teleton 0.7.3 → 0.7.5

package/README.md

@@ -15,18 +15,18 @@
 
 ---
 
-<p align="center">Teleton is an autonomous AI agent platform that operates as a real Telegram user account (not a bot). It thinks through an agentic loop with tool calling, remembers conversations across sessions with hybrid RAG, and natively integrates the TON blockchain: send crypto, swap on DEXs, bid on domains, verify payments - all from a chat message. It can schedule tasks to run autonomously at any time. It ships with 100+ built-in tools, supports 10 LLM providers, and exposes a Plugin SDK so you can build your own tools on top of the platform.</p>
+<p align="center">Teleton is an autonomous AI agent platform that operates as a real Telegram user account (not a bot). It thinks through an agentic loop with tool calling, remembers conversations across sessions with hybrid RAG, and natively integrates the TON blockchain: send crypto, swap on DEXs, bid on domains, verify payments - all from a chat message. It can schedule tasks to run autonomously at any time. It ships with 125+ built-in tools, supports 11 LLM providers, and exposes a Plugin SDK so you can build your own tools on top of the platform.</p>
 
 ### Key Highlights
 
 - **Full Telegram access** - Operates as a real user via MTProto (GramJS), not a limited bot
 - **Agentic loop** - Up to 5 iterations of tool calling per message, the agent thinks, acts, observes, and repeats
-- **Multi-Provider LLM** - Anthropic, OpenAI, Google Gemini, xAI Grok, Groq, OpenRouter, Moonshot, Mistral, Cocoon, Local
+- **Multi-Provider LLM** - Anthropic, Claude Code, OpenAI, Google Gemini, xAI Grok, Groq, OpenRouter, Moonshot, Mistral, Cocoon, Local (11 providers)
 - **TON Blockchain** - Built-in W5R1 wallet, send/receive TON & jettons, swap on STON.fi and DeDust, NFTs, DNS domains
 - **Persistent memory** - Hybrid RAG (sqlite-vec + FTS5), auto-compaction with AI summarization, daily logs
-- **100+ built-in tools** - Messaging, media, blockchain, DEX trading, deals, DNS, journaling, and more
+- **125+ built-in tools** - Messaging, media, blockchain, DEX trading, deals, DNS, exec, journaling, and more
 - **Plugin SDK** - Extend the agent with custom tools, frozen SDK with isolated databases, secrets management, lifecycle hooks
-- **MCP Client** - Connect external tool servers (stdio/SSE) with 2 lines of YAML, no code, no rebuild
+- **MCP Client** - Connect external tool servers (stdio/SSE/Streamable HTTP) with 2 lines of YAML, no code, no rebuild
 - **Secure by design** - Prompt injection defense, sandboxed workspace, plugin isolation, wallet encryption
 
 ---
@@ -37,21 +37,22 @@
 
 | Category      | Tools | Description                                                                                                        |
 | ------------- | ----- | ------------------------------------------------------------------------------------------------------------------ |
-| Telegram      | 66    | Messaging, media, chats, groups, polls, stickers, gifts, stars, stories, contacts, folders, profile, memory, tasks |
+| Telegram      | 77    | Messaging, media, chats, groups, polls, stickers, gifts, stars, stories, contacts, folders, profile, memory, tasks, voice transcription, scheduled messages |
 | TON & Jettons | 15    | W5R1 wallet, send/receive TON & jettons, balances, prices, holders, history, charts, NFTs, smart DEX router        |
 | STON.fi DEX   | 5     | Swap, quote, search, trending tokens, liquidity pools                                                              |
 | DeDust DEX    | 5     | Swap, quote, pools, prices, token analytics (holders, top traders, buy/sell tax)                                   |
-| TON DNS       | 7     | Domain auctions, bidding, linking/unlinking, resolution, availability checks                                       |
+| TON DNS       | 8     | Domain auctions, bidding, linking/unlinking, TON Site hosting, resolution, availability checks                      |
 | Deals         | 5     | P2P escrow with inline buttons, on-chain payment verification, anti double-spend                                   |
 | Journal       | 3     | Trade/operation logging with P&L tracking and natural language queries                                             |
 | Web           | 2     | Web search and page extraction via Tavily (search, fetch/extract)                                                  |
 | Workspace     | 6     | Sandboxed file operations with path traversal protection                                                           |
+| Exec          | 4     | System execution (YOLO mode) — shell commands, file read/write, process management (off by default, admin-only)    |
 
 ### Advanced Capabilities
 
 | Capability              | Description                                                                                                                 |
 | ----------------------- | --------------------------------------------------------------------------------------------------------------------------- |
-| **Multi-Provider LLM**  | Switch between Anthropic, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cocoon, or Local with one config change  |
+| **Multi-Provider LLM**  | Switch between Anthropic, Claude Code, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cocoon, or Local — Dashboard validates API key before switching |
 | **RAG + Hybrid Search** | Local ONNX embeddings (384d) or Voyage AI (512d/1024d) with FTS5 keyword + sqlite-vec cosine similarity, fused via RRF      |
 | **Auto-Compaction**     | AI-summarized context management prevents overflow, preserves key information in `memory/*.md` files                        |
 | **Observation Masking** | Compresses old tool results to one-line summaries, saving ~90% context window                                               |
@@ -61,9 +62,10 @@
 | **Scheduled Tasks**     | Time-based task execution with DAG dependency resolution                                                                    |
 | **Message Debouncing**  | Intelligent batching of rapid group messages (DMs are always instant)                                                       |
 | **Daily Logs**          | Automatic session summaries preserved across resets                                                                         |
-| **Multi-Policy Access** | Configurable DM/group policies (open, allowlist, pairing, disabled) with per-group module permissions                       |
-| **Tool RAG**            | Semantic tool selection - sends only the top-K most relevant tools per message (hybrid vector + FTS5, configurable `top_k`, `always_include` patterns) |
-| **MCP Client**          | Connect external MCP tool servers (stdio or SSE) - auto-discovery, namespaced tools, managed via CLI or WebUI               |
+| **Multi-Policy Access** | Configurable DM/group policies (open, allowlist, admin-only, disabled) with per-group module permissions                    |
+| **Tool RAG**            | Semantic tool selection (enabled by default) - sends only the top-K most relevant tools per message (hybrid vector + FTS5, configurable `top_k`, `always_include` patterns) |
+| **MCP Client**          | Connect external MCP tool servers (stdio, SSE, or Streamable HTTP) - auto-discovery, namespaced tools, managed via CLI or WebUI |
+| **System Execution**    | YOLO mode — 4 system tools (shell, file read/write, process list) with audit logging, configurable timeout, admin-only scope (off by default) |
 | **Sandboxed Workspace** | Secure file system with recursive URL decoding, symlink detection, and immutable config files                               |
 
 ---
@@ -71,7 +73,7 @@
 ## Prerequisites
 
 - **Node.js 20.0.0+** - [Download](https://nodejs.org/)
-- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/)
+- **LLM API Key** - One of: [Anthropic](https://console.anthropic.com/) (recommended), [OpenAI](https://platform.openai.com/), [Google](https://aistudio.google.com/), [xAI](https://console.x.ai/), [Groq](https://console.groq.com/), [OpenRouter](https://openrouter.ai/), [Moonshot](https://platform.moonshot.ai/), [Mistral](https://console.mistral.ai/) — or keyless: Claude Code (auto-detect), Cocoon (TON), Local (Ollama/vLLM)
 - **Telegram Account** - Dedicated account recommended for security
 - **Telegram API Credentials** - From [my.telegram.org/apps](https://my.telegram.org/apps)
 - **Your Telegram User ID** - Message [@userinfobot](https://t.me/userinfobot)
@@ -109,7 +111,7 @@ teleton setup
 ```
 
 The wizard will configure:
-- LLM provider selection (Anthropic, OpenAI, Google, xAI, Groq, OpenRouter)
+- LLM provider selection (11 providers: Anthropic, Claude Code, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cocoon, Local)
 - Telegram authentication (API credentials, phone, login code)
 - Access policies (DM/group response rules)
 - Admin user ID
@@ -152,15 +154,15 @@ The `teleton setup` wizard generates a fully configured `~/.teleton/config.yaml`
 
 ```yaml
 agent:
-  provider: "anthropic"              # anthropic | openai | google | xai | groq | openrouter
+  provider: "anthropic"              # anthropic | claude-code | openai | google | xai | groq | openrouter | moonshot | mistral | cocoon | local
   api_key: "sk-ant-api03-..."
-  model: "claude-opus-4-5-20251101"
-  utility_model: "claude-3-5-haiku-20241022"  # for summarization, compaction, vision
+  model: "claude-opus-4-6"
+  utility_model: "claude-haiku-4-5-20251001"  # for summarization, compaction, vision
   max_agentic_iterations: 5
 
 telegram:
-  dm_policy: "open"         # open | allowlist | pairing | disabled
-  group_policy: "open"      # open | allowlist | disabled
+  dm_policy: "admin-only"   # open | allowlist | admin-only | disabled
+  group_policy: "open"      # open | allowlist | admin-only | disabled
   require_mention: true
   admin_ids: [123456789]
   owner_name: "Your Name"
@@ -181,8 +183,31 @@ webui:                       # Optional: Web dashboard
   port: 7777                 # HTTP server port
   host: "127.0.0.1"          # Localhost only (security)
   # auth_token: "..."        # Auto-generated if omitted
+
+# capabilities:                # System execution (YOLO mode, off by default)
+#   exec:
+#     mode: "off"              # off | yolo
+#     scope: "admin-only"      # admin-only | allowlist | all
 ```
 
+### Supported Models
+
+All models are defined in `src/config/model-catalog.ts` and shared across the CLI setup, WebUI setup wizard, and Dashboard. To add a model, add it there — it will appear everywhere automatically.
+
+| Provider | Models |
+|----------|--------|
+| **Anthropic** | Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 4.6, Claude Haiku 4.5 |
+| **Claude Code** | Same as Anthropic (auto-detected credentials) |
+| **OpenAI** | GPT-5, GPT-5 Pro, GPT-5 Mini, GPT-5.1, GPT-4o, GPT-4.1, GPT-4.1 Mini, o4 Mini, o3, Codex Mini |
+| **Google** | Gemini 3 Pro (preview), Gemini 3 Flash (preview), Gemini 2.5 Pro, Gemini 2.5 Flash, Gemini 2.5 Flash Lite, Gemini 2.0 Flash |
+| **xAI** | Grok 4.1 Fast, Grok 4 Fast, Grok 4, Grok Code, Grok 3 |
+| **Groq** | Llama 4 Maverick, Qwen3 32B, DeepSeek R1 70B, Llama 3.3 70B |
+| **OpenRouter** | Claude Opus/Sonnet, GPT-5, Gemini, DeepSeek R1/V3, Qwen3 Coder/Max/235B, Nemotron, Sonar Pro, MiniMax, Grok 4 |
+| **Moonshot** | Kimi K2.5, Kimi K2 Thinking |
+| **Mistral** | Devstral Small/Medium, Mistral Large, Magistral Small |
+| **Cocoon** | Qwen/Qwen3-32B (decentralized, pays in TON) |
+| **Local** | Auto-detected (Ollama, vLLM, LM Studio) |
+
 ### MCP Servers
 
 Connect external tool servers via the [Model Context Protocol](https://modelcontextprotocol.io/). No code needed - tools are auto-discovered and registered at startup.
@@ -283,7 +308,7 @@ Teleton includes an **optional web dashboard** for monitoring and configuration.
 
 ### Features
 
-- **Dashboard**: System status, uptime, model info, session count, memory stats
+- **Dashboard**: System status, uptime, model info, session count, memory stats, live token usage tracking, provider switching with API key validation
 - **Tools Management**: View all tools grouped by module, toggle enable/disable, change scope per tool
 - **Plugin Marketplace**: Install, update, and manage plugins from registry with secrets management
 - **Soul Editor**: Edit SOUL.md, SECURITY.md, STRATEGY.md, MEMORY.md with unsaved changes warning
@@ -386,8 +411,8 @@ All admin commands support `/`, `!`, or `.` prefix:
 
 | Layer | Technology |
 |-------|------------|
-| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (Anthropic, OpenAI, Google, xAI, Groq, OpenRouter) |
-| Telegram Userbot | [GramJS](https://gram.js.org/) (MTProto) |
+| LLM | Multi-provider via [pi-ai](https://github.com/mariozechner/pi-ai) (11 providers: Anthropic, Claude Code, OpenAI, Google, xAI, Groq, OpenRouter, Moonshot, Mistral, Cocoon, Local) |
+| Telegram Userbot | [GramJS](https://gram.js.org/) Layer 222 fork (MTProto) |
 | Inline Bot | [Grammy](https://grammy.dev/) (Bot API, for deals) |
 | Blockchain | [TON SDK](https://github.com/ton-org/ton) (W5R1 wallet) |
 | DeFi | STON.fi SDK, DeDust SDK |
@@ -396,7 +421,7 @@ All admin commands support `/`, `!`, or `.` prefix:
 | Full-Text Search | SQLite FTS5 (BM25 ranking) |
 | Embeddings | [@huggingface/transformers](https://www.npmjs.com/package/@huggingface/transformers) (local ONNX) or Voyage AI |
 | Token Counting | [js-tiktoken](https://github.com/dqbd/tiktoken) |
-| MCP Client | [@modelcontextprotocol/sdk](https://modelcontextprotocol.io/) (stdio + SSE transports) |
+| MCP Client | [@modelcontextprotocol/sdk](https://modelcontextprotocol.io/) (stdio + SSE + Streamable HTTP) |
 | WebUI | [Hono](https://hono.dev/) (API) + React + Vite (frontend) |
 | Language | TypeScript 5.7, Node.js 20+ |
 
@@ -404,21 +429,22 @@ All admin commands support `/`, `!`, or `.` prefix:
 
 ```
 src/
-├── index.ts                # Entry point, TonnetApp lifecycle, graceful shutdown
+├── index.ts                # Entry point, TeletonApp lifecycle, graceful shutdown
 ├── agent/                  # Core agent runtime
 │   ├── runtime.ts          # Agentic loop (5 iterations, tool calling, masking, compaction)
 │   ├── client.ts           # Multi-provider LLM client
-│   └── tools/              # 100+ built-in tools
-│       ├── register-all.ts # Central tool registration (8 categories, 109 tools)
+│   └── tools/              # 125+ built-in tools
+│       ├── register-all.ts # Central tool registration (8 categories, 121 tools)
 │       ├── registry.ts     # Tool registry, scope filtering, provider limits
-│       ├── module-loader.ts    # Built-in module loading (deals → +5 tools)
+│       ├── module-loader.ts    # Built-in module loading (deals + exec)
 │       ├── plugin-loader.ts    # External plugin discovery, validation, hot-reload
 │       ├── mcp-loader.ts       # MCP client (stdio/SSE), tool discovery, lifecycle
-│       ├── telegram/       # Telegram operations (66 tools)
+│       ├── telegram/       # Telegram operations (77 tools)
 │       ├── ton/            # TON blockchain + jettons + DEX router (15 tools)
 │       ├── stonfi/         # STON.fi DEX (5 tools)
 │       ├── dedust/         # DeDust DEX (5 tools)
-│       ├── dns/            # TON DNS (7 tools)
+│       ├── dns/            # TON DNS (8 tools)
+│       ├── exec/           # System execution — YOLO mode (4 tools)
 │       ├── journal/        # Business journal (3 tools)
 │       └── workspace/      # File operations (6 tools)
 ├── deals/                  # Deals module (5 tools, loaded via module-loader)
@@ -439,7 +465,7 @@ src/
 │   ├── task-dependency-resolver.ts  # DAG-based task chains
 │   └── callbacks/          # Inline button routing
 ├── memory/                 # Storage and knowledge
-│   ├── schema.ts           # 10 tables, 25 indexes, FTS5, vec0, semver migrations
+│   ├── schema.ts           # 16 tables, 42 indexes/triggers, FTS5, vec0, semver migrations
 │   ├── database.ts         # SQLite + WAL + sqlite-vec
 │   ├── search/             # RAG system (hybrid vector + BM25 fusion via RRF)
 │   ├── embeddings/         # Local ONNX + Voyage AI + caching provider
@@ -463,7 +489,8 @@ src/
 │   └── loader.ts           # 10 sections: soul + security + strategy + memory + context + ...
 ├── config/                 # Configuration
 │   ├── schema.ts           # Zod schemas + validation
-│   └── providers.ts        # Multi-provider LLM registry (10 providers)
+│   ├── providers.ts        # Multi-provider LLM registry (11 providers)
+│   └── model-catalog.ts    # Shared model catalog (60+ models across all providers)
 ├── webui/                  # Optional web dashboard
 │   ├── server.ts           # Hono server, auth middleware, static serving
 │   └── routes/             # 11 API route groups (status, tools, logs, memory, soul, plugins, mcp, tasks, workspace, config, marketplace)
@@ -492,7 +519,9 @@ packages/sdk/               # Published @teleton-agent/sdk
 | **Wallet protection** | File permissions `0o600`, KeyPair cached (single PBKDF2), mnemonic never exposed to plugins |
 | **Memory protection** | Memory writes blocked in group chats to prevent poisoning |
 | **Payment security** | `INSERT OR IGNORE` on tx hashes prevents double-spend, atomic status transitions prevent race conditions |
-| **Tool scoping** | Financial tools DM-only, moderation group-only, per-chat permissions configurable at runtime |
+| **Exec audit** | All YOLO mode commands logged to `exec_audit` table with user, command, output, and timestamps |
+| **Pino redaction** | Structured logging with automatic redaction of apiKey, password, secret, token, mnemonic fields |
+| **Tool scoping** | Financial tools DM-only, moderation group-only, admin-only policies, per-chat permissions configurable at runtime |
 
 ### Reporting Vulnerabilities
 
@@ -502,7 +531,7 @@ Do not open public issues for security vulnerabilities. Contact maintainers (t.m
 
 1. Use a dedicated Telegram account
 2. Backup your 24-word mnemonic securely offline
-3. Start with restrictive policies (`allowlist`)
+3. Start with restrictive policies (`admin-only` or `allowlist`)
 4. Set file permissions: `chmod 600 ~/.teleton/wallet.json`
 5. Never commit `config.yaml` to version control
 6. Review `SECURITY.md` and customize for your use case
@@ -652,10 +681,10 @@ Full documentation is available in the [`docs/`](docs/) directory:
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the full guide.
 
 1. Fork the repository
-2. Create a feature branch from `dev`
+2. Create a feature branch from `main`
 3. Make your changes
 4. Verify: `npm run typecheck && npm run lint && npm test`
-5. Open a Pull Request against `dev`
+5. Open a Pull Request against `main`
 
 ---
 
@@ -692,6 +721,6 @@ MIT License - See [LICENSE](LICENSE) for details.
 ## Support
 
 - **Issues**: [GitHub Issues](https://github.com/TONresistor/teleton-agent/issues)
-- **Channel**: [@ResistanceTools](https://t.me/ResistanceTools)
-- **Group Chat**: [@ResistanceForum](https://t.me/ResistanceForum)
+- **Channel**: [@teletonagents](https://t.me/teletonagents)
+- **Group Chat**: [@teletonagentHQ](https://t.me/teletonagentHQ)
 - **Contact**: [@zkproof](https://t.me/zkproof)