@hivemagnus/magnus-server 1.1.12 → 2.0.0

package/dist/db/generated/prisma/internal/prismaNamespace.js

@@ -172,7 +172,8 @@ export const ModelName = {
     ResourceDrainParticipant: 'ResourceDrainParticipant',
     ResourceParticipantWork: 'ResourceParticipantWork',
     ManagedCronDefinition: 'ManagedCronDefinition',
-    ManagedCronOccurrence: 'ManagedCronOccurrence'
+    ManagedCronOccurrence: 'ManagedCronOccurrence',
+    CindertraceResponse: 'CindertraceResponse'
 };
 /**
  * Enums
@@ -1582,6 +1583,16 @@ export const ManagedCronOccurrenceScalarFieldEnum = {
     admissionJson: 'admissionJson',
     createdAt: 'createdAt'
 };
+export const CindertraceResponseScalarFieldEnum = {
+    id: 'id',
+    actionOperation: 'actionOperation',
+    nodeId: 'nodeId',
+    requestSha256: 'requestSha256',
+    requestJson: 'requestJson',
+    status: 'status',
+    responseJson: 'responseJson',
+    createdAt: 'createdAt'
+};
 export const SortOrder = {
     asc: 'asc',
     desc: 'desc'

package/dist/db/generated/prisma/internal/prismaNamespaceBrowser.js

@@ -144,7 +144,8 @@ export const ModelName = {
     ResourceDrainParticipant: 'ResourceDrainParticipant',
     ResourceParticipantWork: 'ResourceParticipantWork',
     ManagedCronDefinition: 'ManagedCronDefinition',
-    ManagedCronOccurrence: 'ManagedCronOccurrence'
+    ManagedCronOccurrence: 'ManagedCronOccurrence',
+    CindertraceResponse: 'CindertraceResponse'
 };
 /*
  * Enums
@@ -1554,6 +1555,16 @@ export const ManagedCronOccurrenceScalarFieldEnum = {
     admissionJson: 'admissionJson',
     createdAt: 'createdAt'
 };
+export const CindertraceResponseScalarFieldEnum = {
+    id: 'id',
+    actionOperation: 'actionOperation',
+    nodeId: 'nodeId',
+    requestSha256: 'requestSha256',
+    requestJson: 'requestJson',
+    status: 'status',
+    responseJson: 'responseJson',
+    createdAt: 'createdAt'
+};
 export const SortOrder = {
     asc: 'asc',
     desc: 'desc'

package/dist/db/generated/prisma/models/CindertraceResponse.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CindertraceResponse.js.map

package/dist/index.js

@@ -14,7 +14,7 @@ if (existsSync(envFile))
 // Validate required secrets before starting anything
 const { validateSecrets } = await import('./utils/env.js');
 validateSecrets();
-const { securityFusionLocal, securityFusionMode, startSecurityExporter, stopSecurityExporter } = await import('./services/security-export.js');
+const { securityFusionMode, startSecurityExporter, stopSecurityExporter } = await import('./services/security-export.js');
 const { featureFlags } = await import('./config/features.js');
 const { serve } = await import('@hono/node-server');
 const { app } = await import('./server.js');
@@ -30,9 +30,6 @@ const { stopLogRetention } = await import('./services/log-retention.js');
 const { startHealthRetention } = await import('./services/health-retention.js');
 const { stopHealthRetention } = await import('./services/health-retention.js');
 const { startNotificationRetention, stopNotificationRetention } = await import('./services/notification-retention.js');
-const { startSecurityFusionRetention, stopSecurityFusionRetention } = await import('./services/security-fusion-service.js');
-const { reconcileSecurityFusionEvidence } = await import('./services/security-fusion-evidence-integrity.js');
-const { startSecurityFusionOutboxDispatcher, stopSecurityFusionOutboxDispatcher, } = await import('./services/security-fusion-outbox.js');
 const { startCommandWorker, closeCommandQueue } = await import('./queue/workers.js');
 const { startUpdateCheck, stopUpdateCheck } = await import('./services/update-check-service.js');
 const { startWebhookWorker, closeWebhookQueue } = await import('./services/webhook-service.js');
@@ -47,12 +44,6 @@ const port = Number(process.env['CONTROL_API_PORT'] ?? 4000);
 const features = featureFlags();
 console.log(`[startup] security-fusion=${securityFusionMode()} hermes-registry=${features.hermesRegistry ? 'on' : 'off'} `
     + `plugin-api=${features.pluginApi ? 'on' : 'off'} iam=${features.iam ? 'on' : 'off'}`);
-if (securityFusionLocal()) {
-    const evidenceReconciliation = await reconcileSecurityFusionEvidence();
-    console.log(`[security-fusion] evidence reconciliation checked=${evidenceReconciliation.checked} `
-        + `updated=${evidenceReconciliation.updated} quarantined=${evidenceReconciliation.quarantined} `
-        + `mismatched_cases=${evidenceReconciliation.mismatchedCases}`);
-}
 const { writeRuntimeFile } = await import('./utils/runtime-file.js');
 const { CONTROL_API_VERSION } = await import('./config/version.js');
 /** Background services shared by the TLS and development listeners. */
@@ -64,10 +55,6 @@ function startBackgroundServices(listenPort) {
     startLogRetention();
     startHealthRetention();
     startNotificationRetention();
-    if (securityFusionLocal()) {
-        startSecurityFusionRetention();
-        startSecurityFusionOutboxDispatcher();
-    }
     startSecurityExporter();
     startCommandWorker();
     startRolloutReconciler();
@@ -137,9 +124,7 @@ async function shutdown(signal) {
                 stopLogRetention();
                 stopHealthRetention();
                 stopNotificationRetention();
-                stopSecurityFusionRetention();
                 stopSecurityExporter();
-                stopSecurityFusionOutboxDispatcher();
                 stopCodexFleetMonitor();
                 stopUpdateCheck();
                 stopExtensionSourceMonitor();

package/dist/openapi/spec.js

@@ -5,7 +5,7 @@ import { participantWorkReconciliationSchema, historicalParticipantWorkReconcili
 import { sharedResourceLeaseIdentitySchema, sharedResourceLeaseViewSchema, sharedResourceReconciliationSchema, sharedResourceReserveSchema, sharedResourceTerminalEvidenceSchema, } from '../schemas/shared-resource-lease.js';
 import { managedCronRegistrationSchema, schedulerSourceSettlementSchema } from '../schemas/managed-cron.js';
 import { legacyAdmissionRequestSchema, resourceClaimSchema } from '../security/managed-http.js';
-import { magnusObservationSchema } from '@hivemagnus/magnus-contracts';
+import { magnusObservationSchema, responseRequestSchema } from '@hivemagnus/magnus-contracts';
 import { maintenanceSchema } from '../services/maintenance-service.js';
 import { rolloutInputSchema } from '../services/rollout-service.js';
 import { lessonSchema } from '../services/incident-lessons.js';
@@ -2703,6 +2703,7 @@ export function buildOpenApiSpec() {
         tags,
         components: {
             securitySchemes: {
+                cindertraceSignature: { type: 'apiKey', in: 'header', name: 'x-cindertrace-signature', description: 'Dedicated response HMAC bound to method, path, exact body, x-cindertrace-time and x-cindertrace-nonce. Responses are signed against the same request binding.' },
                 apiSecret: {
                     type: 'apiKey',
                     in: 'header',
@@ -2734,7 +2735,11 @@ export function buildOpenApiSpec() {
             },
             schemas: componentSchemas,
         },
-        paths,
+        paths: { ...paths,
+            '/api/v1/security-integration/response/execute': { post: { summary: 'Execute an exact Cindertrace-approved response through managed node admission', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], requestBody: { required: true, content: { 'application/json': { schema: zSchema.toJSONSchema(responseRequestSchema) } } }, responses: { 200: { description: 'Signed completion receipt' }, 409: { description: 'Expired, already claimed, blocked, or uncertain execution' } } } },
+            '/api/v1/security-integration/response/{id}': { get: { summary: 'Read an existing Cindertrace execution without replay', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed existing execution status' } } } },
+            '/api/v1/security-integration/response/targets/{id}/health': { get: { summary: 'Read fresh target health for Cindertrace', tags: ['Cindertrace'], security: [{ cindertraceSignature: [] }], parameters: [{ name: 'id', in: 'path', required: true, schema: { type: 'string' } }], responses: { 200: { description: 'Signed minimal health snapshot' } } } },
+        },
     };
 }
 //# sourceMappingURL=spec.js.map

package/dist/queue/workers.js

@@ -1,11 +1,9 @@
 import { ResourceLeaseConflict } from '../services/command-resource-leases.js';
-import { securityFusionLocal } from '../services/security-export.js';
 import { recordMonitorPulse } from '../services/monitor-pulse.js';
 import { Queue, Worker } from 'bullmq';
 import { addDurableJob } from './requeue.js';
 import { validateRemediationCommandForDispatch } from '../services/remediation-service.js';
 import { reconcileCommands } from '../services/command-lifecycle.js';
-import { reconcileRestartVerification } from '../services/security-fusion-verification.js';
 import { getDb } from '../db/index.js';
 import { NodeApiClient } from '../sdk/index.js';
 import { getNodeBaseUrl } from '../utils/node-url.js';
@@ -14,7 +12,6 @@ import { RESULT_SIGNING_PREVIOUS_SECRET, RESULT_SIGNING_SECRET, getNodeManagerSe
 import { safeParse } from '../utils/validate.js';
 import { commandFenceSchema, commandResultSchema } from '../schemas/node-responses.js';
 import { incMetric } from '../routes/metrics.js';
-import { securityFusionActionSources } from '../services/security-fusion-actions.js';
 import { verifyCommandResultSignature } from '../security/command-result-signature.js';
 // ─── Command execution queue ───
 const REDIS_PREFIX = process.env['REDIS_PREFIX'] ?? 'magnus-';
@@ -69,59 +66,6 @@ export async function enqueueCommand(commandId) {
         removeOnFail: { age: 24 * 60 * 60, count: 1_000 },
     });
 }
-/**
- * Verify agent HMAC-SHA256 signature over command result fields.
- * Returns true if valid, false if tampered. Skips if secret is not configured.
- */
-async function recordSecurityFusionCommandResult(commandId, succeeded, detail) {
-    const db = getDb();
-    const outbox = await db.securityFusionCommandOutbox.findUnique({
-        where: { remoteCommandId: commandId },
-    });
-    const action = outbox
-        ? await db.securityFusionAction.findUnique({ where: { id: outbox.actionId } })
-        : null;
-    if (action && outbox) {
-        if (succeeded && action.kind === 'service_restart') {
-            const transitioned = await db.securityFusionAction.updateMany({
-                where: { id: action.id, status: { in: securityFusionActionSources('verifying') } },
-                data: { status: 'verifying', resultJson: JSON.stringify({ commandId, ...detail }) },
-            });
-            if (transitioned.count !== 1)
-                return;
-            await db.securityFusionCaseActivity.create({
-                data: {
-                    caseId: action.caseId,
-                    kind: 'containment.restart_verifying',
-                    actorId: 'system:command-worker',
-                    detailJson: JSON.stringify({ actionId: action.id, commandId }),
-                },
-            });
-            return;
-        }
-        const releasing = outbox.operation === 'release';
-        const status = succeeded ? (releasing ? 'released' : 'succeeded') : 'failed';
-        const transitioned = await db.securityFusionAction.updateMany({
-            where: {
-                id: action.id,
-                status: {
-                    in: securityFusionActionSources(status),
-                },
-            },
-            data: { status, resultJson: JSON.stringify({ commandId, ...detail }) },
-        });
-        if (transitioned.count !== 1)
-            return;
-        await db.securityFusionCaseActivity.create({
-            data: {
-                caseId: action.caseId,
-                kind: `containment.${status}`,
-                actorId: 'system:command-worker',
-                detailJson: JSON.stringify({ actionId: action.id, commandId, ...detail }),
-            },
-        });
-    }
-}
 /** Start the command execution worker. */
 export function startCommandWorker() {
     if (_commandWorker)
@@ -241,11 +185,6 @@ export function startCommandWorker() {
             });
             if (!recorded)
                 return;
-            if (securityFusionLocal())
-                await recordSecurityFusionCommandResult(commandId, result.exitCode === 0, {
-                    exitCode: result.exitCode,
-                    durationMs: result.durationMs,
-                });
             // Emit notification on command failure
             if (result.exitCode !== 0) {
                 // Look up node name for the notification
@@ -287,8 +226,6 @@ export function startCommandWorker() {
             });
             if (!failed)
                 throw err;
-            if (securityFusionLocal())
-                await recordSecurityFusionCommandResult(commandId, false, { error: errMsg });
             // Emit notification on worker-level failure
             const node = nodeId ? await db.node.findUnique({
                 where: { id: nodeId },
@@ -321,8 +258,6 @@ export function startCommandWorker() {
         reconciliationBusy = true;
         try {
             await reconcileCommands();
-            if (securityFusionLocal())
-                await reconcileRestartVerification();
             recordMonitorPulse('commands');
         }
         catch {

package/dist/routes/cindertrace-response.js

@@ -0,0 +1,183 @@
+import { bridgeSignature, equalSignature } from '../security/cindertrace-response.js';
+import { createHash } from 'node:crypto';
+import { Hono } from 'hono';
+import { responseRequestSchema } from '@hivemagnus/magnus-contracts';
+import { getDb } from '../db/index.js';
+import { NodeApiClient } from '../sdk/node-api-client.js';
+import { getNodeBaseUrl } from '../utils/node-url.js';
+import { getNodeManagerSecret } from '../utils/env.js';
+import { HttpError } from '../middleware/error-handler.js';
+import { logAuditEvent } from '../services/audit-service.js';
+export const cindertraceResponseRouter = new Hono();
+function secret() {
+    const value = process.env['CINDERTRACE_RESPONSE_SECRET'] ?? '';
+    if (value.length < 32 ||
+        value === process.env['API_SECRET'] ||
+        value === process.env['NODE_MANAGER_SECRET'])
+        throw new HttpError(503, 'RESPONSE_DISABLED', 'Dedicated Cindertrace response credential is required');
+    return value;
+}
+cindertraceResponseRouter.use('*', async (c, next) => {
+    const timestamp = c.req.header('x-cindertrace-time') ?? '', nonce = c.req.header('x-cindertrace-nonce') ?? '';
+    if (!/^\d{13}$/.test(timestamp) ||
+        Math.abs(Date.now() - Number(timestamp)) > 60000 ||
+        !/^[a-f0-9]{32}$/.test(nonce))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid response request');
+    const raw = c.req.method === 'GET' ? '' : await c.req.text();
+    if (Buffer.byteLength(raw) > 16384 ||
+        !equalSignature(c.req.header('x-cindertrace-signature') ?? '', bridgeSignature(secret(), c.req.method, c.req.path, timestamp, nonce, raw)))
+        throw new HttpError(401, 'UNAUTHORIZED', 'Invalid response request');
+    await next();
+    // Sign the exact response body and bind it to this request; no source output or credentials are returned.
+    const text = await c.res.clone().text();
+    c.header('x-cindertrace-signature', bridgeSignature(secret(), 'RESPONSE', c.req.path, timestamp, nonce, text));
+    c.header('Cache-Control', 'no-store');
+});
+async function client(nodeId) {
+    const node = await getDb().node.findUnique({ where: { id: nodeId } });
+    if (!node)
+        throw new HttpError(404, 'TARGET_NOT_FOUND', 'Target is unavailable');
+    return {
+        node,
+        api: new NodeApiClient({
+            baseUrl: getNodeBaseUrl(node.ipAddress, node.port),
+            nodeToken: getNodeManagerSecret(),
+            resourceNodeId: node.id,
+            resourceActorId: 'service:cindertrace',
+        }),
+    };
+}
+cindertraceResponseRouter.get('/targets/:id/health', async (c) => {
+    const { api } = await client(c.req.param('id'));
+    const health = await api.collectHealth();
+    return c.json({
+        data: {
+            services: health.data?.services ?? [],
+            wazuh: health.data?.wazuh,
+            responseCapable: await api.securityResponseCapable(),
+        },
+    });
+});
+export function validateResponsePolicy(p, node) {
+    if (p.operation === 'release')
+        return;
+    if (node.status !== 'ONLINE' ||
+        !node.lastHeartbeatAt ||
+        Date.now() - node.lastHeartbeatAt.getTime() > 120000)
+        throw new HttpError(409, 'TARGET_STALE', 'A fresh online target is required');
+    if (p.kind === 'service_restart') {
+        const allowed = (process.env['CINDERTRACE_RESTART_ALLOWLIST'] ?? '')
+            .split(',')
+            .map((x) => x.trim());
+        if (!p.serviceName || !allowed.includes(p.serviceName))
+            throw new HttpError(403, 'RESTART_BLOCKED', 'Service must be explicitly allowlisted');
+    }
+    else {
+        const tags = JSON.parse(node.tags), metadata = JSON.parse(node.metadata);
+        const protectedIds = (process.env['CINDERTRACE_PROTECTED_TARGET_IDS'] ?? '').split(',');
+        if (protectedIds.includes(node.id) ||
+            tags.some((x) => ['control-plane', 'network-infrastructure'].includes(x)) ||
+            metadata['securityIsolationPolicy'] !== 'allow' ||
+            metadata['securityIsolationCapable'] !== true ||
+            metadata['securityAegisChannelVerified'] !== true)
+            throw new HttpError(403, 'ISOLATION_BLOCKED', 'Explicit isolation policy, capability, and verified recovery channel are required');
+    }
+}
+cindertraceResponseRouter.post('/execute', async (c) => {
+    const parsed = responseRequestSchema.safeParse(await c.req.json());
+    if (!parsed.success)
+        throw new HttpError(400, 'INVALID_RESPONSE', 'Malformed response plan');
+    const p = parsed.data, raw = JSON.stringify(p), hash = createHash('sha256').update(raw).digest('hex');
+    const db = getDb();
+    const prior = await db.cindertraceResponse.findUnique({ where: { id: p.executionId } });
+    if (prior) {
+        if (prior.requestSha256 !== hash)
+            throw new HttpError(409, 'RESPONSE_CONFLICT', 'Execution identity is bound to another plan');
+        if (prior.status !== 'completed' || !prior.responseJson)
+            throw new HttpError(409, 'RESPONSE_UNKNOWN', 'Inspect the original execution; do not replay it');
+        return c.json(JSON.parse(prior.responseJson));
+    }
+    if (p.expiresAt <= Date.now() || p.expiresAt > Date.now() + 600000)
+        throw new HttpError(409, 'APPROVAL_EXPIRED', 'Approval is expired or outside its maximum lifetime');
+    const { node, api } = await client(p.nodeId);
+    validateResponsePolicy(p, node);
+    if (p.operation === 'release') {
+        const original = await db.cindertraceResponse.findUnique({
+            where: { actionOperation: `${p.actionId}:execute` },
+        });
+        if (!original ||
+            original.nodeId !== p.nodeId ||
+            JSON.parse(original.requestJson).kind !== 'host_isolation')
+            throw new HttpError(409, 'RELEASE_UNBOUND', 'Release requires an existing isolation execution on this target');
+    }
+    try {
+        await db.cindertraceResponse.create({
+            data: {
+                id: p.executionId,
+                actionOperation: `${p.actionId}:${p.operation}`,
+                nodeId: p.nodeId,
+                requestSha256: hash,
+                requestJson: raw,
+            },
+        });
+    }
+    catch (error) {
+        if (error.code === 'P2002')
+            throw new HttpError(409, 'RESPONSE_ALREADY_CLAIMED', 'Action operation already has an owner');
+        throw error;
+    }
+    await logAuditEvent({
+        action: 'cindertrace.response_claimed',
+        actorId: p.approvedBy,
+        targetType: 'node',
+        targetId: p.nodeId,
+        details: {
+            actionId: p.actionId,
+            executionId: p.executionId,
+            planSha256: p.planSha256,
+            operation: p.operation,
+        },
+    });
+    try {
+        const result = await api.securityResponse({
+            operation: p.operation,
+            kind: p.kind,
+            serviceName: p.serviceName,
+            isolationMinutes: p.isolationMinutes,
+        }, p.executionId);
+        if (!result.response.success || !Number.isInteger(result.response.data?.exitCode))
+            throw new Error('Response failed');
+        const reply = {
+            commandId: p.executionId,
+            actionId: p.actionId,
+            nodeId: p.nodeId,
+            operation: p.operation,
+            planSha256: p.planSha256,
+            exitCode: result.response.data.exitCode,
+            receiptSha256: result.evidence.receiptSha256,
+        };
+        await db.cindertraceResponse.update({
+            where: { id: p.executionId },
+            data: { status: 'completed', responseJson: JSON.stringify(reply) },
+        });
+        return c.json(reply);
+    }
+    catch {
+        await db.cindertraceResponse.update({
+            where: { id: p.executionId },
+            data: { status: 'unknown' },
+        });
+        throw new HttpError(409, 'RESPONSE_UNKNOWN', 'No verified completion; inspect the original execution');
+    }
+});
+cindertraceResponseRouter.get('/:id', async (c) => {
+    const row = await getDb().cindertraceResponse.findUnique({ where: { id: c.req.param('id') } });
+    if (!row)
+        throw new HttpError(404, 'NOT_FOUND', 'Execution is unavailable');
+    return c.json({
+        executionId: row.id,
+        status: row.status,
+        result: row.responseJson ? JSON.parse(row.responseJson) : null,
+    });
+});
+//# sourceMappingURL=cindertrace-response.js.map

package/dist/routes/heartbeat.js

@@ -1,4 +1,4 @@
-import { enqueueSecurityObservations, securityFusionLocal } from '../services/security-export.js';
+import { enqueueSecurityObservations } from '../services/security-export.js';
 import { warnOnAgentVersionMismatch } from '../services/agent-version-warnings.js';
 import { recordSelfUpgradeReport } from '../services/agent-upgrade-service.js';
 import { Hono } from 'hono';
@@ -22,7 +22,6 @@ import { heartbeatHealthSchema } from '../schemas/node-responses.js';
 import { normalizeIpAddress, isLoopbackOrUnroutableIp, isUsableNodeIp } from '../utils/ip.js';
 import { AGENT_VERSION } from '../config/version.js';
 import { getHeartbeatStreamStats } from '../services/heartbeat-stream.js';
-import { ingestMagnusServiceHealth } from '../services/security-fusion-service.js';
 import { deriveAgentCertificateHostname, selectAgentEndpointHostname, verifyAgentCertificateHostname, } from '../utils/node-url.js';
 import { heartbeatPeerAddress } from '../utils/heartbeat-peer.js';
 import { authMiddleware } from '../middleware/auth.js';
@@ -490,10 +489,6 @@ heartbeatRouter.post('/', async (c) => {
                 await enqueueSecurityObservations(tx, nodeId, existing?.name ?? fqdn ?? nodeId, (h.services ?? []), snapshot.id, snapshot.timestamp);
                 return snapshot;
             });
-            if (securityFusionLocal())
-                void ingestMagnusServiceHealth(nodeId, existing?.name ?? fqdn ?? nodeId, (h.services ?? [])).catch((err) => {
-                    console.error(`[security-fusion] heartbeat conversion failed for ${nodeId}:`, err instanceof Error ? err.message : err);
-                });
             // Evaluate health against alert rules (fire-and-forget)
             const alertNodeName = existing?.name ?? fqdn ?? nodeId;
             evaluateHealth(nodeId, alertNodeName, {