@hivemagnus/magnus-server 1.1.12 → 2.0.0

package/.env.example

@@ -200,3 +200,8 @@ CORS_ORIGIN=https://magnus.example.com:3000
 # MAGNUS_AGENT_UPGRADE_MAX_FAILURES=2
 # The retired git-checkout self-update endpoints (source installs only).
 # MAGNUS_LEGACY_GIT_SELF_UPDATE=false
+
+# Optional Cindertrace response bridge. Configure a new dedicated secret.
+# CINDERTRACE_RESPONSE_SECRET=
+# CINDERTRACE_RESTART_ALLOWLIST=
+# CINDERTRACE_PROTECTED_TARGET_IDS=

package/README.md

@@ -187,3 +187,7 @@ migrations are never edited.
 ## License
 
 Apache-2.0. See [LICENSE](LICENSE).
+
+## Cindertrace
+
+Embedded Security Fusion is retired. See [migration and response configuration](../../docs/CINDERTRACE_MIGRATION.md). CINDERTRACE_RESPONSE_SECRET, CINDERTRACE_RESTART_ALLOWLIST, and CINDERTRACE_PROTECTED_TARGET_IDS configure the optional managed response adapter.

package/agent-version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.1.12"
+  "version": "2.0.0"
 }

package/dist/cli/env-catalog.js

@@ -60,6 +60,9 @@ export const ENV_CATALOG = [
     { name: 'MAGNUS_LESSONS_HIVEMEM_URL', group: 'hivemem', description: 'Optional HiveMem URL for operational lessons.' },
     { name: 'MAGNUS_LESSONS_HIVEMEM_TOKEN', group: 'hivemem', secret: true, description: 'Token for MAGNUS_LESSONS_HIVEMEM_URL.' },
     // ── Security Fusion / external security console ──
+    { name: 'CINDERTRACE_RESPONSE_SECRET', group: 'security', description: 'Dedicated HMAC credential for the optional Cindertrace managed response bridge.' },
+    { name: 'CINDERTRACE_RESTART_ALLOWLIST', group: 'security', description: 'Comma-separated allowlisted response service names; empty by default.' },
+    { name: 'CINDERTRACE_PROTECTED_TARGET_IDS', group: 'security', description: 'Comma-separated node IDs that Cindertrace must never isolate.' },
     { name: 'SECURITY_FUSION_MODE', group: 'security', default: 'off', description: 'off (feature disabled), local (cases and evidence in this server) or remote (export to an external security console).' },
     { name: 'SECURITY_FUSION_RECEIPT_SIGNING_KEY', group: 'security', secret: true, requiredWhen: 'SECURITY_FUSION_MODE=local', description: 'Dedicated key that signs Security Fusion deletion receipts (min 32 chars).' },
     { name: 'SECURITY_FUSION_EVIDENCE_DIR', group: 'security', description: 'Private evidence directory (local mode).' },

package/dist/config/env.js

@@ -55,7 +55,10 @@ export const envSchema = z.object({
         .regex(/^\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*(?:,\s*[a-z0-9](?:[a-z0-9.-]{0,98}[a-z0-9])?\s*)*$/, 'must list domain prefixes made of a-z, 0-9, "." and "-", separated by commas')
         .optional(),
     // Security Fusion: off (default) | local (in-process) | remote (external security console).
-    SECURITY_FUSION_MODE: z.enum(['off', 'local', 'remote']).default('off'),
+    SECURITY_FUSION_MODE: z.enum(['off', 'remote'], { error: 'Embedded Security Fusion local mode is retired; export and import state into Cindertrace before selecting remote mode (docs/CINDERTRACE_MIGRATION.md)' }).default('off'),
+    CINDERTRACE_RESPONSE_SECRET: z.string().min(32).optional(),
+    CINDERTRACE_RESTART_ALLOWLIST: z.string().optional(),
+    CINDERTRACE_PROTECTED_TARGET_IDS: z.string().optional(),
     SECURITY_FUSION_API_URL: z.string().url().optional(),
     MAGNUS_SECURITY_CONSOLE_URL: z.string().url().optional(),
     SECURITY_APPROVAL_BRIDGE_TOKEN: z.string().min(32).optional(),
@@ -246,10 +249,6 @@ export const envSchema = z.object({
             message: 'AGENT_DISCOVERY_SECRET is required when ENABLE_AGENT_DISCOVERY=true',
         });
     }
-    if (env.SECURITY_FUSION_MODE === 'local' && !env.SECURITY_FUSION_RECEIPT_SIGNING_KEY) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['SECURITY_FUSION_RECEIPT_SIGNING_KEY'],
-            message: 'SECURITY_FUSION_RECEIPT_SIGNING_KEY is required when SECURITY_FUSION_MODE=local' });
-    }
     if (env.MAGNUS_PLUGIN_API_ENABLED) {
         if (!env.MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON)
             ctx.addIssue({ code: z.ZodIssueCode.custom, path: ['MAGNUS_PLUGIN_READ_TOKEN_DIGESTS_JSON'],

package/dist/config/features.js

@@ -5,7 +5,7 @@ export function featureFlags(env = process.env) {
         iam: Boolean(env['IAM_CORE_URL']),
         router: Boolean(env['MAGNUS_ROUTER_URL'] || env['HIVE_ROUTER_URL']),
         hivemem: Boolean(env['HIVEMEM_URL']),
-        securityFusion: mode === 'local' || mode === 'remote' ? mode : 'off',
+        securityFusion: mode === 'remote' ? mode : 'off',
         securityConsoleUrl: env['MAGNUS_SECURITY_CONSOLE_URL'] || null,
         pluginApi: truthy(env['MAGNUS_PLUGIN_API_ENABLED']),
         hermesRegistry: truthy(env['MAGNUS_HERMES_REGISTRY_ENABLED']),