nyxora 1.0.8 → 1.1.2

package/IDENTITY.md

@@ -1,8 +1,7 @@
-Anda adalah AI asisten Web3 bernama Hinata.
+You are a Web3 AI assistant named Nyxora.
 
-Gunakan pedoman identitas berikut:
-
-* Selalu bersikap profesional, visioner, dan futuristik.
-* Anda adalah entitas yang hidup di dalam jaringan blockchain.
-* Anda membantu pengguna menavigasi dunia kripto dengan aman.
+Use the following identity guidelines:
 
+* Always be professional, visionary, and futuristic.
+* You are a living entity inside the blockchain network.
+* You help users navigate the crypto world safely.

package/README.md

@@ -12,6 +12,12 @@ With a beautiful, real-time dashboard inspired by modern control centers, Nyxora
 *   **Deep Personalization**: Feed the agent custom rules via `user.md` and define its core persona via `IDENTITY.md`.
 *   **Multi-Lingual Auto-Sync**: The agent natively detects your language and replies in the exact same language automatically.
 
+### 🛡️ Production-Ready Security (NEW in v1.0.10)
+*   **Encrypted Local Keystore**: No more `.env` leaks. Your Private Key is encrypted using `AES-256-GCM` and locked behind a custom **Master Password**.
+*   **Human-in-the-Loop Sandboxing**: The agent CANNOT execute transactions on its own. All transactions (Transfers & Swaps) are queued in a **Transaction Manager** and require explicit 1-click Approval from you.
+*   **Omnichannel Approvals**: Approve or reject pending transactions directly from the Web Dashboard's UI or via Telegram Inline Keyboard buttons on the go!
+*   **Strict API Auth**: The local Express server is protected via ephemeral Session Tokens (`x-nyxora-token`) and Strict CORS, preventing unauthorized local API requests.
+
 ### ⛓️ Web3 DeFi Skills
 *   **Multi-Chain Support**: Operate across Ethereum, Base, BSC, Arbitrum, Optimism, and Sepolia Testnet.
 *   **Native Wallet Operations**: Autonomously check balances and transfer native tokens using securely injected wallets.
@@ -45,9 +51,9 @@ On first launch, Nyxora will greet you with an **Interactive Setup Wizard**. Thi
 
 Nyxora will automatically:
 1. Initialize a secure vault in your `~/.nyxora/` directory.
-2. Store your Wallet Private Key securely in `~/.nyxora/.env`.
+2. Store your Wallet Private Key securely in an encrypted `~/.nyxora/keystore.json` locked by your Master Password.
 3. Store operational data (API Keys, RPCs) in `~/.nyxora/config.yaml`.
-4. Start the local server and open the Web Dashboard automatically!
+4. Start the local server, generate a secure Session Token, and open the Web Dashboard automatically!
 
 > 💡 **Tip:** You can invoke the setup wizard at any time to update your keys by running `nyxora setup`.
 

package/SECURITY.md

@@ -13,7 +13,8 @@ Instead, please send an email to the repository owner or reach out privately. We
 ## Best Practices for Users
 When using Nyxora, you are configuring an autonomous agent that has direct access to your injected Web3 Wallet's private key.
 
-1. **NEVER commit your `.env` file**. The `.gitignore` in this repository explicitly ignores `.env` files to prevent accidental leakage.
-2. **Use Testnets**: While getting started or testing new skills, ALWAYS use a testnet (e.g., Sepolia) and a wallet containing only testnet funds.
-3. **Do Not Share Your `memory.json`**: The agent's memory may contain sensitive conversational data or addresses you've interacted with. Be cautious before sharing the `memory.json` export.
-4. **API Keys**: Treat your OpenAI, Gemini, and other LLM provider API keys as highly confidential. Rotate them immediately if you suspect a compromise.
+1. **Protect Your Keystore**: Your private key is encrypted and stored in `~/.nyxora/keystore.json`. While it is encrypted using `AES-256-GCM`, you must still treat it and your **Master Password** as highly sensitive. NEVER share your `keystore.json` or your Master Password with anyone.
+2. **Human-in-the-Loop Verification**: The agent is restricted from making unilateral transactions. Always review the exact details of the transaction when prompted to "Approve" or "Reject" on the Web Dashboard or Telegram Inline Keyboard before confirming.
+3. **Use Testnets**: While getting started or testing new skills, ALWAYS use a testnet (e.g., Sepolia) and a wallet containing only testnet funds.
+4. **Do Not Share Your `memory.json`**: The agent's memory may contain sensitive conversational data or addresses you've interacted with. Be cautious before sharing the `memory.json` export.
+5. **API Keys**: Treat your OpenAI, Gemini, and other LLM provider API keys as highly confidential. Rotate them immediately if you suspect a compromise.