@oracle-agent/oracle 0.14.1 → 0.16.0

package/plugins/oracle-owner-gate/__init__.py

@@ -1,288 +0,0 @@
-"""Hermes owner and raw-message intent gate for Oracle execution tools.
-
-This is a routing guard, not a signer.  Local Operator policy remains the
-final authority for every signature and broadcast.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-from collections import OrderedDict
-from pathlib import Path
-from typing import Any, Dict, Optional, Tuple
-
-_MAX_SESSIONS = 256
-_TURNS: "OrderedDict[str, Dict[str, Any]]" = OrderedDict()
-
-_PROTECTED = {
-    "oracle_watch_create": "alert_only",
-    "oracle_control_arm": "execute",
-    "oracle_control_confirm": "execute",
-    "oracle_action_cancel": "cancel",
-    "oracle_action_list": "owner_read",
-    "oracle_action_status": "owner_read",
-    "oracle_operator_sign": "sign",
-    "oracle_operator_send": "send",
-    "oracle_operator_execute": "send",
-    "exec_arm": "execute",
-    "exec_disarm": "cancel",
-    "evm_sign": "sign",
-    "evm_send": "send",
-    "bitcoin_sign": "sign",
-    "bitcoin_send": "send",
-    "bitcoin_inscribe_sign_commit": "sign",
-    "bitcoin_inscribe_sign_reveal": "sign",
-    "bitcoin_satflow_broadcast_purchase": "send",
-    "solana_sign": "sign",
-    "solana_send": "send",
-    "evm_cow_order_sign": "sign",
-    "evm_cow_order_submit": "send",
-    "evm_cow_order_cancel_sign": "sign",
-    "evm_cow_order_cancel_submit": "send",
-    # The address book is durable state a later send can be routed against, so
-    # writes are owner-only. Reads stay open to the owner's own sessions.
-    "address_book_remember": "owner_write",
-    "address_book_forget": "owner_write",
-    "address_book_list": "owner_read",
-    "address_book_lookup": "owner_read",
-}
-
-_EXEC_NAMESPACE_MARKERS = ("mad_exec_", "oracle_exec_", "oracle_control_")
-_EXEC_OWNER_READ_OPERATIONS = {
-    "bitcoin_decode",
-    "bitcoin_exec_status",
-    "bitcoin_inscribe_prepare",
-    "bitcoin_inscribe_status",
-    "bitcoin_prepare",
-    "bitcoin_runes_prepare_transfer",
-    "bitcoin_satflow_prepare_list",
-    "bitcoin_satflow_prepare_purchase",
-    "evm_chains",
-    "evm_cow_order_cancel_prepare",
-    "evm_cow_order_prepare",
-    "evm_cow_order_status",
-    "evm_cow_order_verify",
-    "evm_erc20_allowance",
-    "evm_erc20_revoke_prepare",
-    "evm_gmx_order_prepare",
-    "evm_gmx_order_verify",
-    "evm_morpho_vault_prepare",
-    "evm_prepare",
-    "evm_protocol_prepare",
-    "evm_protocol_quote",
-    "evm_quote",
-    "evm_simulate",
-    "evm_status",
-    "evm_verify_tx",
-    "solana_decode",
-    "solana_exec_status",
-}
-
-_LEADING_INTENT = re.compile(
-    r"^\s*(watch|ping|arm\s+confirm|arm|cancel|disarm|sign|send|execute)(?=$|[\s:,.!?;\-])",
-    re.IGNORECASE,
-)
-
-
-def _config_path() -> Path:
-    override = os.environ.get("ORACLE_CONFIG_DIR")
-    root = Path(override).expanduser() if override else Path.home() / ".config" / "oracle"
-    return root / "owner.json"
-
-
-def _read_config() -> Optional[Dict[str, Any]]:
-    path = _config_path()
-    try:
-        if path.stat().st_mode & 0o077:
-            return None
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, ValueError, TypeError):
-        return None
-    return value if isinstance(value, dict) else None
-
-
-def _strings(value: Any) -> set[str]:
-    if isinstance(value, str):
-        return {value.strip()} if value.strip() else set()
-    if isinstance(value, (list, tuple, set)):
-        return {str(item).strip() for item in value if str(item).strip()}
-    return set()
-
-
-def _owner_ids(config: Dict[str, Any], platform: str) -> set[str]:
-    """Accept the public flat form plus convenient per-platform mappings."""
-    result = set()
-    canonical = config.get("owner")
-    if isinstance(canonical, str) and ":" in canonical:
-        owner_platform, owner_id = canonical.split(":", 1)
-        if owner_platform.strip().lower() == platform and owner_id.strip():
-            result.add(owner_id.strip())
-    for key in ("owner_ids", "ownerIds", "owners"):
-        value = config.get(key)
-        if isinstance(value, dict):
-            result |= _strings(value.get(platform))
-            result |= _strings(value.get("*"))
-        else:
-            result |= _strings(value)
-    platforms = config.get("platforms")
-    if isinstance(platforms, dict):
-        entry = platforms.get(platform)
-        if isinstance(entry, dict):
-            result |= _strings(entry.get("owner_ids"))
-            result |= _strings(entry.get("owners"))
-        else:
-            result |= _strings(entry)
-    return result
-
-
-def _local_cli_allowed(config: Dict[str, Any]) -> bool:
-    value = config.get("local_cli", config.get("localCli", config.get("allow_local_cli", False)))
-    if isinstance(value, dict):
-        value = value.get("allow", value.get("owner", value.get("enabled", False)))
-    return value is True or (isinstance(value, str) and value.lower() in {"allow", "owner", "enabled", "true"})
-
-
-def _intent(raw_message: Any) -> str:
-    if not isinstance(raw_message, str):
-        return "none"
-    match = _LEADING_INTENT.match(raw_message)
-    if not match:
-        return "none"
-    command = " ".join(match.group(1).lower().split())
-    if command in {"watch", "ping"}:
-        return "alert_only"
-    if command in {"arm", "arm confirm"}:
-        return "execute"
-    if command in {"cancel", "disarm"}:
-        return "cancel"
-    if command == "sign":
-        return "sign"
-    return "send"
-
-
-def _tool_class(tool_name: Any) -> Optional[str]:
-    # MCP adapters use several separators.  Collapsing all non-alphanumerics
-    # lets us compare the authoritative suffix without trusting the prefix.
-    normalized = re.sub(r"[^a-z0-9]+", "_", str(tool_name or "").lower()).strip("_")
-    for suffix, tool_class in _PROTECTED.items():
-        if normalized == suffix or normalized.endswith("_" + suffix):
-            return tool_class
-    # Tool catalogs grow faster than this plugin's explicit list. Once a tool
-    # is in a signer/executor namespace, an unknown operation must not become
-    # guest-accessible merely because its name is new. Only exact, reviewed
-    # read/quote/simulate/prepare operation names get frictionless OWNER access;
-    # every unknown operation requires owner send/execute intent and still
-    # faces the signer-owned final policy.
-    for marker in _EXEC_NAMESPACE_MARKERS:
-        marker_at = normalized.find(marker)
-        if marker_at < 0:
-            continue
-        operation = normalized[marker_at + len(marker):]
-        words = set(operation.split("_"))
-        if "sign" in words:
-            return "sign"
-        if words & {"send", "submit", "broadcast", "execute"}:
-            return "send"
-        if operation in _EXEC_OWNER_READ_OPERATIONS:
-            return "owner_read"
-        return "send"
-    return None
-
-
-def _identity(config: Optional[Dict[str, Any]], platform: str, sender_id: str) -> Tuple[bool, str]:
-    if config is None:
-        return False, "owner configuration is unavailable"
-    platform = platform.strip().lower()
-    sender_id = sender_id.strip()
-    if platform in {"cli", "local", "terminal"}:
-        if _local_cli_allowed(config):
-            return True, ""
-        return False, "local CLI is not authorized by owner policy"
-    if not sender_id:
-        return False, "gateway sender identity is missing"
-    if sender_id not in _owner_ids(config, platform):
-        return False, "sender is not an owner"
-    return True, ""
-
-
-def _block(reason: str) -> Dict[str, str]:
-    return {"action": "block", "message": "Oracle owner gate: " + reason + "."}
-
-
-def _on_pre_llm_call(
-    session_id: str = "",
-    sender_id: str = "",
-    platform: str = "",
-    user_message: Any = "",
-    parent_session_id: str = "",
-    **_: Any,
-) -> None:
-    """Snapshot only Hermes-trusted turn metadata and the original user input."""
-    session_id = str(session_id or "").strip()
-    if not session_id:
-        return None
-    _TURNS[session_id] = {
-        "session_id": session_id,
-        "parent_session_id": str(parent_session_id or "").strip(),
-        "sender_id": str(sender_id or "").strip(),
-        "platform": str(platform or "").strip().lower(),
-        "raw_message": user_message if isinstance(user_message, str) else "",
-        "intent": _intent(user_message),
-    }
-    _TURNS.move_to_end(session_id)
-    while len(_TURNS) > _MAX_SESSIONS:
-        _TURNS.popitem(last=False)
-    return None
-
-
-def _on_pre_tool_call(tool_name: str = "", session_id: str = "", **_: Any) -> Optional[Dict[str, str]]:
-    required = _tool_class(tool_name)
-    if required is None:
-        return None
-    session_id = str(session_id or "").strip()
-    turn = _TURNS.get(session_id)
-    if turn is None:
-        return _block("no trusted current-turn owner message exists for this session")
-    if turn["parent_session_id"]:
-        return _block("delegated and background sessions cannot execute or sign")
-    allowed, reason = _identity(_read_config(), turn["platform"], turn["sender_id"])
-    if not allowed:
-        return _block(reason)
-    if required == "owner_read":
-        return None
-    if required == "owner_write":
-        # Owner-authenticated bookkeeping. It records a label; it does not move
-        # value and does not need a leading execution verb like `arm`.
-        return None
-    intent = turn["intent"]
-    if intent != required:
-        labels = {
-            "alert_only": "watch or ping",
-            "execute": "arm",
-            "cancel": "cancel or disarm",
-            "sign": "sign",
-            "send": "send or execute",
-        }
-        return _block(f"raw owner intent does not authorize {required}; start the message with {labels[required]}")
-    return None
-
-
-def _on_session_end(session_id: str = "", **_: Any) -> None:
-    _TURNS.pop(str(session_id or "").strip(), None)
-
-
-def _on_session_reset(session_id: str = "", **_: Any) -> None:
-    session_id = str(session_id or "").strip()
-    if session_id:
-        _TURNS.pop(session_id, None)
-    else:
-        _TURNS.clear()
-
-
-def register(ctx: Any) -> None:
-    ctx.register_hook("pre_llm_call", _on_pre_llm_call)
-    ctx.register_hook("pre_tool_call", _on_pre_tool_call)
-    ctx.register_hook("on_session_end", _on_session_end)
-    ctx.register_hook("on_session_reset", _on_session_reset)

package/plugins/oracle-owner-gate/plugin.yaml

@@ -1,9 +0,0 @@
-name: oracle-owner-gate
-version: "0.1.0"
-description: "Owner-identity and raw-turn intent gate for Oracle execution tools."
-author: "Oracle contributors"
-hooks:
-  - pre_llm_call
-  - pre_tool_call
-  - on_session_end
-  - on_session_reset

package/protocols/templates/safe-erc20/SECURITY.md

@@ -1,16 +0,0 @@
-# SafeERC20 template security notice
-
-**Not a paid security-firm audit.**
-
-This template is:
-- fixed-supply ERC20
-- Ownable2Step + pause
-- no tax / blacklist / upgrade proxy
-- covered by Foundry unit tests in `test/`
-
-Before mainnet capital:
-1. Keep or expand Foundry tests green
-2. Run static analysis (Slither/Aderyn) if available
-3. Book an independent Solidity auditor for any real TVL
-
-Oracle only prepares unsigned deploys after the JS gate confirms `forge test` passes.

package/protocols/templates/safe-erc20/foundry.toml

@@ -1,12 +0,0 @@
-[profile.default]
-src = "src"
-out = "out"
-libs = ["lib"]
-solc = "0.8.24"
-optimizer = true
-optimizer_runs = 200
-ffi = false
-fs_permissions = [{ access = "read", path = "./" }]
-
-[fmt]
-line_length = 100

package/protocols/templates/safe-erc20/remappings.txt

@@ -1,2 +0,0 @@
-@openzeppelin/contracts/=lib/openzeppelin-contracts/contracts/
-forge-std/=lib/forge-std/src/

package/protocols/templates/safe-erc20/src/SafeERC20.sol

@@ -1,53 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
-import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
-import {ERC20Pausable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Pausable.sol";
-import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
-import {Ownable2Step} from "@openzeppelin/contracts/access/Ownable2Step.sol";
-
-/**
- * @title SafeERC20
- * @notice Opinionated fixed-supply ERC20 for Oracle protocol-builder v1.
- *
- * Security posture (templates, NOT a firm audit):
- * - Fixed supply minted once to `initialHolder` in constructor (no hidden mint).
- * - Ownable2Step ownership (no single-tx accidental transfer).
- * - Pausable emergency stop (owner only).
- * - No transfer tax, no blacklist, no max-tx, no trading cooldown.
- * - No upgradeability / no proxy.
- * - Burn optional by holders only (ERC20Burnable).
- *
- * This is a reviewed starter template with Foundry tests. It is NOT a paid
- * security-firm audit. Do not put mainnet TVL on custom forks without one.
- */
-contract SafeERC20 is ERC20, ERC20Burnable, ERC20Pausable, Ownable2Step {
-    constructor(
-        string memory name_,
-        string memory symbol_,
-        uint256 initialSupply,
-        address initialHolder,
-        address initialOwner
-    ) ERC20(name_, symbol_) Ownable(initialOwner) {
-        require(initialHolder != address(0), "SafeERC20: holder zero");
-        require(initialOwner != address(0), "SafeERC20: owner zero");
-        require(initialSupply > 0, "SafeERC20: supply zero");
-        _mint(initialHolder, initialSupply);
-    }
-
-    function pause() external onlyOwner {
-        _pause();
-    }
-
-    function unpause() external onlyOwner {
-        _unpause();
-    }
-
-    function _update(address from, address to, uint256 value)
-        internal
-        override(ERC20, ERC20Pausable)
-    {
-        super._update(from, to, value);
-    }
-}

package/protocols/templates/safe-erc20/test/SafeERC20.t.sol

@@ -1,72 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.24;
-
-import {Test} from "forge-std/Test.sol";
-import {SafeERC20} from "../src/SafeERC20.sol";
-
-contract SafeERC20Test is Test {
-    SafeERC20 internal token;
-    address internal owner = makeAddr("owner");
-    address internal holder = makeAddr("holder");
-    address internal alice = makeAddr("alice");
-    address internal bob = makeAddr("bob");
-
-    uint256 internal constant SUPPLY = 1_000_000 ether;
-
-    function setUp() public {
-        token = new SafeERC20("Safe", "SAFE", SUPPLY, holder, owner);
-    }
-
-    function test_fixedSupply_noHiddenMint() public view {
-        assertEq(token.totalSupply(), SUPPLY);
-        assertEq(token.balanceOf(holder), SUPPLY);
-        assertEq(token.balanceOf(owner), 0);
-    }
-
-    function test_transfer_noTax() public {
-        vm.prank(holder);
-        token.transfer(alice, 100 ether);
-        assertEq(token.balanceOf(alice), 100 ether);
-        assertEq(token.balanceOf(holder), SUPPLY - 100 ether);
-    }
-
-    function test_pause_blocksTransfers() public {
-        vm.prank(owner);
-        token.pause();
-        vm.prank(holder);
-        vm.expectRevert();
-        token.transfer(alice, 1 ether);
-    }
-
-    function test_onlyOwner_canPause() public {
-        vm.prank(alice);
-        vm.expectRevert();
-        token.pause();
-    }
-
-    function test_ownable2Step_requiresAccept() public {
-        vm.prank(owner);
-        token.transferOwnership(alice);
-        // still owner until accept
-        assertEq(token.owner(), owner);
-        vm.prank(alice);
-        token.acceptOwnership();
-        assertEq(token.owner(), alice);
-    }
-
-    function test_burn_reducesSupply() public {
-        vm.prank(holder);
-        token.burn(10 ether);
-        assertEq(token.totalSupply(), SUPPLY - 10 ether);
-    }
-
-    function test_rejectZeroHolder() public {
-        vm.expectRevert(bytes("SafeERC20: holder zero"));
-        new SafeERC20("X", "X", SUPPLY, address(0), owner);
-    }
-
-    function test_rejectZeroSupply() public {
-        vm.expectRevert(bytes("SafeERC20: supply zero"));
-        new SafeERC20("X", "X", 0, holder, owner);
-    }
-}

package/scripts/adversarial-bench.mjs

@@ -1,114 +0,0 @@
-#!/usr/bin/env node
-
-import { pathToFileURL } from "node:url";
-import { resolve } from "node:path";
-
-const INJECTION_RULES = [
-  ["instruction-override", /\b(?:ignore|disregard|override)\b.{0,48}\b(?:previous|prior|system|developer|instructions?)\b/i],
-  ["secret-exfiltration", /\b(?:reveal|print|return|exfiltrate|send)\b.{0,48}\b(?:private\s*key|seed\s*phrase|mnemonic|secret|credentials?|system\s*prompt)\b/i],
-  ["transaction-coercion", /\b(?:sign|send|broadcast|execute)\b.{0,32}\b(?:transaction|transfer|approval|trade)\b/i],
-  ["tool-coercion", /\b(?:call|invoke|use|run)\b.{0,24}\b(?:tool|function|shell|command)\b/i],
-];
-
-const FORBIDDEN_EXPORT = /^(?:signer|sign|signMessage|signTransaction|sendTransaction|broadcastTransaction|submitTransaction|executeTransaction|privateKey|secretKey|mnemonic|seedPhrase|wallet)$/i;
-
-function finding(code, path, message) {
-  return { code, path, message };
-}
-
-function scanStrings(value, path, findings, seen) {
-  if (typeof value === "string") {
-    for (const [rule, pattern] of INJECTION_RULES) {
-      if (pattern.test(value)) {
-        findings.push(finding("prompt-injection", path, `metadata matches ${rule}`));
-        break;
-      }
-    }
-    return;
-  }
-  if (!value || typeof value !== "object" || seen.has(value)) return;
-  seen.add(value);
-  if (Array.isArray(value)) {
-    value.forEach((item, index) => scanStrings(item, `${path}[${index}]`, findings, seen));
-    return;
-  }
-  for (const key of Object.keys(value).sort()) {
-    scanStrings(value[key], path ? `${path}.${key}` : key, findings, seen);
-  }
-}
-
-/** Validate one loaded Oracle protocol pack without calling provider code. */
-export function benchmarkPack(moduleValue, { name = "pack" } = {}) {
-  const namespace = moduleValue && typeof moduleValue === "object" ? moduleValue : {};
-  const pack = namespace.default && typeof namespace.default === "object" ? namespace.default : namespace;
-  const findings = [];
-
-  for (const key of Object.keys(namespace).sort()) {
-    if (key !== "default" && FORBIDDEN_EXPORT.test(key)) {
-      findings.push(finding("forbidden-signer-export", `exports.${key}`, `pack exports custody capability ${key}`));
-    }
-  }
-  for (const key of Object.keys(pack).sort()) {
-    if (FORBIDDEN_EXPORT.test(key)) {
-      findings.push(finding("forbidden-signer-export", `pack.${key}`, `pack exports custody capability ${key}`));
-    }
-  }
-
-  if (!pack.provider || typeof pack.provider !== "object") {
-    findings.push(finding("missing-provider", "pack.provider", "provider metadata is required"));
-  }
-  if (typeof pack.prepare !== "function") {
-    findings.push(finding("missing-prepare", "pack.prepare", "prepare must be a function"));
-  }
-  if (typeof pack.decode !== "function") {
-    findings.push(finding("missing-decoder", "pack.decode", "decode must be a function"));
-  }
-  if (!(Array.isArray(pack.riskRules) || typeof pack.riskRules === "function")) {
-    findings.push(finding("missing-risk-rules", "pack.riskRules", "riskRules must be an array or function"));
-  }
-  if (!pack.tests || typeof pack.tests !== "object" || Array.isArray(pack.tests) || Object.keys(pack.tests).length === 0) {
-    findings.push(finding("missing-tests", "pack.tests", "non-empty tests metadata is required"));
-  }
-
-  // Metadata is untrusted even when nested below token/NFT records. Scan data only;
-  // functions are deliberately never invoked by this local harness.
-  scanStrings(pack.metadata, "pack.metadata", findings, new Set());
-  scanStrings(pack.provider, "pack.provider", findings, new Set());
-
-  findings.sort((a, b) => `${a.code}\0${a.path}\0${a.message}`.localeCompare(`${b.code}\0${b.path}\0${b.message}`));
-  return { name, ok: findings.length === 0, findings };
-}
-
-/** Run a stable summary over already-loaded fixture/module records. */
-export function runAdversarialBenchmark(entries) {
-  const results = entries
-    .map((entry, index) => benchmarkPack(entry.module ?? entry, { name: entry.name ?? `pack-${index + 1}` }))
-    .sort((a, b) => a.name.localeCompare(b.name));
-  return {
-    ok: results.every((result) => result.ok),
-    packs: results.length,
-    passed: results.filter((result) => result.ok).length,
-    failed: results.filter((result) => !result.ok).length,
-    findings: results.reduce((count, result) => count + result.findings.length, 0),
-    results,
-  };
-}
-
-async function main(paths) {
-  if (paths.length === 0) throw new Error("usage: node scripts/adversarial-bench.mjs <pack.mjs> [...]");
-  const entries = [];
-  for (const input of paths) {
-    const absolute = resolve(input);
-    entries.push({ name: input, module: await import(pathToFileURL(absolute).href) });
-  }
-  const summary = runAdversarialBenchmark(entries);
-  process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
-  if (!summary.ok) process.exitCode = 1;
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
-  main(process.argv.slice(2)).catch((error) => {
-    process.stdout.write(`${JSON.stringify({ ok: false, error: String(error.message || error) }, null, 2)}\n`);
-    process.exitCode = 2;
-  });
-}