@hivemagnus/magnus-server 0.0.0-stage → 1.0.2

package/dist/services/host-local-writer.js

@@ -0,0 +1,82 @@
+/** Fresh, owner-signed proof of the node agent's one-way mutation drain.
+ * A proof is only one independent writer class; it cannot transfer release
+ * traffic or settle a retained unknown claim. */
+import { createHash, createHmac, timingSafeEqual } from 'node:crypto';
+import { z } from 'zod';
+import { canonical } from './resource-enrollment.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { getNodeManagerSecret, RESULT_SIGNING_SECRET } from '../utils/env.js';
+const hex = z.string().regex(/^[a-f0-9]{64}$/);
+const proofSchema = z.object({ version: z.literal(1), sourceClass: z.literal('host-local-mutations'),
+    nodeId: z.string().min(1).max(128), nodeFqdn: z.string().min(1).max(253),
+    epoch: z.number().int().positive(), barrierId: z.string().guid(), nonce: z.string().guid(),
+    observedAt: z.number().int().positive(), active: z.number().int().nonnegative(),
+    unknown: z.number().int().nonnegative(), mutationInventorySha256: hex,
+    admissionFenceSha256: hex, signature: hex }).strict();
+const DOMAIN = 'magnus.host-local-writer.v1\n';
+export function verifyHostLocalWriterProof(raw, expected, now = Date.now()) {
+    const parsed = proofSchema.safeParse(raw);
+    if (!parsed.success || RESULT_SIGNING_SECRET.length < 32)
+        return null;
+    const { signature, ...receipt } = parsed.data;
+    if (receipt.nodeId !== expected.nodeId || receipt.nodeFqdn !== expected.nodeFqdn
+        || receipt.nonce !== expected.nonce || receipt.epoch !== expected.epoch
+        || receipt.barrierId !== expected.barrierId || receipt.active !== 0 || receipt.unknown !== 0
+        || now - receipt.observedAt < -1000 || now - receipt.observedAt > 20_000)
+        return null;
+    const exactFence = createHash('sha256').update(canonical({ nodeId: expected.nodeId,
+        nodeFqdn: expected.nodeFqdn, epoch: expected.epoch, barrierId: expected.barrierId })).digest('hex');
+    if (receipt.admissionFenceSha256 !== exactFence)
+        return null;
+    const signed = createHmac('sha256', RESULT_SIGNING_SECRET).update(DOMAIN + canonical(receipt)).digest();
+    if (!timingSafeEqual(signed, Buffer.from(signature, 'hex')))
+        return null;
+    return { ownerReceiptSha256: createHash('sha256').update(canonical(parsed.data)).digest('hex'),
+        admissionFenceSha256: receipt.admissionFenceSha256,
+        mutationInventorySha256: receipt.mutationInventorySha256 };
+}
+async function boundedJson(response) {
+    if (!response.ok || !response.body)
+        throw new Error('Owner proof unavailable');
+    const reader = response.body.getReader();
+    const parts = [];
+    let size = 0;
+    try {
+        while (true) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 4096)
+                throw new Error('Owner proof exceeded bound');
+            parts.push(value);
+        }
+        const envelope = JSON.parse(Buffer.concat(parts).toString('utf8'));
+        if (envelope.success !== true)
+            throw new Error('Owner proof rejected');
+        return envelope.data;
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
+export async function fetchHostLocalWriterProof(node, nodeFqdn, nonce) {
+    try {
+        if (RESULT_SIGNING_SECRET.length < 32)
+            return null;
+        const base = getNodeBaseUrl(node.ipAddress, node.port);
+        if (new URL(base).protocol !== 'https:')
+            return null;
+        const url = new URL(base + '/api/v1/commands/host-local-writer-proof');
+        url.search = new URLSearchParams({ nodeFqdn, nonce }).toString();
+        const response = await fetch(url, {
+            method: 'GET', redirect: 'error', signal: AbortSignal.timeout(5000),
+            headers: { 'x-node-token': getNodeManagerSecret(), 'cache-control': 'no-store' },
+        });
+        return await boundedJson(response);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=host-local-writer.js.map

package/dist/services/incident-evidence.js

@@ -0,0 +1,110 @@
+import { readFileSync, lstatSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+export function evidenceEnvelope(value, maxBytes = 100000) {
+    const json = JSON.stringify(value, null, 2);
+    if (Buffer.byteLength(json) > maxBytes)
+        throw new HttpError(413, 'EVIDENCE_LIMIT', 'Narrow the incident evidence request');
+    return {
+        schemaVersion: 1,
+        sha256: createHash('sha256').update(json).digest('hex'),
+        bytes: Buffer.byteLength(json),
+        json,
+        markdown: `# Magnus incident evidence\n\nIncident: ${String(value.incidentId)}\n\nSHA-256: ${createHash('sha256').update(json).digest('hex')}\n\nThis packet records observations and ordering, not causality. Command text, stdout, logs, credentials, and private case content are excluded.\n\n\`\`\`json\n${json}\n\`\`\`\n`,
+    };
+}
+export function currentReleaseEvidence(file = resolve(import.meta.dirname, '../../release-manifest.json')) {
+    try {
+        const stat = lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 32768)
+            return null;
+        const value = JSON.parse(readFileSync(file, 'utf8'));
+        const keys = ['commit', 'sourceTreeSha256', 'releaseTreeSha256', 'distTreeSha256', 'prismaSchemaSha256'];
+        const result = {};
+        for (const key of keys) {
+            const field = value[key];
+            if (typeof field !== 'string' || !(key === 'commit' ? /^[a-f0-9]{40}$/ : /^[a-f0-9]{64}$/).test(field))
+                return null;
+            result[key] = field;
+        }
+        return { ...result, context: 'Current Control API release; not proof of the release active during this incident' };
+    }
+    catch {
+        return null;
+    }
+}
+export async function exportIncidentEvidence(id) {
+    const db = getDb();
+    const incident = await db.anomalyEvent.findUnique({ where: { id } });
+    if (!incident)
+        throw new HttpError(404, 'NOT_FOUND', 'Incident not found');
+    const start = new Date(incident.firstSeenAt.getTime() - 3600000);
+    const end = new Date((incident.resolvedAt ?? incident.lastSeenAt).getTime() + 3600000);
+    const [health, commands, targets] = await Promise.all([
+        db.healthSnapshot.findMany({
+            where: { nodeId: incident.nodeId, timestamp: { gte: start, lte: end } },
+            take: 20,
+            orderBy: [{ timestamp: 'asc' }, { id: 'asc' }],
+            select: {
+                id: true,
+                timestamp: true,
+                cpuUsagePercent: true,
+                memoryPercent: true,
+                source: true,
+            },
+        }),
+        db.remoteCommand.findMany({
+            where: { nodeId: incident.nodeId, createdAt: { gte: start, lte: end } },
+            take: 20,
+            orderBy: [{ createdAt: 'asc' }, { id: 'asc' }],
+            select: {
+                id: true,
+                status: true,
+                createdAt: true,
+                completedAt: true,
+                correlationId: true,
+                result: { select: { exitCode: true } },
+            },
+        }),
+        db.rolloutTarget.findMany({
+            where: { nodeId: incident.nodeId, startedAt: { gte: start, lte: end } },
+            take: 20,
+            orderBy: [{ startedAt: 'asc' }, { id: 'asc' }],
+            select: { id: true, rolloutId: true, status: true, commandId: true, evidence: true },
+        }),
+    ]);
+    const release = currentReleaseEvidence();
+    return evidenceEnvelope({
+        incidentId: id,
+        nodeId: incident.nodeId,
+        incident,
+        window: { start, end },
+        health,
+        commands,
+        rollouts: targets.map((t) => {
+            let e = {};
+            try {
+                e = JSON.parse(t.evidence);
+            }
+            catch {
+                /* missing */
+            }
+            return {
+                id: t.id,
+                rolloutId: t.rolloutId,
+                status: t.status,
+                commandId: t.commandId,
+                heartbeatAt: e['heartbeatAt'] ?? null,
+                agentVersion: e['agentVersion'] ?? null,
+                verifiedAt: e['verifiedAt'] ?? null,
+            };
+        }),
+        limits: { health: 20, commands: 20, targets: 20, maxBytes: 100000 },
+        release,
+        missing: release ? ['Attach the historical release manifest if the incident preceded this deployment'] : ['Current release manifest unavailable; attach an independently verified deployment manifest'],
+        redaction: 'Allowlisted metadata only; no raw commands, outputs, logs, secrets or asserted cause',
+    });
+}
+//# sourceMappingURL=incident-evidence.js.map

package/dist/services/incident-lessons.js

@@ -0,0 +1,186 @@
+import { z } from 'zod';
+import { getDb } from '../db/index.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { boundedJson } from './application-probes.js';
+const reviewedText = z
+    .string()
+    .trim()
+    .min(5)
+    .max(1200)
+    .refine((s) => !/(?:https?:\/\/|bearer\s|password\s*[:=]|token\s*[:=]|secret\s*[:=]|-----BEGIN|\beyJ[A-Za-z0-9_-]+\.)/i.test(s), 'Remove credentials, URLs, raw logs and private evidence from the reviewed text');
+export const lessonSchema = z
+    .object({
+    incidentId: z.string().min(1).max(200),
+    symptom: reviewedText,
+    cause: reviewedText,
+    runbookVersion: z.enum(['diagnostics.v1', 'restart-service.v1']),
+    evidenceIds: z
+        .array(z.string().regex(/^[a-zA-Z0-9_-]{1,200}$/))
+        .min(1)
+        .max(20),
+    expiresAt: z.string().datetime(),
+    reviewed: z.literal(true),
+})
+    .strict()
+    .refine((v) => Date.parse(v.expiresAt) > Date.now() && Date.parse(v.expiresAt) - Date.now() <= 90 * 86400000, 'Review expiry must be within 90 days');
+function connection() {
+    const url = process.env['MAGNUS_LESSONS_HIVEMEM_URL'];
+    const token = process.env['MAGNUS_LESSONS_HIVEMEM_TOKEN'];
+    const workspace = process.env['MAGNUS_LESSONS_WORKSPACE'];
+    if (!url || !token || !workspace || workspace === 'default')
+        return null;
+    const base = new URL(url);
+    if (base.protocol !== 'https:' ||
+        base.username ||
+        base.password ||
+        base.search ||
+        base.hash ||
+        base.pathname !== '/')
+        throw new Error('Lesson memory requires a dedicated HTTPS origin');
+    if (token === process.env['HIVEMEM_TOKEN'])
+        throw new Error('Use a dedicated lesson credential, not the general memory token');
+    return { base, token, workspace };
+}
+async function request(path, method, body) {
+    const config = connection();
+    if (!config)
+        throw new HttpError(409, 'UNCONFIGURED', 'Configure a dedicated lesson workspace and non-admin credential');
+    const res = await fetch(new URL(path, config.base), {
+        method,
+        headers: { Authorization: `Bearer ${config.token}`, 'Content-Type': 'application/json' },
+        body: body ? JSON.stringify(body) : undefined,
+        redirect: 'error',
+        signal: AbortSignal.timeout(8000),
+    });
+    if (!res.ok) {
+        await res.body?.cancel();
+        throw new HttpError(502, 'LESSON_MEMORY_FAILED', 'Scoped lesson memory request failed');
+    }
+    return res.status === 204 ? {} : (await boundedJson(res));
+}
+export async function publishLesson(input, actorId) {
+    const db = getDb();
+    const incident = await db.anomalyEvent.findUnique({ where: { id: input.incidentId } });
+    if (!incident)
+        throw new HttpError(404, 'NOT_FOUND', 'Incident not found');
+    const evidence = await db.remediationExecution.findMany({
+        where: { id: { in: input.evidenceIds }, anomalyEventId: input.incidentId, status: 'completed' },
+    });
+    if (!evidence.length ||
+        !evidence.some((e) => {
+            try {
+                return JSON.parse(e.input).runbookVersion === input.runbookVersion;
+            }
+            catch {
+                return false;
+            }
+        }))
+        throw new HttpError(400, 'LESSON_EVIDENCE', 'Select a completed matching runbook execution for this incident');
+    const row = await db.incidentLesson.create({
+        data: {
+            incidentId: incident.id,
+            nodeId: incident.nodeId,
+            symptom: input.symptom,
+            cause: input.cause,
+            runbookVersion: input.runbookVersion,
+            evidenceIds: JSON.stringify(evidence.map((e) => e.id)),
+            reviewedBy: actorId,
+            expiresAt: new Date(input.expiresAt),
+        },
+    });
+    const config = connection();
+    if (!config)
+        return { ...row, publication: 'unconfigured' };
+    // One explicit attempt. Ambiguous transport failure retains the local review and
+    // is never automatically re-published, avoiding duplicate external memories.
+    try {
+        const memory = await request('/v1/memories', 'POST', {
+            content: JSON.stringify({
+                lessonId: row.id,
+                symptom: row.symptom,
+                cause: row.cause,
+                runbookVersion: row.runbookVersion,
+                evidenceIds: evidence.map((e) => e.id),
+                reviewedBy: actorId,
+            }),
+            type: 'procedural',
+            scope: 'private',
+            source: 'user_feedback',
+            workspace_id: config.workspace,
+            expires_at: input.expiresAt,
+            sensitivity: 'internal',
+            redaction_policy: 'redact',
+            tags: ['magnus-reviewed-lesson'],
+            metadata: { magnus_lesson_id: row.id },
+        });
+        if (typeof memory['id'] !== 'string' || !memory['id'])
+            throw new Error('Invalid memory receipt');
+        await db.incidentLesson.update({ where: { id: row.id }, data: { memoryId: memory['id'] } });
+        return { ...row, memoryId: memory['id'], publication: 'published' };
+    }
+    catch {
+        return {
+            ...row,
+            publication: 'unknown',
+            message: 'Review the scoped memory receipt before any retry',
+        };
+    }
+}
+export async function lessonSuggestions(query) {
+    // The local approved ledger is the admission boundary. Expired, superseded,
+    // unrelated or model-invented memories cannot become execution authority.
+    const terms = query
+        .toLowerCase()
+        .split(/\W+/)
+        .filter((t) => t.length > 2)
+        .slice(0, 20);
+    const rows = await getDb().incidentLesson.findMany({
+        where: { supersededAt: null, expiresAt: { gt: new Date() } },
+        orderBy: { createdAt: 'desc' },
+        take: 200,
+    });
+    return {
+        advisoryOnly: true,
+        lessons: rows
+            .filter((r) => terms.some((t) => `${r.symptom} ${r.cause}`.toLowerCase().includes(t)))
+            .slice(0, 10),
+    };
+}
+export async function supersedeLesson(id) {
+    const row = await getDb().incidentLesson.update({
+        where: { id },
+        data: { supersededAt: new Date() },
+    });
+    let publication = 'invalidated-locally';
+    if (row.memoryId) {
+        try {
+            await request(`/v1/memories/${encodeURIComponent(row.memoryId)}`, 'DELETE');
+            publication = 'invalidated';
+        }
+        catch {
+            publication = 'remote-invalidation-pending';
+        }
+    }
+    return { id, publication };
+}
+export async function reconcileLessonInvalidations() {
+    if (!connection())
+        return;
+    const rows = await getDb().incidentLesson.findMany({
+        where: {
+            memoryId: { not: null },
+            OR: [{ supersededAt: { not: null } }, { expiresAt: { lte: new Date() } }],
+        },
+        take: 10,
+    });
+    for (const row of rows) {
+        try {
+            await request(`/v1/memories/${encodeURIComponent(row.memoryId)}`, 'DELETE');
+            await getDb().incidentLesson.update({ where: { id: row.id }, data: { memoryId: null } });
+        }
+        catch {
+            /* Retry deletion; never re-publish. */
+        }
+    }
+}
+//# sourceMappingURL=incident-lessons.js.map

package/dist/services/llm-providers/anthropic.js

@@ -0,0 +1,143 @@
+import { createHttpProviderError, LlmProviderError, normalizeProviderError } from './provider-error.js';
+function contentToString(content) {
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .map((entry) => {
+            if (!entry || typeof entry !== 'object')
+                return '';
+            if ('text' in entry)
+                return String(entry.text ?? '');
+            return '';
+        })
+            .join('');
+    }
+    return '';
+}
+export class AnthropicProvider {
+    baseUrl;
+    apiKey;
+    id = 'anthropic';
+    name = 'Anthropic';
+    supportsStreaming = false;
+    supportsToolCalling = false;
+    supportsStructuredOutputs = false;
+    constructor(baseUrl = process.env['ANTHROPIC_API_URL'] ?? 'https://api.anthropic.com/v1', apiKey = process.env['ANTHROPIC_API_KEY']) {
+        this.baseUrl = baseUrl;
+        this.apiKey = apiKey;
+    }
+    isConfigured() {
+        return Boolean(this.baseUrl && this.apiKey);
+    }
+    buildHeaders() {
+        return {
+            'Content-Type': 'application/json',
+            'x-api-key': this.apiKey ?? '',
+            'anthropic-version': '2023-06-01',
+        };
+    }
+    async chat(request) {
+        if (!this.isConfigured()) {
+            throw new LlmProviderError(this.id, 'configuration', 'Anthropic is not configured', false);
+        }
+        const system = request.messages
+            .filter((message) => message.role === 'system')
+            .map((message) => message.content)
+            .join('\n\n');
+        const messages = request.messages
+            .filter((message) => message.role !== 'system')
+            .map((message) => ({
+            role: message.role === 'assistant' ? 'assistant' : 'user',
+            content: message.content,
+        }));
+        try {
+            const response = await fetch(`${this.baseUrl.replace(/\/+$/, '')}/messages`, {
+                method: 'POST',
+                headers: this.buildHeaders(),
+                body: JSON.stringify({
+                    model: request.model,
+                    system,
+                    max_tokens: request.maxTokens ?? 4096,
+                    temperature: request.temperature ?? 0.3,
+                    messages,
+                }),
+                signal: AbortSignal.timeout(120_000),
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw createHttpProviderError(this.id, response.status, `Anthropic API error: ${response.status} ${text.slice(0, 300)}`);
+            }
+            const data = (await response.json());
+            return {
+                providerId: this.id,
+                providerName: this.name,
+                model: data.model ?? request.model,
+                content: contentToString(data.content),
+                thinking: '',
+                evalCount: (data.usage?.input_tokens ?? 0) + (data.usage?.output_tokens ?? 0),
+                nativeToolCalls: [],
+                usedStructuredOutput: false,
+            };
+        }
+        catch (error) {
+            if (error instanceof LlmProviderError)
+                throw error;
+            throw normalizeProviderError(this.id, error);
+        }
+    }
+    async healthCheck() {
+        const checkedAt = new Date().toISOString();
+        if (!this.isConfigured()) {
+            return {
+                id: this.id,
+                name: this.name,
+                configured: false,
+                healthy: false,
+                baseUrl: this.baseUrl,
+                error: 'Anthropic API URL or key is not configured',
+                checkedAt,
+                supportsStreaming: this.supportsStreaming,
+                supportsToolCalling: this.supportsToolCalling,
+                supportsStructuredOutputs: this.supportsStructuredOutputs,
+            };
+        }
+        try {
+            const response = await fetch(`${this.baseUrl.replace(/\/+$/, '')}/models`, {
+                headers: this.buildHeaders(),
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw createHttpProviderError(this.id, response.status, `Anthropic health check failed: ${text.slice(0, 200)}`);
+            }
+            return {
+                id: this.id,
+                name: this.name,
+                configured: true,
+                healthy: true,
+                baseUrl: this.baseUrl,
+                checkedAt,
+                supportsStreaming: this.supportsStreaming,
+                supportsToolCalling: this.supportsToolCalling,
+                supportsStructuredOutputs: this.supportsStructuredOutputs,
+            };
+        }
+        catch (error) {
+            const normalized = normalizeProviderError(this.id, error);
+            return {
+                id: this.id,
+                name: this.name,
+                configured: true,
+                healthy: false,
+                baseUrl: this.baseUrl,
+                error: normalized.message,
+                checkedAt,
+                supportsStreaming: this.supportsStreaming,
+                supportsToolCalling: this.supportsToolCalling,
+                supportsStructuredOutputs: this.supportsStructuredOutputs,
+            };
+        }
+    }
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/services/llm-providers/index.js

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './provider-error.js';
+export * from './ollama.js';
+export * from './openai-compatible.js';
+export * from './anthropic.js';
+export * from './registry.js';
+//# sourceMappingURL=index.js.map