nyxora 26.6.13 → 26.6.18

package/dist/packages/signer/src/server.js

@@ -171,7 +171,7 @@ app.post('/sign-transaction', async (req, res) => {
                     const rpcNonce = await client.getTransactionCount({ address: account.address, blockTag: 'pending' });
                     let nextNonce = Math.max(rpcNonce, nonceCache[chainId] || 0);
                     const txRequest = txPayload.details?.txRequest || txPayload.details?.txData || txPayload;
-                    // Phase 2: Transaction Simulation (Dry-Run / Anti-Gagal)
+                    // Phase 2: Transaction Simulation (Dry-Run / Anti-Fail)
                     try {
                         await client.estimateGas({
                             account,
@@ -225,7 +225,7 @@ app.listen(SOCKET_PATH, () => {
         console.error('Failed to chmod socket:', err);
     }
 });
-// Phase 3: Graceful Shutdown (Keamanan Keyring Lokal)
+// Phase 3: Graceful Shutdown (Local Keyring Security)
 const gracefulShutdown = () => {
     console.log('[Signer Vault] Received shutdown signal. Locking vault...');
     // @ts-ignore

package/launcher.ts

@@ -1,3 +1,4 @@
+// @ts-ignore
 import { initSafeLogger } from './packages/core/src/utils/safeLogger';
 initSafeLogger();
 
@@ -38,7 +39,14 @@ const spawnService = (name: string, command: string, args: string[], env: any, i
 
     if (!inheritStdio) {
       child.stdout?.on('data', (data) => process.stdout.write(`[${name}] ${data}`));
-      child.stderr?.on('data', (data) => process.stderr.write(`[${name}] ERROR: ${data}`));
+      child.stderr?.on('data', (data) => {
+        const msg = data.toString();
+        if (msg.toLowerCase().includes('warn')) {
+          process.stderr.write(`[${name}] ${msg}`);
+        } else {
+          process.stderr.write(`[${name}] ERROR: ${msg}`);
+        }
+      });
     }
 
     child.on('close', async (code) => {
@@ -109,22 +117,25 @@ if (fs.existsSync(socketPath)) {
 
 const children: { kill: () => void }[] = [];
 
-const isCompiled = __filename.endsWith('.js');
+const __filenameResolved = __filename;
+const __dirnameResolved = __dirname;
+
+const isCompiled = __filenameResolved.endsWith('.js');
 const ext = isCompiled ? '.js' : '.ts';
-const cmd = isCompiled ? 'node' : 'npx';
-const baseArgs = isCompiled ? [] : ['ts-node', '-T'];
+const cmd = isCompiled ? 'node' : path.join(__dirnameResolved, 'node_modules', '.bin', 'ts-node');
+const baseArgs = isCompiled ? [] : ['-T'];
 
-const signerPath = path.join(__dirname, `packages/signer/src/server${ext}`);
+const signerPath = path.join(__dirnameResolved, `packages/signer/src/server${ext}`);
 const signer = spawnService('Signer', cmd, [...baseArgs, signerPath], env);
 children.push(signer);
 
 setTimeout(() => {
-  const policyPath = path.join(__dirname, `packages/policy/src/server${ext}`);
+  const policyPath = path.join(__dirnameResolved, `packages/policy/src/server${ext}`);
   const policy = spawnService('Policy', cmd, [...baseArgs, policyPath], env);
   children.push(policy);
   
   setTimeout(() => {
-    const corePath = path.join(__dirname, `packages/core/src/gateway/cli${ext}`);
+    const corePath = path.join(__dirnameResolved, `packages/core/src/gateway/cli${ext}`);
     const args = process.argv.slice(2);
     const core = spawnService('Core', cmd, [...baseArgs, corePath, ...args], env, true);
     children.push(core);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora",
-  "version": "26.6.13",
+  "version": "26.6.18",
   "description": "Your Personal Web3 Assistant",
   "keywords": [
     "web3",
@@ -27,6 +27,7 @@
     "packages/signer/src",
     "packages/signer/package.json",
     "packages/mcp-server/src",
+    "packages/mcp-server/dist",
     "packages/mcp-server/package.json",
     "packages/dashboard/dist",
     "packages/dashboard/package.json"
@@ -35,8 +36,8 @@
     "nyxora": "bin/nyxora.mjs"
   },
   "scripts": {
-    "prepare": "npm run build --workspace=nyxora-dashboard || echo '⚠️ Build failed – dashboard UI may be missing'",
-    "dev": "concurrently -n \"BACKEND,FRONTEND\" -c \"blue,green\" \"npx ts-node -T launcher.ts\" \"npm run dev --workspace=nyxora-dashboard\"",
+    "prepare": "npm run build",
+    "dev": "concurrently -n \"BACKEND,FRONTEND\" -c \"blue,green\" \"NODE_NO_WARNINGS=1 ./node_modules/.bin/ts-node -T launcher.ts\" \"npm run dev --workspace=nyxora-dashboard\"",
     "start": "node ./bin/nyxora.mjs start",
     "stop": "node ./bin/nyxora.mjs stop",
     "restart": "node ./bin/nyxora.mjs restart",
@@ -44,7 +45,7 @@
     "setup": "node ./bin/nyxora.mjs setup",
     "set-key": "node ./bin/nyxora.mjs set-key",
     "doctor": "node ./bin/nyxora.mjs doctor",
-    "build": "tsc && npm run build --workspace=nyxora-dashboard",
+    "build": "tsc && npm run build --workspace=nyxora-mcp-server && npm run build --workspace=nyxora-dashboard",
     "test": "npm run test --workspace=packages/core"
   },
   "dependencies": {
@@ -98,8 +99,5 @@
     "concurrently": "^10.0.3",
     "oxc-minify": "^0.135.0",
     "vitepress": "^2.0.0-alpha.17"
-  },
-  "allowScripts": {
-    "isolated-vm": "true"
   }
 }

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora-agent-core",
-  "version": "26.6.13",
+  "version": "26.6.17",
   "private": true,
   "main": "src/gateway/server.ts",
   "dependencies": {
@@ -13,7 +13,6 @@
     "express": "^5.2.1",
     "express-rate-limit": "^7.5.0",
     "helmet": "^8.0.0",
-    "isolated-vm": "^6.1.2",
     "mammoth": "^1.12.0",
     "open": "^11.0.0",
     "openai": "^6.39.0",

package/packages/core/src/agent/reasoning.ts

@@ -16,6 +16,7 @@ import { customTxToolDefinition, prepareCustomTx } from '../web3/skills/customTx
 
 import { checkSecurityToolDefinition, checkTokenSecurity } from '../web3/skills/checkSecurity';
 import { marketAnalysisToolDefinition, analyzeMarket } from '../web3/skills/marketAnalysis';
+import { createMarketWatchAgentToolDefinition, createMarketWatchAgent } from '../web3/skills/createMarketWatchAgent';
 import { checkPortfolioToolDefinition, checkPortfolio } from '../web3/skills/checkPortfolio';
 import { checkAddressToolDefinition, checkAddress } from '../web3/skills/checkAddress';
 import { getMyAddressToolDefinition, getMyAddress } from '../web3/skills/getMyAddress';
@@ -36,7 +37,7 @@ import { generateExcelToolDefinition, generateExcelFile } from '../system/skills
 import { runTerminalCommandToolDefinition, runTerminalCommand } from '../system/skills/executeShell';
 import { browseWebsiteToolDefinition, browseWebsite } from '../system/skills/browseWeb';
 import { searchWebToolDefinition, searchWeb } from '../system/skills/searchWeb';
-import { installExternalSkillToolDefinition, installExternalSkill } from '../system/skills/installSkill';
+
 import { editLocalFileToolDefinition, editLocalFile } from '../system/skills/editFile';
 import { gitManagerToolDefinition, executeGitCommand } from '../system/skills/gitManager';
 import { xManagerToolDefinition, manageTwitter } from '../system/skills/xManager';
@@ -55,7 +56,7 @@ import {
   readGoogleDocsToolDefinition,
   readGoogleFormResponsesToolDefinition
 } from '../system/skills/googleWorkspace';
-import { pluginManager } from '../system/pluginManager';
+
 import { getPath } from '../config/paths';
 import pc from 'picocolors';
 
@@ -156,7 +157,7 @@ IMPORTANT: The <think> block is strictly for your internal hidden monologue. NEV
 
 [EXECUTION WORKFLOW]
 CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
-CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt.
+CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt. Render all output, metric labels, and suggested actions entirely in the language the user initiated the prompt with, while strictly preserving the visual structure of the progress bars.
 CRITICAL RULE 3: FORMATTING & CONCISENESS. Provide concise analytical summaries of data rather than just dumping raw markdown tables. Be analytical but brief. Use commas for thousands.
 CRITICAL RULE 4: TOOL PRIORITIZATION. Web3 tasks must use Web3 Skills exclusively. OS Skills (search, browse) are fallbacks only. Use get_my_address to show wallet address, and check_portfolio to show balances.
 CRITICAL RULE 5: DEFAULT CHAIN HANDLING. Default to: ${config.agent.default_chain} unless specified. If overridden, confirm the chain politely. For 2-chain txs (bridge), default source to ${config.agent.default_chain}.
@@ -197,15 +198,19 @@ CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token sec
     console.error('Failed to read user.md:', error);
   }
 
-  // Read security_policy.md for NLP security constraints
+  // Read policy.yaml for NLP security constraints
   try {
-    const policyPath = getPath('security_policy.md');
+    const policyPath = getPath('policy.yaml');
     if (fs.existsSync(policyPath)) {
-      const securityInstructions = fs.readFileSync(policyPath, 'utf8');
-      basePrompt += `\n\n--- SECURITY POLICY (MANDATORY RULES) ---\n${securityInstructions}\n\nCRITICAL: If the user asks you to perform an action that violates the Security Policy above, YOU MUST NOT EXECUTE IT DIRECTLY. Instead, ask for their explicit permission first.`;
+      const yaml = require('yaml'); // lazily import if not imported
+      const file = fs.readFileSync(policyPath, 'utf8');
+      const parsed = yaml.parse(file) || {};
+      if (parsed.custom_llm_rules && Array.isArray(parsed.custom_llm_rules) && parsed.custom_llm_rules.length > 0) {
+        basePrompt += `\n\n--- SECURITY POLICY (MANDATORY RULES) ---\n${parsed.custom_llm_rules.map((r: string) => `* ${r}`).join('\n')}\n\nCRITICAL: If the user asks you to perform an action that violates the Security Policy above, YOU MUST NOT EXECUTE IT DIRECTLY. Instead, ask for their explicit permission first.`;
+      }
     }
   } catch (error) {
-    console.error('Failed to read security_policy.md:', error);
+    console.error('Failed to read policy.yaml:', error);
   }
 
   // Inject Episodic Memories (Smart Suggestions Context)
@@ -285,6 +290,7 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
         customTxToolDefinition,
         checkSecurityToolDefinition,
         marketAnalysisToolDefinition,
+        createMarketWatchAgentToolDefinition,
         checkPortfolioToolDefinition,
         checkAddressToolDefinition,
         getMyAddressToolDefinition,
@@ -297,16 +303,16 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
         createLimitOrderToolDefinition
       );
     }
-    const SYSTEM_TOOLS = [updateProfileToolDefinition, updateSecurityPolicyToolDefinition, analyzeDocumentToolDefinition, readLocalFileToolDefinition, writeLocalFileToolDefinition, generateExcelToolDefinition, runTerminalCommandToolDefinition, browseWebsiteToolDefinition, searchWebToolDefinition, installExternalSkillToolDefinition, editLocalFileToolDefinition, gitManagerToolDefinition, xManagerToolDefinition, notionWorkspaceToolDefinition, audioTranscribeToolDefinition, summarizeTextToolDefinition];
+    const SYSTEM_TOOLS = [updateProfileToolDefinition, updateSecurityPolicyToolDefinition, analyzeDocumentToolDefinition, readLocalFileToolDefinition, writeLocalFileToolDefinition, generateExcelToolDefinition, runTerminalCommandToolDefinition, browseWebsiteToolDefinition, searchWebToolDefinition, editLocalFileToolDefinition, gitManagerToolDefinition, xManagerToolDefinition, notionWorkspaceToolDefinition, audioTranscribeToolDefinition, summarizeTextToolDefinition];
     const GOOGLE_TOOLS = [readGmailInboxToolDefinition, listCalendarEventsToolDefinition, appendRowToSheetsToolDefinition, readGoogleDocsToolDefinition, readGoogleFormResponsesToolDefinition];
 
     let activeTools: any[] = [];
     if (hasGoogleKeyword && !hasWeb3Keyword) {
-      activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS, ...pluginManager.getToolDefinitions()];
+      activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS];
     } else if (hasWeb3Keyword && !hasGoogleKeyword) {
-      activeTools = [...tools, ...SYSTEM_TOOLS, ...pluginManager.getToolDefinitions()];
+      activeTools = [...tools, ...SYSTEM_TOOLS];
     } else {
-      activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager.getToolDefinitions()];
+      activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS];
     }
     activeTools = activeTools.filter(t => isSkillActive(t.function.name));
 
@@ -376,10 +382,6 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
             }
             case 'transfer_token':
             case 'transfer_native': {
-              if (config.permissions?.web3?.allow_transfer === false) {
-                result = `[Security Blocked] Runtime Permission Denied: Web3 transfers are disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = await prepareTransfer(args.chainName, args.toAddress, args.amountStr || args.amountEth, args.token);
               break;
             }
@@ -388,18 +390,10 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             case 'swap_token': {
-              if (config.permissions?.web3?.allow_swap === false) {
-                result = `[Security Blocked] Runtime Permission Denied: Web3 swaps are disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = await prepareSwapToken(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
               break;
             }
             case 'bridge_token': {
-              if (config.permissions?.web3?.allow_transfer === false) {
-                result = `[Security Blocked] Runtime Permission Denied: Web3 bridging (transfer) is disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = await prepareBridgeToken(args.fromChain, args.toChain, args.tokenSymbol, args.amountStr, args.mode, args.providerName);
               break;
             }
@@ -408,10 +402,6 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             case 'custom_tx': {
-              if (config.permissions?.web3?.allow_transfer === false) {
-                result = `[Security Blocked] Runtime Permission Denied: Custom transactions are blocked because transfers are disabled.`;
-                break;
-              }
               result = await prepareCustomTx(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
               break;
             }
@@ -423,6 +413,10 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               result = await analyzeMarket(args.chainName, args.tokenAddressOrSymbol);
               break;
             }
+            case 'create_market_watch_agent': {
+              result = await createMarketWatchAgent(args.chainName, args.contractAddress, args.rules, args.durationDays);
+              break;
+            }
             case 'check_portfolio': {
               result = await checkPortfolio(args.chainName, args.address);
               break;
@@ -535,26 +529,14 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             case 'write_local_file': {
-              if (config.permissions?.system?.allow_file_write === false) {
-                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = writeLocalFile(args.filePath, args.content);
               break;
             }
             case 'generate_excel_file': {
-              if (config.permissions?.system?.allow_file_write === false) {
-                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = await generateExcelFile(args.data, args.filePath);
               break;
             }
             case 'run_terminal_command': {
-              if (config.permissions?.system?.allow_shell_execution === false) {
-                result = `[Security Blocked] Runtime Permission Denied: Shell execution is disabled. Update config.yaml to allow.`;
-                break;
-              }
               result = await runTerminalCommand(args.command);
               break;
             }
@@ -566,10 +548,7 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               result = await searchWeb(args.query, args.depth);
               break;
             }
-            case 'install_external_skill': {
-              result = await installExternalSkill(args.url);
-              break;
-            }
+
             case 'read_gmail_inbox': {
               result = await readGmailInbox(args.maxResults);
               break;
@@ -591,12 +570,7 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             default: {
-              const externalResult = await pluginManager.executeTool(toolName, args);
-              if (externalResult !== null) {
-                result = externalResult;
-              } else {
-                result = `Error: Tool ${toolName} is not implemented.`;
-              }
+              result = `Error: Tool ${toolName} is not implemented.`;
               break;
             }
           }

package/packages/core/src/config/parser.ts

@@ -3,6 +3,27 @@ import yaml from 'yaml';
 import path from 'path';
 import { getPath } from './paths';
 
+export function loadRpcConfig(): Record<string, string | string[]> {
+  const rpcPath = getPath('rpc_key.yaml');
+  if (fs.existsSync(rpcPath)) {
+    try {
+      return yaml.parse(fs.readFileSync(rpcPath, 'utf8')) || {};
+    } catch (e) {
+      console.error('[Config] Failed to parse rpc_key.yaml', e);
+    }
+  }
+  return {};
+}
+
+export function saveRpcConfig(rpcUrls: Record<string, string | string[]>): void {
+  const rpcPath = getPath('rpc_key.yaml');
+  try {
+    fs.writeFileSync(rpcPath, yaml.stringify(rpcUrls), 'utf8');
+  } catch (error) {
+    console.error('Failed to save rpc_key.yaml', error);
+  }
+}
+
 export async function loadApiKeys(): Promise<Record<string, string>> {
   const config = loadConfig();
   return config.credentials || {};
@@ -64,21 +85,13 @@ export interface NyxoraConfig {
   channels?: {
     active: string[];
   };
-  permissions?: {
-    web3?: {
-      allow_transfer?: boolean;
-      allow_swap?: boolean;
-      max_usd_per_tx?: number;
-    };
-    system?: {
-      allow_shell_execution?: boolean;
-      allow_file_write?: boolean;
-    };
-  };
 }
 
 export function loadConfig(): NyxoraConfig {
   const configPath = getPath('config.yaml');
+  const rpcPath = getPath('rpc_key.yaml');
+  let rpcUrls = loadRpcConfig();
+  
   try {
     const file = fs.readFileSync(configPath, 'utf8');
     const parsed = yaml.parse(file) as Partial<NyxoraConfig>;
@@ -99,6 +112,24 @@ export function loadConfig(): NyxoraConfig {
       needsSave = true;
     }
 
+    // Ensure we don't accidentally overwrite rpc_key.yaml with old config.yaml data.
+    if (parsed.web3 && parsed.web3.rpc_urls) {
+      delete parsed.web3.rpc_urls;
+      needsSave = true;
+    }
+
+    // Auto-migration logic: move permissions to policy.yaml
+    const policyPath = getPath('policy.yaml');
+    if (!fs.existsSync(policyPath)) {
+      const defaultPolicy = `max_usd_per_tx: ${(parsed as any).permissions?.web3?.max_usd_per_tx || 999999999}\nwhitelist_only: false\nrequire_approval: true\n`;
+      fs.writeFileSync(policyPath, defaultPolicy, 'utf8');
+      console.log('[Config] Created default policy.yaml.');
+    }
+    if ((parsed as any).permissions) {
+      delete (parsed as any).permissions;
+      needsSave = true;
+    }
+
     if (needsSave) {
       try {
         const yamlStr = yaml.stringify(parsed);
@@ -125,13 +156,9 @@ export function loadConfig(): NyxoraConfig {
       },
       credentials: parsed.credentials || {},
       memory: parsed.memory || { type: 'file', path: './memory.json' },
-      web3: parsed.web3 || { rpc_urls: {} },
+      web3: { ...parsed.web3, rpc_urls: rpcUrls },
       integrations: parsed.integrations || {
         telegram: { enabled: false }
-      },
-      permissions: parsed.permissions || {
-        web3: { allow_transfer: true, allow_swap: true, max_usd_per_tx: 999999999 },
-        system: { allow_shell_execution: true, allow_file_write: true }
       }
     } as NyxoraConfig;
   } catch (error: any) {
@@ -160,13 +187,9 @@ export function loadConfig(): NyxoraConfig {
       },
       credentials: {},
       memory: { type: 'file', path: './memory.json' },
-      web3: { rpc_urls: {} },
+      web3: { rpc_urls: rpcUrls },
       integrations: {
         telegram: { enabled: false }
-      },
-      permissions: {
-        web3: { allow_transfer: true, allow_swap: true, max_usd_per_tx: 999999999 },
-        system: { allow_shell_execution: true, allow_file_write: true }
       }
     };
   }
@@ -175,7 +198,11 @@ export function loadConfig(): NyxoraConfig {
 export function saveConfig(newConfig: NyxoraConfig): void {
   const configPath = getPath('config.yaml');
   try {
-    const yamlStr = yaml.stringify(newConfig);
+    const configToSave = JSON.parse(JSON.stringify(newConfig));
+    if (configToSave.web3 && configToSave.web3.rpc_urls) {
+      delete configToSave.web3.rpc_urls;
+    }
+    const yamlStr = yaml.stringify(configToSave);
     fs.writeFileSync(configPath, yamlStr, 'utf8');
   } catch (error) {
     console.error('Failed to save config.yaml', error);

package/packages/core/src/gateway/server.ts

@@ -21,14 +21,15 @@ import { getPath } from '../config/paths';
 import { validateToken, getSessionToken } from '../utils/state';
 
 import fs from 'fs';
+import yaml from 'yaml';
 import { processUserInput, logger } from '../agent/reasoning';
-import { loadConfig, saveConfig } from '../config/parser';
+import { loadConfig, saveConfig, loadRpcConfig, saveRpcConfig } from '../config/parser';
 import { loadDefiKeys, saveDefiKeys } from '../config/defiConfigManager';
 import { getPublicClient, SUPPORTED_CHAIN_NAMES, getAddress } from '../web3/config';
 import { TOKEN_MAP, ERC20_ABI } from '../web3/utils/tokens';
 import { Tracker } from './tracker';
 import { txManager } from '../agent/transactionManager';
-import { pluginManager } from '../system/pluginManager';
+
 import { executeTransfer, transferToolDefinition } from '../web3/skills/transfer';
 import { executeSwap, swapTokenToolDefinition } from '../web3/skills/swapToken';
 import { getBalanceToolDefinition } from '../web3/skills/getBalance';
@@ -56,7 +57,7 @@ import { createLimitOrderToolDefinition } from '../web3/skills/createLimitOrder'
 // System Skills
 import { browseWebsiteToolDefinition } from '../system/skills/browseWeb';
 import { runTerminalCommandToolDefinition } from '../system/skills/executeShell';
-import { installExternalSkillToolDefinition } from '../system/skills/installSkill';
+
 import { readLocalFileToolDefinition } from '../system/skills/readFile';
 import { editLocalFileToolDefinition } from '../system/skills/editFile';
 import { gitManagerToolDefinition } from '../system/skills/gitManager';
@@ -287,6 +288,26 @@ app.post('/api/config', (req, res) => {
   }
 });
 
+app.get('/api/rpc', (req, res) => {
+  try {
+    const rpcConfig = loadRpcConfig();
+    res.json(rpcConfig);
+  } catch (error: any) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+app.post('/api/rpc', (req, res) => {
+  try {
+    const currentRpc = loadRpcConfig();
+    const newRpc = { ...currentRpc, ...req.body };
+    saveRpcConfig(newRpc);
+    res.json({ success: true });
+  } catch (error: any) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
 app.get('/api/defi-keys', (req, res) => {
   try {
     const keys = loadDefiKeys();
@@ -356,7 +377,7 @@ app.get('/api/skills/system', (req, res) => {
     generateExcelToolDefinition,
     browseWebsiteToolDefinition,
     updateSecurityPolicyToolDefinition,
-    installExternalSkillToolDefinition,
+
     analyzeDocumentToolDefinition,
     searchWebToolDefinition,
     readGmailInboxToolDefinition,
@@ -829,6 +850,45 @@ app.delete('/api/memory/:id', (req, res) => {
   }
 });
 
+// --- Policy Engine Endpoints ---
+app.get('/api/policy', (req, res) => {
+  try {
+    const policyPath = getPath('policy.yaml');
+    if (!fs.existsSync(policyPath)) {
+      return res.json({
+        max_usd_per_tx: 999999999,
+        whitelist_only: false,
+        require_approval: true,
+        custom_llm_rules: []
+      });
+    }
+    const file = fs.readFileSync(policyPath, 'utf8');
+    const parsed = yaml.parse(file) || {};
+    res.json({
+      max_usd_per_tx: parsed.max_usd_per_tx ?? 999999999,
+      whitelist_only: parsed.whitelist_only ?? false,
+      require_approval: parsed.require_approval ?? true,
+      custom_llm_rules: parsed.custom_llm_rules || []
+    });
+  } catch (error: any) {
+    res.status(500).json({ error: error.message });
+  }
+});
+
+app.post('/api/policy', (req, res) => {
+  try {
+    const policyPath = getPath('policy.yaml');
+    let current = {};
+    if (fs.existsSync(policyPath)) {
+      current = yaml.parse(fs.readFileSync(policyPath, 'utf8')) || {};
+    }
+    const updated = { ...current, ...req.body };
+    fs.writeFileSync(policyPath, yaml.stringify(updated), 'utf8');
+    res.json({ success: true });
+  } catch (error: any) {
+    res.status(500).json({ error: error.message });
+  }
+});
 
 // --- User Persona / Risk Profile Endpoints (V3) ---
 app.get('/api/profile', (req, res) => {
@@ -893,9 +953,7 @@ export async function autoMigrateKeys() {
 export function startServer() {
   autoMigrateKeys().catch(e => console.error('[Auto-Migrate] Error:', e));
 
-  pluginManager.loadPlugins().then(() => {
-    console.log(`[PluginManager] Finished loading external skills.`);
-  });
+
 
   const PORT = Number(process.env.PORT || 3000);
   const server = app.listen(PORT, '127.0.0.1', () => {
@@ -921,19 +979,27 @@ export function startServer() {
     }
   });
 
+  let isShuttingDown = false;
   const gracefulShutdown = () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
     console.log('[Nyxora Gateway] Received shutdown signal. Closing server...');
+    
+    if (server.closeAllConnections) {
+      server.closeAllConnections();
+    }
+
     server.close(() => {
       console.log('[Nyxora Gateway] HTTP server closed.');
       logger.close();
       process.exit(0);
     });
     
-    // Force exit after 10s if stuck
+    // Force exit after 3s if stuck
     setTimeout(() => {
-      console.error('[Nyxora Gateway] Forced shutdown after 10s.');
+      console.error('[Nyxora Gateway] Forced shutdown.');
       process.exit(1);
-    }, 10000);
+    }, 3000).unref();
   };
 
   process.on('SIGTERM', gracefulShutdown);

package/packages/core/src/gateway/setup.ts

@@ -4,7 +4,7 @@ import pc from 'picocolors';
 import fs from 'fs';
 import path from 'path';
 import { getAppDir, getPath } from '../config/paths';
-import { loadConfig, saveConfig, saveApiKeys } from '../config/parser';
+import { loadConfig, saveConfig, saveApiKeys, saveRpcConfig } from '../config/parser';
 import crypto from 'crypto';
 
 function encryptKey(privateKey: string, password: string) {
@@ -302,9 +302,8 @@ Provider: ${config.llm.provider}`;
       { value: 'generateExcel', label: 'Generate Excel Reports' },
       { value: 'analyzeDocument', label: 'Analyze Docs (PDF/Word)' },
       { value: 'run_terminal', label: 'Run Terminal Command', hint: '⚠️ UNSAFE' },
-      { value: 'installSkill', label: 'Install External Skills (Plugins)' },
       { value: 'gitManager', label: 'Git Operations (Commit/Push/Pull)' },
-      { value: 'updateSecurityPolicy', label: 'Update security_policy.md', hint: 'safeguard' },
+      { value: 'updateSecurityPolicy', label: 'Update policy.yaml rules', hint: 'safeguard' },
       { value: 'browseWeb', label: 'Browse & Scrape Webpages' },
       { value: 'searchWeb', label: 'Smart Web Search (Tavily/Brave)', hint: 'Requires API Key' },
       { value: 'googleWorkspace', label: 'Google Workspace (Gmail, Docs, Sheets, Forms)', hint: 'Requires OAuth' },
@@ -429,7 +428,8 @@ Provider: ${config.llm.provider}`;
   }
 
   if (Object.keys(newApiKeys).length > 0) {
-    await saveApiKeys(newApiKeys);
+    if (!config.credentials) config.credentials = {};
+    config.credentials = { ...config.credentials, ...newApiKeys };
   }
 
   if (!config.integrations) config.integrations = {};
@@ -446,6 +446,7 @@ Provider: ${config.llm.provider}`;
 
   saveConfig(config);
 
+
   // Sync disabled_skills.json based on user selection
   const allWeb3Skills = [
     'transfer', 'swapToken', 'bridgeToken', 'customTx', 'mintNft',
@@ -456,7 +457,7 @@ Provider: ${config.llm.provider}`;
   
   const allOsSkills = [
     'readFile', 'writeFile', 'editFile', 'generateExcel', 'analyzeDocument',
-    'run_terminal', 'installSkill', 'gitManager', 'updateSecurityPolicy',
+    'run_terminal', 'gitManager', 'updateSecurityPolicy',
     'browseWeb', 'searchWeb', 'googleWorkspace', 'notionWorkspace', 'xManager',
     'audioTranscribe', 'summarizeText'
   ];