magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS9017: token store predates grants

The token store found a token written by an older magus: a file under the retired $XDG_STATE_HOME/magus/connectors.d (or connectors.json), or a version 1 record in tokens.d. A retired directory stops listing, minting and revoking with this error until its files are gone, and its tokens do not verify. A version 1 record inside tokens.d is one bad file: it is skipped with this code, and every other token keeps working, as MGS9019 describes.

[MGS9017] auth: 1 token file(s) predate grants and are refused:
/path/connectors.d/obsidian.json; remove each (`rm <file>`) and mint its
replacement with `magus config mcp connector create --name <name>` or
`magus config console token create --name <name>`
  see: .../MGS9017.md

Why

An old record says which surface a token reached, not what it may do, and there is no record of who minted it to check a translated grant against. Magus re-mints rather than guesses. The operator token is unaffected: it never opens the store.

Resolution

For each file the message names, note the token's name, remove the file, and mint a replacement of the same kind:

rm <file>
magus config mcp connector create --name <name>      # an MCP client
magus config console token create --name <name>      # a browser

Give each client its new token. A token the old record described no longer authenticates.

See also

MGS9017authconnectorconsoletokenstoreupgrade
Last updated (f0d4ffc9)
Glossary

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Affected

The set of projects touched by a change; magus affected <target> runs a target only over them. See affected.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.