@hivemagnus/magnus-server 1.0.1 → 1.0.3

package/dist/db/generated/prisma/internal/prismaNamespace.js

@@ -36,12 +36,12 @@ export const Sql = runtime.Sql;
 export const Decimal = runtime.Decimal;
 export const getExtensionContext = runtime.Extensions.getExtensionContext;
 /**
- * Prisma Client JS version: 7.9.1
- * Query Engine version: e922089b7d7502aff4249d5da3420f6fa55fc6ad
+ * Prisma Client JS version: 7.10.1
+ * Query Engine version: d1b3f377ca835d73fd50954a5e22128b9ebdd6b8
  */
 export const prismaVersion = {
-    client: "7.9.1",
-    engine: "e922089b7d7502aff4249d5da3420f6fa55fc6ad"
+    client: "7.10.1",
+    engine: "d1b3f377ca835d73fd50954a5e22128b9ebdd6b8"
 };
 export const NullTypes = {
     DbNull: runtime.NullTypes.DbNull,

package/dist/index.js

@@ -18,6 +18,8 @@ const { securityFusionLocal, securityFusionMode, startSecurityExporter, stopSecu
 const { featureFlags } = await import('./config/features.js');
 const { serve } = await import('@hono/node-server');
 const { app } = await import('./server.js');
+const { parseRouteAliases, withRouteAliases } = await import('./config/route-aliases.js');
+const handler = withRouteAliases(app.fetch, parseRouteAliases(process.env['MAGNUS_ROUTE_ALIASES_JSON']));
 const { startRolloutReconciler, stopRolloutReconciler } = await import('./services/rollout-service.js');
 const { startApplicationProbes, stopApplicationProbes } = await import('./services/application-probes.js');
 const { startNodeIssueMonitor } = await import('./services/node-issue-monitor.js');
@@ -89,7 +91,7 @@ const listener = resolveListenerSecurity({
 });
 const server = listener.useTls
     ? serve({
-        fetch: app.fetch,
+        fetch: handler,
         port,
         hostname: listener.hostname,
         createServer,
@@ -101,7 +103,7 @@ const server = listener.useTls
         console.log(`🚀 Magnus server listening on https://${listener.hostname}:${info.port}`);
         startBackgroundServices();
     })
-    : serve({ fetch: app.fetch, port, hostname: listener.hostname }, (info) => {
+    : serve({ fetch: handler, port, hostname: listener.hostname }, (info) => {
         console.log(`🚀 Magnus server listening on http://${listener.hostname}:${info.port} (development opt-in)`);
         startBackgroundServices();
     });

package/dist/sdk/node-api-client.js

@@ -44,7 +44,7 @@ function verifiedReconciliation(raw, commandId, expected, fresh, nodeToken) {
  * Surface that as a non-retryable "feature disabled on this node" error.
  */
 export const AGENT_NOT_PRIVILEGED = 'AGENT_NOT_PRIVILEGED';
-async function rejectUnprivilegedAgent(_request, _options, response) {
+async function rejectUnprivilegedAgent({ response }) {
     if (response.status !== 403)
         return;
     let body;
@@ -76,7 +76,7 @@ export class NodeApiClient {
                 actorId: options.resourceActorId ?? 'system:control-api', baseUrl: options.baseUrl,
                 ...(options.resourceScope ? { scope: options.resourceScope } : {}) };
         this.api = ky.create({
-            prefixUrl: `${options.baseUrl}/api/v1`,
+            prefix: `${options.baseUrl}/api/v1`,
             timeout: options.timeout ?? 15_000,
             headers: {
                 'x-node-token': options.nodeToken,

package/dist/security/approval-assertion.js

@@ -2,6 +2,26 @@ import { createHash, createPublicKey, timingSafeEqual, verify } from 'node:crypt
 import { readFileSync } from 'node:fs';
 import { z } from 'zod';
 import { HttpError } from '../middleware/error-handler.js';
+/** Signature domain prefix for approval assertions; the signed message is `<prefix>.v<version>\n<canonical payload>`. */
+export const DEFAULT_APPROVAL_ASSERTION_DOMAIN = 'magnus.approval-assertion';
+export const approvalAssertionDomainPattern = /^[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?$/;
+/**
+ * Accepted signature domain prefixes, in preference order. The first one is the
+ * domain this server would sign with. `MAGNUS_APPROVAL_ASSERTION_DOMAINS`
+ * (comma-separated) lets older signers that use another prefix keep working.
+ */
+export function approvalAssertionDomains(value = process.env['MAGNUS_APPROVAL_ASSERTION_DOMAINS']) {
+    if (value === undefined || value.trim() === '')
+        return [DEFAULT_APPROVAL_ASSERTION_DOMAIN];
+    const domains = value.split(',').map(item => item.trim()).filter(Boolean);
+    if (!domains.length || domains.some(domain => !approvalAssertionDomainPattern.test(domain)))
+        throw new Error('MAGNUS_APPROVAL_ASSERTION_DOMAINS must list domain prefixes made of a-z, 0-9, "." and "-"');
+    return [...new Set(domains)];
+}
+/** The exact bytes signed for an approval payload under a domain prefix. */
+export function approvalSigningMessage(payload, domain = approvalAssertionDomains()[0]) {
+    return Buffer.from(`${domain}.v${payload.version}\n` + approvalPayloadCanonical(payload));
+}
 const identifier = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,159}$/);
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
 const payloadFields = {
@@ -49,7 +69,9 @@ export function verifyApprovalAssertion(raw) {
         const key = createPublicKey(inline ?? (encoded
             ? { key: Buffer.from(encoded, 'base64'), format: 'der', type: 'spki' }
             : readFileSync(path, 'utf8')));
-        valid = key.asymmetricKeyType === 'ed25519' && verify(null, Buffer.from(`magnus.approval-assertion.v${payload.version}\n` + canonical), key, Buffer.from(signature, 'base64url'));
+        const signatureBytes = Buffer.from(signature, 'base64url');
+        valid = key.asymmetricKeyType === 'ed25519' && approvalAssertionDomains()
+            .some(domain => verify(null, approvalSigningMessage(payload, domain), key, signatureBytes));
     }
     catch {
         valid = false;

package/dist/services/webhook-service.js

@@ -1,4 +1,5 @@
 import { recordMonitorPulse } from './monitor-pulse.js';
+import { WEBHOOK_FORMATS, webhookFormat } from './webhook-types.js';
 import { redactUnknown } from '../utils/redact.js';
 import { createHmac, randomBytes, createCipheriv } from 'node:crypto';
 import { nanoid } from 'nanoid';
@@ -67,7 +68,7 @@ export async function reconcileWebhookDeliveries() {
         // replaced; failed jobs are finalized by the worker's failure bookkeeping.
         await addDurableJob(getWebhookQueue(), 'deliver', createWebhookJobPayload(delivery.endpointId), {
             jobId: delivery.id,
-            attempts: delivery.endpoint.type === 'mattermost' ? 1 : Math.max(1, Math.min(11, delivery.endpoint.retries + 1)),
+            attempts: webhookFormat(delivery.endpoint.type) === 'mattermost' ? 1 : Math.max(1, Math.min(11, delivery.endpoint.retries + 1)),
             backoff: { type: 'exponential', delay: 1000 },
             removeOnComplete: { age: 86400, count: 10000 }, removeOnFail: { age: 604800, count: 10000 },
         }, ['completed']);
@@ -254,9 +255,9 @@ export function startWebhookWorker() {
         const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
         const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
         delete extraHeaders['x-magnus-encrypt'];
-        const { body: rawBody, contentType } = formatPayload(endpoint.type, delivery.event, delivery.payload);
+        const { body: rawBody, contentType } = formatPayload(webhookFormat(endpoint.type), delivery.event, delivery.payload);
         // Optionally encrypt the payload with AES-256-GCM
-        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const encrypted = shouldEncrypt && secret !== null && webhookFormat(endpoint.type) === 'generic';
         const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
         const headers = {
             ...extraHeaders,
@@ -269,7 +270,7 @@ export function startWebhookWorker() {
         if (secret) {
             headers['X-Magnus-Signature'] = `sha256=${signPayload(body, secret)}`;
         }
-        if (endpoint.type === 'mattermost' && !(await claimMattermostAttempt(deliveryId)))
+        if (webhookFormat(endpoint.type) === 'mattermost' && !(await claimMattermostAttempt(deliveryId)))
             return;
         try {
             const res = await postWebhook(webhookUrl(endpoint), { headers, body, timeoutMs: endpoint.timeoutMs });
@@ -356,7 +357,8 @@ export async function getWebhookEndpoint(id) {
 export async function createWebhookEndpoint(data) {
     const db = getDb();
     const id = nanoid();
-    if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type ?? 'generic'))
+    const type = webhookFormat(data.type ?? 'generic');
+    if (!WEBHOOK_FORMATS.includes(type))
         throw new Error('Unsupported webhook format');
     await validateWebhookTarget(data.url);
     const headers = normalizeHeaders(data.headers ?? {});
@@ -366,7 +368,7 @@ export async function createWebhookEndpoint(data) {
             id,
             name: data.name,
             url: encryptWebhookCredential(data.url, id, 'url'),
-            type: data.type ?? 'generic',
+            type,
             secret: data.secret === undefined ? null : encryptWebhookCredential(data.secret, id, 'secret'),
             events: JSON.stringify(data.events ?? []),
             headers: encryptWebhookCredential(JSON.stringify(headers), id, 'headers'),
@@ -390,9 +392,10 @@ export async function updateWebhookEndpoint(id, data) {
         updateData['url'] = encryptWebhookCredential(data.url, id, 'url');
     }
     if (data.type !== undefined) {
-        if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type))
+        const type = webhookFormat(data.type);
+        if (!WEBHOOK_FORMATS.includes(type))
             throw new Error('Unsupported webhook format');
-        updateData['type'] = data.type;
+        updateData['type'] = type;
     }
     if (data.secret !== undefined) {
         updateData['secret'] = data.secret === null ? null : encryptWebhookCredential(data.secret, id, 'secret');
@@ -442,12 +445,12 @@ export async function testWebhookEndpoint(id) {
             message: 'This is a test webhook delivery from Magnus',
             timestamp: new Date().toISOString(),
         };
-        const { body: rawBody, contentType } = formatPayload(endpoint.type, 'webhook.test', JSON.stringify(testPayload));
+        const { body: rawBody, contentType } = formatPayload(webhookFormat(endpoint.type), 'webhook.test', JSON.stringify(testPayload));
         const secret = encryptedSecret(endpoint);
         const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
         const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
         delete extraHeaders['x-magnus-encrypt'];
-        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const encrypted = shouldEncrypt && secret !== null && webhookFormat(endpoint.type) === 'generic';
         const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
         const headers = {
             ...extraHeaders,

package/dist/services/webhook-types.js

@@ -0,0 +1,29 @@
+export const WEBHOOK_FORMATS = ['generic', 'slack', 'discord', 'mattermost'];
+/**
+ * Legacy webhook type names mapped to current formats, from
+ * `MAGNUS_WEBHOOK_TYPE_ALIASES` (comma-separated `legacy=format` pairs). Lets
+ * endpoints stored or submitted under an older type name keep their format.
+ */
+export function webhookTypeAliases(raw = process.env['MAGNUS_WEBHOOK_TYPE_ALIASES']) {
+    if (raw === undefined || raw.trim() === '')
+        return {};
+    const aliases = {};
+    for (const pair of raw.split(',').map(item => item.trim()).filter(Boolean)) {
+        const [from, to, extra] = pair.split('=').map(item => item.trim());
+        if (extra !== undefined || !from || !to || !/^[a-z][a-z0-9_-]{0,31}$/.test(from)
+            || WEBHOOK_FORMATS.includes(from) || !WEBHOOK_FORMATS.includes(to))
+            throw new Error('MAGNUS_WEBHOOK_TYPE_ALIASES must list legacy=format pairs, where format is generic, slack, discord or mattermost');
+        aliases[from] = to;
+    }
+    return aliases;
+}
+/** The current delivery format for a stored or submitted webhook type. */
+export function webhookFormat(type) {
+    let aliases = {};
+    try {
+        aliases = webhookTypeAliases();
+    }
+    catch { /* Startup validation reports a malformed list. */ }
+    return Object.hasOwn(aliases, type) ? aliases[type] : type;
+}
+//# sourceMappingURL=webhook-types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-server",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "Magnus server: the fleet control plane API (Hono, PostgreSQL, Redis) for nodes running magnus-agent, with optional Hive IAM, Hive Router, HiveMem, Hermes Agent and external security console integrations.",
   "keywords": [
     "magnus",
@@ -84,33 +84,33 @@
     "prepublishOnly": "npm run db:generate && npm run clean && npm run build"
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.0.1",
+    "@hivemagnus/magnus-contracts": "1.0.3",
     "@hono/node-server": "^2.1.5",
-    "@hono/swagger-ui": "^0.5.3",
-    "@prisma/adapter-pg": "7.8.0",
-    "@prisma/client": "^7.9.1",
-    "argon2": "^0.44.0",
+    "@hono/swagger-ui": "^0.6.2",
+    "@prisma/adapter-pg": "7.10.1",
+    "@prisma/client": "^7.10.1",
+    "argon2": "^0.45.1",
     "bullmq": "^5.30.0",
-    "dotenv": "^17.3.1",
-    "hono": "4.13.13",
+    "dotenv": "^18.0.9",
+    "hono": "4.13.14",
     "ioredis": "^5.4.0",
-    "jose": "^6.0.0",
-    "ky": "^1.7.5",
+    "jose": "^6.2.13",
+    "ky": "^2.2.0",
     "nanoid": "^5.0.0",
-    "pg": "^8.22.0",
+    "pg": "^8.23.1",
     "ssh2": "^1.17.0",
-    "ws": "^8.19.0",
+    "ws": "^8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7",
-    "@hivemagnus/magnus-skills": "1.0.1",
-    "prisma": "^7.9.1"
+    "@hivemagnus/magnus-skills": "1.0.3",
+    "prisma": "^7.10.1"
   },
   "devDependencies": {
-    "@types/node": "^22.10.0",
-    "@types/pg": "^8.20.0",
-    "@types/ssh2": "^1.15.5",
-    "@types/ws": "^8.18.1",
-    "tsx": "^4.19.4",
+    "@types/node": "^22.20.5",
+    "@types/pg": "^8.23.1",
+    "@types/ssh2": "^1.15.6",
+    "@types/ws": "^8.18.2",
+    "tsx": "^4.23.15",
     "typescript": "^5.8.3",
     "vitest": "^4.1.12"
   },