nyxora 26.6.8-2 → 26.6.10-2

package/CHANGELOG.md

@@ -5,7 +5,37 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepashangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [26.6.8-1] - Unreleased
+## [26.6.10] - 2026-06-09
+### The DeFi Optimization Update
+- **DeFi Lending Engine**: Integrated native Aave V3 support across all EVM chains. The AI can now autonomously fetch dynamic `Pool` addresses via `PoolAddressesProvider` and securely draft `supply` payloads to earn yield on idle assets.
+- **DeFi Security Guard (Revoke)**: Shipped a critical security skill allowing users to purge "Infinite Approvals". The AI can now construct 0-value `approve()` payloads to instantly revoke access from malicious or vulnerable smart contracts across any chain.
+- **DEX LP Manager**: Integrated Uniswap V3 (and PancakeSwap V3 for BSC) liquidity provision. Enforces strict safety barriers by mandating human-in-the-loop input for `tickLower` and `tickUpper` price ranges, completely neutralizing AI hallucination risks in complex liquidity deployments.
+- **Auto-Compounder Vaults**: Integrated Beefy Finance (Primary) and Yearn Finance (Secondary). The AI can seamlessly route idle LP tokens into auto-compounding smart contracts to automatically maximize yield.
+- **Transaction Chaining (Smart Approve)**: Upgraded the `viem` contract simulator to intelligently read user allowances prior to execution. If a user attempts to supply Aave or deposit to Beefy without prior authorization, the AI will autonomously intercept the request and draft a precise `approve` payload first, drastically improving UX.
+### Enterprise Reporting & History
+- **Automated Excel Reporting**: The AI can now autonomously generate formatted `.xlsx` reports from raw JSON data (e.g., PnL, token balances) via the new `generate_excel_file` OS Skill.
+- **Deep Transaction History**: Integrated `get_tx_history` Web3 skill to fetch complete 30-day (or N-day) history for Native and ERC-20 transfers using the new Unified Etherscan API V2. A single API key now powers cross-chain fetching across 60+ Mainnets and Testnets, featuring a graceful fallback mechanism to public endpoints.
+
+### The Masterpiece Memory Architecture
+- **Air-Gapped Security Vault**: Implemented a strict 4-Layer Memory Architecture. The LLM Reflection Engine is now completely air-gapped from the OS Keyring and Wallet System, establishing absolute immunity against memory-based Private Key leakage.
+- **Hard-Coded Anti-Injection Validator**: Deployed a rule-based RegExp Validator (`validator.ts`) acting as the ultimate gatekeeper before SQLite insertion. It autonomously detects and annihilates Private Keys, 12/24 BIP-39 Seed Phrases, API Tokens, and System Prompt Override attempts without relying on LLM behavior.
+- **Smart Suggestion Engine**: The Agent Reasoning Pipeline now natively hooks into the Layer-2 Episodic Database. By injecting the top 10 most confident habits directly into the System Prompt, Nyxora can now autonomously autocomplete repetitive transaction parameters (e.g., preferred network, preferred token) slashing human-in-the-loop latency by up to 90%.
+- **Persistent Background Reflection**: Eliminated static interval timers. The Reflection Engine is now seamlessly triggered via 3 infallible hooks: a 3-minute Idle Timer, an N-Message threshold (every 5 messages), and a `SIGTERM` Graceful Shutdown hook, ensuring resilient memory retention across daemon lifecycles.
+- **Real-Time Memory Log Dashboard**: Exposed a robust `/api/memory` CRUD endpoint and integrated a sleek "Memory Log" panel directly into the Web Dashboard Overview tab. Users can now audit, review confidence scores, and forcefully delete false observations in real-time with zero state desynchronization.
+
+## [26.6.9] - 2026-06-08
+### Security & UX Hardening
+- **Zero-Trust Auto-Lock (Passwordless)**: Implemented a robust idle timeout mechanism in the React Dashboard with an elegant glassmorphism blur overlay. The dashboard securely locks after periods of inactivity, requiring the user to authorize unlock directly via the CLI (`nyxora unlock`) to prevent unauthorized local access.
+- **Approval Replay Protection (Nonce Guard)**: Hardened the `transactionManager` to cryptographically sign all pending transaction payloads with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint now strictly enforces Nonce matching and immediately marks it as `used_` upon first validation, completely eliminating double-spending and Replay Attack vectors.
+- **Graceful Shutdown (SQLite WAL Guard)**: Integrated deep `SIGTERM` and `SIGINT` signal listeners within the Gateway server. When the daemon is halted, the system now safely terminates active incoming requests and explicitly invokes `logger.close()` to securely flush SQLite Write-Ahead Logs (WAL) before exiting, completely eliminating the risk of database corruption.
+- **Resilient UI (Reconnect Overlay)**: Engineered a global network interceptor inside the Dashboard's React `apiFetch` utility. If the daemon goes offline unexpectedly or is restarting, the UI instantly pauses and deploys a transparent, pulsing "Nyxora Daemon Offline" screen. Once the daemon is revived, the overlay automatically lifts, preserving the user's workflow seamlessly.
+
+### Architecture & Production Readiness
+- **Dynamic Port Anti-Collision**: Replaced the hardcoded `3001` Policy Server port with a dynamic `process.env.POLICY_PORT` fallback. All Web3 Agents (Bridge, Swap, Transfer, etc.) are now dynamically linked to this environment variable, completely eliminating `ECONNREFUSED` crashes when port 3001 is occupied by other local developer applications.
+- **Production-Ready Path Resolution**: Eliminated hardcoded `process.cwd()` dependencies across the Gateway, Dashboard, and Plugin Manager. The CLI now utilizes robust absolute `__dirname` and `getAppDir()` traversal, guaranteeing the Dashboard UI and External Skills load flawlessly regardless of where the global CLI command is executed from.
+
+
+## [26.6.8] - 2026-06-08
 ### Enterprise Features & Web3 Enhancements
 - **Zero-Downtime Directory Migration**: Restructured the root `~/.nyxora` local data directory into a strict `config/`, `data/`, `auth/`, and `run/` subdirectory architecture. Implemented a Lazy Auto-Migration Engine (`getPath()`) that seamlessly relocates legacy files to their new secure zones instantly upon access, ensuring zero-downtime and zero-data-loss upgrades for existing users.
 ### Security & UX Updates

package/README.md

@@ -2,6 +2,7 @@
 **Your Personal Web3 Assistant.**
 
 
+[![Built on Arbitrum](https://img.shields.io/badge/Built_on-Arbitrum-28A0F0?style=flat&logo=arbitrum&logoColor=white)](https://arbitrum.io/)
 [![MCP Supported](https://img.shields.io/badge/MCP-Supported-blue.svg)](#)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Security: Production-Grade](https://img.shields.io/badge/Security-Production--Grade-blue.svg)](#️-advanced-security-threat-model)
@@ -19,28 +20,39 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 ## 🔥 Key Features
 
 ### Advanced Security Architecture
+*   **🛡️ On-Chain AI Kill-Switch**: Nyxora is governed by an Arbitrum Smart Contract (`NyxoraAgentRegistry`). Users have absolute cryptographic power to instantly paralyze the AI's on-chain execution if compromised, solving the Web3 AI safety dilemma. [Read more about our Arbitrum Architecture ->](https://nyxoraai.github.io/Nyxora/security/smart-contract)
 *   **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
-*   **Cryptographically Bound Approval**: Policy changes and transactions requested by the AI are drafted as hashes (`sha256`). Approval via the UI requires a challenge nonce, preventing Man-in-the-Middle (MITM) attacks.
+*   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
 *   **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
 *   **Plugin Sandbox VM**: Execute community-built external skills securely inside an airtight Node.js `vm` chamber with zero access to your file system or terminal processes.
-*   **Enterprise-Grade Stability**: Runs on a WAL-enabled SQLite backend with resilient anti-zombie connection timeouts to ensure maximum concurrency without database locks.
+*   **Graceful SQLite WAL Shutdown**: Integrated `SIGTERM`/`SIGINT` interceptors ensure that when the daemon stops, active requests are safely terminated and SQLite Write-Ahead Logs (WAL) are securely flushed, preventing database corruption.
 
 ### 🌐 Web3 Skills (On-Chain)
 *   **Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
+*   **Advanced DeFi Optimization**: Autonomously supply assets to Aave V3, deposit into Beefy/Yearn Auto-Compounder Vaults, manage Uniswap V3 Liquidity (LP), and instantly revoke infinite approvals to secure your wallet. Features intelligent Transaction Chaining to auto-approve allowances prior to execution.
 *   **Anti-MEV Slippage Protection**: Hardened routing engine with dynamic Slippage Tolerance (default 0.5%) for Relay and Li.Fi. You can manually adjust slippage via the UI or dynamically override it using natural language (e.g., "Swap 1 ETH to PEPE with 10% slippage").
 *   **Automated Take Profit (TP) & Cut Loss (CL)**: The trader's holy grail. Set natural language rules (e.g., "Sell my PEPE if price drops below $0.001"). Nyxora runs a background cron monitor and executes the swap while you sleep.
 *   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.
 *   **Dynamic Portfolio Engine**: Merges standard tokens, your custom Degen CAs, and CoinGecko's daily trending list into a single hyper-fast Multicall scan to deliver a clean, spam-free PnL portfolio report in under 1 second.
+*   **Deep Transaction History**: Accurately fetch your 30-day (or custom timeframe) Native and ERC-20 transaction history across all supported EVM chains. Powered by the Unified Etherscan API V2, enabling seamless cross-chain fetching (Mainnets & Testnets) using a single API key.
 
 ### 💻 OS & Web2 Skills (Off-Chain)
 *   **Google Workspace Automation 🚀**: Transform Nyxora into your ultimate personal assistant. The agent can read your latest Gmail inbox, check your Google Calendar, extract text from Google Docs, and even append expense/trading logs directly to your Google Sheets.
 *   **System Automation & Full OS Access**: Instruct the agent to read/write local files, run terminal commands, and browse the web natively.
+*   **Automated Excel Reporting**: Instruct the agent to compile its Web3 portfolio or transaction history findings and autonomously generate beautiful `.xlsx` spreadsheet reports saved directly to your local machine.
 *   **Unstoppable Synergy**: Combine both engines with a single prompt. Example: *"Read the latest presale token email from my Gmail, automatically set a Take Profit limit order on Uniswap, and log the execution result to my Google Sheets."*
 
+### 🧠 The Masterpiece Memory Architecture
+*   **4-Layer Air-Gapped Vault**: Nyxora features a god-tier memory system that completely isolates conversational habits from the OS Keyring. The AI can dynamically learn your behaviors without ever having physical read-paths to your private keys.
+*   **Hard-Coded Anti-Injection Shield**: We enforce a Zero-Trust memory paradigm. Before any user habit is saved to the local SQLite database, it must pass a strict RegExp-based validation layer that autonomously annihilates Private Keys, BIP-39 Seed Phrases, and Prompt Injection attempts.
+*   **Smart Suggestion Engine**: Nyxora actively queries its Layer-2 Episodic Database to seamlessly autocomplete your repetitive Web3 routines. If you always swap on Arbitrum using USDC, the AI will proactively suggest it, slashing human-in-the-loop latency by up to 90%.
+*   **Persistent Background Reflection**: Empowered by background idle timers and message-count thresholds, Nyxora quietly transcribes your habits into a permanent profile while you step away from the keyboard, ensuring it never forgets your identity even after daemon reboots.
+
 ### AI & UI Customization
+*   **Zero-Trust Auto-Lock (Passwordless)**: A sleek glassmorphism blur overlay automatically locks the dashboard during inactivity. Unlocking requires physical local execution via the CLI (`nyxora unlock`), preventing unauthorized local access.
+*   **Resilient UI (Reconnect Overlay)**: Built-in global network interceptors ensure that if the daemon restarts or crashes, the UI immediately pauses with a transparent "Offline" overlay and seamlessly resumes your workflow once revived.
 *   **Zero-Click Multi-Session**: Instantly create isolated chat sessions with smart auto-naming triggered by your first prompt, exactly like ChatGPT.
-*   **Dynamic Trending Tokens**: Live top 5 crypto assets feed directly injected into the dashboard, completely clickable for instant AI market analysis.
 *   **Premium Utility-Centric UI**: A sleek, dark-themed dashboard built for high readability and professional Web3 execution, featuring Pseudo-Generative UI widgets (`<BalanceWidget>`, `<MarketWidget>`, `<SwapWidget>`).
 *   **Massive 2026 Model Roster**: Out-of-the-box support for cutting-edge models via Google Gemini, OpenAI, Groq, Mistral, xAI, DeepSeek, OpenRouter, and local Ollama, equipped with a searchable CLI prompt to instantly find your favorite model.
 *   **Strict NLP Exactness (Rule 8)**: The AI is rigorously instructed never to hallucinate or guess missing transaction parameters (like destination chains or swap amounts). It halts and requests human clarification, guaranteeing 100% precision.
@@ -70,7 +82,7 @@ To dive deeper into the technical details of our Zero-Knowledge security archite
 
 ---
 
-## 🚀 Quick Start & Installation
+## 1. 🚀 Quick Start & Installation
 
 ### Global Installation via NPM (Recommended)
 The easiest and fastest way to use Nyxora is to install it globally via NPM. This ensures you get the latest version and can run Nyxora from anywhere on your machine.

package/SECURITY.md

@@ -66,12 +66,22 @@ approval_hash = sha256(policy_diff + timestamp + user_id)
 ```
 This ensures that what the human saw on the UI matches exactly what is being executed, preventing the LLM from secretly modifying the payload in transit.
 
-### Anti-Replay Challenge Nonce
-Every approval UI prompt utilizes a **Single-Use Challenge Nonce** with a strict expiry time. This mitigates *XSS Token Leaks* and *Replay Attacks*, ensuring that an old approval token cannot be stolen and reused for a malicious transaction later.
+### Anti-Replay Challenge Nonce (Nonce Guard)
+Every approval UI prompt utilizes a **Single-Use Challenge Nonce** (a randomized 16-byte cryptographic string). The `transactionManager` signs all pending payloads with this Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces matching and immediately marks the Nonce as `used_` upon first validation. This completely eliminates *XSS Token Leaks*, *Double-Spending*, and *Replay Attacks*, ensuring that an old approval token cannot be stolen and reused for a malicious transaction later.
 
 ---
 
-## 4. Plugin Sandboxing (Node.js VM Isolation)
+## 4. Physical Access & Data Integrity
+
+### Zero-Trust Auto-Lock (Physical Protection)
+To protect against unauthorized physical access (e.g., leaving a laptop unattended), the Dashboard implements a **Zero-Trust Auto-Lock** mechanism. After a period of inactivity, the UI aggressively blurs and locks all state. Unlocking the interface requires the user to execute `nyxora unlock` directly from the host operating system's CLI. This guarantees that anyone physically sitting at the unlocked dashboard cannot execute transactions without also possessing SSH or direct terminal access to the host machine.
+
+### SQLite WAL Graceful Shutdown (Data Integrity)
+To prevent database corruption during abrupt terminations, the Gateway daemon employs deep `SIGTERM` and `SIGINT` interceptors. When a halt is requested, the system safely terminates active incoming API requests and explicitly flushes the SQLite Write-Ahead Logs (WAL) before fully exiting, ensuring enterprise-grade state stability.
+
+---
+
+## 5. Plugin Sandboxing (Node.js VM Isolation)
 
 Community plugins and custom skills are NEVER executed directly at the OS level. Instead, Nyxora creates an airtight **Virtual Machine (VM) Sandbox** in memory. 
 

package/bin/nyxora.mjs

@@ -117,7 +117,13 @@ async function dashboard() {
   }
 
   if (fs.existsSync(tokenFile)) {
-    const token = fs.readFileSync(tokenFile, 'utf8').trim();
+    let token = fs.readFileSync(tokenFile, 'utf8').trim();
+    if (token.startsWith('{')) {
+      try {
+        const parsed = JSON.parse(token);
+        token = parsed.token;
+      } catch (e) {}
+    }
     const url = `http://localhost:3000?token=${token}`;
     console.log(`Opening Dashboard at ${url}`);
     try {
@@ -275,8 +281,38 @@ async function runDoctor() {
   await new Promise(resolve => child.on('close', resolve));
 }
 
+async function unlock() {
+  if (fs.existsSync(tokenFile)) {
+    let token = fs.readFileSync(tokenFile, 'utf8').trim();
+    if (token.startsWith('{')) {
+      try {
+        const parsed = JSON.parse(token);
+        token = parsed.token;
+      } catch (e) {}
+    }
+    try {
+      const fetch = (await import('node-fetch')).default;
+      const res = await fetch('http://localhost:3000/api/status/unlock', {
+        method: 'POST',
+        headers: {
+          'x-nyxora-token': token
+        }
+      });
+      if (res.ok) {
+        console.log('✅ Dashboard unlocked successfully.');
+      } else {
+        console.log('❌ Failed to unlock dashboard. Is the daemon running?');
+      }
+    } catch (e) {
+      console.log('❌ Failed to communicate with the daemon. Is it running?');
+    }
+  } else {
+    console.log('❌ Authentication token not found.');
+  }
+}
+
 async function main() {
-  switch (command) {
+  switch(command) {
     case 'doctor': await runDoctor(); break;
     case 'setup': await setup(); break;
     case 'clear': await clearMemory(process.argv.slice(3)); break;
@@ -286,6 +322,7 @@ async function main() {
     case 'stop': await stop(); break;
     case 'restart': await restart(); break;
     case 'dashboard': await dashboard(); break;
+    case 'unlock': await unlock(); break;
     case 'clean-logs': await cleanLogs(); break;
     case 'autostart': await autostart(process.argv[3]); break;
     case '-v':
@@ -307,6 +344,7 @@ Commands:
   restart        Restart the daemon
   setup          Run the interactive Setup Wizard
   dashboard      Open the dashboard in your browser
+  unlock         Unlock an inactive dashboard session
   doctor         Run system diagnostics and check requirements
   clear          Atomically clear the AI's short/long-term memory SQLite database
   clean-logs     Clear the daemon logs

package/dist/packages/core/src/agent/reasoning.js

@@ -4,12 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logger = void 0;
+exports.getOpenAI = getOpenAI;
 exports.processUserInput = processUserInput;
 const fs_1 = __importDefault(require("fs"));
 const openai_1 = require("openai");
 const parser_1 = require("../config/parser");
 const logger_1 = require("../memory/logger");
 const tracker_1 = require("../gateway/tracker");
+const episodic_1 = require("../memory/episodic");
 const getBalance_1 = require("../web3/skills/getBalance");
 const transfer_1 = require("../web3/skills/transfer");
 const getPrice_1 = require("../web3/skills/getPrice");
@@ -25,12 +27,18 @@ const checkPortfolio_1 = require("../web3/skills/checkPortfolio");
 const checkAddress_1 = require("../web3/skills/checkAddress");
 const getMyAddress_1 = require("../web3/skills/getMyAddress");
 const manageCustomTokens_1 = require("../web3/skills/manageCustomTokens");
+const revokeApprovals_1 = require("../web3/skills/revokeApprovals");
+const defiLending_1 = require("../web3/skills/defiLending");
+const yieldVault_1 = require("../web3/skills/yieldVault");
+const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
+const getTxHistory_1 = require("../web3/skills/getTxHistory");
 const limitOrderManager_1 = require("./limitOrderManager");
 const updateProfile_1 = require("./updateProfile");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
 const readFile_1 = require("../system/skills/readFile");
 const writeFile_1 = require("../system/skills/writeFile");
+const generateExcel_1 = require("../system/skills/generateExcel");
 const executeShell_1 = require("../system/skills/executeShell");
 const browseWeb_1 = require("../system/skills/browseWeb");
 const searchWeb_1 = require("../system/skills/searchWeb");
@@ -114,7 +122,7 @@ function getSystemPrompt() {
 You are equipped with a native wallet.
 The current real-world date and time is: ${currentDateTime}. Use this for any time-related questions.
 
-CRITICAL RULE 1: ADVANCED NLP & PERSONA. You must act as a highly intelligent, adaptive, and intuitive assistant (similar to ChatGPT or Gemini). You must seamlessly understand the user's language structure, including slang, shorthand, informal context, and mixed languages. However, you must maintain a professional and highly accurate Web3 operational standard.
+CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
 CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt. If the user's latest prompt is in English, you MUST reply entirely in English, completely ignoring the language of previous messages. If their latest prompt is in Indonesian, reply in Indonesian.
 CRITICAL RULE 3: FORMATTING & CONCISENESS. 
   - Your responses MUST be concise and to the point. Do not add unnecessary fluff or overly long explanations unless explicitly asked.
@@ -158,6 +166,19 @@ CRITICAL RULE 8: EXACTNESS AND SAFETY IN TRANSACTIONS. Never guess or hallucinat
     catch (error) {
         console.error('Failed to read security_policy.md:', error);
     }
+    // Inject Episodic Memories (Smart Suggestions Context)
+    try {
+        const recentMemories = episodic_1.episodicDB.getMemories().slice(0, 10);
+        if (recentMemories.length > 0) {
+            basePrompt += `\n\n--- EPISODIC MEMORIES (SMART SUGGESTIONS) ---\nUse these recent observations to proactively suggest or autocomplete parameters (like networks or tokens) without asking the user if they align with the current request:\n`;
+            recentMemories.forEach(mem => {
+                basePrompt += `- [${mem.category.toUpperCase()}] ${mem.fact} (Confidence: ${(mem.confidence * 100).toFixed(0)}%)\n`;
+            });
+        }
+    }
+    catch (error) {
+        // Ignore db errors if not initialized
+    }
     return basePrompt;
 }
 async function processUserInput(input, role = 'user', onProgress, sessionId) {
@@ -188,25 +209,26 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         if (config.llm.provider !== 'openai' && config.llm.provider !== 'ollama' && config.llm.provider !== 'gemini' && config.llm.provider !== 'openrouter') {
             return `Provider ${config.llm.provider} is configured, but currently only OpenAI, OpenRouter, Ollama, and Gemini adapters are implemented.`;
         }
-        // --- v1.7.4 Semantic Keyword Router ---
         const lowerInput = input.toLowerCase();
         const hasWeb3Keyword = /swap|transfer|price|token|crypto|bridge|wallet|balance|portfolio|buy|sell|send|receive|address|market|limit|mint|nft/i.test(lowerInput);
         const hasGoogleKeyword = /email|gmail|calendar|sheet|doc|form|event/i.test(lowerInput);
-        const WEB3_TOOLS = [getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, createWallet_1.createWalletToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, limitOrderManager_1.createLimitOrderToolDefinition, limitOrderManager_1.listLimitOrdersToolDefinition, limitOrderManager_1.cancelLimitOrderToolDefinition];
-        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition];
+        let tools = [];
+        if ((0, skillManager_1.isSkillActive)('web3')) {
+            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, createWallet_1.createWalletToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, limitOrderManager_1.createLimitOrderToolDefinition, limitOrderManager_1.listLimitOrdersToolDefinition, limitOrderManager_1.cancelLimitOrderToolDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition);
+        }
+        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
         let activeTools = [];
         if (hasGoogleKeyword && !hasWeb3Keyword) {
             activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         else if (hasWeb3Keyword && !hasGoogleKeyword) {
-            activeTools = [...WEB3_TOOLS, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         else {
-            activeTools = [...WEB3_TOOLS, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         activeTools = activeTools.filter(t => (0, skillManager_1.isSkillActive)(t.function.name));
-        // ----------------------------------------
         const response = await executeWithRetry(async (client) => {
             return await client.chat.completions.create({
                 model: config.llm.model,
@@ -217,19 +239,16 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
             });
         });
         const responseMessage = response.choices[0].message;
-        // Log tracking
         tracker_1.Tracker.addMessage();
         if (response.usage?.total_tokens) {
             tracker_1.Tracker.addTokens(response.usage.total_tokens, config.llm.provider);
         }
         tracker_1.Tracker.addEvent('llm.response', { provider: config.llm.provider, tool_calls: responseMessage.tool_calls?.length || 0 });
-        // Log assistant response
         exports.logger.addEntry({
             role: 'assistant',
             content: responseMessage.content || "",
             tool_calls: responseMessage.tool_calls,
         }, sessionId);
-        // Check if the model wants to call a tool
         if (responseMessage.tool_calls && responseMessage.tool_calls.length > 0) {
             for (const _toolCall of responseMessage.tool_calls) {
                 const toolCall = _toolCall;
@@ -239,10 +258,8 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                 console.log(picocolors_1.default.yellow(`[⚡ Tool Execution] AI is calling ${toolName}...`));
                 if (onProgress)
                     onProgress(`_⚡ Running tool: ${toolName}..._`);
-                // Phase 1: LLM Output Validation (Anti-Halusinasi)
                 try {
                     args = JSON.parse(toolCall.function.arguments);
-                    // TODO: Zod schema validation could be injected here per-tool
                 }
                 catch (parseError) {
                     console.error(picocolors_1.default.red(`[LLM Validation Error] Invalid JSON arguments for ${toolName}: ${parseError.message}`));
@@ -252,7 +269,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                         tool_call_id: toolCall.id,
                         content: result
                     }, sessionId);
-                    // Let the second LLM call handle the explanation of the failure
                     continue;
                 }
                 try {
@@ -279,7 +295,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                                 result = `[Security Blocked] Runtime Permission Denied: Web3 swaps are disabled. Update config.yaml to allow.`;
                                 break;
                             }
-                            // Note: max_usd_per_tx validation would ideally be calculated here before prepareSwapToken
                             result = await (0, swapToken_1.prepareSwapToken)(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
                             break;
                         }
@@ -331,6 +346,26 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, manageCustomTokens_1.executeManageCustomTokens)(args);
                             break;
                         }
+                        case 'revoke_approval': {
+                            result = await (0, revokeApprovals_1.prepareRevokeApproval)(args.chainName, args.tokenAddressOrSymbol, args.spenderAddress);
+                            break;
+                        }
+                        case 'supply_aave': {
+                            result = await (0, defiLending_1.prepareAaveSupply)(args.chainName, args.tokenAddressOrSymbol, args.amountStr);
+                            break;
+                        }
+                        case 'deposit_yield_vault': {
+                            result = await (0, yieldVault_1.prepareVaultDeposit)(args.chainName, args.protocol || 'beefy', args.vaultAddress, args.tokenAddressOrSymbol, args.amountStr);
+                            break;
+                        }
+                        case 'provide_liquidity_v3': {
+                            result = await (0, provideLiquidity_1.prepareProvideLiquidity)(args.chainName, args.token0AddressOrSymbol, args.token1AddressOrSymbol, args.amount0Str, args.amount1Str, args.feeTier, args.tickLower, args.tickUpper);
+                            break;
+                        }
+                        case 'get_tx_history': {
+                            result = await (0, getTxHistory_1.getTxHistory)(args.chainName, args.address, args.days);
+                            break;
+                        }
                         case 'create_limit_order': {
                             if (config.permissions?.web3?.allow_swap === false) {
                                 result = `[Security Blocked] Runtime Permission Denied: Limit orders require swap permissions. Update config.yaml to allow.`;
@@ -371,6 +406,14 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = (0, writeFile_1.writeLocalFile)(args.filePath, args.content);
                             break;
                         }
+                        case 'generate_excel_file': {
+                            if (config.permissions?.system?.allow_file_write === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = await (0, generateExcel_1.generateExcelFile)(args.data, args.filePath);
+                            break;
+                        }
                         case 'run_terminal_command': {
                             if (config.permissions?.system?.allow_shell_execution === false) {
                                 result = `[Security Blocked] Runtime Permission Denied: Shell execution is disabled. Update config.yaml to allow.`;

package/dist/packages/core/src/agent/transactionManager.js

@@ -9,6 +9,7 @@ class TransactionManager {
     transactions = new Map();
     createPendingTransaction(type, chainName, details) {
         const id = crypto_1.default.randomUUID();
+        const nonce = crypto_1.default.randomBytes(16).toString('hex');
         const tx = {
             id,
             type,
@@ -16,6 +17,7 @@ class TransactionManager {
             details,
             status: 'pending',
             createdAt: Date.now(),
+            nonce,
         };
         this.transactions.set(id, tx);
         return tx;

package/dist/packages/core/src/gateway/server.js

@@ -44,6 +44,12 @@ const skillManager_1 = require("../utils/skillManager");
 const bridgeToken_1 = require("../web3/skills/bridgeToken");
 const mintNft_1 = require("../web3/skills/mintNft");
 const customTx_1 = require("../web3/skills/customTx");
+const defiLending_1 = require("../web3/skills/defiLending");
+const revokeApprovals_1 = require("../web3/skills/revokeApprovals");
+const yieldVault_1 = require("../web3/skills/yieldVault");
+const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
+const getTxHistory_1 = require("../web3/skills/getTxHistory");
+const checkRegistryStatus_1 = require("../web3/skills/checkRegistryStatus");
 // System Skills
 const browseWeb_1 = require("../system/skills/browseWeb");
 const executeShell_1 = require("../system/skills/executeShell");
@@ -51,12 +57,15 @@ const installSkill_1 = require("../system/skills/installSkill");
 const readFile_1 = require("../system/skills/readFile");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const writeFile_1 = require("../system/skills/writeFile");
+const generateExcel_1 = require("../system/skills/generateExcel");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
 const searchWeb_1 = require("../system/skills/searchWeb");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
 const telegram_1 = require("./telegram");
 const googleAuthModule_1 = require("./googleAuthModule");
 const legalGenerator_1 = require("./legalGenerator");
+const episodic_1 = require("../memory/episodic");
+const reflection_1 = require("../memory/reflection");
 // Initialize Google Auth
 (0, googleAuthModule_1.initGoogleAuth)();
 const util_1 = __importDefault(require("util"));
@@ -109,14 +118,22 @@ app.use('/api', (req, res, next) => {
         return next();
     }
     const token = req.headers['x-nyxora-token'];
-    if (token !== (0, state_1.getSessionToken)()) {
-        console.error(`[Auth] Rejected ${req.method} ${req.originalUrl} - Expected: ${(0, state_1.getSessionToken)().substring(0, 8)}... Received: ${token ? token.toString().substring(0, 8) + '...' : 'undefined'}`);
+    const validation = (0, state_1.validateToken)(token);
+    if (!validation.valid) {
+        console.error(`[Auth] Rejected ${req.method} ${req.originalUrl} - Received invalid token.`);
         return res.status(401).json({ error: `Unauthorized: Invalid or missing token.` });
     }
     next();
 });
 // Serve Static Dashboard
-const dashboardPath = path_1.default.resolve(process.cwd(), 'packages/dashboard/dist');
+let rootDir = __dirname;
+while (!fs_1.default.existsSync(path_1.default.join(rootDir, 'packages', 'dashboard'))) {
+    const nextDir = path_1.default.dirname(rootDir);
+    if (nextDir === rootDir || rootDir === '/' || rootDir === 'C:\\')
+        break;
+    rootDir = nextDir;
+}
+const dashboardPath = path_1.default.join(rootDir, 'packages', 'dashboard', 'dist');
 app.use(express_1.default.static(dashboardPath));
 app.get('/', (req, res) => {
     res.sendFile(path_1.default.join(dashboardPath, 'index.html'));
@@ -260,7 +277,12 @@ app.get('/api/skills', (req, res) => {
         manageCustomTokens_1.manageCustomTokensDefinition,
         limitOrderManager_2.createLimitOrderToolDefinition,
         limitOrderManager_2.listLimitOrdersToolDefinition,
-        limitOrderManager_2.cancelLimitOrderToolDefinition
+        limitOrderManager_2.cancelLimitOrderToolDefinition,
+        defiLending_1.aaveSupplyToolDefinition,
+        revokeApprovals_1.revokeApprovalToolDefinition,
+        yieldVault_1.vaultDepositToolDefinition,
+        provideLiquidity_1.provideLiquidityToolDefinition,
+        getTxHistory_1.getTxHistoryToolDefinition
     ];
     const skillsWithStatus = allSkills.map(skill => ({
         ...skill,
@@ -273,6 +295,7 @@ app.get('/api/skills/system', (req, res) => {
         executeShell_1.runTerminalCommandToolDefinition,
         readFile_1.readLocalFileToolDefinition,
         writeFile_1.writeLocalFileToolDefinition,
+        generateExcel_1.generateExcelToolDefinition,
         browseWeb_1.browseWebsiteToolDefinition,
         updateSecurityPolicy_1.updateSecurityPolicyToolDefinition,
         installSkill_1.installExternalSkillToolDefinition,
@@ -333,16 +356,37 @@ app.delete('/api/auth/google', async (req, res) => {
     const success = await (0, googleAuthModule_1.logoutGoogle)();
     res.json({ success });
 });
+let lastUnlockRequest = 0;
+app.post('/api/status/unlock', (req, res) => {
+    lastUnlockRequest = Date.now();
+    res.json({ success: true });
+});
+app.get('/api/status/lock', (req, res) => {
+    res.json({ lastUnlockRequest });
+});
 app.get('/api/transactions', (req, res) => {
     res.json(transactionManager_1.txManager.getPending());
 });
 app.post('/api/transactions/:id/approve', async (req, res) => {
     try {
         const id = req.params.id;
-        const { sessionId } = req.body || {};
+        const { sessionId, nonce } = req.body || {};
         const tx = transactionManager_1.txManager.getTransaction(id);
         if (!tx || tx.status !== 'pending')
             return res.status(404).json({ error: 'Transaction not found or not pending' });
+        if (tx.nonce !== nonce) {
+            return res.status(403).json({ error: 'Invalid or missing nonce. Replay attack detected.' });
+        }
+        // --- Arbitrum Registry Kill-Switch Interceptor ---
+        const registryCheck = await (0, checkRegistryStatus_1.checkRegistryStatus)();
+        if (!registryCheck.isActive) {
+            transactionManager_1.txManager.updateStatus(id, 'failed', registryCheck.reason);
+            reasoning_1.logger.addEntry({ role: 'assistant', content: `❌ **Security Blocked:** ${registryCheck.reason}` }, sessionId);
+            return res.status(403).json({ error: `[On-Chain Policy] ${registryCheck.reason}` });
+        }
+        // ------------------------------------------------
+        // Invalidate the nonce immediately to prevent replay
+        tx.nonce = 'used_' + Date.now();
         transactionManager_1.txManager.updateStatus(id, 'approved', 'Executing on-chain...');
         res.json({ success: true, status: 'processing', message: 'Transaction submitted to background processing.' });
         // Execute in background
@@ -592,6 +636,17 @@ app.get('/api/portfolio', async (req, res) => {
         res.status(500).json({ error: err.message });
     }
 });
+// --- Memory Triggers ---
+let messageCounter = 0;
+let idleTimer = null;
+function resetIdleTimer() {
+    if (idleTimer)
+        clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => {
+        console.log('[Memory] Idle trigger activated. Running Reflection Engine...');
+        reflection_1.ReflectionEngine.runReflection();
+    }, 3 * 60 * 1000); // 3 minutes idle
+}
 app.post('/api/chat', async (req, res) => {
     try {
         const { message, session_id } = req.body;
@@ -600,12 +655,45 @@ app.post('/api/chat', async (req, res) => {
         }
         // Process input (this will automatically add to memory)
         const response = await (0, reasoning_1.processUserInput)(message, 'user', undefined, session_id);
+        // Memory Triggers
+        resetIdleTimer();
+        messageCounter++;
+        if (messageCounter >= 5) {
+            console.log('[Memory] N-Message threshold reached. Running Reflection Engine...');
+            messageCounter = 0;
+            // Run asynchronously
+            reflection_1.ReflectionEngine.runReflection();
+        }
         res.json({ response });
     }
     catch (error) {
         res.status(500).json({ error: error.message });
     }
 });
+// --- Memory API Endpoints ---
+app.get('/api/memory', (req, res) => {
+    try {
+        const memories = episodic_1.episodicDB.getMemories();
+        res.json(memories);
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
+app.delete('/api/memory/:id', (req, res) => {
+    try {
+        const id = parseInt(req.params.id, 10);
+        episodic_1.episodicDB.deleteMemory(id);
+        // When memory is deleted manually, trigger promotion engine to resync user.md
+        // To avoid circular dependency inside server.ts, we import here or assume it updates next cycle
+        const { PromotionEngine } = require('../memory/promotionEngine');
+        PromotionEngine.runPromotionAndDecay();
+        res.json({ success: true });
+    }
+    catch (error) {
+        res.status(500).json({ error: error.message });
+    }
+});
 // Fallback for React Router (Single Page Application)
 app.use((req, res, next) => {
     if (req.method === 'GET' && !req.path.startsWith('/api')) {
@@ -652,11 +740,36 @@ function startServer() {
     });
     limitOrderManager_1.limitOrderManager.startMonitor();
     const PORT = Number(process.env.PORT || 3000);
-    app.listen(PORT, '0.0.0.0', () => {
+    const server = app.listen(PORT, '0.0.0.0', () => {
         console.log(`🤖 Nyxora API Server running on port ${PORT}`);
         // Start the Telegram bot listener
         (0, telegram_1.startTelegramBot)();
     });
+    server.on('error', (e) => {
+        if (e.code === 'EADDRINUSE') {
+            console.error(`[Nyxora Gateway] Port ${PORT} is already in use. Is Nyxora already running?`);
+            process.exit(1);
+        }
+        else {
+            console.error(`[Nyxora Gateway] Server error:`, e);
+            process.exit(1);
+        }
+    });
+    const gracefulShutdown = () => {
+        console.log('[Nyxora Gateway] Received shutdown signal. Closing server...');
+        server.close(() => {
+            console.log('[Nyxora Gateway] HTTP server closed.');
+            reasoning_1.logger.close();
+            process.exit(0);
+        });
+        // Force exit after 10s if stuck
+        setTimeout(() => {
+            console.error('[Nyxora Gateway] Forced shutdown after 10s.');
+            process.exit(1);
+        }, 10000);
+    };
+    process.on('SIGTERM', gracefulShutdown);
+    process.on('SIGINT', gracefulShutdown);
 }
 // Start server if this file is run directly
 if (require.main === module) {

package/dist/packages/core/src/gateway/setup.js

@@ -231,6 +231,9 @@ Provider: ${config.llm.provider}`;
             { value: 'optimism', label: 'OP Mainnet' },
             { value: 'polygon', label: 'Polygon (Matic)' },
             { value: 'sepolia', label: 'Sepolia (Testnet)' },
+            { value: 'base_sepolia', label: 'Base Sepolia (Testnet)' },
+            { value: 'arbitrum_sepolia', label: 'Arbitrum Sepolia (Testnet)' },
+            { value: 'optimism_sepolia', label: 'OP Sepolia (Testnet)' },
         ],
     });
     if ((0, prompts_1.isCancel)(defaultChain))