nyxora 26.6.20 → 26.6.22-1

package/README.md

@@ -24,6 +24,9 @@ It operates under a **Zero-Trust, Defense-in-Depth Cryptographically Bound Human
 *   **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
 *   **DeFi Configuration BYOK & UI Masking**: All aggregator and provider API keys are strictly isolated via a Bring Your Own Keys (BYOK) architecture into a heavily guarded `~/.nyxora/defi_keys.yaml` file. The local web Dashboard masks these injected secrets using `***********` and `IS_SET` censorship, completely neutralizing malicious browser extensions from exfiltrating your keys.
 *   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
+*   **Native Asset Parameter Tampering Protection**: The internal cryptographic HMAC signature rigorously binds `toAddress`, `txData`, and `valueWei`, rendering the system mathematically immune to Native Token (ETH/BNB) destination or amount hijacking via Indirect Prompt Injections.
+*   **Human-in-the-Loop Memory Approval**: AI-extracted permanent behavioral rules are strictly quarantined in a `pending` state until explicitly authorized by the user via the Dashboard, neutralizing Persistent Memory Poisoning vectors.
+*   **Stateless Policy Engine & DoS Resilience**: The Policy Engine operates as a 100% stateless cryptographic HMAC gatekeeper, hardened with resilient `try...catch` IPC interceptors to withstand Signer-level Denial of Service (Crash) attacks.
 *   **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
 
 *   **Graceful SQLite WAL Shutdown**: Integrated `SIGTERM`/`SIGINT` interceptors ensure that when the daemon stops, active requests are safely terminated and SQLite Write-Ahead Logs (WAL) are securely flushed, preventing database corruption.
@@ -133,6 +136,12 @@ nyxora dashboard
 ```bash
 nyxora clear --force
 ```
+
+### Utility: Clean Uninstallation
+To completely remove Nyxora, wipe the AI's local memory, and securely delete your Private Key from the OS Keyring before uninstalling the NPM package:
+```bash
+nyxora uninstall
+```
 > **⚠️ IMPORTANT:** Whenever you re-run `nyxora setup` or manually edit the config files, you **must restart the daemon** by running `nyxora restart` for the changes to take effect.
 
 ### Local Development (From Source)
@@ -159,6 +168,14 @@ npm start
 
 ---
 
+## ⚖️ Terms of Service
+
+By downloading, installing, or using the Nyxora AI Agent, you agree to our assumption of risk and liability limitations. Please ensure you review our legal policies before deploying the agent.
+
+> **🔗 [Read the Full Terms of Service Here](https://nyxoraai.github.io/Nyxora/terms)**
+
+---
+
 ## 📖 Official Documentation
 
 For complete technical deep-dives into our Cryptographic Architecture, please visit our official VitePress Documentation Site!
@@ -172,7 +189,7 @@ For complete technical deep-dives into our Cryptographic Architecture, please vi
 **❤️ Support the Project**
 
 Building and maintaining a highly secure, zero-trust architecture takes significant time and resources. If you love what we are building, you can help us keep Nyxora open, secure, and constantly evolving by sending a coffee our way:
-- **EVM (Multi-Sig Safe):** `0x490717E50D6434C348AA0D2bD5fe682392823708`
+- **EVM :** `0x490717E50D6434C348AA0D2bD5fe682392823708`
 
 ---
 **License:** MIT License

package/bin/nyxora.mjs

@@ -86,18 +86,30 @@ async function start() {
   }
 }
 
-async function stop() {
+async function stop(preserveTracker = false) {
   const pid = await getDaemonPid();
   if (pid) {
     console.log(`Stopping Nyxora daemon (PID: ${pid})...`);
     try {
       process.kill(-pid, 'SIGTERM');
+      
+      // Wait for process to exit to avoid race condition with flushState
+      let attempts = 0;
+      while (isDaemonRunning(pid.toString()) && attempts < 20) {
+        await new Promise(r => setTimeout(r, 100));
+        attempts++;
+      }
+      
       console.log('Nyxora stopped gracefully.');
     } catch (e) {
       console.error('Failed to kill process:', e.message);
     }
     try {
       fs.unlinkSync(pidFile);
+      if (!preserveTracker) {
+        const trackerFile = path.join(appDir, 'run', 'tracker.json');
+        if (fs.existsSync(trackerFile)) fs.unlinkSync(trackerFile);
+      }
     } catch(e) {}
   } else {
     console.log('Nyxora is not running.');
@@ -105,7 +117,7 @@ async function stop() {
 }
 
 async function restart() {
-  await stop();
+  await stop(true);
   setTimeout(start, 1000);
 }
 
@@ -267,6 +279,34 @@ async function wallet(cliArgs) {
   await new Promise(resolve => child.on('close', resolve));
 }
 
+async function uninstall(cliArgs) {
+  const compiledCli = path.join(projectRoot, 'dist', 'packages/core/src/gateway/cli.js');
+  const useCompiled = fs.existsSync(compiledCli);
+  const cmd = useCompiled ? 'node' : 'npx';
+  const args = useCompiled ? [compiledCli, 'uninstall', ...cliArgs] : ['ts-node', '-T', 'packages/core/src/gateway/cli.ts', 'uninstall', ...cliArgs];
+  const child = spawn(cmd, args, {
+    cwd: projectRoot,
+    stdio: 'inherit',
+    env: { ...process.env, TS_NODE_CACHE: 'false' }
+  });
+  
+  await new Promise(resolve => child.on('close', resolve));
+}
+
+async function chat(cliArgs) {
+  const compiledCli = path.join(projectRoot, 'dist', 'packages/core/src/gateway/cli.js');
+  const useCompiled = fs.existsSync(compiledCli);
+  const cmd = useCompiled ? 'node' : 'npx';
+  const args = useCompiled ? [compiledCli, 'chat', ...cliArgs] : ['ts-node', '-T', 'packages/core/src/gateway/cli.ts', 'chat', ...cliArgs];
+  const child = spawn(cmd, args, {
+    cwd: projectRoot,
+    stdio: 'inherit',
+    env: { ...process.env, TS_NODE_CACHE: 'false' }
+  });
+  
+  await new Promise(resolve => child.on('close', resolve));
+}
+
 async function runDoctor() {
   const compiledCli = path.join(projectRoot, 'dist', 'packages/core/src/gateway/doctor.js');
   const useCompiled = fs.existsSync(compiledCli);
@@ -317,6 +357,8 @@ async function main() {
     case 'clear': await clearMemory(process.argv.slice(3)); break;
     case 'set-key': await setKey(process.argv.slice(3)); break;
     case 'wallet': await wallet(process.argv.slice(3)); break;
+    case 'chat': await chat(process.argv.slice(3)); break;
+    case 'uninstall': await uninstall(process.argv.slice(3)); break;
     case 'start': await start(); break;
     case 'stop': await stop(); break;
     case 'restart': await restart(); break;
@@ -341,6 +383,7 @@ Commands:
   start          Start the Nyxora background daemon
   stop           Stop the running daemon
   restart        Restart the daemon
+  chat           Chat interactively with the AI in terminal
   setup          Run the interactive Setup Wizard
   dashboard      Open the dashboard in your browser
   unlock         Unlock an inactive dashboard session
@@ -350,6 +393,7 @@ Commands:
   autostart      Enable/disable autostart on boot (usage: nyxora autostart enable)
   set-key        Securely save API Key (usage: nyxora set-key <provider> <key>)
   wallet         Manage your Web3 Wallet (usage: nyxora wallet update)
+  uninstall      Wipe AI memory, securely delete keys, and remove configuration
 
 Options:
   -v, --version  Show current version

package/dist/packages/core/src/agent/cronManager.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cronManager = void 0;
+const cron = __importStar(require("node-cron"));
+const parser_1 = require("../config/parser");
+const telegram_1 = require("../gateway/telegram");
+const crypto_1 = require("crypto");
+const picocolors_1 = __importDefault(require("picocolors"));
+class CronManager {
+    jobs = new Map();
+    addJob(expression, prompt) {
+        const id = (0, crypto_1.randomUUID)();
+        // Validate expression
+        if (!cron.validate(expression)) {
+            throw new Error(`Invalid cron expression: ${expression}`);
+        }
+        const task = cron.schedule(expression, async () => {
+            console.log(picocolors_1.default.cyan(`[Cron] Executing job ${id}: "${prompt}"`));
+            try {
+                // Dynamically import processUserInput to avoid circular dependencies
+                const { processUserInput } = await Promise.resolve().then(() => __importStar(require('./reasoning')));
+                // Execute the prompt as a background system task
+                const response = await processUserInput(prompt, 'system', undefined, `cron-${id}`);
+                // Push notification to Telegram if configured
+                const config = (0, parser_1.loadConfig)();
+                if (config.integrations?.telegram?.enabled && config.integrations?.telegram?.authorized_chat_id) {
+                    const message = `🤖 *AI Scheduled Report*\n\n${response}`;
+                    await (0, telegram_1.sendPushNotification)(config.integrations.telegram.authorized_chat_id, message);
+                }
+            }
+            catch (err) {
+                console.error(picocolors_1.default.red(`[Cron] Failed to execute job ${id}:`), err);
+                const config = (0, parser_1.loadConfig)();
+                if (config.integrations?.telegram?.enabled && config.integrations?.telegram?.authorized_chat_id) {
+                    await (0, telegram_1.sendPushNotification)(config.integrations.telegram.authorized_chat_id, `⚠️ *Cron Job Error*\n\nPrompt: ${prompt}\nError: ${err.message}`);
+                }
+            }
+        });
+        this.jobs.set(id, {
+            id,
+            expression,
+            prompt,
+            task,
+            createdAt: Date.now()
+        });
+        console.log(picocolors_1.default.green(`[Cron] Scheduled new job ${id} with expression '${expression}'`));
+        return id;
+    }
+    removeJob(id) {
+        const job = this.jobs.get(id);
+        if (job) {
+            job.task.stop();
+            this.jobs.delete(id);
+            console.log(picocolors_1.default.yellow(`[Cron] Removed job ${id}`));
+            return true;
+        }
+        return false;
+    }
+    getJobs() {
+        return Array.from(this.jobs.values()).map(job => ({
+            id: job.id,
+            expression: job.expression,
+            prompt: job.prompt,
+            createdAt: job.createdAt
+        }));
+    }
+    getActiveJobsCount() {
+        return this.jobs.size;
+    }
+}
+exports.cronManager = new CronManager();

package/dist/packages/core/src/agent/reasoning.js

@@ -34,6 +34,7 @@ const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
 const getTxHistory_1 = require("../web3/skills/getTxHistory");
 const createLimitOrder_1 = require("../web3/skills/createLimitOrder");
 const updateProfile_1 = require("./updateProfile");
+const updateIdentity_1 = require("./updateIdentity");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
 const readFile_1 = require("../system/skills/readFile");
@@ -48,6 +49,8 @@ const xManager_1 = require("../system/skills/xManager");
 const notionWorkspace_1 = require("../system/skills/notionWorkspace");
 const audioTranscribe_1 = require("../system/skills/audioTranscribe");
 const summarizeText_1 = require("../system/skills/summarizeText");
+const scheduleTask_1 = require("../system/skills/scheduleTask");
+const cancelTask_1 = require("../system/skills/cancelTask");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
 const paths_1 = require("../config/paths");
 const picocolors_1 = __importDefault(require("picocolors"));
@@ -143,35 +146,62 @@ CRITICAL RULE 11: ADAPTIVE RESPONSE RULE. You must process Web3 data (portfolio,
 CRITICAL RULE 13: WALLET CONTEXT CACHING. Portfolio data in chat history is potentially stale. Do not use cached data for transactional planning; refresh the balance via tools first.
 CRITICAL RULE 14: TRANSACTION EXECUTION. For ALL state-changing transactions (swap, bridge, transfer, stake), do NOT ask for verbal confirmation. Execute the tool IMMEDIATELY. The tool itself will trigger a secure popup in the user's dashboard UI for final approval.
 CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answer exists in recent verified context and freshness is not strictly required. Use history to save latency.
+CRITICAL RULE 19: GET_PRICE USAGE. Use get_price ONLY when the user explicitly asks for a simple price check (e.g. 'harga', 'price'). Do NOT use this for 'analysis', 'market analysis', or 'analisis pasar'.
 
 [ANTI-HALLUCINATION PROTOCOL]
 CRITICAL RULE 6: NETWORK SAFETY VALIDATION. If a request implies cross-chain or mainnet/testnet mixing, or the token symbol is ambiguous (USDC vs USDC.e), YOU MUST NOT GUESS. Ask for confirmation.
 CRITICAL RULE 7: TOOL CONFIDENCE & HALUCINATION PREVENTION. NEVER fabricate blockchain data. If a tool fails or data is missing, state it explicitly. Do not estimate balances, prices, APY, or gas.
+CRITICAL RULE 18: AMOUNT PRECISION. When displaying crypto amounts, use exactly 6 decimal places for precision, or round to 2 decimals only if the value is significantly large (>$10,000). Never abbreviate unless the number is >$1,000,000.
 CRITICAL RULE 9: DEFI CONFIGURATION FALLBACK. If a tool fails due to Rate Limits, Unauthorized, or Missing API Keys, instruct the user to visit the "DeFi Configuration 🔑" menu in the dashboard.
 CRITICAL RULE 12: SMART SLIPPAGE AWARENESS. For low-liquidity assets, warn the user that default slippage might not be enough. NEVER invent specific slippage percentage numbers.
 CRITICAL RULE 16: CAPABILITY HONESTY. NEVER claim a capability not available through installed tools. If asked for an unsupported action, state honestly that the skill is missing.
-CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token security, or preparing trades, you MUST explicitly declare a 'Confidence Score (0-100%)' INSIDE your <think> block. If your score is below 40%, you must firmly WARN the user and advise against the trade in your final response.`;
-    // Read IDENTITY.md for core AI persona
+CRITICAL RULE 19: MARKET CONFIDENCE SCORE. When analyzing market data, token security, or preparing trades, you MUST explicitly declare a 'Confidence Score (0-100%)' INSIDE your <think> block. If your score is below 40%, you must firmly WARN the user and advise against the trade in your final response.
+CRITICAL RULE 20: CRON JOBS VS LIMIT ORDERS. STRICT RULE: Do NOT use schedule_task for price-based trading triggers or buying/selling at a specific price level. Use create_limit_order. STRICT RULE: Do NOT use create_limit_order for time-based recurring tasks (e.g. 'every 5 minutes', 'every Monday'). Use schedule_task.
+CRITICAL RULE 21: CONFIGURATION SECURITY. You are STRICTLY FORBIDDEN from modifying config.yaml, rpc_key.yaml, or policy.yaml using OS skills or terminal commands (like sed, echo, nano). If you need to change your name, use the update_identity tool.`;
+    const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
+    const userMdPath = (0, paths_1.getPath)('user.md');
+    let isFirstTime = false;
     try {
-        const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
-        if (fs_1.default.existsSync(identityMdPath)) {
-            const identityInstructions = fs_1.default.readFileSync(identityMdPath, 'utf8');
-            basePrompt += `\n\n--- CORE IDENTITY & PERSONA ---\n${identityInstructions}`;
-        }
+        const identityContent = fs_1.default.existsSync(identityMdPath) ? fs_1.default.readFileSync(identityMdPath, 'utf8').trim() : '';
+        const userContent = fs_1.default.existsSync(userMdPath) ? fs_1.default.readFileSync(userMdPath, 'utf8').trim() : '';
+        // Check if files are empty or contain the default installation text
+        const isIdentityDefault = !identityContent || identityContent.includes('You are a Web3 AI assistant named Nyxora.');
+        const isUserDefault = !userContent || userContent.includes('Write custom instructions, special rules, user profiles');
+        isFirstTime = isIdentityDefault && isUserDefault;
     }
-    catch (error) {
-        console.error('Failed to read IDENTITY.md:', error);
+    catch (e) {
+        isFirstTime = true;
     }
-    // Read user.md for custom instructions
-    try {
-        const userMdPath = (0, paths_1.getPath)('user.md');
-        if (fs_1.default.existsSync(userMdPath)) {
-            const customInstructions = fs_1.default.readFileSync(userMdPath, 'utf8');
-            basePrompt += `\n\n--- CUSTOM USER INSTRUCTIONS ---\n${customInstructions}`;
-        }
+    if (isFirstTime) {
+        basePrompt += `\n\n[ONBOARDING MODE]
+This is your VERY FIRST interaction with the user. You MUST warmly welcome them to Nyxora and ask for 4 things to initialize your setup:
+1. Their Name
+2. What they want to name YOU (the AI Agent)
+3. Their Hobbies or Job (so you can tailor your conversation context)
+4. Your Persona/Character (e.g., professional, sarcastic, JARVIS, anime waifu)
+Do NOT perform any web3 tasks or generic answers until they provide all 4 details. Once they answer, use 'update_profile' to save their name and hobbies/job to user.md, and use 'update_identity' (making sure to provide the 'agentName' parameter!) to save your new name and persona to IDENTITY.md.`;
     }
-    catch (error) {
-        console.error('Failed to read user.md:', error);
+    else {
+        // Read IDENTITY.md for core AI persona
+        try {
+            if (fs_1.default.existsSync(identityMdPath)) {
+                const identityInstructions = fs_1.default.readFileSync(identityMdPath, 'utf8');
+                basePrompt += `\n\n--- CORE IDENTITY & PERSONA ---\n${identityInstructions}`;
+            }
+        }
+        catch (error) {
+            console.error('Failed to read IDENTITY.md:', error);
+        }
+        // Read user.md for custom instructions
+        try {
+            if (fs_1.default.existsSync(userMdPath)) {
+                const customInstructions = fs_1.default.readFileSync(userMdPath, 'utf8');
+                basePrompt += `\n\n--- CUSTOM USER INSTRUCTIONS ---\n${customInstructions}`;
+            }
+        }
+        catch (error) {
+            console.error('Failed to read user.md:', error);
+        }
     }
     // Read policy.yaml for NLP security constraints
     try {
@@ -226,7 +256,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
     exports.logger.addEntry({ role, content: input }, sessionId);
     const history = exports.logger.getHistory(sessionId);
     // Format messages for OpenAI
-    const messages = [
+    let messages = [
         { role: 'system', content: getSystemPrompt() },
         ...history
             .filter(m => !(m.role === 'tool' && !m.tool_call_id))
@@ -244,6 +274,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
             return msg;
         })
     ];
+    // Remove orphaned tool responses (truncated by the 40-message limit) at the start of the history window
+    while (messages.length > 1 && messages[1].role === 'tool') {
+        messages.splice(1, 1);
+    }
     try {
         const lowerInput = input.toLowerCase();
         const hasWeb3Keyword = /swap|transfer|price|token|crypto|bridge|wallet|balance|portfolio|buy|sell|send|receive|address|market|limit|mint|nft/i.test(lowerInput);
@@ -252,7 +286,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         if ((0, skillManager_1.isSkillActive)('web3')) {
             tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, createMarketWatchAgent_1.createMarketWatchAgentToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition, createLimitOrder_1.createLimitOrderToolDefinition);
         }
-        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
+        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateIdentity_1.updateIdentityToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition, scheduleTask_1.scheduleTaskDefinition, cancelTask_1.cancelTaskDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
         let activeTools = [];
         if (hasGoogleKeyword && !hasWeb3Keyword) {
@@ -315,6 +349,16 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                     }, sessionId);
                     continue;
                 }
+                if (!(0, skillManager_1.isSkillActive)(toolName)) {
+                    console.warn(picocolors_1.default.red(`[Security] Blocked illegal execution of disabled skill: ${toolName}`));
+                    result = `[System Error] Access denied: Skill '${toolName}' is currently disabled by the user.`;
+                    exports.logger.addEntry({
+                        role: "tool",
+                        tool_call_id: toolCall.id,
+                        content: result
+                    }, sessionId);
+                    continue;
+                }
                 try {
                     switch (toolName) {
                         case 'get_balance': {
@@ -402,6 +446,10 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = (0, updateProfile_1.updateProfile)(args.content, args.mode);
                             break;
                         }
+                        case 'update_identity': {
+                            result = (0, updateIdentity_1.updateIdentity)(args.content, args.mode);
+                            break;
+                        }
                         case 'update_security_policy': {
                             result = await (0, updateSecurityPolicy_1.updateSecurityPolicy)(args.policy, args.action || 'add');
                             break;
@@ -458,6 +506,14 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, searchWeb_1.searchWeb)(args.query, args.depth);
                             break;
                         }
+                        case 'schedule_task': {
+                            result = await (0, scheduleTask_1.executeScheduleTask)(args);
+                            break;
+                        }
+                        case 'cancel_task': {
+                            result = await (0, cancelTask_1.executeCancelTask)(args);
+                            break;
+                        }
                         case 'read_gmail_inbox': {
                             result = await (0, googleWorkspace_1.readGmailInbox)(args.maxResults);
                             break;
@@ -541,11 +597,28 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                 tracker_1.Tracker.addTokens(secondResponse.usage.total_tokens, config.llm.provider);
             }
             tracker_1.Tracker.addEvent('llm.final_response', { provider: config.llm.provider });
-            const finalContent = secondResponse.choices[0].message.content || "";
+            let finalContent = secondResponse.choices[0].message.content || "";
+            // Clean up orphaned <think> blocks that forgot to output </think>
+            finalContent = finalContent.replace(/<thought>[\s\S]*?<\/thought>\n?/gi, '');
+            finalContent = finalContent.replace(/<think>[\s\S]*?<\/think>\n?/gi, '');
+            if (finalContent.includes('<think>')) {
+                finalContent = finalContent.replace(/<think>[\s\S]*?\n\n/i, '');
+                finalContent = finalContent.replace(/<think>[\s\S]*$/i, '');
+            }
+            finalContent = finalContent.trim();
             exports.logger.addEntry({ role: 'assistant', content: finalContent }, sessionId);
             return finalContent;
         }
-        return responseMessage.content || "No response generated.";
+        let finalContent = responseMessage.content || "No response generated.";
+        // Clean up orphaned <think> blocks that forgot to output </think>
+        finalContent = finalContent.replace(/<thought>[\s\S]*?<\/thought>\n?/gi, '');
+        finalContent = finalContent.replace(/<think>[\s\S]*?<\/think>\n?/gi, '');
+        if (finalContent.includes('<think>')) {
+            finalContent = finalContent.replace(/<think>[\s\S]*?\n\n/i, '');
+            finalContent = finalContent.replace(/<think>[\s\S]*$/i, '');
+        }
+        finalContent = finalContent.trim();
+        return finalContent;
     }
     catch (error) {
         console.error("LLM Error:", error);

package/dist/packages/core/src/agent/transactionManager.js

@@ -6,13 +6,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.txManager = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
+const paths_1 = require("../config/paths");
 class TransactionManager {
     transactions = new Map();
     withdrawals = new Map();
     dbPath;
     constructor() {
-        this.dbPath = path_1.default.join(process.cwd(), '.nyxora_withdrawals.json');
+        this.dbPath = (0, paths_1.getPath)('.nyxora_withdrawals.json');
         this.loadWithdrawals();
     }
     loadWithdrawals() {

package/dist/packages/core/src/agent/updateIdentity.js

@@ -0,0 +1,71 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateIdentityToolDefinition = void 0;
+exports.updateIdentity = updateIdentity;
+const fs_1 = __importDefault(require("fs"));
+const paths_1 = require("../config/paths");
+const parser_1 = require("../config/parser");
+function updateIdentity(content, mode, agentName) {
+    try {
+        const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
+        if (mode === 'replace') {
+            fs_1.default.writeFileSync(identityMdPath, content, 'utf8');
+            let msg = "Identity replaced successfully. New IDENTITY.md has been saved.";
+            if (agentName) {
+                const config = (0, parser_1.loadConfig)();
+                config.agent.name = agentName;
+                (0, parser_1.saveConfig)(config);
+                msg += ` Agent Name updated to '${agentName}' in config.`;
+            }
+            return msg;
+        }
+        else {
+            let existingContent = "";
+            if (fs_1.default.existsSync(identityMdPath)) {
+                existingContent = fs_1.default.readFileSync(identityMdPath, 'utf8');
+            }
+            const newContent = existingContent + "\n" + content;
+            fs_1.default.writeFileSync(identityMdPath, newContent, 'utf8');
+            let msg = "Identity appended successfully. New instructions added to IDENTITY.md.";
+            if (agentName) {
+                const config = (0, parser_1.loadConfig)();
+                config.agent.name = agentName;
+                (0, parser_1.saveConfig)(config);
+                msg += ` Agent Name updated to '${agentName}' in config.`;
+            }
+            return msg;
+        }
+    }
+    catch (error) {
+        return `Failed to update identity: ${error.message}`;
+    }
+}
+exports.updateIdentityToolDefinition = {
+    type: "function",
+    function: {
+        name: "update_identity",
+        description: "Updates or rewrites the IDENTITY.md file. Use this when the user sets or changes your AI name, persona, or core character instructions.",
+        parameters: {
+            type: "object",
+            properties: {
+                content: {
+                    type: "string",
+                    description: "The content to write or append to IDENTITY.md",
+                },
+                mode: {
+                    type: "string",
+                    enum: ["append", "replace"],
+                    description: "Whether to append the content to the existing file or replace the entire file.",
+                },
+                agentName: {
+                    type: "string",
+                    description: "The short display name of the AI agent (e.g. Hinata, Nyxora). MUST be provided if the user assigns you a new name.",
+                }
+            },
+            required: ["content", "mode"],
+        },
+    },
+};