nyxora 1.6.1 → 1.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
# Nyxora Agent 🤖
|
|
2
2
|
**Production-Grade Secure AI Execution Framework for Web3 Agents.**
|
|
3
3
|
|
|
4
|
-
[](https://github.com/perasyudha/Nyxora)
|
|
5
5
|
[](https://opensource.org/licenses/MIT)
|
|
6
6
|
[](#️-advanced-security-threat-model)
|
|
7
7
|
[](#️-advanced-security-threat-model)
|
|
8
8
|
[](#️-advanced-security-threat-model)
|
|
9
9
|
|
|
10
|
-
Nyxora (v1.6.
|
|
10
|
+
Nyxora (v1.6.2) is a **secure, non-custodial runtime infrastructure for autonomous onchain agents** built with a robust Monorepo architecture (Node.js & React). Designed for autonomous workflows with a premium Glassmorphism UI dashboard and strict client-side key isolation.
|
|
11
11
|
|
|
12
12
|
It operates under an institutional-grade **Cryptographically Bound Human-in-the-Loop** execution model, ensuring that Remote AIs (LLMs) never have unilateral access to your funds.
|
|
13
13
|
|
|
@@ -15,7 +15,7 @@ It operates under an institutional-grade **Cryptographically Bound Human-in-the-
|
|
|
15
15
|
|
|
16
16
|
## 🔥 Key Features
|
|
17
17
|
|
|
18
|
-
### Advanced Security Architecture (v1.6.
|
|
18
|
+
### Advanced Security Architecture (v1.6.2)
|
|
19
19
|
* **3-Tier IPC Architecture**: Nyxora is split into isolated processes: **Core** (LLM Runtime), **Policy Engine** (Guardrails on port 3001), and **Signer Vault** (Isolated Key Manager on Unix Sockets).
|
|
20
20
|
* **Cryptographically Bound Approval**: Policy changes and transactions requested by the AI are drafted as hashes (`sha256`). Approval via the UI requires a challenge nonce, preventing Man-in-the-Middle (MITM) attacks.
|
|
21
21
|
* **Immutable Policy Guardrails**: Transaction limits (e.g. `max_usd_per_tx`) are strictly enforced by the Policy Engine. The LLM has zero write-access to bypass these rules.
|
package/SECURITY.md
CHANGED
|
@@ -12,20 +12,32 @@ Large Language Models (LLMs) are incredibly powerful reasoning engines, but they
|
|
|
12
12
|
|
|
13
13
|
To achieve this, Nyxora uses a **3-Tier Monorepo IPC (Inter-Process Communication)** architecture:
|
|
14
14
|
|
|
15
|
-
|
|
16
|
-
|
|
17
15
|
1. **Core Runtime (Port 3000):** Executes the LLM logic, handles the UI dashboard, and processes chat inputs.
|
|
18
16
|
2. **Policy Engine (Port 3001):** A strict middleware that evaluates all transaction requests against hard limits (e.g., `max_usd_per_tx`).
|
|
19
17
|
3. **Signer Vault (Unix Socket):** A completely isolated Node.js process that holds the decrypted private keys in memory. It listens exclusively on `/tmp/nyxora-signer.sock`.
|
|
20
18
|
|
|
21
19
|
### The Security Flow
|
|
22
|
-
When the LLM
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
20
|
+
When the LLM processes a transaction instruction (e.g., swapping tokens), the lifecycle is as follows:
|
|
21
|
+
|
|
22
|
+
```text
|
|
23
|
+
[1] User (Dashboard/Telegram) ──> Sends prompt "Please swap ETH to USDC"
|
|
24
|
+
│
|
|
25
|
+
[2] Core Runtime (LLM) <── Understands context & generates JSON Tool Call
|
|
26
|
+
│
|
|
27
|
+
[3] Policy Engine <── Receives payload, evaluates rules & limits
|
|
28
|
+
│
|
|
29
|
+
[4] User (Dashboard/Telegram) <── (If Auth required) Requests Approval (Challenge Nonce)
|
|
30
|
+
│
|
|
31
|
+
[5] Signer Vault <── Receives certified instruction from Policy
|
|
32
|
+
│
|
|
33
|
+
[6] Blockchain RPC <── Signer Vault signs & broadcasts to RPC
|
|
34
|
+
│
|
|
35
|
+
[7] User (Dashboard/Telegram) <── Success status returned to chat interface
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
The diagram above illustrates the lifecycle of a transaction initiated from the user interface. Due to Nyxora's layered architecture, the LLM in the Core Runtime acts solely as a planner generating transaction data structures. The actual cryptographic execution and signing are strictly locked and fully controlled by the Policy Engine and Signer Vault after you provide authorization.
|
|
39
|
+
|
|
40
|
+
> **Performance Note:** Although the multi-layered security flow above appears complex and lengthy, the entire internal verification, IPC communication, and cryptographic signing process is highly optimized and takes only a few **milliseconds (ms)** to complete.
|
|
29
41
|
|
|
30
42
|
---
|
|
31
43
|
|
|
@@ -65,4 +77,4 @@ Community plugins and custom skills are executed inside a sandboxed environment.
|
|
|
65
77
|
## 4. Reporting Vulnerabilities
|
|
66
78
|
|
|
67
79
|
If you discover a vulnerability in the Nyxora architecture, please DO NOT open a public issue.
|
|
68
|
-
Instead, email the core maintainer directly at **
|
|
80
|
+
Instead, email the core maintainer directly at **ainyxor@gmail.com**.
|
package/package.json
CHANGED