nyxora 1.5.9 → 1.6.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
# Nyxora Agent 🤖
|
|
2
2
|
**Production-Grade Secure AI Execution Framework for Web3 Agents.**
|
|
3
3
|
|
|
4
|
-
[](https://github.com/perasyudha/Nyxora)
|
|
5
5
|
[](https://opensource.org/licenses/MIT)
|
|
6
6
|
[](#️-advanced-security-threat-model)
|
|
7
7
|
[](#️-advanced-security-threat-model)
|
|
8
8
|
[](#️-advanced-security-threat-model)
|
|
9
9
|
|
|
10
|
-
Nyxora (v1.
|
|
10
|
+
Nyxora (v1.6.1) is a **secure, non-custodial runtime infrastructure for autonomous onchain agents** built with a robust Monorepo architecture (Node.js & React). Designed for autonomous workflows with a premium Glassmorphism UI dashboard and strict client-side key isolation.
|
|
11
11
|
|
|
12
12
|
It operates under an institutional-grade **Cryptographically Bound Human-in-the-Loop** execution model, ensuring that Remote AIs (LLMs) never have unilateral access to your funds.
|
|
13
13
|
|
|
@@ -15,7 +15,7 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
|
|
|
15
15
|
|
|
16
16
|
## 🔥 Key Features
|
|
17
17
|
|
|
18
|
-
### Advanced Security Architecture (v1.
|
|
18
|
+
### Advanced Security Architecture (v1.6.1)
|
|
19
19
|
* **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
|
|
20
20
|
* **Cryptographically Bound Approval**: Policy changes and transactions requested by the AI are drafted as hashes (`sha256`). Approval via the UI requires a challenge nonce, preventing Man-in-the-Middle (MITM) attacks.
|
|
21
21
|
* **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
|
|
@@ -56,8 +56,22 @@ To dive deeper into the technical details of our Zero-Knowledge security archite
|
|
|
56
56
|
|
|
57
57
|
## 🚀 Quick Start & Installation
|
|
58
58
|
|
|
59
|
-
###
|
|
60
|
-
|
|
59
|
+
### Global Installation via NPM (Recommended)
|
|
60
|
+
The easiest and fastest way to use Nyxora is to install it globally via NPM. This ensures you get the latest version and can run Nyxora from anywhere on your machine.
|
|
61
|
+
|
|
62
|
+
```bash
|
|
63
|
+
# 1. Install Nyxora globally
|
|
64
|
+
npm install -g nyxora@latest
|
|
65
|
+
|
|
66
|
+
# 2. Run the Interactive Setup Wizard (API Keys, Wallet, Model Selection)
|
|
67
|
+
nyxora setup
|
|
68
|
+
|
|
69
|
+
# 3. Start the Nyxora Orchestrator and Dashboard
|
|
70
|
+
nyxora
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
### Local Development (From Source)
|
|
74
|
+
If you wish to modify the code or run from source, you can use the Monorepo architecture.
|
|
61
75
|
|
|
62
76
|
```bash
|
|
63
77
|
git clone https://github.com/perasyudha/Nyxora.git
|
|
@@ -65,8 +79,6 @@ cd Nyxora
|
|
|
65
79
|
|
|
66
80
|
# 1. Install Dependencies
|
|
67
81
|
npm install
|
|
68
|
-
npx ts-node -T packages/core/src/gateway/cli.ts setup
|
|
69
|
-
|
|
70
82
|
|
|
71
83
|
# 2. Build the Dashboard UI
|
|
72
84
|
npm run build
|
package/SECURITY.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Nyxora Security Architecture & Threat Model
|
|
2
2
|
|
|
3
|
-
Nyxora
|
|
3
|
+
Nyxora employs an institutional-grade, **Cryptographically Bound Human-in-the-Loop** security model to protect user assets and private keys against compromised LLMs, supply chain attacks, and prompt injections.
|
|
4
4
|
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -11,6 +11,9 @@ The core philosophy of Nyxora is **Zero-Knowledge to the LLM**.
|
|
|
11
11
|
Large Language Models (LLMs) are incredibly powerful reasoning engines, but they are inherently vulnerable to Prompt Injection and hallucinations. Therefore, the LLM must *never* have unilateral access to private keys or the ability to bypass security guardrails.
|
|
12
12
|
|
|
13
13
|
To achieve this, Nyxora uses a **3-Tier Monorepo IPC (Inter-Process Communication)** architecture:
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
|
|
14
17
|
1. **Core Runtime (Port 3000):** Executes the LLM logic, handles the UI dashboard, and processes chat inputs.
|
|
15
18
|
2. **Policy Engine (Port 3001):** A strict middleware that evaluates all transaction requests against hard limits (e.g., `max_usd_per_tx`).
|
|
16
19
|
3. **Signer Vault (Unix Socket):** A completely isolated Node.js process that holds the decrypted private keys in memory. It listens exclusively on `/tmp/nyxora-signer.sock`.
|
|
@@ -26,7 +29,7 @@ When the LLM decides to swap tokens:
|
|
|
26
29
|
|
|
27
30
|
---
|
|
28
31
|
|
|
29
|
-
## 2. Advanced Cryptographic Security
|
|
32
|
+
## 2. Advanced Cryptographic Security
|
|
30
33
|
|
|
31
34
|
To prevent advanced Man-in-the-Middle (MITM) attacks and UI compromises, Nyxora is adopting the following cryptographic standards:
|
|
32
35
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "nyxora",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.6.1",
|
|
4
4
|
"workspaces": [
|
|
5
5
|
"packages/*"
|
|
6
6
|
],
|
|
@@ -11,12 +11,24 @@
|
|
|
11
11
|
"test": "echo \"Error: no test specified\" && exit 1"
|
|
12
12
|
},
|
|
13
13
|
"dependencies": {
|
|
14
|
+
"@clack/prompts": "^1.4.0",
|
|
15
|
+
"better-sqlite3": "^12.10.0",
|
|
14
16
|
"concurrently": "^9.2.1",
|
|
17
|
+
"cors": "^2.8.6",
|
|
15
18
|
"dotenv": "^17.4.2",
|
|
19
|
+
"express": "^5.2.1",
|
|
20
|
+
"express-rate-limit": "^7.5.0",
|
|
21
|
+
"helmet": "^8.0.0",
|
|
16
22
|
"jsonwebtoken": "^9.0.2",
|
|
23
|
+
"node-telegram-bot-api": "^0.67.0",
|
|
24
|
+
"open": "^11.0.0",
|
|
25
|
+
"openai": "^6.39.0",
|
|
17
26
|
"picocolors": "^1.1.1",
|
|
18
27
|
"ts-node": "^10.9.2",
|
|
19
|
-
"typescript": "^6.0.3"
|
|
28
|
+
"typescript": "^6.0.3",
|
|
29
|
+
"viem": "^2.51.0",
|
|
30
|
+
"yaml": "^2.9.0",
|
|
31
|
+
"zod": "^3.23.8"
|
|
20
32
|
},
|
|
21
33
|
"devDependencies": {
|
|
22
34
|
"@types/jsonwebtoken": "^9.0.5",
|