@hivemagnus/magnus-server 1.1.4 → 1.1.7

package/agent-version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.1.4"
+  "version": "1.1.7"
 }

package/dist/sdk/node-api-client.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { MANAGED_CLAIM_HEADER, httpIdentity, httpReceiptBody, managedHttpRequestSchema } from '../security/managed-http.js';
+import { MANAGED_CLAIM_HEADER, credentialMutationIdentity, httpIdentity, httpReceiptBody, managedHttpRequestSchema } from '../security/managed-http.js';
 import { nativeCompletionDescriptor, nativeCompletionResourceKey } from '../security/native-completion-registry.js';
 import { COMMAND_COMPLETION_REGISTRY, COMMAND_COMPLETION_REGISTRY_SHA256, commandCompletionDescriptor } from '../security/command-completion-registry.js';
 import { commandReconciliationSchema } from '../schemas/command-reconciliation.js';
@@ -232,6 +232,25 @@ export class NodeApiClient {
     async mutate(method, path, body, timeout = this.defaultTimeout) {
         return (await this.mutateWithEvidence(method, path, body, timeout)).response;
     }
+    /**
+     * A body holding a credential never goes through the digest in mutateWithEvidence.
+     * Enrolled nodes refuse it exactly as they refuse any mutation without a reviewed
+     * completion boundary; other nodes receive the same direct POST as before.
+     */
+    async mutateWithCredential(path, body, timeout = this.defaultTimeout) {
+        if (!this.resourceContext)
+            throw new Error('Managed mutation requires canonical resource node identity');
+        const nativePath = '/' + path;
+        if (nativeCompletionDescriptor('POST', nativePath))
+            throw new Error('A managed native path cannot carry an unbound credential mutation');
+        const identity = credentialMutationIdentity('native-' + randomUUID(), 'POST', nativePath, Math.min(3600, Math.ceil(timeout / 1000)));
+        const admission = await admitResourceCommand(this.resourceContext, identity);
+        if (admission) {
+            await failResourceCommand(admission);
+            throw new Error('This enrolled-node mutation lacks a reviewed completion boundary; not dispatched');
+        }
+        return this.api(path, { method: 'POST', body: JSON.stringify(body), headers: { 'content-type': 'application/json' }, timeout, retry: 0 }).json();
+    }
     async evidencedMutation(method, path, body, commandId) {
         const result = await this.mutateWithEvidence(method, path, body, this.defaultTimeout, commandId);
         if (!result.evidence)
@@ -558,10 +577,10 @@ export class NodeApiClient {
         return this.api.get('users').json();
     }
     async provisionUser(payload) {
-        return this.mutate('POST', 'users/provision', payload);
+        return this.mutateWithCredential('users/provision', payload);
     }
     async changeUserPassword(payload) {
-        return this.mutate('POST', 'users/change-password', payload);
+        return this.mutateWithCredential('users/change-password', payload);
     }
 }
 //# sourceMappingURL=node-api-client.js.map

package/dist/security/managed-http.js

@@ -1,5 +1,5 @@
 /** Versioned native HTTP identity. Hashes bind request bytes; bodies stay off receipts. */
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { z } from 'zod';
 import { commandFenceSchema } from '../schemas/node-responses.js';
 export const managedClaimSchema = z.object({
@@ -23,12 +23,26 @@ export const managedHttpRequestSchema = z.object({
 export const MANAGED_HTTP_COMMAND = '@magnus/native-http/v1';
 export const MANAGED_CLAIM_HEADER = 'x-magnus-resource-claim';
 export function sha256(value) { return createHash('sha256').update(value).digest('hex'); }
-export function httpIdentity(commandId, method, path, body, timeoutSeconds) {
+function assertCanonicalMutation(method, path) {
     if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(method) || !/^\/[a-zA-Z0-9/_%.:-]+$/.test(path)
         || path.includes('..') || path.includes('//'))
         throw new Error('Canonical native mutation path required');
+}
+export function httpIdentity(commandId, method, path, body, timeoutSeconds) {
+    assertCanonicalMutation(method, path);
     return { commandId, command: MANAGED_HTTP_COMMAND, args: [method, path, sha256(body)], timeoutSeconds };
 }
+/**
+ * Identity for a mutation whose body holds a credential. A stored digest of
+ * such a body could be guessed offline, so the digest slot holds a random value
+ * instead of binding the body. That is safe only because these paths are absent
+ * from the native completion registry on every released agent: they are never
+ * sent through managed HTTP, so no agent ever recomputes this identity.
+ */
+export function credentialMutationIdentity(commandId, method, path, timeoutSeconds) {
+    assertCanonicalMutation(method, path);
+    return { commandId, command: MANAGED_HTTP_COMMAND, args: [method, path, sha256(randomUUID())], timeoutSeconds };
+}
 export function httpReceiptBody(method, path, status, body) {
     return JSON.stringify({ version: 1, method, path, status, responseSha256: sha256(body) });
 }

package/dist/services/agent-upgrade-service.js

@@ -185,7 +185,7 @@ export async function resolveAgentRelease(options = {}) {
         return { version, integrity: options.integrity };
     }
     const registry = upgradeSettings().updateRegistry;
-    const url = `${registry}/${AGENT_PACKAGE.replace('/', '%2f')}/${version}`;
+    const url = `${registry}/@${encodeURIComponent(AGENT_PACKAGE.slice(1))}/${version}`;
     let response;
     try {
         response = await (options.fetchImpl ?? fetch)(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(options.timeoutMs ?? 15_000) });

package/dist/services/hermes-cli-parser.js

@@ -1,3 +1,58 @@
+import { parseGatewayStatusText } from './hermes-gateway-status.js';
+/** Python port of parseGatewayStatusText for SSH detection, pinned to it by a shared test table. */
+export const GATEWAY_STATUS_PYTHON = String.raw `
+def parse_gateway_status(text):
+    text = re.sub(r'\x1b\[[0-9;]*m', '', text or '').lower()
+    lines = re.split(r'\r?\n', text)
+    states = []
+    for line in lines:
+        match = re.match(r'\s*active:\s*([a-z-]+)(?:\s*\(([^)]*)\))?', line)
+        if not match:
+            continue
+        state, detail = match.group(1), match.group(2) or ''
+        if state == 'active':
+            states.append('inactive' if detail.startswith('exited') else 'running')
+        elif state == 'reloading':
+            states.append('running')
+        elif state in ('inactive', 'deactivating'):
+            states.append('inactive')
+        elif state == 'failed':
+            states.append('failed')
+        elif state == 'activating':
+            states.append('failed' if 'auto-restart' in detail else 'unknown')
+        else:
+            states.append('unknown')
+    if states:
+        for state in ('running', 'failed', 'inactive'):
+            if state in states:
+                return state
+        return 'unknown'
+    ignored = re.compile(
+        r'^\s*(?:[a-z]{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}|\d{4}-\d{2}-\d{2}[t ]\d{2}:\d{2})'
+        r'|^\s*(?:loaded|docs|main pid|tasks|memory|cpu|cgroup|process|drop-in|triggeredby|invocation|status|ip|mem peak)\s*:'
+        r'|^\s*[●○×↻✗✓]?\s*\S+\.service\b'
+        r'|^\s*[│├└]'
+        r'|\b(?:linger|auto-?start|on boot|at boot)\b'
+        r'|failed to connect to bus')
+    healthy = re.compile(r'\b(?:no|0|zero)\s+(?:errors?|failures?|failed)\b|\b(?:last|previous|recent)\s+(?:errors?|failures?)\b.*$')
+    current = []
+    in_history = False
+    for line in lines:
+        if re.match(r'\s*recent\b.*:\s*$', line):
+            in_history = True
+        elif not line.strip():
+            in_history = False
+        if not in_history:
+            current.append(line)
+    summary = [healthy.sub(' ', line) for line in current if not ignored.search(line)]
+    if any(re.search(r"\b(?:not[\s_-]+(?:running|active|started|loaded|installed)|isn'?t\s+running|inactive|stopped|disabled|dead|exited|could not be found)\b", line) for line in summary):
+        return 'inactive'
+    if any(re.search(r'\b(?:failed|failure|crashed|fatal|errors?|errored|unhealthy|not[\s_-]+healthy)\b', line) for line in summary):
+        return 'failed'
+    if any(re.search(r'\b(?:running|active|healthy)\b', line) for line in summary):
+        return 'running'
+    return 'unknown'
+`;
 const START = '__MAGNUS_HERMES_JSON_START__';
 const END = '__MAGNUS_HERMES_JSON_END__';
 function asRecord(value) {
@@ -36,7 +91,7 @@ export function normalizeServiceStatus(value) {
         return 'error';
     if (['not_installed', 'missing', 'not-found'].includes(text))
         return 'not_installed';
-    return 'unknown';
+    return parseGatewayStatusText(text);
 }
 export function normalizeInstallationStatus(value, installed) {
     const text = String(value ?? '').toLowerCase();
@@ -182,7 +237,7 @@ opts = json.loads(base64.b64decode(os.environ['MAGNUS_HERMES_PAYLOAD']).decode('
 hermes_home = os.path.expanduser(opts.get('hermesHome') or '~/.hermes')
 requested_bin = opts.get('hermesBin') or 'hermes'
 dashboard_port = int(opts.get('dashboardPort') or 9119)
-
+${GATEWAY_STATUS_PYTHON}
 
 def looks_like_hermes_home(path):
     home = pathlib.Path(path)
@@ -360,10 +415,10 @@ if resolved_bin:
             plugins.append({'slug': cells[0], 'pluginType': cells[0].split('/')[0] if '/' in cells[0] else 'general', 'version': cells[2] or None, 'status': status_value, 'healthState': 'unknown', 'metadata': {'source': cells[4] or 'hermes plugins list'}})
 
     gateway_result = run([resolved_bin, 'gateway', 'status'])
-    gateway_text = (gateway_result['stdout'] + gateway_result['stderr']).lower()
+    gateway_state = parse_gateway_status(gateway_result['stdout'] + gateway_result['stderr'])
 else:
     gateway_result = {'code': 127, 'stdout': '', 'stderr': 'hermes binary not found'}
-    gateway_text = ''
+    gateway_state = 'unknown'
 
 # Profile discovery fallback: Hermes can be installed with a valid home even when
 # the binary is not visible to a non-login SSH shell. Scan profile directories,
@@ -410,7 +465,8 @@ if installed and not profiles and pathlib.Path(hermes_home).exists():
 # Check systemd and port hints for local dashboard status.
 dash_user = run(['systemctl', '--user', 'is-active', 'hermes-dashboard.service'])
 dash_system = run(['systemctl', 'is-active', 'hermes-dashboard.service'])
-dash_text = (dash_user['stdout'] + dash_user['stderr'] + dash_system['stdout'] + dash_system['stderr']).lower()
+# is-active prints exactly one state per unit; compare whole lines because 'inactive' contains 'active'.
+dash_states = {line.strip() for line in (dash_user['stdout'] + '\n' + dash_system['stdout']).lower().splitlines()}
 
 # Read base .env for API server hints and configured provider key names. Do not return secret values.
 env_path = pathlib.Path(hermes_home) / '.env'
@@ -611,8 +667,11 @@ if plugins_dir.exists():
 status = 'not_installed'
 if installed:
     status = 'detected'
-    if 'running' in gateway_text or 'active' in gateway_text:
+    if gateway_state == 'running':
         status = 'running'
+    elif not resolved_bin:
+        # A Hermes home without a working binary is leftover data, not a usable installation.
+        status = 'degraded'
     elif resolved_bin and not pathlib.Path(hermes_home).exists():
         status = 'needs_setup'
 
@@ -622,8 +681,8 @@ out = {
     'version': version,
     'hermesBin': resolved_bin or requested_bin,
     'hermesHome': hermes_home,
-    'gatewayStatus': 'running' if ('running' in gateway_text or 'active' in gateway_text) else ('error' if gateway_result.get('code') not in (0, None) and resolved_bin else 'unknown'),
-    'dashboardStatus': 'running' if 'active' in dash_text else ('inactive' if 'inactive' in dash_text else 'unknown'),
+    'gatewayStatus': gateway_state if gateway_state != 'unknown' else ('error' if gateway_result.get('code') not in (0, None) and resolved_bin else 'unknown'),
+    'dashboardStatus': 'running' if 'active' in dash_states else ('failed' if 'failed' in dash_states else ('inactive' if 'inactive' in dash_states else 'unknown')),
     'dashboardPort': dashboard_port,
     'apiServerEnabled': api_enabled,
     'apiServerHost': api_host,

package/dist/services/hermes-gateway-status.js

@@ -0,0 +1,67 @@
+const ANSI_COLOUR = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g');
+const ACTIVE_LINE = /^\s*active:\s*([a-z-]+)(?:\s*\(([^)]*)\))?/;
+const IGNORED_LINE = new RegExp([
+    // Journal tail: "Nov 02 10:00:00 host ..." or "2026-11-02 10:00:00 ...".
+    String.raw `^\s*(?:[a-z]{3}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}|\d{4}-\d{2}-\d{2}[t ]\d{2}:\d{2})`,
+    // systemctl status fields other than Active, its unit title and its process tree.
+    String.raw `^\s*(?:loaded|docs|main pid|tasks|memory|cpu|cgroup|process|drop-in|triggeredby|invocation|status|ip|mem peak)\s*:`,
+    String.raw `^\s*[●○×↻✗✓]?\s*\S+\.service\b`,
+    String.raw `^\s*[│├└]`,
+    // Boot and session settings say nothing about the gateway's current state.
+    String.raw `\b(?:linger|auto-?start|on boot|at boot)\b`,
+    // systemctl could not ask: that is not evidence about the gateway either.
+    String.raw `failed to connect to bus`,
+].join('|'));
+// `hermes gateway status` ends with history under a heading such as "Recent gateway health:".
+const HISTORY_HEADING = /^\s*recent\b.*:\s*$/;
+const HEALTHY_PHRASE = /\b(?:no|0|zero)\s+(?:errors?|failures?|failed)\b|\b(?:last|previous|recent)\s+(?:errors?|failures?)\b.*$/g;
+const NEGATIVE = /\b(?:not[\s_-]+(?:running|active|started|loaded|installed)|isn'?t\s+running|inactive|stopped|disabled|dead|exited|could not be found)\b/;
+const FAILED = /\b(?:failed|failure|crashed|fatal|errors?|errored|unhealthy|not[\s_-]+healthy)\b/;
+const POSITIVE = /\b(?:running|active|healthy)\b/;
+function withoutHistory(lines) {
+    let inHistory = false;
+    return lines.filter((line) => {
+        if (HISTORY_HEADING.test(line))
+            inHistory = true;
+        else if (!line.trim())
+            inHistory = false;
+        return !inHistory;
+    });
+}
+function activeLineState(state, detail) {
+    if (state === 'active')
+        return detail.startsWith('exited') ? 'inactive' : 'running';
+    if (state === 'reloading')
+        return 'running';
+    if (state === 'inactive' || state === 'deactivating')
+        return 'inactive';
+    if (state === 'failed')
+        return 'failed';
+    // A unit waiting to restart after a crash is failing, one starting up is not known yet.
+    if (state === 'activating')
+        return detail.includes('auto-restart') ? 'failed' : 'unknown';
+    return 'unknown';
+}
+export function parseGatewayStatusText(text) {
+    const lines = text.replace(ANSI_COLOUR, '').toLowerCase().split(/\r?\n/);
+    const activeStates = lines.flatMap((line) => {
+        const match = ACTIVE_LINE.exec(line);
+        return match ? [activeLineState(match[1] ?? '', match[2] ?? '')] : [];
+    });
+    if (activeStates.length > 0) {
+        // User and system units can both print a status block.
+        for (const state of ['running', 'failed', 'inactive'])
+            if (activeStates.includes(state))
+                return state;
+        return 'unknown';
+    }
+    const summary = withoutHistory(lines).filter((line) => !IGNORED_LINE.test(line)).map((line) => line.replace(HEALTHY_PHRASE, ' '));
+    if (summary.some((line) => NEGATIVE.test(line)))
+        return 'inactive';
+    if (summary.some((line) => FAILED.test(line)))
+        return 'failed';
+    if (summary.some((line) => POSITIVE.test(line)))
+        return 'running';
+    return 'unknown';
+}
+//# sourceMappingURL=hermes-gateway-status.js.map

package/dist/services/hermes-service.js

@@ -1,5 +1,6 @@
 import { observedDashboardEndpoint } from './hermes-dashboard-endpoint.js';
 import { getDb } from '../db/index.js';
+import { normalizeServiceStatus } from './hermes-cli-parser.js';
 // SSH-backed Hermes mutations (deploy, configure, profile, gateway, dashboard,
 // API-server, and OpenClaw operations) are retired; their routes return 410.
 // This module keeps inventory reads and agent-reported state recording.
@@ -181,7 +182,7 @@ function profileFromNodeRecord(record, hermesHome) {
         profileHome: stringField(record, 'profileHome', 'profile_home')
             ?? hermesHome.replace(/\/+$/, '') + '/profiles/' + name,
         isDefault: booleanField(record, name === 'default', 'isDefault', 'is_default', 'default'),
-        gatewayStatus: (stringField(record, 'gatewayStatus', 'gateway_status') ?? 'unknown'),
+        gatewayStatus: normalizeServiceStatus(stringField(record, 'gatewayStatus', 'gateway_status')),
         apiServerEnabled: booleanField(record, false, 'apiServerEnabled', 'api_server_enabled'),
         apiServerHost: stringField(record, 'apiServerHost', 'api_server_host') ?? '127.0.0.1',
         apiServerPort: numberField(record, 'apiServerPort', 'api_server_port'),
@@ -471,6 +472,10 @@ async function upsertInstallationFromDetection(params) {
         });
         profileIdsByName.set(profile.name, profileRow.id);
     }
+    // Hermes is gone from this home: its remembered profiles must not keep counting as running gateways.
+    if (detection.status === 'not_installed') {
+        await db.hermesProfile.updateMany({ where: { installationId: installation.id }, data: { gatewayStatus: 'not_installed' } });
+    }
     if (detection.profiles.length > 0) {
         await db.hermesProfile.deleteMany({
             where: {

package/dist/services/orchestra-extras-service.js

@@ -31,7 +31,7 @@ export async function getOrchestraOverview() {
     const db = getDb();
     const [installations, profiles, jobs, recentJobs, skillAssignments, toolsetPolicies, roles, providerConfigs, credentialPools, mcpServers, messagingBindings, cronJobs, plugins, hooks,] = await Promise.all([
         db.hermesInstallation.findMany({ select: { status: true } }),
-        db.hermesProfile.count(),
+        db.hermesProfile.count({ where: { installation: { status: { not: 'not_installed' } } } }),
         db.hermesOperationJob.findMany({ select: { status: true } }),
         db.hermesOperationJob.findMany({
             orderBy: { startedAt: 'desc' },
@@ -53,7 +53,8 @@ export async function getOrchestraOverview() {
     const jobCount = (s) => jobs.filter((j) => j.status === s).length;
     return {
         installations: {
-            total: installations.length,
+            // A row kept for a host that no longer has Hermes is not an installation.
+            total: installations.filter((i) => i.status !== 'not_installed').length,
             running: installCount('running'),
             degraded: installCount('degraded'),
             error: installCount('error'),
@@ -138,7 +139,7 @@ export async function getOrchestraCapabilityInventory() {
         capabilities.push({
             key: `profile:${profile.id}:gateway`,
             label: `${profileLabel} gateway`,
-            state: profile.gatewayStatus === 'running' ? 'supported' : ['stopped', 'failed', 'error'].includes(profile.gatewayStatus) ? 'missing' : 'unknown',
+            state: profile.gatewayStatus === 'running' ? 'supported' : ['inactive', 'stopped', 'failed', 'error', 'not_installed'].includes(profile.gatewayStatus) ? 'missing' : 'unknown',
             detail: `gateway ${profile.gatewayStatus}`,
             installationId: profile.installationId,
             profileId: profile.id,

package/dist/services/resource-enrollment.js

@@ -163,10 +163,12 @@ export const PARTICIPANT_RECEIPT_LIMITS = { default: 16_384, scheduler: 256 * 10
 export class ParticipantEvidenceError extends Error {
     code;
     agentCode;
-    constructor(code, agentCode = null) {
+    agentReason;
+    constructor(code, agentCode = null, agentReason = null) {
         super(code);
         this.code = code;
         this.agentCode = agentCode;
+        this.agentReason = agentReason;
     }
 }
 const failures = new Map();
@@ -177,20 +179,24 @@ export function lastParticipantFailures(nodeId) {
 /** Bounded response consumption, including dishonest or absent content-length. */
 export async function readParticipantReceipt(response, limit = PARTICIPANT_RECEIPT_LIMITS.default) {
     if (response.status !== 200 || !response.body) {
-        // An optional machine-readable code from the participant (`{ error: { code } }`) is kept; nothing else is.
+        // An optional machine-readable code and fixed reason from the participant
+        // (`{ error: { code, reason } }`) are kept; nothing else is.
         let agentCode = null;
+        let agentReason = null;
         if (response.body && response.status >= 400) {
             const text = await response.text().catch(() => '');
             try {
-                const code = JSON.parse(text.slice(0, 4096))?.error?.code;
-                if (typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(code))
-                    agentCode = code;
+                const error = JSON.parse(text.slice(0, 4096))?.error;
+                if (typeof error?.code === 'string' && /^[A-Z][A-Z0-9_]{0,63}$/.test(error.code))
+                    agentCode = error.code;
+                if (typeof error?.reason === 'string' && /^[a-z][a-z0-9-]{0,47}$/.test(error.reason))
+                    agentReason = error.reason;
             }
             catch { /* no code */ }
         }
         else
             await response.body?.cancel().catch(() => undefined);
-        throw new ParticipantEvidenceError(`participant-http-${response.status}`, agentCode);
+        throw new ParticipantEvidenceError(`participant-http-${response.status}`, agentCode, agentReason);
     }
     const reader = response.body.getReader();
     const chunks = [];
@@ -280,8 +286,9 @@ export async function refreshEnrollmentParticipant(nodeId, participant) {
         // Outstanding challenge remains pending.
         const cause = error instanceof ParticipantEvidenceError ? error.code : 'participant-evidence-unavailable';
         const agentCode = error instanceof ParticipantEvidenceError ? error.agentCode : null;
-        failures.set(`${nodeId}\n${participant}`, { participant, cause, agentCode, at: new Date().toISOString() });
-        return { participant, status: 'pending', reason: 'participant-evidence-unavailable', cause, agentCode };
+        const agentReason = error instanceof ParticipantEvidenceError ? error.agentReason : null;
+        failures.set(`${nodeId}\n${participant}`, { participant, cause, agentCode, agentReason, at: new Date().toISOString() });
+        return { participant, status: 'pending', reason: 'participant-evidence-unavailable', cause, agentCode, agentReason };
     }
     failures.delete(`${nodeId}\n${participant}`);
     return getDb().$transaction(async (tx) => {

package/dist/services/update-check-service.js

@@ -53,7 +53,7 @@ export async function checkForUpdate(options = {}) {
     const current = options.current ?? CONTROL_API_VERSION;
     if (!settings.updateCheck)
         return { ...emptyResult(false), current };
-    const url = `${settings.updateRegistry}/${META_PACKAGE.replace('/', '%2f')}`;
+    const url = `${settings.updateRegistry}/@${encodeURIComponent(META_PACKAGE.slice(1))}`;
     const checkedAt = (options.now ?? (() => new Date()))().toISOString();
     try {
         const response = await (options.fetchImpl ?? fetch)(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(15_000) });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hivemagnus/magnus-server",
-  "version": "1.1.4",
+  "version": "1.1.7",
   "description": "Magnus server: the fleet control plane API (Hono, PostgreSQL, Redis) for nodes running magnus-agent, with optional Hive IAM, Hive Router, HiveMem, Hermes Agent and external security console integrations.",
   "keywords": [
     "magnus",
@@ -84,7 +84,7 @@
     "prepublishOnly": "npm run db:generate && npm run clean && npm run build"
   },
   "dependencies": {
-    "@hivemagnus/magnus-contracts": "1.1.4",
+    "@hivemagnus/magnus-contracts": "1.1.7",
     "@hono/node-server": "^2.1.5",
     "@hono/swagger-ui": "^0.6.2",
     "@prisma/adapter-pg": "7.10.1",
@@ -102,7 +102,7 @@
     "ws": "^8.22.0",
     "yaml": "2.9.1",
     "zod": "^4.6.7",
-    "@hivemagnus/magnus-skills": "1.1.4",
+    "@hivemagnus/magnus-skills": "1.1.7",
     "prisma": "^7.10.1"
   },
   "devDependencies": {