nyxora 26.6.20 → 26.6.21

package/packages/core/src/gateway/server.ts

@@ -42,7 +42,7 @@ import { checkPortfolioToolDefinition } from '../web3/skills/checkPortfolio';
 import { marketAnalysisToolDefinition } from '../web3/skills/marketAnalysis';
 import { executeApprove, executeAaveSupply, executeVaultDeposit, executeUniv3Mint } from '../web3/skills/executeDefi';
 import { executeRevokeApproval } from '../web3/skills/revokeApprovals';
-import { isSkillActive, toggleSkill } from '../utils/skillManager';
+import { isSkillActive, toggleSkill, syncAllSkillsToConfig } from '../utils/skillManager';
 import { executeBridge, bridgeTokenToolDefinition } from '../web3/skills/bridgeToken';
 import { executeMintNft, mintNftToolDefinition } from '../web3/skills/mintNft';
 import { executeCustomTx, customTxToolDefinition } from '../web3/skills/customTx';
@@ -51,8 +51,11 @@ import { revokeApprovalToolDefinition } from '../web3/skills/revokeApprovals';
 import { vaultDepositToolDefinition } from '../web3/skills/yieldVault';
 import { provideLiquidityToolDefinition } from '../web3/skills/provideLiquidity';
 import { getTxHistoryToolDefinition } from '../web3/skills/getTxHistory';
-import { checkRegistryStatus } from '../web3/skills/checkRegistryStatus';
+import { checkRegistryStatus, checkRegistryStatusToolDefinition } from '../web3/skills/checkRegistryStatus';
 import { createLimitOrderToolDefinition } from '../web3/skills/createLimitOrder';
+import { getUserWhitelist, saveTokenToWhitelist, removeTokenFromWhitelist } from '../utils/userWhitelistManager';
+import { getTokenMetadata } from '../web3/utils/tokens';
+import { ChainName } from '../web3/config';
 
 // System Skills
 import { browseWebsiteToolDefinition } from '../system/skills/browseWeb';
@@ -84,6 +87,9 @@ import { ReflectionEngine } from '../memory/reflection';
 // Initialize Google Auth
 initGoogleAuth();
 
+// Synchronize all active skills to config.yaml on startup
+syncAllSkillsToConfig();
+
 import util from 'util';
 
 // Intercept console.log and console.error
@@ -331,8 +337,63 @@ app.post('/api/defi-keys', (req, res) => {
   }
 });
 
+const allSkills = [
+  getBalanceToolDefinition,
+  transferToolDefinition,
+  getPriceToolDefinition,
+  swapTokenToolDefinition,
+  bridgeTokenToolDefinition,
+  mintNftToolDefinition,
+  customTxToolDefinition,
+  checkAddressToolDefinition,
+  getMyAddressToolDefinition,
+  checkSecurityToolDefinition,
+  checkPortfolioToolDefinition,
+  marketAnalysisToolDefinition,
+  manageCustomTokensDefinition,
+  aaveSupplyToolDefinition,
+  revokeApprovalToolDefinition,
+  vaultDepositToolDefinition,
+  provideLiquidityToolDefinition,
+  getTxHistoryToolDefinition,
+  createLimitOrderToolDefinition,
+  checkRegistryStatusToolDefinition
+];
+
+const systemSkills = [
+  runTerminalCommandToolDefinition,
+  readLocalFileToolDefinition,
+  writeLocalFileToolDefinition,
+  generateExcelToolDefinition,
+  browseWebsiteToolDefinition,
+  updateSecurityPolicyToolDefinition,
+
+  analyzeDocumentToolDefinition,
+  searchWebToolDefinition,
+  readGmailInboxToolDefinition,
+  listCalendarEventsToolDefinition,
+  appendRowToSheetsToolDefinition,
+  readGoogleDocsToolDefinition,
+  readGoogleFormResponsesToolDefinition,
+  editLocalFileToolDefinition,
+  gitManagerToolDefinition,
+  xManagerToolDefinition,
+  notionWorkspaceToolDefinition,
+  audioTranscribeToolDefinition,
+  summarizeTextToolDefinition
+];
+
 app.get('/api/stats', (req, res) => {
-  res.json(Tracker.getStats());
+  const stats = Tracker.getStats();
+  const dbPath = getPath('memory.db');
+  
+  const activeWeb3 = allSkills.filter(s => isSkillActive(s.function.name)).length;
+  const activeSystem = systemSkills.filter(s => isSkillActive(s.function.name)).length;
+  
+  const totalSkills = allSkills.length + systemSkills.length;
+  const activeSkills = activeWeb3 + activeSystem;
+
+  res.json({ ...stats, memoryPath: dbPath, totalSkills, activeSkills });
 });
 
 app.get('/api/logs', (req, res) => {
@@ -340,28 +401,6 @@ app.get('/api/logs', (req, res) => {
 });
 
 app.get('/api/skills', (req, res) => {
-  const allSkills = [
-    getBalanceToolDefinition,
-    transferToolDefinition,
-    getPriceToolDefinition,
-    swapTokenToolDefinition,
-    bridgeTokenToolDefinition,
-    mintNftToolDefinition,
-    customTxToolDefinition,
-    checkAddressToolDefinition,
-    getMyAddressToolDefinition,
-    checkSecurityToolDefinition,
-    checkPortfolioToolDefinition,
-    marketAnalysisToolDefinition,
-    manageCustomTokensDefinition,
-    aaveSupplyToolDefinition,
-    revokeApprovalToolDefinition,
-    vaultDepositToolDefinition,
-    provideLiquidityToolDefinition,
-    getTxHistoryToolDefinition,
-    createLimitOrderToolDefinition
-  ];
-  
   const skillsWithStatus = allSkills.map(skill => ({
     ...skill,
     isActive: isSkillActive(skill.function.name)
@@ -371,29 +410,6 @@ app.get('/api/skills', (req, res) => {
 });
 
 app.get('/api/skills/system', (req, res) => {
-  const systemSkills = [
-    runTerminalCommandToolDefinition,
-    readLocalFileToolDefinition,
-    writeLocalFileToolDefinition,
-    generateExcelToolDefinition,
-    browseWebsiteToolDefinition,
-    updateSecurityPolicyToolDefinition,
-
-    analyzeDocumentToolDefinition,
-    searchWebToolDefinition,
-    readGmailInboxToolDefinition,
-    listCalendarEventsToolDefinition,
-    appendRowToSheetsToolDefinition,
-    readGoogleDocsToolDefinition,
-    readGoogleFormResponsesToolDefinition,
-    editLocalFileToolDefinition,
-    gitManagerToolDefinition,
-    xManagerToolDefinition,
-    notionWorkspaceToolDefinition,
-    audioTranscribeToolDefinition,
-    summarizeTextToolDefinition
-  ];
-  
   const skillsWithStatus = systemSkills.map(skill => ({
     ...skill,
     isActive: isSkillActive(skill.function.name)
@@ -411,6 +427,44 @@ app.post('/api/skills/toggle', (req, res) => {
   res.json({ success: true, skillName, active });
 });
 
+// Portfolio Whitelist Routes
+app.get('/api/portfolio/whitelist', async (req, res) => {
+  const whitelist = getUserWhitelist();
+  res.json(whitelist);
+});
+
+app.post('/api/portfolio/whitelist', async (req, res) => {
+  const { walletAddress, chainName, tokenAddress, symbol, decimals } = req.body;
+  if (!walletAddress || !chainName || !tokenAddress) {
+    return res.status(400).json({ error: 'Missing required fields' });
+  }
+  await saveTokenToWhitelist(walletAddress, chainName, tokenAddress, 'manual', symbol, decimals);
+  res.json({ success: true });
+});
+
+app.delete('/api/portfolio/whitelist', (req, res) => {
+  const { walletAddress, chainName, tokenAddress } = req.body;
+  if (!walletAddress || !chainName || !tokenAddress) {
+    return res.status(400).json({ error: 'Missing required fields' });
+  }
+  removeTokenFromWhitelist(walletAddress, chainName, tokenAddress);
+  res.json({ success: true });
+});
+
+app.get('/api/portfolio/token-metadata', async (req, res) => {
+  const { chain, address } = req.query;
+  if (!chain || !address || typeof address !== 'string') {
+    return res.status(400).json({ error: 'Missing chain or address' });
+  }
+  try {
+    const client = getPublicClient(chain as ChainName);
+    const metadata = await getTokenMetadata(client, address as `0x${string}`);
+    res.json(metadata);
+  } catch (err: any) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 // Google Workspace Auth Routes
 app.get('/api/auth/google/url', (req, res) => {
   const url = getAuthUrl();
@@ -642,13 +696,8 @@ app.get('/api/wallet', async (req, res) => {
 app.get('/api/portfolio', async (req, res) => {
   try {
     const userAddress = await getAddress();
-    const customTokensPath = path.join(getPath('custom_tokens.json'));
-    let customTokens: Record<string, any> = {};
-    if (fs.existsSync(customTokensPath)) {
-      try {
-        customTokens = JSON.parse(fs.readFileSync(customTokensPath, 'utf8'));
-      } catch (e) {}
-    }
+    const whitelist = getUserWhitelist();
+    const userCustomTokens = whitelist[userAddress.toLowerCase()] || [];
 
     const portfolio: Record<string, any[]> = {};
     
@@ -669,11 +718,15 @@ app.get('/api/portfolio', async (req, res) => {
           });
         }
 
-        // 2. Combine TOKEN_MAP and customTokens for this chain
+        // 2. Combine TOKEN_MAP and YAML whitelist for this chain
         const tokensToQuery = { ...((TOKEN_MAP as any)[chainName] || {}) };
-        if (customTokens[chainName]) {
-          Object.assign(tokensToQuery, customTokens[chainName]);
-        }
+        
+        // Inject whitelisted tokens
+        userCustomTokens.forEach(t => {
+          if (t.chainName === chainName && t.symbol && t.address) {
+            tokensToQuery[t.symbol.toUpperCase()] = t.address;
+          }
+        });
 
         // 3. Query all ERC-20 balances in parallel
         await Promise.all(Object.entries(tokensToQuery).map(async ([symbol, address]) => {
@@ -692,7 +745,9 @@ app.get('/api/portfolio', async (req, res) => {
             } as any);
 
             const [bal, decimals] = await Promise.all([balPromise, decPromise]) as [bigint, number];
-            if (bal > 0n) {
+            const isCustom = userCustomTokens.some(t => t.chainName === chainName && t.address === address);
+            
+            if (bal > 0n || isCustom) {
               portfolio[chainName].push({
                 symbol,
                 address,

package/packages/core/src/gateway/setup.ts

@@ -7,24 +7,7 @@ import { getAppDir, getPath } from '../config/paths';
 import { loadConfig, saveConfig, saveApiKeys, saveRpcConfig } from '../config/parser';
 import crypto from 'crypto';
 
-function encryptKey(privateKey: string, password: string) {
-    const salt = crypto.randomBytes(16);
-    const key = crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
-    const iv = crypto.randomBytes(12);
-    
-    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
-    let encrypted = cipher.update(privateKey, 'utf8', 'hex');
-    encrypted += cipher.final('hex');
-    
-    const authTag = cipher.getAuthTag().toString('hex');
-    
-    return {
-        salt: salt.toString('hex'),
-        iv: iv.toString('hex'),
-        authTag,
-        encryptedData: encrypted
-    };
-}
+
 import { generatePrivateKey, privateKeyToAccount, generateMnemonic, mnemonicToAccount, english } from 'viem/accounts';
 
 export async function runSetupWizard() {
@@ -286,9 +269,9 @@ Provider: ${config.llm.provider}`;
       privateKey = '0x' + Buffer.from(account.getHdKey().privateKey!).toString('hex');
       log.success('New Wallet Generated!');
       log.info(`Address: ${account.address}`);
-      log.info(`Private Key: ${privateKey}`);
+      log.info(`Private Key: [REDACTED - Saved securely to vault]`);
       log.info(`Seed Phrase (Mnemonic): ${seedPhrase}`);
-      log.warn('IMPORTANT: Write down these 12 words (or the Private Key) NOW! This is your ONLY backup. The credentials have been securely injected into your local OS vault.');
+      log.warn('IMPORTANT: Write down these 12 words NOW! This is your ONLY backup. The credentials have been securely injected into your local OS vault.');
     }
   }
 
@@ -356,19 +339,32 @@ Provider: ${config.llm.provider}`;
     })) as string;
     if (isCancel(telegramToken)) return process.exit(0);
 
-    if (telegramToken && !authorizedChatId) {
+    if (telegramToken && telegramToken.trim() !== '') {
+      authorizedChatId = undefined;
+    }
+
+    const activeToken = telegramToken || config.integrations?.telegram?.bot_token;
+
+    if (activeToken && !authorizedChatId) {
       const s = spinner();
       const pin = Math.floor(100000 + Math.random() * 900000).toString();
       
       note(pc.cyan(`1. Open Telegram and search for your Bot.\n2. Send this exact message to your bot:\n\n   /auth ${pin}\n\nWaiting for your message...`), 'Telegram Pairing Required');
       s.start(`Waiting for /auth ${pin} on Telegram...`);
 
+      let bot: any = null;
       try {
         const { Telegraf } = require('telegraf');
-        const bot = new Telegraf(telegramToken);
+        bot = new Telegraf(activeToken);
         let paired = false;
 
+        let failedAttempts: Record<string, number> = {};
         bot.command('auth', (ctx: any) => {
+          const chatId = ctx.chat.id.toString();
+          if (failedAttempts[chatId] >= 5) {
+             return ctx.reply('❌ Too many failed attempts. You are locked out.');
+          }
+
           const text = ctx.message.text.split(' ');
           if (text[1] === pin) {
             authorizedChatId = ctx.chat.id;
@@ -376,6 +372,7 @@ Provider: ${config.llm.provider}`;
             ctx.reply('✅ Bot successfully paired with Nyxora!');
             bot.stop();
           } else {
+            failedAttempts[chatId] = (failedAttempts[chatId] || 0) + 1;
             ctx.reply('❌ Invalid PIN.');
           }
         });
@@ -383,12 +380,25 @@ Provider: ${config.llm.provider}`;
         bot.launch();
 
         // Wait until paired
-        while (!paired) {
+        let attempts = 0;
+        while (!paired && attempts < 120) {
           await new Promise(r => setTimeout(r, 1000));
+          attempts++;
+        }
+        if (!paired) {
+            s.stop('Timeout waiting for Telegram pairing. Setup will continue, but Telegram integration is disabled.');
+            try { bot.stop(); } catch(e) {}
+            authorizedChatId = undefined;
+            telegramToken = '';
+        } else {
+            s.stop(`Bot successfully paired with Chat ID: ${authorizedChatId}`);
         }
-        s.stop(`Bot successfully paired with Chat ID: ${authorizedChatId}`);
       } catch (err: any) {
         s.stop(`Failed to start bot listener: ${err.message}. You can pair it later.`);
+        // Try to stop the bot if it was initialized before the error (L17)
+        try { 
+          if (bot) bot.stop(); 
+        } catch(e) {}
       }
     }
   }
@@ -403,11 +413,11 @@ Provider: ${config.llm.provider}`;
   config.agent.default_chain = defaultChain as string;
   
   if (!config.skills) config.skills = { web3: [], os: [] } as any;
-  config.skills.web3 = activeWeb3Skills;
-  config.skills.os = activeOsSkills;
+  config.skills!.web3 = activeWeb3Skills;
+  config.skills!.os = activeOsSkills;
 
   if (!config.channels) config.channels = { active: [] } as any;
-  config.channels.active = activeChannels;
+  config.channels!.active = activeChannels;
 
   const newApiKeys: Record<string, string> = {};
   if (apiKey) {
@@ -442,6 +452,8 @@ Provider: ${config.llm.provider}`;
   
   if (authorizedChatId) {
     config.integrations.telegram.authorized_chat_id = authorizedChatId;
+  } else if (config.integrations.telegram) {
+    delete config.integrations.telegram.authorized_chat_id;
   }
 
   saveConfig(config);

package/packages/core/src/utils/formatter.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest';
+import { formatTransactionSuccess, formatTransactionError } from './formatter';
+import { PendingTransaction } from '../agent/transactionManager';
+
+describe('Formatter Utilities', () => {
+  it('should format transaction success correctly for swap', () => {
+    const tx: PendingTransaction = {
+      id: 'test-1',
+      type: 'swap',
+      chainName: 'ethereum',
+      status: 'pending',
+      nonce: "0",
+      details: {
+        fromToken: 'eth',
+        toToken: 'usdc',
+        amountStr: '1'
+      },
+      createdAt: Date.now()
+    };
+    const rawResult = '{"txHash":"0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef"}';
+    const output = formatTransactionSuccess(tx, rawResult);
+    expect(output).toContain('Network:** Ethereum');
+    expect(output).toContain('Action:** Swapped 1 ETH to USDC');
+    expect(output).toContain('Tx Hash:** `0x1234...cdef`');
+  });
+
+  it('should format transaction error correctly', () => {
+    const tx: PendingTransaction = {
+      id: 'test-2',
+      type: 'bridge',
+      chainName: 'base_sepolia',
+      status: 'failed',
+      nonce: "0",
+      details: {},
+      createdAt: Date.now()
+    };
+    const output = formatTransactionError(tx, 'Insufficient funds');
+    expect(output).toContain('Transaction Failed (Base Sepolia)');
+    expect(output).toContain('Error: Insufficient funds');
+  });
+});

package/packages/core/src/utils/skillManager.ts

@@ -1,8 +1,54 @@
 import fs from 'fs';
 import { getPath } from '../config/paths';
+import { loadConfig, saveConfig } from '../config/parser';
 
 let disabledSkillsCache: string[] | null = null;
 
+const reverseSkillMapping: Record<string, { category: 'os' | 'web3', name: string }> = {
+  // OS Skills
+  'read_local_file': { category: 'os', name: 'readFile' },
+  'write_local_file': { category: 'os', name: 'writeFile' },
+  'edit_local_file': { category: 'os', name: 'editFile' },
+  'generate_excel_file': { category: 'os', name: 'generateExcel' },
+  'analyze_document': { category: 'os', name: 'analyzeDocument' },
+  'run_terminal_command': { category: 'os', name: 'executeShell' },
+  'browse_website': { category: 'os', name: 'browseWeb' },
+  'search_web': { category: 'os', name: 'searchWeb' },
+  'read_gmail_inbox': { category: 'os', name: 'readGmail' },
+  'list_calendar_events': { category: 'os', name: 'listCalendar' },
+  'append_row_to_sheets': { category: 'os', name: 'appendSheets' },
+  'read_google_docs': { category: 'os', name: 'readDocs' },
+  'read_google_form_responses': { category: 'os', name: 'readForms' },
+  'execute_git_command': { category: 'os', name: 'gitManager' },
+  'manage_twitter': { category: 'os', name: 'xManager' },
+  'manage_notion': { category: 'os', name: 'notionWorkspace' },
+  'transcribe_audio': { category: 'os', name: 'audioTranscribe' },
+  'summarize_text': { category: 'os', name: 'summarizeText' },
+  'update_security_policy': { category: 'os', name: 'updateSecurityPolicy' },
+  
+  // Web3 Skills
+  'transfer_token': { category: 'web3', name: 'transfer' },
+  'transfer_native': { category: 'web3', name: 'transfer' },
+  'swap_token': { category: 'web3', name: 'swap' },
+  'bridge_token': { category: 'web3', name: 'bridge' },
+  'mint_nft': { category: 'web3', name: 'mintNft' },
+  'custom_tx': { category: 'web3', name: 'customTx' },
+  'check_address': { category: 'web3', name: 'checkAddress' },
+  'get_my_address': { category: 'web3', name: 'getMyAddress' },
+  'check_token_security': { category: 'web3', name: 'checkSecurity' },
+  'check_portfolio': { category: 'web3', name: 'checkPortfolio' },
+  'analyze_market': { category: 'web3', name: 'marketAnalysis' },
+  'manage_custom_tokens': { category: 'web3', name: 'manageCustomTokens' },
+  'get_price': { category: 'web3', name: 'getPrice' },
+  'supply_aave': { category: 'web3', name: 'aaveSupply' },
+  'revoke_approval': { category: 'web3', name: 'revokeApproval' },
+  'deposit_yield_vault': { category: 'web3', name: 'vaultDeposit' },
+  'provide_liquidity_v3': { category: 'web3', name: 'provideLiquidity' },
+  'get_tx_history': { category: 'web3', name: 'getTxHistory' },
+  'check_registry_status': { category: 'web3', name: 'checkRegistryStatus' },
+  'create_limit_order': { category: 'web3', name: 'createLimitOrder' }
+};
+
 function getDisabledSkillsFile(): string {
   return getPath('disabled_skills.json');
 }
@@ -36,9 +82,61 @@ export function toggleSkill(skillName: string, active: boolean): void {
   }
   disabledSkillsCache = Array.from(current);
   fs.writeFileSync(getDisabledSkillsFile(), JSON.stringify(disabledSkillsCache, null, 2));
+
+  // Sync to config.yaml
+  const mapping = reverseSkillMapping[skillName];
+  if (mapping) {
+    const config = loadConfig();
+    if (!config.skills) config.skills = { web3: [], os: [] } as any;
+    
+    const categoryArray = mapping.category === 'web3' ? config.skills!.web3 : config.skills!.os;
+    
+    if (active && !categoryArray.includes(mapping.name)) {
+      categoryArray.push(mapping.name);
+    } else if (!active) {
+      const index = categoryArray.indexOf(mapping.name);
+      if (index !== -1) {
+        categoryArray.splice(index, 1);
+      }
+    }
+    
+    saveConfig(config);
+  }
 }
 
 export function isSkillActive(skillName: string): boolean {
   const disabled = getDisabledSkills();
   return !disabled.includes(skillName);
 }
+
+export function syncAllSkillsToConfig(): void {
+  const config = loadConfig();
+  if (!config.skills) config.skills = { web3: [], os: [] } as any;
+
+  const activeWeb3 = new Set<string>();
+  const activeOs = new Set<string>();
+
+  for (const [skillName, mapping] of Object.entries(reverseSkillMapping)) {
+    if (isSkillActive(skillName)) {
+      if (mapping.category === 'web3') {
+        activeWeb3.add(mapping.name);
+      } else {
+        activeOs.add(mapping.name);
+      }
+    }
+  }
+
+  // Check if arrays are different to avoid unnecessary saves
+  const currentWeb3 = config.skills!.web3 || [];
+  const currentOs = config.skills!.os || [];
+
+  const web3Changed = currentWeb3.length !== activeWeb3.size || !currentWeb3.every(s => activeWeb3.has(s));
+  const osChanged = currentOs.length !== activeOs.size || !currentOs.every(s => activeOs.has(s));
+
+  if (web3Changed || osChanged) {
+    config.skills!.web3 = Array.from(activeWeb3);
+    config.skills!.os = Array.from(activeOs);
+    saveConfig(config);
+    console.log('[SkillManager] Automatically synchronized active skills to config.yaml');
+  }
+}

package/packages/core/src/utils/userWhitelistManager.ts

@@ -1,12 +1,17 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
+import yaml from 'yaml';
+import { getPublicClient, ChainName } from '../web3/config';
+import { getTokenMetadata } from '../web3/utils/tokens';
 
-const WHITELIST_FILE_PATH = path.join(os.homedir(), '.nyxora', 'user_whitelist.json');
+const WHITELIST_FILE_PATH = path.join(os.homedir(), '.nyxora', 'user_whitelist.yaml');
 
 export interface WhitelistedToken {
   chainName: string;
   address: string;
+  symbol?: string;
+  decimals?: number;
   source: 'manual' | 'explorer' | 'swap';
   lastSeen: number;
 }
@@ -18,70 +23,74 @@ export interface UserWhitelist {
 export function getUserWhitelist(): UserWhitelist {
   try {
     if (!fs.existsSync(WHITELIST_FILE_PATH)) {
+      // Try migrating from JSON if YAML doesn't exist yet
+      const oldJsonPath = path.join(os.homedir(), '.nyxora', 'user_whitelist.json');
+      if (fs.existsSync(oldJsonPath)) {
+        const data = fs.readFileSync(oldJsonPath, 'utf-8');
+        const parsed = JSON.parse(data);
+        fs.writeFileSync(WHITELIST_FILE_PATH, yaml.stringify(parsed), 'utf-8');
+        // Rename old file so it doesn't get used again
+        fs.renameSync(oldJsonPath, `${oldJsonPath}.bak`);
+        return parsed;
+      }
       return {};
     }
     const data = fs.readFileSync(WHITELIST_FILE_PATH, 'utf-8');
-    const parsed = JSON.parse(data);
-
-    // Auto-migrate legacy format
-    let migrated = false;
-    for (const addr in parsed) {
-      if (parsed[addr] && !Array.isArray(parsed[addr])) {
-        const newArray: WhitelistedToken[] = [];
-        for (const chain in parsed[addr]) {
-          const tokens = parsed[addr][chain];
-          if (Array.isArray(tokens)) {
-            for (const t of tokens) {
-              newArray.push({
-                chainName: chain,
-                address: typeof t === 'string' ? t.toLowerCase() : (t.address || '').toLowerCase(),
-                source: 'manual',
-                lastSeen: Date.now()
-              });
-            }
-          }
-        }
-        parsed[addr] = newArray;
-        migrated = true;
-      }
-    }
-
-    if (migrated) {
-      fs.writeFileSync(WHITELIST_FILE_PATH, JSON.stringify(parsed, null, 2), 'utf-8');
-    }
-
-    return parsed;
+    return yaml.parse(data) || {};
   } catch (err) {
-    console.error('[Whitelist] Error reading user_whitelist.json', err);
+    console.error('[Whitelist] Error reading user_whitelist.yaml', err);
     return {};
   }
 }
 
-export function saveTokenToWhitelist(walletAddress: string, chainName: string, tokenAddress: string, source: 'manual' | 'explorer' | 'swap' = 'manual') {
+export async function saveTokenToWhitelist(
+  walletAddress: string, 
+  chainName: ChainName, 
+  tokenAddress: string, 
+  source: 'manual' | 'explorer' | 'swap' = 'manual',
+  symbol?: string,
+  decimals?: number
+) {
   try {
     const whitelist = getUserWhitelist();
     const addr = walletAddress.toLowerCase();
     const tokenAddr = tokenAddress.toLowerCase();
 
+    // Auto-fetch metadata if not provided
+    if (!symbol || decimals === undefined) {
+      try {
+        const client = getPublicClient(chainName);
+        const metadata = await getTokenMetadata(client, tokenAddr as `0x${string}`);
+        symbol = metadata.symbol;
+        decimals = metadata.decimals;
+      } catch (err) {
+        console.warn(`[Whitelist] Could not fetch metadata for ${tokenAddr} on ${chainName}`, err);
+      }
+    }
+
     if (!whitelist[addr]) whitelist[addr] = [];
 
     const existingIndex = whitelist[addr].findIndex(t => t.chainName === chainName && t.address === tokenAddr);
     
     if (existingIndex >= 0) {
       whitelist[addr][existingIndex].lastSeen = Date.now();
+      if (symbol) whitelist[addr][existingIndex].symbol = symbol;
+      if (decimals !== undefined) whitelist[addr][existingIndex].decimals = decimals;
     } else {
       whitelist[addr].push({
         chainName,
         address: tokenAddr,
+        symbol,
+        decimals,
         source,
         lastSeen: Date.now()
       });
-      console.log(`[Whitelist] Added ${tokenAddr} to ${chainName} for ${addr} via ${source}`);
+      console.log(`[Whitelist] Added ${symbol || tokenAddr} to ${chainName} for ${addr} via ${source}`);
     }
 
-    fs.writeFileSync(WHITELIST_FILE_PATH, JSON.stringify(whitelist, null, 2), 'utf-8');
+    fs.writeFileSync(WHITELIST_FILE_PATH, yaml.stringify(whitelist), 'utf-8');
   } catch (err) {
-    console.error('[Whitelist] Error saving token to user_whitelist.json', err);
+    console.error('[Whitelist] Error saving token to user_whitelist.yaml', err);
   }
 }
 
@@ -97,11 +106,11 @@ export function removeTokenFromWhitelist(walletAddress: string, chainName: strin
     whitelist[addr] = whitelist[addr].filter(t => !(t.chainName === chainName && t.address === tokenAddr));
     
     if (whitelist[addr].length !== initialLength) {
-      fs.writeFileSync(WHITELIST_FILE_PATH, JSON.stringify(whitelist, null, 2), 'utf-8');
-      console.log(`[Whitelist] Removed garbage token ${tokenAddr} on ${chainName} for ${addr}`);
+      fs.writeFileSync(WHITELIST_FILE_PATH, yaml.stringify(whitelist), 'utf-8');
+      console.log(`[Whitelist] Removed token ${tokenAddr} on ${chainName} for ${addr}`);
     }
   } catch (err) {
-    console.error('[Whitelist] Error removing token from user_whitelist.json', err);
+    console.error('[Whitelist] Error removing token from user_whitelist.yaml', err);
   }
 }