nyxora 26.6.19 → 26.6.21

package/dist/packages/core/src/web3/aggregator/aggregatorMainnet.js

@@ -50,8 +50,8 @@ async function fetchMainnetBestRoute(fromChain, toChain, fromToken, toToken, amo
     if (isProviderHealthy('openocean')) {
         promises.push(fetchOpenOcean(fromChain, toChain, fromToken, toToken, amountInWei, userAddress, slippageTolerance, keys.openocean_key));
     }
-    // Provider 6: KyberSwap (Cross-chain & Same-chain)
-    if (isProviderHealthy('kyberswap')) {
+    // Provider 6: KyberSwap (Same-chain ONLY)
+    if (!isCrossChain && isProviderHealthy('kyberswap')) {
         promises.push(fetchKyberSwap(fromChain, fromToken, toToken, amountInWei, userAddress, slippageTolerance));
     }
     // Execute all healthy providers concurrently with a 4s timeout

package/dist/packages/core/src/web3/aggregator/defiRouter.js

@@ -4,6 +4,9 @@ exports.routeTransaction = routeTransaction;
 const aggregatorMainnet_1 = require("./aggregatorMainnet");
 const aggregatorTestnet_1 = require("./aggregatorTestnet");
 async function routeTransaction(fromChain, toChain, fromToken, toToken, amountInWei, userAddress, slippageTolerance = "auto") {
+    if (!fromChain || !toChain) {
+        throw new Error("Missing source or destination chain in routing.");
+    }
     // Auto-correct: If one is testnet and the other is mainnet, assume they meant testnet
     if (fromChain.includes('sepolia') && !toChain.includes('sepolia')) {
         if (toChain === 'base')

package/dist/packages/core/src/web3/skills/bridgeToken.js

@@ -11,6 +11,10 @@ const tokens_1 = require("../utils/tokens");
 const defiRouter_1 = require("../aggregator/defiRouter");
 async function prepareBridgeToken(fromChain, toChain, tokenSymbol, amountStr, mode = "auto", providerName = "auto", slippagePercent) {
     try {
+        if (!fromChain || !toChain)
+            throw new Error("Source or destination chain not provided by AI.");
+        if (!amountStr)
+            throw new Error("Bridge amount not provided by AI.");
         const userAddress = await (0, vaultClient_1.getAddress)();
         // Auto-correct: If one is testnet and the other is mainnet, assume they meant testnet
         if (fromChain.includes('sepolia') && !toChain.includes('sepolia')) {

package/dist/packages/core/src/web3/skills/checkRegistryStatus.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkRegistryStatusToolDefinition = void 0;
 exports.checkRegistryStatus = checkRegistryStatus;
 const config_1 = require("../config");
 const config_2 = require("../config");
@@ -77,3 +78,15 @@ async function checkRegistryStatus() {
         return { isActive: true, reason: 'Registry check skipped due to network error.' };
     }
 }
+exports.checkRegistryStatusToolDefinition = {
+    type: "function",
+    function: {
+        name: "check_registry_status",
+        description: "Internal Security Middleware: Checks the On-Chain Kill Switch Registry before executing any transaction. If the agent is deactivated, the transaction will be strictly blocked for safety.",
+        parameters: {
+            type: "object",
+            properties: {},
+            required: []
+        }
+    }
+};

package/dist/packages/core/src/web3/skills/customTx.js

@@ -8,6 +8,8 @@ const transactionManager_1 = require("../../agent/transactionManager");
 const vaultClient_1 = require("../utils/vaultClient");
 async function prepareCustomTx(chainName, toAddress, data, valueWei = "0", description = "Custom transaction") {
     try {
+        if (!chainName || !toAddress || !data)
+            throw new Error("Missing required parameters for custom transaction.");
         const tx = transactionManager_1.txManager.createPendingTransaction('custom', chainName, {
             toAddress,
             data,

package/dist/packages/core/src/web3/skills/defiLending.js

@@ -32,6 +32,8 @@ const AAVE_V3_POOLS = {
 };
 async function prepareAaveSupply(chainName, tokenAddressOrSymbol, amountStr) {
     try {
+        if (!chainName || !tokenAddressOrSymbol || !amountStr)
+            throw new Error("Missing protocol/chain/token parameters for DeFi operation.");
         const publicClient = (0, config_1.getPublicClient)(chainName);
         const userAddress = await (0, config_1.getAddress)();
         const account = userAddress;

package/dist/packages/core/src/web3/skills/getPrice.js

@@ -14,27 +14,32 @@ exports.getPriceToolDefinition = {
                 coinId: {
                     type: "string",
                     description: "The CoinGecko ID of the coin (e.g., 'ethereum', 'bitcoin', 'solana')."
+                },
+                currency: {
+                    type: "string",
+                    description: "The fiat currency to convert to (e.g., 'usd', 'idr', 'eur', 'jpy'). Defaults to 'usd'."
                 }
             },
             required: ["coinId"]
         }
     }
 };
-async function getPrice(coinId) {
+async function getPrice(coinId, currency = 'usd') {
     try {
-        const url = `https://api.coingecko.com/api/v3/simple/price?ids=${coinId}&vs_currencies=usd&include_24hr_change=true`;
+        const cur = currency.toLowerCase();
+        const url = `https://api.coingecko.com/api/v3/simple/price?ids=${coinId}&vs_currencies=${cur}&include_24hr_change=true`;
         const data = await (0, httpClient_1.safeFetchJson)(url);
         if (!data[coinId]) {
             return `❌ Could not find price data for **${coinId.toUpperCase()}**. Please verify the coin name.`;
         }
-        const price = data[coinId].usd;
-        const change24h = data[coinId].usd_24h_change;
+        const price = data[coinId][cur];
+        const change24h = data[coinId][`${cur}_24h_change`];
         const isPositive = change24h >= 0;
         const arrow = isPositive ? '📈 🟩 +' : '📉 🟥 ';
-        const priceFormatted = new Intl.NumberFormat('en-US', { style: 'currency', currency: 'USD' }).format(price);
+        const priceFormatted = new Intl.NumberFormat(cur === 'idr' ? 'id-ID' : 'en-US', { style: 'currency', currency: cur.toUpperCase() }).format(price);
         const changeFormatted = change24h ? change24h.toFixed(2) : '0.00';
         return `💰 **Price Update for ${coinId.toUpperCase()}**\n\n` +
-            `- **Price (USD)**: \`${priceFormatted}\`\n` +
+            `- **Price (${cur.toUpperCase()})**: \`${priceFormatted}\`\n` +
             `- **24h Change**: ${arrow}${changeFormatted}%`;
     }
     catch (error) {

package/dist/packages/core/src/web3/skills/manageCustomTokens.js

@@ -1,18 +1,15 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manageCustomTokensDefinition = void 0;
 exports.executeManageCustomTokens = executeManageCustomTokens;
-const fs_1 = __importDefault(require("fs"));
-const paths_1 = require("../../config/paths");
 const config_1 = require("../config");
+const userWhitelistManager_1 = require("../../utils/userWhitelistManager");
+const vaultClient_1 = require("../utils/vaultClient");
 exports.manageCustomTokensDefinition = {
     type: 'function',
     function: {
         name: 'manage_custom_tokens',
-        description: 'Add or remove a custom ERC-20 token (like a memecoin or specific token) from the user\'s local portfolio watcher.',
+        description: 'Add or remove a custom ERC-20 token (like a memecoin or specific token) from the user\'s local portfolio watcher and swap whitelist.',
         parameters: {
             type: 'object',
             properties: {
@@ -32,50 +29,39 @@ exports.manageCustomTokensDefinition = {
                 },
                 contract_address: {
                     type: 'string',
-                    description: 'The smart contract address of the token. Only required for "add" action.'
+                    description: 'The smart contract address of the token. Required for "add" action or "remove" action.'
                 }
             },
-            required: ['action', 'chain_name', 'symbol']
+            required: ['action', 'chain_name', 'symbol', 'contract_address']
         }
     }
 };
 async function executeManageCustomTokens(args) {
     const { action, chain_name, symbol, contract_address } = args;
-    if (!config_1.SUPPORTED_CHAIN_NAMES.includes(chain_name)) {
-        return `Error: Unsupported chain ${chain_name}.`;
+    if (!chain_name) {
+        throw new Error("Chain name is required.");
     }
-    const customTokensPath = (0, paths_1.getPath)('custom_tokens.json');
-    let customTokens = {};
-    if (fs_1.default.existsSync(customTokensPath)) {
-        try {
-            const data = fs_1.default.readFileSync(customTokensPath, 'utf8');
-            customTokens = JSON.parse(data);
-        }
-        catch (e) {
-            console.error('Error parsing custom_tokens.json', e);
-        }
+    if (!symbol) {
+        throw new Error("Token symbol is required.");
     }
-    if (!customTokens[chain_name]) {
-        customTokens[chain_name] = {};
+    if (!config_1.SUPPORTED_CHAIN_NAMES.includes(chain_name)) {
+        return `Error: Unsupported chain ${chain_name}.`;
     }
     const upperSymbol = symbol.toUpperCase();
+    const userAddress = await (0, vaultClient_1.getAddress)();
     if (action === 'add') {
         if (!contract_address || !contract_address.startsWith('0x')) {
             return `Error: Invalid or missing contract_address.`;
         }
-        customTokens[chain_name][upperSymbol] = contract_address;
-        fs_1.default.writeFileSync(customTokensPath, JSON.stringify(customTokens, null, 2));
-        return `Successfully added custom token ${upperSymbol} to the ${chain_name} portfolio tracker.`;
+        await (0, userWhitelistManager_1.saveTokenToWhitelist)(userAddress, chain_name, contract_address, 'manual', upperSymbol);
+        return `Successfully added custom token ${upperSymbol} to the ${chain_name} portfolio tracker and swap whitelist.`;
     }
     else if (action === 'remove') {
-        if (customTokens[chain_name][upperSymbol]) {
-            delete customTokens[chain_name][upperSymbol];
-            fs_1.default.writeFileSync(customTokensPath, JSON.stringify(customTokens, null, 2));
-            return `Successfully removed custom token ${upperSymbol} from the ${chain_name} portfolio tracker.`;
-        }
-        else {
-            return `Warning: Token ${upperSymbol} was not found in the custom portfolio tracker for ${chain_name}.`;
+        if (!contract_address || !contract_address.startsWith('0x')) {
+            return `Error: Invalid or missing contract_address for removal.`;
         }
+        (0, userWhitelistManager_1.removeTokenFromWhitelist)(userAddress, chain_name, contract_address);
+        return `Successfully removed custom token ${upperSymbol} from the ${chain_name} whitelist.`;
     }
     return `Error: Invalid action.`;
 }

package/dist/packages/core/src/web3/skills/marketAnalysis.js

@@ -56,7 +56,7 @@ async function fetchDexData(query, isCa, chainName) {
     if (data && data.pairs && data.pairs.length > 0) {
         let pairs = data.pairs;
         if (chainName) {
-            pairs = pairs.filter((p) => p.chainId.toLowerCase() === chainName.toLowerCase());
+            pairs = pairs.filter((p) => p.chainId?.toLowerCase() === chainName?.toLowerCase());
             if (pairs.length === 0)
                 pairs = data.pairs;
         }
@@ -95,6 +95,8 @@ async function fetchCexMomentum(symbol, currentP) {
 }
 async function analyzeMarket(chainName, tokenAddressOrSymbol) {
     try {
+        if (!tokenAddressOrSymbol)
+            throw new Error("Token symbol is invalid.");
         const cleanInput = tokenAddressOrSymbol.replace('$', '').toLowerCase();
         const isAddress = cleanInput.startsWith('0x') && cleanInput.length === 42;
         let officialSymbol = cleanInput.toUpperCase();

package/dist/packages/core/src/web3/skills/mintNft.js

@@ -8,6 +8,8 @@ const config_1 = require("../config");
 const transactionManager_1 = require("../../agent/transactionManager");
 async function prepareMintNft(chainName, contractAddress, functionSignature, argsStr, valueEth = "0") {
     try {
+        if (!chainName || !contractAddress || !functionSignature)
+            throw new Error("Missing required parameters to mint NFT.");
         const publicClient = (0, config_1.getPublicClient)(chainName);
         const userAddress = await (0, config_1.getAddress)();
         const account = userAddress;

package/dist/packages/core/src/web3/skills/provideLiquidity.js

@@ -52,6 +52,8 @@ const POSITION_MANAGERS = {
 const parser_1 = require("../../config/parser");
 async function prepareProvideLiquidity(chainName, token0AddressOrSymbol, token1AddressOrSymbol, amount0Str, amount1Str, feeTier, tickLower, tickUpper, slippagePercent) {
     try {
+        if (!chainName || !token0AddressOrSymbol || !token1AddressOrSymbol || !amount0Str || !amount1Str)
+            throw new Error("Missing protocol/chain/token parameters for DeFi operation.");
         let actualSlippage = slippagePercent;
         if (actualSlippage === undefined || actualSlippage === null || actualSlippage === "auto") {
             try {

package/dist/packages/core/src/web3/skills/revokeApprovals.js

@@ -8,6 +8,8 @@ const transactionManager_1 = require("../../agent/transactionManager");
 const tokens_1 = require("../utils/tokens");
 async function prepareRevokeApproval(chainName, tokenAddressOrSymbol, spenderAddress) {
     try {
+        if (!chainName || !tokenAddressOrSymbol || !spenderAddress)
+            throw new Error("Missing required parameters for revoking approval.");
         const publicClient = (0, config_1.getPublicClient)(chainName);
         const userAddress = await (0, config_1.getAddress)();
         const account = userAddress;

package/dist/packages/core/src/web3/skills/swapToken.js

@@ -12,15 +12,17 @@ const userWhitelistManager_1 = require("../../utils/userWhitelistManager");
 const defiRouter_1 = require("../aggregator/defiRouter");
 async function prepareSwapToken(chainName, fromToken, toToken, amountStr, mode = "auto", providerName = "auto", slippagePercent) {
     try {
+        if (!chainName || !fromToken || !toToken || !amountStr)
+            throw new Error("Missing required parameters for swap (chain, tokens, or amount).");
         const userAddress = await (0, vaultClient_1.getAddress)();
         const fromTokenAddress = (0, tokens_1.resolveToken)(fromToken, chainName);
         const toTokenAddress = (0, tokens_1.resolveToken)(toToken, chainName);
         const isNativeIn = fromTokenAddress === "0x0000000000000000000000000000000000000000";
         // Auto-save to Degen Whitelist
         if (!isNativeIn)
-            (0, userWhitelistManager_1.saveTokenToWhitelist)(userAddress, chainName, fromTokenAddress, 'swap');
+            await (0, userWhitelistManager_1.saveTokenToWhitelist)(userAddress, chainName, fromTokenAddress, 'swap');
         if (toTokenAddress !== "0x0000000000000000000000000000000000000000") {
-            (0, userWhitelistManager_1.saveTokenToWhitelist)(userAddress, chainName, toTokenAddress, 'swap');
+            await (0, userWhitelistManager_1.saveTokenToWhitelist)(userAddress, chainName, toTokenAddress, 'swap');
         }
         // Default to 18 decimals for formatting input, though Aggregator handles this if we pass raw
         const amountWei = (0, viem_1.parseUnits)(amountStr, 18).toString();

package/dist/packages/core/src/web3/skills/transfer.js

@@ -10,6 +10,8 @@ const tokens_1 = require("../utils/tokens");
 const vaultClient_1 = require("../utils/vaultClient");
 async function prepareTransfer(chainName, toAddress, amountStr, token) {
     try {
+        if (!chainName || !toAddress || !amountStr)
+            throw new Error("Missing required parameters for transfer (chain, recipient, or amount).");
         const publicClient = (0, config_1.getPublicClient)(chainName);
         const userAddress = await (0, config_1.getAddress)();
         const account = userAddress;

package/dist/packages/core/src/web3/skills/yieldVault.js

@@ -25,6 +25,8 @@ const VAULT_ABI = [
 ];
 async function prepareVaultDeposit(chainName, protocol, vaultAddress, tokenAddressOrSymbol, amountStr) {
     try {
+        if (!chainName || !vaultAddress || !tokenAddressOrSymbol || !amountStr)
+            throw new Error("Missing protocol/chain/token parameters for DeFi operation.");
         const publicClient = (0, config_1.getPublicClient)(chainName);
         const userAddress = await (0, config_1.getAddress)();
         const account = userAddress;

package/dist/packages/core/src/web3/utils/tokens.js

@@ -5,6 +5,7 @@ exports.resolveToken = resolveToken;
 exports.getTokenMetadata = getTokenMetadata;
 exports.invalidateTokenCache = invalidateTokenCache;
 exports.preloadTokenMetadataAndAllowance = preloadTokenMetadataAndAllowance;
+const userWhitelistManager_1 = require("../../utils/userWhitelistManager");
 exports.ERC20_ABI = [
     {
         type: 'function',
@@ -76,7 +77,7 @@ exports.TOKEN_MAP = {
         ETH: "0x0000000000000000000000000000000000000000",
         WETH: "0x4200000000000000000000000000000000000006",
         USDC: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
-        USDT: "0xf55BEC9cbd4732f1F4143f647652e924540d9d64"
+        USDT: "0xfde4C96c8593536E31F229EA8f37b2ADa2699bb2"
     },
     optimism: {
         ETH: "0x0000000000000000000000000000000000000000",
@@ -126,6 +127,13 @@ function resolveToken(tokenSymbolOrAddress, chainName) {
     if (chainTokens && chainTokens[symbolUpper]) {
         return chainTokens[symbolUpper];
     }
+    const whitelistData = (0, userWhitelistManager_1.getUserWhitelist)();
+    for (const addr in whitelistData) {
+        const tokens = whitelistData[addr];
+        const match = tokens.find(t => t.chainName === chainName && t.symbol === symbolUpper);
+        if (match)
+            return match.address;
+    }
     throw new Error(`Token "${tokenSymbolOrAddress}" pada chain ${chainName} tidak ditemukan. Silakan gunakan alamat kontrak langsung (0x...).`);
 }
 // Bounded LRU Cache to prevent RAM bloat from fake tokens (OOM protection)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora",
-  "version": "26.6.19",
+  "version": "26.6.21",
   "description": "Your Personal Web3 Assistant",
   "keywords": [
     "web3",
@@ -42,6 +42,7 @@
     "stop": "node ./bin/nyxora.mjs stop",
     "restart": "node ./bin/nyxora.mjs restart",
     "dashboard": "node ./bin/nyxora.mjs dashboard",
+    "chat": "node ./bin/nyxora.mjs chat",
     "setup": "node ./bin/nyxora.mjs setup",
     "set-key": "node ./bin/nyxora.mjs set-key",
     "doctor": "node ./bin/nyxora.mjs doctor",

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nyxora-agent-core",
-  "version": "26.6.19",
+  "version": "26.6.21",
   "private": true,
   "main": "src/gateway/server.ts",
   "dependencies": {

package/packages/core/src/agent/reasoning.ts

@@ -370,6 +370,17 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
           continue;
         }
 
+        if (!isSkillActive(toolName)) {
+          console.warn(pc.red(`[Security] Blocked illegal execution of disabled skill: ${toolName}`));
+          result = `[System Error] Access denied: Skill '${toolName}' is currently disabled by the user.`;
+          logger.addEntry({
+            role: "tool",
+            tool_call_id: toolCall.id,
+            content: result
+          }, sessionId);
+          continue;
+        }
+
         try {
           switch (toolName) {
             case 'get_balance': {
@@ -382,7 +393,7 @@ export async function processUserInput(input: string, role: 'user' | 'system' =
               break;
             }
             case 'get_price': {
-              result = await getPrice(args.coinId);
+              result = await getPrice(args.coinId, args.currency);
               break;
             }
             case 'swap_token': {

package/packages/core/src/config/parser.ts

@@ -1,7 +1,70 @@
 import fs from 'fs';
 import yaml from 'yaml';
 import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
 import { getPath } from './paths';
+let cachedEncryptionKey: Buffer | null = null;
+function getEncryptionKeySync(): Buffer {
+    if (cachedEncryptionKey) return cachedEncryptionKey;
+    let masterKeyRaw = process.env.NYXORA_MASTER_KEY;
+    if (!masterKeyRaw) {
+        try {
+            const { execSync } = require('child_process');
+            const output = execSync(`node -e "require('@napi-rs/keyring').Entry.prototype.getPassword.call(new (require('@napi-rs/keyring').Entry)('nyxora', 'config_master')).then(console.log).catch(()=>console.log(''))"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] });
+            const pk = output?.trim();
+            if (pk) masterKeyRaw = pk;
+        } catch (e) {
+            // Ignore
+        }
+    }
+    if (!masterKeyRaw) {
+        try {
+            const masterKeyPath = path.join(os.homedir(), '.nyxora', 'auth', 'master.key');
+            if (fs.existsSync(masterKeyPath)) {
+                masterKeyRaw = fs.readFileSync(masterKeyPath, 'utf8').trim();
+            } else {
+                masterKeyRaw = crypto.randomBytes(32).toString('hex');
+                try { fs.writeFileSync(masterKeyPath, masterKeyRaw, { mode: 0o600 }); } catch (e) {}
+            }
+        } catch (e) {
+            masterKeyRaw = 'default_fallback_nyxora_key';
+        }
+    }
+    cachedEncryptionKey = crypto.createHash('sha256').update(masterKeyRaw).digest();
+    return cachedEncryptionKey;
+}
+
+export function encryptDataSync(text: string): string {
+    if (!text || text.startsWith('ENC:')) return text;
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', getEncryptionKeySync(), iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const authTag = cipher.getAuthTag().toString('hex');
+    return `ENC:${iv.toString('hex')}:${authTag}:${encrypted}`;
+}
+
+export function decryptDataSync(encryptedText: string): string {
+    if (!encryptedText) return encryptedText;
+    if (!encryptedText.startsWith('ENC:')) {
+        return encryptedText;
+    }
+    try {
+        const parts = encryptedText.split(':');
+        if (parts.length < 4) return encryptedText;
+        const iv = Buffer.from(parts[1], 'hex');
+        const authTag = Buffer.from(parts[2], 'hex');
+        const encrypted = parts.slice(3).join(':');
+        const decipher = crypto.createDecipheriv('aes-256-gcm', getEncryptionKeySync(), iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    } catch (e) {
+        return encryptedText; // return raw if decryption fails
+    }
+}
 
 export function loadRpcConfig(): Record<string, string | string[]> {
   const rpcPath = getPath('rpc_key.yaml');
@@ -26,7 +89,7 @@ export function saveRpcConfig(rpcUrls: Record<string, string | string[]>): void
 
 export async function loadApiKeys(): Promise<Record<string, string>> {
   const config = loadConfig();
-  return config.credentials || {};
+  return (config.credentials as Record<string, string>) || {};
 }
 
 export async function saveApiKeys(newKeys: Record<string, string>): Promise<void> {
@@ -96,8 +159,27 @@ export function loadConfig(): NyxoraConfig {
     const file = fs.readFileSync(configPath, 'utf8');
     const parsed = yaml.parse(file) as Partial<NyxoraConfig>;
     
-    // Auto-migration logic: move llm.credentials to root credentials
     let needsSave = false;
+    
+    // Decrypt credentials
+    if (parsed.credentials) {
+      for (const key in parsed.credentials) {
+        if (parsed.credentials[key]) {
+            if (parsed.credentials[key]!.startsWith('ENC:')) needsSave = true;
+            parsed.credentials[key] = decryptDataSync(parsed.credentials[key]!);
+        }
+      }
+    }
+    if (parsed.integrations?.telegram?.bot_token) {
+      if (parsed.integrations.telegram.bot_token.startsWith('ENC:')) needsSave = true;
+      parsed.integrations.telegram.bot_token = decryptDataSync(parsed.integrations.telegram.bot_token);
+    }
+    if (parsed.web3?.explorer_api_key) {
+      if (parsed.web3.explorer_api_key.startsWith('ENC:')) needsSave = true;
+      parsed.web3.explorer_api_key = decryptDataSync(parsed.web3.explorer_api_key);
+    }
+    
+    // Auto-migration logic: move llm.credentials to root credentials
     if (parsed.llm && (parsed.llm as any).credentials) {
       if (!parsed.credentials) {
         parsed.credentials = {};
@@ -121,7 +203,7 @@ export function loadConfig(): NyxoraConfig {
     // Auto-migration logic: move permissions to policy.yaml
     const policyPath = getPath('policy.yaml');
     if (!fs.existsSync(policyPath)) {
-      const defaultPolicy = `max_usd_per_tx: ${(parsed as any).permissions?.web3?.max_usd_per_tx || 999999999}\nwhitelist_only: false\nrequire_approval: true\n`;
+      const defaultPolicy = `auto_approve_limit_usd: 0\ncustom_llm_rules: []\n`;
       fs.writeFileSync(policyPath, defaultPolicy, 'utf8');
       console.log('[Config] Created default policy.yaml.');
     }
@@ -132,9 +214,8 @@ export function loadConfig(): NyxoraConfig {
 
     if (needsSave) {
       try {
-        const yamlStr = yaml.stringify(parsed);
-        fs.writeFileSync(configPath, yamlStr, 'utf8');
-        console.log('[Config] Auto-migrated llm.credentials to root credentials.');
+        saveConfig(parsed as NyxoraConfig);
+        console.log('[Config] Auto-migrated config file safely.');
       } catch (e) {
         console.error('[Config] Failed to auto-migrate config file', e);
       }
@@ -142,7 +223,8 @@ export function loadConfig(): NyxoraConfig {
     
 
     
-    return {
+    
+    const validatedConfig: NyxoraConfig = {
       agent: parsed.agent || { name: 'Nyxora-Default', description: 'Your Personal Web3 Assistant.', default_chain: 'base', default_router: 'auto', default_slippage: 'auto' },
       llm: parsed.llm || { 
         provider: 'openai', 
@@ -159,11 +241,16 @@ export function loadConfig(): NyxoraConfig {
       web3: { ...parsed.web3, rpc_urls: rpcUrls },
       integrations: parsed.integrations || {
         telegram: { enabled: false }
-      }
-    } as NyxoraConfig;
+      },
+      skills: parsed.skills
+    };
+
+    return validatedConfig;
   } catch (error: any) {
     if (error.code === 'ENOENT') {
       console.log('[Config] No config.yaml found. Using default configuration.');
+    } else if (error.name === 'YAMLError' || error.message?.includes('YAML')) {
+      console.warn('[Parser] YAML Parse Error:', error.message);
     } else {
       console.error('[Config] Failed to load config.yaml. Using default configuration.', error);
     }
@@ -202,9 +289,32 @@ export function saveConfig(newConfig: NyxoraConfig): void {
     if (configToSave.web3 && configToSave.web3.rpc_urls) {
       delete configToSave.web3.rpc_urls;
     }
+
+    // Keys are no longer encrypted before saving. They are stored in plain text.
+
     const yamlStr = yaml.stringify(configToSave);
     fs.writeFileSync(configPath, yamlStr, 'utf8');
   } catch (error) {
     console.error('Failed to save config.yaml', error);
   }
 }
+
+export interface PolicyConfig {
+  max_usd_per_tx?: number;
+  whitelist_only?: boolean;
+  require_approval?: boolean;
+  auto_approve_limit_usd?: number;
+  custom_llm_rules?: string[];
+}
+
+export function loadPolicyConfig(): PolicyConfig {
+  const policyPath = getPath('policy.yaml');
+  if (fs.existsSync(policyPath)) {
+    try {
+      return yaml.parse(fs.readFileSync(policyPath, 'utf8')) || {};
+    } catch (e) {
+      console.error('[Config] Failed to parse policy.yaml', e);
+    }
+  }
+  return {};
+}