nyxora 26.6.14 → 26.6.19

package/README.md

@@ -25,7 +25,7 @@ It operates under a **Zero-Trust, Defense-in-Depth Cryptographically Bound Human
 *   **DeFi Configuration BYOK & UI Masking**: All aggregator and provider API keys are strictly isolated via a Bring Your Own Keys (BYOK) architecture into a heavily guarded `~/.nyxora/defi_keys.yaml` file. The local web Dashboard masks these injected secrets using `***********` and `IS_SET` censorship, completely neutralizing malicious browser extensions from exfiltrating your keys.
 *   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
 *   **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
-*   **Plugin Sandbox VM**: Execute community-built external skills securely inside an airtight Node.js `vm` chamber with zero access to your file system or terminal processes.
+
 *   **Graceful SQLite WAL Shutdown**: Integrated `SIGTERM`/`SIGINT` interceptors ensure that when the daemon stops, active requests are safely terminated and SQLite Write-Ahead Logs (WAL) are securely flushed, preventing database corruption.
 
 ### 🌐 Web3 Skills (On-Chain)
@@ -34,7 +34,8 @@ It operates under a **Zero-Trust, Defense-in-Depth Cryptographically Bound Human
 *   **6-Engine Meta-Aggregator & Anti-MEV**: The core engine interfaces with a powerful 6-Engine Meta-Aggregator (**1inch, 0x, LI.FI, Relay, OpenOcean, and KyberSwap**) to route tokens cross-chain, ensuring absolute maximum liquidity depth.
 *   **Adaptive Auto Slippage Protection**: Nyxora enforces a dynamic and adaptive **'auto' slippage** by default to leverage dynamic MEV-protection from these industry-standard aggregators. However, the user retains absolute control to override this dynamically—either globally via the Dashboard Settings or on a per-transaction basis through NLP chat commands (e.g., *"Swap 1 ETH to PEPE with 10% slippage"*).
 
-*   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
+*   **Dual-Routing Market Intelligence Engine**: Real-time asset tracking utilizing a sophisticated API Waterfall. Symbol queries are routed to CoinGecko/CEXs for global FDV, while Contract Addresses trigger DexScreener for live on-chain liquidity metrics across all networks.
+*   **Asynchronous Watchdog Agents**: Seamlessly spawn detached background instances for long-running monitoring tasks (e.g., *"Notify me when $ETH drops below $2500"*), leaving your primary chat session free for other operations.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.
 *   **Dynamic Portfolio Engine**: Merges standard tokens, your custom Degen CAs, and CoinGecko's daily trending list into a single hyper-fast Multicall scan to deliver a clean, spam-free PnL portfolio report in under 1 second.
 *   **Deep Transaction History**: Accurately fetch your 30-day (or custom timeframe) Native and ERC-20 transaction history across all supported EVM chains. Powered by the Unified Etherscan API V2, enabling seamless cross-chain fetching (Mainnets & Testnets) using a single API key.
@@ -171,7 +172,7 @@ For complete technical deep-dives into our Cryptographic Architecture, please vi
 **❤️ Support the Project**
 
 Building and maintaining a highly secure, zero-trust architecture takes significant time and resources. If you love what we are building, you can help us keep Nyxora open, secure, and constantly evolving by sending a coffee our way:
-- **EVM:** `0x18a30d5db50d287dba669c5672cd71246cc4c4c6`
+- **EVM (Multi-Sig Safe):** `0x490717E50D6434C348AA0D2bD5fe682392823708`
 
 ---
 **License:** MIT License

package/bin/nyxora.mjs

@@ -15,9 +15,9 @@ const pidFile = path.join(appDir, 'run', 'daemon.pid');
 const logFile = path.join(appDir, 'run', 'gateway.log');
 const tokenFile = path.join(appDir, 'auth', 'auth.token');
 
-if (!fs.existsSync(appDir)) {
-  fs.mkdirSync(appDir, { recursive: true });
-}
+[path.join(appDir, 'run'), path.join(appDir, 'auth')].forEach(dir => {
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+});
 
 const command = process.argv[2];
 
@@ -291,7 +291,6 @@ async function unlock() {
       } catch (e) {}
     }
     try {
-      const fetch = (await import('node-fetch')).default;
       const res = await fetch('http://localhost:3000/api/status/unlock', {
         method: 'POST',
         headers: {

package/dist/launcher.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+// @ts-ignore
 const safeLogger_1 = require("./packages/core/src/utils/safeLogger");
 (0, safeLogger_1.initSafeLogger)();
 const child_process_1 = require("child_process");
@@ -107,19 +108,21 @@ if (fs_1.default.existsSync(socketPath)) {
     fs_1.default.unlinkSync(socketPath);
 }
 const children = [];
-const isCompiled = __filename.endsWith('.js');
+const __filenameResolved = __filename;
+const __dirnameResolved = __dirname;
+const isCompiled = __filenameResolved.endsWith('.js');
 const ext = isCompiled ? '.js' : '.ts';
-const cmd = isCompiled ? 'node' : path_1.default.join(__dirname, 'node_modules', '.bin', 'ts-node');
+const cmd = isCompiled ? 'node' : path_1.default.join(__dirnameResolved, 'node_modules', '.bin', 'ts-node');
 const baseArgs = isCompiled ? [] : ['-T'];
-const signerPath = path_1.default.join(__dirname, `packages/signer/src/server${ext}`);
+const signerPath = path_1.default.join(__dirnameResolved, `packages/signer/src/server${ext}`);
 const signer = spawnService('Signer', cmd, [...baseArgs, signerPath], env);
 children.push(signer);
 setTimeout(() => {
-    const policyPath = path_1.default.join(__dirname, `packages/policy/src/server${ext}`);
+    const policyPath = path_1.default.join(__dirnameResolved, `packages/policy/src/server${ext}`);
     const policy = spawnService('Policy', cmd, [...baseArgs, policyPath], env);
     children.push(policy);
     setTimeout(() => {
-        const corePath = path_1.default.join(__dirname, `packages/core/src/gateway/cli${ext}`);
+        const corePath = path_1.default.join(__dirnameResolved, `packages/core/src/gateway/cli${ext}`);
         const args = process.argv.slice(2);
         const core = spawnService('Core', cmd, [...baseArgs, corePath, ...args], env, true);
         children.push(core);

package/dist/packages/core/src/agent/reasoning.js

@@ -22,6 +22,7 @@ const mintNft_1 = require("../web3/skills/mintNft");
 const customTx_1 = require("../web3/skills/customTx");
 const checkSecurity_1 = require("../web3/skills/checkSecurity");
 const marketAnalysis_1 = require("../web3/skills/marketAnalysis");
+const createMarketWatchAgent_1 = require("../web3/skills/createMarketWatchAgent");
 const checkPortfolio_1 = require("../web3/skills/checkPortfolio");
 const checkAddress_1 = require("../web3/skills/checkAddress");
 const getMyAddress_1 = require("../web3/skills/getMyAddress");
@@ -41,7 +42,6 @@ const generateExcel_1 = require("../system/skills/generateExcel");
 const executeShell_1 = require("../system/skills/executeShell");
 const browseWeb_1 = require("../system/skills/browseWeb");
 const searchWeb_1 = require("../system/skills/searchWeb");
-const installSkill_1 = require("../system/skills/installSkill");
 const editFile_1 = require("../system/skills/editFile");
 const gitManager_1 = require("../system/skills/gitManager");
 const xManager_1 = require("../system/skills/xManager");
@@ -49,7 +49,6 @@ const notionWorkspace_1 = require("../system/skills/notionWorkspace");
 const audioTranscribe_1 = require("../system/skills/audioTranscribe");
 const summarizeText_1 = require("../system/skills/summarizeText");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
-const pluginManager_1 = require("../system/pluginManager");
 const paths_1 = require("../config/paths");
 const picocolors_1 = __importDefault(require("picocolors"));
 exports.logger = new logger_1.Logger();
@@ -134,7 +133,7 @@ IMPORTANT: The <think> block is strictly for your internal hidden monologue. NEV
 
 [EXECUTION WORKFLOW]
 CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
-CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt.
+CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt. Render all output, metric labels, and suggested actions entirely in the language the user initiated the prompt with, while strictly preserving the visual structure of the progress bars.
 CRITICAL RULE 3: FORMATTING & CONCISENESS. Provide concise analytical summaries of data rather than just dumping raw markdown tables. Be analytical but brief. Use commas for thousands.
 CRITICAL RULE 4: TOOL PRIORITIZATION. Web3 tasks must use Web3 Skills exclusively. OS Skills (search, browse) are fallbacks only. Use get_my_address to show wallet address, and check_portfolio to show balances.
 CRITICAL RULE 5: DEFAULT CHAIN HANDLING. Default to: ${config.agent.default_chain} unless specified. If overridden, confirm the chain politely. For 2-chain txs (bridge), default source to ${config.agent.default_chain}.
@@ -174,16 +173,20 @@ CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token sec
     catch (error) {
         console.error('Failed to read user.md:', error);
     }
-    // Read security_policy.md for NLP security constraints
+    // Read policy.yaml for NLP security constraints
     try {
-        const policyPath = (0, paths_1.getPath)('security_policy.md');
+        const policyPath = (0, paths_1.getPath)('policy.yaml');
         if (fs_1.default.existsSync(policyPath)) {
-            const securityInstructions = fs_1.default.readFileSync(policyPath, 'utf8');
-            basePrompt += `\n\n--- SECURITY POLICY (MANDATORY RULES) ---\n${securityInstructions}\n\nCRITICAL: If the user asks you to perform an action that violates the Security Policy above, YOU MUST NOT EXECUTE IT DIRECTLY. Instead, ask for their explicit permission first.`;
+            const yaml = require('yaml'); // lazily import if not imported
+            const file = fs_1.default.readFileSync(policyPath, 'utf8');
+            const parsed = yaml.parse(file) || {};
+            if (parsed.custom_llm_rules && Array.isArray(parsed.custom_llm_rules) && parsed.custom_llm_rules.length > 0) {
+                basePrompt += `\n\n--- SECURITY POLICY (MANDATORY RULES) ---\n${parsed.custom_llm_rules.map((r) => `* ${r}`).join('\n')}\n\nCRITICAL: If the user asks you to perform an action that violates the Security Policy above, YOU MUST NOT EXECUTE IT DIRECTLY. Instead, ask for their explicit permission first.`;
+            }
         }
     }
     catch (error) {
-        console.error('Failed to read security_policy.md:', error);
+        console.error('Failed to read policy.yaml:', error);
     }
     // Inject Episodic Memories (Smart Suggestions Context)
     try {
@@ -242,27 +245,24 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         })
     ];
     try {
-        if (config.llm.provider !== 'openai' && config.llm.provider !== 'ollama' && config.llm.provider !== 'gemini' && config.llm.provider !== 'openrouter') {
-            return `Provider ${config.llm.provider} is configured, but currently only OpenAI, OpenRouter, Ollama, and Gemini adapters are implemented.`;
-        }
         const lowerInput = input.toLowerCase();
         const hasWeb3Keyword = /swap|transfer|price|token|crypto|bridge|wallet|balance|portfolio|buy|sell|send|receive|address|market|limit|mint|nft/i.test(lowerInput);
         const hasGoogleKeyword = /email|gmail|calendar|sheet|doc|form|event/i.test(lowerInput);
         let tools = [];
         if ((0, skillManager_1.isSkillActive)('web3')) {
-            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition, createLimitOrder_1.createLimitOrderToolDefinition);
+            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, createMarketWatchAgent_1.createMarketWatchAgentToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition, createLimitOrder_1.createLimitOrderToolDefinition);
         }
-        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
+        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
         let activeTools = [];
         if (hasGoogleKeyword && !hasWeb3Keyword) {
-            activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS];
         }
         else if (hasWeb3Keyword && !hasGoogleKeyword) {
-            activeTools = [...tools, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS];
         }
         else {
-            activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS];
         }
         activeTools = activeTools.filter(t => (0, skillManager_1.isSkillActive)(t.function.name));
         const response = await executeWithRetry(async (client) => {
@@ -323,10 +323,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                         }
                         case 'transfer_token':
                         case 'transfer_native': {
-                            if (config.permissions?.web3?.allow_transfer === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Web3 transfers are disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = await (0, transfer_1.prepareTransfer)(args.chainName, args.toAddress, args.amountStr || args.amountEth, args.token);
                             break;
                         }
@@ -335,18 +331,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'swap_token': {
-                            if (config.permissions?.web3?.allow_swap === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Web3 swaps are disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = await (0, swapToken_1.prepareSwapToken)(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
                             break;
                         }
                         case 'bridge_token': {
-                            if (config.permissions?.web3?.allow_transfer === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Web3 bridging (transfer) is disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChain, args.toChain, args.tokenSymbol, args.amountStr, args.mode, args.providerName);
                             break;
                         }
@@ -355,10 +343,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'custom_tx': {
-                            if (config.permissions?.web3?.allow_transfer === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Custom transactions are blocked because transfers are disabled.`;
-                                break;
-                            }
                             result = await (0, customTx_1.prepareCustomTx)(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
                             break;
                         }
@@ -370,6 +354,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, marketAnalysis_1.analyzeMarket)(args.chainName, args.tokenAddressOrSymbol);
                             break;
                         }
+                        case 'create_market_watch_agent': {
+                            result = await (0, createMarketWatchAgent_1.createMarketWatchAgent)(args.chainName, args.contractAddress, args.rules, args.durationDays);
+                            break;
+                        }
                         case 'check_portfolio': {
                             result = await (0, checkPortfolio_1.checkPortfolio)(args.chainName, args.address);
                             break;
@@ -451,26 +439,14 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'write_local_file': {
-                            if (config.permissions?.system?.allow_file_write === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = (0, writeFile_1.writeLocalFile)(args.filePath, args.content);
                             break;
                         }
                         case 'generate_excel_file': {
-                            if (config.permissions?.system?.allow_file_write === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = await (0, generateExcel_1.generateExcelFile)(args.data, args.filePath);
                             break;
                         }
                         case 'run_terminal_command': {
-                            if (config.permissions?.system?.allow_shell_execution === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Shell execution is disabled. Update config.yaml to allow.`;
-                                break;
-                            }
                             result = await (0, executeShell_1.runTerminalCommand)(args.command);
                             break;
                         }
@@ -482,10 +458,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, searchWeb_1.searchWeb)(args.query, args.depth);
                             break;
                         }
-                        case 'install_external_skill': {
-                            result = await (0, installSkill_1.installExternalSkill)(args.url);
-                            break;
-                        }
                         case 'read_gmail_inbox': {
                             result = await (0, googleWorkspace_1.readGmailInbox)(args.maxResults);
                             break;
@@ -507,13 +479,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         default: {
-                            const externalResult = await pluginManager_1.pluginManager.executeTool(toolName, args);
-                            if (externalResult !== null) {
-                                result = externalResult;
-                            }
-                            else {
-                                result = `Error: Tool ${toolName} is not implemented.`;
-                            }
+                            result = `Error: Tool ${toolName} is not implemented.`;
                             break;
                         }
                     }

package/dist/packages/core/src/config/parser.js

@@ -66,16 +66,22 @@ function loadConfig() {
             delete parsed.llm.credentials;
             needsSave = true;
         }
-        // Auto-migration logic: move web3.rpc_urls to rpc_key.yaml
-        if (parsed.web3 && parsed.web3.rpc_urls && Object.keys(parsed.web3.rpc_urls).length > 0) {
-            if (!fs_1.default.existsSync(rpcPath)) {
-                rpcUrls = parsed.web3.rpc_urls;
-                saveRpcConfig(rpcUrls);
-                console.log('[Config] Auto-migrated web3.rpc_urls to rpc_key.yaml.');
-            }
+        // Ensure we don't accidentally overwrite rpc_key.yaml with old config.yaml data.
+        if (parsed.web3 && parsed.web3.rpc_urls) {
             delete parsed.web3.rpc_urls;
             needsSave = true;
         }
+        // Auto-migration logic: move permissions to policy.yaml
+        const policyPath = (0, paths_1.getPath)('policy.yaml');
+        if (!fs_1.default.existsSync(policyPath)) {
+            const defaultPolicy = `max_usd_per_tx: ${parsed.permissions?.web3?.max_usd_per_tx || 999999999}\nwhitelist_only: false\nrequire_approval: true\n`;
+            fs_1.default.writeFileSync(policyPath, defaultPolicy, 'utf8');
+            console.log('[Config] Created default policy.yaml.');
+        }
+        if (parsed.permissions) {
+            delete parsed.permissions;
+            needsSave = true;
+        }
         if (needsSave) {
             try {
                 const yamlStr = yaml_1.default.stringify(parsed);
@@ -103,10 +109,6 @@ function loadConfig() {
             web3: { ...parsed.web3, rpc_urls: rpcUrls },
             integrations: parsed.integrations || {
                 telegram: { enabled: false }
-            },
-            permissions: parsed.permissions || {
-                web3: { allow_transfer: true, allow_swap: true, max_usd_per_tx: 999999999 },
-                system: { allow_shell_execution: true, allow_file_write: true }
             }
         };
     }
@@ -140,10 +142,6 @@ function loadConfig() {
             web3: { rpc_urls: rpcUrls },
             integrations: {
                 telegram: { enabled: false }
-            },
-            permissions: {
-                web3: { allow_transfer: true, allow_swap: true, max_usd_per_tx: 999999999 },
-                system: { allow_shell_execution: true, allow_file_write: true }
             }
         };
     }

package/dist/packages/core/src/gateway/server.js

@@ -21,6 +21,7 @@ const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
 const paths_1 = require("../config/paths");
 const state_1 = require("../utils/state");
 const fs_1 = __importDefault(require("fs"));
+const yaml_1 = __importDefault(require("yaml"));
 const reasoning_1 = require("../agent/reasoning");
 const parser_1 = require("../config/parser");
 const defiConfigManager_1 = require("../config/defiConfigManager");
@@ -28,7 +29,6 @@ const config_1 = require("../web3/config");
 const tokens_1 = require("../web3/utils/tokens");
 const tracker_1 = require("./tracker");
 const transactionManager_1 = require("../agent/transactionManager");
-const pluginManager_1 = require("../system/pluginManager");
 const transfer_1 = require("../web3/skills/transfer");
 const swapToken_1 = require("../web3/skills/swapToken");
 const getBalance_1 = require("../web3/skills/getBalance");
@@ -55,7 +55,6 @@ const createLimitOrder_1 = require("../web3/skills/createLimitOrder");
 // System Skills
 const browseWeb_1 = require("../system/skills/browseWeb");
 const executeShell_1 = require("../system/skills/executeShell");
-const installSkill_1 = require("../system/skills/installSkill");
 const readFile_1 = require("../system/skills/readFile");
 const editFile_1 = require("../system/skills/editFile");
 const gitManager_1 = require("../system/skills/gitManager");
@@ -125,7 +124,8 @@ app.use('/api/', apiLimiter);
 app.use('/api', (req, res, next) => {
     // Bypass auth for Google OAuth callback and URLs since they are handled externally or by the browser
     const allowedPaths = ['/api/auth/google/url', '/api/auth/google/callback', '/api/auth/google/status', '/api/auth/google'];
-    if (allowedPaths.includes(req.path) || allowedPaths.includes(req.path.replace(/\/$/, ''))) {
+    const currentPath = req.originalUrl.split('?')[0];
+    if (allowedPaths.includes(currentPath) || allowedPaths.includes(currentPath.replace(/\/$/, ''))) {
         return next();
     }
     const token = req.headers['x-nyxora-token'];
@@ -349,7 +349,6 @@ app.get('/api/skills/system', (req, res) => {
         generateExcel_1.generateExcelToolDefinition,
         browseWeb_1.browseWebsiteToolDefinition,
         updateSecurityPolicy_1.updateSecurityPolicyToolDefinition,
-        installSkill_1.installExternalSkillToolDefinition,
         analyzeDocument_1.analyzeDocumentToolDefinition,
         searchWeb_1.searchWebToolDefinition,
         googleWorkspace_1.readGmailInboxToolDefinition,
@@ -802,6 +801,46 @@ app.delete('/api/memory/:id', (req, res) => {
         res.status(500).json({ error: error.message });
     }
 });
+// --- Policy Engine Endpoints ---
+app.get('/api/policy', (req, res) => {
+    try {
+        const policyPath = (0, paths_1.getPath)('policy.yaml');
+        if (!fs_1.default.existsSync(policyPath)) {
+            return res.json({
+                max_usd_per_tx: 999999999,
+                whitelist_only: false,
+                require_approval: true,
+                custom_llm_rules: []
+            });
+        }
+        const file = fs_1.default.readFileSync(policyPath, 'utf8');
+        const parsed = yaml_1.default.parse(file) || {};
+        res.json({
+            max_usd_per_tx: parsed.max_usd_per_tx ?? 999999999,
+            whitelist_only: parsed.whitelist_only ?? false,
+            require_approval: parsed.require_approval ?? true,
+            custom_llm_rules: parsed.custom_llm_rules || []
+        });
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
+app.post('/api/policy', (req, res) => {
+    try {
+        const policyPath = (0, paths_1.getPath)('policy.yaml');
+        let current = {};
+        if (fs_1.default.existsSync(policyPath)) {
+            current = yaml_1.default.parse(fs_1.default.readFileSync(policyPath, 'utf8')) || {};
+        }
+        const updated = { ...current, ...req.body };
+        fs_1.default.writeFileSync(policyPath, yaml_1.default.stringify(updated), 'utf8');
+        res.json({ success: true });
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
 // --- User Persona / Risk Profile Endpoints (V3) ---
 app.get('/api/profile', (req, res) => {
     try {
@@ -862,9 +901,6 @@ async function autoMigrateKeys() {
 }
 function startServer() {
     autoMigrateKeys().catch(e => console.error('[Auto-Migrate] Error:', e));
-    pluginManager_1.pluginManager.loadPlugins().then(() => {
-        console.log(`[PluginManager] Finished loading external skills.`);
-    });
     const PORT = Number(process.env.PORT || 3000);
     const server = app.listen(PORT, '127.0.0.1', () => {
         console.log(`🤖 Nyxora API Server running on port ${PORT}`);
@@ -885,18 +921,25 @@ function startServer() {
             process.exit(1);
         }
     });
+    let isShuttingDown = false;
     const gracefulShutdown = () => {
+        if (isShuttingDown)
+            return;
+        isShuttingDown = true;
         console.log('[Nyxora Gateway] Received shutdown signal. Closing server...');
+        if (server.closeAllConnections) {
+            server.closeAllConnections();
+        }
         server.close(() => {
             console.log('[Nyxora Gateway] HTTP server closed.');
             reasoning_1.logger.close();
             process.exit(0);
         });
-        // Force exit after 10s if stuck
+        // Force exit after 3s if stuck
         setTimeout(() => {
-            console.error('[Nyxora Gateway] Forced shutdown after 10s.');
+            console.error('[Nyxora Gateway] Forced shutdown.');
             process.exit(1);
-        }, 10000);
+        }, 3000).unref();
     };
     process.on('SIGTERM', gracefulShutdown);
     process.on('SIGINT', gracefulShutdown);

package/dist/packages/core/src/gateway/setup.js

@@ -289,9 +289,8 @@ Provider: ${config.llm.provider}`;
             { value: 'generateExcel', label: 'Generate Excel Reports' },
             { value: 'analyzeDocument', label: 'Analyze Docs (PDF/Word)' },
             { value: 'run_terminal', label: 'Run Terminal Command', hint: '⚠️ UNSAFE' },
-            { value: 'installSkill', label: 'Install External Skills (Plugins)' },
             { value: 'gitManager', label: 'Git Operations (Commit/Push/Pull)' },
-            { value: 'updateSecurityPolicy', label: 'Update security_policy.md', hint: 'safeguard' },
+            { value: 'updateSecurityPolicy', label: 'Update policy.yaml rules', hint: 'safeguard' },
             { value: 'browseWeb', label: 'Browse & Scrape Webpages' },
             { value: 'searchWeb', label: 'Smart Web Search (Tavily/Brave)', hint: 'Requires API Key' },
             { value: 'googleWorkspace', label: 'Google Workspace (Gmail, Docs, Sheets, Forms)', hint: 'Requires OAuth' },
@@ -410,7 +409,9 @@ Provider: ${config.llm.provider}`;
         config.web_search.enabled = false;
     }
     if (Object.keys(newApiKeys).length > 0) {
-        await (0, parser_1.saveApiKeys)(newApiKeys);
+        if (!config.credentials)
+            config.credentials = {};
+        config.credentials = { ...config.credentials, ...newApiKeys };
     }
     if (!config.integrations)
         config.integrations = {};
@@ -424,7 +425,6 @@ Provider: ${config.llm.provider}`;
         config.integrations.telegram.authorized_chat_id = authorizedChatId;
     }
     (0, parser_1.saveConfig)(config);
-    (0, parser_1.saveRpcConfig)({});
     // Sync disabled_skills.json based on user selection
     const allWeb3Skills = [
         'transfer', 'swapToken', 'bridgeToken', 'customTx', 'mintNft',
@@ -434,23 +434,75 @@ Provider: ${config.llm.provider}`;
     ];
     const allOsSkills = [
         'readFile', 'writeFile', 'editFile', 'generateExcel', 'analyzeDocument',
-        'run_terminal', 'installSkill', 'gitManager', 'updateSecurityPolicy',
+        'run_terminal', 'gitManager', 'updateSecurityPolicy',
         'browseWeb', 'searchWeb', 'googleWorkspace', 'notionWorkspace', 'xManager',
         'audioTranscribe', 'summarizeText'
     ];
     const disabledSkills = [];
+    const skillMapping = {
+        // OS Skills
+        readFile: 'read_local_file',
+        writeFile: 'write_local_file',
+        editFile: 'edit_local_file',
+        generateExcel: 'generate_excel_file',
+        analyzeDocument: 'analyze_document',
+        run_terminal: 'run_terminal_command',
+        gitManager: 'execute_git_command',
+        updateSecurityPolicy: 'update_security_policy',
+        browseWeb: 'browse_website',
+        searchWeb: 'search_web',
+        googleWorkspace: [
+            'read_gmail_inbox',
+            'list_calendar_events',
+            'append_row_to_sheets',
+            'read_google_docs',
+            'read_google_form_responses'
+        ],
+        notionWorkspace: 'manage_notion',
+        xManager: 'manage_twitter',
+        audioTranscribe: 'transcribe_audio',
+        summarizeText: 'summarize_text',
+        // Web3 Skills
+        transfer: 'transfer_token',
+        swapToken: 'swap_token',
+        bridgeToken: 'bridge_token',
+        customTx: 'custom_tx',
+        mintNft: 'mint_nft',
+        defiLending: 'supply_aave',
+        provideLiquidity: 'provide_liquidity_v3',
+        yieldVault: 'deposit_yield_vault',
+        revokeApprovals: 'revoke_approval',
+        getBalance: 'get_balance',
+        getMyAddress: 'get_my_address',
+        checkPortfolio: 'check_portfolio',
+        getPrice: 'get_price',
+        marketAnalysis: 'analyze_market',
+        getTxHistory: 'get_tx_history',
+        checkSecurity: 'check_token_security',
+        checkAddress: 'check_address',
+        checkRegistryStatus: 'check_registry_status',
+        manageCustomTokens: 'manage_custom_tokens'
+    };
+    const processDisabledSkill = (skill) => {
+        const mapped = skillMapping[skill];
+        if (Array.isArray(mapped)) {
+            disabledSkills.push(...mapped);
+        }
+        else if (mapped) {
+            disabledSkills.push(mapped);
+        }
+        else {
+            disabledSkills.push(skill);
+        }
+    };
     allWeb3Skills.forEach(skill => {
         if (!activeWeb3Skills.includes(skill))
-            disabledSkills.push(skill);
+            processDisabledSkill(skill);
     });
     allOsSkills.forEach(skill => {
         if (!activeOsSkills.includes(skill))
-            disabledSkills.push(skill);
+            processDisabledSkill(skill);
     });
-    // Note: the backend uses 'run_terminal_command', but the UI/wizard used 'run_terminal'
-    // I need to map it just in case:
-    if (!activeOsSkills.includes('run_terminal'))
-        disabledSkills.push('run_terminal_command');
     fs_1.default.writeFileSync((0, paths_1.getPath)('disabled_skills.json'), JSON.stringify(disabledSkills, null, 2));
     // Save Private Key to OS Keyring or fallback to .env
     if (privateKey) {

package/dist/packages/core/src/gateway/telegram.js

@@ -64,13 +64,13 @@ function startTelegramBot() {
             generatedPin = Math.floor(100000 + Math.random() * 900000).toString();
             pinExpiry = Date.now() + 5 * 60 * 1000; // 5 minutes TTL
             console.log(picocolors_1.default.yellow('\n==================================================='));
-            console.log(picocolors_1.default.yellow('🔐 OTORISASI BOT TELEGRAM DIBUTUHKAN'));
+            console.log(picocolors_1.default.yellow('🔐 TELEGRAM BOT AUTHORIZATION REQUIRED'));
             console.log(picocolors_1.default.yellow('==================================================='));
-            console.log('Bot Telegram Anda saat ini terkunci demi keamanan.');
-            console.log('Buka Telegram Anda, dan kirimkan perintah berikut ke bot Anda:\n');
+            console.log('Your Telegram Bot is currently locked for security.');
+            console.log('Open your Telegram app, and send the following command to your bot:\n');
             console.log(picocolors_1.default.cyan(`  /auth ${generatedPin}\n`));
-            console.log(picocolors_1.default.gray('(Kode OTP ini akan kedaluwarsa dalam 5 menit)\n'));
-            console.log('⏳ Menunggu pesan masuk...');
+            console.log(picocolors_1.default.gray('(This OTP code will expire in 5 minutes)\n'));
+            console.log('⏳ Waiting for incoming message...');
         }
         // Security Middleware (OTP & Authorization)
         bot.use(async (ctx, next) => {
@@ -100,12 +100,12 @@ function startTelegramBot() {
                             currentConfig.integrations.telegram = { enabled: true, bot_token: token };
                         currentConfig.integrations.telegram.authorized_chat_id = ctx.chat?.id;
                         (0, parser_1.saveConfig)(currentConfig);
-                        await ctx.reply('✅ Otorisasi Berhasil! Agen Nyxora kini hanya akan mematuhi perintah Anda. Koneksi diamankan.');
+                        await ctx.reply('✅ Authorization Successful! Nyxora Agent will now only obey your commands. Connection secured.');
                         console.log(picocolors_1.default.green(`\n[Telegram] Successfully paired with Chat ID: ${ctx.chat?.id}`));
                         return; // Done parsing auth, ignore this specific message for further logic
                     }
                     else {
-                        await ctx.reply('❌ PIN salah.');
+                        await ctx.reply('❌ Incorrect PIN.');
                         return;
                     }
                 }
@@ -115,7 +115,7 @@ function startTelegramBot() {
         });
         bot.command('clear', async (ctx) => {
             reasoning_1.logger.clear(ctx.chat?.id.toString());
-            await ctx.reply('✅ Memori AI telah dihapus. Mari kita mulai obrolan baru!');
+            await ctx.reply("✅ AI memory has been cleared. Let's start a new chat!");
         });
         bot.on('text', async (ctx) => {
             const text = ctx.message.text;
@@ -216,17 +216,7 @@ function startTelegramBot() {
                     }
                 }
                 transactionManager_1.txManager.updateStatus(txId, 'executed', result);
-                // Pass session history to formatTransactionSuccess to detect language
-                const sessionId = ctx.chat?.id.toString() || 'default';
-                const history = reasoning_1.logger.getHistory(sessionId);
-                let isIndonesian = false;
-                if (history.length > 0) {
-                    const lastMsg = history[history.length - 1].content.toLowerCase();
-                    const idWords = ['saya', 'kamu', 'aku', 'apa', 'bagaimana', 'kenapa', 'bisa', 'tolong', 'ke', 'di', 'dari', 'yang', 'ini', 'itu', 'buat', 'cek', 'saldo'];
-                    if (idWords.some(w => lastMsg.includes(w)))
-                        isIndonesian = true;
-                }
-                const prettyMsg = (0, formatter_1.formatTransactionSuccess)(tx, result, isIndonesian);
+                const prettyMsg = (0, formatter_1.formatTransactionSuccess)(tx, result);
                 await ctx.reply(formatToTelegramHTML(`✅ **Transaction processed: Success**\n\n${prettyMsg}`), { parse_mode: 'HTML' });
                 (0, reasoning_1.processUserInput)(`Transaction ${txId} was APPROVED via Telegram. Result: ${result}`, 'system', undefined, ctx.chat?.id.toString()).catch(() => { });
             }