@topy-ai/maggie 0.6.4 → 0.6.6

package/README.md

@@ -157,8 +157,8 @@ only and never stores response bodies, cookies, or credentials.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.6.4 update --project . --force
-npx @topy-ai/maggie@0.6.4 cleanup --project .
+npx @topy-ai/maggie@0.6.6 update --project . --force
+npx @topy-ai/maggie@0.6.6 cleanup --project .
 ```
 
 ## MaggieDash lifecycle

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.6.4 init --agent all
+npx @topy-ai/maggie@0.6.6 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 

package/bundled-skills/maggie-content-localization/SKILL.md

@@ -2,11 +2,17 @@
 name: maggie-content-localization
 description: Manage translation, polish, rewrite, market localization, review, stale detection, and publishing for pages, guides, posts, services, products, and categories.
 metadata:
-  version: 1.0.0
+  version: 1.1.0
 ---
 
 # Maggie Content Localization
 
+Localization job filenames are derived from content identity, but content IDs
+are data, not paths. The CLI sanitizes separators and adds a short identity
+hash when needed, so IDs such as `site.example/static-pages` always produce a
+single addressable file under `.maggie/localization/`. Never construct a job
+path by interpolating an unsanitized content ID.
+
 Use the shared [Content Localization Contract](../../references/content-localization-contract.md).
 Use the shared [memory hook](../../references/memory-hook.md) to read prior
 locale preferences and record confirmed terminology or translation failures.
@@ -53,3 +59,9 @@ Never change price, currency, rating, provider facts, booking URLs, legal or
 health claims, slug, canonical ownership, or content identity during a copy
 operation without structured approval. Incomplete or fallback output must be
 `isIndexable: false`. High-risk content requires Admin approval before publish.
+
+The current validator checks the localization record. It does not yet extract
+strings from a host project or prove browser-rendered language output. That
+larger capability is specified in
+[`docs/localization-extraction-render-prd.md`](../../docs/localization-extraction-render-prd.md)
+and remains a separate release-gated feature.

package/bundled-tools/clis/maggie_localization.py

@@ -4,7 +4,9 @@
 from __future__ import annotations
 
 import argparse
+import hashlib
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from pathlib import Path
@@ -24,6 +26,14 @@ def load(path: Path) -> dict:
     return value
 
 
+def safe_job_content_token(content_id: str) -> str:
+    """Make a content identity safe for a single filename component."""
+    token = re.sub(r"[^A-Za-z0-9._-]+", "-", str(content_id)).strip(".-_") or "content"
+    if token != content_id:
+        token = f"{token}-{hashlib.sha256(str(content_id).encode('utf-8')).hexdigest()[:8]}"
+    return token[:180]
+
+
 def plan_job(args: argparse.Namespace) -> int:
     content = load(args.content)
     if args.source_lang not in LANGUAGES or args.target_lang not in LANGUAGES:
@@ -39,7 +49,7 @@ def plan_job(args: argparse.Namespace) -> int:
     if not content_id:
         raise ValueError("contentId is required in content identity")
     job = {
-        "jobId": f"localize-{content_id}-{args.target_lang.lower()}-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}",
+        "jobId": f"localize-{safe_job_content_token(content_id)}-{args.target_lang.lower()}-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}",
         "content": content,
         "contentId": content_id,
         "contentType": identity.get("contentType", "page"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",