@hivemagnus/magnus-server 1.0.2 → 1.0.3

package/.env.example

@@ -86,6 +86,13 @@ CORS_ORIGIN=https://magnus.example.com:3000
 # Optional integrations — each is off until configured
 # ═══════════════════════════════════════════════════════════════════════════
 
+# ── Interoperating with older clients (optional) ──
+# JSON object mapping legacy /api/v1 path prefixes to current ones. Requests are
+# rewritten before routing, so auth, scopes and audit see the current path.
+# MAGNUS_ROUTE_ALIASES_JSON={"/api/v1/resource-leases/old-name/admission":"/api/v1/resource-leases/admission"}
+# Legacy webhook type names mapped to a current format (generic, slack, discord, mattermost).
+# MAGNUS_WEBHOOK_TYPE_ALIASES=legacy-chat=mattermost
+
 # ── Hive IAM: verify RS256 access tokens issued by Hive IAM ──
 # When set, JWT_SECRET is no longer required for user tokens.
 # IAM_CORE_URL=https://iam.example.com
@@ -139,6 +146,9 @@ CORS_ORIGIN=https://magnus.example.com:3000
 # APPROVAL_SIGNER_PUBLIC_KEY_PATH=/etc/magnus-server/approval-signer.pub
 # APPROVAL_TELEGRAM_ACTOR_SHA256=
 # APPROVAL_IPHONE_ACTOR_SHA256=
+# Signature domain prefixes accepted for approval decisions; the first is preferred.
+# Add a legacy signer domain (for example legacy.approval) to interoperate with older signers.
+# MAGNUS_APPROVAL_ASSERTION_DOMAINS=magnus.approval-assertion
 # Read-only digests for an external observability collector and the fleet-check reporter.
 # MAGNUS_COLLECTOR_TOKEN_SHA256=
 # MAGNUS_FLEET_CHECK_TOKEN_SHA256=

package/README.md

@@ -132,6 +132,21 @@ Unknown destinations and changed keys fail before authentication. Multiple
 pins permit a reviewed host-key rotation; remove the old pin afterward.
 This setting does not enable the retired browser deployment routes.
 
+## Interoperating with older components
+
+Every switch below is off or set to current behaviour by default. Set them only
+while older clients, signers or scripts still talk to this server.
+
+| Variable | Default | Purpose |
+| --- | --- | --- |
+| `MAGNUS_APPROVAL_ASSERTION_DOMAINS` | `magnus.approval-assertion` | Comma-separated signature domain prefixes accepted for signed approval decisions (the signed message starts with `<prefix>.v<N>`). Add a legacy signer domain, for example `magnus.approval-assertion,legacy.approval`. The first entry is preferred. Allowed characters: `a-z`, `0-9`, `.` and `-`. |
+| `MAGNUS_ROUTE_ALIASES_JSON` | unset | JSON object mapping legacy `/api/v1` path prefixes to current ones, for example `{"/api/v1/resource-leases/old-name/admission": "/api/v1/resource-leases/admission"}`. Requests are rewritten before routing, so authentication, endpoint scopes, rate limits and audit see the current path. Aliases cannot chain or contain `.`/`..` segments. |
+| `MAGNUS_WEBHOOK_TYPE_ALIASES` | unset | Comma-separated `legacy=format` pairs, for example `legacy-chat=mattermost`, so webhook endpoints stored or submitted under an older type name keep their delivery format. New and edited endpoints store the current format. |
+
+Older Hermes Agent plugins also need `MAGNUS_PLUGIN_API_ENABLED=true`, and an
+older approval bridge needs `MAGNUS_APPROVAL_BRIDGE_CONSUMER`. See the
+[changelog](../../CHANGELOG.md) for renamed variables.
+
 ## Develop
 
 From the repository root:

package/agent-version.json

@@ -1 +1 @@
-{"version":"1.0.2"}
+{"version":"1.0.3"}

package/dist/cli/env-catalog.js

@@ -3,6 +3,8 @@ export const ENV_CATALOG = [
     // ── Core ──
     { name: 'NODE_ENV', group: 'core', default: 'development', description: 'development, production or test. Production enforces TLS, DATABASE_URL and strict CORS.' },
     { name: 'LOG_LEVEL', group: 'core', default: 'info', description: 'debug, info, warn, error or fatal.' },
+    { name: 'MAGNUS_ROUTE_ALIASES_JSON', group: 'core', description: 'Optional JSON object mapping legacy /api/v1 path prefixes to current ones, for clients built against older route names. Requests are rewritten before routing, so auth and audit see the current path. Unset means no aliases.' },
+    { name: 'MAGNUS_WEBHOOK_TYPE_ALIASES', group: 'core', description: 'Optional comma-separated legacy=format pairs (format: generic, slack, discord or mattermost) so webhook endpoints stored or submitted under an older type name keep their delivery format.' },
     { name: 'MAGNUS_HOME', group: 'paths', default: '~/.magnus', description: 'Base directory for server-owned data (audit logs, credential rotation state, backups).' },
     { name: 'MAGNUS_ENV_FILE', group: 'paths', description: 'Env file loaded at startup (set by `--env-file`). Variables already in the environment win.' },
     { name: 'AUDIT_LOG_DIR', group: 'paths', default: '$MAGNUS_HOME/audit-logs', description: 'Directory for the append-only audit log files.' },
@@ -81,6 +83,7 @@ export const ENV_CATALOG = [
     { name: 'APPROVAL_SIGNER_PUBLIC_KEY_PEM', group: 'plugins', description: 'Ed25519 public key (PEM) that signs approval decisions. _B64 (DER) and _PATH variants are also accepted.' },
     { name: 'APPROVAL_TELEGRAM_ACTOR_SHA256', group: 'plugins', description: 'Actor binding digest for decisions from the Telegram channel.' },
     { name: 'APPROVAL_IPHONE_ACTOR_SHA256', group: 'plugins', description: 'Actor binding digest for decisions from the iPhone channel.' },
+    { name: 'MAGNUS_APPROVAL_ASSERTION_DOMAINS', group: 'plugins', default: 'magnus.approval-assertion', description: 'Comma-separated signature domain prefixes accepted for approval decisions (signed message is <prefix>.v<N>). The first is preferred; add a legacy signer domain to keep older signers working.' },
     { name: 'MAGNUS_COLLECTOR_TOKEN_SHA256', group: 'plugins', description: 'SHA-256 digest of a read-only external observability collector credential.' },
     { name: 'MAGNUS_FLEET_CHECK_TOKEN_SHA256', group: 'plugins', description: 'SHA-256 digest of the fleet-check reporter credential.' },
     // ── Hermes registry ──

package/dist/config/env.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import path from 'node:path';
+import { parseRouteAliases } from './route-aliases.js';
+import { webhookTypeAliases } from '../services/webhook-types.js';
 // ─── Shared environment schema — validated with Zod ───
 const portSchema = z.coerce.number().int().min(1).max(65535);
 const booleanEnvSchema = z.enum(['true', 'false']).default('false').transform((value) => value === 'true');
@@ -48,6 +50,10 @@ export const envSchema = z.object({
     APPROVAL_TELEGRAM_ACTOR_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     APPROVAL_IPHONE_ACTOR_SHA256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
     MAGNUS_APPROVAL_BRIDGE_CONSUMER: z.string().regex(/^[a-z0-9][a-z0-9._-]{0,63}$/i).optional(),
+    // Accepted approval-assertion signature domain prefixes (comma-separated); first is preferred.
+    MAGNUS_APPROVAL_ASSERTION_DOMAINS: z.string()
+        .regex(/^\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*(?:,\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*)*$/, 'must list domain prefixes made of a-z, 0-9, "." and "-", separated by commas')
+        .optional(),
     // Security Fusion: off (default) | local (in-process) | remote (external security console).
     SECURITY_FUSION_MODE: z.enum(['off', 'local', 'remote']).default('off'),
     SECURITY_FUSION_API_URL: z.string().url().optional(),
@@ -151,7 +157,27 @@ export const envSchema = z.object({
     HERMES_HIVEMEM_WORKSPACE_ID: z.string().optional(),
     HERMES_HIVEMEM_DEFAULT_SCOPE: z.enum(['private', 'shared']).optional(),
     HERMES_OPENAI_RUNTIME: z.enum(['auto', 'codex_app_server']).optional(),
+    // Optional legacy-path -> current-path prefix map for older clients (see config/route-aliases.ts).
+    MAGNUS_ROUTE_ALIASES_JSON: z.string().optional(),
+    // Optional legacy webhook type names: comma-separated legacy=format pairs.
+    MAGNUS_WEBHOOK_TYPE_ALIASES: z.string()
+        .regex(/^\s*(?:[a-z][a-z0-9_-]{0,31}\s*=\s*(?:generic|slack|discord|mattermost)\s*(?:,\s*|$))*$/, 'must list legacy=format pairs, where format is generic, slack, discord or mattermost')
+        .optional(),
 }).superRefine((env, ctx) => {
+    try {
+        webhookTypeAliases(env.MAGNUS_WEBHOOK_TYPE_ALIASES);
+    }
+    catch (error) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['MAGNUS_WEBHOOK_TYPE_ALIASES'],
+            message: error instanceof Error ? error.message : 'MAGNUS_WEBHOOK_TYPE_ALIASES is invalid' });
+    }
+    try {
+        parseRouteAliases(env.MAGNUS_ROUTE_ALIASES_JSON);
+    }
+    catch (error) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['MAGNUS_ROUTE_ALIASES_JSON'],
+            message: error instanceof Error ? error.message : 'MAGNUS_ROUTE_ALIASES_JSON is invalid' });
+    }
     if (env.HEALTH_SNAPSHOT_FULL_FIDELITY_HOURS > env.HEALTH_SNAPSHOT_RETENTION_DAYS * 24) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,

package/dist/config/route-aliases.js

@@ -0,0 +1,73 @@
+/**
+ * Optional request path aliases for clients built against older route names.
+ *
+ * `MAGNUS_ROUTE_ALIASES_JSON` is a JSON object that maps a legacy path prefix
+ * to the current one, for example
+ * `{"/api/v1/old/prefix": "/api/v1/new/prefix"}`. A request whose path equals a
+ * legacy prefix, or continues it after a `/`, is rewritten before routing, so
+ * authentication, endpoint scopes, rate limits and audit all see the current
+ * path. Unset (the default) means no aliases.
+ */
+const segment = '[A-Za-z0-9._~-]+';
+const aliasPath = new RegExp(`^/api/v1(?:/${segment})+$`);
+function validPath(path) {
+    return aliasPath.test(path) && !path.split('/').some(part => part === '.' || part === '..');
+}
+/** Parse and validate the alias map; throws a descriptive error when it is malformed. */
+export function parseRouteAliases(raw) {
+    if (raw === undefined || raw.trim() === '')
+        return [];
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('MAGNUS_ROUTE_ALIASES_JSON must be a JSON object');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('MAGNUS_ROUTE_ALIASES_JSON must be a JSON object');
+    const entries = Object.entries(value);
+    if (entries.length > 64)
+        throw new Error('MAGNUS_ROUTE_ALIASES_JSON may define at most 64 aliases');
+    const aliases = [];
+    for (const [from, to] of entries) {
+        if (typeof to !== 'string' || !validPath(from) || !validPath(to))
+            throw new Error('MAGNUS_ROUTE_ALIASES_JSON keys and values must be /api/v1/... paths without "." or ".." segments');
+        if (from === to)
+            throw new Error('MAGNUS_ROUTE_ALIASES_JSON maps a path to itself');
+        aliases.push({ from, to });
+    }
+    for (const { to } of aliases)
+        if (aliases.some(alias => to === alias.from || to.startsWith(`${alias.from}/`)))
+            throw new Error('MAGNUS_ROUTE_ALIASES_JSON targets must not be aliases themselves');
+    // Longest prefix first, so a more specific alias wins.
+    return aliases.sort((a, b) => b.from.length - a.from.length);
+}
+/** The current path for `path`, or null when no alias applies. */
+export function resolveRouteAlias(path, aliases) {
+    for (const { from, to } of aliases) {
+        if (path === from)
+            return to;
+        if (path.startsWith(`${from}/`))
+            return to + path.slice(from.length);
+    }
+    return null;
+}
+/** Wrap a fetch handler so legacy paths reach their current routes. Returns `fetch` unchanged without aliases. */
+export function withRouteAliases(fetch, aliases) {
+    if (!aliases.length)
+        return fetch;
+    return (request, env, context) => {
+        const url = new URL(request.url);
+        const target = resolveRouteAlias(url.pathname, aliases);
+        if (target === null)
+            return fetch(request, env, context);
+        url.pathname = target;
+        const init = {
+            method: request.method, headers: request.headers, redirect: request.redirect, signal: request.signal,
+            ...(request.body ? { body: request.body, duplex: 'half' } : {}),
+        };
+        return fetch(new Request(url, init), env, context);
+    };
+}
+//# sourceMappingURL=route-aliases.js.map

package/dist/index.js

@@ -18,6 +18,8 @@ const { securityFusionLocal, securityFusionMode, startSecurityExporter, stopSecu
 const { featureFlags } = await import('./config/features.js');
 const { serve } = await import('@hono/node-server');
 const { app } = await import('./server.js');
+const { parseRouteAliases, withRouteAliases } = await import('./config/route-aliases.js');
+const handler = withRouteAliases(app.fetch, parseRouteAliases(process.env['MAGNUS_ROUTE_ALIASES_JSON']));
 const { startRolloutReconciler, stopRolloutReconciler } = await import('./services/rollout-service.js');
 const { startApplicationProbes, stopApplicationProbes } = await import('./services/application-probes.js');
 const { startNodeIssueMonitor } = await import('./services/node-issue-monitor.js');
@@ -89,7 +91,7 @@ const listener = resolveListenerSecurity({
 });
 const server = listener.useTls
     ? serve({
-        fetch: app.fetch,
+        fetch: handler,
         port,
         hostname: listener.hostname,
         createServer,
@@ -101,7 +103,7 @@ const server = listener.useTls
         console.log(`🚀 Magnus server listening on https://${listener.hostname}:${info.port}`);
         startBackgroundServices();
     })
-    : serve({ fetch: app.fetch, port, hostname: listener.hostname }, (info) => {
+    : serve({ fetch: handler, port, hostname: listener.hostname }, (info) => {
         console.log(`🚀 Magnus server listening on http://${listener.hostname}:${info.port} (development opt-in)`);
         startBackgroundServices();
     });

package/dist/security/approval-assertion.js

@@ -2,6 +2,26 @@ import { createHash, createPublicKey, timingSafeEqual, verify } from 'node:crypt
 import { readFileSync } from 'node:fs';
 import { z } from 'zod';
 import { HttpError } from '../middleware/error-handler.js';
+/** Signature domain prefix for approval assertions; the signed message is `<prefix>.v<version>\n<canonical payload>`. */
+export const DEFAULT_APPROVAL_ASSERTION_DOMAIN = 'magnus.approval-assertion';
+export const approvalAssertionDomainPattern = /^[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?$/;
+/**
+ * Accepted signature domain prefixes, in preference order. The first one is the
+ * domain this server would sign with. `MAGNUS_APPROVAL_ASSERTION_DOMAINS`
+ * (comma-separated) lets older signers that use another prefix keep working.
+ */
+export function approvalAssertionDomains(value = process.env['MAGNUS_APPROVAL_ASSERTION_DOMAINS']) {
+    if (value === undefined || value.trim() === '')
+        return [DEFAULT_APPROVAL_ASSERTION_DOMAIN];
+    const domains = value.split(',').map(item => item.trim()).filter(Boolean);
+    if (!domains.length || domains.some(domain => !approvalAssertionDomainPattern.test(domain)))
+        throw new Error('MAGNUS_APPROVAL_ASSERTION_DOMAINS must list domain prefixes made of a-z, 0-9, "." and "-"');
+    return [...new Set(domains)];
+}
+/** The exact bytes signed for an approval payload under a domain prefix. */
+export function approvalSigningMessage(payload, domain = approvalAssertionDomains()[0]) {
+    return Buffer.from(`${domain}.v${payload.version}\n` + approvalPayloadCanonical(payload));
+}
 const identifier = z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9:._-]{0,159}$/);
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
 const payloadFields = {
@@ -49,7 +69,9 @@ export function verifyApprovalAssertion(raw) {
         const key = createPublicKey(inline ?? (encoded
             ? { key: Buffer.from(encoded, 'base64'), format: 'der', type: 'spki' }
             : readFileSync(path, 'utf8')));
-        valid = key.asymmetricKeyType === 'ed25519' && verify(null, Buffer.from(`magnus.approval-assertion.v${payload.version}\n` + canonical), key, Buffer.from(signature, 'base64url'));
+        const signatureBytes = Buffer.from(signature, 'base64url');
+        valid = key.asymmetricKeyType === 'ed25519' && approvalAssertionDomains()
+            .some(domain => verify(null, approvalSigningMessage(payload, domain), key, signatureBytes));
     }
     catch {
         valid = false;

package/dist/services/webhook-service.js

@@ -1,4 +1,5 @@
 import { recordMonitorPulse } from './monitor-pulse.js';
+import { WEBHOOK_FORMATS, webhookFormat } from './webhook-types.js';
 import { redactUnknown } from '../utils/redact.js';
 import { createHmac, randomBytes, createCipheriv } from 'node:crypto';
 import { nanoid } from 'nanoid';
@@ -67,7 +68,7 @@ export async function reconcileWebhookDeliveries() {
         // replaced; failed jobs are finalized by the worker's failure bookkeeping.
         await addDurableJob(getWebhookQueue(), 'deliver', createWebhookJobPayload(delivery.endpointId), {
             jobId: delivery.id,
-            attempts: delivery.endpoint.type === 'mattermost' ? 1 : Math.max(1, Math.min(11, delivery.endpoint.retries + 1)),
+            attempts: webhookFormat(delivery.endpoint.type) === 'mattermost' ? 1 : Math.max(1, Math.min(11, delivery.endpoint.retries + 1)),
             backoff: { type: 'exponential', delay: 1000 },
             removeOnComplete: { age: 86400, count: 10000 }, removeOnFail: { age: 604800, count: 10000 },
         }, ['completed']);
@@ -254,9 +255,9 @@ export function startWebhookWorker() {
         const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
         const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
         delete extraHeaders['x-magnus-encrypt'];
-        const { body: rawBody, contentType } = formatPayload(endpoint.type, delivery.event, delivery.payload);
+        const { body: rawBody, contentType } = formatPayload(webhookFormat(endpoint.type), delivery.event, delivery.payload);
         // Optionally encrypt the payload with AES-256-GCM
-        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const encrypted = shouldEncrypt && secret !== null && webhookFormat(endpoint.type) === 'generic';
         const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
         const headers = {
             ...extraHeaders,
@@ -269,7 +270,7 @@ export function startWebhookWorker() {
         if (secret) {
             headers['X-Magnus-Signature'] = `sha256=${signPayload(body, secret)}`;
         }
-        if (endpoint.type === 'mattermost' && !(await claimMattermostAttempt(deliveryId)))
+        if (webhookFormat(endpoint.type) === 'mattermost' && !(await claimMattermostAttempt(deliveryId)))
             return;
         try {
             const res = await postWebhook(webhookUrl(endpoint), { headers, body, timeoutMs: endpoint.timeoutMs });
@@ -356,7 +357,8 @@ export async function getWebhookEndpoint(id) {
 export async function createWebhookEndpoint(data) {
     const db = getDb();
     const id = nanoid();
-    if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type ?? 'generic'))
+    const type = webhookFormat(data.type ?? 'generic');
+    if (!WEBHOOK_FORMATS.includes(type))
         throw new Error('Unsupported webhook format');
     await validateWebhookTarget(data.url);
     const headers = normalizeHeaders(data.headers ?? {});
@@ -366,7 +368,7 @@ export async function createWebhookEndpoint(data) {
             id,
             name: data.name,
             url: encryptWebhookCredential(data.url, id, 'url'),
-            type: data.type ?? 'generic',
+            type,
             secret: data.secret === undefined ? null : encryptWebhookCredential(data.secret, id, 'secret'),
             events: JSON.stringify(data.events ?? []),
             headers: encryptWebhookCredential(JSON.stringify(headers), id, 'headers'),
@@ -390,9 +392,10 @@ export async function updateWebhookEndpoint(id, data) {
         updateData['url'] = encryptWebhookCredential(data.url, id, 'url');
     }
     if (data.type !== undefined) {
-        if (!['generic', 'slack', 'discord', 'mattermost'].includes(data.type))
+        const type = webhookFormat(data.type);
+        if (!WEBHOOK_FORMATS.includes(type))
             throw new Error('Unsupported webhook format');
-        updateData['type'] = data.type;
+        updateData['type'] = type;
     }
     if (data.secret !== undefined) {
         updateData['secret'] = data.secret === null ? null : encryptWebhookCredential(data.secret, id, 'secret');
@@ -442,12 +445,12 @@ export async function testWebhookEndpoint(id) {
             message: 'This is a test webhook delivery from Magnus',
             timestamp: new Date().toISOString(),
         };
-        const { body: rawBody, contentType } = formatPayload(endpoint.type, 'webhook.test', JSON.stringify(testPayload));
+        const { body: rawBody, contentType } = formatPayload(webhookFormat(endpoint.type), 'webhook.test', JSON.stringify(testPayload));
         const secret = encryptedSecret(endpoint);
         const extraHeaders = parseStoredHeaders(endpoint.id, endpoint.headers);
         const shouldEncrypt = extraHeaders['x-magnus-encrypt'] === 'true';
         delete extraHeaders['x-magnus-encrypt'];
-        const encrypted = shouldEncrypt && secret !== null && endpoint.type === 'generic';
+        const encrypted = shouldEncrypt && secret !== null && webhookFormat(endpoint.type) === 'generic';
         const body = encrypted ? encryptPayload(rawBody, secret) : rawBody;
         const headers = {
             ...extraHeaders,

package/dist/services/webhook-types.js

@@ -0,0 +1,29 @@
+export const WEBHOOK_FORMATS = ['generic', 'slack', 'discord', 'mattermost'];
+/**
+ * Legacy webhook type names mapped to current formats, from
+ * `MAGNUS_WEBHOOK_TYPE_ALIASES` (comma-separated `legacy=format` pairs). Lets
+ * endpoints stored or submitted under an older type name keep their format.
+ */
+export function webhookTypeAliases(raw = process.env['MAGNUS_WEBHOOK_TYPE_ALIASES']) {
+    if (raw === undefined || raw.trim() === '')
+        return {};
+    const aliases = {};
+    for (const pair of raw.split(',').map(item => item.trim()).filter(Boolean)) {
+        const [from, to, extra] = pair.split('=').map(item => item.trim());
+        if (extra !== undefined || !from || !to || !/^[a-z][a-z0-9_-]{0,31}$/.test(from)
+            || WEBHOOK_FORMATS.includes(from) || !WEBHOOK_FORMATS.includes(to))
+            throw new Error('MAGNUS_WEBHOOK_TYPE_ALIASES must list legacy=format pairs, where format is generic, slack, discord or mattermost');
+        aliases[from] = to;
+    }
+    return aliases;
+}
+/** The current delivery format for a stored or submitted webhook type. */
+export function webhookFormat(type) {
+    let aliases = {};
+    try {
+        aliases = webhookTypeAliases();
+    }
+    catch { /* Startup validation reports a malformed list. */ }
+    return Object.hasOwn(aliases, type) ? aliases[type] : type;
+}
+//# sourceMappingURL=webhook-types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-server",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Magnus server: the fleet control plane API (Hono, PostgreSQL, Redis) for nodes running magnus-agent, with optional Hive IAM, Hive Router, HiveMem, Hermes Agent and external security console integrations.",
   "keywords": [
     "magnus",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run db:generate && npm run clean && npm run build"
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.0.2",
+    "@hivemagnus/magnus-contracts": "1.0.3",
     "@hono/node-server": "^2.1.5",
     "@hono/swagger-ui": "^0.6.2",
     "@prisma/adapter-pg": "7.10.1",
@@ -102,7 +102,7 @@
     "ws": "^8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7",
-    "@hivemagnus/magnus-skills": "1.0.2",
+    "@hivemagnus/magnus-skills": "1.0.3",
     "prisma": "^7.10.1"
   },
   "devDependencies": {