => {
-                text += `\n[Sheet: ${worksheet.name}]\n`;
-                worksheet.eachRow((row) => {
-                    const values = Array.isArray(row.values) ? row.values.slice(1) : Object.values(row.values);
-                    text += values.join(',') + '\n';
+                const readXlsxFile = (await Promise.resolve().then(() => __importStar(require('read-excel-file/node')))).default;
+                const sheets = await readXlsxFile(absolutePath);
+                sheets.forEach((s) => {
+                    text += `\n[Sheet: ${s.sheet}]\n`;
+                    s.data.forEach((row) => {
+                        text += row.map(cell => cell === null ? '' : String(cell)).join(',') + '\n';
+                    });
                 });
-            });
+            }
             if (text.length > 20000) {
                 text = text.substring(0, 20000) + "... [Content Truncated]";
             }

package/dist/packages/core/src/system/skills/generateExcel.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateExcelToolDefinition = void 0;
 exports.generateExcelFile = generateExcelFile;
-const exceljs_1 = __importDefault(require("exceljs"));
+const node_1 = __importDefault(require("write-excel-file/node"));
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
 async function generateExcelFile(data, filePath) {
@@ -19,14 +19,12 @@ async function generateExcelFile(data, filePath) {
         if (!reportData || reportData.length === 0) {
             reportData = [{ Message: 'No data available' }];
         }
-        const workbook = new exceljs_1.default.Workbook();
-        const worksheet = workbook.addWorksheet('Report');
         const headers = Object.keys(reportData[0]);
-        worksheet.columns = headers.map(h => ({ header: h, key: h }));
-        reportData.forEach(row => {
-            worksheet.addRow(row);
-        });
-        await workbook.xlsx.writeFile(absolutePath);
+        const excelData = [
+            headers.map(h => ({ value: h, fontWeight: 'bold' })),
+            ...reportData.map(row => headers.map(h => ({ value: String(row[h] || '') })))
+        ];
+        await (0, node_1.default)(excelData).toFile(absolutePath);
         return `Success: Excel file generated at ${absolutePath}`;
     }
     catch (error) {

package/dist/packages/core/src/web3/aggregator/aggregatorMainnet.js

@@ -167,12 +167,17 @@ async function fetchLifi(fromChain, toChain, fromToken, toToken, amount, address
 }
 async function fetchRelay(fromChain, toChain, fromToken, toToken, amount, address, slippage, key) {
     try {
+        // Relay API strictly requires the zero address for Native ETH instead of 0xeeee...
+        const relayOriginCurrency = fromToken.toLowerCase() === '0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee'
+            ? '0x0000000000000000000000000000000000000000' : fromToken;
+        const relayDestCurrency = toToken.toLowerCase() === '0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee'
+            ? '0x0000000000000000000000000000000000000000' : toToken;
         const payload = {
             user: address,
             originChainId: CHAIN_IDS[fromChain].toString(),
             destinationChainId: CHAIN_IDS[toChain].toString(),
-            originCurrency: fromToken,
-            destinationCurrency: toToken,
+            originCurrency: relayOriginCurrency,
+            destinationCurrency: relayDestCurrency,
             recipient: address,
             tradeType: 'EXACT_INPUT',
             amount: amount,
@@ -233,6 +238,8 @@ async function fetchKyberSwap(fromChain, fromToken, toToken, amount, address, sl
         if (!buildRes.ok)
             throw new Error(await buildRes.text());
         const buildData = await buildRes.json();
+        const isNative = fromToken.toLowerCase() === '0xeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee' ||
+            fromToken === '0x0000000000000000000000000000000000000000';
         return {
             provider: 'KyberSwap',
             expectedOutput: (Number(routeData.data.routeSummary.amountOut) / 1e18).toString(),
@@ -241,7 +248,7 @@ async function fetchKyberSwap(fromChain, fromToken, toToken, amount, address, sl
             txPayload: {
                 to: buildData.data.routerAddress,
                 data: buildData.data.data,
-                value: routeData.data.routeSummary.amountInUsd // simplified value mapping
+                value: isNative ? amount : "0" // FIXED: Mengirim jumlah asli dalam WEI jika Native ETH, atau 0 jika ERC20
             },
             rawQuote: buildData.data
         };