nyxora 26.6.9 → 26.6.11-2

package/README.md

@@ -2,6 +2,7 @@
 **Your Personal Web3 Assistant.**
 
 
+[![Built on Arbitrum](https://img.shields.io/badge/Built_on-Arbitrum-28A0F0?style=flat&logo=arbitrum&logoColor=white)](https://arbitrum.io/)
 [![MCP Supported](https://img.shields.io/badge/MCP-Supported-blue.svg)](#)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Security: Production-Grade](https://img.shields.io/badge/Security-Production--Grade-blue.svg)](#️-advanced-security-threat-model)
@@ -19,7 +20,9 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 ## 🔥 Key Features
 
 ### Advanced Security Architecture
+*   **🛡️ On-Chain AI Kill-Switch**: Nyxora is governed by an Arbitrum Smart Contract (`NyxoraAgentRegistry`). Users have absolute cryptographic power to instantly paralyze the AI's on-chain execution if compromised, solving the Web3 AI safety dilemma. [Read more about our Arbitrum Architecture ->](https://nyxoraai.github.io/Nyxora/security/smart-contract)
 *   **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
+*   **DeFi Configuration BYOK & UI Masking**: All aggregator and provider API keys are strictly isolated via a Bring Your Own Keys (BYOK) architecture into a heavily guarded `~/.nyxora/defi_keys.yaml` file. The local web Dashboard masks these injected secrets using `***********` and `IS_SET` censorship, completely neutralizing malicious browser extensions from exfiltrating your keys.
 *   **Approval Replay Protection (Nonce Guard)**: Transactions requested by the AI are drafted as hashes and signed with a randomized 16-byte Nonce. The `/api/transactions/:id/approve` endpoint strictly enforces Nonce matching to completely eliminate double-spending and Replay Attacks.
 *   **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
 *   **Plugin Sandbox VM**: Execute community-built external skills securely inside an airtight Node.js `vm` chamber with zero access to your file system or terminal processes.
@@ -27,17 +30,27 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
 
 ### 🌐 Web3 Skills (On-Chain)
 *   **Security Scanner**: Nyxora can scan smart contracts via GoPlus Labs to detect Honeypots, Hidden Taxes, and malicious proxy upgrades before you buy.
-*   **Anti-MEV Slippage Protection**: Hardened routing engine with dynamic Slippage Tolerance (default 0.5%) for Relay and Li.Fi. You can manually adjust slippage via the UI or dynamically override it using natural language (e.g., "Swap 1 ETH to PEPE with 10% slippage").
-*   **Automated Take Profit (TP) & Cut Loss (CL)**: The trader's holy grail. Set natural language rules (e.g., "Sell my PEPE if price drops below $0.001"). Nyxora runs a background cron monitor and executes the swap while you sleep.
+*   **Advanced DeFi Optimization**: Autonomously supply assets to Aave V3, deposit into Beefy/Yearn Auto-Compounder Vaults, manage Uniswap V3 Liquidity (LP), and instantly revoke infinite approvals to secure your wallet. Features intelligent Transaction Chaining to auto-approve allowances prior to execution.
+*   **6-Engine Meta-Aggregator & Anti-MEV**: The core engine interfaces with a powerful 6-Engine Meta-Aggregator (**1inch, 0x, LI.FI, Relay, OpenOcean, and KyberSwap**) to route tokens cross-chain, ensuring absolute maximum liquidity depth.
+*   **Adaptive Auto Slippage Protection**: Nyxora enforces a dynamic and adaptive **'auto' slippage** by default to leverage dynamic MEV-protection from these enterprise aggregators. However, the user retains absolute control to override this dynamically—either globally via the Dashboard Settings or on a per-transaction basis through NLP chat commands (e.g., *"Swap 1 ETH to PEPE with 10% slippage"*).
+
 *   **Cross-Chain Hybrid Market Scanner**: Real-time asset tracking combining CoinGecko global data with DexScreener on-chain metrics across Ethereum, Base, Solana, BSC, and more.
 *   **"Lean Degen" Auto-Whitelist**: Automatically intercepts Contract Addresses (CAs) whenever you check balances or swap tokens, saving them to your localized `user_whitelist.json` for future tracking.
 *   **Dynamic Portfolio Engine**: Merges standard tokens, your custom Degen CAs, and CoinGecko's daily trending list into a single hyper-fast Multicall scan to deliver a clean, spam-free PnL portfolio report in under 1 second.
+*   **Deep Transaction History**: Accurately fetch your 30-day (or custom timeframe) Native and ERC-20 transaction history across all supported EVM chains. Powered by the Unified Etherscan API V2, enabling seamless cross-chain fetching (Mainnets & Testnets) using a single API key.
 
 ### 💻 OS & Web2 Skills (Off-Chain)
 *   **Google Workspace Automation 🚀**: Transform Nyxora into your ultimate personal assistant. The agent can read your latest Gmail inbox, check your Google Calendar, extract text from Google Docs, and even append expense/trading logs directly to your Google Sheets.
 *   **System Automation & Full OS Access**: Instruct the agent to read/write local files, run terminal commands, and browse the web natively.
+*   **Automated Excel Reporting**: Instruct the agent to compile its Web3 portfolio or transaction history findings and autonomously generate beautiful `.xlsx` spreadsheet reports saved directly to your local machine.
 *   **Unstoppable Synergy**: Combine both engines with a single prompt. Example: *"Read the latest presale token email from my Gmail, automatically set a Take Profit limit order on Uniswap, and log the execution result to my Google Sheets."*
 
+### 🧠 The Masterpiece Memory Architecture
+*   **4-Layer Air-Gapped Vault**: Nyxora features a god-tier memory system that completely isolates conversational habits from the OS Keyring. The AI can dynamically learn your behaviors without ever having physical read-paths to your private keys.
+*   **Hard-Coded Anti-Injection Shield**: We enforce a Zero-Trust memory paradigm. Before any user habit is saved to the local SQLite database, it must pass a strict RegExp-based validation layer that autonomously annihilates Private Keys, BIP-39 Seed Phrases, and Prompt Injection attempts.
+*   **Smart Suggestion Engine**: Nyxora actively queries its Layer-2 Episodic Database to seamlessly autocomplete your repetitive Web3 routines. If you always swap on Arbitrum using USDC, the AI will proactively suggest it, slashing human-in-the-loop latency by up to 90%.
+*   **Persistent Background Reflection**: Empowered by background idle timers and message-count thresholds, Nyxora quietly transcribes your habits into a permanent profile while you step away from the keyboard, ensuring it never forgets your identity even after daemon reboots.
+
 ### AI & UI Customization
 *   **Zero-Trust Auto-Lock (Passwordless)**: A sleek glassmorphism blur overlay automatically locks the dashboard during inactivity. Unlocking requires physical local execution via the CLI (`nyxora unlock`), preventing unauthorized local access.
 *   **Resilient UI (Reconnect Overlay)**: Built-in global network interceptors ensure that if the daemon restarts or crashes, the UI immediately pauses with a transparent "Offline" overlay and seamlessly resumes your workflow once revived.
@@ -61,6 +74,12 @@ The following diagram illustrates Nyxora's **3-Tier Monorepo Architecture**, sho
 2. **🛡️ Policy Engine (The Guard)**: The security guard that verifies the Brain's plans. If the AI attempts to send funds exceeding your set limits, this engine automatically blocks it.
 3. **🔒 Signer Vault (The Safe)**: The offline vault where your Private Keys **and highly sensitive 3rd-party tokens (e.g., Google Workspace OAuth)** are securely locked natively in your OS Keyring (GNOME Keyring / macOS Keychain / Windows Credential Manager). It only signs transactions after they pass all rigorous security checks.
 
+### Web3 Separation of Concerns (Zero-Trust Routing)
+Within the AI Brain, the Web3 codebase is strictly divided to prevent the LLM from hallucinating or maliciously manipulating low-level routing paths:
+- **`aggregator/`**: The core routing engine (1inch, 0x, KyberSwap, etc.) immune to prompt injection. The AI cannot modify execution rules here.
+- **`skills/`**: The execution muscles. Pure functions and tools explicitly exposed to the AI for usage.
+- **`utils/`**: The nervous system managing blockchain configurations, supported tokens, and the RPC Engine.
+
 *(Note: Despite the multi-layered security process appearing lengthy, the internal system validation and cryptographic signing occurs in **milliseconds**, ensuring zero latency bottlenecks).*
 
 ---
@@ -71,7 +90,7 @@ To dive deeper into the technical details of our Zero-Knowledge security archite
 
 ---
 
-## 🚀 Quick Start & Installation
+## 1. 🚀 Quick Start & Installation
 
 ### Global Installation via NPM (Recommended)
 The easiest and fastest way to use Nyxora is to install it globally via NPM. This ensures you get the latest version and can run Nyxora from anywhere on your machine.

package/dist/launcher.js

@@ -9,6 +9,9 @@ const child_process_1 = require("child_process");
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const dns_1 = __importDefault(require("dns"));
+// Fix Node 18+ native fetch randomly failing on dual-stack VPS (IPv6 issues)
+dns_1.default.setDefaultResultOrder('ipv4first');
 const INTERNAL_AUTH_TOKEN = crypto_1.default.randomBytes(64).toString('hex');
 console.log(`[Launcher] Generated Internal Auth Token: ${INTERNAL_AUTH_TOKEN.substring(0, 8)}...`);
 const nyxoraDir = path_1.default.join(process.env.HOME || process.env.USERPROFILE || '', '.nyxora');

package/dist/packages/core/src/agent/limitOrderManager.js

@@ -8,10 +8,7 @@ const fs_1 = __importDefault(require("fs"));
 const parser_1 = require("../config/parser");
 const paths_1 = require("../config/paths");
 const config_1 = require("../web3/config");
-const tokens_1 = require("../web3/utils/tokens");
-const swapToken_1 = require("../web3/skills/swapToken");
 const transactionManager_1 = require("./transactionManager");
-const reasoning_1 = require("./reasoning");
 class LimitOrderManager {
     filePath;
     orders = [];
@@ -40,12 +37,17 @@ class LimitOrderManager {
     }
     createOrder(chainName, fromToken, toToken, amountStr, targetPriceUsd, condition) {
         const id = `order_${Date.now()}_${Math.random().toString(36).substr(2, 5)}`;
-        const order = {
-            id, chainName, fromToken, toToken, amountStr, targetPriceUsd, condition, status: 'pending', createdAt: Date.now()
+        const txDetails = {
+            id,
+            fromToken,
+            toToken,
+            amountStr,
+            targetPriceUsd,
+            condition
         };
-        this.orders.push(order);
-        this.saveOrders();
-        return `Limit order created successfully. ID: ${id}. The system will monitor ${fromToken} price on ${chainName} and execute the swap to ${toToken} when price is ${condition} $${targetPriceUsd}.`;
+        // Instead of saving directly, we push it to txManager to trigger the Approval Gate UX
+        transactionManager_1.txManager.createPendingTransaction('limit_order', chainName, txDetails);
+        return `Prepared limit order: Sell ${amountStr} ${fromToken} for ${toToken} when price is ${condition} $${targetPriceUsd}. I have pushed this to the Transaction Manager. Please wait for user approval on the Dashboard/Telegram. Do not say it's created yet.`;
     }
     listOrders() {
         const pending = this.orders.filter(o => o.status === 'pending');
@@ -58,6 +60,8 @@ class LimitOrderManager {
         return report;
     }
     cancelOrder(id) {
+        // Note: To truly cancel a 1inch limit order, we need to call 1inch API to cancel the hash.
+        // For now, we mark it cancelled locally.
         const order = this.orders.find(o => o.id === id);
         if (!order)
             return `Order ${id} not found.`;
@@ -65,74 +69,16 @@ class LimitOrderManager {
             return `Order ${id} cannot be cancelled because it is ${order.status}.`;
         order.status = 'cancelled';
         this.saveOrders();
-        return `Order ${id} cancelled successfully.`;
+        return `Order ${id} cancelled successfully locally.`;
     }
+    // Polling logic removed as per Phase 2 Migration to 1inch Off-Chain Protocol
     startMonitor() {
-        if (this.monitorInterval)
-            clearInterval(this.monitorInterval);
-        // Monitor every 60 seconds
-        this.monitorInterval = setInterval(() => this.checkOrders(), 60000);
-        console.log('[LimitOrderManager] Order monitoring started (interval: 60s)');
+        console.log('[LimitOrderManager] Local polling disabled. Delegating to 1inch Limit Order Protocol.');
     }
-    async checkOrders() {
-        const pending = this.orders.filter(o => o.status === 'pending');
-        if (pending.length === 0)
-            return;
-        for (const order of pending) {
-            try {
-                let tokenAddress = (0, tokens_1.resolveToken)(order.fromToken, order.chainName);
-                if (tokenAddress === "0x0000000000000000000000000000000000000000") {
-                    tokenAddress = (0, tokens_1.resolveToken)("W" + order.fromToken, order.chainName);
-                }
-                const res = await fetch(`https://api.dexscreener.com/latest/dex/tokens/${tokenAddress}`);
-                if (!res.ok)
-                    continue;
-                const data = await res.json();
-                if (!data.pairs || data.pairs.length === 0)
-                    continue;
-                let pair = data.pairs.find((p) => p.chainId === order.chainName) || data.pairs[0];
-                const currentPrice = parseFloat(pair.priceUsd);
-                let shouldExecute = false;
-                if (order.condition === 'above' && currentPrice >= order.targetPriceUsd)
-                    shouldExecute = true;
-                if (order.condition === 'below' && currentPrice <= order.targetPriceUsd)
-                    shouldExecute = true;
-                if (shouldExecute) {
-                    console.log(`[LimitOrderManager] Condition met for order ${order.id}. Current price $${currentPrice} is ${order.condition} $${order.targetPriceUsd}. Executing...`);
-                    // 1. Prepare Swap
-                    const prepareResult = await (0, swapToken_1.prepareSwapToken)(order.chainName, order.fromToken, order.toToken, order.amountStr, 'auto');
-                    // 2. Extract Tx ID
-                    const txMatch = prepareResult.match(/Transaction ID: ([\w-]+)\./);
-                    if (!txMatch) {
-                        order.status = 'failed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} execution failed during preparation. Output: ${prepareResult}`, 'system').catch(() => { });
-                        continue;
-                    }
-                    const txId = txMatch[1];
-                    const tx = transactionManager_1.txManager.getTransaction(txId);
-                    if (!tx)
-                        throw new Error("Transaction not found in manager");
-                    // 3. Execute Swap automatically (bypass policy with autoApprove: true)
-                    const executeResult = await (0, swapToken_1.executeSwap)(order.chainName, tx.details, true);
-                    if (executeResult.includes('executed') || executeResult.includes('successful')) {
-                        transactionManager_1.txManager.updateStatus(txId, 'executed', executeResult);
-                        order.status = 'executed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} just EXECUTED automatically! Price hit $${currentPrice}. Swap result: ${executeResult}. Please notify the user immediately!`, 'system').catch(() => { });
-                    }
-                    else {
-                        transactionManager_1.txManager.updateStatus(txId, 'failed', executeResult);
-                        order.status = 'failed';
-                        this.saveOrders();
-                        (0, reasoning_1.processUserInput)(`Limit order ${order.id} FAILED to execute. Price hit $${currentPrice} but execution failed: ${executeResult}. Please notify the user.`, 'system').catch(() => { });
-                    }
-                }
-            }
-            catch (error) {
-                console.error(`[LimitOrderManager] Error checking order ${order.id}:`, error.message);
-            }
-        }
+    // We can add a method to save the 1inch hash after the user approves it
+    recordApprovedOrder(orderMetadata) {
+        this.orders.push(orderMetadata);
+        this.saveOrders();
     }
 }
 exports.LimitOrderManager = LimitOrderManager;

package/dist/packages/core/src/agent/reasoning.js

@@ -4,12 +4,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logger = void 0;
+exports.getOpenAI = getOpenAI;
 exports.processUserInput = processUserInput;
 const fs_1 = __importDefault(require("fs"));
 const openai_1 = require("openai");
 const parser_1 = require("../config/parser");
 const logger_1 = require("../memory/logger");
 const tracker_1 = require("../gateway/tracker");
+const episodic_1 = require("../memory/episodic");
 const getBalance_1 = require("../web3/skills/getBalance");
 const transfer_1 = require("../web3/skills/transfer");
 const getPrice_1 = require("../web3/skills/getPrice");
@@ -18,23 +20,33 @@ const bridgeToken_1 = require("../web3/skills/bridgeToken");
 const skillManager_1 = require("../utils/skillManager");
 const mintNft_1 = require("../web3/skills/mintNft");
 const customTx_1 = require("../web3/skills/customTx");
-const createWallet_1 = require("../web3/skills/createWallet");
 const checkSecurity_1 = require("../web3/skills/checkSecurity");
 const marketAnalysis_1 = require("../web3/skills/marketAnalysis");
 const checkPortfolio_1 = require("../web3/skills/checkPortfolio");
 const checkAddress_1 = require("../web3/skills/checkAddress");
 const getMyAddress_1 = require("../web3/skills/getMyAddress");
 const manageCustomTokens_1 = require("../web3/skills/manageCustomTokens");
-const limitOrderManager_1 = require("./limitOrderManager");
+const revokeApprovals_1 = require("../web3/skills/revokeApprovals");
+const defiLending_1 = require("../web3/skills/defiLending");
+const yieldVault_1 = require("../web3/skills/yieldVault");
+const provideLiquidity_1 = require("../web3/skills/provideLiquidity");
+const getTxHistory_1 = require("../web3/skills/getTxHistory");
 const updateProfile_1 = require("./updateProfile");
 const updateSecurityPolicy_1 = require("../system/skills/updateSecurityPolicy");
 const analyzeDocument_1 = require("../system/skills/analyzeDocument");
 const readFile_1 = require("../system/skills/readFile");
 const writeFile_1 = require("../system/skills/writeFile");
+const generateExcel_1 = require("../system/skills/generateExcel");
 const executeShell_1 = require("../system/skills/executeShell");
 const browseWeb_1 = require("../system/skills/browseWeb");
 const searchWeb_1 = require("../system/skills/searchWeb");
 const installSkill_1 = require("../system/skills/installSkill");
+const editFile_1 = require("../system/skills/editFile");
+const gitManager_1 = require("../system/skills/gitManager");
+const xManager_1 = require("../system/skills/xManager");
+const notionWorkspace_1 = require("../system/skills/notionWorkspace");
+const audioTranscribe_1 = require("../system/skills/audioTranscribe");
+const summarizeText_1 = require("../system/skills/summarizeText");
 const googleWorkspace_1 = require("../system/skills/googleWorkspace");
 const pluginManager_1 = require("../system/pluginManager");
 const paths_1 = require("../config/paths");
@@ -115,16 +127,21 @@ You are equipped with a native wallet.
 The current real-world date and time is: ${currentDateTime}. Use this for any time-related questions.
 
 CRITICAL RULE 1: NEVER expose internal JSON tool calls to the user. Always parse them and explain the outcome naturally.
-CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt. If the user's latest prompt is in English, you MUST reply entirely in English, completely ignoring the language of previous messages. If their latest prompt is in Indonesian, reply in Indonesian.
-CRITICAL RULE 3: FORMATTING & CONCISENESS. 
-  - Your responses MUST be concise and to the point. Do not add unnecessary fluff or overly long explanations unless explicitly asked.
-  - When displaying numbers or monetary values, separate thousands with commas (e.g., $1,000,000) for readability.
-  - When displaying a list of assets, tokens, portfolio, or transaction history, YOU MUST USE MARKDOWN TABLES. Do not use bullet points for financial data.
-CRITICAL RULE 4: When the user asks to check "my balance", "saldo saya", or anything about their own wallet generally, ALWAYS use the check_portfolio tool to show all assets on the chain that have a USD value greater than 0. LEAVE THE ADDRESS PARAMETER EMPTY. Do NOT use get_balance unless the user explicitly asks for the balance of ONE specific token.
-CRITICAL RULE 5: If the user doesn't specify a chain, default to: ${config.agent.default_chain}. If the user mentions a specific chain (e.g., "on BNB", "di Base"), you MUST override the default and execute the tool on that specific chain. For transactions that require two chains (like bridge_token), if the user only provides the destination chain, you MUST automatically use ${config.agent.default_chain} as the source chain (fromChainName) without asking for clarification.
-CRITICAL RULE 6: If you use the default chain because the user forgot to specify one, you MUST politely confirm which chain you checked in your response (e.g., "I checked your balance on the ${config.agent.default_chain} network..."). Do not issue scary warnings.
-CRITICAL RULE 7: TOOL PRIORITIZATION. When the user asks about crypto prices, market analysis, token security, or blockchain data, YOU MUST prioritize using the dedicated Web3 skills (e.g., get_price, analyze_market, check_security) FIRST. Only if those tools fail or cannot provide the requested information, you may fallback to using search_web.
-CRITICAL RULE 8: EXACTNESS AND SAFETY IN TRANSACTIONS. Never guess or hallucinate token symbols, network chains, or amounts for Web3 transactions. If the user's intent is ambiguous, you MUST politely ask for clarification instead of attempting a potentially risky transaction. Before confirming any swap or bridge, reiterate the exact tokens, chains, and amounts.`;
+CRITICAL RULE 2: STRICT LANGUAGE MATCHING. You MUST strictly reply in the exact same language as the user's LATEST prompt.
+CRITICAL RULE 3: FORMATTING & CONCISENESS. Be concise. Use markdown tables for lists of assets/transactions. Use commas for thousands.
+CRITICAL RULE 4: TOOL PRIORITIZATION. Web3 tasks must use Web3 Skills exclusively. OS Skills (search, browse) are fallbacks only. Use get_my_address to show wallet address, and check_portfolio to show balances.
+CRITICAL RULE 5: DEFAULT CHAIN HANDLING. Default to: ${config.agent.default_chain} unless specified. If overridden, confirm the chain politely. For 2-chain txs (bridge), default source to ${config.agent.default_chain}.
+CRITICAL RULE 6: NETWORK SAFETY VALIDATION. If a request implies cross-chain or mainnet/testnet mixing, or the token symbol is ambiguous (USDC vs USDC.e), YOU MUST NOT GUESS. Ask for confirmation.
+CRITICAL RULE 7: TOOL CONFIDENCE & HALUCINATION PREVENTION. NEVER fabricate blockchain data. If a tool fails or data is missing, state it explicitly. Do not estimate balances, prices, APY, or gas.
+CRITICAL RULE 8: CONDITIONAL PARALLEL EXECUTION. Parallel tool execution is ONLY allowed if there are zero data dependencies between them.
+CRITICAL RULE 9: DEFI CONFIGURATION FALLBACK. If a tool fails due to Rate Limits, Unauthorized, or Missing API Keys, instruct the user to visit the "DeFi Configuration 🔑" menu in the dashboard.
+CRITICAL RULE 10: PLANNING & RISK DISCLOSURE. For high-level instructions (e.g. "Get yield"), formulate a plan and briefly disclose major risks (smart contract risk, impermanent loss) before asking for approval.
+CRITICAL RULE 11: FAST RETURN RULE. If parameters for read-only tools are complete, execute them IMMEDIATELY without preamble or conversational filler.
+CRITICAL RULE 12: SMART SLIPPAGE AWARENESS. For low-liquidity assets, warn the user that default slippage might not be enough. NEVER invent specific slippage percentage numbers.
+CRITICAL RULE 13: WALLET CONTEXT CACHING. Portfolio data in chat history is potentially stale. Do not use cached data for transactional planning; refresh the balance via tools first.
+CRITICAL RULE 14: TRANSACTION EXECUTION. For ALL state-changing transactions (swap, bridge, transfer, stake), do NOT ask for verbal confirmation. Execute the tool IMMEDIATELY. The tool itself will trigger a secure popup in the user's dashboard UI for final approval.
+CRITICAL RULE 16: CAPABILITY HONESTY. NEVER claim a capability not available through installed tools. If asked for an unsupported action, state honestly that the skill is missing.
+CRITICAL RULE 17: MINIMIZE UNNECESSARY TOOL CALLS. Do not call tools if the answer exists in recent verified context and freshness is not strictly required. Use history to save latency.`;
     // Read IDENTITY.md for core AI persona
     try {
         const identityMdPath = (0, paths_1.getPath)('IDENTITY.md');
@@ -158,6 +175,19 @@ CRITICAL RULE 8: EXACTNESS AND SAFETY IN TRANSACTIONS. Never guess or hallucinat
     catch (error) {
         console.error('Failed to read security_policy.md:', error);
     }
+    // Inject Episodic Memories (Smart Suggestions Context)
+    try {
+        const recentMemories = episodic_1.episodicDB.getMemories().slice(0, 10);
+        if (recentMemories.length > 0) {
+            basePrompt += `\n\n--- EPISODIC MEMORIES (SMART SUGGESTIONS) ---\nUse these recent observations to proactively suggest or autocomplete parameters (like networks or tokens) without asking the user if they align with the current request:\n`;
+            recentMemories.forEach(mem => {
+                basePrompt += `- [${mem.category.toUpperCase()}] ${mem.fact} (Confidence: ${(mem.confidence * 100).toFixed(0)}%)\n`;
+            });
+        }
+    }
+    catch (error) {
+        // Ignore db errors if not initialized
+    }
     return basePrompt;
 }
 async function processUserInput(input, role = 'user', onProgress, sessionId) {
@@ -188,25 +218,26 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
         if (config.llm.provider !== 'openai' && config.llm.provider !== 'ollama' && config.llm.provider !== 'gemini' && config.llm.provider !== 'openrouter') {
             return `Provider ${config.llm.provider} is configured, but currently only OpenAI, OpenRouter, Ollama, and Gemini adapters are implemented.`;
         }
-        // --- v1.7.4 Semantic Keyword Router ---
         const lowerInput = input.toLowerCase();
         const hasWeb3Keyword = /swap|transfer|price|token|crypto|bridge|wallet|balance|portfolio|buy|sell|send|receive|address|market|limit|mint|nft/i.test(lowerInput);
         const hasGoogleKeyword = /email|gmail|calendar|sheet|doc|form|event/i.test(lowerInput);
-        const WEB3_TOOLS = [getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, createWallet_1.createWalletToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, limitOrderManager_1.createLimitOrderToolDefinition, limitOrderManager_1.listLimitOrdersToolDefinition, limitOrderManager_1.cancelLimitOrderToolDefinition];
-        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition];
+        let tools = [];
+        if ((0, skillManager_1.isSkillActive)('web3')) {
+            tools.push(getBalance_1.getBalanceToolDefinition, transfer_1.transferToolDefinition, getPrice_1.getPriceToolDefinition, swapToken_1.swapTokenToolDefinition, bridgeToken_1.bridgeTokenToolDefinition, mintNft_1.mintNftToolDefinition, customTx_1.customTxToolDefinition, checkSecurity_1.checkSecurityToolDefinition, marketAnalysis_1.marketAnalysisToolDefinition, checkPortfolio_1.checkPortfolioToolDefinition, checkAddress_1.checkAddressToolDefinition, getMyAddress_1.getMyAddressToolDefinition, manageCustomTokens_1.manageCustomTokensDefinition, revokeApprovals_1.revokeApprovalToolDefinition, defiLending_1.aaveSupplyToolDefinition, yieldVault_1.vaultDepositToolDefinition, provideLiquidity_1.provideLiquidityToolDefinition, getTxHistory_1.getTxHistoryToolDefinition);
+        }
+        const SYSTEM_TOOLS = [updateProfile_1.updateProfileToolDefinition, updateSecurityPolicy_1.updateSecurityPolicyToolDefinition, analyzeDocument_1.analyzeDocumentToolDefinition, readFile_1.readLocalFileToolDefinition, writeFile_1.writeLocalFileToolDefinition, generateExcel_1.generateExcelToolDefinition, executeShell_1.runTerminalCommandToolDefinition, browseWeb_1.browseWebsiteToolDefinition, searchWeb_1.searchWebToolDefinition, installSkill_1.installExternalSkillToolDefinition, editFile_1.editLocalFileToolDefinition, gitManager_1.gitManagerToolDefinition, xManager_1.xManagerToolDefinition, notionWorkspace_1.notionWorkspaceToolDefinition, audioTranscribe_1.audioTranscribeToolDefinition, summarizeText_1.summarizeTextToolDefinition];
         const GOOGLE_TOOLS = [googleWorkspace_1.readGmailInboxToolDefinition, googleWorkspace_1.listCalendarEventsToolDefinition, googleWorkspace_1.appendRowToSheetsToolDefinition, googleWorkspace_1.readGoogleDocsToolDefinition, googleWorkspace_1.readGoogleFormResponsesToolDefinition];
         let activeTools = [];
         if (hasGoogleKeyword && !hasWeb3Keyword) {
             activeTools = [...GOOGLE_TOOLS, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         else if (hasWeb3Keyword && !hasGoogleKeyword) {
-            activeTools = [...WEB3_TOOLS, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         else {
-            activeTools = [...WEB3_TOOLS, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
+            activeTools = [...tools, ...SYSTEM_TOOLS, ...GOOGLE_TOOLS, ...pluginManager_1.pluginManager.getToolDefinitions()];
         }
         activeTools = activeTools.filter(t => (0, skillManager_1.isSkillActive)(t.function.name));
-        // ----------------------------------------
         const response = await executeWithRetry(async (client) => {
             return await client.chat.completions.create({
                 model: config.llm.model,
@@ -217,20 +248,23 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
             });
         });
         const responseMessage = response.choices[0].message;
-        // Log tracking
         tracker_1.Tracker.addMessage();
         if (response.usage?.total_tokens) {
             tracker_1.Tracker.addTokens(response.usage.total_tokens, config.llm.provider);
         }
         tracker_1.Tracker.addEvent('llm.response', { provider: config.llm.provider, tool_calls: responseMessage.tool_calls?.length || 0 });
-        // Log assistant response
         exports.logger.addEntry({
             role: 'assistant',
             content: responseMessage.content || "",
             tool_calls: responseMessage.tool_calls,
         }, sessionId);
-        // Check if the model wants to call a tool
         if (responseMessage.tool_calls && responseMessage.tool_calls.length > 0) {
+            let canFastReturnAll = true;
+            let accumulatedResults = [];
+            const fastReturnTools = [
+                'check_portfolio', 'check_address', 'get_price', 'get_my_address',
+                'analyze_market', 'check_token_security', 'search_web', 'read_gmail_inbox', 'list_calendar_events'
+            ];
             for (const _toolCall of responseMessage.tool_calls) {
                 const toolCall = _toolCall;
                 let result = "";
@@ -239,10 +273,8 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                 console.log(picocolors_1.default.yellow(`[⚡ Tool Execution] AI is calling ${toolName}...`));
                 if (onProgress)
                     onProgress(`_⚡ Running tool: ${toolName}..._`);
-                // Phase 1: LLM Output Validation (Anti-Halusinasi)
                 try {
                     args = JSON.parse(toolCall.function.arguments);
-                    // TODO: Zod schema validation could be injected here per-tool
                 }
                 catch (parseError) {
                     console.error(picocolors_1.default.red(`[LLM Validation Error] Invalid JSON arguments for ${toolName}: ${parseError.message}`));
@@ -252,7 +284,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                         tool_call_id: toolCall.id,
                         content: result
                     }, sessionId);
-                    // Let the second LLM call handle the explanation of the failure
                     continue;
                 }
                 try {
@@ -279,7 +310,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                                 result = `[Security Blocked] Runtime Permission Denied: Web3 swaps are disabled. Update config.yaml to allow.`;
                                 break;
                             }
-                            // Note: max_usd_per_tx validation would ideally be calculated here before prepareSwapToken
                             result = await (0, swapToken_1.prepareSwapToken)(args.chainName, args.fromToken, args.toToken, args.amountStr || args.amount, args.mode, args.providerName);
                             break;
                         }
@@ -288,7 +318,7 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                                 result = `[Security Blocked] Runtime Permission Denied: Web3 bridging (transfer) is disabled. Update config.yaml to allow.`;
                                 break;
                             }
-                            result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChainName, args.toChainName, args.fromToken, args.toToken, args.amountStr, args.mode, args.providerName);
+                            result = await (0, bridgeToken_1.prepareBridgeToken)(args.fromChain, args.toChain, args.tokenSymbol, args.amountStr, args.mode, args.providerName);
                             break;
                         }
                         case 'mint_nft': {
@@ -303,10 +333,6 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, customTx_1.prepareCustomTx)(args.chainName, args.toAddress, args.dataHex, args.valueEth, args.gasLimitStr);
                             break;
                         }
-                        case 'create_wallet': {
-                            result = await (0, createWallet_1.createWallet)();
-                            break;
-                        }
                         case 'check_token_security': {
                             result = await (0, checkSecurity_1.checkTokenSecurity)(args.chainName, args.contractAddress);
                             break;
@@ -331,20 +357,24 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = await (0, manageCustomTokens_1.executeManageCustomTokens)(args);
                             break;
                         }
-                        case 'create_limit_order': {
-                            if (config.permissions?.web3?.allow_swap === false) {
-                                result = `[Security Blocked] Runtime Permission Denied: Limit orders require swap permissions. Update config.yaml to allow.`;
-                                break;
-                            }
-                            result = limitOrderManager_1.limitOrderManager.createOrder(args.chainName, args.fromToken, args.toToken, args.amountStr, args.targetPriceUsd, args.condition);
+                        case 'revoke_approval': {
+                            result = await (0, revokeApprovals_1.prepareRevokeApproval)(args.chainName, args.tokenAddressOrSymbol, args.spenderAddress);
                             break;
                         }
-                        case 'list_limit_orders': {
-                            result = limitOrderManager_1.limitOrderManager.listOrders();
+                        case 'supply_aave': {
+                            result = await (0, defiLending_1.prepareAaveSupply)(args.chainName, args.tokenAddressOrSymbol, args.amountStr);
                             break;
                         }
-                        case 'cancel_limit_order': {
-                            result = limitOrderManager_1.limitOrderManager.cancelOrder(args.id);
+                        case 'deposit_yield_vault': {
+                            result = await (0, yieldVault_1.prepareVaultDeposit)(args.chainName, args.protocol || 'beefy', args.vaultAddress, args.tokenAddressOrSymbol, args.amountStr);
+                            break;
+                        }
+                        case 'provide_liquidity_v3': {
+                            result = await (0, provideLiquidity_1.prepareProvideLiquidity)(args.chainName, args.token0AddressOrSymbol, args.token1AddressOrSymbol, args.amount0Str, args.amount1Str, args.feeTier, args.tickLower, args.tickUpper);
+                            break;
+                        }
+                        case 'get_tx_history': {
+                            result = await (0, getTxHistory_1.getTxHistory)(args.chainName, args.address, args.days);
                             break;
                         }
                         case 'update_profile': {
@@ -360,7 +390,31 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             break;
                         }
                         case 'read_local_file': {
-                            result = (0, readFile_1.readLocalFile)(args.filePath);
+                            result = (0, readFile_1.readLocalFile)(args.filePath, args.startLine, args.endLine);
+                            break;
+                        }
+                        case 'edit_local_file': {
+                            result = (0, editFile_1.editLocalFile)(args.filePath, args.searchString, args.replacementString);
+                            break;
+                        }
+                        case 'execute_git_command': {
+                            result = await (0, gitManager_1.executeGitCommand)(args.action, args.commitMessage);
+                            break;
+                        }
+                        case 'manage_twitter': {
+                            result = await (0, xManager_1.manageTwitter)(args.action, args.content, args.username);
+                            break;
+                        }
+                        case 'manage_notion': {
+                            result = await (0, notionWorkspace_1.manageNotion)(args.action, args.pageId, args.text);
+                            break;
+                        }
+                        case 'transcribe_audio': {
+                            result = await (0, audioTranscribe_1.transcribeAudio)(args.filePath);
+                            break;
+                        }
+                        case 'summarize_text': {
+                            result = await (0, summarizeText_1.summarizeText)(args.text, args.focus);
                             break;
                         }
                         case 'write_local_file': {
@@ -371,6 +425,14 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                             result = (0, writeFile_1.writeLocalFile)(args.filePath, args.content);
                             break;
                         }
+                        case 'generate_excel_file': {
+                            if (config.permissions?.system?.allow_file_write === false) {
+                                result = `[Security Blocked] Runtime Permission Denied: File writing is disabled. Update config.yaml to allow.`;
+                                break;
+                            }
+                            result = await (0, generateExcel_1.generateExcelFile)(args.data, args.filePath);
+                            break;
+                        }
                         case 'run_terminal_command': {
                             if (config.permissions?.system?.allow_shell_execution === false) {
                                 result = `[Security Blocked] Runtime Permission Denied: Shell execution is disabled. Update config.yaml to allow.`;
@@ -439,17 +501,18 @@ async function processUserInput(input, role = 'user', onProgress, sessionId) {
                     name: toolName,
                     content: result,
                 }, sessionId);
-                // V2 Optimization (Expanded in v1.7.4): Zero-LLM Fast Return for data-heavy and read-only tools
-                // If the tool already returns perfectly formatted markdown, skip the second LLM call to save 5-10s latency and tokens!
-                const fastReturnTools = [
-                    'check_portfolio', 'check_address', 'get_price', 'get_my_address',
-                    'analyze_market', 'check_token_security', 'search_web', 'read_gmail_inbox', 'list_calendar_events'
-                ];
-                if (fastReturnTools.includes(toolName)) {
-                    exports.logger.addEntry({ role: 'assistant', content: result }, sessionId);
-                    return result;
+                accumulatedResults.push(result);
+                if (!fastReturnTools.includes(toolName)) {
+                    canFastReturnAll = false;
                 }
             }
+            // V2 Optimization (Expanded in v1.7.4): Zero-LLM Fast Return for data-heavy and read-only tools
+            // If all tools already return perfectly formatted markdown, skip the second LLM call to save 5-10s latency!
+            if (canFastReturnAll && accumulatedResults.length > 0) {
+                const finalContent = accumulatedResults.join('\n\n---\n\n');
+                exports.logger.addEntry({ role: 'assistant', content: finalContent }, sessionId);
+                return finalContent;
+            }
             // Second call to get the final answer after tool execution
             const secondMessages = [
                 { role: 'system', content: getSystemPrompt() },

package/dist/packages/core/src/config/defiConfigManager.js

@@ -0,0 +1,36 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadDefiKeys = loadDefiKeys;
+exports.saveDefiKeys = saveDefiKeys;
+const fs_1 = __importDefault(require("fs"));
+const yaml_1 = __importDefault(require("yaml"));
+const paths_1 = require("./paths");
+function loadDefiKeys() {
+    const configPath = (0, paths_1.getPath)('defi_keys.yaml');
+    try {
+        if (!fs_1.default.existsSync(configPath)) {
+            return {};
+        }
+        const file = fs_1.default.readFileSync(configPath, 'utf8');
+        return yaml_1.default.parse(file) || {};
+    }
+    catch (e) {
+        console.error('[DefiConfig] Failed to load defi_keys.yaml', e);
+        return {};
+    }
+}
+function saveDefiKeys(newKeys) {
+    const configPath = (0, paths_1.getPath)('defi_keys.yaml');
+    try {
+        const currentKeys = loadDefiKeys();
+        const merged = { ...currentKeys, ...newKeys };
+        const yamlStr = yaml_1.default.stringify(merged);
+        fs_1.default.writeFileSync(configPath, yamlStr, 'utf8');
+    }
+    catch (e) {
+        console.error('[DefiConfig] Failed to save defi_keys.yaml', e);
+    }
+}

package/dist/packages/core/src/config/parser.js

@@ -52,7 +52,7 @@ function loadConfig() {
             }
         }
         return {
-            agent: parsed.agent || { name: 'Nyxora-Default', description: 'Your Personal Web3 Assistant.', default_chain: 'base', default_router: 'auto', default_slippage: 0.5 },
+            agent: parsed.agent || { name: 'Nyxora-Default', description: 'Your Personal Web3 Assistant.', default_chain: 'base', default_router: 'auto', default_slippage: 'auto' },
             llm: parsed.llm || {
                 provider: 'openai',
                 model: 'gpt-4o-mini',
@@ -88,7 +88,7 @@ function loadConfig() {
                 description: "Your Personal Web3 Assistant.",
                 default_chain: "ethereum",
                 default_router: "auto",
-                default_slippage: 0.5
+                default_slippage: "auto"
             },
             llm: {
                 provider: 'openai',