feat: add ton-trading-bot plugin & ton-bridge plugin & github-dev-assistant#10
Closed
xlabtg wants to merge 165 commits intoTONresistor:mainfrom
Closed
feat: add ton-trading-bot plugin & ton-bridge plugin & github-dev-assistant#10xlabtg wants to merge 165 commits intoTONresistor:mainfrom
xlabtg wants to merge 165 commits intoTONresistor:mainfrom
Conversation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #1
Implements all 15 tools from issue #1: - Auth (2): github_auth (OAuth 2.0 with CSRF state), github_check_auth - Repos (2): github_list_repos, github_create_repo - Files/Branches (3): github_get_file, github_update_file, github_create_branch - PRs (3): github_create_pr, github_list_prs, github_merge_pr - Issues (4): github_create_issue, github_list_issues, github_comment_issue, github_close_issue - Actions (1): github_trigger_workflow Architecture: modular lib/*.js separation (github-client, auth, repo-ops, pr-manager, issue-tracker, utils), web-ui components (config-panel.jsx, oauth-callback.html), Vitest tests (unit + integration with mocked API). Security: tokens only in sdk.secrets, cryptographically random CSRF state with 10-min TTL, token redaction in errors, require_pr_review merge policy. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit b9dee2f.
feat: add github-dev-assistant plugin — full GitHub workflow automation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #3
- Remove all sdk.inline.send() calls that caused 400/BOT_RESPONSE_TIMEOUT errors - Tools now return structured inline result objects (article type with input_message_content + reply_markup) instead of sending messages directly - Add sdk.bot.onInlineQuery handler with three results: open, about, custom - Add query alias routing (ton-bridge:open, ton_bridge_open, etc.) - Fix button label: no leading space when emoji is empty - Support dynamic startParam in Mini App URL - Bump version to 1.1.0 and declare bot.inline: true in manifest Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit c241e1f.
refactor: rewrite ton-bridge plugin to inline-native architecture
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #5
Fixes #5 — the plugin had architectural issues that prevented the LLM from using it correctly: - Renamed tools with ton_trading_ prefix for global uniqueness - Removed embedded signal/strategy logic (ton_analyze_signal, ton_generate_plan, ton_switch_mode) — the LLM now owns strategy decisions - Fixed sdk.ton.dex API calls: use dex.quote({fromAsset,toAsset,amount}) and dex.swap() instead of the non-existent dex.quoteDeDust/quoteSTONfi variants with wrong parameter shapes - Fixed sdk.telegram.sendMessage calls to use (chatId, text) signature - Removed sdk.ton.validate_risk() call (non-existent SDK method) - Removed autoTrade config gate from execute path — LLM decides when to act - Collapsed from 10 tools to 6 atomic, well-named tools: ton_trading_get_market_data, ton_trading_get_portfolio, ton_trading_validate_trade, ton_trading_simulate_trade, ton_trading_execute_swap, ton_trading_record_trade - Simplified DB schema (trade_journal + sim_balance) - Updated manifest.json and README.md to match new architecture - Updated registry.json description and tags Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 481c138.
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #7
refactor: rewrite ton-trading-bot as atomic tool-provider plugin
- Remove sdk.bot.onInlineQuery handler (never executed in MTProto agent)
- Fix tool return format: was { success, data: { type: "article", ... } },
now returns agent-compatible { content, reply_markup }
- Add proper manifest.json following the same structure as other plugins
- Remove TypeScript build files (index.ts, manifest.ts, tsconfig.json,
tsup.config.ts) — the plugin uses plain JS like all other plugins
- Use optional chaining (?.)) for sdk.log and sdk.pluginConfig access
to avoid crashes if they are not provided
Fixes #7
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 1e539a8.
fix(ton-bridge): rewrite plugin for LLM tool agent compatibility
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #9
Fixes critical incompatibilities identified in issue #9: 1. **Return format**: All tools now return `{ content: string }` (human-readable text) instead of `{ success, data }` JSON blobs. The LLM agent directly reads `content` and presents it to the user without extra parsing. 2. **Authentication**: Replaced OAuth 2.0 flow (incompatible with agent runtime — no callback handler) with Personal Access Token (PAT) via `sdk.secrets`. Set `github_token` secret to connect. Removed `github_auth` tool and the OAuth `lib/auth.js` module. Updated `manifest.json` secrets declaration. 3. **Client instantiation**: GitHub client is now created inside each tool's `execute()` function (not shared at SDK init time), so token updates in `sdk.secrets` are always picked up — no stale client issues. 4. **LLM-friendly descriptions**: All tool descriptions rewritten from technical API docs to intent-level ("Use this when the user wants to...") so the LLM can correctly decide when to call each tool. 5. **Normalized output**: List tools (repos, PRs, issues) return formatted Markdown lists instead of raw JSON arrays. Errors include a human-readable prefix ("Failed to list repositories: ..."). 6. **Tests**: All 38 tests updated and passing — auth tests cover new PAT flow, integration tests use `global.fetch` mocking instead of injected client mock. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit b48e695.
fix(github-dev-assistant): rewrite plugin for LLM agent compatibility
Use sdk.ton.getPrice() to convert reserve_in_usd to TON instead of hardcoded division by 3, in both ton_trading_get_token_listings and ton_trading_get_token_info. Fallback to 3 if getPrice() returns null. Fixes #59 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit c21d602.
fix(ton-trading-bot): replace hardcoded /3 price conversion with sdk.ton.getPrice()
fix(github-dev-assistant): path traversal vulnerability in github_download_file
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #60
feat(ton-trading-bot): add ton_trading_check_stop_loss to query stop_loss_rules table
…s (issue #60) Destructive tools (merge, push, close, delete, cancel) were missing scope: "dm-only", allowing them to be called in group chats. This patch adds the restriction to all 8 affected tools: - github_merge_pr - github_push_files - github_close_issue - github_reopen_issue - github_assign_issue - github_create_gist - github_delete_label - github_cancel_workflow_run Bumps plugin version to 3.1.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit d2c632a.
security(github-dev-assistant): add dm-only scope to destructive tools
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #61
…leton-plugins All 4 plugin manifests (ton-bridge, ton-trading-bot, github-dev-assistant, memory) incorrectly referenced xlabtg/teleton-plugins. Updated to use the correct TONresistor/teleton-plugins URL as specified in CONTRIBUTING.md. Closes #61 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 40183ba.
housekeeping: fix manifest repository URLs to point to TONresistor/teleton-plugins
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #62
…lescing - Wrap all error.message returns with String(...).slice(0, 500) to prevent excessively long error messages from propagating to users - Replace `|| 0` with `?? 0` in memory_list for limit/offset defaults so that an explicit 0 is handled correctly Fixes #62 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(memory): truncate error messages to 500 chars and use nullish coalescing
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #63
The ton-trading-bot plugin was expanded from 6 to 22 tools but the documentation was not updated. This updates both the main README table and the plugin's own README architecture section and tools table to accurately reflect all 22 tools now present in manifest.json. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 38f0427.
docs: fix ton-trading-bot tool count from 6 to 22 in README files
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #64
… trades queries Replace string interpolation of `mode` and `status` enum values in SQL queries with parameterized `?` placeholders, consistent with all other queries in the file. Adds 4 regression tests that verify injection payloads never appear in query strings. Fixes #64 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit 0bd6738.
fix(ton-trading-bot): fix SQL injection in risk metrics and scheduled trades queries
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: #73
…count - Add memory plugin to Available Plugins table under new "AI & Memory" section with 10 tools and correct description - Fix github-dev-assistant tool count from 57 to 60 (matches manifest v3.1.2) - All plugin manifests already reference TONresistor/teleton-plugins (no change needed) Fixes #73 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This reverts commit f9a0e59.
docs: update README with memory plugin and github-dev-assistant tool count
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description of changes
This PR adds three new plug-ins to extend the functionality of the Teleton AI Agent.:
ton-bridgeton-trading-bot🔌 Details on plugins
🌉 TON Bridge Plugin
https://t.me/TONBridge_robot?startappton_bridge_open— open the bridge with a buttonton_bridge_about— send information about the projectton_bridge_custom_message— custom message with a button💹 TON Trading Bot Plugin
Architecture according to the tool-provider pattern:
Tools:
ton_trading_get_market_dataton_trading_get_portfolioton_trading_validate_tradeton_trading_simulate_tradeton_trading_execute_swapton_trading_record_trade🔐 Risk Management:
scope: dm-onlyforexecute_swap— real operations only in private messages🐙 GitHub Dev Assistant Plugin
Full development cycle on GitHub directly from Telegram:
github_auth',github_check_auth`github_list_repos',github_create_repo`github_get_file,github_update_file,github_create_branchgithub_create_pr,github_list_prs,github_merge_prgithub_create_issue,github_list_issues,github_comment_issue,github_close_issuegithub_trigger_workflow, Security:
require_pr_reviewoption to confirm the PR merger✅ Checklist
@teleton-agent/sdkmanifest.jsonandindex.jswith the exportmanifest{ success, data?, error? }config.yamlconfiguration has been verifiedTesting
📝 Notes
ton-bridge@1.2.0,ton-trading-bot@1.0.0,github-dev-assistant@1.0.0🔗 Related changes
manifestfor runtime validation